@amos.com/amos-js 0.10.1 → 0.10.3

package/dist/jwt.d.ts

@@ -12,5 +12,9 @@ export declare function decodeJwt(token: string | undefined): {
 /**
  * Resolve the Amos embed origin (production vs. sandbox) from a render
  * token's decoded payload.
+ *
+ * When the parent page is on localhost / *.localhost, always target the
+ * local embed app (https://embed.localhost) so dashboard + embed can be
+ * developed together without pointing at sandbox/production iframes.
  */
 export declare function getEmbedOrigin(renderToken: string): string;

package/dist/log.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Forward an info log to the embed iframe so Rollbar records it with
+ * Amos credentials. Payload shape matches dashboard/embed API traces:
+ * `endpoint`, `headers`, `body`.
+ */
+export declare function reportParentInfoLog({ iframe, message, endpoint, headers, body, }: {
+    iframe: HTMLIFrameElement;
+    message: string;
+    endpoint: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+}): void;

package/dist/mount.d.ts

@@ -85,9 +85,22 @@ export type AmosBankAccountPaymentMethodFormOptions = PaymentMethodFormListenerO
      * `"0"`, which is typically under the threshold so Connect / Plaid
      * stays hidden until the host passes a real charge.
      *
+     * Ignored when {@link AmosBankAccountPaymentMethodFormOptions.intent}
+     * is `"setup"` — setup intents always show Connect (unless the render
+     * token disables Plaid verification).
+     *
      * @default "0"
      */
     amount?: string;
+    /**
+     * `"setup"` saves a bank account for later charges and always shows
+     * Connect / Plaid (no merchant threshold lookup). `"payment"`
+     * compares {@link AmosBankAccountPaymentMethodFormOptions.amount} to
+     * the merchant ACH threshold.
+     *
+     * @default "payment"
+     */
+    intent?: "payment" | "setup";
 };
 /**
  * Mount the secure bank-account payment method form into a container
@@ -98,7 +111,8 @@ export type AmosBankAccountPaymentMethodFormOptions = PaymentMethodFormListenerO
  * Connect bank button is rendered in the parent document and Plaid Link
  * is opened on click. `amount` defaults to `"0"`, which is typically
  * under the threshold so Connect stays hidden on open-amount forms
- * until the host passes a real charge. The button uses the same
+ * until the host passes a real charge. Pass `intent: "setup"` to always
+ * show Connect without a merchant lookup. The button uses the same
  * `appearance.themeVariables` as the iframe (and inherits host-page
  * tokens when those variables are unset). Otherwise a field-shaped
  * skeleton is shown and replaced by the iframe once appearance is applied.

package/dist/payment-method-form.d.ts

@@ -22,8 +22,11 @@ export type BillingAddressRequirement = "country" | "full";
 export declare function getCreditCardFormSrc(renderToken: string, additionalFields?: CreditCardAdditionalFields, billingAddressRequirement?: BillingAddressRequirement): string;
 /**
  * Build the iframe `src` URL for the embedded bank-account form.
+ *
+ * Pass `intent: "setup"` so the iframe always requires Plaid (when the
+ * render token allows it) and does not `GET /merchants` for a threshold.
  */
-export declare function getBankAccountFormSrc(renderToken: string, billingAddressRequirement?: BillingAddressRequirement): string;
+export declare function getBankAccountFormSrc(renderToken: string, billingAddressRequirement?: BillingAddressRequirement, intent?: "payment" | "setup"): string;
 /**
  * Default iframe pixel height for the credit-card form, taking the
  * configured `additionalFields` and `billingAddressRequirement` into

package/dist/types.d.ts

@@ -248,10 +248,11 @@ export type Message = {
     brand: CardBrand | null;
 } | {
     /**
-     * Embed → parent: merchant ACH verification threshold for this
-     * render token. `achThreshold` is cents, or `null` when the
-     * merchant has no threshold (manual ACH). `requireVerification`
-     * is true when the fetch failed in production (fail closed).
+     * Embed → parent: ACH verification policy for this bank iframe.
+     * `achThreshold` is cents, or `null` when the merchant has no
+     * threshold (manual ACH). `requireVerification` is true for setup
+     * intents (always Plaid, no merchant lookup), and when a payment
+     * threshold fetch failed in production (fail closed).
      */
     type: "ACH_THRESHOLD";
     achThreshold?: number | null;
@@ -266,6 +267,16 @@ export type Message = {
     requestId: string;
     link_token?: string;
     error?: string;
+} | {
+    /**
+     * Parent → embed: info telemetry for Rollbar. The iframe reports
+     * `message` with `endpoint`, `headers`, and `body`.
+     */
+    type: "PARENT_INFO_LOG";
+    message: string;
+    endpoint?: string;
+    headers?: Record<string, string>;
+    body?: unknown;
 };
 /**
  * Identity helper that brands an object as a typed `Message`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amos.com/amos-js",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "main": "dist/index.js",
   "repository": {
     "type": "git",
@@ -35,11 +35,8 @@
   "author": "Amos",
   "license": "MIT",
   "description": "Amos JavaScript SDK for embedding payment methods via iframes.",
-  "peerDependencies": {
-    "@amos.com/node": ">=0.1.39"
-  },
   "devDependencies": {
-    "@amos.com/node": "0.1.39",
+    "@amos.com/node": "0.1.50",
     "@biomejs/biome": "2.5.7",
     "@changesets/cli": "2.31.1",
     "@types/node": "26.1.2",
@@ -50,5 +47,8 @@
   },
   "dependencies": {
     "@types/googlepay": "0.7.11"
+  },
+  "peerDependencies": {
+    "@amos.com/node": ">=0.1.50"
   }
 }

package/src/jwt.ts

@@ -25,11 +25,35 @@ export function decodeJwt(token: string | undefined): {
   };
 }
 
+// --- BEGIN amos-ui sdk:link localhost embed origin ---
+/**
+ * True when the parent page is running on localhost / *.localhost
+ * (e.g. https://dashboard.localhost via portless).
+ *
+ * Injected by amos-ui `pnpm sdk:link`; removed by `pnpm sdk:unlink`.
+ * Do not commit this block to amos-js.
+ */
+function isLocalhostParent(): boolean {
+  if (typeof window === "undefined") {
+    return false;
+  }
+  const { hostname } = window.location;
+  return hostname === "localhost" || hostname.endsWith(".localhost");
+}
+
 /**
  * Resolve the Amos embed origin (production vs. sandbox) from a render
  * token's decoded payload.
+ *
+ * When the parent page is on localhost / *.localhost, always target the
+ * local embed app (https://embed.localhost) so dashboard + embed can be
+ * developed together without pointing at sandbox/production iframes.
  */
 export function getEmbedOrigin(renderToken: string): string {
+  if (isLocalhostParent()) {
+    return "https://embed.localhost";
+  }
+
   const { env = "sandbox" }: components["schemas"]["RenderTokenJwt"] =
     decodeJwt(renderToken).payload;
 
@@ -42,3 +66,4 @@ export function getEmbedOrigin(renderToken: string): string {
       return "https://embed-sandbox.amos.com";
   }
 }
+// --- END amos-ui sdk:link localhost embed origin ---

package/src/log.ts

@@ -0,0 +1,74 @@
+import { createMessage } from "./types";
+
+const SENSITIVE_HEADER_NAMES = new Set([
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+]);
+
+const SENSITIVE_BODY_KEYS = new Set([
+  "authorization",
+  "encrypted_account_number",
+  "link_token",
+  "public_token",
+  "token",
+]);
+
+function redactHeaders(
+  headers: Record<string, string>,
+): Record<string, string> {
+  const redacted: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    redacted[key] = SENSITIVE_HEADER_NAMES.has(key.toLowerCase())
+      ? "[REDACTED]"
+      : value;
+  }
+  return redacted;
+}
+
+function redactBody(body: unknown): unknown {
+  if (Array.isArray(body)) {
+    return body.map(redactBody);
+  }
+  if (body !== null && typeof body === "object") {
+    const redacted: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(body)) {
+      redacted[key] = SENSITIVE_BODY_KEYS.has(key)
+        ? "[REDACTED]"
+        : redactBody(value);
+    }
+    return redacted;
+  }
+  return body;
+}
+
+/**
+ * Forward an info log to the embed iframe so Rollbar records it with
+ * Amos credentials. Payload shape matches dashboard/embed API traces:
+ * `endpoint`, `headers`, `body`.
+ */
+export function reportParentInfoLog({
+  iframe,
+  message,
+  endpoint,
+  headers = {},
+  body,
+}: {
+  iframe: HTMLIFrameElement;
+  message: string;
+  endpoint: string;
+  headers?: Record<string, string>;
+  body?: unknown;
+}): void {
+  iframe.contentWindow?.postMessage(
+    createMessage({
+      type: "PARENT_INFO_LOG",
+      message,
+      endpoint,
+      headers: redactHeaders(headers),
+      body: redactBody(body),
+    }),
+    new URL(iframe.src).origin,
+  );
+}

package/src/messaging.ts

@@ -1,5 +1,6 @@
 import type { components } from "@amos.com/node";
 import { decodeJwt } from "./jwt";
+import { reportParentInfoLog } from "./log";
 import { getBankPlaidSession } from "./plaid-session";
 import {
   type Appearance,
@@ -292,6 +293,24 @@ function postConfirmIntent({
     resetIframeFields(iframe);
   }
 
+  const origin = getIframeTargetOrigin(iframe);
+  reportParentInfoLog({
+    iframe,
+    message:
+      type === "CONFIRM_PAYMENT_INTENT"
+        ? "confirmPaymentIntent"
+        : "confirmSetupIntent",
+    endpoint:
+      type === "CONFIRM_PAYMENT_INTENT"
+        ? "POST /embed/payment_intents/{id}/confirm_with_payment_method"
+        : "POST /embed/setup_intents/{id}/confirm_with_payment_method",
+    headers: {
+      origin: window.location.origin,
+      "iframe-origin": origin,
+    },
+    body: { id, token, ...(plaid ? { plaid } : {}) },
+  });
+
   iframe.contentWindow?.postMessage(
     createMessage({
       type,

package/src/mount.ts

@@ -514,9 +514,22 @@ export type AmosBankAccountPaymentMethodFormOptions =
      * `"0"`, which is typically under the threshold so Connect / Plaid
      * stays hidden until the host passes a real charge.
      *
+     * Ignored when {@link AmosBankAccountPaymentMethodFormOptions.intent}
+     * is `"setup"` — setup intents always show Connect (unless the render
+     * token disables Plaid verification).
+     *
      * @default "0"
      */
     amount?: string;
+    /**
+     * `"setup"` saves a bank account for later charges and always shows
+     * Connect / Plaid (no merchant threshold lookup). `"payment"`
+     * compares {@link AmosBankAccountPaymentMethodFormOptions.amount} to
+     * the merchant ACH threshold.
+     *
+     * @default "payment"
+     */
+    intent?: "payment" | "setup";
   };
 
 /**
@@ -528,7 +541,8 @@ export type AmosBankAccountPaymentMethodFormOptions =
  * Connect bank button is rendered in the parent document and Plaid Link
  * is opened on click. `amount` defaults to `"0"`, which is typically
  * under the threshold so Connect stays hidden on open-amount forms
- * until the host passes a real charge. The button uses the same
+ * until the host passes a real charge. Pass `intent: "setup"` to always
+ * show Connect without a merchant lookup. The button uses the same
  * `appearance.themeVariables` as the iframe (and inherits host-page
  * tokens when those variables are unset). Otherwise a field-shaped
  * skeleton is shown and replaced by the iframe once appearance is applied.
@@ -546,11 +560,12 @@ export function mountAmosBankAccountPaymentMethodForm(
     renderToken,
     billingAddressRequirement = "country",
     amount = "0",
+    intent = "payment",
     ...listenerOptions
   } = options;
 
   const iframe = createIframe({
-    src: getBankAccountFormSrc(renderToken, billingAddressRequirement),
+    src: getBankAccountFormSrc(renderToken, billingAddressRequirement, intent),
     title: "Secure bank account payment method form powered by Amos",
     name: "amos-bank-account-payment-method-form",
     height: getBankAccountFormInitialHeight(billingAddressRequirement),

package/src/payment-method-form.ts

@@ -68,15 +68,22 @@ export function getCreditCardFormSrc(
 
 /**
  * Build the iframe `src` URL for the embedded bank-account form.
+ *
+ * Pass `intent: "setup"` so the iframe always requires Plaid (when the
+ * render token allows it) and does not `GET /merchants` for a threshold.
  */
 export function getBankAccountFormSrc(
   renderToken: string,
   billingAddressRequirement: BillingAddressRequirement = "country",
+  intent: "payment" | "setup" = "payment",
 ): string {
   const params = new URLSearchParams({
     token: renderToken,
     billingAddressRequirement,
   });
+  if (intent === "setup") {
+    params.set("intent", "setup");
+  }
 
   return `${getEmbedOrigin(renderToken)}/iframe/bank?${params}`;
 }

package/src/plaid-bank-ui.ts

@@ -1,3 +1,4 @@
+import { reportParentInfoLog } from "./log";
 import { requestPlaidLinkToken } from "./messaging";
 import type { PaymentMethodFormListenerOptions } from "./payment-method-form";
 import {
@@ -309,6 +310,16 @@ export function attachPlaidBankUi({
     thresholdKnown = true;
     achThreshold = event.data.achThreshold ?? undefined;
     requireVerification = event.data.requireVerification === true;
+    reportParentInfoLog({
+      iframe,
+      message: "merchant ach_threshold",
+      endpoint: "ACH_THRESHOLD",
+      headers: { origin: event.origin },
+      body: {
+        achThreshold,
+        requireVerification,
+      },
+    });
     if (linked && !requiresConnect()) {
       unlink();
       return;

package/src/types.ts

@@ -536,10 +536,11 @@ export type Message =
     }
   | {
       /**
-       * Embed → parent: merchant ACH verification threshold for this
-       * render token. `achThreshold` is cents, or `null` when the
-       * merchant has no threshold (manual ACH). `requireVerification`
-       * is true when the fetch failed in production (fail closed).
+       * Embed → parent: ACH verification policy for this bank iframe.
+       * `achThreshold` is cents, or `null` when the merchant has no
+       * threshold (manual ACH). `requireVerification` is true for setup
+       * intents (always Plaid, no merchant lookup), and when a payment
+       * threshold fetch failed in production (fail closed).
        */
       type: "ACH_THRESHOLD";
       achThreshold?: number | null;
@@ -556,6 +557,17 @@ export type Message =
       requestId: string;
       link_token?: string;
       error?: string;
+    }
+  | {
+      /**
+       * Parent → embed: info telemetry for Rollbar. The iframe reports
+       * `message` with `endpoint`, `headers`, and `body`.
+       */
+      type: "PARENT_INFO_LOG";
+      message: string;
+      endpoint?: string;
+      headers?: Record<string, string>;
+      body?: unknown;
     };
 
 /**