@ozura/elements 1.3.1-next.66 → 1.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. package/LICENSE +21 -21
  2. package/dist/frame/element-frame.html +1 -1
  3. package/dist/frame/element-frame.js +0 -1
  4. package/dist/frame/tokenizer-frame.html +2 -2
  5. package/dist/frame/tokenizer-frame.js +2 -3
  6. package/dist/oz-elements.esm.js +5 -3
  7. package/dist/oz-elements.umd.js +5 -3
  8. package/dist/react/index.cjs.js +5 -2
  9. package/dist/react/index.cjs.js.map +1 -1
  10. package/dist/react/index.esm.js +5 -2
  11. package/dist/react/index.esm.js.map +1 -1
  12. package/dist/server/index.cjs.js +2 -2
  13. package/dist/server/index.cjs.js.map +1 -1
  14. package/dist/server/index.esm.js +2 -2
  15. package/dist/server/index.esm.js.map +1 -1
  16. package/dist/vue/index.cjs.js +5 -2
  17. package/dist/vue/index.cjs.js.map +1 -1
  18. package/dist/vue/index.esm.js +5 -2
  19. package/dist/vue/index.esm.js.map +1 -1
  20. package/package.json +1 -1
  21. package/dist/frame/element-frame.js.map +0 -1
  22. package/dist/frame/tokenizer-frame.js.map +0 -1
  23. package/dist/oz-elements.esm.js.map +0 -1
  24. package/dist/oz-elements.umd.js.map +0 -1
package/LICENSE CHANGED
@@ -1,21 +1,21 @@
1
- MIT License
2
-
3
- Copyright (c) 2025 Ozura
4
-
5
- Permission is hereby granted, free of charge, to any person obtaining a copy
6
- of this software and associated documentation files (the "Software"), to deal
7
- in the Software without restriction, including without limitation the rights
8
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
- copies of the Software, and to permit persons to whom the Software is
10
- furnished to do so, subject to the following conditions:
11
-
12
- The above copyright notice and this permission notice shall be included in all
13
- copies or substantial portions of the Software.
14
-
15
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
- SOFTWARE.
1
+ MIT License
2
+
3
+ Copyright (c) 2025 Ozura
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/dist/frame/element-frame.html CHANGED
@@ -17,6 +17,6 @@
17
17
  </style>
18
18
  </head>
19
19
  <body>
20
- <script src="./element-frame.js"></script>
20
+ <script src="./element-frame.js" integrity="sha384-xpV1wS1ZIxuDGHUg8WQAbQr94m8oGwI4CutCvD37d7sacy9sRmi4CA/EU62Mrd2I" crossorigin="anonymous"></script>
21
21
  </body>
22
22
  </html>
package/dist/frame/element-frame.js CHANGED
@@ -920,4 +920,3 @@ var _OzElementFrame = (function (exports) {
920
920
  return exports;
921
921
 
922
922
  })({});
923
- //# sourceMappingURL=element-frame.js.map
package/dist/frame/tokenizer-frame.html CHANGED
@@ -2,10 +2,10 @@
2
2
  <html lang="en">
3
3
  <head>
4
4
  <meta charset="UTF-8" />
5
- <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; connect-src https://pci-vault-staging-drc0duhcakf4g4fr.eastus-01.azurewebsites.net; base-uri 'none'; form-action 'none';" />
5
+ <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; connect-src https://api.ozuravault.com; base-uri 'none'; form-action 'none';" />
6
6
  <title>Ozura Tokenizer</title>
7
7
  </head>
8
8
  <body>
9
- <script src="./tokenizer-frame.js"></script>
9
+ <script src="./tokenizer-frame.js" integrity="sha384-jKzyFta4CjrMb8YW6wX9/MzSUp55uqUytZeya/g55SgF9IvsJ39Jveh4AhwszApc" crossorigin="anonymous"></script>
10
10
  </body>
11
11
  </html>
package/dist/frame/tokenizer-frame.js CHANGED
@@ -38,13 +38,13 @@ var _OzTokenizerFrame = (function (exports) {
38
38
  * assembles the vault tokenization payload, and POSTs it directly to the
39
39
  * vault API. The merchant page never sees raw card data.
40
40
  *
41
- * The vault URL is determined by "https://pci-vault-staging-drc0duhcakf4g4fr.eastus-01.azurewebsites.net", injected at build time.
41
+ * The vault URL is determined by "https://api.ozuravault.com", injected at build time.
42
42
  * The tokenizer ignores any apiUrl sent by the SDK in OZ_TOKENIZE messages —
43
43
  * an attacker who XSSes the merchant page cannot redirect where card data is
44
44
  * sent because the destination is hardcoded in this Ozura-controlled bundle.
45
45
  */
46
46
  var _a;
47
- const VAULT_API_URL = "https://pci-vault-staging-drc0duhcakf4g4fr.eastus-01.azurewebsites.net";
47
+ const VAULT_API_URL = "https://api.ozuravault.com";
48
48
  /**
49
49
  * Validates and normalises a `parentOrigin` value supplied via URL hash params.
50
50
  *
@@ -610,4 +610,3 @@ var _OzTokenizerFrame = (function (exports) {
610
610
  return exports;
611
611
 
612
612
  })({});
613
- //# sourceMappingURL=tokenizer-frame.js.map
package/dist/oz-elements.esm.js CHANGED
@@ -1077,7 +1077,7 @@ function isBankAccountMetadata(v) {
1077
1077
  const r = v;
1078
1078
  return typeof r.last4 === 'string' && typeof r.routingNumberLast4 === 'string';
1079
1079
  }
1080
- const DEFAULT_FRAME_BASE_URL = "https://lively-hill-097170c0f.4.azurestaticapps.net";
1080
+ const DEFAULT_FRAME_BASE_URL = "https://elements.ozura.com";
1081
1081
  /**
1082
1082
  * The main entry point for OzElements. Creates and manages iframe-based
1083
1083
  * card input elements that keep raw card data isolated from the merchant page.
@@ -2218,8 +2218,11 @@ class OzVault {
2218
2218
  // "Wax key expired") while explicitly excluding card-level validation
2219
2219
  // errors (e.g. "Card has expired", "Card expiry date invalid") that share
2220
2220
  // the 'expired' keyword but should NOT trigger a session refresh.
2221
+ // Use a word-boundary regex (\bcard\b) rather than includes('card') to
2222
+ // avoid false matches on words containing "card" as a substring
2223
+ // (e.g. "discarded", "discarding").
2221
2224
  return (msg.includes('wax') ||
2222
- (msg.includes('expired') && !msg.includes('card')) ||
2225
+ (msg.includes('expired') && !/\bcard\b/.test(msg)) ||
2223
2226
  msg.includes('consumed') ||
2224
2227
  msg.includes('invalid key') ||
2225
2228
  msg.includes('key not found') ||
@@ -2278,4 +2281,3 @@ class OzVault {
2278
2281
  _OzVault_waxKey = new WeakMap();
2279
2282
 
2280
2283
  export { OzElement, OzError, OzVault, createSessionFetcher as createFetchWaxKey, createSessionFetcher, normalizeBankVaultError, normalizeCardSaleError, normalizeVaultError };
2281
- //# sourceMappingURL=oz-elements.esm.js.map
package/dist/oz-elements.umd.js CHANGED
@@ -1083,7 +1083,7 @@
1083
1083
  const r = v;
1084
1084
  return typeof r.last4 === 'string' && typeof r.routingNumberLast4 === 'string';
1085
1085
  }
1086
- const DEFAULT_FRAME_BASE_URL = "https://lively-hill-097170c0f.4.azurestaticapps.net";
1086
+ const DEFAULT_FRAME_BASE_URL = "https://elements.ozura.com";
1087
1087
  /**
1088
1088
  * The main entry point for OzElements. Creates and manages iframe-based
1089
1089
  * card input elements that keep raw card data isolated from the merchant page.
@@ -2224,8 +2224,11 @@
2224
2224
  // "Wax key expired") while explicitly excluding card-level validation
2225
2225
  // errors (e.g. "Card has expired", "Card expiry date invalid") that share
2226
2226
  // the 'expired' keyword but should NOT trigger a session refresh.
2227
+ // Use a word-boundary regex (\bcard\b) rather than includes('card') to
2228
+ // avoid false matches on words containing "card" as a substring
2229
+ // (e.g. "discarded", "discarding").
2227
2230
  return (msg.includes('wax') ||
2228
- (msg.includes('expired') && !msg.includes('card')) ||
2231
+ (msg.includes('expired') && !/\bcard\b/.test(msg)) ||
2229
2232
  msg.includes('consumed') ||
2230
2233
  msg.includes('invalid key') ||
2231
2234
  msg.includes('key not found') ||
@@ -2293,4 +2296,3 @@
2293
2296
  exports.normalizeVaultError = normalizeVaultError;
2294
2297
 
2295
2298
  }));
2296
- //# sourceMappingURL=oz-elements.umd.js.map
package/dist/react/index.cjs.js CHANGED
@@ -1027,7 +1027,7 @@ function isBankAccountMetadata(v) {
1027
1027
  const r = v;
1028
1028
  return typeof r.last4 === 'string' && typeof r.routingNumberLast4 === 'string';
1029
1029
  }
1030
- const DEFAULT_FRAME_BASE_URL = "https://lively-hill-097170c0f.4.azurestaticapps.net";
1030
+ const DEFAULT_FRAME_BASE_URL = "https://elements.ozura.com";
1031
1031
  /**
1032
1032
  * The main entry point for OzElements. Creates and manages iframe-based
1033
1033
  * card input elements that keep raw card data isolated from the merchant page.
@@ -2168,8 +2168,11 @@ class OzVault {
2168
2168
  // "Wax key expired") while explicitly excluding card-level validation
2169
2169
  // errors (e.g. "Card has expired", "Card expiry date invalid") that share
2170
2170
  // the 'expired' keyword but should NOT trigger a session refresh.
2171
+ // Use a word-boundary regex (\bcard\b) rather than includes('card') to
2172
+ // avoid false matches on words containing "card" as a substring
2173
+ // (e.g. "discarded", "discarding").
2171
2174
  return (msg.includes('wax') ||
2172
- (msg.includes('expired') && !msg.includes('card')) ||
2175
+ (msg.includes('expired') && !/\bcard\b/.test(msg)) ||
2173
2176
  msg.includes('consumed') ||
2174
2177
  msg.includes('invalid key') ||
2175
2178
  msg.includes('key not found') ||