@autra-io/react-native-card 0.1.0

package/dist/index.cjs

@@ -0,0 +1,341 @@
+'use strict';
+
+var React = require('react');
+var reactNativeWebview = require('react-native-webview');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var React__default = /*#__PURE__*/_interopDefault(React);
+
+// src/AutraCardForm.ts
+
+// src/messages.ts
+var errorCodes = /* @__PURE__ */ new Set([
+  "configuration_error",
+  "token_expired",
+  "message_origin_rejected",
+  "message_invalid",
+  "validation_error",
+  "tokenization_failed"
+]);
+var originRejectedError = {
+  code: "message_origin_rejected",
+  message: "Rejected hosted card message origin.",
+  retryable: false
+};
+var invalidMessageError = {
+  code: "message_invalid",
+  message: "Invalid hosted card message.",
+  retryable: false
+};
+function deriveAllowedOrigins(cardBaseUrl) {
+  return [new URL(cardBaseUrl).origin];
+}
+function normalizeAllowedOrigins(origins) {
+  const normalized = [];
+  for (const candidate of origins) {
+    let url;
+    try {
+      url = new URL(candidate);
+    } catch {
+      continue;
+    }
+    if (url.protocol !== "https:") {
+      continue;
+    }
+    if (!normalized.includes(url.origin)) {
+      normalized.push(url.origin);
+    }
+  }
+  return normalized;
+}
+function parseAutraCardWebViewMessage(event, allowedOrigins) {
+  const eventOrigin = toOrigin(event.url);
+  if (eventOrigin === void 0 || !allowedOrigins.includes(eventOrigin)) {
+    return { ok: false, error: originRejectedError };
+  }
+  const rawMessage = parseJson(event.data);
+  if (!isRecord(rawMessage)) {
+    return { ok: false, error: invalidMessageError };
+  }
+  if (rawMessage.type === "autra.card.tokenized" && isRecord(rawMessage.payload)) {
+    const result = toTokenizedResult(rawMessage.payload);
+    if (result !== void 0) {
+      return { ok: true, message: { type: "tokenized", result } };
+    }
+  }
+  if (rawMessage.type === "autra.card.error" && isRecord(rawMessage.error)) {
+    const error = toAutraCardError(rawMessage.error);
+    if (error !== void 0) {
+      return { ok: true, message: { type: "error", error } };
+    }
+  }
+  if (rawMessage.type === "autra.card.ready") {
+    return {
+      ok: true,
+      message: {
+        type: "ready",
+        requestId: optionalString(rawMessage.requestId)
+      }
+    };
+  }
+  return { ok: false, error: invalidMessageError };
+}
+function toOrigin(url) {
+  if (url === void 0) {
+    return void 0;
+  }
+  try {
+    return new URL(url).origin;
+  } catch {
+    return void 0;
+  }
+}
+function parseJson(data) {
+  try {
+    return JSON.parse(data);
+  } catch {
+    return void 0;
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function toTokenizedResult(payload) {
+  const storedCard = isRecord(payload.storedCard) ? payload.storedCard : void 0;
+  const tokenizedCard = isRecord(payload.tokenizedCard) ? payload.tokenizedCard : void 0;
+  const slugStoredCard = optionalString(payload.slugStoredCard) ?? optionalString(storedCard?.slugStoredCard);
+  const slugToken = optionalString(payload.slugToken) ?? optionalString(tokenizedCard?.slugToken);
+  const tokenExpirationDate = optionalString(payload.tokenExpirationDate) ?? optionalString(tokenizedCard?.tokenExpirationDate);
+  if (slugStoredCard === void 0 && slugToken === void 0) {
+    return void 0;
+  }
+  return {
+    slugStoredCard,
+    slugToken,
+    tokenExpirationDate,
+    brand: optionalString(payload.brand),
+    last4: optionalString(payload.last4),
+    expirationMonth: optionalString(payload.expirationMonth),
+    expirationYear: optionalString(payload.expirationYear),
+    requestId: optionalString(payload.requestId)
+  };
+}
+function toAutraCardError(error) {
+  if (typeof error.code !== "string" || !isAutraCardErrorCode(error.code)) {
+    return void 0;
+  }
+  if (typeof error.message !== "string") {
+    return void 0;
+  }
+  return {
+    code: error.code,
+    message: error.message,
+    requestId: optionalString(error.requestId),
+    retryable: typeof error.retryable === "boolean" ? error.retryable : void 0
+  };
+}
+function isAutraCardErrorCode(code) {
+  return errorCodes.has(code);
+}
+
+// src/AutraCardForm.ts
+var hostedPageLoadError = {
+  code: "tokenization_failed",
+  message: "Hosted card page failed to load.",
+  retryable: true
+};
+var hostedPageHttpError = {
+  code: "tokenization_failed",
+  message: "Hosted card page returned an HTTP error.",
+  retryable: true
+};
+var hostedSessionUnauthorizedError = {
+  code: "token_expired",
+  message: "Hosted card session expired or is not authorized.",
+  retryable: false
+};
+var invalidHostedUrlError = {
+  code: "configuration_error",
+  message: "Invalid hosted card URL.",
+  retryable: false
+};
+var insecureHostedUrlError = {
+  code: "configuration_error",
+  message: "Hosted card URL must use HTTPS.",
+  retryable: false
+};
+var invalidAllowedOriginsError = {
+  code: "configuration_error",
+  message: "allowedOrigins must contain at least one valid HTTPS origin.",
+  retryable: false
+};
+var blockedNavigationError = {
+  code: "message_origin_rejected",
+  message: "Blocked hosted card navigation.",
+  retryable: false
+};
+function buildAutraCardTokenizeUrl(hostedCardUrl) {
+  return hostedCardUrl;
+}
+function AutraCardForm(props) {
+  const allowedOriginsKey = props.allowedOrigins?.join(" ");
+  const configuration = React__default.default.useMemo(
+    () => resolveHostedCardConfiguration(props.hostedCardUrl, props.allowedOrigins),
+    // deps intentionally keyed by content (allowedOriginsKey), not array identity
+    [props.hostedCardUrl, allowedOriginsKey]
+  );
+  const terminalRef = React__default.default.useRef(false);
+  const onErrorRef = React__default.default.useRef(props.onError);
+  React__default.default.useEffect(() => {
+    onErrorRef.current = props.onError;
+  });
+  React__default.default.useEffect(() => {
+    if (!configuration.ok) {
+      onErrorRef.current(configuration.error);
+    }
+  }, [configuration]);
+  if (!configuration.ok) {
+    return null;
+  }
+  const { tokenizeUrl, allowedOrigins } = configuration;
+  const handleMessage = (event) => {
+    if (terminalRef.current) {
+      return;
+    }
+    const result = parseAutraCardWebViewMessage(event.nativeEvent, allowedOrigins);
+    if (!result.ok) {
+      props.onError(result.error);
+      return;
+    }
+    if (result.message.type === "tokenized") {
+      terminalRef.current = true;
+      props.onSuccess(result.message.result);
+      return;
+    }
+    if (result.message.type === "error") {
+      props.onError(result.message.error);
+      return;
+    }
+    props.onReady?.(result.message.requestId);
+  };
+  const handleHttpError = (event) => {
+    if (terminalRef.current) {
+      return;
+    }
+    if (!isHostedDocumentUrl(event.nativeEvent.url, tokenizeUrl)) {
+      return;
+    }
+    if (event.nativeEvent.statusCode === 401 || event.nativeEvent.statusCode === 403) {
+      props.onError(hostedSessionUnauthorizedError);
+      return;
+    }
+    props.onError(hostedPageHttpError);
+  };
+  const handleShouldStartLoadWithRequest = (request) => {
+    if (isAllowedHostedNavigation(request.url, allowedOrigins)) {
+      return true;
+    }
+    if (!terminalRef.current) {
+      props.onError(blockedNavigationError);
+    }
+    return false;
+  };
+  const WebViewComponent = reactNativeWebview.WebView;
+  return React__default.default.createElement(WebViewComponent, {
+    source: {
+      uri: tokenizeUrl
+    },
+    // Security: react-native-webview hands URLs that fail originWhitelist to
+    // the OS (Linking.openURL) BEFORE onShouldStartLoadWithRequest runs — a
+    // compromised hosted page could silently bounce the user to an external
+    // browser (phishing surface). The payment-WebView hardening pattern is a
+    // wildcard whitelist plus a full allowlist in
+    // onShouldStartLoadWithRequest: returning false there blocks the
+    // navigation WITHOUT opening it externally.
+    originWhitelist: ["*"],
+    onMessage: handleMessage,
+    onError: () => {
+      if (!terminalRef.current) {
+        props.onError(hostedPageLoadError);
+      }
+    },
+    onHttpError: handleHttpError,
+    onShouldStartLoadWithRequest: handleShouldStartLoadWithRequest,
+    mixedContentMode: "never",
+    allowFileAccess: false,
+    allowsBackForwardNavigationGestures: false,
+    // PCI hygiene: never persist the hosted card page (or anything typed in
+    // it) to disk caches.
+    incognito: true,
+    cacheEnabled: false,
+    style: props.style,
+    testID: props.testID
+  });
+}
+function resolveHostedCardConfiguration(hostedCardUrl, allowedOriginsInput) {
+  const parsedHostedCardUrl = parseHostedCardUrl(hostedCardUrl);
+  if (!parsedHostedCardUrl.ok) {
+    return parsedHostedCardUrl;
+  }
+  const allowedOrigins = normalizeAllowedOrigins(
+    allowedOriginsInput ?? deriveAllowedOrigins(hostedCardUrl)
+  );
+  if (allowedOrigins.length === 0) {
+    return { ok: false, error: invalidAllowedOriginsError };
+  }
+  return {
+    ok: true,
+    tokenizeUrl: buildAutraCardTokenizeUrl(hostedCardUrl),
+    allowedOrigins
+  };
+}
+function parseHostedCardUrl(hostedCardUrl) {
+  let url;
+  try {
+    url = new URL(hostedCardUrl);
+  } catch {
+    return { ok: false, error: invalidHostedUrlError };
+  }
+  if (url.protocol !== "https:") {
+    return { ok: false, error: insecureHostedUrlError };
+  }
+  return { ok: true, url };
+}
+function isAllowedHostedNavigation(navigationUrl, allowedOrigins) {
+  let url;
+  try {
+    url = new URL(navigationUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") {
+    return false;
+  }
+  return allowedOrigins.includes(url.origin);
+}
+function isHostedDocumentUrl(eventUrl, documentUrl) {
+  if (eventUrl === void 0) {
+    return true;
+  }
+  let failed;
+  let document;
+  try {
+    failed = new URL(eventUrl);
+    document = new URL(documentUrl);
+  } catch {
+    return true;
+  }
+  return failed.origin === document.origin && failed.pathname === document.pathname;
+}
+
+// src/index.ts
+var AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.0";
+
+exports.AUTRA_REACT_NATIVE_CARD_SDK_VERSION = AUTRA_REACT_NATIVE_CARD_SDK_VERSION;
+exports.AutraCardForm = AutraCardForm;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/messages.ts","../src/AutraCardForm.ts","../src/index.ts"],"names":["React","WebView"],"mappings":";;;;;;;;;;;;AAeA,IAAM,UAAA,uBAAiB,GAAA,CAAwB;AAAA,EAC7C,qBAAA;AAAA,EACA,eAAA;AAAA,EACA,yBAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,sCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,iBAAA;AAAA,EACN,OAAA,EAAS,8BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,qBAAqB,WAAA,EAA+B;AAClE,EAAA,OAAO,CAAC,IAAI,GAAA,CAAI,WAAW,EAAE,MAAM,CAAA;AACrC;AAUO,SAAS,wBAAwB,OAAA,EAAsC;AAC5E,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,KAAA,MAAW,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,SAAS,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,CAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AACpC,MAAA,UAAA,CAAW,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,UAAA;AACT;AAEO,SAAS,4BAAA,CACd,OACA,cAAA,EACoC;AACpC,EAAA,MAAM,WAAA,GAAc,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAEtC,EAAA,IAAI,gBAAgB,MAAA,IAAa,CAAC,cAAA,CAAe,QAAA,CAAS,WAAW,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA;AAEvC,EAAA,IAAI,CAAC,QAAA,CAAS,UAAU,CAAA,EAAG;AACzB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AAAA,EACjD;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,sBAAA,IAA0B,QAAA,CAAS,UAAA,CAAW,OAAO,CAAA,EAAG;AAC9E,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAA,CAAW,OAAO,CAAA;AAEnD,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,EAAa,QAAO,EAAE;AAAA,IAC5D;AAAA,EACF;AAEA,EAAA,IAAI,WAAW,IAAA,KAAS,kBAAA,IAAsB,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AACxE,IAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,UAAA,CAAW,KAAK,CAAA;AAE/C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,OAAM,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,SAAS,kBAAA,EAAoB;AAC1C,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,OAAA;AAAA,QACN,SAAA,EAAW,cAAA,CAAe,UAAA,CAAW,SAAS;AAAA;AAChD,KACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mBAAA,EAAoB;AACjD;AAEA,SAAS,SAAS,GAAA,EAA6C;AAC7D,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,eAAe,KAAA,EAAoC;AAC1D,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,kBAAkB,OAAA,EAAwE;AACjG,EAAA,MAAM,aAAa,QAAA,CAAS,OAAA,CAAQ,UAAU,CAAA,GAAI,QAAQ,UAAA,GAAa,MAAA;AACvE,EAAA,MAAM,gBAAgB,QAAA,CAAS,OAAA,CAAQ,aAAa,CAAA,GAAI,QAAQ,aAAA,GAAgB,MAAA;AAEhF,EAAA,MAAM,iBACJ,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA,IAAK,cAAA,CAAe,YAAY,cAAc,CAAA;AACrF,EAAA,MAAM,YAAY,cAAA,CAAe,OAAA,CAAQ,SAAS,CAAA,IAAK,cAAA,CAAe,eAAe,SAAS,CAAA;AAC9F,EAAA,MAAM,sBACJ,cAAA,CAAe,OAAA,CAAQ,mBAAmB,CAAA,IAC1C,cAAA,CAAe,eAAe,mBAAmB,CAAA;AAEnD,EAAA,IAAI,cAAA,KAAmB,MAAA,IAAa,SAAA,KAAc,MAAA,EAAW;AAC3D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,cAAA;AAAA,IACA,SAAA;AAAA,IACA,mBAAA;AAAA,IACA,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,KAAA,EAAO,cAAA,CAAe,OAAA,CAAQ,KAAK,CAAA;AAAA,IACnC,eAAA,EAAiB,cAAA,CAAe,OAAA,CAAQ,eAAe,CAAA;AAAA,IACvD,cAAA,EAAgB,cAAA,CAAe,OAAA,CAAQ,cAAc,CAAA;AAAA,IACrD,SAAA,EAAW,cAAA,CAAe,OAAA,CAAQ,SAAS;AAAA,GAC7C;AACF;AAEA,SAAS,iBAAiB,KAAA,EAA4D;AACpF,EAAA,IAAI,OAAO,MAAM,IAAA,KAAS,QAAA,IAAY,CAAC,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA,EAAG;AACvE,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,EAAU;AACrC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,SAAA,EAAW,cAAA,CAAe,KAAA,CAAM,SAAS,CAAA;AAAA,IACzC,WAAW,OAAO,KAAA,CAAM,SAAA,KAAc,SAAA,GAAY,MAAM,SAAA,GAAY;AAAA,GACtE;AACF;AAEA,SAAS,qBAAqB,IAAA,EAA0C;AACtE,EAAA,OAAO,UAAA,CAAW,IAAI,IAA0B,CAAA;AAClD;;;ACxIA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,kCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,mBAAA,GAAsC;AAAA,EAC1C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0CAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,8BAAA,GAAiD;AAAA,EACrD,IAAA,EAAM,eAAA;AAAA,EACN,OAAA,EAAS,mDAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,qBAAA,GAAwC;AAAA,EAC5C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,0BAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,0BAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,qBAAA;AAAA,EACN,OAAA,EAAS,8DAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEA,IAAM,sBAAA,GAAyC;AAAA,EAC7C,IAAA,EAAM,yBAAA;AAAA,EACN,OAAA,EAAS,iCAAA;AAAA,EACT,SAAA,EAAW;AACb,CAAA;AAEO,SAAS,0BAA0B,aAAA,EAA+B;AACvE,EAAA,OAAO,aAAA;AACT;AAMO,SAAS,cAAc,KAAA,EAAsD;AAGlF,EAAA,MAAM,iBAAA,GAAoB,KAAA,CAAM,cAAA,EAAgB,IAAA,CAAK,GAAG,CAAA;AACxD,EAAA,MAAM,gBAAgBA,sBAAA,CAAM,OAAA;AAAA,IAC1B,MAAM,8BAAA,CAA+B,KAAA,CAAM,aAAA,EAAe,MAAM,cAAc,CAAA;AAAA;AAAA,IAE9E,CAAC,KAAA,CAAM,aAAA,EAAe,iBAAiB;AAAA,GACzC;AAKA,EAAA,MAAM,WAAA,GAAcA,sBAAA,CAAM,MAAA,CAAO,KAAK,CAAA;AAEtC,EAAA,MAAM,UAAA,GAAaA,sBAAA,CAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAC7C,EAAAA,sBAAA,CAAM,UAAU,MAAM;AACpB,IAAA,UAAA,CAAW,UAAU,KAAA,CAAM,OAAA;AAAA,EAC7B,CAAC,CAAA;AAMD,EAAAA,sBAAA,CAAM,UAAU,MAAM;AACpB,IAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,MAAA,UAAA,CAAW,OAAA,CAAQ,cAAc,KAAK,CAAA;AAAA,IACxC;AAAA,EACF,CAAA,EAAG,CAAC,aAAa,CAAC,CAAA;AAElB,EAAA,IAAI,CAAC,cAAc,EAAA,EAAI;AACrB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,EAAE,WAAA,EAAa,cAAA,EAAe,GAAI,aAAA;AAExC,EAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,KAAqC;AAC1D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,KAAA,CAAM,WAAA,EAAa,cAAc,CAAA;AAE7E,IAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,MAAA,KAAA,CAAM,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,WAAA,EAAa;AACvC,MAAA,WAAA,CAAY,OAAA,GAAU,IAAA;AACtB,MAAA,KAAA,CAAM,SAAA,CAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACrC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,IAAA,KAAS,OAAA,EAAS;AACnC,MAAA,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA;AAClC,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA;AAAA,EAC1C,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,KAAA,KAAuC;AAC9D,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAMA,IAAA,IAAI,CAAC,mBAAA,CAAoB,KAAA,CAAM,WAAA,CAAY,GAAA,EAAK,WAAW,CAAA,EAAG;AAC5D,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAM,WAAA,CAAY,UAAA,KAAe,OAAO,KAAA,CAAM,WAAA,CAAY,eAAe,GAAA,EAAK;AAChF,MAAA,KAAA,CAAM,QAAQ,8BAA8B,CAAA;AAC5C,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,gCAAA,GAAmC,CAAC,OAAA,KAA+C;AACvF,IAAA,IAAI,yBAAA,CAA0B,OAAA,CAAQ,GAAA,EAAK,cAAc,CAAA,EAAG;AAC1D,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,KAAA,CAAM,QAAQ,sBAAsB,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmBC,0BAAA;AAEzB,EAAA,OAAOD,sBAAA,CAAM,cAAc,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ;AAAA,MACN,GAAA,EAAK;AAAA,KACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,eAAA,EAAiB,CAAC,GAAG,CAAA;AAAA,IACrB,SAAA,EAAW,aAAA;AAAA,IACX,SAAS,MAAM;AACb,MAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,QAAA,KAAA,CAAM,QAAQ,mBAAmB,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,WAAA,EAAa,eAAA;AAAA,IACb,4BAAA,EAA8B,gCAAA;AAAA,IAC9B,gBAAA,EAAkB,OAAA;AAAA,IAClB,eAAA,EAAiB,KAAA;AAAA,IACjB,mCAAA,EAAqC,KAAA;AAAA;AAAA;AAAA,IAGrC,SAAA,EAAW,IAAA;AAAA,IACX,YAAA,EAAc,KAAA;AAAA,IACd,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,QAAQ,KAAA,CAAM;AAAA,GACf,CAAA;AACH;AAEA,SAAS,8BAAA,CACP,eACA,mBAAA,EACyB;AACzB,EAAA,MAAM,mBAAA,GAAsB,mBAAmB,aAAa,CAAA;AAE5D,EAAA,IAAI,CAAC,oBAAoB,EAAA,EAAI;AAC3B,IAAA,OAAO,mBAAA;AAAA,EACT;AAKA,EAAA,MAAM,cAAA,GAAiB,uBAAA;AAAA,IACrB,mBAAA,IAAuB,qBAAqB,aAAa;AAAA,GAC3D;AAEA,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,0BAAA,EAA2B;AAAA,EACxD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,WAAA,EAAa,0BAA0B,aAAa,CAAA;AAAA,IACpD;AAAA,GACF;AACF;AAEA,SAAS,mBACP,aAAA,EAC+D;AAC/D,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACnD;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,EACpD;AAEA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,GAAA,EAAI;AACzB;AAEA,SAAS,yBAAA,CACP,eACA,cAAA,EACS;AACT,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,aAAa,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,cAAA,CAAe,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AAC3C;AAEA,SAAS,mBAAA,CAAoB,UAA8B,WAAA,EAA8B;AACvF,EAAA,IAAI,aAAa,MAAA,EAAW;AAG1B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,QAAQ,CAAA;AACzB,IAAA,QAAA,GAAW,IAAI,IAAI,WAAW,CAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAO,MAAA,KAAW,QAAA,CAAS,MAAA,IAAU,MAAA,CAAO,aAAa,QAAA,CAAS,QAAA;AAC3E;;;AC5SO,IAAM,mCAAA,GAAsC","file":"index.cjs","sourcesContent":["import type { AutraCardError, AutraCardErrorCode, AutraCardTokenizedResult } from './index';\n\nexport type AutraCardWebViewNativeMessage = {\n  data: string;\n  url?: string;\n};\n\nexport type AutraCardHostedMessage =\n  | { type: 'tokenized'; result: AutraCardTokenizedResult }\n  | { type: 'error'; error: AutraCardError }\n  | { type: 'ready'; requestId?: string };\n\nexport type ParseAutraCardWebViewMessageResult =\n  { ok: true; message: AutraCardHostedMessage } | { ok: false; error: AutraCardError };\n\nconst errorCodes = new Set<AutraCardErrorCode>([\n  'configuration_error',\n  'token_expired',\n  'message_origin_rejected',\n  'message_invalid',\n  'validation_error',\n  'tokenization_failed',\n]);\n\nconst originRejectedError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Rejected hosted card message origin.',\n  retryable: false,\n};\n\nconst invalidMessageError: AutraCardError = {\n  code: 'message_invalid',\n  message: 'Invalid hosted card message.',\n  retryable: false,\n};\n\nexport function deriveAllowedOrigins(cardBaseUrl: string): string[] {\n  return [new URL(cardBaseUrl).origin];\n}\n\n/**\n * Normalizes a caller-supplied origin list into canonical HTTPS origins.\n *\n * Guards against silent lockouts: `['https://cards.example/']` (trailing\n * slash) never equals a browser-reported origin and would reject every\n * hosted message. Entries that are not valid HTTPS URLs are dropped —\n * postMessage trust must never be extended to plaintext origins.\n */\nexport function normalizeAllowedOrigins(origins: readonly string[]): string[] {\n  const normalized: string[] = [];\n\n  for (const candidate of origins) {\n    let url: URL;\n\n    try {\n      url = new URL(candidate);\n    } catch {\n      continue;\n    }\n\n    if (url.protocol !== 'https:') {\n      continue;\n    }\n\n    if (!normalized.includes(url.origin)) {\n      normalized.push(url.origin);\n    }\n  }\n\n  return normalized;\n}\n\nexport function parseAutraCardWebViewMessage(\n  event: AutraCardWebViewNativeMessage,\n  allowedOrigins: readonly string[],\n): ParseAutraCardWebViewMessageResult {\n  const eventOrigin = toOrigin(event.url);\n\n  if (eventOrigin === undefined || !allowedOrigins.includes(eventOrigin)) {\n    return { ok: false, error: originRejectedError };\n  }\n\n  const rawMessage = parseJson(event.data);\n\n  if (!isRecord(rawMessage)) {\n    return { ok: false, error: invalidMessageError };\n  }\n\n  if (rawMessage.type === 'autra.card.tokenized' && isRecord(rawMessage.payload)) {\n    const result = toTokenizedResult(rawMessage.payload);\n\n    if (result !== undefined) {\n      return { ok: true, message: { type: 'tokenized', result } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.error' && isRecord(rawMessage.error)) {\n    const error = toAutraCardError(rawMessage.error);\n\n    if (error !== undefined) {\n      return { ok: true, message: { type: 'error', error } };\n    }\n  }\n\n  if (rawMessage.type === 'autra.card.ready') {\n    return {\n      ok: true,\n      message: {\n        type: 'ready',\n        requestId: optionalString(rawMessage.requestId),\n      },\n    };\n  }\n\n  return { ok: false, error: invalidMessageError };\n}\n\nfunction toOrigin(url: string | undefined): string | undefined {\n  if (url === undefined) {\n    return undefined;\n  }\n\n  try {\n    return new URL(url).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseJson(data: string): unknown {\n  try {\n    return JSON.parse(data) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction optionalString(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction toTokenizedResult(payload: Record<string, unknown>): AutraCardTokenizedResult | undefined {\n  const storedCard = isRecord(payload.storedCard) ? payload.storedCard : undefined;\n  const tokenizedCard = isRecord(payload.tokenizedCard) ? payload.tokenizedCard : undefined;\n\n  const slugStoredCard =\n    optionalString(payload.slugStoredCard) ?? optionalString(storedCard?.slugStoredCard);\n  const slugToken = optionalString(payload.slugToken) ?? optionalString(tokenizedCard?.slugToken);\n  const tokenExpirationDate =\n    optionalString(payload.tokenExpirationDate) ??\n    optionalString(tokenizedCard?.tokenExpirationDate);\n\n  if (slugStoredCard === undefined && slugToken === undefined) {\n    return undefined;\n  }\n\n  return {\n    slugStoredCard,\n    slugToken,\n    tokenExpirationDate,\n    brand: optionalString(payload.brand),\n    last4: optionalString(payload.last4),\n    expirationMonth: optionalString(payload.expirationMonth),\n    expirationYear: optionalString(payload.expirationYear),\n    requestId: optionalString(payload.requestId),\n  };\n}\n\nfunction toAutraCardError(error: Record<string, unknown>): AutraCardError | undefined {\n  if (typeof error.code !== 'string' || !isAutraCardErrorCode(error.code)) {\n    return undefined;\n  }\n\n  if (typeof error.message !== 'string') {\n    return undefined;\n  }\n\n  return {\n    code: error.code,\n    message: error.message,\n    requestId: optionalString(error.requestId),\n    retryable: typeof error.retryable === 'boolean' ? error.retryable : undefined,\n  };\n}\n\nfunction isAutraCardErrorCode(code: string): code is AutraCardErrorCode {\n  return errorCodes.has(code as AutraCardErrorCode);\n}\n","import React from 'react';\nimport type { StyleProp, ViewStyle } from 'react-native';\nimport { WebView } from 'react-native-webview';\n\nimport type { AutraCardError, AutraCardTokenizedResult } from './index';\nimport {\n  deriveAllowedOrigins,\n  normalizeAllowedOrigins,\n  parseAutraCardWebViewMessage,\n  type AutraCardWebViewNativeMessage,\n} from './messages';\n\nexport type AutraCardFormProps = {\n  hostedCardUrl: string;\n  onSuccess: (result: AutraCardTokenizedResult) => void;\n  onError: (error: AutraCardError) => void;\n  allowedOrigins?: readonly string[];\n  onReady?: (requestId?: string) => void;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\ntype WebViewMessageEvent = {\n  nativeEvent: AutraCardWebViewNativeMessage;\n};\n\ntype WebViewHttpErrorEvent = {\n  nativeEvent: {\n    statusCode: number;\n    url?: string;\n  };\n};\n\ntype WebViewNavigationRequest = {\n  url: string;\n};\n\ntype AutraCardWebViewProps = {\n  source: {\n    uri: string;\n  };\n  originWhitelist: string[];\n  onMessage: (event: WebViewMessageEvent) => void;\n  onError: () => void;\n  onHttpError: (event: WebViewHttpErrorEvent) => void;\n  onShouldStartLoadWithRequest: (request: WebViewNavigationRequest) => boolean;\n  mixedContentMode: 'never';\n  allowFileAccess: boolean;\n  allowsBackForwardNavigationGestures: boolean;\n  incognito: boolean;\n  cacheEnabled: boolean;\n  style?: StyleProp<ViewStyle>;\n  testID?: string;\n};\n\nconst hostedPageLoadError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page failed to load.',\n  retryable: true,\n};\n\nconst hostedPageHttpError: AutraCardError = {\n  code: 'tokenization_failed',\n  message: 'Hosted card page returned an HTTP error.',\n  retryable: true,\n};\n\nconst hostedSessionUnauthorizedError: AutraCardError = {\n  code: 'token_expired',\n  message: 'Hosted card session expired or is not authorized.',\n  retryable: false,\n};\n\nconst invalidHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Invalid hosted card URL.',\n  retryable: false,\n};\n\nconst insecureHostedUrlError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'Hosted card URL must use HTTPS.',\n  retryable: false,\n};\n\nconst invalidAllowedOriginsError: AutraCardError = {\n  code: 'configuration_error',\n  message: 'allowedOrigins must contain at least one valid HTTPS origin.',\n  retryable: false,\n};\n\nconst blockedNavigationError: AutraCardError = {\n  code: 'message_origin_rejected',\n  message: 'Blocked hosted card navigation.',\n  retryable: false,\n};\n\nexport function buildAutraCardTokenizeUrl(hostedCardUrl: string): string {\n  return hostedCardUrl;\n}\n\ntype HostedCardConfiguration =\n  | { ok: true; tokenizeUrl: string; allowedOrigins: readonly string[] }\n  | { ok: false; error: AutraCardError };\n\nexport function AutraCardForm(props: AutraCardFormProps): React.ReactElement | null {\n  // Key the memo by origin CONTENT so an inline `allowedOrigins={[...]}`\n  // (new array identity every render) neither recomputes nor re-emits.\n  const allowedOriginsKey = props.allowedOrigins?.join(' ');\n  const configuration = React.useMemo<HostedCardConfiguration>(\n    () => resolveHostedCardConfiguration(props.hostedCardUrl, props.allowedOrigins),\n    // deps intentionally keyed by content (allowedOriginsKey), not array identity\n    [props.hostedCardUrl, allowedOriginsKey],\n  );\n\n  // Terminal guard: once the hosted page reports a successful tokenization,\n  // every later event (duplicate `tokenized`, stray errors, sub-frame noise)\n  // is ignored so the consumer can never double-charge or double-navigate.\n  const terminalRef = React.useRef(false);\n\n  const onErrorRef = React.useRef(props.onError);\n  React.useEffect(() => {\n    onErrorRef.current = props.onError;\n  });\n\n  // Configuration errors are emitted from an effect: calling props.onError\n  // during render would trigger a parent setState mid-render (React error\n  // \"Cannot update a component while rendering a different component\") and\n  // would re-fire on every re-render.\n  React.useEffect(() => {\n    if (!configuration.ok) {\n      onErrorRef.current(configuration.error);\n    }\n  }, [configuration]);\n\n  if (!configuration.ok) {\n    return null;\n  }\n\n  const { tokenizeUrl, allowedOrigins } = configuration;\n\n  const handleMessage = (event: WebViewMessageEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    const result = parseAutraCardWebViewMessage(event.nativeEvent, allowedOrigins);\n\n    if (!result.ok) {\n      props.onError(result.error);\n      return;\n    }\n\n    if (result.message.type === 'tokenized') {\n      terminalRef.current = true;\n      props.onSuccess(result.message.result);\n      return;\n    }\n\n    if (result.message.type === 'error') {\n      props.onError(result.message.error);\n      return;\n    }\n\n    props.onReady?.(result.message.requestId);\n  };\n\n  const handleHttpError = (event: WebViewHttpErrorEvent): void => {\n    if (terminalRef.current) {\n      return;\n    }\n\n    // On Android onHttpError also fires for sub-resources (favicon, assets,\n    // page-initiated fetches). Only a failure of the hosted DOCUMENT itself\n    // is fatal to the flow — the page reports its own API errors through the\n    // postMessage channel.\n    if (!isHostedDocumentUrl(event.nativeEvent.url, tokenizeUrl)) {\n      return;\n    }\n\n    if (event.nativeEvent.statusCode === 401 || event.nativeEvent.statusCode === 403) {\n      props.onError(hostedSessionUnauthorizedError);\n      return;\n    }\n\n    props.onError(hostedPageHttpError);\n  };\n\n  const handleShouldStartLoadWithRequest = (request: WebViewNavigationRequest): boolean => {\n    if (isAllowedHostedNavigation(request.url, allowedOrigins)) {\n      return true;\n    }\n\n    if (!terminalRef.current) {\n      props.onError(blockedNavigationError);\n    }\n    return false;\n  };\n\n  const WebViewComponent = WebView as unknown as React.ComponentType<AutraCardWebViewProps>;\n\n  return React.createElement(WebViewComponent, {\n    source: {\n      uri: tokenizeUrl,\n    },\n    // Security: react-native-webview hands URLs that fail originWhitelist to\n    // the OS (Linking.openURL) BEFORE onShouldStartLoadWithRequest runs — a\n    // compromised hosted page could silently bounce the user to an external\n    // browser (phishing surface). The payment-WebView hardening pattern is a\n    // wildcard whitelist plus a full allowlist in\n    // onShouldStartLoadWithRequest: returning false there blocks the\n    // navigation WITHOUT opening it externally.\n    originWhitelist: ['*'],\n    onMessage: handleMessage,\n    onError: () => {\n      if (!terminalRef.current) {\n        props.onError(hostedPageLoadError);\n      }\n    },\n    onHttpError: handleHttpError,\n    onShouldStartLoadWithRequest: handleShouldStartLoadWithRequest,\n    mixedContentMode: 'never',\n    allowFileAccess: false,\n    allowsBackForwardNavigationGestures: false,\n    // PCI hygiene: never persist the hosted card page (or anything typed in\n    // it) to disk caches.\n    incognito: true,\n    cacheEnabled: false,\n    style: props.style,\n    testID: props.testID,\n  });\n}\n\nfunction resolveHostedCardConfiguration(\n  hostedCardUrl: string,\n  allowedOriginsInput: readonly string[] | undefined,\n): HostedCardConfiguration {\n  const parsedHostedCardUrl = parseHostedCardUrl(hostedCardUrl);\n\n  if (!parsedHostedCardUrl.ok) {\n    return parsedHostedCardUrl;\n  }\n\n  // Normalization guards against silent lockouts: an entry with a trailing\n  // slash/path (`https://cards.example/`) would never equal a browser origin\n  // and would reject every hosted message. Non-HTTPS entries are dropped.\n  const allowedOrigins = normalizeAllowedOrigins(\n    allowedOriginsInput ?? deriveAllowedOrigins(hostedCardUrl),\n  );\n\n  if (allowedOrigins.length === 0) {\n    return { ok: false, error: invalidAllowedOriginsError };\n  }\n\n  return {\n    ok: true,\n    tokenizeUrl: buildAutraCardTokenizeUrl(hostedCardUrl),\n    allowedOrigins,\n  };\n}\n\nfunction parseHostedCardUrl(\n  hostedCardUrl: string,\n): { ok: true; url: URL } | { ok: false; error: AutraCardError } {\n  let url: URL;\n\n  try {\n    url = new URL(hostedCardUrl);\n  } catch {\n    return { ok: false, error: invalidHostedUrlError };\n  }\n\n  if (url.protocol !== 'https:') {\n    return { ok: false, error: insecureHostedUrlError };\n  }\n\n  return { ok: true, url };\n}\n\nfunction isAllowedHostedNavigation(\n  navigationUrl: string,\n  allowedOrigins: readonly string[],\n): boolean {\n  let url: URL;\n\n  try {\n    url = new URL(navigationUrl);\n  } catch {\n    return false;\n  }\n\n  if (url.protocol !== 'https:') {\n    return false;\n  }\n\n  return allowedOrigins.includes(url.origin);\n}\n\nfunction isHostedDocumentUrl(eventUrl: string | undefined, documentUrl: string): boolean {\n  if (eventUrl === undefined) {\n    // Older react-native-webview versions omit the URL — stay conservative\n    // and treat the failure as fatal rather than silently swallowing it.\n    return true;\n  }\n\n  let failed: URL;\n  let document: URL;\n\n  try {\n    failed = new URL(eventUrl);\n    document = new URL(documentUrl);\n  } catch {\n    return true;\n  }\n\n  return failed.origin === document.origin && failed.pathname === document.pathname;\n}\n","/**\n * @autra-io/react-native-card — hosted card tokenization SDK exports.\n *\n * Phase: v0 hosted-WebView tokenization. The SDK owns only the React Native\n * component shell and message bridge; the hosted card page owns PAN/CVV entry.\n *\n * Security (payment-adjacent SDK):\n *   - Never embed or log PAN, CVV, expiry or cardholder data.\n *   - Never place OAuth clientSecret or a strong accessToken in the app.\n *   - The mobile context must only ever load a short-lived hostedCardUrl.\n */\n\nexport { AutraCardForm } from './AutraCardForm';\nexport type { AutraCardFormProps } from './AutraCardForm';\n\n/** Semantic version marker for the v0 implementation phase. */\nexport const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = '0.1.0';\n\n/**\n * Result returned by a successful card tokenization.\n * `slugStoredCard` is the opaque reference the backend uses to charge later.\n * Never populate this with raw PAN/CVV; only tokenized/masked references.\n */\nexport type AutraCardTokenizedResult = {\n  slugStoredCard?: string;\n  slugToken?: string;\n  tokenExpirationDate?: string;\n  brand?: string;\n  last4?: string;\n  expirationMonth?: string;\n  expirationYear?: string;\n  requestId?: string;\n};\n\n/** Normalized v0 error code taxonomy surfaced by the SDK. */\nexport type AutraCardErrorCode =\n  | 'configuration_error'\n  | 'token_expired'\n  | 'message_origin_rejected'\n  | 'message_invalid'\n  | 'validation_error'\n  | 'tokenization_failed';\n\nexport type AutraCardError = {\n  code: AutraCardErrorCode;\n  message: string;\n  requestId?: string;\n  retryable?: boolean;\n};\n"]}

package/dist/index.d.cts

@@ -0,0 +1,53 @@
+import React from 'react';
+import { StyleProp, ViewStyle } from 'react-native';
+
+type AutraCardFormProps = {
+    hostedCardUrl: string;
+    onSuccess: (result: AutraCardTokenizedResult) => void;
+    onError: (error: AutraCardError) => void;
+    allowedOrigins?: readonly string[];
+    onReady?: (requestId?: string) => void;
+    style?: StyleProp<ViewStyle>;
+    testID?: string;
+};
+declare function AutraCardForm(props: AutraCardFormProps): React.ReactElement | null;
+
+/**
+ * @autra-io/react-native-card — hosted card tokenization SDK exports.
+ *
+ * Phase: v0 hosted-WebView tokenization. The SDK owns only the React Native
+ * component shell and message bridge; the hosted card page owns PAN/CVV entry.
+ *
+ * Security (payment-adjacent SDK):
+ *   - Never embed or log PAN, CVV, expiry or cardholder data.
+ *   - Never place OAuth clientSecret or a strong accessToken in the app.
+ *   - The mobile context must only ever load a short-lived hostedCardUrl.
+ */
+
+/** Semantic version marker for the v0 implementation phase. */
+declare const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.0";
+/**
+ * Result returned by a successful card tokenization.
+ * `slugStoredCard` is the opaque reference the backend uses to charge later.
+ * Never populate this with raw PAN/CVV; only tokenized/masked references.
+ */
+type AutraCardTokenizedResult = {
+    slugStoredCard?: string;
+    slugToken?: string;
+    tokenExpirationDate?: string;
+    brand?: string;
+    last4?: string;
+    expirationMonth?: string;
+    expirationYear?: string;
+    requestId?: string;
+};
+/** Normalized v0 error code taxonomy surfaced by the SDK. */
+type AutraCardErrorCode = 'configuration_error' | 'token_expired' | 'message_origin_rejected' | 'message_invalid' | 'validation_error' | 'tokenization_failed';
+type AutraCardError = {
+    code: AutraCardErrorCode;
+    message: string;
+    requestId?: string;
+    retryable?: boolean;
+};
+
+export { AUTRA_REACT_NATIVE_CARD_SDK_VERSION, type AutraCardError, type AutraCardErrorCode, AutraCardForm, type AutraCardFormProps, type AutraCardTokenizedResult };

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+import React from 'react';
+import { StyleProp, ViewStyle } from 'react-native';
+
+type AutraCardFormProps = {
+    hostedCardUrl: string;
+    onSuccess: (result: AutraCardTokenizedResult) => void;
+    onError: (error: AutraCardError) => void;
+    allowedOrigins?: readonly string[];
+    onReady?: (requestId?: string) => void;
+    style?: StyleProp<ViewStyle>;
+    testID?: string;
+};
+declare function AutraCardForm(props: AutraCardFormProps): React.ReactElement | null;
+
+/**
+ * @autra-io/react-native-card — hosted card tokenization SDK exports.
+ *
+ * Phase: v0 hosted-WebView tokenization. The SDK owns only the React Native
+ * component shell and message bridge; the hosted card page owns PAN/CVV entry.
+ *
+ * Security (payment-adjacent SDK):
+ *   - Never embed or log PAN, CVV, expiry or cardholder data.
+ *   - Never place OAuth clientSecret or a strong accessToken in the app.
+ *   - The mobile context must only ever load a short-lived hostedCardUrl.
+ */
+
+/** Semantic version marker for the v0 implementation phase. */
+declare const AUTRA_REACT_NATIVE_CARD_SDK_VERSION = "0.1.0";
+/**
+ * Result returned by a successful card tokenization.
+ * `slugStoredCard` is the opaque reference the backend uses to charge later.
+ * Never populate this with raw PAN/CVV; only tokenized/masked references.
+ */
+type AutraCardTokenizedResult = {
+    slugStoredCard?: string;
+    slugToken?: string;
+    tokenExpirationDate?: string;
+    brand?: string;
+    last4?: string;
+    expirationMonth?: string;
+    expirationYear?: string;
+    requestId?: string;
+};
+/** Normalized v0 error code taxonomy surfaced by the SDK. */
+type AutraCardErrorCode = 'configuration_error' | 'token_expired' | 'message_origin_rejected' | 'message_invalid' | 'validation_error' | 'tokenization_failed';
+type AutraCardError = {
+    code: AutraCardErrorCode;
+    message: string;
+    requestId?: string;
+    retryable?: boolean;
+};
+
+export { AUTRA_REACT_NATIVE_CARD_SDK_VERSION, type AutraCardError, type AutraCardErrorCode, AutraCardForm, type AutraCardFormProps, type AutraCardTokenizedResult };