Changelog

0.14.0 2026-10-26

The CLI and the engine are on npm as one package, pandapaylens: npx pandapaylens analyze events.json, or import { analyze } from "pandapaylens".
The package has no runtime dependencies and ships its TypeScript types; CI installs the packed package before every release.
Official documentation links are checked once a month.

Plain text with one name: value pair per line is read, pasted alone or as a text/plain response body.
Verotel FlexPay status pages are analyzed as a snapshot of the sale.
Billing and shipping address groups are hidden, and form fields named like built-in object members are read correctly.

Worldpay WPG and cnpAPI XML responses and notifications are analyzed.
Event times are used only with a time zone; times read as UTC because the provider documents no zone are marked "UTC assumed".
Findings show documentation links for every provider, and the unsafe retry finding links more providers' idempotency pages.
Checkout.com no longer appears as a strong alternative for Razorpay payment ids.

XML input is read safely: no DOCTYPE or entity declarations, bounded depth, element count and text length.
XML responses are analyzed for emerchantpay, Skrill, Authorize.net, BlueSnap and Inpay (ISO 20022 status reports).
The getting-started page lists every accepted input format, and the demo has two XML examples.

Identical records from providers without a delivery id are recognized as a possible repeated delivery and counted once, so a refund delivered twice no longer looks like two refunds.

Provider list grouped by support level, and an Analyze as <provider> button for records that resemble a provider.
Official documentation links are shown for every provider's decoded errors.
Events without their own timestamp stay where they occurred in the timeline.
Redaction covers the sensitive fields of the newer providers, including Flutterwave's verif-hash header, provider keys and UPI ids.
Text redaction and the PayU India scrubber run in linear time on any input.

New adapters with limited support: BlueSnap, PayU India, Razorpay, Paystack and Flutterwave.
40 of 42 roadmap providers can now be analyzed; Pavilion Payments and Epoch publish no developer documentation.

New adapters with limited support: Worldpay (Access Worldpay JSON), Cybersource, Authorize.net and Nuvei.
30 of 42 roadmap providers can now be analyzed.
Events linked by a transaction or root id are no longer reported as missing a reference.
Redaction covers more card, track and credential field names.

Documentation verified for Worldpay, Cybersource, Authorize.net and Nuvei; adapters are next.
Plain-text HTTP error bodies are passed to adapters, and HTML error pages keep their status code.
DECTA decodes its documented plain-text error texts when DECTA is selected.
The repeated-attempt retry finding gives payout and non-card advice instead of card-only advice.

High-risk wave HR-3 with limited support: Finrax (crypto payments and payouts), Inpay (bank transfers and payouts), DECTA (card acquiring) and Trustly (pay-by-bank, EU and North America).
Underpaid crypto payments are shown as an unknown outcome, never as a success.
JSON with trailing commas or comments, as in provider documentation examples, is accepted with a warning.
26 of 42 roadmap providers can now be analyzed.

High-risk wave HR-2 with limited support: emerchantpay, Ecommpay, Paymentwall, NMI, MiFinity, AstroPay, Skrill and eZeeWallet.
Form examples split over lines that start with & are joined; form bodies labelled text/plain or text/html are parsed.
XML input is reported as an unsupported format instead of a JSON error.
Status responses that list past operations are no longer reported as out-of-order arrivals (rule catalog 2026.10.2).

High-risk wave HR-1 with limited support: CCBill, Segpay, Verotel, NETbilling, PXP Financial and Trust Payments.
Qualification gate for all 20 high-risk candidates: 18 documentation verified, 2 blocked.
Lifecycle rules for rebills, chargebacks, payouts, refunds and amount mismatches.
GET callbacks, pasted callback URLs and status-only error responses are analyzed.
New logo and provider directory filters for high-risk categories.

Analysis engine for JSON, JSON Lines, URL-encoded form data and raw HTTP messages, with provider detection, correlation and deterministic rules (catalog 2026.10.0).
Error decoder, timeline with filters, data inspector, findings and JSON/Markdown/PNG export.
Supported providers: Stripe and Adyen. Limited support: payabl., Checkout.com, PayPal, Braintree, Mollie and Square.
Provider directory with capability status for all 22 roadmap providers.
GitHub Pages demo built from the same pages and engine.
Optional admin area for the hosted app: magic link sign-in, passkey MFA, RBAC and audit log.
Offline CLI with a configurable failure threshold.