@autra-io/react-native-card 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -43,7 +43,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Package prepared for public release: MIT license, `publishConfig.access:
+- Package prepared for public release: Apache-2.0 license, `publishConfig.access:
 public`; publishing remains manual and gated (see `docs/platform.md`).
 
 ### Notes

package/LICENSE

@@ -1,21 +1,216 @@
-MIT License
-
-Copyright (c) 2026 Autra
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Copyright 2026 Autra
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,4 @@
+Autra React Native Card SDK (@autra-io/react-native-card)
+Copyright 2026 Autra
+
+This product is licensed under the Apache License, Version 2.0.

package/README.md

@@ -3,14 +3,12 @@
 React Native SDK for secure card tokenization via Autra's hosted card page.
 **Card data never touches your app or your servers.**
 
-[![CI](https://github.com/autratech/autra-card-sdk-react-native/actions/workflows/ci.yml/badge.svg)](https://github.com/autratech/autra-card-sdk-react-native/actions/workflows/ci.yml)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)
-<!-- Enable after the first npm publish:
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
 [![npm version](https://img.shields.io/npm/v/%40autra-io%2Freact-native-card.svg)](https://www.npmjs.com/package/@autra-io/react-native-card)
--->
 
-> 🇧🇷 [Leia este README em português](./README.pt-BR.md) · Guias completos em
-> português no portal do desenvolvedor <!-- PLACEHOLDER: developer portal URL -->
+> 🇧🇷 Uma versão em português deste guia (`README.pt-BR.md`) acompanha o
+> pacote npm. Guias completos em português no portal do desenvolvedor
+> <!-- PLACEHOLDER: developer portal URL -->
 
 ## Table of contents
 
@@ -24,7 +22,6 @@ React Native SDK for secure card tokenization via Autra's hosted card page.
 - [Testing your integration](#testing-your-integration)
 - [Troubleshooting](#troubleshooting)
 - [Documentation](#documentation)
-- [Contributing](#contributing)
 - [Support](#support)
 - [License](#license)
 
@@ -86,25 +83,41 @@ npm install @autra-io/react-native-card
 
 ## How it works
 
-```mermaid
-sequenceDiagram
-    participant App as Your app (SDK)
-    participant Backend as Your backend
-    participant Autra as Autra Platform API
-    participant Page as Autra hosted card page
-
-    App->>Backend: request a card session
-    Backend->>Autra: POST /v1/acquiring/card-sessions (service credentials)
-    Autra-->>Backend: hostedCardUrl (short-lived, single-use)
-    Backend-->>App: hostedCardUrl
-    App->>Page: <AutraCardForm hostedCardUrl /> loads the page in a WebView
-    Note over Page: Cardholder types PAN/CVV here —<br/>never in your app
-    Page->>Autra: tokenize (direct, over HTTPS)
-    Autra-->>Page: opaque token references
-    Page-->>App: postMessage: tokenized
-    App->>Backend: slugStoredCard (opaque) for future charges
+```text
+ Your app (SDK)        Your backend           Autra API         Hosted card page
+       │                     │                     │                     │
+       │ 1. request session  │                     │                     │
+       │────────────────────▶│ 2. POST /v1/        │                     │
+       │                     │ acquiring/          │                     │
+       │                     │ card-sessions ─────▶│                     │
+       │   hostedCardUrl     │◀── hostedCardUrl ───│                     │
+       │◀────────────────────│  (short-lived,      │                     │
+       │                     │   single-use)       │                     │
+       │ 3. <AutraCardForm hostedCardUrl /> renders the page in a WebView│
+       │─────────────────────────────────────────────────────────────── ▶│
+       │                     │                     │  4. cardholder types│
+       │                     │                     │     PAN/CVV here —  │
+       │                     │                     │     never in the app│
+       │                     │                     │◀──── tokenize ──────│
+       │                     │                     │── token references ▶│
+       │◀──────────── 5. message: tokenized ───────────────────────────── │
+       │ 6. slugStoredCard   │                     │                     │
+       │────────────────────▶│ (store server-side for future charges)   │
 ```
 
+1. Your app asks **your backend** for a card session.
+2. Your backend calls the Autra API (`POST /v1/acquiring/card-sessions`,
+   service credentials — server-side only) and receives a short-lived,
+   single-use `hostedCardUrl`.
+3. Your app renders `<AutraCardForm hostedCardUrl={...} />`, which loads the
+   Autra-hosted page in a hardened WebView.
+4. The cardholder types PAN/CVV **on the hosted page**, which tokenizes
+   directly against Autra over HTTPS.
+5. The SDK receives the result and calls `onSuccess` with opaque token
+   references.
+6. Your app sends `slugStoredCard` to your backend, which stores it for
+   future charges.
+
 Card data flows only between the cardholder and Autra's hosted page — it never
 transits your app or backend. Your systems only ever see two opaque values:
 the short-lived `hostedCardUrl` going in, and the `slugStoredCard` /
@@ -248,8 +261,11 @@ Version marker string, useful for support tickets and smoke tests.
 - The WebView is hardened by default: HTTPS-only, navigation allow-list,
   no mixed content, incognito, no disk cache, no file access.
 
-Found a vulnerability? See [SECURITY.md](./SECURITY.md) — please do not open a
-public issue.
+Found a vulnerability? Report it privately to `security@autra.io`
+<!-- PLACEHOLDER: confirm the public security contact email --> — never
+
+through regular support channels. Full policy in the `SECURITY.md` file
+shipped with this package.
 
 ## Testing your integration
 
@@ -257,10 +273,8 @@ public issue.
   values only — never real card data.
   <!-- PLACEHOLDER: sandbox test card numbers, if provided by the team -->
 - For unit tests, inject your session-creation function and mock the WebView
-  bridge — see
-  [`test/functional-app/`](./test/functional-app/FunctionalAutraCardApp.ts)
-  for a complete reference harness driving `ready`, `tokenized` and `error`
-  flows with a mocked backend.
+  bridge: emit `autra.card.ready`, `autra.card.tokenized` and
+  `autra.card.error` messages against your handlers with mocked payloads.
 
 ## Troubleshooting
 
@@ -277,22 +291,16 @@ public issue.
 
 ## Documentation
 
-- Integration guides: developer portal
+- Integration guides (EN + PT-BR): developer portal
   <!-- PLACEHOLDER: developer portal URL (EN + PT-BR) -->
-- [Backend flow overview](./docs/integration/backend-flow.md)
-- [SDK scope and limitations](./docs/integration/limitations.md)
-
-## Contributing
-
-See [CONTRIBUTING.md](./CONTRIBUTING.md). Never include real card data or
-secrets in issues, PRs or examples.
 
 ## Support
 
-- Bugs and feature requests:
-  [GitHub issues](https://github.com/autratech/autra-card-sdk-react-native/issues)
-- Integration support: <!-- PLACEHOLDER: support channel/email -->
+- Integration support and bug reports: <!-- PLACEHOLDER: support channel/email -->
+- Security vulnerabilities: `security@autra.io`
+  <!-- PLACEHOLDER: confirm the public security contact email --> — never
+  through regular support channels (see `SECURITY.md` in this package).
 
 ## License
 
-[MIT](./LICENSE)
+Apache-2.0 — see the `LICENSE` file shipped with this package.

package/README.pt-BR.md

@@ -10,7 +10,7 @@ SDK React Native para tokenização segura de cartões via página hospedada da
 Autra. **Os dados do cartão nunca passam pelo seu app nem pelos seus
 servidores.**
 
-> 🌎 [Read this README in English](./README.md) (documentação completa) ·
+> 🌎 `README.md` (in English) (documentação completa) ·
 > Guias completos no portal do desenvolvedor
 > <!-- PLACEHOLDER: URL do portal do desenvolvedor -->
 
@@ -126,8 +126,8 @@ export function AdicionarCartaoScreen() {
 ## Documentação completa
 
 Referência completa da API, segurança & PCI, testes e troubleshooting:
-[README.md (English)](./README.md).
+o `README.md` (em inglês) que acompanha este pacote.
 
 ## Licença
 
-[MIT](./LICENSE)
+Apache-2.0 — veja o arquivo `LICENSE` que acompanha este pacote.

package/SECURITY.md

@@ -6,11 +6,11 @@ contributors (human and AI).
 
 ## Reporting a vulnerability
 
-- **Do not** open a public GitHub issue for security vulnerabilities.
-- Report privately via
-  [GitHub private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
-  on this repository, or by email to `security@autra.io`
+- **Do not** report security vulnerabilities through regular support channels.
+- Report privately by email to `security@autra.io`
   <!-- PLACEHOLDER: confirm the public security contact email with the team -->.
+  (This repository is private, so GitHub vulnerability reporting is only
+  available to internal contributors.)
 - Include: affected version/commit, impact, and reproduction steps using
   **non-sensitive, mock data only**.
 

package/dist/index.cjs

@@ -333,7 +333,7 @@ function isHostedDocumentUrl(eventUrl, documentUrl) {
 }
 
 // src/index.ts
-var AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.0";
+var AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.1";
 
 exports.AUTRA_REACT_NATIVE_CARD_SDK_VERSION = AUTRA_REACT_NATIVE_CARD_SDK_VERSION;
 exports.AutraCardForm = AutraCardForm;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/messages.ts","../src/AutraCardForm.ts","../src/index.ts"],"names":["React","WebView"],"mappings":";;;;;;;;;;;;AAeA,IAAM,UAAA,uBAAiB,GAAA,CAAwB;AAAA,EAC7C,qBAAA;AAAA,EACA,eAAA;AAAA,EACA,yBAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,sCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,iBAAA;AAAA,EACN,OAAA,EAAS,8BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,qBAAqB,WAAA,EAA+B;AAClE,EAAA,OAAO,CAAC,IAAI,GAAA,CAAI,WAAW,EAAE,MAAM,CAAA;AACrC;AAUO,SAAS,wBAAwB,OAAA,EAAsC;AAC5E,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,KAAA,MAAW,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,SAAS,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,CAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AACpC,MAAA,UAAA,CAAW,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,UAAA;AACT;AAEO,SAAS,4BAAA,CACd,OACA,cAAA,EACoC;AACpC,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAEtC,EAAA,IAAI,gBAAgB,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,WAAW,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA;AAEvC,EAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AACzB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,sBAAA,IAA0B,QAAA,CAAS,UAAA,CAAW,OAAO,CAAA,EAAG;AAC9E,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAA,CAAW,OAAO,CAAA;AAEnD,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAa,QAAO,EAAE;AAAA,IAC5D;AAAA,EACF;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,kBAAA,IAAsB,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AACxE,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,UAAA,CAAW,KAAK,CAAA;AAE/C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,OAAM,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,SAAS,kBAAA,EAAoB;AAC1C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,OAAA;AAAA,QACN,SAAA,EAAW,cAAA,CAAe,UAAA,CAAW,SAAS;AAAA;AAChD,KACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AACjD;AAEA,SAAS,SAAS,GAAA,EAA6C;AAC7D,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,eAAe,KAAA,EAAoC;AAC1D,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,kBAAkB,OAAA,EAAwE;AACjG,EAAA,MAAM,aAAa,QAAA,CAAS,OAAA,CAAQ,UAAU,CAAA,GAAI,QAAQ,UAAA,GAAa,MAAA;AACvE,EAAA,MAAM,gBAAgB,QAAA,CAAS,OAAA,CAAQ,aAAa,CAAA,GAAI,QAAQ,aAAA,GAAgB,MAAA;AAEhF,EAAA,MAAM,iBACJ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA,IAAK,cAAA,CAAe,YAAY,cAAc,CAAA;AACrF,EAAA,MAAM,YAAY,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,IAAK,cAAA,CAAe,eAAe,SAAS,CAAA;AAC9F,EAAA,MAAM,sBACJ,cAAA,CAAe,OAAA,CAAQ,mBAAmB,CAAA,IAC1C,cAAA,CAAe,eAAe,mBAAmB,CAAA;AAEnD,EAAA,IAAI,cAAA,KAAmB,MAAA,IAAa,SAAA,KAAc,MAAA,EAAW;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,cAAA;AAAA,IACA,SAAA;AAAA,IACA,mBAAA;AAAA,IACA,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,eAAA,EAAiB,cAAA,CAAe,OAAA,CAAQ,eAAe,CAAA;AAAA,IACvD,cAAA,EAAgB,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AAAA,IACrD,SAAA,EAAW,cAAA,CAAe,OAAA,CAAQ,SAAS;AAAA,GAC7C;AACF;AAEA,SAAS,iBAAiB,KAAA,EAA4D;AACpF,EAAA,IAAI,OAAO,MAAM,IAAA,KAAS,QAAA,IAAY,CAAC,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA,EAAG;AACvE,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,EAAU;AACrC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,SAAA,EAAW,cAAA,CAAe,KAAA,CAAM,SAAS,CAAA;AAAA,IACzC,WAAW,OAAO,KAAA,CAAM,SAAA,KAAc,SAAA,GAAY,MAAM,SAAA,GAAY;AAAA,GACtE;AACF;AAEA,SAAS,qBAAqB,IAAA,EAA0C;AACtE,EAAA,OAAO,UAAA,CAAW,IAAI,IAA0B,CAAA;AAClD;;;ACxIA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,kCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0CAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,8BAAA,GAAiD;AAAA,EACrD,IAAA,EAAM,eAAA;AAAA,EACN,OAAA,EAAS,mDAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,qBAAA,GAAwC;AAAA,EAC5C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,0BAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,8DAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,0BAA0B,aAAA,EAA+B;AACvE,EAAA,OAAO,aAAA;AACT;AAMO,SAAS,cAAc,KAAA,EAAsD;AAGlF,EAAA,MAAM,iBAAA,GAAoB,KAAA,CAAM,cAAA,EAAgB,IAAA,CAAK,GAAG,CAAA;AACxD,EAAA,MAAM,gBAAgBA,sBAAA,CAAM,OAAA;AAAA,IAC1B,MAAM,8BAAA,CAA+B,KAAA,CAAM,aAAA,EAAe,MAAM,cAAc,CAAA;AAAA;AAAA,IAE9E,CAAC,KAAA,CAAM,aAAA,EAAe,iBAAiB;AAAA,GACzC;AAKA,EAAA,MAAM,WAAA,GAAcA,sBAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AAEtC,EAAA,MAAM,UAAA,GAAaA,sBAAA,CAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAC7C,EAAAA,sBAAA,CAAM,UAAU,MAAM;AACpB,IAAA,UAAA,CAAW,UAAU,KAAA,CAAM,OAAA;AAAA,EAC7B,CAAC,CAAA;AAMD,EAAAA,sBAAA,CAAM,UAAU,MAAM;AACpB,IAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,MAAA,UAAA,CAAW,OAAA,CAAQ,cAAc,KAAK,CAAA;AAAA,IACxC;AAAA,EACF,CAAA,EAAG,CAAC,aAAa,CAAC,CAAA;AAElB,EAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,EAAE,WAAA,EAAa,cAAA,EAAe,GAAI,aAAA;AAExC,EAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,KAAqC;AAC1D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,KAAA,CAAM,WAAA,EAAa,cAAc,CAAA;AAE7E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,KAAA,CAAM,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa;AACvC,MAAA,WAAA,CAAY,OAAA,GAAU,IAAA;AACtB,MAAA,KAAA,CAAM,SAAA,CAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACrC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA;AAClC,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA;AAAA,EAC1C,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,KAAA,KAAuC;AAC9D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAMA,IAAA,IAAI,CAAC,mBAAA,CAAoB,KAAA,CAAM,WAAA,CAAY,GAAA,EAAK,WAAW,CAAA,EAAG;AAC5D,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAM,WAAA,CAAY,UAAA,KAAe,OAAO,KAAA,CAAM,WAAA,CAAY,eAAe,GAAA,EAAK;AAChF,MAAA,KAAA,CAAM,QAAQ,8BAA8B,CAAA;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,gCAAA,GAAmC,CAAC,OAAA,KAA+C;AACvF,IAAA,IAAI,yBAAA,CAA0B,OAAA,CAAQ,GAAA,EAAK,cAAc,CAAA,EAAG;AAC1D,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,KAAA,CAAM,QAAQ,sBAAsB,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmBC,0BAAA;AAEzB,EAAA,OAAOD,sBAAA,CAAM,cAAc,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK;AAAA,KACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,eAAA,EAAiB,CAAC,GAAG,CAAA;AAAA,IACrB,SAAA,EAAW,aAAA;AAAA,IACX,SAAS,MAAM;AACb,MAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,QAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,WAAA,EAAa,eAAA;AAAA,IACb,4BAAA,EAA8B,gCAAA;AAAA,IAC9B,gBAAA,EAAkB,OAAA;AAAA,IAClB,eAAA,EAAiB,KAAA;AAAA,IACjB,mCAAA,EAAqC,KAAA;AAAA;AAAA;AAAA,IAGrC,SAAA,EAAW,IAAA;AAAA,IACX,YAAA,EAAc,KAAA;AAAA,IACd,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,QAAQ,KAAA,CAAM;AAAA,GACf,CAAA;AACH;AAEA,SAAS,8BAAA,CACP,eACA,mBAAA,EACyB;AACzB,EAAA,MAAM,mBAAA,GAAsB,mBAAmB,aAAa,CAAA;AAE5D,EAAA,IAAI,CAAC,oBAAoB,EAAA,EAAI;AAC3B,IAAA,OAAO,mBAAA;AAAA,EACT;AAKA,EAAA,MAAM,cAAA,GAAiB,uBAAA;AAAA,IACrB,mBAAA,IAAuB,qBAAqB,aAAa;AAAA,GAC3D;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,0BAAA,EAA2B;AAAA,EACxD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,WAAA,EAAa,0BAA0B,aAAa,CAAA;AAAA,IACpD;AAAA,GACF;AACF;AAEA,SAAS,mBACP,aAAA,EAC+D;AAC/D,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACnD;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,EACpD;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AACzB;AAEA,SAAS,yBAAA,CACP,eACA,cAAA,EACS;AACT,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,cAAA,CAAe,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AAC3C;AAEA,SAAS,mBAAA,CAAoB,UAA8B,WAAA,EAA8B;AACvF,EAAA,IAAI,aAAa,MAAA,EAAW;AAG1B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,QAAQ,CAAA;AACzB,IAAA,QAAA,GAAW,IAAI,IAAI,WAAW,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAO,MAAA,KAAW,QAAA,CAAS,MAAA,IAAU,MAAA,CAAO,aAAa,QAAA,CAAS,QAAA;AAC3E;;;AC5SO,IAAM,mCAAA,GAAsC","file":"index.cjs","sourcesContent":["import type { AutraCardError, AutraCardErrorCode, AutraCardTokenizedResult } from './index';\n\nexport type AutraCardWebViewNativeMessage = {\n  data: string;\n  url?: string;\n};\n\nexport type AutraCardHostedMessage =\n  | { type: 'tokenized'; result: AutraCardTokenizedResult }\n  | { type: 'error'; error: AutraCardError }\n  | { type: 'ready'; requestId?: string };\n\nexport type ParseAutraCardWebViewMessageResult =\n  { ok: true; message: AutraCardHostedMessage } | { ok: false; error: AutraCardError };\n\nconst errorCodes = new Set<AutraCardErrorCode>([\n  'configuration_error',\n  'token_expired',\n  'message_origin_rejected',\n  'message_invalid',\n  'validation_error',\n  'tokenization_failed',\n]);\n\nconst originRejectedError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Rejected hosted card message origin.',\n  retryable: false,\n};\n\nconst invalidMessageError: AutraCardError = {\n  code: 'message_invalid',\n  message: 'Invalid hosted card message.',\n  retryable: false,\n};\n\nexport function deriveAllowedOrigins(cardBaseUrl: string): string[] {\n  return [new URL(cardBaseUrl).origin];\n}\n\n/**\n * Normalizes a caller-supplied origin list into canonical HTTPS origins.\n *\n * Guards against silent lockouts: `['https://cards.example/']` (trailing\n * slash) never equals a browser-reported origin and would reject every\n * hosted message. Entries that are not valid HTTPS URLs are dropped —\n * postMessage trust must never be extended to plaintext origins.\n */\nexport function normalizeAllowedOrigins(origins: readonly string[]): string[] {\n  const normalized: string[] = [];\n\n  for (const candidate of origins) {\n    let url: URL;\n\n    try {\n      url = new URL(candidate);\n    } catch {\n      continue;\n    }\n\n    if (url.protocol !== 'https:') {\n      continue;\n    }\n\n    if (!normalized.includes(url.origin)) {\n      normalized.push(url.origin);\n    }\n  }\n\n  return normalized;\n}\n\nexport function parseAutraCardWebViewMessage(\n  event: AutraCardWebViewNativeMessage,\n  allowedOrigins: readonly string[],\n): ParseAutraCardWebViewMessageResult {\n  const eventOrigin = toOrigin(event.url);\n\n  if (eventOrigin === undefined || !allowedOrigins.includes(eventOrigin)) {\n    return { ok: false, error: originRejectedError };\n  }\n\n  const rawMessage = parseJson(event.data);\n\n  if (!isRecord(rawMessage)) {\n    return { ok: false, error: invalidMessageError };\n  }\n\n  if (rawMessage.type === 'autra.card.tokenized' && isRecord(rawMessage.payload)) {\n    const result = toTokenizedResult(rawMessage.payload);\n\n    if (result !== undefined) {\n      return { ok: true, message: { type: 'tokenized', result } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.error' && isRecord(rawMessage.error)) {\n    const error = toAutraCardError(rawMessage.error);\n\n    if (error !== undefined) {\n      return { ok: true, message: { type: 'error', error } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.ready') {\n    return {\n      ok: true,\n      message: {\n        type: 'ready',\n        requestId: optionalString(rawMessage.requestId),\n      },\n    };\n  }\n\n  return { ok: false, error: invalidMessageError };\n}\n\nfunction toOrigin(url: string | undefined): string | undefined {\n  if (url === undefined) {\n    return undefined;\n  }\n\n  try {\n    return new URL(url).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseJson(data: string): unknown {\n  try {\n    return JSON.parse(data) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction optionalString(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction toTokenizedResult(payload: Record<string, unknown>): AutraCardTokenizedResult | undefined {\n  const storedCard = isRecord(payload.storedCard) ? payload.storedCard : undefined;\n  const tokenizedCard = isRecord(payload.tokenizedCard) ? payload.tokenizedCard : undefined;\n\n  const slugStoredCard =\n    optionalString(payload.slugStoredCard) ?? optionalString(storedCard?.slugStoredCard);\n  const slugToken = optionalString(payload.slugToken) ?? optionalString(tokenizedCard?.slugToken);\n  const tokenExpirationDate =\n    optionalString(payload.tokenExpirationDate) ??\n    optionalString(tokenizedCard?.tokenExpirationDate);\n\n  if (slugStoredCard === undefined && slugToken === undefined) {\n    return undefined;\n  }\n\n  return {\n    slugStoredCard,\n    slugToken,\n    tokenExpirationDate,\n    brand: optionalString(payload.brand),\n    last4: optionalString(payload.last4),\n    expirationMonth: optionalString(payload.expirationMonth),\n    expirationYear: optionalString(payload.expirationYear),\n    requestId: optionalString(payload.requestId),\n  };\n}\n\nfunction toAutraCardError(error: Record<string, unknown>): AutraCardError | undefined {\n  if (typeof error.code !== 'string' || !isAutraCardErrorCode(error.code)) {\n    return undefined;\n  }\n\n  if (typeof error.message !== 'string') {\n    return undefined;\n  }\n\n  return {\n    code: error.code,\n    message: error.message,\n    requestId: optionalString(error.requestId),\n    retryable: typeof error.retryable === 'boolean' ? error.retryable : undefined,\n  };\n}\n\nfunction isAutraCardErrorCode(code: string): code is AutraCardErrorCode {\n  return errorCodes.has(code as AutraCardErrorCode);\n}\n","import React from 'react';\nimport type { StyleProp, ViewStyle } from 'react-native';\nimport { WebView } from 'react-native-webview';\n\nimport type { AutraCardError, AutraCardTokenizedResult } from './index';\nimport {\n  deriveAllowedOrigins,\n  normalizeAllowedOrigins,\n  parseAutraCardWebViewMessage,\n  type AutraCardWebViewNativeMessage,\n} from './messages';\n\nexport type AutraCardFormProps = {\n  hostedCardUrl: string;\n  onSuccess: (result: AutraCardTokenizedResult) => void;\n  onError: (error: AutraCardError) => void;\n  allowedOrigins?: readonly string[];\n  onReady?: (requestId?: string) => void;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\ntype WebViewMessageEvent = {\n  nativeEvent: AutraCardWebViewNativeMessage;\n};\n\ntype WebViewHttpErrorEvent = {\n  nativeEvent: {\n    statusCode: number;\n    url?: string;\n  };\n};\n\ntype WebViewNavigationRequest = {\n  url: string;\n};\n\ntype AutraCardWebViewProps = {\n  source: {\n    uri: string;\n  };\n  originWhitelist: string[];\n  onMessage: (event: WebViewMessageEvent) => void;\n  onError: () => void;\n  onHttpError: (event: WebViewHttpErrorEvent) => void;\n  onShouldStartLoadWithRequest: (request: WebViewNavigationRequest) => boolean;\n  mixedContentMode: 'never';\n  allowFileAccess: boolean;\n  allowsBackForwardNavigationGestures: boolean;\n  incognito: boolean;\n  cacheEnabled: boolean;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\nconst hostedPageLoadError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page failed to load.',\n  retryable: true,\n};\n\nconst hostedPageHttpError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page returned an HTTP error.',\n  retryable: true,\n};\n\nconst hostedSessionUnauthorizedError: AutraCardError = {\n  code: 'token_expired',\n  message: 'Hosted card session expired or is not authorized.',\n  retryable: false,\n};\n\nconst invalidHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Invalid hosted card URL.',\n  retryable: false,\n};\n\nconst insecureHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Hosted card URL must use HTTPS.',\n  retryable: false,\n};\n\nconst invalidAllowedOriginsError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'allowedOrigins must contain at least one valid HTTPS origin.',\n  retryable: false,\n};\n\nconst blockedNavigationError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Blocked hosted card navigation.',\n  retryable: false,\n};\n\nexport function buildAutraCardTokenizeUrl(hostedCardUrl: string): string {\n  return hostedCardUrl;\n}\n\ntype HostedCardConfiguration =\n  | { ok: true; tokenizeUrl: string; allowedOrigins: readonly string[] }\n  | { ok: false; error: AutraCardError };\n\nexport function AutraCardForm(props: AutraCardFormProps): React.ReactElement | null {\n  // Key the memo by origin CONTENT so an inline `allowedOrigins={[...]}`\n  // (new array identity every render) neither recomputes nor re-emits.\n  const allowedOriginsKey = props.allowedOrigins?.join(' ');\n  const configuration = React.useMemo<HostedCardConfiguration>(\n    () => resolveHostedCardConfiguration(props.hostedCardUrl, props.allowedOrigins),\n    // deps intentionally keyed by content (allowedOriginsKey), not array identity\n    [props.hostedCardUrl, allowedOriginsKey],\n  );\n\n  // Terminal guard: once the hosted page reports a successful tokenization,\n  // every later event (duplicate `tokenized`, stray errors, sub-frame noise)\n  // is ignored so the consumer can never double-charge or double-navigate.\n  const terminalRef = React.useRef(false);\n\n  const onErrorRef = React.useRef(props.onError);\n  React.useEffect(() => {\n    onErrorRef.current = props.onError;\n  });\n\n  // Configuration errors are emitted from an effect: calling props.onError\n  // during render would trigger a parent setState mid-render (React error\n  // \"Cannot update a component while rendering a different component\") and\n  // would re-fire on every re-render.\n  React.useEffect(() => {\n    if (!configuration.ok) {\n      onErrorRef.current(configuration.error);\n    }\n  }, [configuration]);\n\n  if (!configuration.ok) {\n    return null;\n  }\n\n  const { tokenizeUrl, allowedOrigins } = configuration;\n\n  const handleMessage = (event: WebViewMessageEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    const result = parseAutraCardWebViewMessage(event.nativeEvent, allowedOrigins);\n\n    if (!result.ok) {\n      props.onError(result.error);\n      return;\n    }\n\n    if (result.message.type === 'tokenized') {\n      terminalRef.current = true;\n      props.onSuccess(result.message.result);\n      return;\n    }\n\n    if (result.message.type === 'error') {\n      props.onError(result.message.error);\n      return;\n    }\n\n    props.onReady?.(result.message.requestId);\n  };\n\n  const handleHttpError = (event: WebViewHttpErrorEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    // On Android onHttpError also fires for sub-resources (favicon, assets,\n    // page-initiated fetches). Only a failure of the hosted DOCUMENT itself\n    // is fatal to the flow — the page reports its own API errors through the\n    // postMessage channel.\n    if (!isHostedDocumentUrl(event.nativeEvent.url, tokenizeUrl)) {\n      return;\n    }\n\n    if (event.nativeEvent.statusCode === 401 || event.nativeEvent.statusCode === 403) {\n      props.onError(hostedSessionUnauthorizedError);\n      return;\n    }\n\n    props.onError(hostedPageHttpError);\n  };\n\n  const handleShouldStartLoadWithRequest = (request: WebViewNavigationRequest): boolean => {\n    if (isAllowedHostedNavigation(request.url, allowedOrigins)) {\n      return true;\n    }\n\n    if (!terminalRef.current) {\n      props.onError(blockedNavigationError);\n    }\n    return false;\n  };\n\n  const WebViewComponent = WebView as unknown as React.ComponentType<AutraCardWebViewProps>;\n\n  return React.createElement(WebViewComponent, {\n    source: {\n      uri: tokenizeUrl,\n    },\n    // Security: react-native-webview hands URLs that fail originWhitelist to\n    // the OS (Linking.openURL) BEFORE onShouldStartLoadWithRequest runs — a\n    // compromised hosted page could silently bounce the user to an external\n    // browser (phishing surface). The payment-WebView hardening pattern is a\n    // wildcard whitelist plus a full allowlist in\n    // onShouldStartLoadWithRequest: returning false there blocks the\n    // navigation WITHOUT opening it externally.\n    originWhitelist: ['*'],\n    onMessage: handleMessage,\n    onError: () => {\n      if (!terminalRef.current) {\n        props.onError(hostedPageLoadError);\n      }\n    },\n    onHttpError: handleHttpError,\n    onShouldStartLoadWithRequest: handleShouldStartLoadWithRequest,\n    mixedContentMode: 'never',\n    allowFileAccess: false,\n    allowsBackForwardNavigationGestures: false,\n    // PCI hygiene: never persist the hosted card page (or anything typed in\n    // it) to disk caches.\n    incognito: true,\n    cacheEnabled: false,\n    style: props.style,\n    testID: props.testID,\n  });\n}\n\nfunction resolveHostedCardConfiguration(\n  hostedCardUrl: string,\n  allowedOriginsInput: readonly string[] | undefined,\n): HostedCardConfiguration {\n  const parsedHostedCardUrl = parseHostedCardUrl(hostedCardUrl);\n\n  if (!parsedHostedCardUrl.ok) {\n    return parsedHostedCardUrl;\n  }\n\n  // Normalization guards against silent lockouts: an entry with a trailing\n  // slash/path (`https://cards.example/`) would never equal a browser origin\n  // and would reject every hosted message. Non-HTTPS entries are dropped.\n  const allowedOrigins = normalizeAllowedOrigins(\n    allowedOriginsInput ?? deriveAllowedOrigins(hostedCardUrl),\n  );\n\n  if (allowedOrigins.length === 0) {\n    return { ok: false, error: invalidAllowedOriginsError };\n  }\n\n  return {\n    ok: true,\n    tokenizeUrl: buildAutraCardTokenizeUrl(hostedCardUrl),\n    allowedOrigins,\n  };\n}\n\nfunction parseHostedCardUrl(\n  hostedCardUrl: string,\n): { ok: true; url: URL } | { ok: false; error: AutraCardError } {\n  let url: URL;\n\n  try {\n    url = new URL(hostedCardUrl);\n  } catch {\n    return { ok: false, error: invalidHostedUrlError };\n  }\n\n  if (url.protocol !== 'https:') {\n    return { ok: false, error: insecureHostedUrlError };\n  }\n\n  return { ok: true, url };\n}\n\nfunction isAllowedHostedNavigation(\n  navigationUrl: string,\n  allowedOrigins: readonly string[],\n): boolean {\n  let url: URL;\n\n  try {\n    url = new URL(navigationUrl);\n  } catch {\n    return false;\n  }\n\n  if (url.protocol !== 'https:') {\n    return false;\n  }\n\n  return allowedOrigins.includes(url.origin);\n}\n\nfunction isHostedDocumentUrl(eventUrl: string | undefined, documentUrl: string): boolean {\n  if (eventUrl === undefined) {\n    // Older react-native-webview versions omit the URL — stay conservative\n    // and treat the failure as fatal rather than silently swallowing it.\n    return true;\n  }\n\n  let failed: URL;\n  let document: URL;\n\n  try {\n    failed = new URL(eventUrl);\n    document = new URL(documentUrl);\n  } catch {\n    return true;\n  }\n\n  return failed.origin === document.origin && failed.pathname === document.pathname;\n}\n","/**\n * @autra-io/react-native-card — hosted card tokenization SDK exports.\n *\n * Phase: v0 hosted-WebView tokenization. The SDK owns only the React Native\n * component shell and message bridge; the hosted card page owns PAN/CVV entry.\n *\n * Security (payment-adjacent SDK):\n *   - Never embed or log PAN, CVV, expiry or cardholder data.\n *   - Never place OAuth clientSecret or a strong accessToken in the app.\n *   - The mobile context must only ever load a short-lived hostedCardUrl.\n */\n\nexport { AutraCardForm } from './AutraCardForm';\nexport type { AutraCardFormProps } from './AutraCardForm';\n\n/** Semantic version marker for the v0 implementation phase. */\nexport const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = '0.1.0';\n\n/**\n * Result returned by a successful card tokenization.\n * `slugStoredCard` is the opaque reference the backend uses to charge later.\n * Never populate this with raw PAN/CVV; only tokenized/masked references.\n */\nexport type AutraCardTokenizedResult = {\n  slugStoredCard?: string;\n  slugToken?: string;\n  tokenExpirationDate?: string;\n  brand?: string;\n  last4?: string;\n  expirationMonth?: string;\n  expirationYear?: string;\n  requestId?: string;\n};\n\n/** Normalized v0 error code taxonomy surfaced by the SDK. */\nexport type AutraCardErrorCode =\n  | 'configuration_error'\n  | 'token_expired'\n  | 'message_origin_rejected'\n  | 'message_invalid'\n  | 'validation_error'\n  | 'tokenization_failed';\n\nexport type AutraCardError = {\n  code: AutraCardErrorCode;\n  message: string;\n  requestId?: string;\n  retryable?: boolean;\n};\n"]}
+{"version":3,"sources":["../src/messages.ts","../src/AutraCardForm.ts","../src/index.ts"],"names":["React","WebView"],"mappings":";;;;;;;;;;;;AAeA,IAAM,UAAA,uBAAiB,GAAA,CAAwB;AAAA,EAC7C,qBAAA;AAAA,EACA,eAAA;AAAA,EACA,yBAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,sCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,iBAAA;AAAA,EACN,OAAA,EAAS,8BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,qBAAqB,WAAA,EAA+B;AAClE,EAAA,OAAO,CAAC,IAAI,GAAA,CAAI,WAAW,EAAE,MAAM,CAAA;AACrC;AAUO,SAAS,wBAAwB,OAAA,EAAsC;AAC5E,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,KAAA,MAAW,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,SAAS,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,CAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AACpC,MAAA,UAAA,CAAW,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,UAAA;AACT;AAEO,SAAS,4BAAA,CACd,OACA,cAAA,EACoC;AACpC,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAEtC,EAAA,IAAI,gBAAgB,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,WAAW,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA;AAEvC,EAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AACzB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,sBAAA,IAA0B,QAAA,CAAS,UAAA,CAAW,OAAO,CAAA,EAAG;AAC9E,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAA,CAAW,OAAO,CAAA;AAEnD,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAa,QAAO,EAAE;AAAA,IAC5D;AAAA,EACF;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,kBAAA,IAAsB,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AACxE,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,UAAA,CAAW,KAAK,CAAA;AAE/C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,OAAM,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,SAAS,kBAAA,EAAoB;AAC1C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,OAAA;AAAA,QACN,SAAA,EAAW,cAAA,CAAe,UAAA,CAAW,SAAS;AAAA;AAChD,KACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AACjD;AAEA,SAAS,SAAS,GAAA,EAA6C;AAC7D,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,eAAe,KAAA,EAAoC;AAC1D,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,kBAAkB,OAAA,EAAwE;AACjG,EAAA,MAAM,aAAa,QAAA,CAAS,OAAA,CAAQ,UAAU,CAAA,GAAI,QAAQ,UAAA,GAAa,MAAA;AACvE,EAAA,MAAM,gBAAgB,QAAA,CAAS,OAAA,CAAQ,aAAa,CAAA,GAAI,QAAQ,aAAA,GAAgB,MAAA;AAEhF,EAAA,MAAM,iBACJ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA,IAAK,cAAA,CAAe,YAAY,cAAc,CAAA;AACrF,EAAA,MAAM,YAAY,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,IAAK,cAAA,CAAe,eAAe,SAAS,CAAA;AAC9F,EAAA,MAAM,sBACJ,cAAA,CAAe,OAAA,CAAQ,mBAAmB,CAAA,IAC1C,cAAA,CAAe,eAAe,mBAAmB,CAAA;AAEnD,EAAA,IAAI,cAAA,KAAmB,MAAA,IAAa,SAAA,KAAc,MAAA,EAAW;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,cAAA;AAAA,IACA,SAAA;AAAA,IACA,mBAAA;AAAA,IACA,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,eAAA,EAAiB,cAAA,CAAe,OAAA,CAAQ,eAAe,CAAA;AAAA,IACvD,cAAA,EAAgB,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AAAA,IACrD,SAAA,EAAW,cAAA,CAAe,OAAA,CAAQ,SAAS;AAAA,GAC7C;AACF;AAEA,SAAS,iBAAiB,KAAA,EAA4D;AACpF,EAAA,IAAI,OAAO,MAAM,IAAA,KAAS,QAAA,IAAY,CAAC,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA,EAAG;AACvE,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,EAAU;AACrC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,SAAA,EAAW,cAAA,CAAe,KAAA,CAAM,SAAS,CAAA;AAAA,IACzC,WAAW,OAAO,KAAA,CAAM,SAAA,KAAc,SAAA,GAAY,MAAM,SAAA,GAAY;AAAA,GACtE;AACF;AAEA,SAAS,qBAAqB,IAAA,EAA0C;AACtE,EAAA,OAAO,UAAA,CAAW,IAAI,IAA0B,CAAA;AAClD;;;ACxIA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,kCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0CAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,8BAAA,GAAiD;AAAA,EACrD,IAAA,EAAM,eAAA;AAAA,EACN,OAAA,EAAS,mDAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,qBAAA,GAAwC;AAAA,EAC5C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,0BAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,8DAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,0BAA0B,aAAA,EAA+B;AACvE,EAAA,OAAO,aAAA;AACT;AAMO,SAAS,cAAc,KAAA,EAAsD;AAGlF,EAAA,MAAM,iBAAA,GAAoB,KAAA,CAAM,cAAA,EAAgB,IAAA,CAAK,GAAG,CAAA;AACxD,EAAA,MAAM,gBAAgBA,sBAAA,CAAM,OAAA;AAAA,IAC1B,MAAM,8BAAA,CAA+B,KAAA,CAAM,aAAA,EAAe,MAAM,cAAc,CAAA;AAAA;AAAA,IAE9E,CAAC,KAAA,CAAM,aAAA,EAAe,iBAAiB;AAAA,GACzC;AAKA,EAAA,MAAM,WAAA,GAAcA,sBAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AAEtC,EAAA,MAAM,UAAA,GAAaA,sBAAA,CAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAC7C,EAAAA,sBAAA,CAAM,UAAU,MAAM;AACpB,IAAA,UAAA,CAAW,UAAU,KAAA,CAAM,OAAA;AAAA,EAC7B,CAAC,CAAA;AAMD,EAAAA,sBAAA,CAAM,UAAU,MAAM;AACpB,IAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,MAAA,UAAA,CAAW,OAAA,CAAQ,cAAc,KAAK,CAAA;AAAA,IACxC;AAAA,EACF,CAAA,EAAG,CAAC,aAAa,CAAC,CAAA;AAElB,EAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,EAAE,WAAA,EAAa,cAAA,EAAe,GAAI,aAAA;AAExC,EAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,KAAqC;AAC1D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,KAAA,CAAM,WAAA,EAAa,cAAc,CAAA;AAE7E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,KAAA,CAAM,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa;AACvC,MAAA,WAAA,CAAY,OAAA,GAAU,IAAA;AACtB,MAAA,KAAA,CAAM,SAAA,CAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACrC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA;AAClC,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA;AAAA,EAC1C,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,KAAA,KAAuC;AAC9D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAMA,IAAA,IAAI,CAAC,mBAAA,CAAoB,KAAA,CAAM,WAAA,CAAY,GAAA,EAAK,WAAW,CAAA,EAAG;AAC5D,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAM,WAAA,CAAY,UAAA,KAAe,OAAO,KAAA,CAAM,WAAA,CAAY,eAAe,GAAA,EAAK;AAChF,MAAA,KAAA,CAAM,QAAQ,8BAA8B,CAAA;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,gCAAA,GAAmC,CAAC,OAAA,KAA+C;AACvF,IAAA,IAAI,yBAAA,CAA0B,OAAA,CAAQ,GAAA,EAAK,cAAc,CAAA,EAAG;AAC1D,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,KAAA,CAAM,QAAQ,sBAAsB,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmBC,0BAAA;AAEzB,EAAA,OAAOD,sBAAA,CAAM,cAAc,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK;AAAA,KACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,eAAA,EAAiB,CAAC,GAAG,CAAA;AAAA,IACrB,SAAA,EAAW,aAAA;AAAA,IACX,SAAS,MAAM;AACb,MAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,QAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,WAAA,EAAa,eAAA;AAAA,IACb,4BAAA,EAA8B,gCAAA;AAAA,IAC9B,gBAAA,EAAkB,OAAA;AAAA,IAClB,eAAA,EAAiB,KAAA;AAAA,IACjB,mCAAA,EAAqC,KAAA;AAAA;AAAA;AAAA,IAGrC,SAAA,EAAW,IAAA;AAAA,IACX,YAAA,EAAc,KAAA;AAAA,IACd,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,QAAQ,KAAA,CAAM;AAAA,GACf,CAAA;AACH;AAEA,SAAS,8BAAA,CACP,eACA,mBAAA,EACyB;AACzB,EAAA,MAAM,mBAAA,GAAsB,mBAAmB,aAAa,CAAA;AAE5D,EAAA,IAAI,CAAC,oBAAoB,EAAA,EAAI;AAC3B,IAAA,OAAO,mBAAA;AAAA,EACT;AAKA,EAAA,MAAM,cAAA,GAAiB,uBAAA;AAAA,IACrB,mBAAA,IAAuB,qBAAqB,aAAa;AAAA,GAC3D;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,0BAAA,EAA2B;AAAA,EACxD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,WAAA,EAAa,0BAA0B,aAAa,CAAA;AAAA,IACpD;AAAA,GACF;AACF;AAEA,SAAS,mBACP,aAAA,EAC+D;AAC/D,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACnD;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,EACpD;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AACzB;AAEA,SAAS,yBAAA,CACP,eACA,cAAA,EACS;AACT,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,cAAA,CAAe,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AAC3C;AAEA,SAAS,mBAAA,CAAoB,UAA8B,WAAA,EAA8B;AACvF,EAAA,IAAI,aAAa,MAAA,EAAW;AAG1B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,QAAQ,CAAA;AACzB,IAAA,QAAA,GAAW,IAAI,IAAI,WAAW,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAO,MAAA,KAAW,QAAA,CAAS,MAAA,IAAU,MAAA,CAAO,aAAa,QAAA,CAAS,QAAA;AAC3E;;;ACxSO,IAAM,mCAAA,GAAsC","file":"index.cjs","sourcesContent":["import type { AutraCardError, AutraCardErrorCode, AutraCardTokenizedResult } from './index';\n\nexport type AutraCardWebViewNativeMessage = {\n  data: string;\n  url?: string;\n};\n\nexport type AutraCardHostedMessage =\n  | { type: 'tokenized'; result: AutraCardTokenizedResult }\n  | { type: 'error'; error: AutraCardError }\n  | { type: 'ready'; requestId?: string };\n\nexport type ParseAutraCardWebViewMessageResult =\n  { ok: true; message: AutraCardHostedMessage } | { ok: false; error: AutraCardError };\n\nconst errorCodes = new Set<AutraCardErrorCode>([\n  'configuration_error',\n  'token_expired',\n  'message_origin_rejected',\n  'message_invalid',\n  'validation_error',\n  'tokenization_failed',\n]);\n\nconst originRejectedError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Rejected hosted card message origin.',\n  retryable: false,\n};\n\nconst invalidMessageError: AutraCardError = {\n  code: 'message_invalid',\n  message: 'Invalid hosted card message.',\n  retryable: false,\n};\n\nexport function deriveAllowedOrigins(cardBaseUrl: string): string[] {\n  return [new URL(cardBaseUrl).origin];\n}\n\n/**\n * Normalizes a caller-supplied origin list into canonical HTTPS origins.\n *\n * Guards against silent lockouts: `['https://cards.example/']` (trailing\n * slash) never equals a browser-reported origin and would reject every\n * hosted message. Entries that are not valid HTTPS URLs are dropped —\n * postMessage trust must never be extended to plaintext origins.\n */\nexport function normalizeAllowedOrigins(origins: readonly string[]): string[] {\n  const normalized: string[] = [];\n\n  for (const candidate of origins) {\n    let url: URL;\n\n    try {\n      url = new URL(candidate);\n    } catch {\n      continue;\n    }\n\n    if (url.protocol !== 'https:') {\n      continue;\n    }\n\n    if (!normalized.includes(url.origin)) {\n      normalized.push(url.origin);\n    }\n  }\n\n  return normalized;\n}\n\nexport function parseAutraCardWebViewMessage(\n  event: AutraCardWebViewNativeMessage,\n  allowedOrigins: readonly string[],\n): ParseAutraCardWebViewMessageResult {\n  const eventOrigin = toOrigin(event.url);\n\n  if (eventOrigin === undefined || !allowedOrigins.includes(eventOrigin)) {\n    return { ok: false, error: originRejectedError };\n  }\n\n  const rawMessage = parseJson(event.data);\n\n  if (!isRecord(rawMessage)) {\n    return { ok: false, error: invalidMessageError };\n  }\n\n  if (rawMessage.type === 'autra.card.tokenized' && isRecord(rawMessage.payload)) {\n    const result = toTokenizedResult(rawMessage.payload);\n\n    if (result !== undefined) {\n      return { ok: true, message: { type: 'tokenized', result } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.error' && isRecord(rawMessage.error)) {\n    const error = toAutraCardError(rawMessage.error);\n\n    if (error !== undefined) {\n      return { ok: true, message: { type: 'error', error } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.ready') {\n    return {\n      ok: true,\n      message: {\n        type: 'ready',\n        requestId: optionalString(rawMessage.requestId),\n      },\n    };\n  }\n\n  return { ok: false, error: invalidMessageError };\n}\n\nfunction toOrigin(url: string | undefined): string | undefined {\n  if (url === undefined) {\n    return undefined;\n  }\n\n  try {\n    return new URL(url).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseJson(data: string): unknown {\n  try {\n    return JSON.parse(data) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction optionalString(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction toTokenizedResult(payload: Record<string, unknown>): AutraCardTokenizedResult | undefined {\n  const storedCard = isRecord(payload.storedCard) ? payload.storedCard : undefined;\n  const tokenizedCard = isRecord(payload.tokenizedCard) ? payload.tokenizedCard : undefined;\n\n  const slugStoredCard =\n    optionalString(payload.slugStoredCard) ?? optionalString(storedCard?.slugStoredCard);\n  const slugToken = optionalString(payload.slugToken) ?? optionalString(tokenizedCard?.slugToken);\n  const tokenExpirationDate =\n    optionalString(payload.tokenExpirationDate) ??\n    optionalString(tokenizedCard?.tokenExpirationDate);\n\n  if (slugStoredCard === undefined && slugToken === undefined) {\n    return undefined;\n  }\n\n  return {\n    slugStoredCard,\n    slugToken,\n    tokenExpirationDate,\n    brand: optionalString(payload.brand),\n    last4: optionalString(payload.last4),\n    expirationMonth: optionalString(payload.expirationMonth),\n    expirationYear: optionalString(payload.expirationYear),\n    requestId: optionalString(payload.requestId),\n  };\n}\n\nfunction toAutraCardError(error: Record<string, unknown>): AutraCardError | undefined {\n  if (typeof error.code !== 'string' || !isAutraCardErrorCode(error.code)) {\n    return undefined;\n  }\n\n  if (typeof error.message !== 'string') {\n    return undefined;\n  }\n\n  return {\n    code: error.code,\n    message: error.message,\n    requestId: optionalString(error.requestId),\n    retryable: typeof error.retryable === 'boolean' ? error.retryable : undefined,\n  };\n}\n\nfunction isAutraCardErrorCode(code: string): code is AutraCardErrorCode {\n  return errorCodes.has(code as AutraCardErrorCode);\n}\n","import React from 'react';\nimport type { StyleProp, ViewStyle } from 'react-native';\nimport { WebView } from 'react-native-webview';\n\nimport type { AutraCardError, AutraCardTokenizedResult } from './index';\nimport {\n  deriveAllowedOrigins,\n  normalizeAllowedOrigins,\n  parseAutraCardWebViewMessage,\n  type AutraCardWebViewNativeMessage,\n} from './messages';\n\nexport type AutraCardFormProps = {\n  hostedCardUrl: string;\n  onSuccess: (result: AutraCardTokenizedResult) => void;\n  onError: (error: AutraCardError) => void;\n  allowedOrigins?: readonly string[];\n  onReady?: (requestId?: string) => void;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\ntype WebViewMessageEvent = {\n  nativeEvent: AutraCardWebViewNativeMessage;\n};\n\ntype WebViewHttpErrorEvent = {\n  nativeEvent: {\n    statusCode: number;\n    url?: string;\n  };\n};\n\ntype WebViewNavigationRequest = {\n  url: string;\n};\n\ntype AutraCardWebViewProps = {\n  source: {\n    uri: string;\n  };\n  originWhitelist: string[];\n  onMessage: (event: WebViewMessageEvent) => void;\n  onError: () => void;\n  onHttpError: (event: WebViewHttpErrorEvent) => void;\n  onShouldStartLoadWithRequest: (request: WebViewNavigationRequest) => boolean;\n  mixedContentMode: 'never';\n  allowFileAccess: boolean;\n  allowsBackForwardNavigationGestures: boolean;\n  incognito: boolean;\n  cacheEnabled: boolean;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\nconst hostedPageLoadError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page failed to load.',\n  retryable: true,\n};\n\nconst hostedPageHttpError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page returned an HTTP error.',\n  retryable: true,\n};\n\nconst hostedSessionUnauthorizedError: AutraCardError = {\n  code: 'token_expired',\n  message: 'Hosted card session expired or is not authorized.',\n  retryable: false,\n};\n\nconst invalidHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Invalid hosted card URL.',\n  retryable: false,\n};\n\nconst insecureHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Hosted card URL must use HTTPS.',\n  retryable: false,\n};\n\nconst invalidAllowedOriginsError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'allowedOrigins must contain at least one valid HTTPS origin.',\n  retryable: false,\n};\n\nconst blockedNavigationError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Blocked hosted card navigation.',\n  retryable: false,\n};\n\nexport function buildAutraCardTokenizeUrl(hostedCardUrl: string): string {\n  return hostedCardUrl;\n}\n\ntype HostedCardConfiguration =\n  | { ok: true; tokenizeUrl: string; allowedOrigins: readonly string[] }\n  | { ok: false; error: AutraCardError };\n\nexport function AutraCardForm(props: AutraCardFormProps): React.ReactElement | null {\n  // Key the memo by origin CONTENT so an inline `allowedOrigins={[...]}`\n  // (new array identity every render) neither recomputes nor re-emits.\n  const allowedOriginsKey = props.allowedOrigins?.join(' ');\n  const configuration = React.useMemo<HostedCardConfiguration>(\n    () => resolveHostedCardConfiguration(props.hostedCardUrl, props.allowedOrigins),\n    // deps intentionally keyed by content (allowedOriginsKey), not array identity\n    [props.hostedCardUrl, allowedOriginsKey],\n  );\n\n  // Terminal guard: once the hosted page reports a successful tokenization,\n  // every later event (duplicate `tokenized`, stray errors, sub-frame noise)\n  // is ignored so the consumer can never double-charge or double-navigate.\n  const terminalRef = React.useRef(false);\n\n  const onErrorRef = React.useRef(props.onError);\n  React.useEffect(() => {\n    onErrorRef.current = props.onError;\n  });\n\n  // Configuration errors are emitted from an effect: calling props.onError\n  // during render would trigger a parent setState mid-render (React error\n  // \"Cannot update a component while rendering a different component\") and\n  // would re-fire on every re-render.\n  React.useEffect(() => {\n    if (!configuration.ok) {\n      onErrorRef.current(configuration.error);\n    }\n  }, [configuration]);\n\n  if (!configuration.ok) {\n    return null;\n  }\n\n  const { tokenizeUrl, allowedOrigins } = configuration;\n\n  const handleMessage = (event: WebViewMessageEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    const result = parseAutraCardWebViewMessage(event.nativeEvent, allowedOrigins);\n\n    if (!result.ok) {\n      props.onError(result.error);\n      return;\n    }\n\n    if (result.message.type === 'tokenized') {\n      terminalRef.current = true;\n      props.onSuccess(result.message.result);\n      return;\n    }\n\n    if (result.message.type === 'error') {\n      props.onError(result.message.error);\n      return;\n    }\n\n    props.onReady?.(result.message.requestId);\n  };\n\n  const handleHttpError = (event: WebViewHttpErrorEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    // On Android onHttpError also fires for sub-resources (favicon, assets,\n    // page-initiated fetches). Only a failure of the hosted DOCUMENT itself\n    // is fatal to the flow — the page reports its own API errors through the\n    // postMessage channel.\n    if (!isHostedDocumentUrl(event.nativeEvent.url, tokenizeUrl)) {\n      return;\n    }\n\n    if (event.nativeEvent.statusCode === 401 || event.nativeEvent.statusCode === 403) {\n      props.onError(hostedSessionUnauthorizedError);\n      return;\n    }\n\n    props.onError(hostedPageHttpError);\n  };\n\n  const handleShouldStartLoadWithRequest = (request: WebViewNavigationRequest): boolean => {\n    if (isAllowedHostedNavigation(request.url, allowedOrigins)) {\n      return true;\n    }\n\n    if (!terminalRef.current) {\n      props.onError(blockedNavigationError);\n    }\n    return false;\n  };\n\n  const WebViewComponent = WebView as unknown as React.ComponentType<AutraCardWebViewProps>;\n\n  return React.createElement(WebViewComponent, {\n    source: {\n      uri: tokenizeUrl,\n    },\n    // Security: react-native-webview hands URLs that fail originWhitelist to\n    // the OS (Linking.openURL) BEFORE onShouldStartLoadWithRequest runs — a\n    // compromised hosted page could silently bounce the user to an external\n    // browser (phishing surface). The payment-WebView hardening pattern is a\n    // wildcard whitelist plus a full allowlist in\n    // onShouldStartLoadWithRequest: returning false there blocks the\n    // navigation WITHOUT opening it externally.\n    originWhitelist: ['*'],\n    onMessage: handleMessage,\n    onError: () => {\n      if (!terminalRef.current) {\n        props.onError(hostedPageLoadError);\n      }\n    },\n    onHttpError: handleHttpError,\n    onShouldStartLoadWithRequest: handleShouldStartLoadWithRequest,\n    mixedContentMode: 'never',\n    allowFileAccess: false,\n    allowsBackForwardNavigationGestures: false,\n    // PCI hygiene: never persist the hosted card page (or anything typed in\n    // it) to disk caches.\n    incognito: true,\n    cacheEnabled: false,\n    style: props.style,\n    testID: props.testID,\n  });\n}\n\nfunction resolveHostedCardConfiguration(\n  hostedCardUrl: string,\n  allowedOriginsInput: readonly string[] | undefined,\n): HostedCardConfiguration {\n  const parsedHostedCardUrl = parseHostedCardUrl(hostedCardUrl);\n\n  if (!parsedHostedCardUrl.ok) {\n    return parsedHostedCardUrl;\n  }\n\n  // Normalization guards against silent lockouts: an entry with a trailing\n  // slash/path (`https://cards.example/`) would never equal a browser origin\n  // and would reject every hosted message. Non-HTTPS entries are dropped.\n  const allowedOrigins = normalizeAllowedOrigins(\n    allowedOriginsInput ?? deriveAllowedOrigins(hostedCardUrl),\n  );\n\n  if (allowedOrigins.length === 0) {\n    return { ok: false, error: invalidAllowedOriginsError };\n  }\n\n  return {\n    ok: true,\n    tokenizeUrl: buildAutraCardTokenizeUrl(hostedCardUrl),\n    allowedOrigins,\n  };\n}\n\nfunction parseHostedCardUrl(\n  hostedCardUrl: string,\n): { ok: true; url: URL } | { ok: false; error: AutraCardError } {\n  let url: URL;\n\n  try {\n    url = new URL(hostedCardUrl);\n  } catch {\n    return { ok: false, error: invalidHostedUrlError };\n  }\n\n  if (url.protocol !== 'https:') {\n    return { ok: false, error: insecureHostedUrlError };\n  }\n\n  return { ok: true, url };\n}\n\nfunction isAllowedHostedNavigation(\n  navigationUrl: string,\n  allowedOrigins: readonly string[],\n): boolean {\n  let url: URL;\n\n  try {\n    url = new URL(navigationUrl);\n  } catch {\n    return false;\n  }\n\n  if (url.protocol !== 'https:') {\n    return false;\n  }\n\n  return allowedOrigins.includes(url.origin);\n}\n\nfunction isHostedDocumentUrl(eventUrl: string | undefined, documentUrl: string): boolean {\n  if (eventUrl === undefined) {\n    // Older react-native-webview versions omit the URL — stay conservative\n    // and treat the failure as fatal rather than silently swallowing it.\n    return true;\n  }\n\n  let failed: URL;\n  let document: URL;\n\n  try {\n    failed = new URL(eventUrl);\n    document = new URL(documentUrl);\n  } catch {\n    return true;\n  }\n\n  return failed.origin === document.origin && failed.pathname === document.pathname;\n}\n","/**\n * @autra-io/react-native-card — hosted card tokenization SDK exports.\n *\n * Phase: v0 hosted-WebView tokenization. The SDK owns only the React Native\n * component shell and message bridge; the hosted card page owns PAN/CVV entry.\n *\n * Security (payment-adjacent SDK):\n *   - Never embed or log PAN, CVV, expiry or cardholder data.\n *   - Never place OAuth clientSecret or a strong accessToken in the app.\n *   - The mobile context must only ever load a short-lived hostedCardUrl.\n */\n\nexport { AutraCardForm } from './AutraCardForm';\nexport type { AutraCardFormProps } from './AutraCardForm';\n\n// Injected at build time from package.json (see tsup.config.ts /\n// vitest.config.ts) so the constant always matches the published version.\ndeclare const __AUTRA_SDK_VERSION__: string;\n\n/** The published package version of this SDK build. */\nexport const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = __AUTRA_SDK_VERSION__;\n\n/**\n * Result returned by a successful card tokenization.\n * `slugStoredCard` is the opaque reference the backend uses to charge later.\n * Never populate this with raw PAN/CVV; only tokenized/masked references.\n */\nexport type AutraCardTokenizedResult = {\n  slugStoredCard?: string;\n  slugToken?: string;\n  tokenExpirationDate?: string;\n  brand?: string;\n  last4?: string;\n  expirationMonth?: string;\n  expirationYear?: string;\n  requestId?: string;\n};\n\n/** Normalized v0 error code taxonomy surfaced by the SDK. */\nexport type AutraCardErrorCode =\n  | 'configuration_error'\n  | 'token_expired'\n  | 'message_origin_rejected'\n  | 'message_invalid'\n  | 'validation_error'\n  | 'tokenization_failed';\n\nexport type AutraCardError = {\n  code: AutraCardErrorCode;\n  message: string;\n  requestId?: string;\n  retryable?: boolean;\n};\n"]}

package/dist/index.d.cts

@@ -24,8 +24,8 @@ declare function AutraCardForm(props: AutraCardFormProps): React.ReactElement |
  *   - The mobile context must only ever load a short-lived hostedCardUrl.
  */
 
-/** Semantic version marker for the v0 implementation phase. */
-declare const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.0";
+/** The published package version of this SDK build. */
+declare const AUTRA_REACT_NATIVE_CARD_SDK_VERSION: string;
 /**
  * Result returned by a successful card tokenization.
  * `slugStoredCard` is the opaque reference the backend uses to charge later.

package/dist/index.d.ts

@@ -24,8 +24,8 @@ declare function AutraCardForm(props: AutraCardFormProps): React.ReactElement |
  *   - The mobile context must only ever load a short-lived hostedCardUrl.
  */
 
-/** Semantic version marker for the v0 implementation phase. */
-declare const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.0";
+/** The published package version of this SDK build. */
+declare const AUTRA_REACT_NATIVE_CARD_SDK_VERSION: string;
 /**
  * Result returned by a successful card tokenization.
  * `slugStoredCard` is the opaque reference the backend uses to charge later.

package/dist/index.js

@@ -327,7 +327,7 @@ function isHostedDocumentUrl(eventUrl, documentUrl) {
 }
 
 // src/index.ts
-var AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.0";
+var AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.1";
 
 export { AUTRA_REACT_NATIVE_CARD_SDK_VERSION, AutraCardForm };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/messages.ts","../src/AutraCardForm.ts","../src/index.ts"],"names":[],"mappings":";;;;;;AAeA,IAAM,UAAA,uBAAiB,GAAA,CAAwB;AAAA,EAC7C,qBAAA;AAAA,EACA,eAAA;AAAA,EACA,yBAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,sCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,iBAAA;AAAA,EACN,OAAA,EAAS,8BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,qBAAqB,WAAA,EAA+B;AAClE,EAAA,OAAO,CAAC,IAAI,GAAA,CAAI,WAAW,EAAE,MAAM,CAAA;AACrC;AAUO,SAAS,wBAAwB,OAAA,EAAsC;AAC5E,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,KAAA,MAAW,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,SAAS,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,CAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AACpC,MAAA,UAAA,CAAW,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,UAAA;AACT;AAEO,SAAS,4BAAA,CACd,OACA,cAAA,EACoC;AACpC,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAEtC,EAAA,IAAI,gBAAgB,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,WAAW,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA;AAEvC,EAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AACzB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,sBAAA,IAA0B,QAAA,CAAS,UAAA,CAAW,OAAO,CAAA,EAAG;AAC9E,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAA,CAAW,OAAO,CAAA;AAEnD,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAa,QAAO,EAAE;AAAA,IAC5D;AAAA,EACF;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,kBAAA,IAAsB,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AACxE,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,UAAA,CAAW,KAAK,CAAA;AAE/C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,OAAM,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,SAAS,kBAAA,EAAoB;AAC1C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,OAAA;AAAA,QACN,SAAA,EAAW,cAAA,CAAe,UAAA,CAAW,SAAS;AAAA;AAChD,KACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AACjD;AAEA,SAAS,SAAS,GAAA,EAA6C;AAC7D,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,eAAe,KAAA,EAAoC;AAC1D,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,kBAAkB,OAAA,EAAwE;AACjG,EAAA,MAAM,aAAa,QAAA,CAAS,OAAA,CAAQ,UAAU,CAAA,GAAI,QAAQ,UAAA,GAAa,MAAA;AACvE,EAAA,MAAM,gBAAgB,QAAA,CAAS,OAAA,CAAQ,aAAa,CAAA,GAAI,QAAQ,aAAA,GAAgB,MAAA;AAEhF,EAAA,MAAM,iBACJ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA,IAAK,cAAA,CAAe,YAAY,cAAc,CAAA;AACrF,EAAA,MAAM,YAAY,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,IAAK,cAAA,CAAe,eAAe,SAAS,CAAA;AAC9F,EAAA,MAAM,sBACJ,cAAA,CAAe,OAAA,CAAQ,mBAAmB,CAAA,IAC1C,cAAA,CAAe,eAAe,mBAAmB,CAAA;AAEnD,EAAA,IAAI,cAAA,KAAmB,MAAA,IAAa,SAAA,KAAc,MAAA,EAAW;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,cAAA;AAAA,IACA,SAAA;AAAA,IACA,mBAAA;AAAA,IACA,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,eAAA,EAAiB,cAAA,CAAe,OAAA,CAAQ,eAAe,CAAA;AAAA,IACvD,cAAA,EAAgB,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AAAA,IACrD,SAAA,EAAW,cAAA,CAAe,OAAA,CAAQ,SAAS;AAAA,GAC7C;AACF;AAEA,SAAS,iBAAiB,KAAA,EAA4D;AACpF,EAAA,IAAI,OAAO,MAAM,IAAA,KAAS,QAAA,IAAY,CAAC,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA,EAAG;AACvE,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,EAAU;AACrC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,SAAA,EAAW,cAAA,CAAe,KAAA,CAAM,SAAS,CAAA;AAAA,IACzC,WAAW,OAAO,KAAA,CAAM,SAAA,KAAc,SAAA,GAAY,MAAM,SAAA,GAAY;AAAA,GACtE;AACF;AAEA,SAAS,qBAAqB,IAAA,EAA0C;AACtE,EAAA,OAAO,UAAA,CAAW,IAAI,IAA0B,CAAA;AAClD;;;ACxIA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,kCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0CAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,8BAAA,GAAiD;AAAA,EACrD,IAAA,EAAM,eAAA;AAAA,EACN,OAAA,EAAS,mDAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,qBAAA,GAAwC;AAAA,EAC5C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,0BAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,8DAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,0BAA0B,aAAA,EAA+B;AACvE,EAAA,OAAO,aAAA;AACT;AAMO,SAAS,cAAc,KAAA,EAAsD;AAGlF,EAAA,MAAM,iBAAA,GAAoB,KAAA,CAAM,cAAA,EAAgB,IAAA,CAAK,GAAG,CAAA;AACxD,EAAA,MAAM,gBAAgB,KAAA,CAAM,OAAA;AAAA,IAC1B,MAAM,8BAAA,CAA+B,KAAA,CAAM,aAAA,EAAe,MAAM,cAAc,CAAA;AAAA;AAAA,IAE9E,CAAC,KAAA,CAAM,aAAA,EAAe,iBAAiB;AAAA,GACzC;AAKA,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AAEtC,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAC7C,EAAA,KAAA,CAAM,UAAU,MAAM;AACpB,IAAA,UAAA,CAAW,UAAU,KAAA,CAAM,OAAA;AAAA,EAC7B,CAAC,CAAA;AAMD,EAAA,KAAA,CAAM,UAAU,MAAM;AACpB,IAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,MAAA,UAAA,CAAW,OAAA,CAAQ,cAAc,KAAK,CAAA;AAAA,IACxC;AAAA,EACF,CAAA,EAAG,CAAC,aAAa,CAAC,CAAA;AAElB,EAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,EAAE,WAAA,EAAa,cAAA,EAAe,GAAI,aAAA;AAExC,EAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,KAAqC;AAC1D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,KAAA,CAAM,WAAA,EAAa,cAAc,CAAA;AAE7E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,KAAA,CAAM,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa;AACvC,MAAA,WAAA,CAAY,OAAA,GAAU,IAAA;AACtB,MAAA,KAAA,CAAM,SAAA,CAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACrC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA;AAClC,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA;AAAA,EAC1C,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,KAAA,KAAuC;AAC9D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAMA,IAAA,IAAI,CAAC,mBAAA,CAAoB,KAAA,CAAM,WAAA,CAAY,GAAA,EAAK,WAAW,CAAA,EAAG;AAC5D,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAM,WAAA,CAAY,UAAA,KAAe,OAAO,KAAA,CAAM,WAAA,CAAY,eAAe,GAAA,EAAK;AAChF,MAAA,KAAA,CAAM,QAAQ,8BAA8B,CAAA;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,gCAAA,GAAmC,CAAC,OAAA,KAA+C;AACvF,IAAA,IAAI,yBAAA,CAA0B,OAAA,CAAQ,GAAA,EAAK,cAAc,CAAA,EAAG;AAC1D,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,KAAA,CAAM,QAAQ,sBAAsB,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmB,OAAA;AAEzB,EAAA,OAAO,KAAA,CAAM,cAAc,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK;AAAA,KACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,eAAA,EAAiB,CAAC,GAAG,CAAA;AAAA,IACrB,SAAA,EAAW,aAAA;AAAA,IACX,SAAS,MAAM;AACb,MAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,QAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,WAAA,EAAa,eAAA;AAAA,IACb,4BAAA,EAA8B,gCAAA;AAAA,IAC9B,gBAAA,EAAkB,OAAA;AAAA,IAClB,eAAA,EAAiB,KAAA;AAAA,IACjB,mCAAA,EAAqC,KAAA;AAAA;AAAA;AAAA,IAGrC,SAAA,EAAW,IAAA;AAAA,IACX,YAAA,EAAc,KAAA;AAAA,IACd,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,QAAQ,KAAA,CAAM;AAAA,GACf,CAAA;AACH;AAEA,SAAS,8BAAA,CACP,eACA,mBAAA,EACyB;AACzB,EAAA,MAAM,mBAAA,GAAsB,mBAAmB,aAAa,CAAA;AAE5D,EAAA,IAAI,CAAC,oBAAoB,EAAA,EAAI;AAC3B,IAAA,OAAO,mBAAA;AAAA,EACT;AAKA,EAAA,MAAM,cAAA,GAAiB,uBAAA;AAAA,IACrB,mBAAA,IAAuB,qBAAqB,aAAa;AAAA,GAC3D;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,0BAAA,EAA2B;AAAA,EACxD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,WAAA,EAAa,0BAA0B,aAAa,CAAA;AAAA,IACpD;AAAA,GACF;AACF;AAEA,SAAS,mBACP,aAAA,EAC+D;AAC/D,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACnD;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,EACpD;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AACzB;AAEA,SAAS,yBAAA,CACP,eACA,cAAA,EACS;AACT,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,cAAA,CAAe,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AAC3C;AAEA,SAAS,mBAAA,CAAoB,UAA8B,WAAA,EAA8B;AACvF,EAAA,IAAI,aAAa,MAAA,EAAW;AAG1B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,QAAQ,CAAA;AACzB,IAAA,QAAA,GAAW,IAAI,IAAI,WAAW,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAO,MAAA,KAAW,QAAA,CAAS,MAAA,IAAU,MAAA,CAAO,aAAa,QAAA,CAAS,QAAA;AAC3E;;;AC5SO,IAAM,mCAAA,GAAsC","file":"index.js","sourcesContent":["import type { AutraCardError, AutraCardErrorCode, AutraCardTokenizedResult } from './index';\n\nexport type AutraCardWebViewNativeMessage = {\n  data: string;\n  url?: string;\n};\n\nexport type AutraCardHostedMessage =\n  | { type: 'tokenized'; result: AutraCardTokenizedResult }\n  | { type: 'error'; error: AutraCardError }\n  | { type: 'ready'; requestId?: string };\n\nexport type ParseAutraCardWebViewMessageResult =\n  { ok: true; message: AutraCardHostedMessage } | { ok: false; error: AutraCardError };\n\nconst errorCodes = new Set<AutraCardErrorCode>([\n  'configuration_error',\n  'token_expired',\n  'message_origin_rejected',\n  'message_invalid',\n  'validation_error',\n  'tokenization_failed',\n]);\n\nconst originRejectedError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Rejected hosted card message origin.',\n  retryable: false,\n};\n\nconst invalidMessageError: AutraCardError = {\n  code: 'message_invalid',\n  message: 'Invalid hosted card message.',\n  retryable: false,\n};\n\nexport function deriveAllowedOrigins(cardBaseUrl: string): string[] {\n  return [new URL(cardBaseUrl).origin];\n}\n\n/**\n * Normalizes a caller-supplied origin list into canonical HTTPS origins.\n *\n * Guards against silent lockouts: `['https://cards.example/']` (trailing\n * slash) never equals a browser-reported origin and would reject every\n * hosted message. Entries that are not valid HTTPS URLs are dropped —\n * postMessage trust must never be extended to plaintext origins.\n */\nexport function normalizeAllowedOrigins(origins: readonly string[]): string[] {\n  const normalized: string[] = [];\n\n  for (const candidate of origins) {\n    let url: URL;\n\n    try {\n      url = new URL(candidate);\n    } catch {\n      continue;\n    }\n\n    if (url.protocol !== 'https:') {\n      continue;\n    }\n\n    if (!normalized.includes(url.origin)) {\n      normalized.push(url.origin);\n    }\n  }\n\n  return normalized;\n}\n\nexport function parseAutraCardWebViewMessage(\n  event: AutraCardWebViewNativeMessage,\n  allowedOrigins: readonly string[],\n): ParseAutraCardWebViewMessageResult {\n  const eventOrigin = toOrigin(event.url);\n\n  if (eventOrigin === undefined || !allowedOrigins.includes(eventOrigin)) {\n    return { ok: false, error: originRejectedError };\n  }\n\n  const rawMessage = parseJson(event.data);\n\n  if (!isRecord(rawMessage)) {\n    return { ok: false, error: invalidMessageError };\n  }\n\n  if (rawMessage.type === 'autra.card.tokenized' && isRecord(rawMessage.payload)) {\n    const result = toTokenizedResult(rawMessage.payload);\n\n    if (result !== undefined) {\n      return { ok: true, message: { type: 'tokenized', result } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.error' && isRecord(rawMessage.error)) {\n    const error = toAutraCardError(rawMessage.error);\n\n    if (error !== undefined) {\n      return { ok: true, message: { type: 'error', error } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.ready') {\n    return {\n      ok: true,\n      message: {\n        type: 'ready',\n        requestId: optionalString(rawMessage.requestId),\n      },\n    };\n  }\n\n  return { ok: false, error: invalidMessageError };\n}\n\nfunction toOrigin(url: string | undefined): string | undefined {\n  if (url === undefined) {\n    return undefined;\n  }\n\n  try {\n    return new URL(url).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseJson(data: string): unknown {\n  try {\n    return JSON.parse(data) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction optionalString(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction toTokenizedResult(payload: Record<string, unknown>): AutraCardTokenizedResult | undefined {\n  const storedCard = isRecord(payload.storedCard) ? payload.storedCard : undefined;\n  const tokenizedCard = isRecord(payload.tokenizedCard) ? payload.tokenizedCard : undefined;\n\n  const slugStoredCard =\n    optionalString(payload.slugStoredCard) ?? optionalString(storedCard?.slugStoredCard);\n  const slugToken = optionalString(payload.slugToken) ?? optionalString(tokenizedCard?.slugToken);\n  const tokenExpirationDate =\n    optionalString(payload.tokenExpirationDate) ??\n    optionalString(tokenizedCard?.tokenExpirationDate);\n\n  if (slugStoredCard === undefined && slugToken === undefined) {\n    return undefined;\n  }\n\n  return {\n    slugStoredCard,\n    slugToken,\n    tokenExpirationDate,\n    brand: optionalString(payload.brand),\n    last4: optionalString(payload.last4),\n    expirationMonth: optionalString(payload.expirationMonth),\n    expirationYear: optionalString(payload.expirationYear),\n    requestId: optionalString(payload.requestId),\n  };\n}\n\nfunction toAutraCardError(error: Record<string, unknown>): AutraCardError | undefined {\n  if (typeof error.code !== 'string' || !isAutraCardErrorCode(error.code)) {\n    return undefined;\n  }\n\n  if (typeof error.message !== 'string') {\n    return undefined;\n  }\n\n  return {\n    code: error.code,\n    message: error.message,\n    requestId: optionalString(error.requestId),\n    retryable: typeof error.retryable === 'boolean' ? error.retryable : undefined,\n  };\n}\n\nfunction isAutraCardErrorCode(code: string): code is AutraCardErrorCode {\n  return errorCodes.has(code as AutraCardErrorCode);\n}\n","import React from 'react';\nimport type { StyleProp, ViewStyle } from 'react-native';\nimport { WebView } from 'react-native-webview';\n\nimport type { AutraCardError, AutraCardTokenizedResult } from './index';\nimport {\n  deriveAllowedOrigins,\n  normalizeAllowedOrigins,\n  parseAutraCardWebViewMessage,\n  type AutraCardWebViewNativeMessage,\n} from './messages';\n\nexport type AutraCardFormProps = {\n  hostedCardUrl: string;\n  onSuccess: (result: AutraCardTokenizedResult) => void;\n  onError: (error: AutraCardError) => void;\n  allowedOrigins?: readonly string[];\n  onReady?: (requestId?: string) => void;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\ntype WebViewMessageEvent = {\n  nativeEvent: AutraCardWebViewNativeMessage;\n};\n\ntype WebViewHttpErrorEvent = {\n  nativeEvent: {\n    statusCode: number;\n    url?: string;\n  };\n};\n\ntype WebViewNavigationRequest = {\n  url: string;\n};\n\ntype AutraCardWebViewProps = {\n  source: {\n    uri: string;\n  };\n  originWhitelist: string[];\n  onMessage: (event: WebViewMessageEvent) => void;\n  onError: () => void;\n  onHttpError: (event: WebViewHttpErrorEvent) => void;\n  onShouldStartLoadWithRequest: (request: WebViewNavigationRequest) => boolean;\n  mixedContentMode: 'never';\n  allowFileAccess: boolean;\n  allowsBackForwardNavigationGestures: boolean;\n  incognito: boolean;\n  cacheEnabled: boolean;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\nconst hostedPageLoadError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page failed to load.',\n  retryable: true,\n};\n\nconst hostedPageHttpError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page returned an HTTP error.',\n  retryable: true,\n};\n\nconst hostedSessionUnauthorizedError: AutraCardError = {\n  code: 'token_expired',\n  message: 'Hosted card session expired or is not authorized.',\n  retryable: false,\n};\n\nconst invalidHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Invalid hosted card URL.',\n  retryable: false,\n};\n\nconst insecureHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Hosted card URL must use HTTPS.',\n  retryable: false,\n};\n\nconst invalidAllowedOriginsError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'allowedOrigins must contain at least one valid HTTPS origin.',\n  retryable: false,\n};\n\nconst blockedNavigationError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Blocked hosted card navigation.',\n  retryable: false,\n};\n\nexport function buildAutraCardTokenizeUrl(hostedCardUrl: string): string {\n  return hostedCardUrl;\n}\n\ntype HostedCardConfiguration =\n  | { ok: true; tokenizeUrl: string; allowedOrigins: readonly string[] }\n  | { ok: false; error: AutraCardError };\n\nexport function AutraCardForm(props: AutraCardFormProps): React.ReactElement | null {\n  // Key the memo by origin CONTENT so an inline `allowedOrigins={[...]}`\n  // (new array identity every render) neither recomputes nor re-emits.\n  const allowedOriginsKey = props.allowedOrigins?.join(' ');\n  const configuration = React.useMemo<HostedCardConfiguration>(\n    () => resolveHostedCardConfiguration(props.hostedCardUrl, props.allowedOrigins),\n    // deps intentionally keyed by content (allowedOriginsKey), not array identity\n    [props.hostedCardUrl, allowedOriginsKey],\n  );\n\n  // Terminal guard: once the hosted page reports a successful tokenization,\n  // every later event (duplicate `tokenized`, stray errors, sub-frame noise)\n  // is ignored so the consumer can never double-charge or double-navigate.\n  const terminalRef = React.useRef(false);\n\n  const onErrorRef = React.useRef(props.onError);\n  React.useEffect(() => {\n    onErrorRef.current = props.onError;\n  });\n\n  // Configuration errors are emitted from an effect: calling props.onError\n  // during render would trigger a parent setState mid-render (React error\n  // \"Cannot update a component while rendering a different component\") and\n  // would re-fire on every re-render.\n  React.useEffect(() => {\n    if (!configuration.ok) {\n      onErrorRef.current(configuration.error);\n    }\n  }, [configuration]);\n\n  if (!configuration.ok) {\n    return null;\n  }\n\n  const { tokenizeUrl, allowedOrigins } = configuration;\n\n  const handleMessage = (event: WebViewMessageEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    const result = parseAutraCardWebViewMessage(event.nativeEvent, allowedOrigins);\n\n    if (!result.ok) {\n      props.onError(result.error);\n      return;\n    }\n\n    if (result.message.type === 'tokenized') {\n      terminalRef.current = true;\n      props.onSuccess(result.message.result);\n      return;\n    }\n\n    if (result.message.type === 'error') {\n      props.onError(result.message.error);\n      return;\n    }\n\n    props.onReady?.(result.message.requestId);\n  };\n\n  const handleHttpError = (event: WebViewHttpErrorEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    // On Android onHttpError also fires for sub-resources (favicon, assets,\n    // page-initiated fetches). Only a failure of the hosted DOCUMENT itself\n    // is fatal to the flow — the page reports its own API errors through the\n    // postMessage channel.\n    if (!isHostedDocumentUrl(event.nativeEvent.url, tokenizeUrl)) {\n      return;\n    }\n\n    if (event.nativeEvent.statusCode === 401 || event.nativeEvent.statusCode === 403) {\n      props.onError(hostedSessionUnauthorizedError);\n      return;\n    }\n\n    props.onError(hostedPageHttpError);\n  };\n\n  const handleShouldStartLoadWithRequest = (request: WebViewNavigationRequest): boolean => {\n    if (isAllowedHostedNavigation(request.url, allowedOrigins)) {\n      return true;\n    }\n\n    if (!terminalRef.current) {\n      props.onError(blockedNavigationError);\n    }\n    return false;\n  };\n\n  const WebViewComponent = WebView as unknown as React.ComponentType<AutraCardWebViewProps>;\n\n  return React.createElement(WebViewComponent, {\n    source: {\n      uri: tokenizeUrl,\n    },\n    // Security: react-native-webview hands URLs that fail originWhitelist to\n    // the OS (Linking.openURL) BEFORE onShouldStartLoadWithRequest runs — a\n    // compromised hosted page could silently bounce the user to an external\n    // browser (phishing surface). The payment-WebView hardening pattern is a\n    // wildcard whitelist plus a full allowlist in\n    // onShouldStartLoadWithRequest: returning false there blocks the\n    // navigation WITHOUT opening it externally.\n    originWhitelist: ['*'],\n    onMessage: handleMessage,\n    onError: () => {\n      if (!terminalRef.current) {\n        props.onError(hostedPageLoadError);\n      }\n    },\n    onHttpError: handleHttpError,\n    onShouldStartLoadWithRequest: handleShouldStartLoadWithRequest,\n    mixedContentMode: 'never',\n    allowFileAccess: false,\n    allowsBackForwardNavigationGestures: false,\n    // PCI hygiene: never persist the hosted card page (or anything typed in\n    // it) to disk caches.\n    incognito: true,\n    cacheEnabled: false,\n    style: props.style,\n    testID: props.testID,\n  });\n}\n\nfunction resolveHostedCardConfiguration(\n  hostedCardUrl: string,\n  allowedOriginsInput: readonly string[] | undefined,\n): HostedCardConfiguration {\n  const parsedHostedCardUrl = parseHostedCardUrl(hostedCardUrl);\n\n  if (!parsedHostedCardUrl.ok) {\n    return parsedHostedCardUrl;\n  }\n\n  // Normalization guards against silent lockouts: an entry with a trailing\n  // slash/path (`https://cards.example/`) would never equal a browser origin\n  // and would reject every hosted message. Non-HTTPS entries are dropped.\n  const allowedOrigins = normalizeAllowedOrigins(\n    allowedOriginsInput ?? deriveAllowedOrigins(hostedCardUrl),\n  );\n\n  if (allowedOrigins.length === 0) {\n    return { ok: false, error: invalidAllowedOriginsError };\n  }\n\n  return {\n    ok: true,\n    tokenizeUrl: buildAutraCardTokenizeUrl(hostedCardUrl),\n    allowedOrigins,\n  };\n}\n\nfunction parseHostedCardUrl(\n  hostedCardUrl: string,\n): { ok: true; url: URL } | { ok: false; error: AutraCardError } {\n  let url: URL;\n\n  try {\n    url = new URL(hostedCardUrl);\n  } catch {\n    return { ok: false, error: invalidHostedUrlError };\n  }\n\n  if (url.protocol !== 'https:') {\n    return { ok: false, error: insecureHostedUrlError };\n  }\n\n  return { ok: true, url };\n}\n\nfunction isAllowedHostedNavigation(\n  navigationUrl: string,\n  allowedOrigins: readonly string[],\n): boolean {\n  let url: URL;\n\n  try {\n    url = new URL(navigationUrl);\n  } catch {\n    return false;\n  }\n\n  if (url.protocol !== 'https:') {\n    return false;\n  }\n\n  return allowedOrigins.includes(url.origin);\n}\n\nfunction isHostedDocumentUrl(eventUrl: string | undefined, documentUrl: string): boolean {\n  if (eventUrl === undefined) {\n    // Older react-native-webview versions omit the URL — stay conservative\n    // and treat the failure as fatal rather than silently swallowing it.\n    return true;\n  }\n\n  let failed: URL;\n  let document: URL;\n\n  try {\n    failed = new URL(eventUrl);\n    document = new URL(documentUrl);\n  } catch {\n    return true;\n  }\n\n  return failed.origin === document.origin && failed.pathname === document.pathname;\n}\n","/**\n * @autra-io/react-native-card — hosted card tokenization SDK exports.\n *\n * Phase: v0 hosted-WebView tokenization. The SDK owns only the React Native\n * component shell and message bridge; the hosted card page owns PAN/CVV entry.\n *\n * Security (payment-adjacent SDK):\n *   - Never embed or log PAN, CVV, expiry or cardholder data.\n *   - Never place OAuth clientSecret or a strong accessToken in the app.\n *   - The mobile context must only ever load a short-lived hostedCardUrl.\n */\n\nexport { AutraCardForm } from './AutraCardForm';\nexport type { AutraCardFormProps } from './AutraCardForm';\n\n/** Semantic version marker for the v0 implementation phase. */\nexport const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = '0.1.0';\n\n/**\n * Result returned by a successful card tokenization.\n * `slugStoredCard` is the opaque reference the backend uses to charge later.\n * Never populate this with raw PAN/CVV; only tokenized/masked references.\n */\nexport type AutraCardTokenizedResult = {\n  slugStoredCard?: string;\n  slugToken?: string;\n  tokenExpirationDate?: string;\n  brand?: string;\n  last4?: string;\n  expirationMonth?: string;\n  expirationYear?: string;\n  requestId?: string;\n};\n\n/** Normalized v0 error code taxonomy surfaced by the SDK. */\nexport type AutraCardErrorCode =\n  | 'configuration_error'\n  | 'token_expired'\n  | 'message_origin_rejected'\n  | 'message_invalid'\n  | 'validation_error'\n  | 'tokenization_failed';\n\nexport type AutraCardError = {\n  code: AutraCardErrorCode;\n  message: string;\n  requestId?: string;\n  retryable?: boolean;\n};\n"]}
+{"version":3,"sources":["../src/messages.ts","../src/AutraCardForm.ts","../src/index.ts"],"names":[],"mappings":";;;;;;AAeA,IAAM,UAAA,uBAAiB,GAAA,CAAwB;AAAA,EAC7C,qBAAA;AAAA,EACA,eAAA;AAAA,EACA,yBAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,sCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,iBAAA;AAAA,EACN,OAAA,EAAS,8BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,qBAAqB,WAAA,EAA+B;AAClE,EAAA,OAAO,CAAC,IAAI,GAAA,CAAI,WAAW,EAAE,MAAM,CAAA;AACrC;AAUO,SAAS,wBAAwB,OAAA,EAAsC;AAC5E,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,KAAA,MAAW,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,SAAS,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,CAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AACpC,MAAA,UAAA,CAAW,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,UAAA;AACT;AAEO,SAAS,4BAAA,CACd,OACA,cAAA,EACoC;AACpC,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAEtC,EAAA,IAAI,gBAAgB,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,WAAW,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA;AAEvC,EAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AACzB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,sBAAA,IAA0B,QAAA,CAAS,UAAA,CAAW,OAAO,CAAA,EAAG;AAC9E,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAA,CAAW,OAAO,CAAA;AAEnD,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAa,QAAO,EAAE;AAAA,IAC5D;AAAA,EACF;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,kBAAA,IAAsB,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AACxE,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,UAAA,CAAW,KAAK,CAAA;AAE/C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,OAAM,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,SAAS,kBAAA,EAAoB;AAC1C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,OAAA;AAAA,QACN,SAAA,EAAW,cAAA,CAAe,UAAA,CAAW,SAAS;AAAA;AAChD,KACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AACjD;AAEA,SAAS,SAAS,GAAA,EAA6C;AAC7D,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,eAAe,KAAA,EAAoC;AAC1D,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,kBAAkB,OAAA,EAAwE;AACjG,EAAA,MAAM,aAAa,QAAA,CAAS,OAAA,CAAQ,UAAU,CAAA,GAAI,QAAQ,UAAA,GAAa,MAAA;AACvE,EAAA,MAAM,gBAAgB,QAAA,CAAS,OAAA,CAAQ,aAAa,CAAA,GAAI,QAAQ,aAAA,GAAgB,MAAA;AAEhF,EAAA,MAAM,iBACJ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA,IAAK,cAAA,CAAe,YAAY,cAAc,CAAA;AACrF,EAAA,MAAM,YAAY,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,IAAK,cAAA,CAAe,eAAe,SAAS,CAAA;AAC9F,EAAA,MAAM,sBACJ,cAAA,CAAe,OAAA,CAAQ,mBAAmB,CAAA,IAC1C,cAAA,CAAe,eAAe,mBAAmB,CAAA;AAEnD,EAAA,IAAI,cAAA,KAAmB,MAAA,IAAa,SAAA,KAAc,MAAA,EAAW;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,cAAA;AAAA,IACA,SAAA;AAAA,IACA,mBAAA;AAAA,IACA,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,eAAA,EAAiB,cAAA,CAAe,OAAA,CAAQ,eAAe,CAAA;AAAA,IACvD,cAAA,EAAgB,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AAAA,IACrD,SAAA,EAAW,cAAA,CAAe,OAAA,CAAQ,SAAS;AAAA,GAC7C;AACF;AAEA,SAAS,iBAAiB,KAAA,EAA4D;AACpF,EAAA,IAAI,OAAO,MAAM,IAAA,KAAS,QAAA,IAAY,CAAC,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA,EAAG;AACvE,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,EAAU;AACrC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,SAAA,EAAW,cAAA,CAAe,KAAA,CAAM,SAAS,CAAA;AAAA,IACzC,WAAW,OAAO,KAAA,CAAM,SAAA,KAAc,SAAA,GAAY,MAAM,SAAA,GAAY;AAAA,GACtE;AACF;AAEA,SAAS,qBAAqB,IAAA,EAA0C;AACtE,EAAA,OAAO,UAAA,CAAW,IAAI,IAA0B,CAAA;AAClD;;;ACxIA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,kCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0CAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,8BAAA,GAAiD;AAAA,EACrD,IAAA,EAAM,eAAA;AAAA,EACN,OAAA,EAAS,mDAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,qBAAA,GAAwC;AAAA,EAC5C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,0BAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,8DAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,0BAA0B,aAAA,EAA+B;AACvE,EAAA,OAAO,aAAA;AACT;AAMO,SAAS,cAAc,KAAA,EAAsD;AAGlF,EAAA,MAAM,iBAAA,GAAoB,KAAA,CAAM,cAAA,EAAgB,IAAA,CAAK,GAAG,CAAA;AACxD,EAAA,MAAM,gBAAgB,KAAA,CAAM,OAAA;AAAA,IAC1B,MAAM,8BAAA,CAA+B,KAAA,CAAM,aAAA,EAAe,MAAM,cAAc,CAAA;AAAA;AAAA,IAE9E,CAAC,KAAA,CAAM,aAAA,EAAe,iBAAiB;AAAA,GACzC;AAKA,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AAEtC,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAC7C,EAAA,KAAA,CAAM,UAAU,MAAM;AACpB,IAAA,UAAA,CAAW,UAAU,KAAA,CAAM,OAAA;AAAA,EAC7B,CAAC,CAAA;AAMD,EAAA,KAAA,CAAM,UAAU,MAAM;AACpB,IAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,MAAA,UAAA,CAAW,OAAA,CAAQ,cAAc,KAAK,CAAA;AAAA,IACxC;AAAA,EACF,CAAA,EAAG,CAAC,aAAa,CAAC,CAAA;AAElB,EAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,EAAE,WAAA,EAAa,cAAA,EAAe,GAAI,aAAA;AAExC,EAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,KAAqC;AAC1D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,KAAA,CAAM,WAAA,EAAa,cAAc,CAAA;AAE7E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,KAAA,CAAM,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa;AACvC,MAAA,WAAA,CAAY,OAAA,GAAU,IAAA;AACtB,MAAA,KAAA,CAAM,SAAA,CAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACrC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA;AAClC,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA;AAAA,EAC1C,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,KAAA,KAAuC;AAC9D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAMA,IAAA,IAAI,CAAC,mBAAA,CAAoB,KAAA,CAAM,WAAA,CAAY,GAAA,EAAK,WAAW,CAAA,EAAG;AAC5D,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAM,WAAA,CAAY,UAAA,KAAe,OAAO,KAAA,CAAM,WAAA,CAAY,eAAe,GAAA,EAAK;AAChF,MAAA,KAAA,CAAM,QAAQ,8BAA8B,CAAA;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,gCAAA,GAAmC,CAAC,OAAA,KAA+C;AACvF,IAAA,IAAI,yBAAA,CAA0B,OAAA,CAAQ,GAAA,EAAK,cAAc,CAAA,EAAG;AAC1D,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,KAAA,CAAM,QAAQ,sBAAsB,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmB,OAAA;AAEzB,EAAA,OAAO,KAAA,CAAM,cAAc,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK;AAAA,KACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,eAAA,EAAiB,CAAC,GAAG,CAAA;AAAA,IACrB,SAAA,EAAW,aAAA;AAAA,IACX,SAAS,MAAM;AACb,MAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,QAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,WAAA,EAAa,eAAA;AAAA,IACb,4BAAA,EAA8B,gCAAA;AAAA,IAC9B,gBAAA,EAAkB,OAAA;AAAA,IAClB,eAAA,EAAiB,KAAA;AAAA,IACjB,mCAAA,EAAqC,KAAA;AAAA;AAAA;AAAA,IAGrC,SAAA,EAAW,IAAA;AAAA,IACX,YAAA,EAAc,KAAA;AAAA,IACd,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,QAAQ,KAAA,CAAM;AAAA,GACf,CAAA;AACH;AAEA,SAAS,8BAAA,CACP,eACA,mBAAA,EACyB;AACzB,EAAA,MAAM,mBAAA,GAAsB,mBAAmB,aAAa,CAAA;AAE5D,EAAA,IAAI,CAAC,oBAAoB,EAAA,EAAI;AAC3B,IAAA,OAAO,mBAAA;AAAA,EACT;AAKA,EAAA,MAAM,cAAA,GAAiB,uBAAA;AAAA,IACrB,mBAAA,IAAuB,qBAAqB,aAAa;AAAA,GAC3D;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,0BAAA,EAA2B;AAAA,EACxD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,WAAA,EAAa,0BAA0B,aAAa,CAAA;AAAA,IACpD;AAAA,GACF;AACF;AAEA,SAAS,mBACP,aAAA,EAC+D;AAC/D,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACnD;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,EACpD;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AACzB;AAEA,SAAS,yBAAA,CACP,eACA,cAAA,EACS;AACT,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,cAAA,CAAe,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AAC3C;AAEA,SAAS,mBAAA,CAAoB,UAA8B,WAAA,EAA8B;AACvF,EAAA,IAAI,aAAa,MAAA,EAAW;AAG1B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,QAAQ,CAAA;AACzB,IAAA,QAAA,GAAW,IAAI,IAAI,WAAW,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAO,MAAA,KAAW,QAAA,CAAS,MAAA,IAAU,MAAA,CAAO,aAAa,QAAA,CAAS,QAAA;AAC3E;;;ACxSO,IAAM,mCAAA,GAAsC","file":"index.js","sourcesContent":["import type { AutraCardError, AutraCardErrorCode, AutraCardTokenizedResult } from './index';\n\nexport type AutraCardWebViewNativeMessage = {\n  data: string;\n  url?: string;\n};\n\nexport type AutraCardHostedMessage =\n  | { type: 'tokenized'; result: AutraCardTokenizedResult }\n  | { type: 'error'; error: AutraCardError }\n  | { type: 'ready'; requestId?: string };\n\nexport type ParseAutraCardWebViewMessageResult =\n  { ok: true; message: AutraCardHostedMessage } | { ok: false; error: AutraCardError };\n\nconst errorCodes = new Set<AutraCardErrorCode>([\n  'configuration_error',\n  'token_expired',\n  'message_origin_rejected',\n  'message_invalid',\n  'validation_error',\n  'tokenization_failed',\n]);\n\nconst originRejectedError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Rejected hosted card message origin.',\n  retryable: false,\n};\n\nconst invalidMessageError: AutraCardError = {\n  code: 'message_invalid',\n  message: 'Invalid hosted card message.',\n  retryable: false,\n};\n\nexport function deriveAllowedOrigins(cardBaseUrl: string): string[] {\n  return [new URL(cardBaseUrl).origin];\n}\n\n/**\n * Normalizes a caller-supplied origin list into canonical HTTPS origins.\n *\n * Guards against silent lockouts: `['https://cards.example/']` (trailing\n * slash) never equals a browser-reported origin and would reject every\n * hosted message. Entries that are not valid HTTPS URLs are dropped —\n * postMessage trust must never be extended to plaintext origins.\n */\nexport function normalizeAllowedOrigins(origins: readonly string[]): string[] {\n  const normalized: string[] = [];\n\n  for (const candidate of origins) {\n    let url: URL;\n\n    try {\n      url = new URL(candidate);\n    } catch {\n      continue;\n    }\n\n    if (url.protocol !== 'https:') {\n      continue;\n    }\n\n    if (!normalized.includes(url.origin)) {\n      normalized.push(url.origin);\n    }\n  }\n\n  return normalized;\n}\n\nexport function parseAutraCardWebViewMessage(\n  event: AutraCardWebViewNativeMessage,\n  allowedOrigins: readonly string[],\n): ParseAutraCardWebViewMessageResult {\n  const eventOrigin = toOrigin(event.url);\n\n  if (eventOrigin === undefined || !allowedOrigins.includes(eventOrigin)) {\n    return { ok: false, error: originRejectedError };\n  }\n\n  const rawMessage = parseJson(event.data);\n\n  if (!isRecord(rawMessage)) {\n    return { ok: false, error: invalidMessageError };\n  }\n\n  if (rawMessage.type === 'autra.card.tokenized' && isRecord(rawMessage.payload)) {\n    const result = toTokenizedResult(rawMessage.payload);\n\n    if (result !== undefined) {\n      return { ok: true, message: { type: 'tokenized', result } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.error' && isRecord(rawMessage.error)) {\n    const error = toAutraCardError(rawMessage.error);\n\n    if (error !== undefined) {\n      return { ok: true, message: { type: 'error', error } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.ready') {\n    return {\n      ok: true,\n      message: {\n        type: 'ready',\n        requestId: optionalString(rawMessage.requestId),\n      },\n    };\n  }\n\n  return { ok: false, error: invalidMessageError };\n}\n\nfunction toOrigin(url: string | undefined): string | undefined {\n  if (url === undefined) {\n    return undefined;\n  }\n\n  try {\n    return new URL(url).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseJson(data: string): unknown {\n  try {\n    return JSON.parse(data) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction optionalString(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction toTokenizedResult(payload: Record<string, unknown>): AutraCardTokenizedResult | undefined {\n  const storedCard = isRecord(payload.storedCard) ? payload.storedCard : undefined;\n  const tokenizedCard = isRecord(payload.tokenizedCard) ? payload.tokenizedCard : undefined;\n\n  const slugStoredCard =\n    optionalString(payload.slugStoredCard) ?? optionalString(storedCard?.slugStoredCard);\n  const slugToken = optionalString(payload.slugToken) ?? optionalString(tokenizedCard?.slugToken);\n  const tokenExpirationDate =\n    optionalString(payload.tokenExpirationDate) ??\n    optionalString(tokenizedCard?.tokenExpirationDate);\n\n  if (slugStoredCard === undefined && slugToken === undefined) {\n    return undefined;\n  }\n\n  return {\n    slugStoredCard,\n    slugToken,\n    tokenExpirationDate,\n    brand: optionalString(payload.brand),\n    last4: optionalString(payload.last4),\n    expirationMonth: optionalString(payload.expirationMonth),\n    expirationYear: optionalString(payload.expirationYear),\n    requestId: optionalString(payload.requestId),\n  };\n}\n\nfunction toAutraCardError(error: Record<string, unknown>): AutraCardError | undefined {\n  if (typeof error.code !== 'string' || !isAutraCardErrorCode(error.code)) {\n    return undefined;\n  }\n\n  if (typeof error.message !== 'string') {\n    return undefined;\n  }\n\n  return {\n    code: error.code,\n    message: error.message,\n    requestId: optionalString(error.requestId),\n    retryable: typeof error.retryable === 'boolean' ? error.retryable : undefined,\n  };\n}\n\nfunction isAutraCardErrorCode(code: string): code is AutraCardErrorCode {\n  return errorCodes.has(code as AutraCardErrorCode);\n}\n","import React from 'react';\nimport type { StyleProp, ViewStyle } from 'react-native';\nimport { WebView } from 'react-native-webview';\n\nimport type { AutraCardError, AutraCardTokenizedResult } from './index';\nimport {\n  deriveAllowedOrigins,\n  normalizeAllowedOrigins,\n  parseAutraCardWebViewMessage,\n  type AutraCardWebViewNativeMessage,\n} from './messages';\n\nexport type AutraCardFormProps = {\n  hostedCardUrl: string;\n  onSuccess: (result: AutraCardTokenizedResult) => void;\n  onError: (error: AutraCardError) => void;\n  allowedOrigins?: readonly string[];\n  onReady?: (requestId?: string) => void;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\ntype WebViewMessageEvent = {\n  nativeEvent: AutraCardWebViewNativeMessage;\n};\n\ntype WebViewHttpErrorEvent = {\n  nativeEvent: {\n    statusCode: number;\n    url?: string;\n  };\n};\n\ntype WebViewNavigationRequest = {\n  url: string;\n};\n\ntype AutraCardWebViewProps = {\n  source: {\n    uri: string;\n  };\n  originWhitelist: string[];\n  onMessage: (event: WebViewMessageEvent) => void;\n  onError: () => void;\n  onHttpError: (event: WebViewHttpErrorEvent) => void;\n  onShouldStartLoadWithRequest: (request: WebViewNavigationRequest) => boolean;\n  mixedContentMode: 'never';\n  allowFileAccess: boolean;\n  allowsBackForwardNavigationGestures: boolean;\n  incognito: boolean;\n  cacheEnabled: boolean;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\nconst hostedPageLoadError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page failed to load.',\n  retryable: true,\n};\n\nconst hostedPageHttpError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page returned an HTTP error.',\n  retryable: true,\n};\n\nconst hostedSessionUnauthorizedError: AutraCardError = {\n  code: 'token_expired',\n  message: 'Hosted card session expired or is not authorized.',\n  retryable: false,\n};\n\nconst invalidHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Invalid hosted card URL.',\n  retryable: false,\n};\n\nconst insecureHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Hosted card URL must use HTTPS.',\n  retryable: false,\n};\n\nconst invalidAllowedOriginsError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'allowedOrigins must contain at least one valid HTTPS origin.',\n  retryable: false,\n};\n\nconst blockedNavigationError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Blocked hosted card navigation.',\n  retryable: false,\n};\n\nexport function buildAutraCardTokenizeUrl(hostedCardUrl: string): string {\n  return hostedCardUrl;\n}\n\ntype HostedCardConfiguration =\n  | { ok: true; tokenizeUrl: string; allowedOrigins: readonly string[] }\n  | { ok: false; error: AutraCardError };\n\nexport function AutraCardForm(props: AutraCardFormProps): React.ReactElement | null {\n  // Key the memo by origin CONTENT so an inline `allowedOrigins={[...]}`\n  // (new array identity every render) neither recomputes nor re-emits.\n  const allowedOriginsKey = props.allowedOrigins?.join(' ');\n  const configuration = React.useMemo<HostedCardConfiguration>(\n    () => resolveHostedCardConfiguration(props.hostedCardUrl, props.allowedOrigins),\n    // deps intentionally keyed by content (allowedOriginsKey), not array identity\n    [props.hostedCardUrl, allowedOriginsKey],\n  );\n\n  // Terminal guard: once the hosted page reports a successful tokenization,\n  // every later event (duplicate `tokenized`, stray errors, sub-frame noise)\n  // is ignored so the consumer can never double-charge or double-navigate.\n  const terminalRef = React.useRef(false);\n\n  const onErrorRef = React.useRef(props.onError);\n  React.useEffect(() => {\n    onErrorRef.current = props.onError;\n  });\n\n  // Configuration errors are emitted from an effect: calling props.onError\n  // during render would trigger a parent setState mid-render (React error\n  // \"Cannot update a component while rendering a different component\") and\n  // would re-fire on every re-render.\n  React.useEffect(() => {\n    if (!configuration.ok) {\n      onErrorRef.current(configuration.error);\n    }\n  }, [configuration]);\n\n  if (!configuration.ok) {\n    return null;\n  }\n\n  const { tokenizeUrl, allowedOrigins } = configuration;\n\n  const handleMessage = (event: WebViewMessageEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    const result = parseAutraCardWebViewMessage(event.nativeEvent, allowedOrigins);\n\n    if (!result.ok) {\n      props.onError(result.error);\n      return;\n    }\n\n    if (result.message.type === 'tokenized') {\n      terminalRef.current = true;\n      props.onSuccess(result.message.result);\n      return;\n    }\n\n    if (result.message.type === 'error') {\n      props.onError(result.message.error);\n      return;\n    }\n\n    props.onReady?.(result.message.requestId);\n  };\n\n  const handleHttpError = (event: WebViewHttpErrorEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    // On Android onHttpError also fires for sub-resources (favicon, assets,\n    // page-initiated fetches). Only a failure of the hosted DOCUMENT itself\n    // is fatal to the flow — the page reports its own API errors through the\n    // postMessage channel.\n    if (!isHostedDocumentUrl(event.nativeEvent.url, tokenizeUrl)) {\n      return;\n    }\n\n    if (event.nativeEvent.statusCode === 401 || event.nativeEvent.statusCode === 403) {\n      props.onError(hostedSessionUnauthorizedError);\n      return;\n    }\n\n    props.onError(hostedPageHttpError);\n  };\n\n  const handleShouldStartLoadWithRequest = (request: WebViewNavigationRequest): boolean => {\n    if (isAllowedHostedNavigation(request.url, allowedOrigins)) {\n      return true;\n    }\n\n    if (!terminalRef.current) {\n      props.onError(blockedNavigationError);\n    }\n    return false;\n  };\n\n  const WebViewComponent = WebView as unknown as React.ComponentType<AutraCardWebViewProps>;\n\n  return React.createElement(WebViewComponent, {\n    source: {\n      uri: tokenizeUrl,\n    },\n    // Security: react-native-webview hands URLs that fail originWhitelist to\n    // the OS (Linking.openURL) BEFORE onShouldStartLoadWithRequest runs — a\n    // compromised hosted page could silently bounce the user to an external\n    // browser (phishing surface). The payment-WebView hardening pattern is a\n    // wildcard whitelist plus a full allowlist in\n    // onShouldStartLoadWithRequest: returning false there blocks the\n    // navigation WITHOUT opening it externally.\n    originWhitelist: ['*'],\n    onMessage: handleMessage,\n    onError: () => {\n      if (!terminalRef.current) {\n        props.onError(hostedPageLoadError);\n      }\n    },\n    onHttpError: handleHttpError,\n    onShouldStartLoadWithRequest: handleShouldStartLoadWithRequest,\n    mixedContentMode: 'never',\n    allowFileAccess: false,\n    allowsBackForwardNavigationGestures: false,\n    // PCI hygiene: never persist the hosted card page (or anything typed in\n    // it) to disk caches.\n    incognito: true,\n    cacheEnabled: false,\n    style: props.style,\n    testID: props.testID,\n  });\n}\n\nfunction resolveHostedCardConfiguration(\n  hostedCardUrl: string,\n  allowedOriginsInput: readonly string[] | undefined,\n): HostedCardConfiguration {\n  const parsedHostedCardUrl = parseHostedCardUrl(hostedCardUrl);\n\n  if (!parsedHostedCardUrl.ok) {\n    return parsedHostedCardUrl;\n  }\n\n  // Normalization guards against silent lockouts: an entry with a trailing\n  // slash/path (`https://cards.example/`) would never equal a browser origin\n  // and would reject every hosted message. Non-HTTPS entries are dropped.\n  const allowedOrigins = normalizeAllowedOrigins(\n    allowedOriginsInput ?? deriveAllowedOrigins(hostedCardUrl),\n  );\n\n  if (allowedOrigins.length === 0) {\n    return { ok: false, error: invalidAllowedOriginsError };\n  }\n\n  return {\n    ok: true,\n    tokenizeUrl: buildAutraCardTokenizeUrl(hostedCardUrl),\n    allowedOrigins,\n  };\n}\n\nfunction parseHostedCardUrl(\n  hostedCardUrl: string,\n): { ok: true; url: URL } | { ok: false; error: AutraCardError } {\n  let url: URL;\n\n  try {\n    url = new URL(hostedCardUrl);\n  } catch {\n    return { ok: false, error: invalidHostedUrlError };\n  }\n\n  if (url.protocol !== 'https:') {\n    return { ok: false, error: insecureHostedUrlError };\n  }\n\n  return { ok: true, url };\n}\n\nfunction isAllowedHostedNavigation(\n  navigationUrl: string,\n  allowedOrigins: readonly string[],\n): boolean {\n  let url: URL;\n\n  try {\n    url = new URL(navigationUrl);\n  } catch {\n    return false;\n  }\n\n  if (url.protocol !== 'https:') {\n    return false;\n  }\n\n  return allowedOrigins.includes(url.origin);\n}\n\nfunction isHostedDocumentUrl(eventUrl: string | undefined, documentUrl: string): boolean {\n  if (eventUrl === undefined) {\n    // Older react-native-webview versions omit the URL — stay conservative\n    // and treat the failure as fatal rather than silently swallowing it.\n    return true;\n  }\n\n  let failed: URL;\n  let document: URL;\n\n  try {\n    failed = new URL(eventUrl);\n    document = new URL(documentUrl);\n  } catch {\n    return true;\n  }\n\n  return failed.origin === document.origin && failed.pathname === document.pathname;\n}\n","/**\n * @autra-io/react-native-card — hosted card tokenization SDK exports.\n *\n * Phase: v0 hosted-WebView tokenization. The SDK owns only the React Native\n * component shell and message bridge; the hosted card page owns PAN/CVV entry.\n *\n * Security (payment-adjacent SDK):\n *   - Never embed or log PAN, CVV, expiry or cardholder data.\n *   - Never place OAuth clientSecret or a strong accessToken in the app.\n *   - The mobile context must only ever load a short-lived hostedCardUrl.\n */\n\nexport { AutraCardForm } from './AutraCardForm';\nexport type { AutraCardFormProps } from './AutraCardForm';\n\n// Injected at build time from package.json (see tsup.config.ts /\n// vitest.config.ts) so the constant always matches the published version.\ndeclare const __AUTRA_SDK_VERSION__: string;\n\n/** The published package version of this SDK build. */\nexport const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = __AUTRA_SDK_VERSION__;\n\n/**\n * Result returned by a successful card tokenization.\n * `slugStoredCard` is the opaque reference the backend uses to charge later.\n * Never populate this with raw PAN/CVV; only tokenized/masked references.\n */\nexport type AutraCardTokenizedResult = {\n  slugStoredCard?: string;\n  slugToken?: string;\n  tokenExpirationDate?: string;\n  brand?: string;\n  last4?: string;\n  expirationMonth?: string;\n  expirationYear?: string;\n  requestId?: string;\n};\n\n/** Normalized v0 error code taxonomy surfaced by the SDK. */\nexport type AutraCardErrorCode =\n  | 'configuration_error'\n  | 'token_expired'\n  | 'message_origin_rejected'\n  | 'message_invalid'\n  | 'validation_error'\n  | 'tokenization_failed';\n\nexport type AutraCardError = {\n  code: AutraCardErrorCode;\n  message: string;\n  requestId?: string;\n  retryable?: boolean;\n};\n"]}

package/package.json

@@ -1,17 +1,14 @@
 {
   "name": "@autra-io/react-native-card",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "React Native SDK for secure card tokenization via Autra's hosted card page.",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "type": "module",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/autratech/autra-card-sdk-react-native.git"
   },
-  "homepage": "https://github.com/autratech/autra-card-sdk-react-native#readme",
-  "bugs": {
-    "url": "https://github.com/autratech/autra-card-sdk-react-native/issues"
-  },
+  "homepage": "https://autra.io",
   "keywords": [
     "react-native",
     "card",
@@ -42,7 +39,8 @@
     "README.pt-BR.md",
     "SECURITY.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "NOTICE"
   ],
   "engines": {
     "node": ">=20"
@@ -82,6 +80,7 @@
     "eslint-config-prettier": "^9.1.0",
     "prettier": "^3.3.3",
     "react-test-renderer": "^19.2.7",
+    "semantic-release": "25.0.5",
     "tsup": "^8.3.5",
     "typescript": "^5.6.3",
     "typescript-eslint": "^8.16.0",