v0.1.1

The same two Hosted Fields examples as v0.1.0, now built for a laptop as well as a server.

What the examples show

Card number, expiry and CVV are iframes served by the payment gateway, so the card never reaches
the merchant server. Everything around them is the merchant's: the layout, the light and dark
themes, the result panel — and one of the merchant's own inputs, the cardholder name, sitting
between the gateway's fields in the same visual row. A redirect to a hosted payment page cannot
do that.

Both examples cover the whole flow: the single-use ephemeral ticket, tokenization, the Sale with
hosted_fields_token, status polling, and the 3DS return whose control checksum is verified
before the page renders. The browser half is byte-for-byte identical between the two.

Artefacts

File	Contents	Requires
hosted-fields-examples-go_v0.1.1_linux_amd64.tar.gz	static binary with the pages compiled in, plus deploy/	nothing
hosted-fields-examples-go_v0.1.1_linux_arm64.tar.gz	the same, for arm64	nothing
hosted-fields-examples-go_v0.1.1_darwin_arm64.tar.gz	the same, for Apple silicon	nothing
hosted-fields-examples-go_v0.1.1_windows_amd64.zip	the same, as .exe	nothing
hosted-fields-examples-nodejs-express-js_v0.1.1.tar.gz	bundled server.js with public/, views/ and deploy/	Node 20+, no node_modules

Verify with sha256sum -c SHA256SUMS.

The macOS and Windows builds carry no deploy/: the systemd unit and the nginx snippet are for a
Linux server, and these builds are for trying the example locally.

The macOS binary is not signed or notarised. Downloaded through a browser it arrives quarantined,
and Gatekeeper will refuse to start it until the attribute is cleared:

xattr -d com.apple.quarantine hosted-fields-examples-go

Running one

Every setting comes from the environment and none of them has a default: the app refuses to start
until the gateway URLs, the endpoint, the merchant login, the control key and the RSA private key
are all provided. See deploy/*.env.example in the Linux archive, and the README for what to ask
the gateway for.

Each app mounts everything under a URL prefix, so several of them fit behind one nginx.

Notes

• The RSA key signs the server calls and never leaves the server. It is not in this repository
  and must not be committed.
• Field validation messages the payer sees come from the SDK the gateway serves, not from this
  code. To show them in a language of your own, switch on error.code rather than printing
  error.payerMessage.

Changes since v0.1.0

• Release binaries for Windows x64 and macOS arm64.