@glomopay/react-native-sdk 4.1.0 → 5.0.0

package/lib/utils/device-compliance.d.ts

@@ -1,24 +1,69 @@
 /**
- * Device compliance utilities for the GlomoPay RN SDK
+ * Device compliance for the GlomoPay RN SDK
  *
- * These utilities check device security compliance using jail-monkey (if available).
- * If jail-monkey is not installed, compliance checks are skipped.
+ * Whether a checkout may run on this device, from `jail-monkey`'s root/jailbreak detection.
  *
- * Merchants are STRONGLY encouraged to install peerDependencies for better security compliance.
+ * The gate exists to protect a **compromised customer device**: malware on a real user's rooted
+ * phone reading cached KYC documents. That framing is what decides the two judgement calls below -
+ * which root signals to trust, and when not to gate at all.
  */
+/** The package name, so a missing dependency can be named in a warning and in telemetry */
+export declare const COMPLIANCE_PACKAGE = "jail-monkey";
 /**
- * Checks if the device is rooted or jailbroken
- * Returns null if jail-monkey is not available (compliance check skipped)
- * Returns true if device is compromised, false if device is safe
+ * rootBeer checks deliberately excluded from our verdict.
  *
- * @param devMode - Whether to log debug information
- * @returns true if device is compromised, false if safe, null if check unavailable
+ * Both fire on a stock AOSP emulator image - `ro.build.tags=test-keys`, and `ro.debuggable=1` /
+ * `ro.secure=0` - so an Android emulator reports as rooted through `isJailBroken()`, which is a
+ * hardcoded OR over every check and is not configurable. Merchants integration-test with live keys
+ * on emulators; blocking that turns integration into a support ticket, and an emulator is not the
+ * threat this gate exists for - there is no unwitting victim whose documents are being read.
+ *
+ * What this costs is custom-ROM detection on physical devices, the weakest signal in the set. Every
+ * strong indicator is kept: a genuinely rooted handset trips su, Magisk or a root-manager app
+ * essentially always.
+ */
+export declare const IGNORED_ROOT_SIGNALS: string[];
+/** How the verdict below was reached. Rides telemetry, because the three are not equally strong. */
+export type ComplianceSource = 
+/** Per-check rootBeer breakdown, with IGNORED_ROOT_SIGNALS excluded. Android only. */
+"decomposed"
+/** jail-monkey's own `isJailBroken()`. iOS, and Android builds that expose no breakdown. */
+ | "aggregate"
+/** jail-monkey could not be loaded at all. */
+ | "unavailable";
+/** What the probe concluded */
+export interface DeviceComplianceResult {
+    /** True if compromised, false if clean, **null if it could not be determined** - never "clean" */
+    compromised: boolean | null;
+    source: ComplianceSource;
+    /** Names of the checks that tripped. Never the device identifiers behind them. */
+    trippedSignals: string[];
+}
+/**
+ * Whether this device is compromised.
+ *
+ * Prefers the per-check breakdown over `isJailBroken()`, because the aggregate is a hardcoded OR
+ * that includes the two emulator-tripping checks. Falls back to the aggregate whenever the
+ * breakdown is absent - iOS never reports one, and a future jail-monkey that stops exporting it
+ * degrades to today's behaviour rather than to "clean".
+ */
+export declare function resolveDeviceCompliance(devMode?: boolean): DeviceComplianceResult;
+/**
+ * Whether a checkout must be refused on this device.
+ *
+ * **Fails closed on a live key**: unknown blocks, because on RN unknown overwhelmingly means the
+ * merchant did not install `jail-monkey` rather than that a platform probe failed. That is why the
+ * package stopped being an optional peer dependency in v5 - a dependency cannot be optional and
+ * load-bearing at once, and an install-time warning beats a silent runtime outage.
+ *
+ * **Never gates mock or test traffic.** Measured, never blocked - matching the Flutter SDK's
+ * `enforced` model, and so QA on a rooted handset or an emulator image stays possible.
  */
-export declare function checkDeviceCompliance(devMode?: boolean): boolean | null;
+export declare function blocksCheckout(result: DeviceComplianceResult, publicKey?: string): boolean;
 /**
- * Checks if compliance checking is possible in the current environment
+ * Whether the device compliance check could run at all
  *
- * @returns true if peerDependencies for compliance checking are installed and available
+ * @returns true if jail-monkey is installed and its native module is linked
  */
 export declare function isComplianceCheckAvailable(): boolean;
 //# sourceMappingURL=device-compliance.d.ts.map

package/lib/utils/device-compliance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-compliance.d.ts","sourceRoot":"","sources":["../../src/utils/device-compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,OAAe,GAAG,OAAO,GAAG,IAAI,CA+B9E;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD"}
+{"version":3,"file":"device-compliance.d.ts","sourceRoot":"","sources":["../../src/utils/device-compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,UAA+C,CAAC;AAEjF,oGAAoG;AACpG,MAAM,MAAM,gBAAgB;AACxB,sFAAsF;AACpF,YAAY;AAEd,4FAA4F;GAC1F,WAAW;AAEb,8CAA8C;GAC5C,aAAa,CAAC;AAEpB,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACnC,kGAAkG;IAClG,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IAE5B,MAAM,EAAE,gBAAgB,CAAC;IAEzB,kFAAkF;IAClF,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B;AA4CD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,OAAe,GAAG,sBAAsB,CAuDxF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAK1F;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD"}

package/lib/utils/device-compliance.js

@@ -1,71 +1,135 @@
 "use strict";
 /**
- * Device compliance utilities for the GlomoPay RN SDK
+ * Device compliance for the GlomoPay RN SDK
  *
- * These utilities check device security compliance using jail-monkey (if available).
- * If jail-monkey is not installed, compliance checks are skipped.
+ * Whether a checkout may run on this device, from `jail-monkey`'s root/jailbreak detection.
  *
- * Merchants are STRONGLY encouraged to install peerDependencies for better security compliance.
+ * The gate exists to protect a **compromised customer device**: malware on a real user's rooted
+ * phone reading cached KYC documents. That framing is what decides the two judgement calls below -
+ * which root signals to trust, and when not to gate at all.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkDeviceCompliance = checkDeviceCompliance;
+exports.IGNORED_ROOT_SIGNALS = exports.COMPLIANCE_PACKAGE = void 0;
+exports.resolveDeviceCompliance = resolveDeviceCompliance;
+exports.blocksCheckout = blocksCheckout;
 exports.isComplianceCheckAvailable = isComplianceCheckAvailable;
+const validation_1 = require("./validation");
+/** The package name, so a missing dependency can be named in a warning and in telemetry */
+exports.COMPLIANCE_PACKAGE = "jail-monkey";
 /**
- * Safely checks if jail-monkey is available
- * Returns null if the library is not installed
+ * rootBeer checks deliberately excluded from our verdict.
+ *
+ * Both fire on a stock AOSP emulator image - `ro.build.tags=test-keys`, and `ro.debuggable=1` /
+ * `ro.secure=0` - so an Android emulator reports as rooted through `isJailBroken()`, which is a
+ * hardcoded OR over every check and is not configurable. Merchants integration-test with live keys
+ * on emulators; blocking that turns integration into a support ticket, and an emulator is not the
+ * threat this gate exists for - there is no unwitting victim whose documents are being read.
+ *
+ * What this costs is custom-ROM detection on physical devices, the weakest signal in the set. Every
+ * strong indicator is kept: a genuinely rooted handset trips su, Magisk or a root-manager app
+ * essentially always.
  */
-function getJailMonkey() {
+exports.IGNORED_ROOT_SIGNALS = ["detectTestKeys", "checkForDangerousProps"];
+/**
+ * Loads jail-monkey, or null.
+ *
+ * Literal `require` directly inside the `try`, resolved once at module init. Both are what Metro
+ * requires of an optional dependency, and the second is the one that is easy to get wrong: a lazy
+ * first `require` runs outside Metro's `inGuard`, where a failed load is reported through
+ * `ErrorUtils.reportFatalError` and raises a full-screen LogBox in dev builds even though the
+ * `catch` here degrades correctly. See the full note in capabilities/file-save.ts.
+ *
+ * Also catches the installed-but-not-rebuilt case: jail-monkey reads
+ * `NativeModules.JailMonkey.rootedDetectionMethods` at module scope, so an unlinked native module
+ * throws on import rather than degrading.
+ */
+const jailMonkeyModule = (() => {
+    var _a;
     try {
-        const JailMonkey = require("jail-monkey");
-        if (JailMonkey && typeof JailMonkey.isJailBroken === "function") {
-            return JailMonkey;
-        }
-        return null;
+        const loaded = require("jail-monkey");
+        const module = ((_a = loaded === null || loaded === void 0 ? void 0 : loaded.default) !== null && _a !== void 0 ? _a : loaded);
+        return module && typeof module.isJailBroken === "function" ? module : null;
     }
-    catch (_a) {
-        // jail-monkey is not installed
+    catch (_b) {
         return null;
     }
+})();
+function loadJailMonkey() {
+    return jailMonkeyModule;
 }
 /**
- * Checks if the device is rooted or jailbroken
- * Returns null if jail-monkey is not available (compliance check skipped)
- * Returns true if device is compromised, false if device is safe
+ * Whether this device is compromised.
  *
- * @param devMode - Whether to log debug information
- * @returns true if device is compromised, false if safe, null if check unavailable
+ * Prefers the per-check breakdown over `isJailBroken()`, because the aggregate is a hardcoded OR
+ * that includes the two emulator-tripping checks. Falls back to the aggregate whenever the
+ * breakdown is absent - iOS never reports one, and a future jail-monkey that stops exporting it
+ * degrades to today's behaviour rather than to "clean".
  */
-function checkDeviceCompliance(devMode = false) {
-    const JailMonkey = getJailMonkey();
-    if (!JailMonkey) {
+function resolveDeviceCompliance(devMode = false) {
+    const jailMonkey = loadJailMonkey();
+    if (!jailMonkey) {
         if (devMode) {
-            console.log("[Glomo-RN-SDK] jail-monkey not available. Device compliance check skipped. " +
-                "Install jail-monkey for enhanced security compliance.");
+            console.log(`[Glomo-RN-SDK] ${exports.COMPLIANCE_PACKAGE} not available. Device compliance could not be determined.`);
         }
-        // Check unavailable - allowing checkout to proceed
-        return null;
+        return { compromised: null, source: "unavailable", trippedSignals: [] };
     }
     try {
-        const isCompromised = JailMonkey.isJailBroken();
+        const breakdown = jailMonkey.androidRootedDetectionMethods;
+        // Read as an open map: the checks are iterated, and a jail-monkey that adds one should have
+        // it counted rather than ignored for being absent from a hardcoded list
+        const rootBeer = breakdown === null || breakdown === void 0 ? void 0 : breakdown.rootBeer;
+        if (rootBeer && typeof rootBeer === "object") {
+            const trippedSignals = Object.keys(rootBeer).filter((signal) => rootBeer[signal] === true && !exports.IGNORED_ROOT_SIGNALS.includes(signal));
+            // jail-monkey's own non-rootBeer signal sits beside the map rather than inside it
+            if ((breakdown === null || breakdown === void 0 ? void 0 : breakdown.jailMonkey) === true) {
+                trippedSignals.push("jailMonkey");
+            }
+            if (devMode) {
+                console.log(`[Glomo-RN-SDK] Device compliance (decomposed): ${trippedSignals.length > 0 ? `FAILED via ${trippedSignals.join(", ")}` : "PASSED"}`);
+            }
+            return { compromised: trippedSignals.length > 0, source: "decomposed", trippedSignals };
+        }
+        const compromised = jailMonkey.isJailBroken();
         if (devMode) {
-            console.log(`[Glomo-RN-SDK] Device compliance check: ${isCompromised ? "FAILED (device compromised)" : "PASSED"}`);
+            console.log(`[Glomo-RN-SDK] Device compliance (aggregate): ${compromised ? "FAILED" : "PASSED"}`);
         }
-        return isCompromised;
+        return {
+            compromised,
+            source: "aggregate",
+            trippedSignals: compromised ? ["isJailBroken"] : [],
+        };
     }
     catch (error) {
         if (devMode) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            console.error("[Glomo-RN-SDK] Error checking device compliance:", errorMessage);
+            const message = error instanceof Error ? error.message : String(error);
+            console.error("[Glomo-RN-SDK] Error checking device compliance:", message);
         }
-        // On error, allowing checkout to proceed (fail open strategy)
-        return null;
+        // Unknown, not clean. The caller decides what to do with that, and on a live key it blocks.
+        return { compromised: null, source: "unavailable", trippedSignals: [] };
+    }
+}
+/**
+ * Whether a checkout must be refused on this device.
+ *
+ * **Fails closed on a live key**: unknown blocks, because on RN unknown overwhelmingly means the
+ * merchant did not install `jail-monkey` rather than that a platform probe failed. That is why the
+ * package stopped being an optional peer dependency in v5 - a dependency cannot be optional and
+ * load-bearing at once, and an install-time warning beats a silent runtime outage.
+ *
+ * **Never gates mock or test traffic.** Measured, never blocked - matching the Flutter SDK's
+ * `enforced` model, and so QA on a rooted handset or an emulator image stays possible.
+ */
+function blocksCheckout(result, publicKey) {
+    if ((0, validation_1.isMockModeKey)(publicKey)) {
+        return false;
     }
+    return result.compromised !== false;
 }
 /**
- * Checks if compliance checking is possible in the current environment
+ * Whether the device compliance check could run at all
  *
- * @returns true if peerDependencies for compliance checking are installed and available
+ * @returns true if jail-monkey is installed and its native module is linked
  */
 function isComplianceCheckAvailable() {
-    return getJailMonkey() !== null;
+    return loadJailMonkey() !== null;
 }

package/lib/utils/event-projections.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Runtime allowlists for what a callback payload may contribute to telemetry
+ *
+ * **Every tracker that reports a payload takes one of these, never the payload itself.**
+ *
+ * The rule exists because TypeScript types are erased. A `Pick<>`, a cast or a projection
+ * *interface* removes nothing from the object at runtime - the value still carries every field, and
+ * `client.post("/track", payload)` serialises all of them. So "pass the payload, constrain it with a
+ * type" compiles cleanly, reviews cleanly, and ships `signature` to Segment on every payment. A
+ * signature is a bearer credential.
+ *
+ * Constructing the outbound object field by field is what actually enforces the allowlist, and
+ * keeping it here rather than at each call site is what keeps the callback and the event assembled
+ * from one source, so a field added to a payload cannot reach an event unless someone adds it here
+ * deliberately.
+ */
+import { type GlomoCheckoutPayload, type GlomoTerminationPayload } from "../types/checkout";
+/** What a payment payload may say about itself */
+export interface PaymentEventData {
+    orderId: string;
+    paymentId?: string;
+}
+/**
+ * Projection of a success or failure payload.
+ *
+ * `signature` is excluded and must stay excluded - it is the field this whole module exists for.
+ */
+export declare function toPaymentEventData(payload: GlomoCheckoutPayload): PaymentEventData;
+/** What a termination payload may say about itself */
+export interface TerminationEventData {
+    source: string;
+}
+/** Projection of a termination payload. Everything it carries today is safe; that is not a licence. */
+export declare function toTerminationEventData(payload: GlomoTerminationPayload): TerminationEventData;
+/** What an asynchronous journey payload may say about itself */
+export interface JourneyEventData {
+    journeyType: string;
+    journeyStatus?: string;
+    /**
+     * Whether the page sent bank details, not what they were.
+     *
+     * `senderAccountNumber` is a customer bank account number and `transactionReference` identifies
+     * a specific transfer; neither belongs in analytics. Presence is what triage actually needs - it
+     * separates "the page reported a transfer without details" from "the SDK dropped them".
+     */
+    hasSenderAccountNumber: boolean;
+    hasTransactionReference: boolean;
+}
+/** Projection of an asynchronous journey payload */
+export declare function toJourneyEventData(payload: {
+    journeyType: string;
+    status?: string;
+    senderAccountNumber?: string;
+    transactionReference?: string;
+}): JourneyEventData;
+//# sourceMappingURL=event-projections.d.ts.map

package/lib/utils/event-projections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-projections.d.ts","sourceRoot":"","sources":["../../src/utils/event-projections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5F,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,gBAAgB,CAElF;AAED,sDAAsD;AACtD,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,oBAAoB,CAE7F;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;OAMG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,uBAAuB,EAAE,OAAO,CAAC;CACpC;AAED,oDAAoD;AACpD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACjC,GAAG,gBAAgB,CAOnB"}

package/lib/utils/event-projections.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Runtime allowlists for what a callback payload may contribute to telemetry
+ *
+ * **Every tracker that reports a payload takes one of these, never the payload itself.**
+ *
+ * The rule exists because TypeScript types are erased. A `Pick<>`, a cast or a projection
+ * *interface* removes nothing from the object at runtime - the value still carries every field, and
+ * `client.post("/track", payload)` serialises all of them. So "pass the payload, constrain it with a
+ * type" compiles cleanly, reviews cleanly, and ships `signature` to Segment on every payment. A
+ * signature is a bearer credential.
+ *
+ * Constructing the outbound object field by field is what actually enforces the allowlist, and
+ * keeping it here rather than at each call site is what keeps the callback and the event assembled
+ * from one source, so a field added to a payload cannot reach an event unless someone adds it here
+ * deliberately.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPaymentEventData = toPaymentEventData;
+exports.toTerminationEventData = toTerminationEventData;
+exports.toJourneyEventData = toJourneyEventData;
+/**
+ * Projection of a success or failure payload.
+ *
+ * `signature` is excluded and must stay excluded - it is the field this whole module exists for.
+ */
+function toPaymentEventData(payload) {
+    return { orderId: payload.orderId, paymentId: payload.paymentId };
+}
+/** Projection of a termination payload. Everything it carries today is safe; that is not a licence. */
+function toTerminationEventData(payload) {
+    return { source: payload.source };
+}
+/** Projection of an asynchronous journey payload */
+function toJourneyEventData(payload) {
+    return {
+        journeyType: payload.journeyType,
+        journeyStatus: payload.status,
+        hasSenderAccountNumber: Boolean(payload.senderAccountNumber),
+        hasTransactionReference: Boolean(payload.transactionReference),
+    };
+}

package/lib/utils/file-metadata.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Shapes what a saved or picked file may say about itself in telemetry
+ *
+ * Extension and byte count only - never the file name, which is the user's data
+ * (`passport_A1234567.pdf`) where these two are not.
+ *
+ * Values are sentinels rather than nulls so an event always carries the same shape and a missing
+ * value is something to filter on. Ported from the Flutter SDK's `FileMetadata` so the two report
+ * the same vocabulary on the same events.
+ */
+/**
+ * Length could not be read. Negative because `0` is legitimate: a zero-byte file is a real failure
+ * that would otherwise look like an unexplained bank rejection.
+ */
+export declare const SIZE_UNAVAILABLE = -1;
+/** The file had no extension. User behaviour, not an error. */
+export declare const EXTENSION_NONE = "FILE_WITH_NO_EXTENSION";
+/**
+ * The tail was rejected: too long, or not purely alphanumeric. In the field this is ordinary user
+ * naming (`scan.jpeg (1)`), not an SDK fault. Do not alert on it.
+ */
+export declare const EXTENSION_EXTRACTION_FAILED = "EXTRACTION_FAILED";
+/**
+ * A well-formed extension that is not one we know. Reports that something novel was handled without
+ * carrying the value, so a new format is still visible as an event.
+ */
+export declare const EXTENSION_UNKNOWN = "UNKNOWN_EXTENSION";
+/**
+ * Lowercased extension of a path, or a sentinel.
+ *
+ * Not `split(".").pop()`, which returns the whole filename when there is no dot - shipping exactly
+ * what this exists to keep out.
+ */
+export declare function extensionOf(path?: string | null): string;
+/**
+ * The MIME type to declare for a file, from the extension extensionOf resolved.
+ *
+ * Falls back to the generic type for every sentinel: an unrecognised extension is exactly the case
+ * where a guess would be wrong, and Android will still let the user save with a generic type.
+ */
+export declare function mimeTypeFor(fileExtension: string): string;
+/**
+ * Normalises a raw HTML `accept` attribute for telemetry.
+ *
+ * The injected JS reads the attribute verbatim (`".pdf, .jpeg"`) where a native layer may hand over
+ * an already-parsed list (`".pdf,.jpeg"`), so without this the request event and anything reported
+ * later for the same click will not join on it.
+ *
+ * Never used to decide what may be picked - the bank owns that.
+ */
+export declare function normalizeAcceptTypes(acceptTypes?: string | null): string | undefined;
+//# sourceMappingURL=file-metadata.d.ts.map

package/lib/utils/file-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-metadata.d.ts","sourceRoot":"","sources":["../../src/utils/file-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,cAAc,2BAA2B,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,2BAA2B,sBAAsB,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AA2CrD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA4BxD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAWpF"}

package/lib/utils/file-metadata.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Shapes what a saved or picked file may say about itself in telemetry
+ *
+ * Extension and byte count only - never the file name, which is the user's data
+ * (`passport_A1234567.pdf`) where these two are not.
+ *
+ * Values are sentinels rather than nulls so an event always carries the same shape and a missing
+ * value is something to filter on. Ported from the Flutter SDK's `FileMetadata` so the two report
+ * the same vocabulary on the same events.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXTENSION_UNKNOWN = exports.EXTENSION_EXTRACTION_FAILED = exports.EXTENSION_NONE = exports.SIZE_UNAVAILABLE = void 0;
+exports.extensionOf = extensionOf;
+exports.mimeTypeFor = mimeTypeFor;
+exports.normalizeAcceptTypes = normalizeAcceptTypes;
+/**
+ * Length could not be read. Negative because `0` is legitimate: a zero-byte file is a real failure
+ * that would otherwise look like an unexplained bank rejection.
+ */
+exports.SIZE_UNAVAILABLE = -1;
+/** The file had no extension. User behaviour, not an error. */
+exports.EXTENSION_NONE = "FILE_WITH_NO_EXTENSION";
+/**
+ * The tail was rejected: too long, or not purely alphanumeric. In the field this is ordinary user
+ * naming (`scan.jpeg (1)`), not an SDK fault. Do not alert on it.
+ */
+exports.EXTENSION_EXTRACTION_FAILED = "EXTRACTION_FAILED";
+/**
+ * A well-formed extension that is not one we know. Reports that something novel was handled without
+ * carrying the value, so a new format is still visible as an event.
+ */
+exports.EXTENSION_UNKNOWN = "UNKNOWN_EXTENSION";
+/** First of two gates. Rejects a long tail early; KNOWN_EXTENSIONS is what actually bounds this. */
+const MAX_EXTENSION_LENGTH = 5;
+/**
+ * Extensions reported verbatim, and the MIME type each one maps to.
+ *
+ * Anything outside this map becomes a sentinel, so no part of a filename can reach telemetry by
+ * being short enough to look plausible. The MIME side exists because Android's save dialog is an
+ * `ACTION_CREATE_DOCUMENT` intent that wants a type: deriving it here rather than forwarding the
+ * `mimeType` the page sends keeps untrusted page input out of an Intent, and is the same call the
+ * Flutter SDK makes when it declines to forward that field to `file_picker`.
+ */
+const KNOWN_EXTENSIONS = {
+    pdf: "application/pdf",
+    epdf: "application/pdf",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    png: "image/png",
+    gif: "image/gif",
+    webp: "image/webp",
+    bmp: "image/bmp",
+    tiff: "image/tiff",
+    tif: "image/tiff",
+    heic: "image/heic",
+    heif: "image/heif",
+    jfif: "image/jpeg",
+    pjpeg: "image/jpeg",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xls: "application/vnd.ms-excel",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    csv: "text/csv",
+    txt: "text/plain",
+    rtf: "application/rtf",
+    odt: "application/vnd.oasis.opendocument.text",
+    zip: "application/zip",
+};
+/** Hoisted - extensionOf runs on every save. */
+const ALPHANUMERIC = /^[a-z0-9]+$/;
+/**
+ * Lowercased extension of a path, or a sentinel.
+ *
+ * Not `split(".").pop()`, which returns the whole filename when there is no dot - shipping exactly
+ * what this exists to keep out.
+ */
+function extensionOf(path) {
+    var _a;
+    if (!path) {
+        return exports.EXTENSION_EXTRACTION_FAILED;
+    }
+    // A staging directory can carry dots, so the basename is isolated before looking for one
+    const name = (_a = path.split("/").pop()) !== null && _a !== void 0 ? _a : "";
+    if (name.length === 0) {
+        return exports.EXTENSION_EXTRACTION_FAILED;
+    }
+    const dot = name.lastIndexOf(".");
+    // `dot === 0` is a dotfile (`.bank_statement`), not an extension
+    if (dot <= 0 || dot === name.length - 1) {
+        return exports.EXTENSION_NONE;
+    }
+    /**
+     * Rejected, not stripped. Stripping separators first let a 15-character filename tail collapse
+     * into a plausible 8-character extension (`aadhaar.9876-5432` -> `98765432`), which is filename
+     * content on a KYC upload. A real extension has no separators to remove.
+     */
+    const raw = name.slice(dot + 1).toLowerCase();
+    if (raw.length === 0 || raw.length > MAX_EXTENSION_LENGTH || !ALPHANUMERIC.test(raw)) {
+        return exports.EXTENSION_EXTRACTION_FAILED;
+    }
+    return raw in KNOWN_EXTENSIONS ? raw : exports.EXTENSION_UNKNOWN;
+}
+/**
+ * The MIME type to declare for a file, from the extension extensionOf resolved.
+ *
+ * Falls back to the generic type for every sentinel: an unrecognised extension is exactly the case
+ * where a guess would be wrong, and Android will still let the user save with a generic type.
+ */
+function mimeTypeFor(fileExtension) {
+    var _a;
+    return (_a = KNOWN_EXTENSIONS[fileExtension]) !== null && _a !== void 0 ? _a : "application/octet-stream";
+}
+/**
+ * Normalises a raw HTML `accept` attribute for telemetry.
+ *
+ * The injected JS reads the attribute verbatim (`".pdf, .jpeg"`) where a native layer may hand over
+ * an already-parsed list (`".pdf,.jpeg"`), so without this the request event and anything reported
+ * later for the same click will not join on it.
+ *
+ * Never used to decide what may be picked - the bank owns that.
+ */
+function normalizeAcceptTypes(acceptTypes) {
+    if (!acceptTypes || acceptTypes.trim().length === 0) {
+        return undefined;
+    }
+    const parts = acceptTypes
+        .toLowerCase()
+        .split(",")
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0)
+        .sort();
+    return parts.length === 0 ? undefined : parts.join(",");
+}

package/lib/utils/use-sdk-session.d.ts

@@ -0,0 +1,12 @@
+/** Binds one checkout attempt's telemetry context for as long as the component is mounted */
+/**
+ * Mints a session id and binds a checkout-status getter, both for the mounted lifetime.
+ *
+ * Deliberately a hook rather than something `start()` calls, so a merchant who retries produces two
+ * `start_attempted` events inside one session instead of two unrelated sessions.
+ *
+ * The status getter is held in a ref and re-read on every event, so a status that changes mid-session
+ * reaches later events without anything re-binding.
+ */
+export declare function useSdkSession(readStatus: () => string): void;
+//# sourceMappingURL=use-sdk-session.d.ts.map

package/lib/utils/use-sdk-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-sdk-session.d.ts","sourceRoot":"","sources":["../../src/utils/use-sdk-session.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAS7F;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAsB5D"}

package/lib/utils/use-sdk-session.js

@@ -0,0 +1,37 @@
+"use strict";
+/** Binds one checkout attempt's telemetry context for as long as the component is mounted */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useSdkSession = useSdkSession;
+const react_1 = require("react");
+const analytics_1 = require("./analytics");
+/** Distinguishes two mounts in the same process without reaching for a uuid dependency */
+let mountCounter = 0;
+/**
+ * Mints a session id and binds a checkout-status getter, both for the mounted lifetime.
+ *
+ * Deliberately a hook rather than something `start()` calls, so a merchant who retries produces two
+ * `start_attempted` events inside one session instead of two unrelated sessions.
+ *
+ * The status getter is held in a ref and re-read on every event, so a status that changes mid-session
+ * reaches later events without anything re-binding.
+ */
+function useSdkSession(readStatus) {
+    const readStatusRef = (0, react_1.useRef)(readStatus);
+    readStatusRef.current = readStatus;
+    (0, react_1.useEffect)(() => {
+        const sessionId = `sess-${Date.now().toString(36)}-${(++mountCounter).toString(36)}-${Math.random()
+            .toString(36)
+            .slice(2, 8)}`;
+        (0, analytics_1.setSdkSession)(sessionId);
+        (0, analytics_1.bindCheckoutStatus)(() => readStatusRef.current());
+        return () => {
+            /**
+             * Cleared rather than left dangling, so an event from an unmounted checkout carries
+             * neither - but only if this mount's session is still the active one. A merchant with
+             * two checkouts alive would otherwise have the one unmounting silence the one still
+             * taking a payment.
+             */
+            (0, analytics_1.releaseSdkSession)(sessionId);
+        };
+    }, []);
+}