1.0.0

🚀 UPC 1.0.0

This release adds asynchronous webhook/3DS confirmation, synchronous hosted-fields payment
creation, and completes the 3DS-pending redirect flow — the first release with a real end-to-end
payment path, from creation through the bank's 3DS challenge to the final webhook confirmation.

💥 Breaking Changes

No CMS plugin has integrated against UPC yet, so these carry no runtime blast radius today.

• 📦 Models/ → DataValues/ + Output/ — the category is gone; PaymentOutcome/
  OperationData moved to DataValues/ (durable state), Token→TokenOutput,
  AuthorizationRequest→AuthorizationRequestOutput, and the new HostedPaymentResult→
  HostedPaymentOutput moved to Output/ (call-result value objects)
• ✍️ createHostedPayment() signature — replaced its original 11 positional parameters with
  a single validated HostedFieldDto

✨ Highlights

• 🔔 Webhook / 3DS confirmation (PRE-3588) — WebhookNotificationHelper verifies an inbound
  "Payment Operation" notification's Authorization header (constant-time comparison) and parses
  its body into an OperationData, mapping execCode to a PaymentOutcome via the new
  ExecCodeMapper; throws the new InvalidNotificationException on a missing/invalid signature,
  malformed body, or invalid field
• 💳 Hosted-fields payment creation (PRE-3587) — UnifiedApiHostedPaymentService:: createHostedPayment() creates/confirms a payment from an hfToken against the Unified API,
  distinguishing a direct success from a pending 3DS/SCA redirect; new Dto/ (HostedFieldDto,
  CommonFieldsDto, BrowserDto, CustomerDto) and Validators/ (HostedFieldDtoValidator,
  CommonFieldsDtoValidator) categories back the validated input
• 🔁 Completing the 3DS-pending redirect (PRE-3551) — CommonFieldsDto gains successUrl/
  cancelUrl (nested under a redirect object, the merchant-return URLs after the bank's
  challenge); HostedPaymentOutput gains redirectHtml alongside redirectUrl, decoding the
  Unified API's default Base64-encoded redirect.html self-submitting challenge form
• 🏬 Marketplace routing — submerchantExternalId added as a required CommonFieldsDto field

✅ Quality

216 tests / 517 assertions, PHPStan level 8, PHP-CS-Fixer, and CI verifying PHP 7.1–8.2
compatibility — all clean on this release branch.

📋 Requirements

• PHP ≥7.4 to install/develop (build-tooling floor only — shipped source runs on PHP 7.1)
• Runtime dependency: giggsey/libphonenumber-for-php

🔗 Full Changelog: 0.1.0...1.0.0