@payment-kit-js/vanilla 0.5.17 → 0.5.19

package/README.md

@@ -7,3 +7,17 @@ Vanilla JavaScript SDK for PaymentKit. A type-safe, framework-agnostic payment p
 For complete documentation, guides, and examples, visit:
 
 **[PaymentKit.js Documentation](https://docs.paymentkit.com/guides/integration/sdk-reference/payment-kit-js/getting-started)**
+
+## Content-Security-Policy Requirements
+
+If your site uses a Content-Security-Policy header, you must add the following domains to your `script-src` directive to allow fraud prevention scripts:
+
+- **Production:** `https://static.airwallex.com`
+- **Sandbox:** `https://static-demo.airwallex.com`
+
+Example:
+```
+Content-Security-Policy: script-src 'self' https://static.airwallex.com;
+```
+
+If these domains are blocked, PaymentKit.js will log an error to the console with the required domain.

package/dist/{bnpl-shared-DGs1YzS9.mjs → bnpl-shared-CL900HFN.mjs}

@@ -1,4 +1,4 @@
-import { i as definePaymentMethod, n as collectFraudMetadata, o as getOrCreateCheckoutRequestId } from "./utils-Dc6zwOe1.mjs";
+import { i as definePaymentMethod, n as collectFraudMetadata, o as getOrCreateCheckoutRequestId } from "./utils-DIqrx4XF.mjs";
 
 //#region src/payment-methods/bnpl-shared.ts
 const createSubmitPayment = (states, config) => {
@@ -104,4 +104,4 @@ function createBnplPaymentMethod(config) {
 
 //#endregion
 export { createBnplPaymentMethod as t };
-//# sourceMappingURL=bnpl-shared-DGs1YzS9.mjs.map
+//# sourceMappingURL=bnpl-shared-CL900HFN.mjs.map

package/dist/{bnpl-shared-DGs1YzS9.mjs.map → bnpl-shared-CL900HFN.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"bnpl-shared-DGs1YzS9.mjs","names":["submitPayment: TInternalFuncs[\"submitPayment\"]","requestBody: BnplStartRequest","localStates: BnplStates"],"sources":["../src/payment-methods/bnpl-shared.ts"],"sourcesContent":["/**\n * Shared BNPL (Buy Now Pay Later) payment method factory.\n * Used by Klarna, Afterpay, and Affirm payment methods.\n */\n\nimport type { PaymentKitErrors, PaymentKitStates, TInternalFuncs } from \"../types\";\nimport { collectFraudMetadata, definePaymentMethod, getOrCreateCheckoutRequestId } from \"../utils\";\n\nexport type BnplCustomerInfo = {\n  first_name: string;\n  last_name: string;\n  email?: string;\n};\n\nexport type BnplStartRequest = {\n  processor_id: string;\n  customer_info: BnplCustomerInfo;\n  fraud_metadata: {\n    ipAddress?: string;\n    browserInfo?: { [key: string]: unknown };\n    processorFraudInfo?: { [key: string]: unknown };\n  };\n  setup_future_usage?: boolean;\n};\n\nexport type BnplStartResponse = {\n  approval_url: string;\n  popup_token: string;\n  checkout_attempt_id: string;\n};\n\nexport type BnplStatusResponse = {\n  completed: boolean;\n  status: \"success\" | \"failed\" | \"cancelled\";\n  result?: unknown;\n  error?: string;\n};\n\nexport type BnplCheckoutResponse = {\n  id: string;\n  checkoutAttemptId: string;\n  checkoutSessionId: string;\n  state: string;\n  customerId?: string;\n  paymentMethodId?: string;\n  processorUsed?: string;\n  subscriptionId?: string;\n  invoiceId?: string;\n  invoiceNumber?: number;\n};\n\nexport type BnplSubmitOptions = {\n  processorId: string;\n  customerInfo: BnplCustomerInfo;\n  setupFutureUsage?: boolean;\n};\n\ntype BnplStates = PaymentKitStates & {\n  popup?: Window | null;\n  pollInterval?: ReturnType<typeof setInterval>;\n};\n\nexport type BnplProviderConfig = {\n  name: string;\n  endpointPath: string;\n  supportsSetupFutureUsage?: boolean;\n};\n\nconst createSubmitPayment = (states: BnplStates, config: BnplProviderConfig) => {\n  const { name, endpointPath, supportsSetupFutureUsage } = config;\n  const capitalizedName = name.charAt(0).toUpperCase() + name.slice(1);\n\n  const submitPayment: TInternalFuncs[\"submitPayment\"] = async (_fields, options) => {\n    const { apiBaseUrl, secureToken, environment } = states;\n    const bnplOptions = options as BnplSubmitOptions;\n\n    if (!bnplOptions?.processorId) {\n      return { errors: { processor_id: \"Processor ID is required\" } as PaymentKitErrors };\n    }\n\n    if (!bnplOptions?.customerInfo?.first_name || !bnplOptions?.customerInfo?.last_name) {\n      return {\n        errors: {\n          customer_name: \"Customer first and last name are required\",\n        } as PaymentKitErrors,\n      };\n    }\n\n    try {\n      const checkoutRequestId = getOrCreateCheckoutRequestId(environment);\n\n      const requestBody: BnplStartRequest = {\n        processor_id: bnplOptions.processorId,\n        customer_info: bnplOptions.customerInfo,\n        fraud_metadata: collectFraudMetadata(),\n      };\n\n      if (supportsSetupFutureUsage && bnplOptions.setupFutureUsage !== undefined) {\n        requestBody.setup_future_usage = bnplOptions.setupFutureUsage;\n      }\n\n      const startResponse = await fetch(`${apiBaseUrl}/api/checkout/${secureToken}/stripe/${endpointPath}/start`, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"x-request-id\": checkoutRequestId,\n        },\n        body: JSON.stringify(requestBody),\n      });\n\n      if (!startResponse.ok) {\n        let errorMessage = `Failed to start ${capitalizedName} checkout (${startResponse.status})`;\n        try {\n          const errorData = await startResponse.json();\n          errorMessage = errorData.detail || errorMessage;\n        } catch {\n          errorMessage = startResponse.statusText || errorMessage;\n        }\n        return {\n          errors: {\n            [name]: errorMessage,\n          } as PaymentKitErrors,\n        };\n      }\n\n      const { approval_url, popup_token, checkout_attempt_id } = (await startResponse.json()) as BnplStartResponse;\n\n      const popup = window.open(approval_url, capitalizedName, \"width=600,height=700\");\n\n      if (!popup) {\n        return {\n          errors: {\n            [name]: `Failed to open ${capitalizedName} popup. Please allow popups for this site.`,\n          } as PaymentKitErrors,\n        };\n      }\n\n      states.popup = popup;\n\n      return new Promise((resolve) => {\n        let popupClosedGracePolls = 0;\n        const MAX_GRACE_POLLS = 5;\n\n        const pollInterval = setInterval(async () => {\n          try {\n            const statusResponse = await fetch(\n              `${apiBaseUrl}/api/checkout/${secureToken}/popup/status?popup_token=${popup_token}`,\n            );\n\n            if (!statusResponse.ok) {\n              clearInterval(pollInterval);\n              popup.close();\n              resolve({\n                errors: {\n                  [name]: `Failed to check ${capitalizedName} status`,\n                } as PaymentKitErrors,\n              });\n              return;\n            }\n\n            const statusResult = (await statusResponse.json()) as BnplStatusResponse;\n\n            if (statusResult.completed) {\n              clearInterval(pollInterval);\n              popup.close();\n\n              if (statusResult.status === \"success\") {\n                // Result is returned directly from popup status endpoint\n                const result = statusResult.result || {\n                  id: checkout_attempt_id,\n                  checkoutAttemptId: checkout_attempt_id,\n                  checkoutSessionId: secureToken,\n                  state: \"checkout_succeeded\",\n                };\n\n                resolve({ data: result });\n              } else {\n                resolve({\n                  errors: {\n                    [name]: statusResult.error || `${capitalizedName} checkout ${statusResult.status}`,\n                  } as PaymentKitErrors,\n                });\n              }\n              return;\n            }\n\n            if (popup.closed) {\n              popupClosedGracePolls++;\n              if (popupClosedGracePolls >= MAX_GRACE_POLLS) {\n                clearInterval(pollInterval);\n                resolve({\n                  errors: {\n                    [name]: `${capitalizedName} popup closed by user`,\n                  } as PaymentKitErrors,\n                });\n              }\n              return;\n            }\n          } catch (error) {\n            clearInterval(pollInterval);\n            popup.close();\n            resolve({\n              errors: {\n                [name]: `Polling error: ${error}`,\n              } as PaymentKitErrors,\n            });\n          }\n        }, 2000);\n\n        states.pollInterval = pollInterval;\n      });\n    } catch (error) {\n      return {\n        errors: {\n          [name]: `${capitalizedName} checkout error: ${error}`,\n        } as PaymentKitErrors,\n      };\n    }\n  };\n\n  return submitPayment;\n};\n\nexport function createBnplPaymentMethod(config: BnplProviderConfig) {\n  return definePaymentMethod((paymentKitStates) => {\n    const localStates: BnplStates = { ...paymentKitStates };\n\n    return {\n      name: config.name,\n      externalFuncs: {},\n      internalFuncs: {\n        submitPayment: createSubmitPayment(localStates, config),\n        cleanup: () => {\n          if (localStates.pollInterval) {\n            clearInterval(localStates.pollInterval);\n          }\n          if (localStates.popup && !localStates.popup.closed) {\n            localStates.popup.close();\n          }\n        },\n      },\n    };\n  });\n}\n"],"mappings":";;;AAoEA,MAAM,uBAAuB,QAAoB,WAA+B;CAC9E,MAAM,EAAE,MAAM,cAAc,6BAA6B;CACzD,MAAM,kBAAkB,KAAK,OAAO,EAAE,CAAC,aAAa,GAAG,KAAK,MAAM,EAAE;CAEpE,MAAMA,gBAAiD,OAAO,SAAS,YAAY;EACjF,MAAM,EAAE,YAAY,aAAa,gBAAgB;EACjD,MAAM,cAAc;AAEpB,MAAI,CAAC,aAAa,YAChB,QAAO,EAAE,QAAQ,EAAE,cAAc,4BAA4B,EAAsB;AAGrF,MAAI,CAAC,aAAa,cAAc,cAAc,CAAC,aAAa,cAAc,UACxE,QAAO,EACL,QAAQ,EACN,eAAe,6CAChB,EACF;AAGH,MAAI;GACF,MAAM,oBAAoB,6BAA6B,YAAY;GAEnE,MAAMC,cAAgC;IACpC,cAAc,YAAY;IAC1B,eAAe,YAAY;IAC3B,gBAAgB,sBAAsB;IACvC;AAED,OAAI,4BAA4B,YAAY,qBAAqB,OAC/D,aAAY,qBAAqB,YAAY;GAG/C,MAAM,gBAAgB,MAAM,MAAM,GAAG,WAAW,gBAAgB,YAAY,UAAU,aAAa,SAAS;IAC1G,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,gBAAgB;KACjB;IACD,MAAM,KAAK,UAAU,YAAY;IAClC,CAAC;AAEF,OAAI,CAAC,cAAc,IAAI;IACrB,IAAI,eAAe,mBAAmB,gBAAgB,aAAa,cAAc,OAAO;AACxF,QAAI;AAEF,qBADkB,MAAM,cAAc,MAAM,EACnB,UAAU;YAC7B;AACN,oBAAe,cAAc,cAAc;;AAE7C,WAAO,EACL,QAAQ,GACL,OAAO,cACT,EACF;;GAGH,MAAM,EAAE,cAAc,aAAa,wBAAyB,MAAM,cAAc,MAAM;GAEtF,MAAM,QAAQ,OAAO,KAAK,cAAc,iBAAiB,uBAAuB;AAEhF,OAAI,CAAC,MACH,QAAO,EACL,QAAQ,GACL,OAAO,kBAAkB,gBAAgB,6CAC3C,EACF;AAGH,UAAO,QAAQ;AAEf,UAAO,IAAI,SAAS,YAAY;IAC9B,IAAI,wBAAwB;IAC5B,MAAM,kBAAkB;IAExB,MAAM,eAAe,YAAY,YAAY;AAC3C,SAAI;MACF,MAAM,iBAAiB,MAAM,MAC3B,GAAG,WAAW,gBAAgB,YAAY,4BAA4B,cACvE;AAED,UAAI,CAAC,eAAe,IAAI;AACtB,qBAAc,aAAa;AAC3B,aAAM,OAAO;AACb,eAAQ,EACN,QAAQ,GACL,OAAO,mBAAmB,gBAAgB,UAC5C,EACF,CAAC;AACF;;MAGF,MAAM,eAAgB,MAAM,eAAe,MAAM;AAEjD,UAAI,aAAa,WAAW;AAC1B,qBAAc,aAAa;AAC3B,aAAM,OAAO;AAEb,WAAI,aAAa,WAAW,UAS1B,SAAQ,EAAE,MAPK,aAAa,UAAU;QACpC,IAAI;QACJ,mBAAmB;QACnB,mBAAmB;QACnB,OAAO;QACR,EAEuB,CAAC;WAEzB,SAAQ,EACN,QAAQ,GACL,OAAO,aAAa,SAAS,GAAG,gBAAgB,YAAY,aAAa,UAC3E,EACF,CAAC;AAEJ;;AAGF,UAAI,MAAM,QAAQ;AAChB;AACA,WAAI,yBAAyB,iBAAiB;AAC5C,sBAAc,aAAa;AAC3B,gBAAQ,EACN,QAAQ,GACL,OAAO,GAAG,gBAAgB,wBAC5B,EACF,CAAC;;AAEJ;;cAEK,OAAO;AACd,oBAAc,aAAa;AAC3B,YAAM,OAAO;AACb,cAAQ,EACN,QAAQ,GACL,OAAO,kBAAkB,SAC3B,EACF,CAAC;;OAEH,IAAK;AAER,WAAO,eAAe;KACtB;WACK,OAAO;AACd,UAAO,EACL,QAAQ,GACL,OAAO,GAAG,gBAAgB,mBAAmB,SAC/C,EACF;;;AAIL,QAAO;;AAGT,SAAgB,wBAAwB,QAA4B;AAClE,QAAO,qBAAqB,qBAAqB;EAC/C,MAAMC,cAA0B,EAAE,GAAG,kBAAkB;AAEvD,SAAO;GACL,MAAM,OAAO;GACb,eAAe,EAAE;GACjB,eAAe;IACb,eAAe,oBAAoB,aAAa,OAAO;IACvD,eAAe;AACb,SAAI,YAAY,aACd,eAAc,YAAY,aAAa;AAEzC,SAAI,YAAY,SAAS,CAAC,YAAY,MAAM,OAC1C,aAAY,MAAM,OAAO;;IAG9B;GACF;GACD"}
+{"version":3,"file":"bnpl-shared-CL900HFN.mjs","names":["submitPayment: TInternalFuncs[\"submitPayment\"]","requestBody: BnplStartRequest","localStates: BnplStates"],"sources":["../src/payment-methods/bnpl-shared.ts"],"sourcesContent":["/**\n * Shared BNPL (Buy Now Pay Later) payment method factory.\n * Used by Klarna, Afterpay, and Affirm payment methods.\n */\n\nimport type { PaymentKitErrors, PaymentKitStates, TInternalFuncs } from \"../types\";\nimport { collectFraudMetadata, definePaymentMethod, getOrCreateCheckoutRequestId } from \"../utils\";\n\nexport type BnplCustomerInfo = {\n  first_name: string;\n  last_name: string;\n  email?: string;\n};\n\nexport type BnplStartRequest = {\n  processor_id: string;\n  customer_info: BnplCustomerInfo;\n  fraud_metadata: {\n    ipAddress?: string;\n    browserInfo?: { [key: string]: unknown };\n    processorFraudInfo?: { [key: string]: unknown };\n  };\n  setup_future_usage?: boolean;\n};\n\nexport type BnplStartResponse = {\n  approval_url: string;\n  popup_token: string;\n  checkout_attempt_id: string;\n};\n\nexport type BnplStatusResponse = {\n  completed: boolean;\n  status: \"success\" | \"failed\" | \"cancelled\";\n  result?: unknown;\n  error?: string;\n};\n\nexport type BnplCheckoutResponse = {\n  id: string;\n  checkoutAttemptId: string;\n  checkoutSessionId: string;\n  state: string;\n  customerId?: string;\n  paymentMethodId?: string;\n  processorUsed?: string;\n  subscriptionId?: string;\n  invoiceId?: string;\n  invoiceNumber?: number;\n};\n\nexport type BnplSubmitOptions = {\n  processorId: string;\n  customerInfo: BnplCustomerInfo;\n  setupFutureUsage?: boolean;\n};\n\ntype BnplStates = PaymentKitStates & {\n  popup?: Window | null;\n  pollInterval?: ReturnType<typeof setInterval>;\n};\n\nexport type BnplProviderConfig = {\n  name: string;\n  endpointPath: string;\n  supportsSetupFutureUsage?: boolean;\n};\n\nconst createSubmitPayment = (states: BnplStates, config: BnplProviderConfig) => {\n  const { name, endpointPath, supportsSetupFutureUsage } = config;\n  const capitalizedName = name.charAt(0).toUpperCase() + name.slice(1);\n\n  const submitPayment: TInternalFuncs[\"submitPayment\"] = async (_fields, options) => {\n    const { apiBaseUrl, secureToken, environment } = states;\n    const bnplOptions = options as BnplSubmitOptions;\n\n    if (!bnplOptions?.processorId) {\n      return { errors: { processor_id: \"Processor ID is required\" } as PaymentKitErrors };\n    }\n\n    if (!bnplOptions?.customerInfo?.first_name || !bnplOptions?.customerInfo?.last_name) {\n      return {\n        errors: {\n          customer_name: \"Customer first and last name are required\",\n        } as PaymentKitErrors,\n      };\n    }\n\n    try {\n      const checkoutRequestId = getOrCreateCheckoutRequestId(environment);\n\n      const requestBody: BnplStartRequest = {\n        processor_id: bnplOptions.processorId,\n        customer_info: bnplOptions.customerInfo,\n        fraud_metadata: collectFraudMetadata(),\n      };\n\n      if (supportsSetupFutureUsage && bnplOptions.setupFutureUsage !== undefined) {\n        requestBody.setup_future_usage = bnplOptions.setupFutureUsage;\n      }\n\n      const startResponse = await fetch(`${apiBaseUrl}/api/checkout/${secureToken}/stripe/${endpointPath}/start`, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"x-request-id\": checkoutRequestId,\n        },\n        body: JSON.stringify(requestBody),\n      });\n\n      if (!startResponse.ok) {\n        let errorMessage = `Failed to start ${capitalizedName} checkout (${startResponse.status})`;\n        try {\n          const errorData = await startResponse.json();\n          errorMessage = errorData.detail || errorMessage;\n        } catch {\n          errorMessage = startResponse.statusText || errorMessage;\n        }\n        return {\n          errors: {\n            [name]: errorMessage,\n          } as PaymentKitErrors,\n        };\n      }\n\n      const { approval_url, popup_token, checkout_attempt_id } = (await startResponse.json()) as BnplStartResponse;\n\n      const popup = window.open(approval_url, capitalizedName, \"width=600,height=700\");\n\n      if (!popup) {\n        return {\n          errors: {\n            [name]: `Failed to open ${capitalizedName} popup. Please allow popups for this site.`,\n          } as PaymentKitErrors,\n        };\n      }\n\n      states.popup = popup;\n\n      return new Promise((resolve) => {\n        let popupClosedGracePolls = 0;\n        const MAX_GRACE_POLLS = 5;\n\n        const pollInterval = setInterval(async () => {\n          try {\n            const statusResponse = await fetch(\n              `${apiBaseUrl}/api/checkout/${secureToken}/popup/status?popup_token=${popup_token}`,\n            );\n\n            if (!statusResponse.ok) {\n              clearInterval(pollInterval);\n              popup.close();\n              resolve({\n                errors: {\n                  [name]: `Failed to check ${capitalizedName} status`,\n                } as PaymentKitErrors,\n              });\n              return;\n            }\n\n            const statusResult = (await statusResponse.json()) as BnplStatusResponse;\n\n            if (statusResult.completed) {\n              clearInterval(pollInterval);\n              popup.close();\n\n              if (statusResult.status === \"success\") {\n                // Result is returned directly from popup status endpoint\n                const result = statusResult.result || {\n                  id: checkout_attempt_id,\n                  checkoutAttemptId: checkout_attempt_id,\n                  checkoutSessionId: secureToken,\n                  state: \"checkout_succeeded\",\n                };\n\n                resolve({ data: result });\n              } else {\n                resolve({\n                  errors: {\n                    [name]: statusResult.error || `${capitalizedName} checkout ${statusResult.status}`,\n                  } as PaymentKitErrors,\n                });\n              }\n              return;\n            }\n\n            if (popup.closed) {\n              popupClosedGracePolls++;\n              if (popupClosedGracePolls >= MAX_GRACE_POLLS) {\n                clearInterval(pollInterval);\n                resolve({\n                  errors: {\n                    [name]: `${capitalizedName} popup closed by user`,\n                  } as PaymentKitErrors,\n                });\n              }\n              return;\n            }\n          } catch (error) {\n            clearInterval(pollInterval);\n            popup.close();\n            resolve({\n              errors: {\n                [name]: `Polling error: ${error}`,\n              } as PaymentKitErrors,\n            });\n          }\n        }, 2000);\n\n        states.pollInterval = pollInterval;\n      });\n    } catch (error) {\n      return {\n        errors: {\n          [name]: `${capitalizedName} checkout error: ${error}`,\n        } as PaymentKitErrors,\n      };\n    }\n  };\n\n  return submitPayment;\n};\n\nexport function createBnplPaymentMethod(config: BnplProviderConfig) {\n  return definePaymentMethod((paymentKitStates) => {\n    const localStates: BnplStates = { ...paymentKitStates };\n\n    return {\n      name: config.name,\n      externalFuncs: {},\n      internalFuncs: {\n        submitPayment: createSubmitPayment(localStates, config),\n        cleanup: () => {\n          if (localStates.pollInterval) {\n            clearInterval(localStates.pollInterval);\n          }\n          if (localStates.popup && !localStates.popup.closed) {\n            localStates.popup.close();\n          }\n        },\n      },\n    };\n  });\n}\n"],"mappings":";;;AAoEA,MAAM,uBAAuB,QAAoB,WAA+B;CAC9E,MAAM,EAAE,MAAM,cAAc,6BAA6B;CACzD,MAAM,kBAAkB,KAAK,OAAO,EAAE,CAAC,aAAa,GAAG,KAAK,MAAM,EAAE;CAEpE,MAAMA,gBAAiD,OAAO,SAAS,YAAY;EACjF,MAAM,EAAE,YAAY,aAAa,gBAAgB;EACjD,MAAM,cAAc;AAEpB,MAAI,CAAC,aAAa,YAChB,QAAO,EAAE,QAAQ,EAAE,cAAc,4BAA4B,EAAsB;AAGrF,MAAI,CAAC,aAAa,cAAc,cAAc,CAAC,aAAa,cAAc,UACxE,QAAO,EACL,QAAQ,EACN,eAAe,6CAChB,EACF;AAGH,MAAI;GACF,MAAM,oBAAoB,6BAA6B,YAAY;GAEnE,MAAMC,cAAgC;IACpC,cAAc,YAAY;IAC1B,eAAe,YAAY;IAC3B,gBAAgB,sBAAsB;IACvC;AAED,OAAI,4BAA4B,YAAY,qBAAqB,OAC/D,aAAY,qBAAqB,YAAY;GAG/C,MAAM,gBAAgB,MAAM,MAAM,GAAG,WAAW,gBAAgB,YAAY,UAAU,aAAa,SAAS;IAC1G,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,gBAAgB;KACjB;IACD,MAAM,KAAK,UAAU,YAAY;IAClC,CAAC;AAEF,OAAI,CAAC,cAAc,IAAI;IACrB,IAAI,eAAe,mBAAmB,gBAAgB,aAAa,cAAc,OAAO;AACxF,QAAI;AAEF,qBADkB,MAAM,cAAc,MAAM,EACnB,UAAU;YAC7B;AACN,oBAAe,cAAc,cAAc;;AAE7C,WAAO,EACL,QAAQ,GACL,OAAO,cACT,EACF;;GAGH,MAAM,EAAE,cAAc,aAAa,wBAAyB,MAAM,cAAc,MAAM;GAEtF,MAAM,QAAQ,OAAO,KAAK,cAAc,iBAAiB,uBAAuB;AAEhF,OAAI,CAAC,MACH,QAAO,EACL,QAAQ,GACL,OAAO,kBAAkB,gBAAgB,6CAC3C,EACF;AAGH,UAAO,QAAQ;AAEf,UAAO,IAAI,SAAS,YAAY;IAC9B,IAAI,wBAAwB;IAC5B,MAAM,kBAAkB;IAExB,MAAM,eAAe,YAAY,YAAY;AAC3C,SAAI;MACF,MAAM,iBAAiB,MAAM,MAC3B,GAAG,WAAW,gBAAgB,YAAY,4BAA4B,cACvE;AAED,UAAI,CAAC,eAAe,IAAI;AACtB,qBAAc,aAAa;AAC3B,aAAM,OAAO;AACb,eAAQ,EACN,QAAQ,GACL,OAAO,mBAAmB,gBAAgB,UAC5C,EACF,CAAC;AACF;;MAGF,MAAM,eAAgB,MAAM,eAAe,MAAM;AAEjD,UAAI,aAAa,WAAW;AAC1B,qBAAc,aAAa;AAC3B,aAAM,OAAO;AAEb,WAAI,aAAa,WAAW,UAS1B,SAAQ,EAAE,MAPK,aAAa,UAAU;QACpC,IAAI;QACJ,mBAAmB;QACnB,mBAAmB;QACnB,OAAO;QACR,EAEuB,CAAC;WAEzB,SAAQ,EACN,QAAQ,GACL,OAAO,aAAa,SAAS,GAAG,gBAAgB,YAAY,aAAa,UAC3E,EACF,CAAC;AAEJ;;AAGF,UAAI,MAAM,QAAQ;AAChB;AACA,WAAI,yBAAyB,iBAAiB;AAC5C,sBAAc,aAAa;AAC3B,gBAAQ,EACN,QAAQ,GACL,OAAO,GAAG,gBAAgB,wBAC5B,EACF,CAAC;;AAEJ;;cAEK,OAAO;AACd,oBAAc,aAAa;AAC3B,YAAM,OAAO;AACb,cAAQ,EACN,QAAQ,GACL,OAAO,kBAAkB,SAC3B,EACF,CAAC;;OAEH,IAAK;AAER,WAAO,eAAe;KACtB;WACK,OAAO;AACd,UAAO,EACL,QAAQ,GACL,OAAO,GAAG,gBAAgB,mBAAmB,SAC/C,EACF;;;AAIL,QAAO;;AAGT,SAAgB,wBAAwB,QAA4B;AAClE,QAAO,qBAAqB,qBAAqB;EAC/C,MAAMC,cAA0B,EAAE,GAAG,kBAAkB;AAEvD,SAAO;GACL,MAAM,OAAO;GACb,eAAe,EAAE;GACjB,eAAe;IACb,eAAe,oBAAoB,aAAa,OAAO;IACvD,eAAe;AACb,SAAI,YAAY,aACd,eAAc,YAAY,aAAa;AAEzC,SAAI,YAAY,SAAS,CAAC,YAAY,MAAM,OAC1C,aAAY,MAAM,OAAO;;IAG9B;GACF;GACD"}

package/dist/{bnpl-shared-BQwCBD45.d.mts → bnpl-shared-D-Kd58Qz.d.mts}

@@ -1,4 +1,4 @@
-import { r as PaymentMethod } from "./types-B3mjYfOm.mjs";
+import { i as PaymentMethod } from "./types-Cjcc3xak.mjs";
 
 //#region src/payment-methods/bnpl-shared.d.ts
 
@@ -61,4 +61,4 @@ type BnplProviderConfig = {
 declare function createBnplPaymentMethod(config: BnplProviderConfig): PaymentMethod<{}, string>;
 //#endregion
 export { BnplStartResponse as a, createBnplPaymentMethod as c, BnplStartRequest as i, BnplCustomerInfo as n, BnplStatusResponse as o, BnplProviderConfig as r, BnplSubmitOptions as s, BnplCheckoutResponse as t };
-//# sourceMappingURL=bnpl-shared-BQwCBD45.d.mts.map
+//# sourceMappingURL=bnpl-shared-D-Kd58Qz.d.mts.map

package/dist/{bnpl-shared-BQwCBD45.d.mts.map → bnpl-shared-D-Kd58Qz.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"bnpl-shared-BQwCBD45.d.mts","names":[],"sources":["../src/payment-methods/bnpl-shared.ts"],"sourcesContent":[],"mappings":";;;;;;;AAQA;AAMY,KANA,gBAAA,GAMgB;EAWhB,UAAA,EAAA,MAAA;EAMA,SAAA,EAAA,MAAA;EAOA,KAAA,CAAA,EAAA,MAAA;AAaZ,CAAA;AAWY,KAhDA,gBAAA,GAgDkB;EAiKd,YAAA,EAAA,MAAA;iBA/MC;;;;;;;;;;;;KASL,iBAAA;;;;;KAMA,kBAAA;;;;;;KAOA,oBAAA;;;;;;;;;;;;KAaA,iBAAA;;gBAEI;;;KASJ,kBAAA;;;;;iBAiKI,uBAAA,SAAgC,qBAAkB"}
+{"version":3,"file":"bnpl-shared-D-Kd58Qz.d.mts","names":[],"sources":["../src/payment-methods/bnpl-shared.ts"],"sourcesContent":[],"mappings":";;;;;;;AAQA;AAMY,KANA,gBAAA,GAMgB;EAWhB,UAAA,EAAA,MAAA;EAMA,SAAA,EAAA,MAAA;EAOA,KAAA,CAAA,EAAA,MAAA;AAaZ,CAAA;AAWY,KAhDA,gBAAA,GAgDkB;EAiKd,YAAA,EAAA,MAAA;iBA/MC;;;;;;;;;;;;KASL,iBAAA;;;;;KAMA,kBAAA;;;;;;KAOA,oBAAA;;;;;;;;;;;;KAaA,iBAAA;;gBAEI;;;KASJ,kBAAA;;;;;iBAiKI,uBAAA,SAAgC,qBAAkB"}

package/dist/cdn/paymentkit.js

@@ -1,5 +1,5 @@
 /**
- * PaymentKit.js v0.5.17
+ * PaymentKit.js v0.5.19
  * https://paymentkit.com
  *
  * @license MIT
@@ -42,7 +42,7 @@ var PaymentKit = (() => {
   });
 
   // package.json
-  var version = "0.5.17";
+  var version = "0.5.19";
 
   // src/analytics/mock-adapter.ts
   var MockAnalyticsAdapter = class {
@@ -6049,6 +6049,10 @@ var PaymentKit = (() => {
       apiBaseUrl: "http://localhost:9000"
     },
     sandbox: {
+      baseUrl: "https://app.paymentkit.com/customer",
+      apiBaseUrl: "https://app.paymentkit.com"
+    },
+    staging: {
       baseUrl: "https://staging.paymentkit.com/customer",
       apiBaseUrl: "https://staging.paymentkit.com"
     },
@@ -6082,10 +6086,10 @@ var PaymentKit = (() => {
     if (environment === "tunnel") {
       return getTunnelUrls();
     }
-    const env = environment;
-    const urls = STATIC_ENVIRONMENT_URLS[env];
+    const urls = STATIC_ENVIRONMENT_URLS[environment];
     if (!urls) {
-      throw new Error(`Invalid environment: ${environment}. Must be one of: local, tunnel, sandbox, production`);
+      console.warn(`[PaymentKit] Invalid environment "${environment}", falling back to local`);
+      return STATIC_ENVIRONMENT_URLS.local;
     }
     return urls;
   }
@@ -6107,22 +6111,22 @@ var PaymentKit = (() => {
   var ENV_TO_SLUG = {
     local: "dev",
     tunnel: "dev",
-    sandbox: "stg",
+    sandbox: "prod",
+    staging: "stg",
     production: "prod"
   };
-  var WINDOW_KEY = "__paymentKitRequestId__";
   function generateCheckoutRequestId(environment) {
-    const envSlug = ENV_TO_SLUG[environment] || "dev";
+    const envSlug = ENV_TO_SLUG[environment] ?? "dev";
     const randomPart = nanoid(12);
     return `pk_${envSlug}_${randomPart}`;
   }
   function getOrCreateCheckoutRequestId(environment) {
-    if (typeof window !== "undefined" && window[WINDOW_KEY]) {
-      return window[WINDOW_KEY];
+    if (typeof window !== "undefined" && window.__paymentKitRequestId__) {
+      return window.__paymentKitRequestId__;
     }
     const requestId = generateCheckoutRequestId(environment);
     if (typeof window !== "undefined") {
-      window[WINDOW_KEY] = requestId;
+      window.__paymentKitRequestId__ = requestId;
     }
     return requestId;
   }
@@ -6423,7 +6427,7 @@ var PaymentKit = (() => {
       }, {});
       return { isSuccess: false, errors };
     }
-    return { isSuccess: true };
+    return { isSuccess: true, errors: {} };
   };
 
   // src/utils/index.ts
@@ -6460,6 +6464,18 @@ var PaymentKit = (() => {
   }
 
   // src/index.ts
+  function appendScriptToDOM(script) {
+    const target = document.body ?? document.head;
+    target.appendChild(script);
+  }
+  function getFraudScriptId(url) {
+    if (url.includes("airwallex.com")) {
+      return "airwallex-fraud-api";
+    }
+    const urlObj = new URL(url);
+    const hash = btoa(urlObj.origin + urlObj.pathname).replace(/[^a-zA-Z0-9]/g, "").slice(0, 12);
+    return `pk-fraud-script-${hash}`;
+  }
   var createTunnelXConnection = (baseUrl, apiBaseUrl, token) => {
     const iframe = createCheckoutIFrame("tunnel-x", baseUrl, {
       checkout_token: token,
@@ -6468,14 +6484,17 @@ var PaymentKit = (() => {
     Object.assign(iframe.style, { width: "0", height: "0", position: "absolute", visibility: "hidden" });
     document.body.appendChild(iframe);
     const connection = connectToTunnelXIframe(iframe, {});
+    let destroyed = false;
     const unmount = () => {
+      if (destroyed) return;
+      destroyed = true;
       connection.destroy();
-      document.body.removeChild(iframe);
+      iframe.remove();
     };
     return { unmount, connection };
   };
   var PaymentKit = ({
-    environment,
+    environment = "production",
     secureToken,
     paymentMethods,
     cardTokenizationMode,
@@ -6507,7 +6526,9 @@ var PaymentKit = (() => {
       cardTokenizationMode,
       vgsVaultId,
       vgsEnvironment,
-      _sessionConfigReady: void 0
+      _sessionConfigReady: void 0,
+      _fraudScriptIds: [],
+      _fraudScriptsReady: void 0
     };
     if (cardTokenizationMode === void 0) {
       const sessionConfigUrl = `${apiBaseUrl}/api/checkout-sessions/token/${secureToken}`;
@@ -6538,6 +6559,48 @@ var PaymentKit = (() => {
             );
             paymentKitStates.cardTokenizationMode = "direct";
           }
+          if (session?.fraud_script_urls?.length) {
+            const loadPromises = [];
+            session.fraud_script_urls.forEach((url) => {
+              const scriptId = getFraudScriptId(url);
+              if (document.getElementById(scriptId)) {
+                console.log(`[PaymentKit] Fraud script already present: ${scriptId}`);
+                loadPromises.push(Promise.resolve());
+                return;
+              }
+              const script = document.createElement("script");
+              script.type = "text/javascript";
+              script.async = true;
+              script.id = scriptId;
+              script.src = url;
+              script.dataset.orderSessionId = checkoutRequestId;
+              const loadPromise2 = new Promise((resolve) => {
+                script.onload = () => {
+                  console.log(`[PaymentKit] Fraud script loaded: ${scriptId}`);
+                  resolve();
+                };
+                script.onerror = () => {
+                  console.error(
+                    `[PaymentKit] Failed to load fraud prevention script. If using Content-Security-Policy, add to script-src: ${new URL(url).origin}`
+                  );
+                  resolve();
+                };
+              });
+              loadPromises.push(loadPromise2);
+              paymentKitStates._fraudScriptIds.push(scriptId);
+              appendScriptToDOM(script);
+            });
+            paymentKitStates._fraudScriptsReady = Promise.all(loadPromises).then(() => {
+              console.log(`[PaymentKit] All ${loadPromises.length} fraud fingerprinting script(s) ready`);
+            });
+            session.fraud_script_urls.forEach((url) => {
+              const scriptId = getFraudScriptId(url);
+              console.log(
+                `[PaymentKit] Fraud script injected: id=${scriptId}, data-order-session-id=${checkoutRequestId}, src=${url}`
+              );
+            });
+            console.log(`[PaymentKit] Injected ${session.fraud_script_urls.length} fraud fingerprinting script(s)`);
+          }
         } else {
           console.log("[PaymentKit] Session response missing card_tokenization_mode \u2014 defaulting to direct mode");
           paymentKitStates.cardTokenizationMode = "direct";
@@ -6583,6 +6646,13 @@ var PaymentKit = (() => {
       });
     };
     const cleanup = () => {
+      for (const scriptId of paymentKitStates._fraudScriptIds) {
+        const script = document.getElementById(scriptId);
+        if (script) {
+          script.remove();
+        }
+      }
+      paymentKitStates._fraudScriptIds = [];
       for (const pm of pmInstances) {
         if (pm.internalFuncs.cleanup) {
           pm.internalFuncs.cleanup();
@@ -7023,21 +7093,21 @@ var PaymentKit = (() => {
       closeButton.setAttribute("aria-label", "Cancel verification");
       closeButton.setAttribute("type", "button");
       closeButton.style.cssText = `
-      position: absolute;
-      top: -40px;
-      right: 0;
-      width: 32px;
-      height: 32px;
-      border: none;
-      background: white;
-      border-radius: 8px;
-      cursor: pointer;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      z-index: 10;
-      transition: background 0.15s ease;
-      box-shadow: 0 2px 8px rgba(0, 0, 0, 0.15);
+      position: absolute !important;
+      top: 8px !important;
+      right: 8px !important;
+      width: 32px !important;
+      height: 32px !important;
+      border: none !important;
+      background: white !important;
+      border-radius: 8px !important;
+      cursor: pointer !important;
+      display: flex !important;
+      align-items: center !important;
+      justify-content: center !important;
+      z-index: 10 !important;
+      transition: background 0.15s ease !important;
+      box-shadow: 0 2px 8px rgba(0, 0, 0, 0.15) !important;
     `;
       closeButton.innerHTML = `
       <svg width="12" height="12" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">
@@ -7045,10 +7115,10 @@ var PaymentKit = (() => {
       </svg>
     `;
       closeButton.onmouseenter = () => {
-        closeButton.style.background = "#f5f5f5";
+        closeButton.style.setProperty("background", "#f5f5f5", "important");
       };
       closeButton.onmouseleave = () => {
-        closeButton.style.background = "white";
+        closeButton.style.setProperty("background", "white", "important");
       };
       const iframe = document.createElement("iframe");
       iframe.src = url;
@@ -7093,9 +7163,7 @@ var PaymentKit = (() => {
           container.style.opacity = "0";
           container.style.transform = "scale(0.95) translateY(10px)";
           setTimeout(() => {
-            if (overlay.parentNode) {
-              overlay.parentNode.removeChild(overlay);
-            }
+            overlay.remove();
           }, 250);
         });
       };
@@ -7643,12 +7711,7 @@ var PaymentKit = (() => {
       console.log("[ApplePay] Airwallex prepared state:", preparedAirwallexState);
       return { success: true, applePay: true };
     }
-    const startResult = await callStripeStartEndpoint(
-      apiBaseUrl,
-      secureToken,
-      options,
-      checkoutRequestId
-    );
+    const startResult = await callStripeStartEndpoint(apiBaseUrl, secureToken, options, checkoutRequestId);
     if (startResult.error || !startResult.data) {
       return { success: false, error: startResult.error || "Failed to start Apple Pay" };
     }
@@ -7981,12 +8044,7 @@ var PaymentKit = (() => {
             preparedAirwallexState = null;
           }
         }
-        const startResult = await callStripeStartEndpoint(
-          apiBaseUrl,
-          secureToken,
-          applePayOptions,
-          checkoutRequestId
-        );
+        const startResult = await callStripeStartEndpoint(apiBaseUrl, secureToken, applePayOptions, checkoutRequestId);
         if (startResult.error || !startResult.data) {
           return { errors: { apple_pay: startResult.error || "Failed to start Apple Pay" } };
         }
@@ -8485,10 +8543,7 @@ var PaymentKit = (() => {
           cleanupDirect = () => {
             const connection = cardInputConnections[type];
             connection?.destroy();
-            try {
-              parent.removeChild(iframe);
-            } catch {
-            }
+            iframe.remove();
             states.cardInputConnections[type] = void 0;
           };
           parent.appendChild(iframe);
@@ -8530,7 +8585,7 @@ var PaymentKit = (() => {
       const requestOptions = withRequestId(checkoutRequestId);
       const tunnelX = await TunnelXManager.createFromPenpalConnection(states.tunnelXConnection);
       const skipCustomerValidation = options?.skipCustomerValidation === true;
-      const validateFormResult = skipCustomerValidation ? { isSuccess: true } : await validateFormFields(fields);
+      const validateFormResult = skipCustomerValidation ? { isSuccess: true, errors: {} } : await validateFormFields(fields);
       if (!isVgsMode) {
         const validateCardResult = await validateCardFields(states);
         if (!(validateCardResult.isSuccess && validateFormResult.isSuccess)) {
@@ -8576,13 +8631,19 @@ var PaymentKit = (() => {
       }
       console.log("Card setup intent is set \u2705", cardSetupIntent);
       console.log("Fields", fields);
+      const fraudMetadata = {
+        ...collectFraudMetadata(),
+        processorFraudInfo: {
+          airwallexDeviceId: states.checkoutRequestId
+        }
+      };
       let currentResult = await tunnelX.publicEndpoints.cardCheckout(
         {
           checkoutToken: states.secureToken,
           publicCardCheckoutRequest: {
             cardSetupIntentId: states.cardSetupIntentId,
             customerInfo: mapFieldsToCustomerInfo(fields),
-            fraudMetadata: collectFraudMetadata()
+            fraudMetadata
           }
         },
         requestOptions
@@ -8805,6 +8866,12 @@ var PaymentKit = (() => {
       return { errors, isSuccess: false };
     }
     const { pan_alias, cvc_alias, exp_month, exp_year } = cardResult.data.attributes;
+    if (!cvc_alias) {
+      console.warn(
+        `${logPrefix} VGS createCard response missing cvc_alias (303 dedup):`,
+        JSON.stringify(cardResult.data.attributes)
+      );
+    }
     const fullYear = exp_year < 100 ? 2e3 + exp_year : exp_year;
     const formattedExp = `${String(exp_month).padStart(2, "0")}/${fullYear}`;
     const cmpCardId = cardResult.data.id;
@@ -8815,7 +8882,7 @@ var PaymentKit = (() => {
         updateCardSetupIntentReq: {
           cardPan: pan_alias,
           cardExp: formattedExp,
-          cardCvc: cvc_alias,
+          ...cvc_alias ? { cardCvc: cvc_alias } : {},
           cmpCardId,
           fraudMetadata: collectFraudMetadata()
         }
@@ -9217,12 +9284,41 @@ var PaymentKit = (() => {
     }
     return { data: await response.json() };
   }
-  function validateOptions2(options) {
-    if (!options?.processorId) {
+  function validateOptions2(options, autoPrepareConfig) {
+    if (!options?.processorId && !autoPrepareConfig?.processorId) {
       return { processor_id: "Processor ID is required" };
     }
     return null;
   }
+  async function checkGooglePayAvailability() {
+    if (!window.google?.payments?.api?.PaymentsClient) {
+      console.log("[GooglePay] Google Pay API not loaded");
+      return false;
+    }
+    try {
+      const client = new window.google.payments.api.PaymentsClient({
+        environment: "TEST"
+      });
+      const request = {
+        apiVersion: 2,
+        apiVersionMinor: 0,
+        allowedPaymentMethods: [
+          {
+            type: "CARD",
+            parameters: {
+              allowedAuthMethods: ["PAN_ONLY", "CRYPTOGRAM_3DS"],
+              allowedCardNetworks: ["VISA", "MASTERCARD", "AMEX", "DISCOVER", "JCB"]
+            }
+          }
+        ]
+      };
+      const response = await client.isReadyToPay(request);
+      return response.result;
+    } catch (error) {
+      console.error("[GooglePay] availability check error:", error);
+      return false;
+    }
+  }
   function getMockScenarioStr2(mockScenario) {
     return mockScenario && mockScenario !== "none" /* None */ ? mockScenario : void 0;
   }
@@ -9456,14 +9552,19 @@ var PaymentKit = (() => {
     }
     return toGooglePayResult(response, secureToken);
   }
-  var defSubmitPayment3 = (states) => {
+  var defSubmitPayment3 = (states, getAutoPrepareConfig) => {
     const submitPayment = async (_fields, options) => {
       const { apiBaseUrl, secureToken, environment } = states;
       const gpayOptions = options;
-      const validationError = validateOptions2(gpayOptions);
+      const autoPrepareConfig = getAutoPrepareConfig();
+      const validationError = validateOptions2(gpayOptions, autoPrepareConfig);
       if (validationError) {
         return { errors: validationError };
       }
+      const effectiveOptions = {
+        ...gpayOptions,
+        processorId: gpayOptions.processorId || autoPrepareConfig?.processorId || ""
+      };
       try {
         const mockScenarioStr = getMockScenarioStr2(gpayOptions.mockScenario);
         const checkoutRequestId = getOrCreateCheckoutRequestId(environment);
@@ -9471,7 +9572,7 @@ var PaymentKit = (() => {
         const startResult = await callStartEndpoint(
           apiBaseUrl,
           secureToken,
-          gpayOptions,
+          effectiveOptions,
           mockScenarioStr,
           checkoutRequestId
         );
@@ -9517,12 +9618,113 @@ var PaymentKit = (() => {
     return submitPayment;
   };
   var GooglePayPaymentMethod = definePaymentMethod((paymentKitStates) => {
+    const { apiBaseUrl, secureToken, environment } = paymentKitStates;
+    let autoPrepareConfig = null;
+    let onGooglePayReadyCallbacks = [];
+    let isGooglePayReadyState = false;
+    let autoPrepareInProgress = false;
+    let cleanupGeneration = 0;
+    let pendingAutoPrepareArgs = null;
+    let pendingPrepareResolvers = [];
+    function instanceSetGooglePayReady(ready) {
+      isGooglePayReadyState = ready;
+      for (const cb of onGooglePayReadyCallbacks) cb(ready);
+    }
+    function instanceClearPreparedGooglePay() {
+      instanceSetGooglePayReady(false);
+    }
+    async function instanceAutoPrepare(apBase, sToken, env) {
+      if (autoPrepareInProgress) {
+        pendingAutoPrepareArgs = { apiBaseUrl: apBase, secureToken: sToken, environment: env };
+        return new Promise((resolve) => pendingPrepareResolvers.push(resolve));
+      }
+      autoPrepareInProgress = true;
+      const capturedGeneration = cleanupGeneration;
+      instanceSetGooglePayReady(false);
+      try {
+        const result = await apiCall2(`${apBase}/api/checkout-sessions/token/${sToken}`, {
+          method: "GET"
+        });
+        if (cleanupGeneration !== capturedGeneration) return;
+        if (result.error || !result.data) {
+          console.warn("[GooglePay] Auto-prepare: failed to fetch session config:", result.error);
+          return;
+        }
+        const processorId = result.data.express_checkout_processor_id;
+        if (!processorId) {
+          console.log("[GooglePay] Auto-prepare: no express checkout processor configured");
+          return;
+        }
+        const processorTypeRaw = result.data.express_checkout_processor_type;
+        const processorType = processorTypeRaw === "airwallex" || processorTypeRaw === "stripe" ? processorTypeRaw : void 0;
+        autoPrepareConfig = { processorId, processorType };
+        const isAvailable = await checkGooglePayAvailability();
+        if (cleanupGeneration !== capturedGeneration) return;
+        instanceSetGooglePayReady(isAvailable);
+      } catch (err) {
+        if (cleanupGeneration === capturedGeneration) {
+          console.error("[GooglePay] Auto-prepare failed:", err);
+        }
+      } finally {
+        autoPrepareInProgress = false;
+        const stale = cleanupGeneration !== capturedGeneration;
+        const pending = pendingAutoPrepareArgs;
+        const resolvers = pendingPrepareResolvers.splice(0);
+        if (!stale && pending) {
+          pendingAutoPrepareArgs = null;
+          instanceAutoPrepare(pending.apiBaseUrl, pending.secureToken, pending.environment).then(() => {
+            for (const r2 of resolvers) r2();
+          });
+        } else {
+          pendingAutoPrepareArgs = null;
+          for (const r2 of resolvers) r2();
+        }
+      }
+    }
+    instanceAutoPrepare(apiBaseUrl, secureToken, environment).catch(
+      (err) => console.error("[GooglePay] Unhandled init error:", err)
+    );
     return {
       name: "google_pay",
-      externalFuncs: {},
+      externalFuncs: {
+        /**
+         * Register a callback to be notified when Google Pay becomes ready (or stops being ready).
+         * Fires immediately with the current state, then on every state change.
+         * Multiple registrations are all notified — none are silently overwritten.
+         *
+         * @example
+         * paymentKit.google_pay.onGooglePayReady((isReady) => {
+         *   googlePayButton.disabled = !isReady;
+         * });
+         */
+        onGooglePayReady: (callback) => {
+          onGooglePayReadyCallbacks.push(callback);
+          callback(isGooglePayReadyState);
+        },
+        /**
+         * Notify the SDK that the payment amount has changed (e.g. coupon applied).
+         * The SDK will disable Google Pay, re-prepare with the new amount, then re-enable.
+         * The returned promise resolves when re-prepare is fully complete.
+         *
+         * @example
+         * await paymentKit.google_pay.notifyAmountChanged();
+         */
+        notifyAmountChanged: () => {
+          instanceClearPreparedGooglePay();
+          autoPrepareConfig = null;
+          return instanceAutoPrepare(apiBaseUrl, secureToken, environment);
+        }
+      },
       internalFuncs: {
-        submitPayment: defSubmitPayment3(paymentKitStates),
+        submitPayment: defSubmitPayment3(paymentKitStates, () => autoPrepareConfig),
         cleanup: () => {
+          cleanupGeneration++;
+          onGooglePayReadyCallbacks = [];
+          isGooglePayReadyState = false;
+          autoPrepareConfig = null;
+          pendingAutoPrepareArgs = null;
+          pendingPrepareResolvers = [];
+          autoPrepareInProgress = false;
         }
       }
     };