• Improved pub.flutter-io.cn discovery with a search-focused description, five relevant topics, an integration-architecture thumbnail, current install commands, and a clearer explanation of tokenized versus direct Flutter integration.
• Added tag-based GitHub OIDC publishing support; no long-lived pub token is required after the package admin enables trusted publishing.

• Fixed LICENSE: it had the standard MIT text plus a custom disclaimer appended after it, which broke automated license recognition (pub.flutter-io.cn scored it 0/10 for "Use an OSI-approved license"). LICENSE is now pure MIT text; the disclaimer's content was already covered by this README's License section and the root repo's SECURITY.md.

First stable release: the in-app client layer, covering Mode 2 (tokenize client-side, charge server-side) and Mode 3 (opt-in direct charge). Plain Dart, no WebView dependency and no widgets of its own: see the README.

• Test suite (35 tests) covers 100% of lib/.
• The Accept.js bridge now reports script-loading and malformed-response failures through the typed channel contract instead of failing silently.
• AcceptHostedMessage.transactionId is exposed only for a transactResponse action, and never as an empty string.
• buildAcceptJsHtml() / buildAcceptJsTokenizeCall() / parseAcceptJsMessage(): a headless Accept.js bridge. The HTML page defines no form fields; collect card details with your own widgets and call runJavaScript(buildAcceptJsTokenizeCall(...)) on your own WebViewController.
• buildAcceptHostedHtml() / buildAcceptHostedCommunicatorHtml() / parseAcceptHostedMessage(): Accept Hosted's documented iframe communicator contract, including query-string callback parsing and an Authorize.Net-origin filter.
• AuthNetDirectCharge: Mode 3's gated direct-charge wrapper. Refuses to construct unless acknowledgeClientSecretRisk: true is passed explicitly, checked before its underlying AuthNetClient is created. Forwards authnet_core's charge-family operations plus an escape-hatch .client getter for everything else.
• applePayOpaqueData() / googlePayOpaqueData(): build the OpaqueData Authorize.Net expects from a wallet payment result. No decryption needed; Authorize.Net accepts the wallet's own token as opaque data.
• Every HTML/JS builder escapes embedded values against breaking out of their <script>/JS-call context, including mixed-case HTML end tags.
• New authnet_core dependencies: AuthNetClient.getHostedPaymentPageToken(), .getHostedProfilePageToken(), .authenticate(), AuthNetConfig.hostedFormUrl.
• Accept.js refuses to tokenize a page with no HTTPS origin, which is exactly what loadHtmlString() gives it without a baseUrl. The README and example now pass baseUrl: 'https://...'; see buildAcceptJsHtml()'s dartdoc.

The JS bridge (script loading, authnetTokenize(), and the response round-tripping through parseAcceptJsMessage()) has been run end-to-end against the real sandbox Accept.js in a headless browser. That doesn't cover the exact flow inside a mobile WebView on a device; see the README.