@flopay/shared 1.2.8 → 1.3.1

package/README.md

@@ -175,3 +175,28 @@ throw validationError('Email is required', 'email');
 | `getCurrencyByCountry(countryCode)` | Returns `CurrencyInfo` for a country code, falls back to USD |
 | `isValidPublishableKey(key)` | Returns `true` if the key matches `pk_(test|live)_...` |
 | `isValidSecretKey(key)` | Returns `true` if the key matches `sk_(test|live)_...` |
+
+### Postal Code Helpers
+
+Country-aware postcode format validation, backed by the [`validator`](https://www.npmjs.com/package/validator) package's `isPostalCode` (the same library the billing API uses, so client and server rules agree). `@flopay/react`'s AVS block uses these to block a malformed postcode before the card is captured and to show the expected format inline.
+
+| Export | Description |
+|--------|-------------|
+| `getPostalCodeLabel(countryCode)` | Country-appropriate field label (`'ZIP Code'`, `'Postcode'`, `'Eircode'`, …); defaults to `'Postal Code'` |
+| `isPostalCodeSupported(country)` | `true` when `validator` has a postcode pattern for the (ISO 3166-1 alpha-2, case-insensitive; `UK`→`GB`) country. Unsupported / no-postcode countries return `false` |
+| `isValidPostalCode(country, postalCode)` | `true` when the (trimmed) postcode matches the country's format. **Fails open** — unsupported / no-postcode countries always return `true`, so callers never block them. A supported country with an empty value returns `false`; check emptiness first to distinguish "required" from "malformed" |
+| `getPostalCodeExample(country)` | A curated example postcode for the field hint (US `12345 or 12345-6789`, GB `SW1A 1AA`, CA `A1A 1A1`, …), or `undefined` when there is no curated example |
+| `getStateFromPostalCode(country, postalCode)` | Derives a US state / CA province code from a postcode for AVS enrichment; `null` for other countries or a malformed code |
+
+```ts
+import { isPostalCodeSupported, isValidPostalCode, getPostalCodeExample } from '@flopay/shared';
+
+isPostalCodeSupported('US');            // true
+isPostalCodeSupported('AE');            // false — UAE has no postcodes
+isValidPostalCode('GB', 'SW1A 1AA');    // true
+isValidPostalCode('GB', '12345');       // false — US shape in GB
+isValidPostalCode('AE', '');            // true — fail open, never blocks
+getPostalCodeExample('CA');             // 'A1A 1A1'
+```
+
+> **Runtime dependency.** Unlike the rest of `@flopay/shared`, these helpers pull in `validator` (imported via the `validator/lib/isPostalCode.js` submodule so bundlers only include the one check). It installs transitively when you depend on `@flopay/shared`.

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,7 +17,15 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
+  mod2
+));
+var __toCommonJS = (mod2) => __copyProps(__defProp({}, "__esModule", { value: true }), mod2);
 
 // src/index.ts
 var index_exports = {};
@@ -44,6 +54,7 @@ __export(index_exports, {
   DEFAULT_CURRENCY: () => DEFAULT_CURRENCY,
   ELEMENT_TYPES: () => ELEMENT_TYPES,
   FLAT_APPEARANCE: () => FLAT_APPEARANCE,
+  FLO_SDK_VERSION_HEADER: () => FLO_SDK_VERSION_HEADER,
   FloPayError: () => FloPayError,
   GLASS_DARK_APPEARANCE: () => GLASS_DARK_APPEARANCE,
   GLASS_LIGHT_APPEARANCE: () => GLASS_LIGHT_APPEARANCE,
@@ -74,6 +85,7 @@ __export(index_exports, {
   getCountryByCode: () => getCountryByCode,
   getCurrencyByCountry: () => getCurrencyByCountry,
   getFloPayEnvironment: () => getFloPayEnvironment,
+  getPostalCodeExample: () => getPostalCodeExample,
   getPostalCodeLabel: () => getPostalCodeLabel,
   getStateFromPostalCode: () => getStateFromPostalCode,
   getStateLabel: () => getStateLabel,
@@ -82,7 +94,9 @@ __export(index_exports, {
   hasVendoredStripeMethodLogo: () => hasVendoredStripeMethodLogo,
   isAVSEnabled: () => isAVSEnabled,
   isAVSFieldVisible: () => isAVSFieldVisible,
+  isPostalCodeSupported: () => isPostalCodeSupported,
   isSetupIntentClientSecret: () => isSetupIntentClientSecret,
+  isValidPostalCode: () => isValidPostalCode,
   isValidPublishableKey: () => isValidPublishableKey,
   isValidSecretKey: () => isValidSecretKey,
   needsStripeMethodExplicitConfirm: () => needsStripeMethodExplicitConfirm,
@@ -182,7 +196,8 @@ var PAYMENT_METHOD_LOGOS = {
 };
 
 // src/constants.ts
-var SDK_VERSION = "1.2.8";
+var SDK_VERSION = "1.3.1";
+var FLO_SDK_VERSION_HEADER = "x-flo-sdk-version";
 var BILLING_API_URL_STAGING = "https://api.stage.flopay.com";
 var BILLING_API_URL_PRODUCTION = "https://api.flopay.com";
 var DEFAULT_API_BASE_URL = BILLING_API_URL_STAGING;
@@ -864,6 +879,9 @@ function stripeExpressMethodToOptionKey(method) {
 function buildPlaceholderMark(glyph, discColor, glyphColor) {
   return `<svg viewBox="0 0 22 22" xmlns="http://www.w3.org/2000/svg" role="img" aria-hidden="true"><circle cx="11" cy="11" r="11" fill="${discColor}"/><text x="11" y="15.5" text-anchor="middle" font-size="13" font-weight="700" font-family="-apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif" fill="${glyphColor}">${glyph}</text></svg>`;
 }
+function buildBankMark(discColor, glyphColor) {
+  return `<svg viewBox="0 0 22 22" xmlns="http://www.w3.org/2000/svg" role="img" aria-hidden="true"><circle cx="11" cy="11" r="11" fill="${discColor}"/><g fill="${glyphColor}"><path d="M11 4 L17.5 8 L4.5 8 Z"/><rect x="5" y="8.4" width="12" height="1.2" rx="0.3"/><rect x="5.9" y="10" width="1.5" height="5"/><rect x="8.55" y="10" width="1.5" height="5"/><rect x="11.95" y="10" width="1.5" height="5"/><rect x="14.6" y="10" width="1.5" height="5"/><rect x="4.6" y="15.4" width="12.8" height="1.5" rx="0.3"/></g></svg>`;
+}
 var SEPA_COUNTRIES = [
   "AT",
   "BE",
@@ -904,6 +922,7 @@ var SEPA_COUNTRIES = [
   "VA"
   // non-EEA SEPA participants
 ];
+var BANK_TRANSFER_COUNTRIES = [...SEPA_COUNTRIES, "JP", "MX", "US"];
 var STRIPE_METHOD_MATRIX = {
   // ─── Express wallets ────────────────────────────────────────────────────
   apple_pay: {
@@ -936,14 +955,42 @@ var STRIPE_METHOD_MATRIX = {
     express: true,
     needsExplicitConfirm: false
   },
+  // ─── Klarna: PaymentElement tile, explicit confirm ─────────────────────
+  // Klarna renders as a PaymentElement tile (NOT express) so it always appears
+  // when the backend includes it in `enabledPaymentMethods`. Stripe's
+  // ExpressCheckoutElement only paints a Klarna button in eligible *real*
+  // browsers (never headless), which made it effectively invisible and looked
+  // like an SDK-level disable — as a tile it's purely backend-driven. Klarna
+  // may redirect during confirm, but it still surfaces a deliberate "Pay with
+  // Klarna" step: it omits `needsExplicitConfirm: false`, so the default
+  // `needsStripeMethodExplicitConfirm(...) === true` applies — unlike the
+  // auto-confirm APMs below.
   klarna: {
     displayName: "Klarna",
     currencies: ["usd", "eur", "gbp", "aud", "nzd", "cad", "chf", "sek", "nok", "dkk", "pln", "czk", "ron"],
     amounts: { usd: { min: 100 }, eur: { min: 100 }, gbp: { min: 100 } },
-    express: true,
-    needsExplicitConfirm: false
+    // Default (explicit "Pay with Klarna" button) — Klarna's PaymentElement can
+    // collect inline data and isn't a pure redirect-only method, so surface a
+    // deliberate confirm rather than auto-submitting on tile click.
+    theme: {
+      light: {
+        backgroundColor: "#FFB3C7",
+        textColor: "#0A0B09",
+        borderColor: "#FFB3C7",
+        logoSvg: buildPlaceholderMark("K", "#0A0B09", "#FFB3C7")
+      },
+      dark: {
+        backgroundColor: "#FFB3C7",
+        textColor: "#0A0B09",
+        borderColor: "#FFB3C7",
+        logoSvg: buildPlaceholderMark("K", "#0A0B09", "#FFB3C7")
+      }
+    }
   },
   // ─── PaymentElement APMs: auto-confirm (redirect-only, no Pay button) ───
+  // Affirm and Cash App Pay are pure redirect/handoff methods with no inline
+  // inputs, so they auto-submit on tile click (`needsExplicitConfirm: false`).
+  //
   // Affirm currently rejects on non-USD currencies via
   // /v1/elements/sessions, hence the narrow currency list. Below $35.00 USD
   // it returns `amount_too_small` and blanks out the whole accordion, hence
@@ -1008,11 +1055,28 @@ var STRIPE_METHOD_MATRIX = {
       gbp: { min: 100, max: 12e4 },
       aud: { min: 100, max: 2e5 },
       nzd: { min: 100, max: 2e5 }
+    },
+    // Afterpay's brand mint (#B2FCE4) with black wordmark/icon — the signature
+    // palette from afterpay.com's brand system.
+    theme: {
+      light: {
+        backgroundColor: "#B2FCE4",
+        textColor: "#0A0B09",
+        borderColor: "#B2FCE4",
+        logoSvg: buildPlaceholderMark("A", "#0A0B09", "#B2FCE4")
+      },
+      dark: {
+        backgroundColor: "#B2FCE4",
+        textColor: "#0A0B09",
+        borderColor: "#B2FCE4",
+        logoSvg: buildPlaceholderMark("A", "#0A0B09", "#B2FCE4")
+      }
     }
   },
   alipay: {
     displayName: "Alipay",
-    currencies: ["cny", "aud", "cad", "eur", "gbp", "hkd", "jpy", "myr", "nzd", "sgd", "usd"],
+    // Presentment currencies only — Alipay is offered to USD / CNY carts.
+    currencies: ["usd", "cny"],
     theme: {
       light: {
         backgroundColor: "#1677FF",
@@ -1049,6 +1113,25 @@ var STRIPE_METHOD_MATRIX = {
       }
     }
   },
+  bizum: {
+    displayName: "Bizum",
+    currencies: ["eur"],
+    countries: ["ES"],
+    theme: {
+      light: {
+        backgroundColor: "#00BFB3",
+        textColor: "#FFFFFF",
+        borderColor: "#00BFB3",
+        logoSvg: buildPlaceholderMark("B", "#FFFFFF", "#00BFB3")
+      },
+      dark: {
+        backgroundColor: "#00BFB3",
+        textColor: "#FFFFFF",
+        borderColor: "#00BFB3",
+        logoSvg: buildPlaceholderMark("B", "#FFFFFF", "#00BFB3")
+      }
+    }
+  },
   blik: {
     displayName: "BLIK",
     currencies: ["pln"],
@@ -1069,7 +1152,25 @@ var STRIPE_METHOD_MATRIX = {
     }
   },
   boleto: { displayName: "Boleto", currencies: ["brl"], countries: ["BR"] },
-  customer_balance: { displayName: "Customer Balance", currencies: ["*"] },
+  customer_balance: {
+    displayName: "Bank Transfer",
+    currencies: ["eur", "usd"],
+    countries: BANK_TRANSFER_COUNTRIES,
+    theme: {
+      light: {
+        backgroundColor: "#1F2937",
+        textColor: "#FFFFFF",
+        borderColor: "#1F2937",
+        logoSvg: buildBankMark("#1F2937", "#FFFFFF")
+      },
+      dark: {
+        backgroundColor: "#374151",
+        textColor: "#FFFFFF",
+        borderColor: "#374151",
+        logoSvg: buildBankMark("#374151", "#FFFFFF")
+      }
+    }
+  },
   eps: {
     displayName: "EPS",
     currencies: ["eur"],
@@ -1128,6 +1229,25 @@ var STRIPE_METHOD_MATRIX = {
     }
   },
   konbini: { displayName: "Konbini", currencies: ["jpy"], countries: ["JP"] },
+  kr_card: {
+    displayName: "Korean Card",
+    currencies: ["krw"],
+    countries: ["KR"],
+    theme: {
+      light: {
+        backgroundColor: "#0B3D91",
+        textColor: "#FFFFFF",
+        borderColor: "#0B3D91",
+        logoSvg: buildPlaceholderMark("K", "#FFFFFF", "#0B3D91")
+      },
+      dark: {
+        backgroundColor: "#0B3D91",
+        textColor: "#FFFFFF",
+        borderColor: "#0B3D91",
+        logoSvg: buildPlaceholderMark("K", "#FFFFFF", "#0B3D91")
+      }
+    }
+  },
   multibanco: { displayName: "Multibanco", currencies: ["eur"], countries: ["PT"] },
   oxxo: { displayName: "OXXO", currencies: ["mxn"], countries: ["MX"] },
   p24: {
@@ -1193,10 +1313,30 @@ var STRIPE_METHOD_MATRIX = {
       }
     }
   },
+  upi: {
+    displayName: "UPI",
+    currencies: ["inr"],
+    countries: ["IN"],
+    theme: {
+      light: {
+        backgroundColor: "#FF7909",
+        textColor: "#FFFFFF",
+        borderColor: "#FF7909",
+        logoSvg: buildPlaceholderMark("U", "#FFFFFF", "#FF7909")
+      },
+      dark: {
+        backgroundColor: "#FF7909",
+        textColor: "#FFFFFF",
+        borderColor: "#FF7909",
+        logoSvg: buildPlaceholderMark("U", "#FFFFFF", "#FF7909")
+      }
+    }
+  },
   us_bank_account: { displayName: "US Bank Account", currencies: ["usd"], countries: ["US"] },
   wechat_pay: {
     displayName: "WeChat Pay",
-    currencies: ["cny", "usd", "eur", "gbp", "aud", "cad", "jpy", "chf", "hkd", "sgd", "nzd", "nok", "sek", "dkk"],
+    // Presentment currencies only — WeChat Pay is offered to USD / CNY carts.
+    currencies: ["usd", "cny"],
     theme: {
       light: {
         backgroundColor: "#07C160",
@@ -1833,6 +1973,67 @@ function getStateFromPostalCode(country, postalCode) {
   }
 }
 
+// src/postal-code-validation.ts
+var isPostalCodeModule = __toESM(require("validator/lib/isPostalCode.js"), 1);
+var mod = isPostalCodeModule;
+var isPostalCode = typeof mod.default === "function" ? mod.default : mod.default?.default;
+if (typeof isPostalCode !== "function") {
+  throw new Error(
+    "validator/lib/isPostalCode.js interop failed: unexpected module shape. This likely means the bundler's CJS/ESM interop changed."
+  );
+}
+var SUPPORTED_LOCALES = new Set(
+  mod.locales.map((code) => code.toUpperCase())
+);
+var LOCALE_ALIASES = {
+  UK: "GB"
+};
+function normalizeCountry(country) {
+  const upper = country.trim().toUpperCase();
+  return LOCALE_ALIASES[upper] ?? upper;
+}
+var POSTAL_CODE_EXAMPLES = {
+  US: "12345 or 12345-6789",
+  GB: "SW1A 1AA",
+  CA: "A1A 1A1",
+  AU: "2000",
+  NZ: "6011",
+  IE: "D02 AF30",
+  DE: "10115",
+  FR: "75008",
+  NL: "1011 AB",
+  ES: "28001",
+  IT: "00100",
+  IN: "110001",
+  JP: "100-0001",
+  BR: "01310-100",
+  MX: "01000",
+  SE: "114 55",
+  CH: "8001",
+  PL: "00-001",
+  PT: "1000-001",
+  SG: "570150",
+  ZA: "0001",
+  NO: "0001",
+  DK: "1050",
+  FI: "00100",
+  AT: "1010",
+  BE: "1000",
+  CZ: "100 00"
+};
+function isPostalCodeSupported(country) {
+  if (!country) return false;
+  return SUPPORTED_LOCALES.has(normalizeCountry(country));
+}
+function isValidPostalCode(country, postalCode) {
+  if (!isPostalCodeSupported(country)) return true;
+  return isPostalCode(postalCode.trim(), normalizeCountry(country));
+}
+function getPostalCodeExample(country) {
+  if (!country) return void 0;
+  return POSTAL_CODE_EXAMPLES[normalizeCountry(country)];
+}
+
 // src/checkout-payload.ts
 function nonBlank(value) {
   if (typeof value !== "string") return void 0;
@@ -2059,6 +2260,7 @@ function isSetupIntentClientSecret(clientSecret) {
   DEFAULT_CURRENCY,
   ELEMENT_TYPES,
   FLAT_APPEARANCE,
+  FLO_SDK_VERSION_HEADER,
   FloPayError,
   GLASS_DARK_APPEARANCE,
   GLASS_LIGHT_APPEARANCE,
@@ -2089,6 +2291,7 @@ function isSetupIntentClientSecret(clientSecret) {
   getCountryByCode,
   getCurrencyByCountry,
   getFloPayEnvironment,
+  getPostalCodeExample,
   getPostalCodeLabel,
   getStateFromPostalCode,
   getStateLabel,
@@ -2097,7 +2300,9 @@ function isSetupIntentClientSecret(clientSecret) {
   hasVendoredStripeMethodLogo,
   isAVSEnabled,
   isAVSFieldVisible,
+  isPostalCodeSupported,
   isSetupIntentClientSecret,
+  isValidPostalCode,
   isValidPublishableKey,
   isValidSecretKey,
   needsStripeMethodExplicitConfirm,