Interface PayZenClientAdapterConfig

A Content-Security-Policy nonce for the three tags the adapter injects, the krypton-client <script> and, once it has loaded, the theme stylesheet <link> and theme <script>, set as their nonce attribute before insertion, so a script-src or style-src that allows them by nonce alone loads them. krypton-client reads no nonce itself. It adds scripts to the page without one: its kr-asset-* chunks, Apple's Apple Pay SDK when the smartForm offers Apple Pay with production keys (test keys show a simulator and load no Apple script), and a risk-analysis script when the form token names one. The theme stylesheet's Google Fonts @imports carry none either, nor does the kr-base-styles <style> it adds when a form mounts, which a nonce in style-src therefore blocks. Pass the value alone, as in the policy's 'nonce-<value>' source; the constructor refuses anything else. The adapter never reads a nonce from the page, and a loadScript seam loads the files without it.

Theme stylesheet URL; defaults to neon-reset.min.css, which PayZen says "Applies the neon theme by forcing the styles (!important)". Injected once the script has loaded, and never awaited. An empty string loads no theme stylesheet, which PayZen documents as optional.

Explicit, mirrors the server adapter. PayZen selects TEST/LIVE by the key set.

Form to render on mount — see PayZenFormMode. Default "embedded" (card-only, host-button-driven), the pre-smartForm behavior.

Test seam: KR global lookup override.

Test seam: full asset injection (script, stylesheet and theme script) override. Called again by the next loadSdk() after an attempt that rejects or leaves the KR global missing, so it must be safe to call more than once.

Wallet/APM enablement varies per shop contract — override the conservative card-only default in lock-step with the server adapter once the Back Office lists the contract. Overrides wholesale.

Back Office "Public key" (kr-public-key), format shopId:testpublickey_… — browser-safe.

krypton-client script URL — per-shop config in the Back Office, not a constant.

Theme script URL. PayZen calls a theme's script its active part: neon.js sets the button template, the field icons and the theme's form settings as window.KR_CONFIGURATION, which krypton-client reads when a form is set up (a form, a smartForm and their pop-ins). It defaults to neon.js only while scriptUrl and cssUrl are the default files, as the three come as a set; a host that points either elsewhere loads no theme script unless it sets this too, so its own styling is not overlaid. A host with its own library sets cssUrl and this together, next to that library. Injected once the script has loaded, as PayZen's pages load it, and waited for before loadSdk() resolves; one that fails to load only leaves the theme's active part out. An empty string loads none. When a theme script has set window.KR_CONFIGURATION, krypton-client checks that the theme's version is the library's, that a stylesheet named after the theme on the page and the script, found by its file name (neon.js, classic.js, material.js), come from the library's domain, and reports a mismatch. material.js also turns the smartForm off (CLIENT_505).