@amos.com/amos-js 0.10.2 → 0.10.3

package/dist/jwt.d.ts

@@ -12,5 +12,9 @@ export declare function decodeJwt(token: string | undefined): {
 /**
  * Resolve the Amos embed origin (production vs. sandbox) from a render
  * token's decoded payload.
+ *
+ * When the parent page is on localhost / *.localhost, always target the
+ * local embed app (https://embed.localhost) so dashboard + embed can be
+ * developed together without pointing at sandbox/production iframes.
  */
 export declare function getEmbedOrigin(renderToken: string): string;

package/dist/log.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Forward an info log to the embed iframe so Rollbar records it with
+ * Amos credentials. Payload shape matches dashboard/embed API traces:
+ * `endpoint`, `headers`, `body`.
+ */
+export declare function reportParentInfoLog({ iframe, message, endpoint, headers, body, }: {
+    iframe: HTMLIFrameElement;
+    message: string;
+    endpoint: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+}): void;

package/dist/types.d.ts

@@ -267,6 +267,16 @@ export type Message = {
     requestId: string;
     link_token?: string;
     error?: string;
+} | {
+    /**
+     * Parent → embed: info telemetry for Rollbar. The iframe reports
+     * `message` with `endpoint`, `headers`, and `body`.
+     */
+    type: "PARENT_INFO_LOG";
+    message: string;
+    endpoint?: string;
+    headers?: Record<string, string>;
+    body?: unknown;
 };
 /**
  * Identity helper that brands an object as a typed `Message`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amos.com/amos-js",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "main": "dist/index.js",
   "repository": {
     "type": "git",

package/src/jwt.ts

@@ -25,11 +25,35 @@ export function decodeJwt(token: string | undefined): {
   };
 }
 
+// --- BEGIN amos-ui sdk:link localhost embed origin ---
+/**
+ * True when the parent page is running on localhost / *.localhost
+ * (e.g. https://dashboard.localhost via portless).
+ *
+ * Injected by amos-ui `pnpm sdk:link`; removed by `pnpm sdk:unlink`.
+ * Do not commit this block to amos-js.
+ */
+function isLocalhostParent(): boolean {
+  if (typeof window === "undefined") {
+    return false;
+  }
+  const { hostname } = window.location;
+  return hostname === "localhost" || hostname.endsWith(".localhost");
+}
+
 /**
  * Resolve the Amos embed origin (production vs. sandbox) from a render
  * token's decoded payload.
+ *
+ * When the parent page is on localhost / *.localhost, always target the
+ * local embed app (https://embed.localhost) so dashboard + embed can be
+ * developed together without pointing at sandbox/production iframes.
  */
 export function getEmbedOrigin(renderToken: string): string {
+  if (isLocalhostParent()) {
+    return "https://embed.localhost";
+  }
+
   const { env = "sandbox" }: components["schemas"]["RenderTokenJwt"] =
     decodeJwt(renderToken).payload;
 
@@ -42,3 +66,4 @@ export function getEmbedOrigin(renderToken: string): string {
       return "https://embed-sandbox.amos.com";
   }
 }
+// --- END amos-ui sdk:link localhost embed origin ---

package/src/log.ts

@@ -0,0 +1,74 @@
+import { createMessage } from "./types";
+
+const SENSITIVE_HEADER_NAMES = new Set([
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+]);
+
+const SENSITIVE_BODY_KEYS = new Set([
+  "authorization",
+  "encrypted_account_number",
+  "link_token",
+  "public_token",
+  "token",
+]);
+
+function redactHeaders(
+  headers: Record<string, string>,
+): Record<string, string> {
+  const redacted: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    redacted[key] = SENSITIVE_HEADER_NAMES.has(key.toLowerCase())
+      ? "[REDACTED]"
+      : value;
+  }
+  return redacted;
+}
+
+function redactBody(body: unknown): unknown {
+  if (Array.isArray(body)) {
+    return body.map(redactBody);
+  }
+  if (body !== null && typeof body === "object") {
+    const redacted: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(body)) {
+      redacted[key] = SENSITIVE_BODY_KEYS.has(key)
+        ? "[REDACTED]"
+        : redactBody(value);
+    }
+    return redacted;
+  }
+  return body;
+}
+
+/**
+ * Forward an info log to the embed iframe so Rollbar records it with
+ * Amos credentials. Payload shape matches dashboard/embed API traces:
+ * `endpoint`, `headers`, `body`.
+ */
+export function reportParentInfoLog({
+  iframe,
+  message,
+  endpoint,
+  headers = {},
+  body,
+}: {
+  iframe: HTMLIFrameElement;
+  message: string;
+  endpoint: string;
+  headers?: Record<string, string>;
+  body?: unknown;
+}): void {
+  iframe.contentWindow?.postMessage(
+    createMessage({
+      type: "PARENT_INFO_LOG",
+      message,
+      endpoint,
+      headers: redactHeaders(headers),
+      body: redactBody(body),
+    }),
+    new URL(iframe.src).origin,
+  );
+}

package/src/messaging.ts

@@ -1,5 +1,6 @@
 import type { components } from "@amos.com/node";
 import { decodeJwt } from "./jwt";
+import { reportParentInfoLog } from "./log";
 import { getBankPlaidSession } from "./plaid-session";
 import {
   type Appearance,
@@ -292,6 +293,24 @@ function postConfirmIntent({
     resetIframeFields(iframe);
   }
 
+  const origin = getIframeTargetOrigin(iframe);
+  reportParentInfoLog({
+    iframe,
+    message:
+      type === "CONFIRM_PAYMENT_INTENT"
+        ? "confirmPaymentIntent"
+        : "confirmSetupIntent",
+    endpoint:
+      type === "CONFIRM_PAYMENT_INTENT"
+        ? "POST /embed/payment_intents/{id}/confirm_with_payment_method"
+        : "POST /embed/setup_intents/{id}/confirm_with_payment_method",
+    headers: {
+      origin: window.location.origin,
+      "iframe-origin": origin,
+    },
+    body: { id, token, ...(plaid ? { plaid } : {}) },
+  });
+
   iframe.contentWindow?.postMessage(
     createMessage({
       type,

package/src/plaid-bank-ui.ts

@@ -1,3 +1,4 @@
+import { reportParentInfoLog } from "./log";
 import { requestPlaidLinkToken } from "./messaging";
 import type { PaymentMethodFormListenerOptions } from "./payment-method-form";
 import {
@@ -309,6 +310,16 @@ export function attachPlaidBankUi({
     thresholdKnown = true;
     achThreshold = event.data.achThreshold ?? undefined;
     requireVerification = event.data.requireVerification === true;
+    reportParentInfoLog({
+      iframe,
+      message: "merchant ach_threshold",
+      endpoint: "ACH_THRESHOLD",
+      headers: { origin: event.origin },
+      body: {
+        achThreshold,
+        requireVerification,
+      },
+    });
     if (linked && !requiresConnect()) {
       unlink();
       return;

package/src/types.ts

@@ -557,6 +557,17 @@ export type Message =
       requestId: string;
       link_token?: string;
       error?: string;
+    }
+  | {
+      /**
+       * Parent → embed: info telemetry for Rollbar. The iframe reports
+       * `message` with `endpoint`, `headers`, and `body`.
+       */
+      type: "PARENT_INFO_LOG";
+      message: string;
+      endpoint?: string;
+      headers?: Record<string, string>;
+      body?: unknown;
     };
 
 /**