@glomopay/react-native-sdk 4.0.0 → 5.0.0

package/lib/use-standard-checkout.js

@@ -8,14 +8,26 @@ const index_1 = require("./injections/index");
 const segment_1 = require("./config/segment");
 const base_1 = require("./config/base");
 const validation_1 = require("./utils/validation");
+const payment_payload_1 = require("./bridge/payment-payload");
+const event_projections_1 = require("./utils/event-projections");
 const device_compliance_1 = require("./utils/device-compliance");
+const message_router_1 = require("./bridge/message-router");
+const file_save_handler_1 = require("./bridge/file-save-handler");
+const file_input_handler_1 = require("./bridge/file-input-handler");
+const index_2 = require("./capabilities/index");
+const use_capability_reporting_1 = require("./capabilities/use-capability-reporting");
+const use_sdk_session_1 = require("./utils/use-sdk-session");
+const use_permission_request_1 = require("./webview/use-permission-request");
 const analytics_1 = require("./utils/analytics");
 const checkout_1 = require("./types/checkout");
+/** Log prefix for everything this flow emits */
+const LOG_PREFIX = "[Glomo-RN-SDK Standard]";
 /** The main SDK hook for the GlomoPay Standard Checkout flow */
-function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, onUserJourneyCompleted, onUserRefusedCameraPermissions, devMode = false, }, mockMode, internalOptions) {
-    var _a;
+function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, onUserJourneyCompleted, onUserRefusedDevicePermissions, devMode = false, }, mockMode, internalOptions) {
+    var _a, _b;
     // Resolving analytics trackers - defaults to standard, subscription flow overrides
     const trackers = (_a = internalOptions === null || internalOptions === void 0 ? void 0 : internalOptions.analyticsTrackers) !== null && _a !== void 0 ? _a : analytics_1.standardCheckoutTrackers;
+    const flowType = (_b = internalOptions === null || internalOptions === void 0 ? void 0 : internalOptions.flowType) !== null && _b !== void 0 ? _b : "standard";
     // Refs for the WebViews
     const mainWebViewRef = (0, react_1.useRef)(null);
     const flowWebViewRef = (0, react_1.useRef)(null);
@@ -32,7 +44,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
             // Building the query string manually since URLSearchParams is not fully supported in React Native
             const baseParams = [`orderId=${encodeURIComponent(orderId)}`];
             const mode = mockMode ? "mock" : "live";
-            const params = baseParams.concat(`mode=${encodeURIComponent(mode)}`, `publicKey=${encodeURIComponent(publicKey)}`);
+            const params = baseParams.concat(`mode=${encodeURIComponent(mode)}`, `publicKey=${encodeURIComponent(publicKey)}`, `product=${encodeURIComponent(base_1.ANALYTICS_PRODUCT)}`, `surface=${encodeURIComponent(base_1.ANALYTICS_SURFACE)}`);
             const queryString = params.join("&");
             // Handling base URL with or without existing query parameters
             const separator = baseCheckoutUrl.includes("?") ? "&" : "?";
@@ -126,43 +138,69 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
             }
         }
     }, [devMode]);
+    // Correlates every event from this mount, and keeps checkoutStatus current on all of them
+    (0, use_sdk_session_1.useSdkSession)(() => status);
+    // Missing optional dependencies reach the host here; start() warns on the console separately
+    (0, use_capability_reporting_1.useCapabilityReporting)({ onSdkError, devMode });
+    /**
+     * Handler for `file.input` - the user tapping a file input on a bank's page.
+     *
+     * Registered beside `file.save` on the same WebViews, for the same reason: uploads are not a
+     * property of one flow, and until now this message had no handler anywhere.
+     */
+    const fileInputHandler = (0, react_1.useMemo)(() => (0, file_input_handler_1.createFileInputHandler)({
+        flowType: flowType,
+        orderId,
+        publicKey,
+        checkoutUrl,
+        mockMode,
+        devMode,
+    }), [orderId, publicKey, checkoutUrl, mockMode, devMode, flowType]);
+    /**
+     * Handler for `file.save` - the page asking the SDK to put a document on the device.
+     *
+     * One handler, registered on the main and flow WebViews both. Not on the education carousel:
+     * that renders our own content, which has nothing to gate, and the capability is not advertised
+     * there either.
+     */
+    const fileSaveHandler = (0, react_1.useMemo)(() => (0, file_save_handler_1.createFileSaveHandler)({
+        flowType,
+        orderId,
+        publicKey,
+        checkoutUrl,
+        mockMode,
+        devMode,
+        onSdkError,
+    }), [flowType, orderId, publicKey, checkoutUrl, mockMode, devMode, onSdkError]);
     /**
      * Handler for the main WebView messages.
      * The main WebView hosts the checkout page. Messages arrive as JSON strings from the injected
      * JavaScript bridge and include console logs, window.open/close interceptions, and payment
      * lifecycle events (success, failure, terminate, bank transfer, pay via bank).
      */
-    const handleMainWebViewMessage = (0, react_1.useCallback)((event) => {
-        var _a, _b, _c;
-        try {
-            // Extracting and validating the raw message data from the WebView event
-            const data = (_a = event.nativeEvent) === null || _a === void 0 ? void 0 : _a.data;
-            if (!data || typeof data !== "string") {
-                if (devMode) {
-                    console.warn("[Glomo-RN-SDK Standard] Invalid message data from MainWebView");
-                }
-                // Tracking invalid message received
-                trackers.trackInvalidMessageReceived("main", data, checkoutUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
-            const message = JSON.parse(data);
-            if (devMode) {
-                console.log("[Glomo-RN-SDK Standard] MainWebView Message received:", message.type, message);
-            }
+    const handleMainWebViewMessage = (0, react_1.useMemo)(() => (0, message_router_1.createMessageRouter)({
+        logPrefix: LOG_PREFIX,
+        source: "MainWebView",
+        devMode,
+        onInvalidMessage: (data) => {
+            trackers.trackInvalidMessageReceived("main", data, checkoutUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
+        },
+        handlers: {
+            "file.save": fileSaveHandler,
+            "file.input": fileInputHandler,
             // Forwarding console messages from the injected script to the React Native console
-            if (message.type === "console") {
+            console: (message) => {
                 if (devMode) {
-                    const level = message.level || "log";
-                    console.log(`[Glomo-RN-SDK Standard] [WebView ${level.toUpperCase()}]`, message.message);
+                    const level = (typeof message.level === "string" && message.level) || "log";
+                    console.log(`${LOG_PREFIX} [WebView ${level.toUpperCase()}]`, message.message);
                 }
-                return;
-            }
+            },
             // Intercepting window.open calls - opening the target URL in the flow WebView overlay
-            if (message.type === "window.open") {
+            "window.open": (message) => {
                 const url = message.url;
                 if (url && typeof url === "string" && (0, validation_1.isValidUrl)(url)) {
                     if (devMode) {
-                        console.log(`[Glomo-RN-SDK Standard] window.open called from MainWebView: ${url}`);
+                        console.log(`${LOG_PREFIX} window.open called from MainWebView: ${url}`);
                     }
                     setFlowWebViewUrl(url);
                     setShowFlowWebView(true);
@@ -171,26 +209,27 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                 }
                 else {
                     if (devMode) {
-                        console.log("[Glomo-RN-SDK Standard] Invalid URL in window.open from MainWebView:", url, typeof url === "undefined" ? "undefined" : "");
+                        console.log(`${LOG_PREFIX} Invalid URL in window.open from MainWebView:`, url, typeof url === "undefined" ? "undefined" : "");
                     }
                 }
-                return;
-            }
+            },
             // Intercepting window.close calls - closing the flow WebView overlay
-            if (message.type === "window.close") {
+            "window.close": () => {
                 if (devMode) {
-                    console.log("[Glomo-RN-SDK Standard] Child window close requested from MainWebView");
+                    console.log(`${LOG_PREFIX} Child window close requested from MainWebView`);
                 }
                 setShowFlowWebView(false);
                 setFlowWebViewUrl("");
                 // Tracking window.close interception
                 trackers.trackWindowClose("main", orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
+            },
             // Handling merchant JS callbacks on flow completion (payment events, lifecycle events)
-            if (message.type === "message" && message.message) {
+            message: (message) => {
+                var _a;
                 const messageData = message.message;
-                const messageType = messageData === null || messageData === void 0 ? void 0 : messageData.type;
+                if (!messageData)
+                    return;
+                const messageType = messageData.type;
                 // Handling payment success - closing checkout and notifying the merchant
                 if (messageType === "payment.success" || messageType === "payment.complete") {
                     const paymentMessage = messageData;
@@ -205,12 +244,24 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                         setStatus("payment_successful");
                         (0, validation_1.safeCallback)(onPaymentSuccess, [payload], "onPaymentSuccess", devMode);
                         // Tracking payment success callback
-                        trackers.trackPaymentSuccess(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        trackers.trackPaymentSuccess((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.success", missingFields, "main", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK Standard] Invalid payment success payload:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.success payload from main:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.success", (0, payment_payload_1.payloadKeysOf)(payload), "main", orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.success")]], "onSdkError", devMode);
                     }
                     return;
                 }
@@ -228,12 +279,24 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                         setStatus("payment_failed");
                         (0, validation_1.safeCallback)(onPaymentFailure, [payload], "onPaymentFailure", devMode);
                         // Tracking payment failure callback
-                        trackers.trackPaymentFailure(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        trackers.trackPaymentFailure((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.failure", missingFields, "main", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK Standard] Invalid payment failure payload:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.failure payload from main:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.failure", (0, payment_payload_1.payloadKeysOf)(payload), "main", orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.failure")]], "onSdkError", devMode);
                     }
                     return;
                 }
@@ -254,7 +317,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                         transactionReference: payload === null || payload === void 0 ? void 0 : payload.transactionReference,
                     };
                     (0, validation_1.safeCallback)(onUserJourneyCompleted, [journeyPayload], "onUserJourneyCompleted", devMode);
-                    trackers.trackBankTransferSubmitted(orderId, publicKey, devMode, mockMode, checkoutUrl);
+                    trackers.trackBankTransferSubmitted(orderId, (0, event_projections_1.toJourneyEventData)(journeyPayload), publicKey, devMode, mockMode, checkoutUrl);
                     return;
                 }
                 /**
@@ -283,10 +346,10 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                     const journeyPayload = {
                         journeyType: checkout_1.ASYNC_PAYMENT_EVENTS.PAY_VIA_BANK_COMPLETED,
                         orderId: payload === null || payload === void 0 ? void 0 : payload.orderId,
-                        status: (_b = payload === null || payload === void 0 ? void 0 : payload.status) !== null && _b !== void 0 ? _b : "unknown",
+                        status: (_a = payload === null || payload === void 0 ? void 0 : payload.status) !== null && _a !== void 0 ? _a : "unknown",
                     };
                     (0, validation_1.safeCallback)(onUserJourneyCompleted, [journeyPayload], "onUserJourneyCompleted", devMode);
-                    trackers.trackPayViaBankCompleted(orderId, publicKey, (_c = payload === null || payload === void 0 ? void 0 : payload.status) !== null && _c !== void 0 ? _c : "unknown", devMode, mockMode, checkoutUrl);
+                    trackers.trackPayViaBankCompleted(orderId, (0, event_projections_1.toJourneyEventData)(journeyPayload), publicKey, devMode, mockMode, checkoutUrl);
                     return;
                 }
                 // Handling checkout.closed events
@@ -297,19 +360,15 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                     setShowCheckout(false);
                     setShowFlowWebView(false);
                     setFlowWebViewUrl("");
-                    (0, validation_1.safeCallback)(onPaymentTerminate, [], "onPaymentTerminate", devMode);
-                    // Tracking payment terminate callback
-                    trackers.trackPaymentTerminate(orderId, "checkout_closed", publicKey, devMode, mockMode, checkoutUrl);
+                    const termination = { source: checkout_1.TERMINATION_SOURCES.CHECKOUT_CLOSED };
+                    (0, validation_1.safeCallback)(onPaymentTerminate, [termination], "onPaymentTerminate", devMode);
+                    // One object to the host and to telemetry, so the two cannot drift
+                    trackers.trackPaymentTerminate(orderId, (0, event_projections_1.toTerminationEventData)(termination), publicKey, devMode, mockMode, checkoutUrl);
                     return;
                 }
-            }
-        }
-        catch (error) {
-            if (devMode) {
-                console.error("[Glomo-RN-SDK Standard] Error parsing MainWebView message:", error);
-            }
-        }
-    }, [
+            },
+        },
+    }), [
         onPaymentSuccess,
         onPaymentFailure,
         onPaymentTerminate,
@@ -320,42 +379,47 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
         publicKey,
         checkoutUrl,
         trackers,
+        fileSaveHandler,
+        flowType,
+        onSdkError,
+        fileInputHandler,
     ]);
     /**
      * Handler for the flow WebView messages.
      * The flow WebView hosts child pages opened via window.open (e.g. 3DS, bank redirects).
      * Message structure mirrors the main WebView handler but operates on the overlay WebView.
      */
-    const handleFlowWebViewMessage = (0, react_1.useCallback)((event) => {
-        var _a, _b, _c;
-        try {
-            // Extracting and validating the raw message data from the flow WebView event
-            const data = (_a = event.nativeEvent) === null || _a === void 0 ? void 0 : _a.data;
-            if (!data || typeof data !== "string") {
-                if (devMode) {
-                    console.warn("[Glomo-RN-SDK Standard] Invalid message data from FlowWebView");
-                }
-                // Tracking invalid message received
-                trackers.trackInvalidMessageReceived("flow", data, flowWebViewUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
-            const message = JSON.parse(data);
-            if (devMode) {
-                console.log("[Glomo-RN-SDK Standard] FlowWebView Message received:", message.type, message);
-            }
+    const handleFlowWebViewMessage = (0, react_1.useMemo)(() => (0, message_router_1.createMessageRouter)({
+        logPrefix: LOG_PREFIX,
+        source: "FlowWebView",
+        devMode,
+        onInvalidMessage: (data) => {
+            trackers.trackInvalidMessageReceived("flow", data, flowWebViewUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
+        },
+        handlers: {
+            /**
+             * Telemetry only, and deliberately not wired to onUserRefusedDevicePermissions.
+             * The flow injection sees this by watching getUserMedia, so coverage depends on
+             * whether a given bank uses it - partial coverage on a merchant callback is
+             * worse than none, because silence would stop being unambiguous.
+             */
+            "permission.denied": (message) => {
+                (0, analytics_1.trackDevicePermissionRefused)(typeof message.resource === "string" ? message.resource : "camera", "get_user_media", orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+            },
+            "file.save": fileSaveHandler,
+            "file.input": fileInputHandler,
             // Forwarding console messages from the flow WebView's injected script
-            if (message.type === "console") {
+            console: (message) => {
                 if (devMode) {
-                    console.log(`[Glomo-RN-SDK Standard] [Flow] ${message.message}`);
+                    console.log(`${LOG_PREFIX} [Flow] ${message.message}`);
                 }
-                return;
-            }
+            },
             // Intercepting window.open calls from the flow WebView - navigating within the same overlay
-            if (message.type === "window.open") {
+            "window.open": (message) => {
                 const url = message.url;
                 if (url && typeof url === "string" && (0, validation_1.isValidUrl)(url)) {
                     if (devMode) {
-                        console.log(`[Glomo-RN-SDK Standard] window.open called from FlowWebView: ${url}`);
+                        console.log(`${LOG_PREFIX} window.open called from FlowWebView: ${url}`);
                     }
                     setFlowWebViewUrl(url);
                     // Tracking window.open interception
@@ -363,26 +427,27 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                 }
                 else {
                     if (devMode) {
-                        console.log("[Glomo-RN-SDK Standard] Invalid URL in window.open from FlowWebView:", url, typeof url === "undefined" ? "undefined" : "");
+                        console.log(`${LOG_PREFIX} Invalid URL in window.open from FlowWebView:`, url, typeof url === "undefined" ? "undefined" : "");
                     }
                 }
-                return;
-            }
+            },
             // Intercepting window.close calls from the flow WebView - closing the overlay
-            if (message.type === "window.close") {
+            "window.close": () => {
                 if (devMode) {
-                    console.log("[Glomo-RN-SDK Standard] FlowWebView close requested");
+                    console.log(`${LOG_PREFIX} FlowWebView close requested`);
                 }
                 setShowFlowWebView(false);
                 setFlowWebViewUrl("");
                 // Tracking window.close interception
                 trackers.trackWindowClose("flow", orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
+            },
             // Handling merchant JS callbacks from the flow WebView (payment events, lifecycle events)
-            if (message.type === "message" && message.message) {
+            message: (message) => {
+                var _a;
                 const messageData = message.message;
-                const messageType = messageData === null || messageData === void 0 ? void 0 : messageData.type;
+                if (!messageData)
+                    return;
+                const messageType = messageData.type;
                 // Handling payment success from the flow WebView
                 if (messageType === "payment.success" || messageType === "payment.complete") {
                     const paymentMessage = messageData;
@@ -397,12 +462,24 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                         setStatus("payment_successful");
                         (0, validation_1.safeCallback)(onPaymentSuccess, [payload], "onPaymentSuccess", devMode);
                         // Tracking payment success callback
-                        trackers.trackPaymentSuccess(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        trackers.trackPaymentSuccess((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.success", missingFields, "flow", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK Standard] Invalid payment success payload from FlowWebView:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.success payload from flow:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.success", (0, payment_payload_1.payloadKeysOf)(payload), "flow", orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.success")]], "onSdkError", devMode);
                     }
                     return;
                 }
@@ -420,12 +497,24 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                         setStatus("payment_failed");
                         (0, validation_1.safeCallback)(onPaymentFailure, [payload], "onPaymentFailure", devMode);
                         // Tracking payment failure callback
-                        trackers.trackPaymentFailure(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        trackers.trackPaymentFailure((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.failure", missingFields, "flow", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK Standard] Invalid payment failure payload from FlowWebView:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.failure payload from flow:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.failure", (0, payment_payload_1.payloadKeysOf)(payload), "flow", orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.failure")]], "onSdkError", devMode);
                     }
                     return;
                 }
@@ -450,20 +539,15 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                     const journeyPayload = {
                         journeyType: checkout_1.ASYNC_PAYMENT_EVENTS.PAY_VIA_BANK_COMPLETED,
                         orderId: payload === null || payload === void 0 ? void 0 : payload.orderId,
-                        status: (_b = payload === null || payload === void 0 ? void 0 : payload.status) !== null && _b !== void 0 ? _b : "unknown",
+                        status: (_a = payload === null || payload === void 0 ? void 0 : payload.status) !== null && _a !== void 0 ? _a : "unknown",
                     };
                     (0, validation_1.safeCallback)(onUserJourneyCompleted, [journeyPayload], "onUserJourneyCompleted", devMode);
-                    trackers.trackPayViaBankCompleted(orderId, publicKey, (_c = payload === null || payload === void 0 ? void 0 : payload.status) !== null && _c !== void 0 ? _c : "unknown", devMode, mockMode, checkoutUrl);
+                    trackers.trackPayViaBankCompleted(orderId, (0, event_projections_1.toJourneyEventData)(journeyPayload), publicKey, devMode, mockMode, checkoutUrl);
                     return;
                 }
-            }
-        }
-        catch (error) {
-            if (devMode) {
-                console.error("[Glomo-RN-SDK Standard] Error parsing FlowWebView message:", error);
-            }
-        }
-    }, [
+            },
+        },
+    }), [
         onPaymentSuccess,
         onPaymentFailure,
         onUserJourneyCompleted,
@@ -474,6 +558,10 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
         flowWebViewUrl,
         checkoutUrl,
         trackers,
+        fileSaveHandler,
+        flowType,
+        onSdkError,
+        fileInputHandler,
     ]);
     // Handler for the navigation state changes
     const handleNavigationStateChange = (0, react_1.useCallback)((navState) => {
@@ -503,10 +591,18 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                     console.log("[Glomo-RN-SDK Standard] Ignoring checkout status update for: " + status);
                 }
             }
-            (0, validation_1.safeCallback)(onPaymentTerminate, [], "onPaymentTerminate", devMode);
-            // Tracking payment terminate callback (user dismiss/back button)
-            const terminateSource = react_native_1.Platform.OS === "ios" ? "user_dismiss" : "back_button";
-            trackers.trackPaymentTerminate(orderId, terminateSource, publicKey, devMode, mockMode, checkoutUrl);
+            /**
+             * Inferred from the platform rather than read off an event, because `onRequestClose` is
+             * the only wiring here and the two platforms raise it for different gestures: Android
+             * for hardware back and the back gesture, iOS for swipe-down on the pageSheet. Nothing
+             * else routes through it, so the inference is sound - but it is an inference.
+             */
+            const termination = {
+                source: react_native_1.Platform.OS === "ios" ? checkout_1.TERMINATION_SOURCES.MODAL_DISMISS : checkout_1.TERMINATION_SOURCES.DEVICE_BACK_BUTTON,
+            };
+            (0, validation_1.safeCallback)(onPaymentTerminate, [termination], "onPaymentTerminate", devMode);
+            // One object to the host and to telemetry, so the two cannot drift
+            trackers.trackPaymentTerminate(orderId, (0, event_projections_1.toTerminationEventData)(termination), publicKey, devMode, mockMode, checkoutUrl);
         }
         catch (error) {
             if (devMode) {
@@ -521,88 +617,35 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
         }
         setShowFlowWebView(false);
         setFlowWebViewUrl("");
-        trackers.trackWindowClose("flow", orderId, publicKey, devMode, mockMode, checkoutUrl);
-    }, [devMode, orderId, publicKey, mockMode, checkoutUrl, trackers]);
+        (0, analytics_1.trackBackNavigationViaSdkBackButton)(orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+    }, [devMode, orderId, publicKey, mockMode, checkoutUrl, flowType]);
     /**
-     * Handler for WebView permission requests (e.g. camera access for bank authentication).
-     * On Android, prompts the user for camera permission via PermissionsAndroid.
-     * On iOS, grants camera access automatically (iOS handles its own permission prompt).
-     * Non-camera permissions are denied by default.
+     * Closing the checkout when the user refuses camera access, since the bank page cannot
+     * proceed without it. Kept here rather than inside usePermissionRequest because moving the
+     * status and notifying the merchant are flow concerns.
+     *
+     * Resets the flow overlay as well as the modal, matching the LRS handler. The prompt is raised
+     * from a bank page inside that overlay, so this is the one close path where the flow state is
+     * guaranteed non-default. Nothing visible depends on it today - the overlay renders inside the
+     * Modal and unmounts with it - but "every close path resets derived state" should not hold in
+     * one flow and not the other.
      */
-    const handlePermissionRequest = (0, react_1.useCallback)(async (request) => {
-        try {
-            const { resources } = request.nativeEvent;
-            // Checking if the requested permission is camera-related
-            const isCameraPermissionRequest = resources.some((resource) => resource === "camera" || resource.toLowerCase().includes("camera"));
-            if (!isCameraPermissionRequest) {
-                if (devMode) {
-                    console.log("[Glomo-RN-SDK Standard] Non-camera permission requested, denying:", resources);
-                }
-                request.deny();
-                return;
-            }
-            if (devMode) {
-                console.log("[Glomo-RN-SDK Standard] Camera permission requested by webpage");
-            }
-            if (react_native_1.Platform.OS === "android") {
-                try {
-                    const granted = await react_native_1.PermissionsAndroid.request(react_native_1.PermissionsAndroid.PERMISSIONS.CAMERA, {
-                        title: "Camera Permission",
-                        message: "This app needs camera access for identity verification during checkout",
-                        buttonNeutral: "Ask Me Later",
-                        buttonNegative: "Cancel",
-                        buttonPositive: "OK",
-                    });
-                    if (granted === react_native_1.PermissionsAndroid.RESULTS.GRANTED) {
-                        if (devMode) {
-                            console.log("[Glomo-RN-SDK Standard] Camera permission granted");
-                        }
-                        request.grant(resources);
-                    }
-                    else {
-                        if (devMode) {
-                            console.log("[Glomo-RN-SDK Standard] Camera permission denied by user");
-                        }
-                        setShowCheckout(false);
-                        if (status === "payment_in_progress") {
-                            setStatus("payment_cancelled");
-                        }
-                        (0, validation_1.safeCallback)(onUserRefusedCameraPermissions, [], "onUserRefusedCameraPermissions", devMode);
-                        request.deny();
-                    }
-                }
-                catch (err) {
-                    if (devMode) {
-                        console.error("[Glomo-RN-SDK Standard] Error requesting camera permission:", err);
-                    }
-                    setShowCheckout(false);
-                    if (status === "payment_in_progress") {
-                        setStatus("payment_cancelled");
-                    }
-                    (0, validation_1.safeCallback)(onUserRefusedCameraPermissions, [], "onUserRefusedCameraPermissions", devMode);
-                    request.deny();
-                }
-            }
-            else if (react_native_1.Platform.OS === "ios") {
-                if (devMode) {
-                    console.log("[Glomo-RN-SDK Standard] Granting camera permission request on iOS");
-                }
-                request.grant(resources);
-            }
-            else {
-                if (devMode) {
-                    console.warn("[Glomo-RN-SDK Standard] Unsupported platform for camera permissions");
-                }
-                request.deny();
-            }
-        }
-        catch (error) {
-            if (devMode) {
-                console.error("[Glomo-RN-SDK Standard] Error in handlePermissionRequest:", error);
-            }
-            request.deny();
+    const handleCameraPermissionDenied = (0, react_1.useCallback)(() => {
+        setShowCheckout(false);
+        setShowFlowWebView(false);
+        setFlowWebViewUrl("");
+        if (status === "payment_in_progress") {
+            setStatus("payment_cancelled");
         }
-    }, [devMode, status, onUserRefusedCameraPermissions]);
+        (0, validation_1.safeCallback)(onUserRefusedDevicePermissions, [], "onUserRefusedDevicePermissions", devMode);
+        // The permission hook only reaches here for camera; anything else is denied without notifying
+        (0, analytics_1.trackDevicePermissionRefused)("camera", "permission_request", orderId, publicKey, devMode, mockMode, checkoutUrl, flowType);
+    }, [status, onUserRefusedDevicePermissions, devMode, orderId, publicKey, mockMode, checkoutUrl, flowType]);
+    const handlePermissionRequest = (0, use_permission_request_1.usePermissionRequest)({
+        logPrefix: "[Glomo-RN-SDK Standard]",
+        onDenied: handleCameraPermissionDenied,
+        devMode,
+    });
     /**
      * Initiator method for the Standard Checkout flow.
      * Using a ref, the standard flow can be started by calling this method.
@@ -620,38 +663,62 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
          * Checking device security compliance (if peerDependencies are available)
          * A null value indicates that recommended security dependencies were not installed and compliance checks will be skipped in this case
          */
-        const deviceComplianceCheck = (0, device_compliance_1.checkDeviceCompliance)(devMode);
-        const jailbreakDetectionLibraryInstalled = (0, device_compliance_1.isComplianceCheckAvailable)();
-        const jailbreakDetectionInfo = {
-            jailbreakDetectionLibraryInstalled,
-            jailbreakDetected: deviceComplianceCheck,
+        const compliance = (0, device_compliance_1.resolveDeviceCompliance)(devMode);
+        const complianceLibraryInstalled = (0, device_compliance_1.isComplianceCheckAvailable)();
+        const fileSave = (0, index_2.resolveFileSaveAvailability)();
+        const dependencyInfo = {
+            jailbreakDetectionLibraryInstalled: complianceLibraryInstalled,
+            jailbreakDetected: compliance.compromised,
+            complianceSource: compliance.source,
+            complianceSignals: compliance.trippedSignals,
+            fileSaveAvailable: fileSave.available,
+            missingFileSavePackages: fileSave.missing,
         };
         if (devMode) {
             console.log(`[Glomo-RN-SDK Standard] Attempting to start checkout of ${checkoutUrl} from status: ${status}`);
         }
         // Tracking start attempt with current status
-        trackers.trackStartAttempt(status, orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
-        if (deviceComplianceCheck === true) {
-            // Device detected as compromised
+        trackers.trackStartAttempt(status, orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
+        /**
+         * Ungated on purpose, both of them. An absent optional dependency degrades silently by
+         * design, so a console warning is the only thing that reaches a merchant who has not
+         * noticed - and the compliance one now precedes a hard block on live keys.
+         */
+        if (!complianceLibraryInstalled) {
+            console.warn("[Glomo-RN-SDK Standard] jail-monkey is not installed or its native module is not linked, so " +
+                "rooted and jailbroken devices cannot be detected. As of v5 this BLOCKS live checkouts. " +
+                "Install jail-monkey and rebuild the app - see the README.");
+        }
+        if (!fileSave.available) {
+            console.warn(`[Glomo-RN-SDK Standard] Document downloads are disabled: ${fileSave.missing.join(" and ")} ` +
+                "could not be loaded. Install the package(s) and rebuild the app, or ignore this if your " +
+                "checkout does not offer downloads - the page falls back to its own behaviour.");
+        }
+        if ((0, device_compliance_1.blocksCheckout)(compliance, publicKey)) {
+            /**
+             * Two conditions, one refusal. `compromised === true` is a rooted or jailbroken device;
+             * `null` is a device we could not check, which on RN overwhelmingly means jail-monkey is
+             * absent rather than that a platform probe failed. Both fail closed on a live key, and
+             * neither fires on a test or mock key.
+             */
+            const unknown = compliance.compromised === null;
             if (devMode) {
-                console.error("[Glomo-RN-SDK Standard] Cannot start checkout. Device is rooted or jailbroken.");
+                console.error(`[Glomo-RN-SDK Standard] Cannot start checkout. ${unknown ? "Device security could not be verified." : "Device is rooted or jailbroken."}`);
             }
             const errors = [
                 {
                     type: "device_forbidden",
-                    message: "Standard checkout is not allowed on rooted or jailbroken devices.",
+                    message: unknown
+                        ? "Standard checkout could not verify this device's security. Install jail-monkey and rebuild the app."
+                        : "Standard checkout is not allowed on rooted or jailbroken devices.",
                 },
             ];
             (0, validation_1.safeCallback)(onSdkError, [errors], "onSdkError", devMode);
             // Tracking start() failure
-            trackers.trackStartFailure("device_forbidden", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            trackers.trackStartFailure(unknown ? "device_compliance_unknown" : "device_forbidden", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
-        else if (deviceComplianceCheck === null) {
-            // This warning was intentionally not gated behind a devMode check to ensure merchants are aware of the strong recommendation to install jail-monkey for enhanced security compliance.
-            console.warn("[Glomo-RN-SDK Standard] Device security library not installed - the SDK won't be able to automatically detect rooted/jailbroken devices. It is HIGHLY recommended to install jail-monkey as per the README, and prevent standard checkouts from compromised devices.");
-        }
         // Enforcing devMode requirement for development servers
         const resolvedServer = server || "prod";
         if (!devMode && resolvedServer !== "prod") {
@@ -663,7 +730,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
             ];
             (0, validation_1.safeCallback)(onSdkError, [errors], "onSdkError", devMode);
             trackers.trackSdkError(errors, orderId, publicKey, devMode, mockMode, checkoutUrl);
-            trackers.trackStartFailure("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            trackers.trackStartFailure("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -706,7 +773,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
             (0, validation_1.safeCallback)(onSdkError, [errors], "onSdkError", devMode);
             // Tracking start() failure
             trackers.trackSdkError(errors, orderId, publicKey, devMode, mockMode, checkoutUrl);
-            trackers.trackStartFailure("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            trackers.trackStartFailure("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -715,7 +782,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                 console.log(`[Glomo-RN-SDK Standard] Cannot start checkout. Current status: ${status}. Payment already successful.`);
             }
             // Tracking start() failure
-            trackers.trackStartFailure("payment_successful", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            trackers.trackStartFailure("payment_successful", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -729,7 +796,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                 console.log(`[Glomo-RN-SDK Standard] Cannot start checkout. Unknown status: ${status}.`);
             }
             // Tracking start() failure
-            trackers.trackStartFailure("invalid_status", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            trackers.trackStartFailure("invalid_status", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -738,7 +805,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
                 console.error("[Glomo-RN-SDK Standard] Cannot start checkout. Invalid checkout URL.");
             }
             // Tracking start() failure
-            trackers.trackStartFailure("invalid_url", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            trackers.trackStartFailure("invalid_url", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -751,7 +818,7 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
         payViaBankCompletedHandledRef.current = false;
         setStatus("payment_in_progress");
         // Tracking successful start
-        trackers.trackStartSuccess(orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+        trackers.trackStartSuccess(orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
         // Opening the checkout modal
         setShowCheckout(true);
         return true;
@@ -798,6 +865,13 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
             setFlowWebViewUrl("");
         };
     }, []);
+    /**
+     * Scripts injected into each WebView, carrying what this build can advertise.
+     *
+     * Resolved once per mount rather than at module load, so a merchant who never opens a
+     * checkout never pays for the dependency probe.
+     */
+    const injectionScripts = (0, react_1.useMemo)(() => (0, index_1.buildInjectionScripts)((0, index_2.resolveCapabilities)()), []);
     return {
         start,
         status,
@@ -815,7 +889,9 @@ function useStandardCheckout({ server, publicKey, orderId, onPaymentSuccess, onP
         handleNavigationStateChange,
         handleModalBackButton,
         handleFlowBack,
-        injectedMain: index_1.InjectionScripts.standard,
-        injectedFlow: index_1.InjectionScripts.flow,
+        injectedMain: __DEV__ && (internalOptions === null || internalOptions === void 0 ? void 0 : internalOptions._testInjectionScript)
+            ? injectionScripts.standard + internalOptions._testInjectionScript
+            : injectionScripts.standard,
+        injectedFlow: injectionScripts.flow,
     };
 }