@glomopay/react-native-sdk 4.1.0 → 5.0.0

package/lib/use-lrs-checkout.js

@@ -8,9 +8,21 @@ const index_1 = require("./injections/index");
 const segment_1 = require("./config/segment");
 const base_1 = require("./config/base");
 const validation_1 = require("./utils/validation");
+const payment_payload_1 = require("./bridge/payment-payload");
+const event_projections_1 = require("./utils/event-projections");
 const device_compliance_1 = require("./utils/device-compliance");
+const use_permission_request_1 = require("./webview/use-permission-request");
+const message_router_1 = require("./bridge/message-router");
+const file_save_handler_1 = require("./bridge/file-save-handler");
+const file_input_handler_1 = require("./bridge/file-input-handler");
+const index_2 = require("./capabilities/index");
+const use_capability_reporting_1 = require("./capabilities/use-capability-reporting");
+const use_sdk_session_1 = require("./utils/use-sdk-session");
 const analytics_1 = require("./utils/analytics");
-function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, devMode = false, }, mockMode, internalOptions) {
+const checkout_1 = require("./types/checkout");
+/** Log prefix for everything this flow emits */
+const LOG_PREFIX = "[Glomo-RN-SDK LRS]";
+function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymentFailure, onConnectionError, onPaymentTerminate, onSdkError, onUserRefusedDevicePermissions, devMode = false, }, mockMode, internalOptions) {
     // Refs for the WebViews
     const mainWebViewRef = (0, react_1.useRef)(null);
     const flowWebViewRef = (0, react_1.useRef)(null);
@@ -27,7 +39,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
             // Building the query string manually since URLSearchParams is not fully supported in React Native
             const baseParams = [`orderId=${encodeURIComponent(orderId)}`];
             const mode = mockMode ? "mock" : "live";
-            const params = baseParams.concat(`mode=${encodeURIComponent(mode)}`, `publicKey=${encodeURIComponent(publicKey)}`);
+            const params = baseParams.concat(`mode=${encodeURIComponent(mode)}`, `publicKey=${encodeURIComponent(publicKey)}`, `product=${encodeURIComponent(base_1.ANALYTICS_PRODUCT)}`, `surface=${encodeURIComponent(base_1.ANALYTICS_SURFACE)}`);
             const queryString = params.join("&");
             // Handling base URL with or without existing query parameters
             const separator = baseCheckoutUrl.includes("?") ? "&" : "?";
@@ -60,7 +72,9 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
             const baseEducationCarouselUrl = serverConfig.baseUrl.lrsEducationCarousel;
             const separator = baseEducationCarouselUrl.includes("?") ? "&" : "?";
             const finalUrl = `${baseEducationCarouselUrl}${separator}orderId=${encodeURIComponent(orderId)}` +
-                `&publicKey=${encodeURIComponent(publicKey)}`;
+                `&publicKey=${encodeURIComponent(publicKey)}` +
+                `&product=${encodeURIComponent(base_1.ANALYTICS_PRODUCT)}` +
+                `&surface=${encodeURIComponent(base_1.ANALYTICS_SURFACE)}`;
             if (!(0, validation_1.isValidUrl)(finalUrl)) {
                 if (devMode) {
                     console.error("[Glomo-RN-SDK LRS] Generated invalid education carousel URL:", finalUrl);
@@ -167,35 +181,62 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
             }
         }
     }, [devMode]);
+    // Correlates every event from this mount, and keeps checkoutStatus current on all of them
+    (0, use_sdk_session_1.useSdkSession)(() => status);
+    // Missing optional dependencies reach the host here; start() warns on the console separately
+    (0, use_capability_reporting_1.useCapabilityReporting)({ onSdkError, devMode });
+    /**
+     * Handler for `file.input` - the user tapping a file input on a bank's page.
+     *
+     * Registered beside `file.save` on the same WebViews, for the same reason: uploads are not a
+     * property of one flow, and until now this message had no handler anywhere.
+     */
+    const fileInputHandler = (0, react_1.useMemo)(() => (0, file_input_handler_1.createFileInputHandler)({
+        flowType: "lrs",
+        orderId,
+        publicKey,
+        checkoutUrl,
+        mockMode,
+        devMode,
+    }), [orderId, publicKey, checkoutUrl, mockMode, devMode]);
+    /**
+     * Handler for `file.save` - the page asking the SDK to put a document on the device.
+     *
+     * One handler, registered on the main and flow WebViews both. Not on the education carousel:
+     * that renders our own content, which has nothing to gate, and the capability is not advertised
+     * there either.
+     */
+    const fileSaveHandler = (0, react_1.useMemo)(() => (0, file_save_handler_1.createFileSaveHandler)({
+        flowType: "lrs",
+        orderId,
+        publicKey,
+        checkoutUrl,
+        mockMode,
+        devMode,
+        onSdkError,
+    }), [orderId, publicKey, checkoutUrl, mockMode, devMode, onSdkError]);
     // Handler for the main WebView messages
-    const handleMainWebViewMessage = (0, react_1.useCallback)((event) => {
-        var _a;
-        try {
-            const data = (_a = event.nativeEvent) === null || _a === void 0 ? void 0 : _a.data;
-            if (!data || typeof data !== "string") {
+    const handleMainWebViewMessage = (0, react_1.useMemo)(() => (0, message_router_1.createMessageRouter)({
+        logPrefix: LOG_PREFIX,
+        source: "MainWebView",
+        devMode,
+        onInvalidMessage: (data) => {
+            (0, analytics_1.trackInvalidMessageReceived)("main", data, checkoutUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
+        },
+        handlers: {
+            "file.save": fileSaveHandler,
+            "file.input": fileInputHandler,
+            console: (message) => {
                 if (devMode) {
-                    console.warn("[Glomo-RN-SDK LRS] Invalid message data from MainWebView");
+                    const level = (typeof message.level === "string" && message.level) || "log";
+                    console.log(`${LOG_PREFIX} [WebView ${level.toUpperCase()}]`, message.message);
                 }
-                // Tracking invalid message received
-                (0, analytics_1.trackInvalidMessageReceived)("main", data, checkoutUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
-            const message = JSON.parse(data);
-            if (devMode) {
-                console.log("[Glomo-RN-SDK LRS] MainWebView Message received:", message.type, message);
-            }
-            if (message.type === "console") {
-                if (devMode) {
-                    const level = message.level || "log";
-                    console.log(`[Glomo-RN-SDK LRS] [WebView ${level.toUpperCase()}]`, message.message);
-                }
-                return;
-            }
-            if (message.type === "window.open") {
+            },
+            "window.open": (message) => {
                 const url = message.url;
                 if (url && typeof url === "string" && (0, validation_1.isValidUrl)(url)) {
                     if (devMode) {
-                        console.log(`[Glomo-RN-SDK LRS] window.open called from MainWebView: ${url}`);
+                        console.log(`${LOG_PREFIX} window.open called from MainWebView: ${url}`);
                     }
                     setFlowWebViewUrl(url);
                     setShowFlowWebView(true);
@@ -205,32 +246,31 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                 }
                 else {
                     if (devMode) {
-                        console.log("[Glomo-RN-SDK LRS] Invalid URL in window.open from MainWebView:", url, typeof url === "undefined" ? "undefined" : "");
+                        console.log(`${LOG_PREFIX} Invalid URL in window.open from MainWebView:`, url, typeof url === "undefined" ? "undefined" : "");
                     }
                 }
-                return;
-            }
-            if (message.type === "window.close") {
+            },
+            "window.close": () => {
                 if (devMode) {
-                    console.log("[Glomo-RN-SDK LRS] Child window close requested from MainWebView");
+                    console.log(`${LOG_PREFIX} Child window close requested from MainWebView`);
                 }
                 setShowFlowWebView(false);
                 setFlowWebViewUrl("");
                 setEducationCarouselState("pending");
                 // Tracking window.close interception
                 (0, analytics_1.trackWindowClose)("main", orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
+            },
             // Handling merchant JS callbacks on flow completion
-            if (message.type === "message" && message.message) {
+            message: (message) => {
                 const messageData = message.message;
-                const messageType = messageData === null || messageData === void 0 ? void 0 : messageData.type;
+                if (!messageData)
+                    return;
+                const messageType = messageData.type;
                 if (messageType === "payment.success" || messageType === "payment.complete") {
-                    const paymentMessage = messageData;
-                    const payload = paymentMessage === null || paymentMessage === void 0 ? void 0 : paymentMessage.payload;
+                    const payload = messageData.payload;
                     if ((0, validation_1.isValidPaymentPayload)(payload)) {
                         if (devMode) {
-                            console.log("[Glomo-RN-SDK LRS] Payment successful via merchant callback!");
+                            console.log(`${LOG_PREFIX} Payment successful via merchant callback!`);
                         }
                         setShowCheckout(false);
                         setShowFlowWebView(false);
@@ -239,21 +279,32 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                         setStatus("payment_successful");
                         (0, validation_1.safeCallback)(onPaymentSuccess, [payload], "onPaymentSuccess", devMode);
                         // Tracking payment success callback
-                        (0, analytics_1.trackPaymentSuccess)(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        (0, analytics_1.trackPaymentSuccess)((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.success", missingFields, "main", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK LRS] Invalid payment success payload:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.success payload from main:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.success", (0, payment_payload_1.payloadKeysOf)(payload), "main", orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.success")]], "onSdkError", devMode);
                     }
                     return;
                 }
                 if (messageType === "payment.failure" || messageType === "payment.error") {
-                    const paymentMessage = messageData;
-                    const payload = paymentMessage === null || paymentMessage === void 0 ? void 0 : paymentMessage.payload;
+                    const payload = messageData.payload;
                     if ((0, validation_1.isValidPaymentPayload)(payload)) {
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK LRS] Payment failed via merchant callback");
+                            console.error(`${LOG_PREFIX} Payment failed via merchant callback`);
                         }
                         setShowCheckout(false);
                         setShowFlowWebView(false);
@@ -262,65 +313,86 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                         setStatus("payment_failed");
                         (0, validation_1.safeCallback)(onPaymentFailure, [payload], "onPaymentFailure", devMode);
                         // Tracking payment failure callback
-                        (0, analytics_1.trackPaymentFailure)(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        (0, analytics_1.trackPaymentFailure)((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.failure", missingFields, "main", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK LRS] Invalid payment failure payload:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.failure payload from main:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.failure", (0, payment_payload_1.payloadKeysOf)(payload), "main", orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.failure")]], "onSdkError", devMode);
                     }
                     return;
                 }
                 // Handling checkout.closed events
                 if (messageType === "checkout.closed") {
                     if (devMode) {
-                        console.log("[Glomo-RN-SDK LRS] Checkout closed event received");
+                        console.log(`${LOG_PREFIX} Checkout closed event received`);
                     }
                     setShowCheckout(false);
                     setShowFlowWebView(false);
                     setFlowWebViewUrl("");
                     setEducationCarouselState("pending");
-                    (0, validation_1.safeCallback)(onPaymentTerminate, [], "onPaymentTerminate", devMode);
-                    // Tracking payment terminate callback
-                    (0, analytics_1.trackPaymentTerminate)(orderId, "checkout_closed", publicKey, devMode, mockMode, checkoutUrl);
-                    return;
+                    const termination = { source: checkout_1.TERMINATION_SOURCES.CHECKOUT_CLOSED };
+                    (0, validation_1.safeCallback)(onPaymentTerminate, [termination], "onPaymentTerminate", devMode);
+                    // One object to the host and to telemetry, so the two cannot drift
+                    (0, analytics_1.trackPaymentTerminate)(orderId, (0, event_projections_1.toTerminationEventData)(termination), publicKey, devMode, mockMode, checkoutUrl);
                 }
-            }
-        }
-        catch (error) {
-            if (devMode) {
-                console.error("[Glomo-RN-SDK LRS] Error parsing MainWebView message:", error);
-            }
-        }
-    }, [onPaymentSuccess, onPaymentFailure, onPaymentTerminate, devMode, mockMode, orderId, publicKey, checkoutUrl]);
+            },
+        },
+    }), [
+        onPaymentSuccess,
+        onPaymentFailure,
+        onPaymentTerminate,
+        devMode,
+        mockMode,
+        orderId,
+        publicKey,
+        checkoutUrl,
+        fileSaveHandler,
+        onSdkError,
+        fileInputHandler,
+    ]);
     // Handler for the flow WebView messages
-    const handleFlowWebViewMessage = (0, react_1.useCallback)((event) => {
-        var _a;
-        try {
-            const data = (_a = event.nativeEvent) === null || _a === void 0 ? void 0 : _a.data;
-            if (!data || typeof data !== "string") {
+    const handleFlowWebViewMessage = (0, react_1.useMemo)(() => (0, message_router_1.createMessageRouter)({
+        logPrefix: LOG_PREFIX,
+        source: "FlowWebView",
+        devMode,
+        onInvalidMessage: (data) => {
+            (0, analytics_1.trackInvalidMessageReceived)("flow", data, flowWebViewUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
+        },
+        handlers: {
+            /**
+             * Telemetry only, and deliberately not wired to onUserRefusedDevicePermissions.
+             * The flow injection sees this by watching getUserMedia, so coverage depends on
+             * whether a given bank uses it - partial coverage on a merchant callback is
+             * worse than none, because silence would stop being unambiguous.
+             */
+            "permission.denied": (message) => {
+                (0, analytics_1.trackDevicePermissionRefused)(typeof message.resource === "string" ? message.resource : "camera", "get_user_media", orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+            },
+            "file.save": fileSaveHandler,
+            "file.input": fileInputHandler,
+            console: (message) => {
                 if (devMode) {
-                    console.warn("[Glomo-RN-SDK LRS] Invalid message data from FlowWebView");
+                    console.log(`${LOG_PREFIX} [Flow] ${message.message}`);
                 }
-                // Tracking invalid message received
-                (0, analytics_1.trackInvalidMessageReceived)("flow", data, flowWebViewUrl, orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
-            const message = JSON.parse(data);
-            if (devMode) {
-                console.log("[Glomo-RN-SDK LRS] FlowWebView Message received:", message.type, message);
-            }
-            if (message.type === "console") {
-                if (devMode) {
-                    console.log(`[Glomo-RN-SDK LRS] [Flow] ${message.message}`);
-                }
-                return;
-            }
-            if (message.type === "window.open") {
+            },
+            "window.open": (message) => {
                 const url = message.url;
                 if (url && typeof url === "string" && (0, validation_1.isValidUrl)(url)) {
                     if (devMode) {
-                        console.log(`[Glomo-RN-SDK LRS] window.open called from FlowWebView: ${url}`);
+                        console.log(`${LOG_PREFIX} window.open called from FlowWebView: ${url}`);
                     }
                     setFlowWebViewUrl(url);
                     setEducationCarouselState("pending");
@@ -329,31 +401,31 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                 }
                 else {
                     if (devMode) {
-                        console.log("[Glomo-RN-SDK LRS] Invalid URL in window.open from FlowWebView:", url, typeof url === "undefined" ? "undefined" : "");
+                        console.log(`${LOG_PREFIX} Invalid URL in window.open from FlowWebView:`, url, typeof url === "undefined" ? "undefined" : "");
                     }
                 }
-                return;
-            }
-            if (message.type === "window.close") {
+            },
+            "window.close": () => {
                 if (devMode) {
-                    console.log("[Glomo-RN-SDK LRS] FlowWebView close requested");
+                    console.log(`${LOG_PREFIX} FlowWebView close requested`);
                 }
                 setShowFlowWebView(false);
                 setFlowWebViewUrl("");
                 setEducationCarouselState("pending");
                 // Tracking window.close interception
                 (0, analytics_1.trackWindowClose)("flow", orderId, publicKey, devMode, mockMode, checkoutUrl);
-                return;
-            }
-            if (message.type === "message" && message.message) {
+            },
+            // Handling merchant JS callbacks on flow completion
+            message: (message) => {
                 const messageData = message.message;
-                const messageType = messageData === null || messageData === void 0 ? void 0 : messageData.type;
+                if (!messageData)
+                    return;
+                const messageType = messageData.type;
                 if (messageType === "payment.success" || messageType === "payment.complete") {
-                    const paymentMessage = messageData;
-                    const payload = paymentMessage === null || paymentMessage === void 0 ? void 0 : paymentMessage.payload;
+                    const payload = messageData.payload;
                     if ((0, validation_1.isValidPaymentPayload)(payload)) {
                         if (devMode) {
-                            console.log("[Glomo-RN-SDK LRS] Payment successful via FlowWebView callback!");
+                            console.log(`${LOG_PREFIX} Payment successful via FlowWebView callback!`);
                         }
                         setShowFlowWebView(false);
                         setShowCheckout(false);
@@ -362,21 +434,32 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                         setStatus("payment_successful");
                         (0, validation_1.safeCallback)(onPaymentSuccess, [payload], "onPaymentSuccess", devMode);
                         // Tracking payment success callback
-                        (0, analytics_1.trackPaymentSuccess)(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        (0, analytics_1.trackPaymentSuccess)((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.success", missingFields, "flow", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK LRS] Invalid payment success payload from FlowWebView:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.success payload from flow:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.success", (0, payment_payload_1.payloadKeysOf)(payload), "flow", orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.success")]], "onSdkError", devMode);
                     }
                     return;
                 }
                 if (messageType === "payment.failure" || messageType === "payment.error") {
-                    const paymentMessage = messageData;
-                    const payload = paymentMessage === null || paymentMessage === void 0 ? void 0 : paymentMessage.payload;
+                    const payload = messageData.payload;
                     if ((0, validation_1.isValidPaymentPayload)(payload)) {
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK LRS] Payment failed via FlowWebView callback");
+                            console.error(`${LOG_PREFIX} Payment failed via FlowWebView callback`);
                         }
                         setShowFlowWebView(false);
                         setShowCheckout(false);
@@ -385,60 +468,61 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                         setStatus("payment_failed");
                         (0, validation_1.safeCallback)(onPaymentFailure, [payload], "onPaymentFailure", devMode);
                         // Tracking payment failure callback
-                        (0, analytics_1.trackPaymentFailure)(payload.orderId, payload.paymentId, publicKey, devMode, mockMode, checkoutUrl);
+                        (0, analytics_1.trackPaymentFailure)((0, event_projections_1.toPaymentEventData)(payload), publicKey, devMode, mockMode, checkoutUrl);
+                        // Fires alongside the callback, not instead of it - the outcome is real, the payload is thin
+                        const missingFields = (0, validation_1.missingPaymentFields)(payload);
+                        if (missingFields.length > 0) {
+                            (0, analytics_1.trackIncompletePaymentPayload)("payment.failure", missingFields, "flow", payload.orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        }
                     }
                     else {
+                        /**
+                         * Reported, not dropped. Before v5 this branch was a devMode-only console.error, so in a
+                         * release build a terminal payment outcome the SDK could not route left no trace
+                         * anywhere - no callback, no telemetry, nothing for support to find.
+                         */
                         if (devMode) {
-                            console.error("[Glomo-RN-SDK LRS] Invalid payment failure payload from FlowWebView:", payload);
+                            console.error(`${LOG_PREFIX} Unroutable payment.failure payload from flow:`, payload);
                         }
+                        (0, analytics_1.trackDroppedPaymentPayload)("payment.failure", (0, payment_payload_1.payloadKeysOf)(payload), "flow", orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+                        (0, validation_1.safeCallback)(onSdkError, [[(0, payment_payload_1.droppedPayloadSdkError)("payment.failure")]], "onSdkError", devMode);
                     }
-                    return;
                 }
-            }
-        }
-        catch (error) {
-            if (devMode) {
-                console.error("[Glomo-RN-SDK LRS] Error parsing FlowWebView message:", error);
-            }
-        }
-    }, [onPaymentSuccess, onPaymentFailure, devMode, mockMode, orderId, publicKey, flowWebViewUrl, checkoutUrl]);
+            },
+        },
+    }), [
+        onPaymentSuccess,
+        onPaymentFailure,
+        devMode,
+        mockMode,
+        orderId,
+        publicKey,
+        flowWebViewUrl,
+        checkoutUrl,
+        fileSaveHandler,
+        onSdkError,
+        fileInputHandler,
+    ]);
     // Handler for the education carousel WebView messages
-    const handleEducationCarouselWebViewMessage = (0, react_1.useCallback)((event) => {
-        var _a;
-        try {
-            const data = (_a = event.nativeEvent) === null || _a === void 0 ? void 0 : _a.data;
-            if (!data || typeof data !== "string") {
+    const handleEducationCarouselWebViewMessage = (0, react_1.useMemo)(() => (0, message_router_1.createMessageRouter)({
+        logPrefix: LOG_PREFIX,
+        source: "EducationCarouselWebView",
+        devMode,
+        handlers: {
+            console: (message) => {
                 if (devMode) {
-                    console.warn("[Glomo-RN-SDK LRS] Invalid message data from EducationCarouselWebView");
+                    console.log(`${LOG_PREFIX} [EducationCarousel] ${message.message}`);
                 }
-                return;
-            }
-            const message = JSON.parse(data);
-            if (devMode) {
-                console.log("[Glomo-RN-SDK LRS] EducationCarouselWebView Message received:", message.type, message);
-            }
-            if (message.type === "console") {
+            },
+            "lrs.has_education_steps": (message) => {
                 if (devMode) {
-                    console.log(`[Glomo-RN-SDK LRS] [EducationCarousel] ${message.message}`);
+                    console.log(`${LOG_PREFIX} Education carousel signal received: value=${String(message.value)} source=${message.source || "unknown"} payload=${JSON.stringify(message.payload || {})}`);
                 }
-                return;
-            }
-            if (message.type === "lrs.has_education_steps") {
-                const nextState = "hasContent";
-                if (devMode) {
-                    console.log(`[Glomo-RN-SDK LRS] Education carousel signal received: value=${String(message.value)} source=${message.source || "unknown"} payload=${JSON.stringify(message.payload || {})}`);
-                }
-                (0, analytics_1.trackEducationStepsShown)(orderId, publicKey, devMode, mockMode, checkoutUrl, message.source);
-                setEducationCarouselState(nextState);
-                return;
-            }
-        }
-        catch (error) {
-            if (devMode) {
-                console.error("[Glomo-RN-SDK LRS] Error parsing EducationCarouselWebView message:", error);
-            }
-        }
-    }, [checkoutUrl, devMode, mockMode, orderId, publicKey]);
+                (0, analytics_1.trackEducationStepsShown)(orderId, publicKey, devMode, mockMode, checkoutUrl, typeof message.source === "string" ? message.source : undefined);
+                setEducationCarouselState("hasContent");
+            },
+        },
+    }), [checkoutUrl, devMode, mockMode, orderId, publicKey]);
     // Handler for the navigation state changes
     const handleNavigationStateChange = (0, react_1.useCallback)((navState) => {
         if (devMode) {
@@ -469,10 +553,18 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                     console.log("[Glomo-RN-SDK LRS] Ignoring checkout status update for: " + status);
                 }
             }
-            (0, validation_1.safeCallback)(onPaymentTerminate, [], "onPaymentTerminate", devMode);
-            // Tracking payment terminate callback (user dismiss/back button)
-            const terminateSource = react_native_1.Platform.OS === "ios" ? "user_dismiss" : "back_button";
-            (0, analytics_1.trackPaymentTerminate)(orderId, terminateSource, publicKey, devMode, mockMode, checkoutUrl);
+            /**
+             * Inferred from the platform rather than read off an event, because `onRequestClose` is
+             * the only wiring here and the two platforms raise it for different gestures: Android
+             * for hardware back and the back gesture, iOS for swipe-down on the pageSheet. Nothing
+             * else routes through it, so the inference is sound - but it is an inference.
+             */
+            const termination = {
+                source: react_native_1.Platform.OS === "ios" ? checkout_1.TERMINATION_SOURCES.MODAL_DISMISS : checkout_1.TERMINATION_SOURCES.DEVICE_BACK_BUTTON,
+            };
+            (0, validation_1.safeCallback)(onPaymentTerminate, [termination], "onPaymentTerminate", devMode);
+            // One object to the host and to telemetry, so the two cannot drift
+            (0, analytics_1.trackPaymentTerminate)(orderId, (0, event_projections_1.toTerminationEventData)(termination), publicKey, devMode, mockMode, checkoutUrl);
         }
         catch (error) {
             if (devMode) {
@@ -480,6 +572,28 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
             }
         }
     }, [showFlowWebView, devMode, onPaymentTerminate, status, orderId, publicKey, mockMode, checkoutUrl]);
+    /**
+     * Closing the checkout when the user refuses camera access, since the bank page cannot
+     * proceed without it. Kept here rather than inside usePermissionRequest because moving the
+     * status and notifying the merchant are flow concerns.
+     */
+    const handleDevicePermissionDenied = (0, react_1.useCallback)(() => {
+        setShowCheckout(false);
+        setShowFlowWebView(false);
+        setFlowWebViewUrl("");
+        setEducationCarouselState("pending");
+        if (status === "payment_in_progress") {
+            setStatus("payment_cancelled");
+        }
+        (0, validation_1.safeCallback)(onUserRefusedDevicePermissions, [], "onUserRefusedDevicePermissions", devMode);
+        // The permission hook only reaches here for camera; anything else is denied without notifying
+        (0, analytics_1.trackDevicePermissionRefused)("camera", "permission_request", orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
+    }, [status, onUserRefusedDevicePermissions, devMode, orderId, publicKey, mockMode, checkoutUrl]);
+    const handlePermissionRequest = (0, use_permission_request_1.usePermissionRequest)({
+        logPrefix: "[Glomo-RN-SDK LRS]",
+        onDenied: handleDevicePermissionDenied,
+        devMode,
+    });
     /** Closes the flow WebView and returns to the main checkout */
     const handleFlowBack = (0, react_1.useCallback)(() => {
         if (devMode) {
@@ -488,7 +602,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
         setShowFlowWebView(false);
         setFlowWebViewUrl("");
         setEducationCarouselState("pending");
-        (0, analytics_1.trackWindowClose)("flow", orderId, publicKey, devMode, mockMode, checkoutUrl);
+        (0, analytics_1.trackBackNavigationViaSdkBackButton)(orderId, publicKey, devMode, mockMode, checkoutUrl, "lrs");
     }, [devMode, orderId, publicKey, mockMode, checkoutUrl]);
     /**
      * Initiator method for the LRS Checkout flow.
@@ -507,38 +621,62 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
          * Checking device security compliance (if peerDependencies are available)
          * A null value indicates that recommended security dependencies were not installed and compliance checks will be skipped in this case
          */
-        const deviceComplianceCheck = (0, device_compliance_1.checkDeviceCompliance)(devMode);
-        const jailbreakDetectionLibraryInstalled = (0, device_compliance_1.isComplianceCheckAvailable)();
-        const jailbreakDetectionInfo = {
-            jailbreakDetectionLibraryInstalled,
-            jailbreakDetected: deviceComplianceCheck,
+        const compliance = (0, device_compliance_1.resolveDeviceCompliance)(devMode);
+        const complianceLibraryInstalled = (0, device_compliance_1.isComplianceCheckAvailable)();
+        const fileSave = (0, index_2.resolveFileSaveAvailability)();
+        const dependencyInfo = {
+            jailbreakDetectionLibraryInstalled: complianceLibraryInstalled,
+            jailbreakDetected: compliance.compromised,
+            complianceSource: compliance.source,
+            complianceSignals: compliance.trippedSignals,
+            fileSaveAvailable: fileSave.available,
+            missingFileSavePackages: fileSave.missing,
         };
         if (devMode) {
             console.log(`[Glomo-RN-SDK LRS] Attempting to start checkout of ${checkoutUrl} from status: ${status}`);
         }
         // Tracking start attempt with current status
-        (0, analytics_1.trackStartAttempt)(status, orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
-        if (deviceComplianceCheck === true) {
-            // Device detected as compromised
+        (0, analytics_1.trackStartAttempt)(status, orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
+        /**
+         * Ungated on purpose, both of them. An absent optional dependency degrades silently by
+         * design, so a console warning is the only thing that reaches a merchant who has not
+         * noticed - and the compliance one now precedes a hard block on live keys.
+         */
+        if (!complianceLibraryInstalled) {
+            console.warn("[Glomo-RN-SDK LRS] jail-monkey is not installed or its native module is not linked, so " +
+                "rooted and jailbroken devices cannot be detected. As of v5 this BLOCKS live checkouts. " +
+                "Install jail-monkey and rebuild the app - see the README.");
+        }
+        if (!fileSave.available) {
+            console.warn(`[Glomo-RN-SDK LRS] Document downloads are disabled: ${fileSave.missing.join(" and ")} ` +
+                "could not be loaded. Install the package(s) and rebuild the app, or ignore this if your " +
+                "checkout does not offer downloads - the page falls back to its own behaviour.");
+        }
+        if ((0, device_compliance_1.blocksCheckout)(compliance, publicKey)) {
+            /**
+             * Two conditions, one refusal. `compromised === true` is a rooted or jailbroken device;
+             * `null` is a device we could not check, which on RN overwhelmingly means jail-monkey is
+             * absent rather than that a platform probe failed. Both fail closed on a live key, and
+             * neither fires on a test or mock key.
+             */
+            const unknown = compliance.compromised === null;
             if (devMode) {
-                console.error("[Glomo-RN-SDK LRS] Cannot start checkout. Device is rooted or jailbroken.");
+                console.error(`[Glomo-RN-SDK LRS] Cannot start checkout. ${unknown ? "Device security could not be verified." : "Device is rooted or jailbroken."}`);
             }
             const errors = [
                 {
                     type: "device_forbidden",
-                    message: "LRS checkout is not allowed on rooted or jailbroken devices.",
+                    message: unknown
+                        ? "LRS checkout could not verify this device's security. Install jail-monkey and rebuild the app."
+                        : "LRS checkout is not allowed on rooted or jailbroken devices.",
                 },
             ];
             (0, validation_1.safeCallback)(onSdkError, [errors], "onSdkError", devMode);
             // Tracking start() failure
-            (0, analytics_1.trackStartFailure)("device_forbidden", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            (0, analytics_1.trackStartFailure)(unknown ? "device_compliance_unknown" : "device_forbidden", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
-        else if (deviceComplianceCheck === null) {
-            // This warning was intentionally not gated behind a devMode check to ensure merchants are aware of the strong recommendation to install jail-monkey for enhanced security compliance.
-            console.warn("[Glomo-RN-SDK LRS] Device security library not installed - the SDK won't be able to automatically detect rooted/jailbroken devices. It is HIGHLY recommended to install jail-monkey as per the README, and prevent LRS checkouts from compromised devices.");
-        }
         // Enforcing devMode requirement for development servers
         const resolvedServer = server || "prod";
         if (!devMode && resolvedServer !== "prod") {
@@ -550,7 +688,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
             ];
             (0, validation_1.safeCallback)(onSdkError, [errors], "onSdkError", devMode);
             (0, analytics_1.trackSdkError)(errors, orderId, publicKey, devMode, mockMode, checkoutUrl);
-            (0, analytics_1.trackStartFailure)("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            (0, analytics_1.trackStartFailure)("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -593,7 +731,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
             (0, validation_1.safeCallback)(onSdkError, [errors], "onSdkError", devMode);
             // Tracking start() failure
             (0, analytics_1.trackSdkError)(errors, orderId, publicKey, devMode, mockMode, checkoutUrl);
-            (0, analytics_1.trackStartFailure)("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            (0, analytics_1.trackStartFailure)("validation_error", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -602,7 +740,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                 console.log(`[Glomo-RN-SDK LRS] Cannot start checkout. Current status: ${status}. Payment already successful.`);
             }
             // Tracking start() failure
-            (0, analytics_1.trackStartFailure)("payment_successful", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            (0, analytics_1.trackStartFailure)("payment_successful", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -616,7 +754,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                 console.log(`[Glomo-RN-SDK LRS] Cannot start checkout. Unknown status: ${status}.`);
             }
             // Tracking start() failure
-            (0, analytics_1.trackStartFailure)("invalid_status", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            (0, analytics_1.trackStartFailure)("invalid_status", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -625,7 +763,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
                 console.error("[Glomo-RN-SDK LRS] Cannot start checkout. Invalid checkout URL.");
             }
             // Tracking start() failure
-            (0, analytics_1.trackStartFailure)("invalid_url", orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+            (0, analytics_1.trackStartFailure)("invalid_url", orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
             setShowCheckout(false);
             return false;
         }
@@ -637,7 +775,7 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
         setEducationCarouselState("pending");
         setStatus("payment_in_progress");
         // Tracking successful start
-        (0, analytics_1.trackStartSuccess)(orderId, publicKey, devMode, mockMode, checkoutUrl, jailbreakDetectionInfo);
+        (0, analytics_1.trackStartSuccess)(orderId, publicKey, devMode, mockMode, checkoutUrl, dependencyInfo);
         setShowCheckout(true);
         return true;
     }, [devMode, status, publicKey, orderId, baseCheckoutUrl, checkoutUrl, mockMode, onSdkError, server]);
@@ -672,6 +810,13 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
             setEducationCarouselState("pending");
         };
     }, []);
+    /**
+     * Scripts injected into each WebView, carrying what this build can advertise.
+     *
+     * Resolved once per mount rather than at module load, so a merchant who never opens a
+     * checkout never pays for the dependency probe.
+     */
+    const injectionScripts = (0, react_1.useMemo)(() => (0, index_1.buildInjectionScripts)((0, index_2.resolveCapabilities)()), []);
     return {
         start,
         status,
@@ -692,12 +837,13 @@ function useLrsCheckout({ server, publicKey, orderId, onPaymentSuccess, onPaymen
         handleNavigationStateChange,
         handleModalBackButton,
         handleFlowBack,
+        handlePermissionRequest,
         injectedMain: __DEV__ && (internalOptions === null || internalOptions === void 0 ? void 0 : internalOptions._testInjectionScript)
-            ? index_1.InjectionScripts.main + internalOptions._testInjectionScript
-            : index_1.InjectionScripts.main,
-        injectedFlow: index_1.InjectionScripts.flow,
+            ? injectionScripts.main + internalOptions._testInjectionScript
+            : injectionScripts.main,
+        injectedFlow: injectionScripts.flow,
         injectedEducationCarousel: __DEV__ && (internalOptions === null || internalOptions === void 0 ? void 0 : internalOptions._testCarouselInjectionScript)
-            ? index_1.InjectionScripts.educationCarousel + internalOptions._testCarouselInjectionScript
-            : index_1.InjectionScripts.educationCarousel,
+            ? injectionScripts.educationCarousel + internalOptions._testCarouselInjectionScript
+            : injectionScripts.educationCarousel,
     };
 }