@paydock/client-sdk 1.145.0-beta → 1.148.0-beta

package/docs/api-canvas3ds.md

@@ -29,6 +29,7 @@ Class Canvas3ds include method for working on html
     * [.load()](#Canvas3ds+load)
     * [.setEnv(env, [alias])](#Canvas3ds+setEnv)
     * [.on(eventName, cb)](#Canvas3ds+on) ⇒
+    * [.authenticate()](#Canvas3ds+authenticate)
     * [.hide([saveSize])](#Canvas3ds+hide)
     * [.show()](#Canvas3ds+show)
     * [.reload()](#Canvas3ds+reload)
@@ -98,6 +99,35 @@ widget.on('chargeAuthReject').then((data) => {
   console.log(data);
 });
 ```
+<a name="Canvas3ds+authenticate" id="Canvas3ds+authenticate" href="#Canvas3ds+authenticate">&nbsp;</a>
+
+### canvas3ds.authenticate()
+Two-step mode only (`_3ds.authentication_flow: 'two_step'`): runs the authentication the API deferred after the
+fingerprint. Call it when the shopper confirms (e.g. presses "Pay"); the outcome arrives through the
+usual events (`chargeAuthChallenge`, `chargeAuthSuccess`, `chargeAuthReject`, `error`).
+
+Never throws. After `chargeAuthReady` the authentication starts at once; before it, the call is
+remembered and runs as soon as the fingerprint completes. One-step charges, repeated calls and calls after
+a terminal outcome are no-ops. For inbuilt 3DS (`html` / `url`) tokens it is a silent no-op: no event is
+emitted at all, so do not wait for `error` there. Calling it before `load()` is an integration error: it emits `error` and
+is not remembered. If `/process` could not be reached (`error` with `error_code` `service_unreachable` /
+`aborted`), `authenticate()` may be called once more; any other `error`, and any failure of that retry,
+is final.
+No client-side deadline: a stale 3DS Server session surfaces as `error` / `chargeAuthReject`.
+
+**Kind**: instance method of [<code>Canvas3ds</code>](#Canvas3ds)  
+**Example**  
+```js
+const widget = new Canvas3ds('#widget', token); // charge created with _3ds.authentication_flow: 'two_step'
+widget.on('chargeAuthReady', () => payButton.disabled = false);
+widget.on('chargeAuthChallenge', () => showChallengeModal());
+widget.on('chargeAuthSuccess', (data) => completePayment(data.charge_3ds_id));
+widget.on('chargeAuthReject', () => showDeclined());
+widget.on('error', () => showError());
+widget.load(); // fingerprint runs while the shopper reviews the order
+
+payButton.addEventListener('click', () => widget.authenticate());
+```
 <a name="Canvas3ds+hide" id="Canvas3ds+hide" href="#Canvas3ds+hide">&nbsp;</a>
 
 ### canvas3ds.hide([saveSize])
@@ -154,12 +184,15 @@ List of available event's name for Standalone 3ds flow
 
 **Kind**: global constant  
 
-| Param | Type | Default |
-| --- | --- | --- |
-| CHARGE_AUTH_SUCCESS | <code>string</code> | <code>&quot;chargeAuthSuccess&quot;</code> | 
-| CHARGE_AUTH_REJECT | <code>string</code> | <code>&quot;chargeAuthReject&quot;</code> | 
-| CHARGE_AUTH_DECOUPLED | <code>string</code> | <code>&quot;chargeAuthDecoupled&quot;</code> | 
-| CHARGE_AUTH_CHALLENGE | <code>string</code> | <code>&quot;chargeAuthChallenge&quot;</code> | 
-| CHARGE_AUTH_INFO | <code>string</code> | <code>&quot;chargeAuthInfo&quot;</code> | 
-| ERROR | <code>string</code> | <code>&quot;error&quot;</code> | 
+| Param | Type | Default | Description |
+| --- | --- | --- | --- |
+| AUTH_SUCCESS | <code>string</code> | <code>&quot;chargeAuthSuccess&quot;</code> |  |
+| AUTH_ERROR | <code>string</code> | <code>&quot;chargeAuthReject&quot;</code> |  |
+| DECOUPLED | <code>string</code> | <code>&quot;chargeAuthDecoupled&quot;</code> |  |
+| CHALLENGE | <code>string</code> | <code>&quot;chargeAuthChallenge&quot;</code> |  |
+| READY | <code>string</code> | <code>&quot;chargeAuthReady&quot;</code> | two-step mode only: fingerprint done, waiting for `authenticate()` |
+| CHALLENGE_LOADED | <code>string</code> | <code>&quot;chargeAuthChallengeLoaded&quot;</code> | challenge iframe painted (first `load`, or 2.5 s fallback); reveal your challenge UI here |
+| CHALLENGE_COMPLETED | <code>string</code> | <code>&quot;chargeAuthChallengeCompleted&quot;</code> | the shopper finished the challenge (issuer result delivered to the 3DS Server); cover the challenge iframe with your own loader until the terminal event |
+| INFO | <code>string</code> | <code>&quot;chargeAuthInfo&quot;</code> |  |
+| ERROR | <code>string</code> | <code>&quot;error&quot;</code> |  |
 

package/docs/api-checkout-button.md

@@ -23,6 +23,12 @@
 <dl>
 <dt><a href="#user-content-cb_CHECKOUT_BUTTON_EVENT">CHECKOUT_BUTTON_EVENT</a> : <code>object</code></dt>
 <dd></dd>
+<dt><a href="#user-content-cb_CARD_SCHEME">CARD_SCHEME</a></dt>
+<dd><p>Card schemes the widget is able to resolve from a card number, and therefore the only values
+<code>setAllowedCardSchemes</code> accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+card icons: it omits the icon-only variants <code>visa_white</code> / <code>eftpos_white</code>, and the <code>laser</code> / <code>maestro</code>
+identifiers the widget can never resolve — allowing those would be configuration that can never match.</p>
+</dd>
 </dl>
 
 ## Typedefs
@@ -556,6 +562,15 @@ button.turnOffBackdrop();
 | FINISH | <code>string</code> | <code>&quot;finish&quot;</code> | 
 | CLOSE | <code>string</code> | <code>&quot;close&quot;</code> | 
 
+<a name="cb_CARD_SCHEME" id="cb_CARD_SCHEME" href="#user-content-cb_CARD_SCHEME">&nbsp;</a>
+
+## CARD\_SCHEME
+Card schemes the widget is able to resolve from a card number, and therefore the only values
+`setAllowedCardSchemes` accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+card icons: it omits the icon-only variants `visa_white` / `eftpos_white`, and the `laser` / `maestro`
+identifiers the widget can never resolve — allowing those would be configuration that can never match.
+
+**Kind**: global constant  
 <a name="cb_listener" id="cb_listener" href="#user-content-cb_listener">&nbsp;</a>
 
 ## listener : <code>function</code>

package/docs/api-ps-widget.md

@@ -21,6 +21,12 @@
 <dt><a href="#user-content-psw_PAYMENT_SOURCE_TYPE">PAYMENT_SOURCE_TYPE</a> : <code>object</code></dt>
 <dd><p>List of available payment source types</p>
 </dd>
+<dt><a href="#user-content-psw_CARD_SCHEME">CARD_SCHEME</a></dt>
+<dd><p>Card schemes the widget is able to resolve from a card number, and therefore the only values
+<code>setAllowedCardSchemes</code> accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+card icons: it omits the icon-only variants <code>visa_white</code> / <code>eftpos_white</code>, and the <code>laser</code> / <code>maestro</code>
+identifiers the widget can never resolve — allowing those would be configuration that can never match.</p>
+</dd>
 </dl>
 
 ## Typedefs
@@ -572,6 +578,15 @@ List of available payment source types
 | BANK_ACCOUNT | <code>string</code> | <code>&quot;bank_account&quot;</code> | 
 | CHECKOUT | <code>string</code> | <code>&quot;checkout&quot;</code> | 
 
+<a name="psw_CARD_SCHEME" id="psw_CARD_SCHEME" href="#user-content-psw_CARD_SCHEME">&nbsp;</a>
+
+## CARD\_SCHEME
+Card schemes the widget is able to resolve from a card number, and therefore the only values
+`setAllowedCardSchemes` accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+card icons: it omits the icon-only variants `visa_white` / `eftpos_white`, and the `laser` / `maestro`
+identifiers the widget can never resolve — allowing those would be configuration that can never match.
+
+**Kind**: global constant  
 <a name="psw_listener--PaymentSourceWidget" id="psw_listener--PaymentSourceWidget" href="#user-content-psw_listener--PaymentSourceWidget">&nbsp;</a>
 
 ## listener--PaymentSourceWidget : <code>function</code>

package/docs/api-widget.md

@@ -28,6 +28,12 @@
 <dt><a href="#user-content-w_GENERIC_VALIDATORS">GENERIC_VALIDATORS</a> : <code>Record.&lt;string, string&gt;</code></dt>
 <dd><p>List of available generic form field validators and their definition</p>
 </dd>
+<dt><a href="#user-content-w_CARD_SCHEME">CARD_SCHEME</a></dt>
+<dd><p>Card schemes the widget is able to resolve from a card number, and therefore the only values
+<code>setAllowedCardSchemes</code> accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+card icons: it omits the icon-only variants <code>visa_white</code> / <code>eftpos_white</code>, and the <code>laser</code> / <code>maestro</code>
+identifiers the widget can never resolve — allowing those would be configuration that can never match.</p>
+</dd>
 <dt><a href="#user-content-w_TRIGGER">TRIGGER</a> : <code>object</code></dt>
 <dd><p>List of available triggers</p>
 </dd>
@@ -414,6 +420,15 @@ List of available generic form field validators and their definition
 | --- | --- | --- | --- |
 | REQUIRED | <code>string</code> | <code>&quot;required&quot;</code> | Asserts the input or form field has a value defined truthy value |
 
+<a name="w_CARD_SCHEME" id="w_CARD_SCHEME" href="#user-content-w_CARD_SCHEME">&nbsp;</a>
+
+## CARD\_SCHEME
+Card schemes the widget is able to resolve from a card number, and therefore the only values
+`setAllowedCardSchemes` accepts. This is a separate vocabulary from SUPPORTED_CARD_TYPES, which drives the
+card icons: it omits the icon-only variants `visa_white` / `eftpos_white`, and the `laser` / `maestro`
+identifiers the widget can never resolve — allowing those would be configuration that can never match.
+
+**Kind**: global constant  
 <a name="w_TRIGGER" id="w_TRIGGER" href="#user-content-w_TRIGGER">&nbsp;</a>
 
 ## TRIGGER : <code>object</code>

package/docs/canvas3ds-examples.md

@@ -181,7 +181,13 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
                 console.log(data);
             });
             canvas3ds.on("chargeAuthChallenge", function (data) {
-                console.log(data);
+                console.log(data); // keep your loader up — the challenge page is still loading
+            });
+            canvas3ds.on("chargeAuthChallengeLoaded", function (data) {
+                console.log(data.reason); // 'load' | 'timeout' — hide your loader, the challenge is visible
+            });
+            canvas3ds.on("chargeAuthChallengeCompleted", function (data) {
+                console.log(data.source); // 'poll' | 'callback' — shopper finished, cover the challenge with "Completing verification"
             });
             canvas3ds.on("chargeAuthDecoupled", function (data) {
                 console.log(data.result.description);
@@ -204,10 +210,26 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
   - A `data.status` of `rejected` will be received when the authorization was rejected.
   - A `data.status` of `invalid_event` will be received for unhandled situations.
 - The `chargeAuthChallenge` event is sent before starting a challenge flow (i.e. opening an IFrame for the customer to complete a challenge with ther bank). Once the end customer performs the challenge, the Canvas3ds will be able to identify the challenge result and will either produce a `chargeAuthSuccess` or `chargeAuthReject` event.
+- The `chargeAuthChallengeLoaded` event (SDK **v1.147.0+**) is sent once per challenge, after `chargeAuthChallenge`, when the challenge IFrame has finished loading the bank's page (its first `load` event) — this is the moment the customer can actually see the challenge. `data.reason` is `load` for a real load, or `timeout` when no load was observed within 2.5 seconds: the event is emitted anyway so you never hold a loading indicator forever (a `load` arriving later is simply ignored). Hide your loader on this event either way; `data.reason` is only informational (e.g. analytics). Not sent for decoupled challenges (no challenge IFrame).
+- The `chargeAuthChallengeCompleted` event (SDK **v1.147.0+**) is sent once the customer has finished the challenge (or approved a decoupled authentication): the bank has delivered the final result to the 3DS server and the Canvas3ds is now obtaining the outcome. Whatever the bank or the 3DS server render inside the IFrame from here on is plumbing, not UX — cover the IFrame with your own "Completing verification" state and hold it until the terminal event. `data.source` tells you how the SDK learned about it: `poll` (the 3DS server's result monitor — the usual case, it flips before the IFrame has even left the bank's page) or `callback` (the callback message carrying the outcome arrived first; the terminal event follows immediately) — handle both the same way. Sent at most once per authentication, always before `chargeAuthSuccess` / `chargeAuthReject` / `error` and never after them. A wrong OTP or a further interactive step (e.g. a second OTP screen) does **not** send it — no result has been delivered yet — so no grace timer or reveal fallback is needed on your side. Also sent for decoupled challenges.
 - The `chargeAuthDecoupled` event is sent when the flow is a decoupled challenge, alongside a `data.result.description` field that you must show to the customer, indicating the method the user must use to authenticate. For example this may happen by having the cardholder authenticating directly with their banking app through biometrics. Once the end customer does this, the Canvas3ds will be able to recognize the challenge result is ready and will either produce a `chargeAuthSuccess` or `chargeAuthReject` event.
 - The `error` event is sent if an unexpected issue with the client library occurs. In such scenarios, you should consider the autentication process as interrupted:
   - When getting this event, you will get on `data.error` the full error object.
 
+### Recommended loading indicator pattern
+
+> Requires SDK **v1.147.0 or later** (`chargeAuthChallengeLoaded` / `chargeAuthChallengeCompleted`). On older versions the same effect needs a `MutationObserver` on the container plus `load` listeners on the challenge IFrame — see the Standalone 3DS UX guide in the playground for that legacy approach.
+
+The Canvas3ds renders nothing visible until a challenge is presented, and `chargeAuthChallenge` fires when the API responds — about 1–2 seconds before the bank's page actually paints inside the IFrame. Drive a single loading indicator from the events:
+
+1. Show the loader **before** you `POST /v1/charges/standalone-3ds` and keep it up through `canvas3ds.load()` (fingerprinting and processing are invisible).
+2. Keep it up on `chargeAuthChallenge` — the challenge IFrame is being injected but is still blank.
+3. Hide it on `chargeAuthChallengeLoaded` — the challenge is visible. `data.reason` tells you whether it was a real paint (`load`) or the 2.5 s safety fallback (`timeout`); either way, no further handling is needed.
+4. Cover the IFrame with a "Completing verification" indicator on `chargeAuthChallengeCompleted` — the customer finished the challenge and the SDK is obtaining the outcome — and hold it until the terminal event. No grace timer or reveal fallback is needed: a wrong OTP or a second interactive step does not fire this event.
+5. Finish on `chargeAuthSuccess` / `chargeAuthReject` / `error`.
+
+Decoupled challenges (`chargeAuthDecoupled`) never emit `chargeAuthChallengeLoaded` (there is no challenge IFrame) but do emit `chargeAuthChallengeCompleted` once the customer approved out-of-band: show a dedicated waiting state with `data.result.description` until then, and "Completing verification" until the terminal event. Frictionless flows go straight from `load()` to the terminal event.
+
 ### Events and Values
 
 | Event Value         | Type                | Description                                                    |
@@ -215,6 +237,8 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
 | <code>chargeAuthSuccess</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>chargeAuthReject</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>chargeAuthChallenge</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
+| <code>chargeAuthChallengeLoaded</code> | <code>object</code> | Instance of [ChallengeLoadedResponse](#cb_challengeLoadedResponse) |
+| <code>chargeAuthChallengeCompleted</code> | <code>object</code> | Instance of [ChallengeCompletedResponse](#cb_challengeCompletedResponse) |
 | <code>chargeAuthDecoupled</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>chargeAuthInfo</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>error</code> | <code>object</code> | Instance of [chargeError](#cb_chargeError) |
@@ -232,6 +256,24 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
 | <code>info</code> | <code>string</code> | info field for `chargeAuthInfo` event |
 | <code>result.description</code> | <code>string</code> [Optional] | field that you must show to the customer, indicating the method the user must use to authenticate during the decoupled challenge flow. |
 
+<a name="cb_challengeLoadedResponse" id="cb_challengeLoadedResponse"></a>
+
+### ChallengeLoadedResponse
+
+| Param                           | Type                           | Description                                                                                        |
+| ------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------- |
+| <code>charge_3ds_id</code> | <code>string</code> | Universal unique transaction identifier to identify the transaction |
+| <code>reason</code> | <code>string</code> | `load` — the challenge IFrame fired its first load event; `timeout` — no load within 2.5 s, emitted so a loader is never held forever (a later load is ignored) |
+
+<a name="cb_challengeCompletedResponse" id="cb_challengeCompletedResponse"></a>
+
+### ChallengeCompletedResponse
+
+| Param                           | Type                           | Description                                                                                        |
+| ------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------- |
+| <code>charge_3ds_id</code> | <code>string</code> | Universal unique transaction identifier to identify the transaction |
+| <code>source</code> | <code>string</code> | `poll` — the 3DS server's result monitor reported that the bank delivered the result (the usual case); `callback` — the callback message carrying the outcome arrived first (the terminal event follows immediately). Informational only — handle both the same way |
+
 ### ChargeError
 
 <a name="cb_chargeError" id="cb_chargeError"></a>

package/docs/widget-examples.md

@@ -94,8 +94,48 @@ widget.setRefId('id'); // your unique identifier to identify the data
 widget.setFormFields(['phone', 'email']); // add additional fields for form of widget
 
 widget.setSupportedCardIcons(['mastercard', 'visa']); // add icons of supported card types
+
+widget.setAllowedCardSchemes(['mastercard', 'visa']); // restrict which card schemes the card number field accepts
+```
+
+### Restricting accepted card schemes
+
+`setAllowedCardSchemes(schemes)` restricts which card schemes the card number field accepts, **without** changing
+which card icons the widget displays. Call it before `load()`.
+
+```javascript
+widget.setAllowedCardSchemes(['visa', 'mastercard']);
 ```
 
+Accepted identifiers — the schemes the widget can resolve from a card number:
+
+`amex`, `ausbc`, `diners`, `discover`, `eftpos`, `japcb`, `mastercard`, `solo`, `unionpay`, `visa`
+
+Behaviour:
+
+- **Not called, or an empty array** — every scheme is accepted. Existing integrations are unaffected.
+- **Case-insensitive**, and surrounding whitespace is ignored: `' Visa '` and `'MASTERCARD'` both work. Note that
+  `setSupportedCardIcons` matches case-**sensitively**; the two methods differ here.
+- **Unsupported identifiers are ignored with a `console.warn`** naming the value, and never throw. A list in which
+  every identifier is unsupported therefore applies **no restriction at all** — check the console if a restriction
+  seems to have no effect. The icon-only values `visa_white` and `eftpos_white` are not schemes and are rejected,
+  as are `laser` and `maestro`, which the widget can never resolve from a card number.
+- **Takes precedence over `setSupportedCardIcons`.** When a non-empty list is supplied here, it is the only list
+  used for validation, and the second argument of `setSupportedCardIcons` no longer affects validation. Icons keep
+  coming from `setSupportedCardIcons`, so a scheme can legitimately be shown as an icon and still be rejected —
+  make sure that is what you intend:
+
+  ```javascript
+  widget.setSupportedCardIcons(['visa', 'mastercard', 'amex'], true);
+  widget.setAllowedCardSchemes(['visa', 'mastercard']);
+  // three icons are displayed; an Amex card is rejected
+  ```
+
+- **Calling it again replaces the previous list** rather than merging with it.
+- A card of a rejected scheme shows `Card type not accepted.` on the card number field, the submit button is
+  disabled, and the submit handler refuses the card even if the button is re-enabled outside the widget. The same
+  message is shown for a card whose scheme cannot be resolved at all.
+
 This example shows how you can use a lot of other methods to settings your form
 
 ### Error handling
@@ -255,6 +295,7 @@ When handling errors, consider:
  var widget = new paydock.HtmlWidget('#widget', 'publicKey', 'gatewayId');
 
  widget.setSupportedCardIcons(['mastercard', 'visa']);
+ widget.setAllowedCardSchemes(['mastercard', 'visa']);
  widget.setFormFields(['phone', 'email']);
  widget.setRefId('custom-ref-id');
     widget.onFinishInsert('input[name="payment_source_token"]', 'payment_source');

package/package.json

@@ -104,7 +104,7 @@
     }
   },
   "name": "@paydock/client-sdk",
-  "version": "1.145.0-beta",
+  "version": "1.148.0-beta",
   "scripts": {
     "build:doc": "node docs/html/marked.js",
     "build:js": "rollup --config rollup.config.ts --configPlugin @rollup/plugin-typescript",
@@ -180,7 +180,6 @@
     "buffer": "5.7.1",
     "cross-fetch": "4.1.0",
     "dotenv": "16.4.5",
-    "fs": "0.0.2",
     "grunt": "1.6.1",
     "grunt-cli": "1.4.3",
     "grunt-jsdoc-to-markdown": "6.0.0",
@@ -214,38 +213,48 @@
     "tsify": "3.0.4",
     "tslib": "2.6.2",
     "typescript": "5.4.5",
-    "vitest": "3.2.6",
+    "vitest": "4.1.11",
     "zod": "3.23.8"
   },
   "overrides": {
     "sha.js@>=2.0.0 <=2.4.11": "2.4.12",
     "pbkdf2": ">=3.1.3",
     "form-data": ">=4.0.6",
-    "qs": ">=6.15.2",
-    "js-yaml": ">=4.2.0",
+    "qs": "6.16.0",
+    "js-yaml": "4.3.2",
+    "fflate@0.4": "0.4.9",
+    "fflate@0.7": "0.7.5",
     "@babel/plugin-transform-modules-systemjs": ">=7.29.4",
-    "fast-uri": ">=3.1.2",
+    "fast-uri": "3.1.7",
     "tmp": ">=0.2.6",
     "ws": ">=8.20.1",
     "minimatch@^3": "3.1.5",
     "minimatch@^5": "5.1.9",
     "minimatch@^9": "9.0.9",
     "@isaacs/brace-expansion": ">=5.0.1",
+    "brace-expansion@1": "1.1.21",
+    "brace-expansion@2": "2.1.7",
+    "postcss": "8.5.23",
     "bn.js": ">=5.2.3",
     "ajv": "8.18.0",
     "serialize-javascript": ">=7.0.3",
     "underscore": ">=1.13.8",
-    "dompurify": "3.4.11",
-    "immutable": ">=5.1.5",
+    "dompurify": "3.4.13",
+    "immutable": "5.1.8",
     "flatted": ">=3.4.2",
     "node-forge": ">=1.4.0",
     "picomatch": ">=2.3.2",
-    "socket.io-parser": ">=4.2.6",
+    "socket.io-parser": "4.2.7",
+    "engine.io": "6.6.11",
     "lodash": ">=4.18.0",
     "vite": ">=6.4.2 <7",
     "follow-redirects": ">=1.16.0",
-    "shell-quote": ">=1.8.4",
-    "esbuild": ">=0.28.1"
+    "shell-quote": "1.9.0",
+    "esbuild": ">=0.28.1",
+    "linkify-it": "5.0.2",
+    "body-parser": "1.20.6",
+    "nanoid": "3.3.18",
+    "markdown-it": "14.2.0"
   },
   "engines": {
     "node": ">=16.0.0"

package/slate.md

@@ -194,8 +194,48 @@ widget.setRefId('id'); // your unique identifier to identify the data
 widget.setFormFields(['phone', 'email']); // add additional fields for form of widget
 
 widget.setSupportedCardIcons(['mastercard', 'visa']); // add icons of supported card types
+
+widget.setAllowedCardSchemes(['mastercard', 'visa']); // restrict which card schemes the card number field accepts
+```
+
+### Restricting accepted card schemes
+
+`setAllowedCardSchemes(schemes)` restricts which card schemes the card number field accepts, **without** changing
+which card icons the widget displays. Call it before `load()`.
+
+```javascript
+widget.setAllowedCardSchemes(['visa', 'mastercard']);
 ```
 
+Accepted identifiers — the schemes the widget can resolve from a card number:
+
+`amex`, `ausbc`, `diners`, `discover`, `eftpos`, `japcb`, `mastercard`, `solo`, `unionpay`, `visa`
+
+Behaviour:
+
+- **Not called, or an empty array** — every scheme is accepted. Existing integrations are unaffected.
+- **Case-insensitive**, and surrounding whitespace is ignored: `' Visa '` and `'MASTERCARD'` both work. Note that
+  `setSupportedCardIcons` matches case-**sensitively**; the two methods differ here.
+- **Unsupported identifiers are ignored with a `console.warn`** naming the value, and never throw. A list in which
+  every identifier is unsupported therefore applies **no restriction at all** — check the console if a restriction
+  seems to have no effect. The icon-only values `visa_white` and `eftpos_white` are not schemes and are rejected,
+  as are `laser` and `maestro`, which the widget can never resolve from a card number.
+- **Takes precedence over `setSupportedCardIcons`.** When a non-empty list is supplied here, it is the only list
+  used for validation, and the second argument of `setSupportedCardIcons` no longer affects validation. Icons keep
+  coming from `setSupportedCardIcons`, so a scheme can legitimately be shown as an icon and still be rejected —
+  make sure that is what you intend:
+
+  ```javascript
+  widget.setSupportedCardIcons(['visa', 'mastercard', 'amex'], true);
+  widget.setAllowedCardSchemes(['visa', 'mastercard']);
+  // three icons are displayed; an Amex card is rejected
+  ```
+
+- **Calling it again replaces the previous list** rather than merging with it.
+- A card of a rejected scheme shows `Card type not accepted.` on the card number field, the submit button is
+  disabled, and the submit handler refuses the card even if the button is re-enabled outside the widget. The same
+  message is shown for a card whose scheme cannot be resolved at all.
+
 This example shows how you can use a lot of other methods to settings your form
 
 ### Error handling
@@ -355,6 +395,7 @@ When handling errors, consider:
  var widget = new paydock.HtmlWidget('#widget', 'publicKey', 'gatewayId');
 
  widget.setSupportedCardIcons(['mastercard', 'visa']);
+ widget.setAllowedCardSchemes(['mastercard', 'visa']);
  widget.setFormFields(['phone', 'email']);
  widget.setRefId('custom-ref-id');
     widget.onFinishInsert('input[name="payment_source_token"]', 'payment_source');
@@ -743,7 +784,13 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
                 console.log(data);
             });
             canvas3ds.on("chargeAuthChallenge", function (data) {
-                console.log(data);
+                console.log(data); // keep your loader up — the challenge page is still loading
+            });
+            canvas3ds.on("chargeAuthChallengeLoaded", function (data) {
+                console.log(data.reason); // 'load' | 'timeout' — hide your loader, the challenge is visible
+            });
+            canvas3ds.on("chargeAuthChallengeCompleted", function (data) {
+                console.log(data.source); // 'poll' | 'callback' — shopper finished, cover the challenge with "Completing verification"
             });
             canvas3ds.on("chargeAuthDecoupled", function (data) {
                 console.log(data.result.description);
@@ -766,10 +813,26 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
   - A `data.status` of `rejected` will be received when the authorization was rejected.
   - A `data.status` of `invalid_event` will be received for unhandled situations.
 - The `chargeAuthChallenge` event is sent before starting a challenge flow (i.e. opening an IFrame for the customer to complete a challenge with ther bank). Once the end customer performs the challenge, the Canvas3ds will be able to identify the challenge result and will either produce a `chargeAuthSuccess` or `chargeAuthReject` event.
+- The `chargeAuthChallengeLoaded` event (SDK **v1.147.0+**) is sent once per challenge, after `chargeAuthChallenge`, when the challenge IFrame has finished loading the bank's page (its first `load` event) — this is the moment the customer can actually see the challenge. `data.reason` is `load` for a real load, or `timeout` when no load was observed within 2.5 seconds: the event is emitted anyway so you never hold a loading indicator forever (a `load` arriving later is simply ignored). Hide your loader on this event either way; `data.reason` is only informational (e.g. analytics). Not sent for decoupled challenges (no challenge IFrame).
+- The `chargeAuthChallengeCompleted` event (SDK **v1.147.0+**) is sent once the customer has finished the challenge (or approved a decoupled authentication): the bank has delivered the final result to the 3DS server and the Canvas3ds is now obtaining the outcome. Whatever the bank or the 3DS server render inside the IFrame from here on is plumbing, not UX — cover the IFrame with your own "Completing verification" state and hold it until the terminal event. `data.source` tells you how the SDK learned about it: `poll` (the 3DS server's result monitor — the usual case, it flips before the IFrame has even left the bank's page) or `callback` (the callback message carrying the outcome arrived first; the terminal event follows immediately) — handle both the same way. Sent at most once per authentication, always before `chargeAuthSuccess` / `chargeAuthReject` / `error` and never after them. A wrong OTP or a further interactive step (e.g. a second OTP screen) does **not** send it — no result has been delivered yet — so no grace timer or reveal fallback is needed on your side. Also sent for decoupled challenges.
 - The `chargeAuthDecoupled` event is sent when the flow is a decoupled challenge, alongside a `data.result.description` field that you must show to the customer, indicating the method the user must use to authenticate. For example this may happen by having the cardholder authenticating directly with their banking app through biometrics. Once the end customer does this, the Canvas3ds will be able to recognize the challenge result is ready and will either produce a `chargeAuthSuccess` or `chargeAuthReject` event.
 - The `error` event is sent if an unexpected issue with the client library occurs. In such scenarios, you should consider the autentication process as interrupted:
   - When getting this event, you will get on `data.error` the full error object.
 
+### Recommended loading indicator pattern
+
+> Requires SDK **v1.147.0 or later** (`chargeAuthChallengeLoaded` / `chargeAuthChallengeCompleted`). On older versions the same effect needs a `MutationObserver` on the container plus `load` listeners on the challenge IFrame — see the Standalone 3DS UX guide in the playground for that legacy approach.
+
+The Canvas3ds renders nothing visible until a challenge is presented, and `chargeAuthChallenge` fires when the API responds — about 1–2 seconds before the bank's page actually paints inside the IFrame. Drive a single loading indicator from the events:
+
+1. Show the loader **before** you `POST /v1/charges/standalone-3ds` and keep it up through `canvas3ds.load()` (fingerprinting and processing are invisible).
+2. Keep it up on `chargeAuthChallenge` — the challenge IFrame is being injected but is still blank.
+3. Hide it on `chargeAuthChallengeLoaded` — the challenge is visible. `data.reason` tells you whether it was a real paint (`load`) or the 2.5 s safety fallback (`timeout`); either way, no further handling is needed.
+4. Cover the IFrame with a "Completing verification" indicator on `chargeAuthChallengeCompleted` — the customer finished the challenge and the SDK is obtaining the outcome — and hold it until the terminal event. No grace timer or reveal fallback is needed: a wrong OTP or a second interactive step does not fire this event.
+5. Finish on `chargeAuthSuccess` / `chargeAuthReject` / `error`.
+
+Decoupled challenges (`chargeAuthDecoupled`) never emit `chargeAuthChallengeLoaded` (there is no challenge IFrame) but do emit `chargeAuthChallengeCompleted` once the customer approved out-of-band: show a dedicated waiting state with `data.result.description` until then, and "Completing verification" until the terminal event. Frictionless flows go straight from `load()` to the terminal event.
+
 ### Events and Values
 
 | Event Value         | Type                | Description                                                    |
@@ -777,6 +840,8 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
 | <code>chargeAuthSuccess</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>chargeAuthReject</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>chargeAuthChallenge</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
+| <code>chargeAuthChallengeLoaded</code> | <code>object</code> | Instance of [ChallengeLoadedResponse](#cb_challengeLoadedResponse) |
+| <code>chargeAuthChallengeCompleted</code> | <code>object</code> | Instance of [ChallengeCompletedResponse](#cb_challengeCompletedResponse) |
 | <code>chargeAuthDecoupled</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>chargeAuthInfo</code> | <code>object</code> | Instance of [ChargeEventResponse](#cb_chargeEventResponse) |
 | <code>error</code> | <code>object</code> | Instance of [chargeError](#cb_chargeError) |
@@ -794,6 +859,24 @@ After you initialized the standalone 3ds charge via `v1/charges/standalone-3ds`
 | <code>info</code> | <code>string</code> | info field for `chargeAuthInfo` event |
 | <code>result.description</code> | <code>string</code> [Optional] | field that you must show to the customer, indicating the method the user must use to authenticate during the decoupled challenge flow. |
 
+<a name="cb_challengeLoadedResponse" id="cb_challengeLoadedResponse"></a>
+
+### ChallengeLoadedResponse
+
+| Param                           | Type                           | Description                                                                                        |
+| ------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------- |
+| <code>charge_3ds_id</code> | <code>string</code> | Universal unique transaction identifier to identify the transaction |
+| <code>reason</code> | <code>string</code> | `load` — the challenge IFrame fired its first load event; `timeout` — no load within 2.5 s, emitted so a loader is never held forever (a later load is ignored) |
+
+<a name="cb_challengeCompletedResponse" id="cb_challengeCompletedResponse"></a>
+
+### ChallengeCompletedResponse
+
+| Param                           | Type                           | Description                                                                                        |
+| ------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------- |
+| <code>charge_3ds_id</code> | <code>string</code> | Universal unique transaction identifier to identify the transaction |
+| <code>source</code> | <code>string</code> | `poll` — the 3DS server's result monitor reported that the bank delivered the result (the usual case); `callback` — the callback message carrying the outcome arrived first (the terminal event follows immediately). Informational only — handle both the same way |
+
 ### ChargeError
 
 <a name="cb_chargeError" id="cb_chargeError"></a>