@ozura/elements 1.2.0-next.26 → 1.2.0-next.27

package/dist/react/index.cjs.js

@@ -326,7 +326,7 @@ function sanitizeOptions(options) {
  * it never holds raw card data — all sensitive values live in the iframe.
  */
 class OzElement {
-    constructor(elementType, options, vaultId, frameBaseUrl, fonts = [], appearanceStyle) {
+    constructor(elementType, options, vaultId, frameBaseUrl, fonts = [], appearanceStyle, onDestroy) {
         this.iframe = null;
         this._frameWindow = null;
         this._ready = false;
@@ -342,6 +342,7 @@ class OzElement {
         this.fonts = fonts;
         this.appearanceStyle = appearanceStyle;
         this.frameId = `oz-${elementType}-${uuid()}`;
+        this._onDestroy = onDestroy;
     }
     /** The element type this proxy represents. */
     get type() {
@@ -497,9 +498,14 @@ class OzElement {
      * and prevents future use. Distinct from `unmount()` which allows re-mounting.
      */
     destroy() {
+        var _a;
         this.unmount();
         this.handlers.clear();
         this._destroyed = true;
+        // Notify OzVault so it can prune the stale frameId entry from its elements
+        // and completionState maps. Without this, manually calling el.destroy() leaks
+        // map entries that grow unboundedly in SPA scenarios with repeated mount/unmount.
+        (_a = this._onDestroy) === null || _a === void 0 ? void 0 : _a.call(this);
     }
     // ─── Called by OzVault ───────────────────────────────────────────────────
     /**
@@ -902,7 +908,22 @@ function createSessionFetcher(url) {
                 throw new OzError(`Could not reach session endpoint (${url}): ${msg}`, undefined, 'network');
             }
         }
-        const data = await res.json().catch(() => ({}));
+        // Parse JSON separately from the ok-check so that a non-JSON error body
+        // (HTML error page, WAF block, CDN 503) produces the right error code.
+        // Previously res.json() was attempted before res.ok was checked; a parse
+        // failure on a 5xx HTML body would fall through as {} and produce a
+        // misleading 'validation' code when the real cause is a server/network issue.
+        let data = {};
+        try {
+            data = await res.json();
+        }
+        catch (_a) {
+            if (!res.ok) {
+                throw new OzError(`Session endpoint returned HTTP ${res.status} with a non-JSON body`, undefined, res.status >= 500 ? 'server' : res.status === 401 || res.status === 403 ? 'auth' : 'validation');
+            }
+            // HTTP 200 but body isn't JSON — this is a misconfigured session endpoint.
+            throw new OzError('Session endpoint returned HTTP 200 but the response body is not valid JSON. Check your /api/oz-session implementation.', undefined, 'validation');
+        }
         if (!res.ok) {
             throw new OzError(typeof data.error === 'string' && data.error
                 ? data.error
@@ -920,10 +941,19 @@ function createSessionFetcher(url) {
 }
 
 function isCardMetadata(v) {
-    return !!v && typeof v === 'object' && typeof v.last4 === 'string';
+    if (!v || typeof v !== 'object')
+        return false;
+    const r = v;
+    return (typeof r.last4 === 'string' &&
+        typeof r.brand === 'string' &&
+        typeof r.expMonth === 'string' &&
+        typeof r.expYear === 'string');
 }
 function isBankAccountMetadata(v) {
-    return !!v && typeof v === 'object' && typeof v.last4 === 'string';
+    if (!v || typeof v !== 'object')
+        return false;
+    const r = v;
+    return typeof r.last4 === 'string' && typeof r.routingNumberLast4 === 'string';
 }
 const DEFAULT_FRAME_BASE_URL = "https://lively-hill-097170c0f.4.azurestaticapps.net";
 /**
@@ -933,16 +963,10 @@ const DEFAULT_FRAME_BASE_URL = "https://lively-hill-097170c0f.4.azurestaticapps.
  * Use the static `OzVault.create()` factory — do not call `new OzVault()` directly.
  *
  * @example
+ * // Recommended — pass sessionUrl and let the SDK call your backend automatically
  * const vault = await OzVault.create({
- *   pubKey: 'pk_live_...',
- *   fetchWaxKey: async (sessionId) => {
- *     // Call your backend — which calls ozura.mintWaxKey() from @ozura/elements/server
- *     const { waxKey } = await fetch('/api/mint-wax', {
- *       method: 'POST',
- *       body: JSON.stringify({ sessionId }),
- *     }).then(r => r.json());
- *     return waxKey;
- *   },
+ *   pubKey: 'pk_prod_...',  // or 'pk_test_...' for test mode
+ *   sessionUrl: '/api/oz-session',  // backend endpoint that calls ozura.createSession()
  * });
  * const cardNum = vault.createElement('cardNumber');
  * cardNum.mount('#card-number');
@@ -1178,7 +1202,12 @@ class OzVault {
             this.completionState.delete(existing.frameId);
             existing.destroy();
         }
-        const el = new OzElement(type, options, this.vaultId, this.frameBaseUrl, this.fonts, this.resolvedAppearance);
+        const el = new OzElement(type, options, this.vaultId, this.frameBaseUrl, this.fonts, this.resolvedAppearance, () => {
+            // Prune vault-level maps when the element is manually destroyed so they
+            // don't grow unboundedly in SPA scenarios with repeated mount/unmount cycles.
+            this.elements.delete(el.frameId);
+            this.completionState.delete(el.frameId);
+        });
         this.elements.set(el.frameId, el);
         typeMap.set(type, el);
         return el;
@@ -1835,61 +1864,65 @@ class OzVault {
                     }
                     pending.reject(new OzError(normalizeVaultError(raw), raw, errorCode));
                 }
-                // Also check bank resolvers — both card and bank errors use OZ_TOKEN_ERROR
-                const bankPending = this.bankTokenizeResolvers.get(msg.requestId);
-                if (bankPending) {
-                    this.bankTokenizeResolvers.delete(msg.requestId);
-                    if (bankPending.timeoutId != null)
-                        clearTimeout(bankPending.timeoutId);
-                    if (this.isRefreshableAuthError(errorCode, raw) && !bankPending.retried && this._storedFetchWaxKey) {
-                        const resetCountAtRetry = this._resetCount;
-                        this.refreshWaxKey().then(() => {
-                            if (this._destroyed) {
-                                bankPending.reject(new OzError('Vault destroyed during wax key refresh.'));
-                                return;
-                            }
-                            if (this._resetCount !== resetCountAtRetry) {
-                                bankPending.reject(new OzError('Vault was reset while tokenization was in progress.'));
-                                return;
-                            }
-                            const newRequestId = `req-${uuid()}`;
-                            this.bankTokenizeResolvers.set(newRequestId, Object.assign(Object.assign({}, bankPending), { retried: true }));
-                            try {
-                                const retryBankChannels = bankPending.readyElements.map(() => new MessageChannel());
-                                this.sendToTokenizer({
-                                    type: 'OZ_BANK_TOKENIZE',
-                                    requestId: newRequestId,
-                                    waxKey: this.waxKey,
-                                    tokenizationSessionId: this.tokenizationSessionId,
-                                    pubKey: this.pubKey,
-                                    firstName: bankPending.firstName,
-                                    lastName: bankPending.lastName,
-                                    fieldCount: bankPending.fieldCount,
-                                }, retryBankChannels.map(ch => ch.port1));
-                                bankPending.readyElements.forEach((el, i) => el.beginCollect(newRequestId, retryBankChannels[i].port2));
-                                const retryBankTimeoutId = setTimeout(() => {
-                                    if (this.bankTokenizeResolvers.has(newRequestId)) {
-                                        this.bankTokenizeResolvers.delete(newRequestId);
-                                        this.sendToTokenizer({ type: 'OZ_TOKENIZE_CANCEL', requestId: newRequestId });
-                                        bankPending.reject(new OzError('Bank tokenization timed out after wax key refresh.', undefined, 'timeout'));
-                                    }
-                                }, 30000);
-                                const retryBankEntry = this.bankTokenizeResolvers.get(newRequestId);
-                                if (retryBankEntry)
-                                    retryBankEntry.timeoutId = retryBankTimeoutId;
-                            }
-                            catch (setupErr) {
-                                this.bankTokenizeResolvers.delete(newRequestId);
-                                bankPending.reject(setupErr instanceof OzError ? setupErr : new OzError('Retry bank tokenization failed to start'));
-                            }
-                        }).catch((refreshErr) => {
-                            const msg = refreshErr instanceof Error ? refreshErr.message : 'Wax key refresh failed';
-                            bankPending.reject(new OzError(msg, undefined, 'auth'));
-                        });
-                        break;
+                else {
+                    // Also check bank resolvers — both card and bank errors use OZ_TOKEN_ERROR.
+                    // Use else-if rather than sequential checks so a UUID collision (however
+                    // improbable) can never trigger double-rejection of two unrelated resolvers.
+                    const bankPending = this.bankTokenizeResolvers.get(msg.requestId);
+                    if (bankPending) {
+                        this.bankTokenizeResolvers.delete(msg.requestId);
+                        if (bankPending.timeoutId != null)
+                            clearTimeout(bankPending.timeoutId);
+                        if (this.isRefreshableAuthError(errorCode, raw) && !bankPending.retried && this._storedFetchWaxKey) {
+                            const resetCountAtRetry = this._resetCount;
+                            this.refreshWaxKey().then(() => {
+                                if (this._destroyed) {
+                                    bankPending.reject(new OzError('Vault destroyed during wax key refresh.'));
+                                    return;
+                                }
+                                if (this._resetCount !== resetCountAtRetry) {
+                                    bankPending.reject(new OzError('Vault was reset while tokenization was in progress.'));
+                                    return;
+                                }
+                                const newRequestId = `req-${uuid()}`;
+                                this.bankTokenizeResolvers.set(newRequestId, Object.assign(Object.assign({}, bankPending), { retried: true }));
+                                try {
+                                    const retryBankChannels = bankPending.readyElements.map(() => new MessageChannel());
+                                    this.sendToTokenizer({
+                                        type: 'OZ_BANK_TOKENIZE',
+                                        requestId: newRequestId,
+                                        waxKey: this.waxKey,
+                                        tokenizationSessionId: this.tokenizationSessionId,
+                                        pubKey: this.pubKey,
+                                        firstName: bankPending.firstName,
+                                        lastName: bankPending.lastName,
+                                        fieldCount: bankPending.fieldCount,
+                                    }, retryBankChannels.map(ch => ch.port1));
+                                    bankPending.readyElements.forEach((el, i) => el.beginCollect(newRequestId, retryBankChannels[i].port2));
+                                    const retryBankTimeoutId = setTimeout(() => {
+                                        if (this.bankTokenizeResolvers.has(newRequestId)) {
+                                            this.bankTokenizeResolvers.delete(newRequestId);
+                                            this.sendToTokenizer({ type: 'OZ_TOKENIZE_CANCEL', requestId: newRequestId });
+                                            bankPending.reject(new OzError('Bank tokenization timed out after wax key refresh.', undefined, 'timeout'));
+                                        }
+                                    }, 30000);
+                                    const retryBankEntry = this.bankTokenizeResolvers.get(newRequestId);
+                                    if (retryBankEntry)
+                                        retryBankEntry.timeoutId = retryBankTimeoutId;
+                                }
+                                catch (setupErr) {
+                                    this.bankTokenizeResolvers.delete(newRequestId);
+                                    bankPending.reject(setupErr instanceof OzError ? setupErr : new OzError('Retry bank tokenization failed to start'));
+                                }
+                            }).catch((refreshErr) => {
+                                const msg = refreshErr instanceof Error ? refreshErr.message : 'Wax key refresh failed';
+                                bankPending.reject(new OzError(msg, undefined, 'auth'));
+                            });
+                            break;
+                        }
+                        bankPending.reject(new OzError(normalizeBankVaultError(raw), raw, errorCode));
                     }
-                    bankPending.reject(new OzError(normalizeBankVaultError(raw), raw, errorCode));
-                }
+                } // end else (bank path)
                 break;
             }
             case 'OZ_BANK_TOKEN_RESULT': {