@glomopay/react-native-sdk 4.1.0 → 5.0.0

package/lib/glomo-checkout.js

@@ -1,8 +1,13 @@
 "use strict";
 /**
- * The unified GlomoPay Checkout Component (v4).
+ * The unified GlomoPay Checkout Component.
  * Detects order type (LRS vs Standard) and delegates rendering to the appropriate inner component.
  * Enforces error handling via `onSdkError()` as a mandatory prop.
+ *
+ * Its props are a union over both flows, so a prop that only one flow uses is still accepted here.
+ * `onUserJourneyCompleted` is the one case where that matters: it is forwarded to the standard and
+ * subscriptions flows and silently ignored on LRS orders, because LRS never produces an
+ * asynchronous journey for it to report. Every other callback reaches every flow.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -45,6 +50,7 @@ const analytics_1 = require("./utils/analytics");
 const glomo_lrs_checkout_1 = require("./glomo-lrs-checkout");
 const glomo_standard_checkout_1 = require("./glomo-standard-checkout");
 const glomo_subscriptions_checkout_1 = require("./glomo-subscriptions-checkout");
+const validation_1 = require("./utils/validation");
 function GlomoCheckoutComponent(props, ref) {
     var _a;
     // useGlomoCheckout handles order type detection and exposes start/getStatus for the ref
@@ -57,7 +63,7 @@ function GlomoCheckoutComponent(props, ref) {
     // Tracking unsupported callback props on subscription flows (fires once per mount)
     const hasTrackedUnsupportedRef = (0, react_1.useRef)(false);
     const devMode = (_a = passedProps.devMode) !== null && _a !== void 0 ? _a : false;
-    const mockMode = (0, react_1.useMemo)(() => { var _a, _b; return (_b = (_a = passedProps.publicKey) === null || _a === void 0 ? void 0 : _a.toLowerCase().startsWith("test_")) !== null && _b !== void 0 ? _b : false; }, [passedProps.publicKey]);
+    const mockMode = (0, react_1.useMemo)(() => (0, validation_1.isMockModeKey)(passedProps.publicKey), [passedProps.publicKey]);
     // Extracting stable boolean for the tracking effect to avoid depending on passedProps object
     const hasUserJourneyCallback = !!passedProps.onUserJourneyCompleted;
     (0, react_1.useEffect)(() => {
@@ -70,15 +76,15 @@ function GlomoCheckoutComponent(props, ref) {
     }, [orderType, hasUserJourneyCallback, passedProps.subscriptionId, passedProps.publicKey, devMode, mockMode]);
     // Delegating to the LRS checkout component once order type is resolved as LRS
     if (orderType === "lrs") {
-        return (<glomo_lrs_checkout_1.GlomoLrsCheckout ref={innerLrsRef} server={passedProps.server} publicKey={passedProps.publicKey} orderId={passedProps.orderId} onPaymentSuccess={passedProps.onPaymentSuccess} onPaymentFailure={passedProps.onPaymentFailure} onConnectionError={passedProps.onConnectionError} onPaymentTerminate={passedProps.onPaymentTerminate} onSdkError={passedProps.onSdkError} devMode={passedProps.devMode} _testInjectionScript={props._testInjectionScript} _testCarouselInjectionScript={props._testCarouselInjectionScript} _onEducationCarouselStateChange={props._onEducationCarouselStateChange}/>);
+        return (<glomo_lrs_checkout_1.GlomoLrsCheckout ref={innerLrsRef} server={passedProps.server} publicKey={passedProps.publicKey} orderId={passedProps.orderId} onPaymentSuccess={passedProps.onPaymentSuccess} onPaymentFailure={passedProps.onPaymentFailure} onConnectionError={passedProps.onConnectionError} onPaymentTerminate={passedProps.onPaymentTerminate} onSdkError={passedProps.onSdkError} onUserRefusedDevicePermissions={passedProps.onUserRefusedDevicePermissions} devMode={passedProps.devMode} _testInjectionScript={props._testInjectionScript} _testCarouselInjectionScript={props._testCarouselInjectionScript} _onEducationCarouselStateChange={props._onEducationCarouselStateChange}/>);
     }
     // Delegating to the Standard checkout component once order type is resolved as Standard
     if (orderType === "standard") {
-        return (<glomo_standard_checkout_1.GlomoStandardCheckoutInternal ref={innerStandardRef} server={passedProps.server} publicKey={passedProps.publicKey} orderId={passedProps.orderId} onPaymentSuccess={passedProps.onPaymentSuccess} onPaymentFailure={passedProps.onPaymentFailure} onConnectionError={passedProps.onConnectionError} onPaymentTerminate={passedProps.onPaymentTerminate} onSdkError={passedProps.onSdkError} onUserJourneyCompleted={passedProps.onUserJourneyCompleted} onUserRefusedCameraPermissions={passedProps.onUserRefusedCameraPermissions} devMode={passedProps.devMode} _testInjectionScript={props._testInjectionScript}/>);
+        return (<glomo_standard_checkout_1.GlomoStandardCheckoutInternal ref={innerStandardRef} server={passedProps.server} publicKey={passedProps.publicKey} orderId={passedProps.orderId} onPaymentSuccess={passedProps.onPaymentSuccess} onPaymentFailure={passedProps.onPaymentFailure} onConnectionError={passedProps.onConnectionError} onPaymentTerminate={passedProps.onPaymentTerminate} onSdkError={passedProps.onSdkError} onUserJourneyCompleted={passedProps.onUserJourneyCompleted} onUserRefusedDevicePermissions={passedProps.onUserRefusedDevicePermissions} devMode={passedProps.devMode} _testInjectionScript={props._testInjectionScript}/>);
     }
     // Delegating to the Subscriptions checkout component when subscriptionId is provided (no API call)
     if (orderType === "subscriptions") {
-        return (<glomo_subscriptions_checkout_1.GlomoSubscriptionsCheckout ref={innerSubscriptionsRef} server={passedProps.server} publicKey={passedProps.publicKey} subscriptionId={passedProps.subscriptionId} onPaymentSuccess={passedProps.onPaymentSuccess} onPaymentFailure={passedProps.onPaymentFailure} onConnectionError={passedProps.onConnectionError} onPaymentTerminate={passedProps.onPaymentTerminate} onSdkError={passedProps.onSdkError} onUserJourneyCompleted={passedProps.onUserJourneyCompleted} onUserRefusedCameraPermissions={passedProps.onUserRefusedCameraPermissions} devMode={passedProps.devMode} _testInjectionScript={props._testInjectionScript}/>);
+        return (<glomo_subscriptions_checkout_1.GlomoSubscriptionsCheckout ref={innerSubscriptionsRef} server={passedProps.server} publicKey={passedProps.publicKey} subscriptionId={passedProps.subscriptionId} onPaymentSuccess={passedProps.onPaymentSuccess} onPaymentFailure={passedProps.onPaymentFailure} onConnectionError={passedProps.onConnectionError} onPaymentTerminate={passedProps.onPaymentTerminate} onSdkError={passedProps.onSdkError} onUserJourneyCompleted={passedProps.onUserJourneyCompleted} onUserRefusedDevicePermissions={passedProps.onUserRefusedDevicePermissions} devMode={passedProps.devMode} _testInjectionScript={props._testInjectionScript}/>);
     }
     /**
      * No modal for detecting state - avoids iOS pageSheet conflict where

package/lib/glomo-lrs-checkout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glomo-lrs-checkout.d.ts","sourceRoot":"","sources":["../src/glomo-lrs-checkout.tsx"],"names":[],"mappings":"AAAA,0CAA0C;AAE1C,OAAO,KAAmD,MAAM,OAAO,CAAC;AAIxE,OAAO,EAAkB,KAAK,qBAAqB,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IAC7C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,+BAA+B,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,iBAAiB,CAAC;CACtC;AA+WD,eAAO,MAAM,gBAAgB,mGAAoF,CAAC"}
+{"version":3,"file":"glomo-lrs-checkout.d.ts","sourceRoot":"","sources":["../src/glomo-lrs-checkout.tsx"],"names":[],"mappings":"AAAA,0CAA0C;AAE1C,OAAO,KAAmD,MAAM,OAAO,CAAC;AAIxE,OAAO,EAAkB,KAAK,qBAAqB,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAIlD,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IAC7C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,+BAA+B,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,iBAAiB,CAAC;CACtC;AAuXD,eAAO,MAAM,gBAAgB,mGAAoF,CAAC"}

package/lib/glomo-lrs-checkout.js

@@ -40,6 +40,7 @@ const react_native_1 = require("react-native");
 const react_native_webview_1 = require("react-native-webview");
 const use_lrs_checkout_1 = require("./use-lrs-checkout");
 const validation_1 = require("./utils/validation");
+const capability_props_1 = require("./webview/capability-props");
 /**
  * The Main GlomoPay LRS Checkout Component
  *
@@ -49,7 +50,8 @@ const validation_1 = require("./utils/validation");
  *
  * @param onPaymentSuccess - The success callback with payload, for a successful payment
  * @param onPaymentFailure - The failure callback with payload, for a failed payment
- * @param onPaymentTerminate - Optional callback called when the checkout is terminated either from the LRS webpage (back button or close button) or mobile component (user dismissing the modal on iOS or user pressing the back button on Android)
+ * @param onPaymentTerminate - Optional callback called when the checkout ends without a payment outcome. Receives a payload whose `source` is a TERMINATION_SOURCES value naming how it ended: the page's own close control, the Android back button/gesture, or an iOS swipe-down on the modal. The back chevron over a bank flow is deliberately not a termination - it returns the user to the checkout with the session intact.
+ * @param onUserRefusedDevicePermissions - Optional callback invoked when the user refuses a device permission the bank's page asked for - camera today. Upload-related permissions are requested by react-native-webview itself and do not reach this callback. Currently Android only: due to platform limitations on iOS, the WebView raises its own prompt and never reports the answer back, so this cannot fire there.
  *
  * @param onConnectionError - Optional callback for connection/network errors
  * @param onSdkError - Optional callback for handling SDK validation errors and configuration issues
@@ -59,17 +61,16 @@ const validation_1 = require("./utils/validation");
  *
  * @param visible - Advanced: If provided, the component visibility will be controlled by the visible prop. Otherwise, the component will be controlled internally by the SDK.
  */
-function GlomoLrsCheckoutComponent({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, devMode = false, visible: controlledVisible, _testInjectionScript, _testCarouselInjectionScript, _onEducationCarouselStateChange, }, ref) {
+function GlomoLrsCheckoutComponent({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, onUserRefusedDevicePermissions, devMode = false, visible: controlledVisible, _testInjectionScript, _testCarouselInjectionScript, _onEducationCarouselStateChange, }, ref) {
     // Computing mockMode based on the publicKey prefix
     const mockMode = (0, react_1.useMemo)(() => {
-        var _a;
-        const resolvedMockMode = (_a = publicKey === null || publicKey === void 0 ? void 0 : publicKey.toLowerCase().startsWith("test_")) !== null && _a !== void 0 ? _a : false;
+        const resolvedMockMode = (0, validation_1.isMockModeKey)(publicKey);
         if (devMode) {
             console.log(`[Glomo-RN-SDK LRS] ${resolvedMockMode ? "Using" : "Not using"} Mock mode for publicKey: ${publicKey}`);
         }
         return resolvedMockMode;
     }, [publicKey, devMode]);
-    const { start, status, showCheckout, flowWebViewUrl, showFlowWebView, educationCarouselUrl: resolvedEducationCarouselUrl, educationCarouselState, checkoutUrl, mainWebViewRef, flowWebViewRef, educationCarouselWebViewRef, handleMainWebViewMessage, handleFlowWebViewMessage, handleEducationCarouselWebViewMessage, handleError, handleHttpError, handleNavigationStateChange, handleModalBackButton, handleFlowBack, injectedMain, injectedFlow, injectedEducationCarousel, } = (0, use_lrs_checkout_1.useLrsCheckout)({
+    const { start, status, showCheckout, flowWebViewUrl, showFlowWebView, educationCarouselUrl: resolvedEducationCarouselUrl, educationCarouselState, checkoutUrl, mainWebViewRef, flowWebViewRef, educationCarouselWebViewRef, handleMainWebViewMessage, handleFlowWebViewMessage, handleEducationCarouselWebViewMessage, handleError, handleHttpError, handleNavigationStateChange, handleModalBackButton, handleFlowBack, handlePermissionRequest, injectedMain, injectedFlow, injectedEducationCarousel, } = (0, use_lrs_checkout_1.useLrsCheckout)({
         server,
         publicKey,
         orderId,
@@ -78,6 +79,7 @@ function GlomoLrsCheckoutComponent({ server, publicKey, orderId, onPaymentSucces
         onConnectionError,
         onPaymentTerminate,
         onSdkError,
+        onUserRefusedDevicePermissions,
         devMode,
     }, mockMode, { _testInjectionScript, _testCarouselInjectionScript, _onEducationCarouselStateChange });
     // Exposing the start() and getStatus() methods via the ref
@@ -129,11 +131,19 @@ function GlomoLrsCheckoutComponent({ server, publicKey, orderId, onPaymentSucces
      * textZoom=100 on Android normalises the system font-size setting so the carousel isn't affected.
      */
     const carouselWebViewProps = (0, react_1.useMemo)(() => ({
+        /**
+         * The carousel renders our own content, which never asks for a device permission.
+         * Capabilities are advertised only where something can exercise them, so it opts out
+         * of the handler the other two WebViews share.
+         */
+        onPermissionRequest: undefined,
         setSupportZoom: false,
         scalesPageToFit: false,
         overScrollMode: "never",
         textZoom: react_native_1.Platform.OS === "android" ? 100 : undefined,
     }), []);
+    // Configuration shared by every WebView the SDK renders, regardless of flow
+    const capabilityProps = (0, react_1.useMemo)(() => (0, capability_props_1.buildCapabilityProps)({ devMode, onPermissionRequest: handlePermissionRequest }), [devMode, handlePermissionRequest]);
     // Making the WebView component
     const makeWebView = react_1.default.useCallback((ref, url, messageHandler, identifier, injectedJavaScript, injectedJavaScriptBeforeContentLoaded, additionalProps) => {
         // Preventing a render if no injection script is provided
@@ -157,7 +167,7 @@ function GlomoLrsCheckoutComponent({ server, publicKey, orderId, onPaymentSucces
             }
             return null;
         }
-        return (<react_native_webview_1.WebView ref={ref} webviewDebuggingEnabled={__DEV__ && devMode} javaScriptEnabled={true} domStorageEnabled={true} onMessage={messageHandler} onError={handleError} onHttpError={handleHttpError} onNavigationStateChange={handleNavigationStateChange} onLoadStart={() => {
+        return (<react_native_webview_1.WebView {...capabilityProps} ref={ref} onMessage={messageHandler} onError={handleError} onHttpError={handleHttpError} onNavigationStateChange={handleNavigationStateChange} onLoadStart={() => {
                 if (devMode) {
                     console.log(`[Glomo-RN-SDK LRS] [${identifier}] WebView load started for ${url}`);
                 }
@@ -172,8 +182,15 @@ function GlomoLrsCheckoutComponent({ server, publicKey, orderId, onPaymentSucces
                 if (devMode && identifier === "educationCarousel") {
                     console.log(`[Glomo-RN-SDK LRS] [educationCarousel] load progress=${nativeEvent.progress} url=${nativeEvent.url}`);
                 }
-            }} source={{ uri: url }} javaScriptCanOpenWindowsAutomatically={true} setSupportMultipleWindows={true} incognito={true} cacheEnabled={false} cacheMode='LOAD_NO_CACHE' pullToRefreshEnabled={false} limitsNavigationsToAppBoundDomains={false} menuItems={[]} injectedJavaScript={injectedJavaScript} injectedJavaScriptBeforeContentLoaded={injectedJavaScriptBeforeContentLoaded} style={styles.webview} showsHorizontalScrollIndicator={false} showsVerticalScrollIndicator={false} mixedContentMode='always' thirdPartyCookiesEnabled={true} sharedCookiesEnabled={true} allowsInlineMediaPlayback={true} mediaPlaybackRequiresUserAction={false} {...additionalProps}/>);
-    }, [handleError, handleHttpError, handleNavigationStateChange, devMode, carouselViewportGuardScript]);
+            }} source={{ uri: url }} injectedJavaScript={injectedJavaScript} injectedJavaScriptBeforeContentLoaded={injectedJavaScriptBeforeContentLoaded} style={styles.webview} {...additionalProps}/>);
+    }, [
+        handleError,
+        handleHttpError,
+        handleNavigationStateChange,
+        devMode,
+        carouselViewportGuardScript,
+        capabilityProps,
+    ]);
     const MainWebViewComponent = (0, react_1.useMemo)(() => makeWebView(mainWebViewRef, checkoutUrl, handleMainWebViewMessage, "main", injectedMain), [makeWebView, checkoutUrl, handleMainWebViewMessage, injectedMain, mainWebViewRef]);
     const FlowWebViewComponent = (0, react_1.useMemo)(() => flowWebViewUrl
         ? makeWebView(flowWebViewRef, flowWebViewUrl, handleFlowWebViewMessage, "flow", injectedFlow)
@@ -218,7 +235,7 @@ function GlomoLrsCheckoutComponent({ server, publicKey, orderId, onPaymentSucces
 
                 {shouldRenderFlowOverlay && (<react_native_1.View style={styles.flowWebViewContainer}>
                         <react_native_1.SafeAreaView style={styles.flowHeader}>
-                            <react_native_1.TouchableOpacity onPress={handleFlowBack} style={styles.flowBackButton}>
+                            <react_native_1.TouchableOpacity onPress={handleFlowBack} style={styles.flowBackButton} accessibilityRole='button' accessibilityLabel='Go back to checkout'>
                                 <react_native_1.Text style={styles.flowBackChevron}>‹</react_native_1.Text>
                             </react_native_1.TouchableOpacity>
                         </react_native_1.SafeAreaView>
@@ -273,8 +290,14 @@ const styles = react_native_1.StyleSheet.create({
         borderBottomColor: "#e0e0e0",
     },
     flowBackButton: {
-        paddingVertical: 0,
+        /**
+         * Sized to the 44dp / 44pt minimum touch target both platforms specify. The glyph alone is
+         * 42px tall and the hit area used to hug it horizontally, which is the only SDK-drawn
+         * control in this package and the one a user reaches mid-payment.
+         */
+        paddingVertical: 6,
         paddingLeft: 20,
+        paddingRight: 20,
     },
     flowBackChevron: {
         fontSize: 42,

package/lib/glomo-standard-checkout.d.ts

@@ -1,7 +1,7 @@
 /** The GlomoPay Standard Checkout Component */
 import React from "react";
 import { type GlomoStandardCheckoutRef, type GlomoStandardCheckoutProps } from "./types/standard-checkout";
-import { type CheckoutAnalyticsTrackers } from "./utils/analytics";
+import { type CheckoutAnalyticsTrackers, type FlowType } from "./utils/analytics";
 /**
  * Internal-only props for GlomoStandardCheckout.
  * Used by GlomoSubscriptionsCheckout to inject subscription analytics trackers.
@@ -9,6 +9,8 @@ import { type CheckoutAnalyticsTrackers } from "./utils/analytics";
  */
 export interface GlomoStandardCheckoutInternalProps extends GlomoStandardCheckoutProps {
     _analyticsTrackers?: CheckoutAnalyticsTrackers;
+    /** Names the flow for telemetry the tracker map does not cover - see UseStandardCheckoutInternalOptions */
+    _flowType?: FlowType;
     _skipOrderIdValidation?: boolean;
     _testInjectionScript?: string;
 }

package/lib/glomo-standard-checkout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glomo-standard-checkout.d.ts","sourceRoot":"","sources":["../src/glomo-standard-checkout.tsx"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,OAAO,KAAmD,MAAM,OAAO,CAAC;AAKxE,OAAO,EAAE,KAAK,wBAAwB,EAAE,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAGnE;;;;GAIG;AACH,MAAM,WAAW,kCAAmC,SAAQ,0BAA0B;IAClF,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IAC/C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACjC;AAgQD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAiD,KAAK,CAAC,yBAAyB,CAC9G,0BAA0B,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAC7E,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,qHAEzC,CAAC"}
+{"version":3,"file":"glomo-standard-checkout.d.ts","sourceRoot":"","sources":["../src/glomo-standard-checkout.tsx"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,OAAO,KAAmD,MAAM,OAAO,CAAC;AAKxE,OAAO,EAAE,KAAK,wBAAwB,EAAE,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EAAE,KAAK,yBAAyB,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAIlF;;;;GAIG;AACH,MAAM,WAAW,kCAAmC,SAAQ,0BAA0B;IAClF,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IAE/C,2GAA2G;IAC3G,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACjC;AAmPD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAiD,KAAK,CAAC,yBAAyB,CAC9G,0BAA0B,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAC7E,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,qHAEzC,CAAC"}

package/lib/glomo-standard-checkout.js

@@ -40,6 +40,7 @@ const react_native_1 = require("react-native");
 const react_native_webview_1 = require("react-native-webview");
 const use_standard_checkout_1 = require("./use-standard-checkout");
 const validation_1 = require("./utils/validation");
+const capability_props_1 = require("./webview/capability-props");
 /**
  * The Main GlomoPay Standard Checkout Component
  *
@@ -49,7 +50,9 @@ const validation_1 = require("./utils/validation");
  *
  * @param onPaymentSuccess - The success callback with payload, for a successful payment
  * @param onPaymentFailure - The failure callback with payload, for a failed payment
- * @param onPaymentTerminate - Optional callback called when the checkout is terminated either from the webpage (back button or close button) or mobile component (user dismissing the modal on iOS or user pressing the back button on Android)
+ * @param onUserJourneyCompleted - Optional callback for asynchronous payment journeys - bank transfers and pay via bank. Carries the journey type and the transfer details the page reported, not a confirmed payment. LRS/Cards flows will never trigger this.
+ * @param onPaymentTerminate - Optional callback called when the checkout ends without a payment outcome. Receives a payload whose `source` is a TERMINATION_SOURCES value naming how it ended: the page's own close control, the Android back button/gesture, or an iOS swipe-down on the modal. The back chevron over a bank flow is deliberately not a termination - it returns the user to the checkout with the session intact.
+ * @param onUserRefusedDevicePermissions - Optional callback invoked when the user refuses a device permission the bank's page asked for - camera today. Upload-related permissions are requested by react-native-webview itself and do not reach this callback. Currently Android only: due to platform limitations on iOS, the WebView raises its own prompt and never reports the answer back, so this cannot fire there.
  *
  * @param onConnectionError - Optional callback for connection/network errors
  * @param onSdkError - Optional callback for handling SDK validation errors and configuration issues
@@ -57,11 +60,10 @@ const validation_1 = require("./utils/validation");
  * @param ref - The ref for the component
  * @param devMode - Turn on to see all logs, warnings, and errors in the console. Off by default
  */
-function GlomoStandardCheckoutComponent({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, onUserJourneyCompleted, onUserRefusedCameraPermissions, devMode = false, _analyticsTrackers, _skipOrderIdValidation, _testInjectionScript, }, ref) {
+function GlomoStandardCheckoutComponent({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, onUserJourneyCompleted, onUserRefusedDevicePermissions, devMode = false, _analyticsTrackers, _flowType, _skipOrderIdValidation, _testInjectionScript, }, ref) {
     // Computing mockMode based on the publicKey prefix
     const mockMode = (0, react_1.useMemo)(() => {
-        var _a;
-        const resolvedMockMode = (_a = publicKey === null || publicKey === void 0 ? void 0 : publicKey.toLowerCase().startsWith("test_")) !== null && _a !== void 0 ? _a : false;
+        const resolvedMockMode = (0, validation_1.isMockModeKey)(publicKey);
         if (devMode) {
             console.log(`[Glomo-RN-SDK Standard] ${resolvedMockMode ? "Using" : "Not using"} Mock mode for publicKey: ${publicKey}`);
         }
@@ -77,14 +79,16 @@ function GlomoStandardCheckoutComponent({ server, publicKey, orderId, onPaymentS
         onPaymentTerminate,
         onSdkError,
         onUserJourneyCompleted,
-        onUserRefusedCameraPermissions,
+        onUserRefusedDevicePermissions,
         devMode,
-    }, mockMode, { analyticsTrackers: _analyticsTrackers, _skipOrderIdValidation, _testInjectionScript });
+    }, mockMode, { analyticsTrackers: _analyticsTrackers, flowType: _flowType, _skipOrderIdValidation, _testInjectionScript });
     // Exposing the start() and getStatus() methods via the ref
     (0, react_1.useImperativeHandle)(ref, () => ({
         start,
         getStatus: () => status,
     }));
+    // Configuration shared by every WebView the SDK renders, regardless of flow
+    const capabilityProps = (0, react_1.useMemo)(() => (0, capability_props_1.buildCapabilityProps)({ devMode, onPermissionRequest: handlePermissionRequest }), [devMode, handlePermissionRequest]);
     // Making the WebView component
     const makeWebView = react_1.default.useCallback((ref, url, messageHandler, identifier, injectedJavaScript, injectedJavaScriptBeforeContentLoaded, additionalProps) => {
         // Preventing a render if no injection script is provided
@@ -108,7 +112,7 @@ function GlomoStandardCheckoutComponent({ server, publicKey, orderId, onPaymentS
             }
             return null;
         }
-        return (<react_native_webview_1.WebView ref={ref} webviewDebuggingEnabled={__DEV__ && devMode} javaScriptEnabled={true} domStorageEnabled={true} onMessage={messageHandler} onError={handleError} onHttpError={handleHttpError} onNavigationStateChange={handleNavigationStateChange} onLoadStart={() => {
+        return (<react_native_webview_1.WebView {...capabilityProps} ref={ref} onMessage={messageHandler} onError={handleError} onHttpError={handleHttpError} onNavigationStateChange={handleNavigationStateChange} onLoadStart={() => {
                 if (devMode) {
                     console.log(`[Glomo-RN-SDK Standard] [${identifier}] WebView load started for ${url}`);
                 }
@@ -116,10 +120,8 @@ function GlomoStandardCheckoutComponent({ server, publicKey, orderId, onPaymentS
                 if (devMode) {
                     console.log(`[Glomo-RN-SDK Standard] [${identifier}] WebView load ended for ${url}`);
                 }
-            }} source={{ uri: url }} javaScriptCanOpenWindowsAutomatically={true} setSupportMultipleWindows={true} incognito={true} cacheEnabled={false} cacheMode='LOAD_NO_CACHE' pullToRefreshEnabled={false} limitsNavigationsToAppBoundDomains={false} menuItems={[]} injectedJavaScript={injectedJavaScript} injectedJavaScriptBeforeContentLoaded={injectedJavaScriptBeforeContentLoaded} style={styles.webview} showsHorizontalScrollIndicator={false} showsVerticalScrollIndicator={false} mixedContentMode='always' thirdPartyCookiesEnabled={true} sharedCookiesEnabled={true} allowsInlineMediaPlayback={true} mediaPlaybackRequiresUserAction={false} mediaCapturePermissionGrantType='prompt' allowFileAccess={true} allowUniversalAccessFromFileURLs={true} allowFileAccessFromFileURLs={true} androidLayerType='hardware' 
-        // @ts-expect-error onPermissionRequest is an Android-only WebView prop not yet in react-native-webview type definitions
-        onPermissionRequest={handlePermissionRequest} {...additionalProps}/>);
-    }, [handleError, handleHttpError, handleNavigationStateChange, handlePermissionRequest, devMode]);
+            }} source={{ uri: url }} injectedJavaScript={injectedJavaScript} injectedJavaScriptBeforeContentLoaded={injectedJavaScriptBeforeContentLoaded} style={styles.webview} {...additionalProps}/>);
+    }, [handleError, handleHttpError, handleNavigationStateChange, capabilityProps, devMode]);
     const MainWebViewComponent = (0, react_1.useMemo)(() => makeWebView(mainWebViewRef, checkoutUrl, handleMainWebViewMessage, "main", injectedMain), [makeWebView, checkoutUrl, handleMainWebViewMessage, injectedMain, mainWebViewRef]);
     const FlowWebViewComponent = (0, react_1.useMemo)(() => flowWebViewUrl
         ? makeWebView(flowWebViewRef, flowWebViewUrl, handleFlowWebViewMessage, "flow", injectedFlow)
@@ -149,7 +151,7 @@ function GlomoStandardCheckoutComponent({ server, publicKey, orderId, onPaymentS
 
                 {shouldRenderFlowOverlay && (<react_native_1.View style={styles.flowWebViewContainer}>
                         <react_native_1.SafeAreaView style={styles.flowHeader}>
-                            <react_native_1.TouchableOpacity onPress={handleFlowBack} style={styles.flowBackButton}>
+                            <react_native_1.TouchableOpacity onPress={handleFlowBack} style={styles.flowBackButton} accessibilityRole='button' accessibilityLabel='Go back to checkout'>
                                 <react_native_1.Text style={styles.flowBackChevron}>{"\u2039"}</react_native_1.Text>
                             </react_native_1.TouchableOpacity>
                         </react_native_1.SafeAreaView>
@@ -200,8 +202,14 @@ const styles = react_native_1.StyleSheet.create({
         borderBottomColor: "#e0e0e0",
     },
     flowBackButton: {
-        paddingVertical: 0,
+        /**
+         * Sized to the 44dp / 44pt minimum touch target both platforms specify. The glyph alone is
+         * 42px tall and the hit area used to hug it horizontally, which is the only SDK-drawn
+         * control in this package and the one a user reaches mid-payment.
+         */
+        paddingVertical: 6,
         paddingLeft: 20,
+        paddingRight: 20,
     },
     flowBackChevron: {
         fontSize: 42,

package/lib/glomo-subscriptions-checkout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glomo-subscriptions-checkout.d.ts","sourceRoot":"","sources":["../src/glomo-subscriptions-checkout.tsx"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAA6D,MAAM,OAAO,CAAC;AAIlF,OAAO,EACH,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EACrC,MAAM,gCAAgC,CAAC;AAkExC,eAAO,MAAM,0BAA0B,uHAEtC,CAAC"}
+{"version":3,"file":"glomo-subscriptions-checkout.d.ts","sourceRoot":"","sources":["../src/glomo-subscriptions-checkout.tsx"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAA6D,MAAM,OAAO,CAAC;AAIlF,OAAO,EACH,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EACrC,MAAM,gCAAgC,CAAC;AAmExC,eAAO,MAAM,0BAA0B,uHAEtC,CAAC"}

package/lib/glomo-subscriptions-checkout.js

@@ -79,7 +79,7 @@ function GlomoSubscriptionsCheckoutComponent(props, ref) {
     if (validationError) {
         return null;
     }
-    return (<glomo_standard_checkout_1.GlomoStandardCheckoutInternal ref={innerRef} {...rest} orderId={subscriptionId} onSdkError={onSdkError} devMode={devMode} _analyticsTrackers={analytics_1.subscriptionCheckoutTrackers} _skipOrderIdValidation={true}/>);
+    return (<glomo_standard_checkout_1.GlomoStandardCheckoutInternal ref={innerRef} {...rest} orderId={subscriptionId} onSdkError={onSdkError} devMode={devMode} _analyticsTrackers={analytics_1.subscriptionCheckoutTrackers} _flowType='subscriptions' _skipOrderIdValidation={true}/>);
 }
 exports.GlomoSubscriptionsCheckout = (0, react_1.forwardRef)(GlomoSubscriptionsCheckoutComponent);
 exports.GlomoSubscriptionsCheckout.displayName = "GlomoSubscriptionsCheckout";

package/lib/index.d.ts

@@ -1,6 +1,6 @@
-/** The GlomoPay RN SDK v4 exports */
+/** The GlomoPay RN SDK v5 exports */
 export { GlomoCheckout } from "./glomo-checkout";
-export { type GlomoCheckoutRef, type GlomoCheckoutProps, type GlomoCheckoutPayload, type CheckoutStatus, type GlomoUserJourneyCompletedPayload, ASYNC_PAYMENT_EVENTS, } from "./types/checkout";
+export { type GlomoCheckoutRef, type GlomoCheckoutProps, type GlomoCheckoutPayload, type CheckoutStatus, type GlomoUserJourneyCompletedPayload, type GlomoTerminationPayload, ASYNC_PAYMENT_EVENTS, TERMINATION_SOURCES, } from "./types/checkout";
 export { type GlomoServer } from "./config/base";
 export { type SdkError } from "./utils/analytics";
 export { useGlomoCheckout, type UseGlomoCheckoutReturn } from "./use-glomo-checkout";

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACH,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,gCAAgC,EACrC,oBAAoB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACH,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAC5B,oBAAoB,EACpB,mBAAmB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC"}

package/lib/index.js

@@ -1,11 +1,12 @@
 "use strict";
-/** The GlomoPay RN SDK v4 exports */
+/** The GlomoPay RN SDK v5 exports */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.useGlomoCheckout = exports.ASYNC_PAYMENT_EVENTS = exports.GlomoCheckout = void 0;
-// v4 public API - unified checkout
+exports.useGlomoCheckout = exports.TERMINATION_SOURCES = exports.ASYNC_PAYMENT_EVENTS = exports.GlomoCheckout = void 0;
+// v5 public API - unified checkout
 var glomo_checkout_1 = require("./glomo-checkout");
 Object.defineProperty(exports, "GlomoCheckout", { enumerable: true, get: function () { return glomo_checkout_1.GlomoCheckout; } });
 var checkout_1 = require("./types/checkout");
 Object.defineProperty(exports, "ASYNC_PAYMENT_EVENTS", { enumerable: true, get: function () { return checkout_1.ASYNC_PAYMENT_EVENTS; } });
+Object.defineProperty(exports, "TERMINATION_SOURCES", { enumerable: true, get: function () { return checkout_1.TERMINATION_SOURCES; } });
 var use_glomo_checkout_1 = require("./use-glomo-checkout");
 Object.defineProperty(exports, "useGlomoCheckout", { enumerable: true, get: function () { return use_glomo_checkout_1.useGlomoCheckout; } });

package/lib/injections/index.d.ts

@@ -1,3 +1,27 @@
+/**
+ * Publishes what this SDK build can handle, for the checkout page to gate on.
+ *
+ * Appends rather than assigns, and de-duplicates, because the array is shared with anything else
+ * that writes to it. The page reads it at the moment it needs a capability rather than snapshotting
+ * it at load, so a script that runs after the page has mounted still takes effect.
+ *
+ * Returns an empty string when there is nothing to advertise - the page treats a missing array and
+ * an empty one the same way, so there is no reason to inject the assignment.
+ */
+export declare function buildCapabilityAdvertisement(capabilities: string[]): string;
+/**
+ * The scripts injected into each WebView, for a build with the given capabilities.
+ *
+ * Capabilities are advertised on the WebViews that load a checkout or a bank page, and not on the
+ * education carousel - that renders our own content, which has nothing to gate. Advertising a
+ * capability where nothing can exercise it is noise on a contract the page reads.
+ */
+export declare function buildInjectionScripts(capabilities: string[]): {
+    main: string;
+    flow: string;
+    standard: string;
+    educationCarousel: string;
+};
 export declare const InjectionScripts: {
     main: string;
     flow: string;

package/lib/injections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/injections/index.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gBAAgB;;;;;CAK5B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/injections/index.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAa3E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE;;;;;EAS3D;AAED,eAAO,MAAM,gBAAgB;;;;;CAK5B,CAAC"}

package/lib/injections/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InjectionScripts = void 0;
+exports.buildCapabilityAdvertisement = buildCapabilityAdvertisement;
+exports.buildInjectionScripts = buildInjectionScripts;
 /**
  * Injection scripts for WebView bridging
  */
@@ -8,6 +10,45 @@ const webview_main_injection_1 = require("./webview-main.injection");
 const webview_flow_injection_1 = require("./webview-flow.injection");
 const webview_education_carousel_injection_1 = require("./webview-education-carousel.injection");
 const webview_standard_injection_1 = require("./webview-standard.injection");
+/**
+ * Publishes what this SDK build can handle, for the checkout page to gate on.
+ *
+ * Appends rather than assigns, and de-duplicates, because the array is shared with anything else
+ * that writes to it. The page reads it at the moment it needs a capability rather than snapshotting
+ * it at load, so a script that runs after the page has mounted still takes effect.
+ *
+ * Returns an empty string when there is nothing to advertise - the page treats a missing array and
+ * an empty one the same way, so there is no reason to inject the assignment.
+ */
+function buildCapabilityAdvertisement(capabilities) {
+    if (capabilities.length === 0) {
+        return "";
+    }
+    return `
+    (function() {
+      window.__glomoSdkCapabilities__ = (window.__glomoSdkCapabilities__ || [])
+        .concat(${JSON.stringify(capabilities)})
+        .filter(function(cap, i, all) { return all.indexOf(cap) === i; });
+    })();
+    true;
+  `;
+}
+/**
+ * The scripts injected into each WebView, for a build with the given capabilities.
+ *
+ * Capabilities are advertised on the WebViews that load a checkout or a bank page, and not on the
+ * education carousel - that renders our own content, which has nothing to gate. Advertising a
+ * capability where nothing can exercise it is noise on a contract the page reads.
+ */
+function buildInjectionScripts(capabilities) {
+    const advertisement = buildCapabilityAdvertisement(capabilities);
+    return {
+        main: webview_main_injection_1.injectedScript + advertisement,
+        flow: webview_flow_injection_1.injectedScript + advertisement,
+        standard: webview_standard_injection_1.injectedScript + advertisement,
+        educationCarousel: webview_education_carousel_injection_1.injectedScript,
+    };
+}
 exports.InjectionScripts = {
     main: webview_main_injection_1.injectedScript,
     flow: webview_flow_injection_1.injectedScript,

package/lib/injections/webview-flow.injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webview-flow.injection.d.ts","sourceRoot":"","sources":["../../src/injections/webview-flow.injection.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAE,MAiN5B,CAAC"}
+{"version":3,"file":"webview-flow.injection.d.ts","sourceRoot":"","sources":["../../src/injections/webview-flow.injection.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAE,MA6R5B,CAAC"}

package/lib/injections/webview-flow.injection.js

@@ -206,6 +206,82 @@ exports.injectedScript = `
         });
       });
 
+
+      /**
+       * File-input click detection.
+       *
+       * Does not open the picker - react-native-webview does that natively through
+       * onShowFileChooser, and the SDK never sees the rest of it. This carries the only record
+       * that an upload was attempted, and on iOS it is the only file signal at all, since
+       * WKWebView runs its own picker and reports nothing back.
+       *
+       * Capture phase, so a page that stops propagation on its own handler cannot silence it.
+       *
+       * Posts the shape of the input and nothing that identifies it. The id and name of a KYC
+       * upload control are third-party identity, and unconsumed page data sitting on the bridge is
+       * how identity ends up spread into a tracker by someone who never read this.
+       */
+      document.addEventListener('click', function(event) {
+        try {
+          const target = event.target;
+          if (!target || target.tagName !== 'INPUT' || target.type !== 'file') {
+            return;
+          }
+          safePostMessage({
+            type: 'file.input',
+            accept: target.getAttribute('accept') || '',
+            hasCapture: target.hasAttribute('capture')
+          });
+        } catch (error) {
+          // Never let this break a bank's own upload handling
+        }
+      }, true);
+
+
+      /**
+       * getUserMedia observation.
+       *
+       * Telemetry only, and it must stay that way. A rejection with NotAllowedError IS the user
+       * denying camera access - an observation, not an inference - and on iOS it is the only one
+       * available, because WKWebView raises its own prompt and never reports the answer back.
+       *
+       * It deliberately does NOT drive onUserRefusedDevicePermissions. Coverage depends on whether
+       * a given bank uses getUserMedia or a capture-enabled file input, which is third-party
+       * markup we do not control and are not told about when it changes. A callback that fires for
+       * some banks would leave a merchant unable to tell "the user did not deny" from "this bank's
+       * flow is not observable". Silence is unambiguous; partial coverage is not.
+       *
+       * Wrapped thinly and never allowed to throw: this runs inside a bank's page, and a fault in
+       * our handler must not be able to break their capture flow.
+       */
+      (function() {
+        try {
+          const media = navigator.mediaDevices;
+          if (!media || typeof media.getUserMedia !== 'function') {
+            return;
+          }
+          const originalGetUserMedia = media.getUserMedia.bind(media);
+          media.getUserMedia = function(constraints) {
+            return originalGetUserMedia(constraints).catch(function(error) {
+              try {
+                if (error && error.name === 'NotAllowedError') {
+                  safePostMessage({
+                    type: 'permission.denied',
+                    resource: (constraints && constraints.video) ? 'camera' : 'microphone',
+                    errorName: error.name
+                  });
+                }
+              } catch (reportingError) {
+                // Reporting must never change what the page sees
+              }
+              throw error;
+            });
+          };
+        } catch (error) {
+          // A page that has frozen navigator.mediaDevices keeps working, unobserved
+        }
+      })();
+
       // Logging that injection is complete
       console.log(LOG_PREFIX + 'GlomoPay WebView JavaScript injection complete');
 

package/lib/injections/webview-main.injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webview-main.injection.d.ts","sourceRoot":"","sources":["../../src/injections/webview-main.injection.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,eAAO,MAAM,cAAc,EAAE,MAuN5B,CAAC"}
+{"version":3,"file":"webview-main.injection.d.ts","sourceRoot":"","sources":["../../src/injections/webview-main.injection.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,eAAO,MAAM,cAAc,EAAE,MAsP5B,CAAC"}

package/lib/injections/webview-main.injection.js

@@ -212,6 +212,37 @@ exports.injectedScript = `
         });
       });
 
+
+      /**
+       * File-input click detection.
+       *
+       * Does not open the picker - react-native-webview does that natively through
+       * onShowFileChooser, and the SDK never sees the rest of it. This carries the only record
+       * that an upload was attempted, and on iOS it is the only file signal at all, since
+       * WKWebView runs its own picker and reports nothing back.
+       *
+       * Capture phase, so a page that stops propagation on its own handler cannot silence it.
+       *
+       * Posts the shape of the input and nothing that identifies it. The id and name of a KYC
+       * upload control are third-party identity, and unconsumed page data sitting on the bridge is
+       * how identity ends up spread into a tracker by someone who never read this.
+       */
+      document.addEventListener('click', function(event) {
+        try {
+          const target = event.target;
+          if (!target || target.tagName !== 'INPUT' || target.type !== 'file') {
+            return;
+          }
+          safePostMessage({
+            type: 'file.input',
+            accept: target.getAttribute('accept') || '',
+            hasCapture: target.hasAttribute('capture')
+          });
+        } catch (error) {
+          // Never let this break a bank's own upload handling
+        }
+      }, true);
+
       // Logging that injection is complete
       console.log(LOG_PREFIX + 'GlomoPay WebView JavaScript injection complete');
 

package/lib/injections/webview-standard.injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webview-standard.injection.d.ts","sourceRoot":"","sources":["../../src/injections/webview-standard.injection.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,eAAO,MAAM,cAAc,EAAE,MAiN5B,CAAC"}
+{"version":3,"file":"webview-standard.injection.d.ts","sourceRoot":"","sources":["../../src/injections/webview-standard.injection.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,eAAO,MAAM,cAAc,EAAE,MAgP5B,CAAC"}

package/lib/injections/webview-standard.injection.js

@@ -206,6 +206,37 @@ exports.injectedScript = `
         });
       });
 
+
+      /**
+       * File-input click detection.
+       *
+       * Does not open the picker - react-native-webview does that natively through
+       * onShowFileChooser, and the SDK never sees the rest of it. This carries the only record
+       * that an upload was attempted, and on iOS it is the only file signal at all, since
+       * WKWebView runs its own picker and reports nothing back.
+       *
+       * Capture phase, so a page that stops propagation on its own handler cannot silence it.
+       *
+       * Posts the shape of the input and nothing that identifies it. The id and name of a KYC
+       * upload control are third-party identity, and unconsumed page data sitting on the bridge is
+       * how identity ends up spread into a tracker by someone who never read this.
+       */
+      document.addEventListener('click', function(event) {
+        try {
+          const target = event.target;
+          if (!target || target.tagName !== 'INPUT' || target.type !== 'file') {
+            return;
+          }
+          safePostMessage({
+            type: 'file.input',
+            accept: target.getAttribute('accept') || '',
+            hasCapture: target.hasAttribute('capture')
+          });
+        } catch (error) {
+          // Never let this break a bank's own upload handling
+        }
+      }, true);
+
       // Logging that injection is complete
       console.log(LOG_PREFIX + 'GlomoPay WebView JavaScript injection complete');