@spare-technologies/spare-link 0.1.0-beta.0 → 1.0.0

package/lib/typescript/module/core/services/hosted-flow-state.d.ts

@@ -0,0 +1,75 @@
+import type { PaymentReturnReport } from '../models/payment-return-params.js';
+/**
+ * Where a hosted payment has got to.
+ *
+ * The phases the payer spends most of their time in — choosing a bank, reading
+ * the consent, confirming the payee — are all `hosted`: they happen inside the
+ * page, which does not report them, and the SDK has nothing to decide there.
+ */
+export type HostedFlowPhase = 
+/** The page is being fetched. Nothing is interactive yet. */
+'loading'
+/** The page is interactive and the payer is working through it. */
+ | 'hosted'
+/**
+ * The page could not be loaded, or loaded and never became interactive.
+ *
+ * Deliberately not terminal. Nothing has been attempted — no consent, no bank,
+ * no money — so the payer is offered the page again rather than told their
+ * payment failed, and the flow stays open while they decide.
+ */
+ | 'unreachable'
+/** A consent exists and the bank is being opened outside the WebView. */
+ | 'redirecting'
+/** The bank has the payer. The next thing to happen is a deep link home. */
+ | 'awaitingCallback' | 'succeeded' | 'failed' | 'cancelled'
+/** The payer left before the flow resolved either way. */
+ | 'abandoned';
+/** Immutable snapshot of a hosted payment. */
+export interface HostedFlowState {
+    readonly phase: HostedFlowPhase;
+    /**
+     * The payment request this flow is paying. Also what the merchant's backend
+     * reads the authoritative result by.
+     */
+    readonly reference: string;
+    /**
+     * Everything the return deep link reported — the merchant's reference, the
+     * payment id, the signature, the failure detail.
+     *
+     * Carried whole so a parameter added to the return contract reaches the caller
+     * without threading a new field through every factory below.
+     */
+    readonly report?: PaymentReturnReport;
+    readonly errorCode?: string;
+    /**
+     * How many times the page has been asked for, starting at 1.
+     *
+     * The screen keys the webview on this so a retry mounts a fresh one; reusing
+     * the failed instance would show the payer the same dead frame.
+     */
+    readonly attempt: number;
+}
+export declare function isTerminalPhase(phase: HostedFlowPhase): boolean;
+/** Factories for each phase, so no caller assembles a state by hand. */
+export declare const HostedFlowStates: {
+    readonly loading: (reference: string, attempt?: number) => HostedFlowState;
+    readonly hosted: (reference: string, attempt?: number) => HostedFlowState;
+    readonly unreachable: (reference: string, attempt?: number) => HostedFlowState;
+    readonly redirecting: (reference: string, attempt?: number) => HostedFlowState;
+    readonly awaitingCallback: (reference: string, attempt?: number) => HostedFlowState;
+    readonly succeeded: (args: {
+        reference: string;
+        report?: PaymentReturnReport;
+        attempt?: number;
+    }) => HostedFlowState;
+    readonly failed: (args: {
+        reference: string;
+        errorCode: string;
+        report?: PaymentReturnReport;
+        attempt?: number;
+    }) => HostedFlowState;
+    readonly cancelled: (reference: string, attempt?: number) => HostedFlowState;
+    readonly abandoned: (reference: string, attempt?: number) => HostedFlowState;
+};
+//# sourceMappingURL=hosted-flow-state.d.ts.map

package/lib/typescript/module/core/services/hosted-flow-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-flow-state.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAiC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,MAAM,eAAe;AACzB,6DAA6D;AAC3D,SAAS;AACX,mEAAmE;GACjE,QAAQ;AACV;;;;;;GAMG;GACD,aAAa;AACf,yEAAyE;GACvE,aAAa;AACf,4EAA4E;GAC1E,kBAAkB,GAClB,WAAW,GACX,QAAQ,GACR,WAAW;AACb,0DAA0D;GACxD,WAAW,CAAC;AAEhB,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAE/D;AAED,wEAAwE;AACxE,eAAO,MAAM,gBAAgB;kCACR,MAAM,uBAAgB,eAAe;iCAGtC,MAAM,uBAAgB,eAAe;sCAGhC,MAAM,uBAAgB,eAAe;sCAGrC,MAAM,uBAAgB,eAAe;2CAGhC,MAAM,uBAAgB,eAAe;+BAGjD;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KAAG,eAAe;4BAQN;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KAAG,eAAe;oCASE,MAAM,uBAAgB,eAAe;oCAGrC,MAAM,uBAAgB,eAAe;CAGlD,CAAC"}

package/lib/typescript/module/index.d.ts

@@ -1,19 +1,10 @@
 export { SDK_VERSION } from './version.js';
 export * from './public/index.js';
-export { PaymentApiError, isPaymentApiError } from './core/errors/payment-api-error.js';
-export type { CreatePaymentRequestInput, AmountDto, PaymentInstructions, PaymentScheduleEntry, PeriodicSchedule, PeriodicControls, CurrencyRequest, LinkSessionResponse, ConsentResponse, LinkStatusResponse, CopResponse, TelemetryResponse, PatchTokenResponse, ProviderCountry, ProviderSummary, PendingSessionRecord, } from './core/models/index.js';
-export { isPaymentReturnCallbackUri, extractPaymentReturnErrorCode, } from './core/models/payment-return-params.js';
-export { LinkApiClient, type LinkApiClientOptions } from './core/client/link-api-client.js';
-export { PaymentFlowController, type PaymentFlowControllerOptions, type Clock, } from './core/services/payment-flow-controller.js';
-export { PaymentFlowStates, type PaymentFlowPhase, type PaymentFlowState, } from './core/services/payment-flow-state.js';
+export { type PaymentReturnReport, isPaymentReturnCallbackUri, readPaymentReturn, extractPaymentReturnErrorCode, extractPaymentReturnErrorDescription, extractPaymentReturnErrorReason, extractPaymentReturnPaymentId, extractPaymentReturnMandateId, extractPaymentReturnReference, extractPaymentReturnMerchantRef, extractPaymentReturnSignature, isPaymentReturnSuccess, paymentReturnParams, } from './core/models/payment-return-params.js';
+export type { HostedFlowPhase, HostedFlowState } from './core/services/hosted-flow-state.js';
 export type { PendingSessionStore } from './core/services/pending-session-store.js';
-export { presentConsent, summaryFromState, formatAmount, formatCop, type ConsentSummaryData, type SinglePaymentSummaryData, type InternationalPaymentSummaryData, type MultiPaymentSummaryData, type ConsentDisplayData, type CopDisplayData, type CopMatchIndicator, } from './core/services/consent-presenter.js';
-export { buildMultiPaymentRules, rulesSectionTitle, type LabelValueRow, } from './core/services/multi-payment-rules-presenter.js';
-export { isMultiPayment, isInternational, supportsConfirmationOfPayee, resolvedPaymentType, consentUiVariant, PaymentType, type ConsentUiVariant, } from './core/models/payment-type.js';
-export { SpareLinkHost, type SpareLinkHostProps, } from './ui/spare-link-host.js';
-export { PaymentFlowPage, type PaymentFlowPageProps } from './ui/payment-flow-page.js';
-export { usePaymentFlowState } from './ui/hooks/use-payment-flow-state.js';
-export { BankSelectionScreen, type BankSelectionScreenProps, ConsentDetailsScreen, type ConsentDetailsScreenProps, RedirectHandoffScreen, ResumeProcessingScreen, type ResumeProcessingScreenProps, ResultScreen, type ResultScreenProps, MandateSetupSuccessScreen, type MandateSetupSuccessScreenProps, } from './ui/screens/index.js';
+export type { PendingSessionRecord } from './core/models/index.js';
+export { SpareLinkHost, type SpareLinkHostProps } from './ui/spare-link-host.js';
 export { Colors, Typography, Spacing, FONT_FAMILY } from './ui/theme/index.js';
-export { collectTelemetry, launchBankRedirect, type BankRedirectArgs, SecureStorePendingSessionStore, useSpareLinkDeepLinks, } from './internal/index.js';
+export { launchBankRedirect, type BankRedirectArgs, SecureStorePendingSessionStore, useSpareLinkDeepLinks, } from './internal/index.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAW,CAAC;AAExC,cAAc,mBAAU,CAAC;AAGzB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,oCAAiC,CAAC;AAGrF,YAAY,EACV,yBAAyB,EACzB,SAAS,EACT,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAe,CAAC;AAIvB,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,wCAAqC,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,kCAA+B,CAAC;AAGzF,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,KAAK,KAAK,GACX,MAAM,4CAAyC,CAAC;AACjD,OAAO,EACL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,uCAAoC,CAAC;AAG5C,YAAY,EAAE,mBAAmB,EAAE,MAAM,0CAAuC,CAAC;AAGjF,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,sCAAmC,CAAC;AAE3C,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,kDAA+C,CAAC;AAEvD,OAAO,EACL,cAAc,EACd,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,KAAK,gBAAgB,GACtB,MAAM,+BAA4B,CAAC;AAGpC,OAAO,EACL,aAAa,EACb,KAAK,kBAAkB,GACxB,MAAM,yBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,2BAAwB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAmC,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,YAAY,EACZ,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,KAAK,8BAA8B,GACpC,MAAM,uBAAc,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAY,CAAC;AAGtE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,qBAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAW,CAAC;AAExC,cAAc,mBAAU,CAAC;AAIzB,OAAO,EACL,KAAK,mBAAmB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,6BAA6B,EAC7B,oCAAoC,EACpC,+BAA+B,EAC/B,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,6BAA6B,EAC7B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,wCAAqC,CAAC;AAO7C,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sCAAmC,CAAC;AAG1F,YAAY,EAAE,mBAAmB,EAAE,MAAM,0CAAuC,CAAC;AACjF,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAe,CAAC;AAG1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAsB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAY,CAAC;AAGtE,OAAO,EACL,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,qBAAY,CAAC"}

package/lib/typescript/module/internal/hosted/bridge-message.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Messages the hosted payment page sends to this SDK.
+ *
+ * The contract is one-way. The page never waits on a reply, so a message this
+ * version does not recognise is dropped rather than treated as a failure — the
+ * page continues, and a newer page stays usable by an older app.
+ *
+ * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
+ * which arrives here as `event.nativeEvent.data`.
+ */
+export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError;
+/** The payable page is interactive. */
+export interface HostedReady {
+    readonly type: 'ready';
+}
+/**
+ * A consent exists and the bank must now be opened outside the WebView.
+ *
+ * Banks commonly refuse to serve their authorization pages inside an embedded
+ * browser, and the address bar is what lets a payer tell a real bank page from
+ * a convincing copy.
+ */
+export interface HostedOpenUrl {
+    readonly type: 'openUrl';
+    readonly url: string;
+}
+/** The payer cancelled, and the request is already rejected server-side. */
+export interface HostedCancel {
+    readonly type: 'cancel';
+}
+/** The flow cannot continue. [code] is the key the page itself renders. */
+export interface HostedError {
+    readonly type: 'error';
+    readonly code: string;
+}
+/**
+ * Parses a message posted by the hosted page.
+ *
+ * Returns null for anything unrecognised. The message crosses a boundary the
+ * SDK does not control, so nothing here trusts its shape — the WebView message
+ * channel is shared with every script on the page.
+ */
+export declare function parseHostedBridgeMessage(raw: unknown): HostedBridgeMessage | null;
+//# sourceMappingURL=bridge-message.d.ts.map

package/lib/typescript/module/internal/hosted/bridge-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,WAAW,CAAC;AAE3F,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAyBjF"}

package/lib/typescript/module/internal/hosted/hosted-url.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Origin channel this SDK identifies as to the hosted page.
+ *
+ * The same value must be recorded on the payment request by the merchant's
+ * backend, because the bank redirect that completes a payment carries no query
+ * string of ours and the return path is decided from the stored row.
+ */
+export declare const HOSTED_ORIGIN_CHANNEL = "sdk_react_native";
+/**
+ * Builds the hosted payment page URL for a payment request reference.
+ *
+ * The reference is the only credential the page needs; everything else is
+ * resolved server-side from the row it names.
+ */
+export declare function buildHostedPaymentUrl(args: {
+    baseUrl: string;
+    reference: string;
+}): string;
+/**
+ * Whether [url] belongs to the hosted origin derived from [baseUrl].
+ *
+ * The WebView loads only the hosted origin. Bank authentication deliberately
+ * happens outside it, so anything else navigating in-frame is refused rather
+ * than followed.
+ */
+export declare function isHostedOriginUrl(args: {
+    baseUrl: string;
+    url: string;
+}): boolean;
+//# sourceMappingURL=hosted-url.d.ts.map

package/lib/typescript/module/internal/hosted/hosted-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-url.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/hosted-url.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAI1F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAEjF"}

package/lib/typescript/module/internal/index.d.ts

@@ -1,4 +1,3 @@
-export { collectTelemetry } from './telemetry-collector.js';
 export { launchBankRedirect, type BankRedirectArgs } from './bank-redirect.js';
 export { SecureStorePendingSessionStore } from './secure-store-pending-session-store.js';
 export { useSpareLinkDeepLinks } from './deep-link-listener.js';

package/lib/typescript/module/internal/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/internal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAiB,CAAC;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAsC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/internal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAiB,CAAC;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAsC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAsB,CAAC"}

package/lib/typescript/module/internal/redact-uri.d.ts

@@ -1,3 +1,23 @@
-/** Redacts sensitive query params before logging bank-return URIs. */
+/**
+ * Redacts the query of a bank-return URI before it is logged.
+ *
+ * Every value goes except the few that describe the outcome rather than identify
+ * anyone — see {@link KEPT_KEYS}. Redaction is a denylist by default rather than
+ * an allowlist of names to remove: an earlier version named the two keys to
+ * redact, so anything else the return ever carried was logged in full, and one of
+ * the names it knew (`exchange_code`) is not even in the contract any more.
+ *
+ * What is worth keeping in a log is the shape of the URI — its scheme, its path,
+ * which parameters were present — plus enough to explain the outcome.
+ *
+ * It also cannot use the global `URL`. React Native's is a stub whose
+ * `searchParams` returns a fresh empty instance, so `has()` was always false and
+ * this function returned the URI untouched on a device while redacting correctly
+ * under Jest, which runs on Node.
+ *
+ * The query is split here rather than read through `parseQueryParams`, because
+ * that decodes values and keeps only the first of a repeated key — fine for
+ * reading an outcome, wrong for reproducing a URI whose shape is the point.
+ */
 export declare function redactPaymentReturnUri(uri: string): string;
 //# sourceMappingURL=redact-uri.d.ts.map

package/lib/typescript/module/internal/redact-uri.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact-uri.d.ts","sourceRoot":"","sources":["../../../../src/internal/redact-uri.ts"],"names":[],"mappings":"AAEA,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAc1D"}
+{"version":3,"file":"redact-uri.d.ts","sourceRoot":"","sources":["../../../../src/internal/redact-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAmBH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgC1D"}

package/lib/typescript/module/internal/secure-store-pending-session-store.d.ts

@@ -1,6 +1,7 @@
 /**
- * Production `PendingSessionStore` backed by expo-secure-store. Persists a
- * single in-flight payment session so the SDK can recover after cold start.
+ * Production `PendingSessionStore` backed by expo-secure-store. Persists the
+ * reference of a single in-flight payment so a cold start knows which payment
+ * was under way.
  */
 import type { PendingSessionRecord } from '../core/models/index.js';
 import type { PendingSessionStore } from '../core/services/pending-session-store.js';

package/lib/typescript/module/internal/secure-store-pending-session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-store-pending-session-store.d.ts","sourceRoot":"","sources":["../../../../src/internal/secure-store-pending-session-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAAwC,CAAC;AAclF,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAcD,qBAAa,8BAA+B,YAAW,mBAAmB;IACxE,OAAO,CAAC,WAAW,CAA2C;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D;;;OAGG;IACH,OAAO,CAAC,UAAU,CAAoC;IAEtD;;;;OAIG;gBACS,YAAY,GAAE,MAAM,OAAO,CAAC,iBAAiB,CAAiB;IAI1E,OAAO,KAAK,MAAM,GAGjB;IAED,kEAAkE;IAClE,OAAO,CAAC,YAAY;IAQpB,IAAI,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB3C,IAAI,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6BlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAavB"}
+{"version":3,"file":"secure-store-pending-session-store.d.ts","sourceRoot":"","sources":["../../../../src/internal/secure-store-pending-session-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAAwC,CAAC;AAwBlF,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAcD,qBAAa,8BAA+B,YAAW,mBAAmB;IACxE,OAAO,CAAC,WAAW,CAA2C;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D;;;OAGG;IACH,OAAO,CAAC,UAAU,CAAoC;IAEtD;;;;OAIG;gBACS,YAAY,GAAE,MAAM,OAAO,CAAC,iBAAiB,CAAiB;IAI1E,OAAO,KAAK,MAAM,GAGjB;IAED,kEAAkE;IAClE,OAAO,CAAC,YAAY;IAQpB,IAAI,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3C,IAAI,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAYlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CASvB"}

package/lib/typescript/module/internal/url-parts.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Minimal URL parsing that does not go through the global `URL`.
+ *
+ * React Native ships a stub: every component accessor — `protocol`, `hostname`,
+ * `port`, `origin`, `search`, `pathname` — throws "not implemented", and
+ * `searchParams` returns a fresh empty instance that never reads the URL it was
+ * constructed from (`react-native/Libraries/Blob/URL.js`, installed globally by
+ * `setUpXHR.js`). Code written against the standard therefore behaves correctly
+ * under Jest, which runs on Node's real `URL`, and silently reads nothing on a
+ * device.
+ *
+ * The SDK parses what it needs itself rather than asking the host app to install
+ * a polyfill whose presence it cannot verify — an origin check that quietly
+ * stops comparing hosts is worse than one that was never written.
+ */
+/** The parts of a URL this SDK compares origins on. */
+export interface UrlParts {
+    /** Lower-cased, without the trailing colon. */
+    scheme: string;
+    /** Lower-cased host, without userinfo. IPv6 hosts keep their brackets. */
+    host: string;
+    /** The explicit port, or the scheme's default where it has one. */
+    port: number | undefined;
+}
+/**
+ * Splits [url] into the parts an origin comparison needs, or null if it has no
+ * authority to compare.
+ */
+export declare function parseUrlParts(url: string): UrlParts | null;
+/**
+ * Whether two URLs share a scheme, host and port.
+ *
+ * Both must carry an authority, so a relative path never matches an absolute
+ * URL: `/link/payment/x` names no origin and must not be read as naming this one.
+ */
+export declare function isSameOrigin(a: string, b: string): boolean;
+/**
+ * Reads the query string of [url] into a plain object.
+ *
+ * The first occurrence of a repeated key wins, matching `URLSearchParams.get`.
+ * A value the SDK cannot decode is kept in its raw form rather than dropping the
+ * parameter: callers compare against known literals, and a mangled value should
+ * fail that comparison rather than read as absent.
+ */
+export declare function parseQueryParams(url: string): Record<string, string>;
+//# sourceMappingURL=url-parts.d.ts.map

package/lib/typescript/module/internal/url-parts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-parts.d.ts","sourceRoot":"","sources":["../../../../src/internal/url-parts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACvB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAOD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CA0B1D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBpE"}

package/lib/typescript/module/public/index.d.ts

@@ -1,11 +1,9 @@
-export { type PaymentEnvironment, type SpareApiTenant, type SpareLinkConfig, type SpareLinkResumeConfig, defaultBaseUrlFor, tenantCountryCode, resolvedBaseUrl, resolvedResumeBaseUrl, assertValidConfig, } from './spare-link-config.js';
-export { type SpareLinkEvent, type SpareLinkEventType, type SpareLinkInitialized, type SpareLinkSessionLoaded, type SpareLinkConsentStarted, type SpareLinkRedirectToBank, type SpareLinkBankCallbackReceived, type SpareLinkSucceeded, type SpareLinkFailed, type SpareLinkCancelled, type SpareLinkAbandoned, SPARE_LINK_EVENT_TYPES, isSpareLinkEvent, SpareLinkEvents, } from './spare-link-event.js';
+export { type PaymentEnvironment, type SpareApiTenant, type SpareLinkConfig, defaultBaseUrlFor, tenantCountryCode, resolvedBaseUrl, assertValidConfig, } from './spare-link-config.js';
+export { type SpareLinkEvent, type SpareLinkEventType, type SpareLinkInitialized, type SpareLinkPageReady, type SpareLinkRedirectToBank, type SpareLinkBankCallbackReceived, type SpareLinkSucceeded, type SpareLinkFailed, type SpareLinkCancelled, type SpareLinkAbandoned, SPARE_LINK_EVENT_TYPES, isSpareLinkEvent, SpareLinkEvents, } from './spare-link-event.js';
 export { type PaymentStatus, type PaymentResult, type PaymentSuccess, type PaymentCancelled, type PaymentFailed, type PaymentAbandoned, paymentSuccess, paymentCancelled, paymentFailed, paymentAbandoned, } from './payment-result.js';
-export type { SpareLinkCallbacks, SpareLinkSuccessCallback, SpareLinkExitCallback, SpareLinkEventCallback, } from './spare-link-callbacks.js';
-export type { RecoveryResult, NoRecoveryReason, NoRecoveryNeeded, SessionRecovered, RecoveryAwaitingUser, } from './recovery-result.js';
-export { isSessionRecovered, isNoRecoveryNeeded, isRecoveryAwaitingUser, } from './recovery-result.js';
+export type { RecoveryResult, NoRecoveryReason, NoRecoveryNeeded, SessionRecovered, } from './recovery-result.js';
+export { isSessionRecovered, isNoRecoveryNeeded } from './recovery-result.js';
 export { SpareLinkSession } from './spare-link-session.js';
 export { SpareLink, type SpareLinkOptions } from './spare-link-instance.js';
-export { kMaxRecoveryAttempts, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_AWAITING_CALLBACK_TIMEOUT_MS, DEFAULT_AWAITING_CALLBACK_POLL_MS, } from './constants.js';
 export { configureSpareLinkLogging, createLogger, type SpareLinkLogLevel, type SpareLinkLogRecord, type SpareLinkLogSink, type SpareLinkLogger, } from '../internal/logger.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/public/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/public/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,GAChB,MAAM,uBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GACjB,MAAM,qBAAkB,CAAC;AAE1B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,2BAAwB,CAAC;AAEhC,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAmB,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAsB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAEzE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,gBAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,uBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/public/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAClB,MAAM,wBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,GAChB,MAAM,uBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GACjB,MAAM,qBAAkB,CAAC;AAE1B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,sBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAmB,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAsB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAEzE,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,uBAAoB,CAAC"}

package/lib/typescript/module/public/payment-result.d.ts

@@ -1,26 +1,59 @@
 /**
  * Terminal outcome of a payment flow — narrow on the `status` field.
+ *
+ * Every result here is read off a deep link, which is interceptable by design
+ * and names no bank identifiers. It reports what happened rather than attesting
+ * to it: confirm with your backend via `GET /payment-requests/{reference}`
+ * before acting on one.
  */
 export type PaymentStatus = 'success' | 'cancelled' | 'failed' | 'abandoned';
 interface PaymentResultBase {
     status: PaymentStatus;
-    /** The `link_token` JWS that identifies this payment flow. Mirrors Flutter's `linkToken`. */
-    linkToken: string;
-    bankId?: string;
-    linkSessionId?: string;
+    /** The payment request this flow was paying, and what your backend reads the
+     *  authoritative result by. */
+    reference: string;
+    /** The merchant's own reference for the attempt, when the return named one. */
+    merchantRef?: string;
+    /**
+     * Spare's identifier for the payment, present on a reported success.
+     *
+     * Distinct from `reference`, which names the request. This is what an order
+     * records.
+     */
+    paymentId?: string;
+    /**
+     * Spare's identifier for a mandate, present when the flow created one.
+     *
+     * A return names a payment or a mandate, never both. Read whichever is set
+     * rather than assuming which the flow produced.
+     */
+    mandateId?: string;
+    /**
+     * The return's signature: an ES256 JWS whose payload is the return URL, every
+     * parameter included.
+     *
+     * The only part of the return that cannot be forged. Verify it against Spare's
+     * public key on your backend before acting on the outcome — the SDK holds no
+     * keys and passes it through unchecked.
+     */
+    signature?: string;
+    /**
+     * The machine-readable reason a payment did not complete, e.g. `user_cancelled`.
+     *
+     * Alongside `errorCode`, which is often generic where this is not.
+     */
+    errorReason?: string;
     message?: string;
     errorCode?: string;
     resolvedAtMs?: number;
 }
-/** Payment completed at the bank. `exchangeCode` may be null when recovered
- * via status polling (the bank delivered the code straight to the merchant
- * backend, bypassing the SDK). */
+/**
+ * The return reported a completed payment.
+ *
+ * Treat this as a prompt to confirm with your backend, not as settlement.
+ */
 export interface PaymentSuccess extends PaymentResultBase {
     status: 'success';
-    exchangeCode?: string;
-    merchantRef?: string;
-    /** API payment type string (e.g. `FixedPeriodicSchedule`), when available. Mirrors Flutter's `paymentType`. */
-    paymentType?: string;
 }
 export interface PaymentCancelled extends PaymentResultBase {
     status: 'cancelled';
@@ -30,7 +63,12 @@ export interface PaymentFailed extends PaymentResultBase {
     status: 'failed';
     errorCode: string;
 }
-/** Flow abandoned mid-flight (app killed, host removed the SDK navigator). */
+/**
+ * The payer left before the flow resolved either way.
+ *
+ * A payment already at the bank may still complete after this, so it is not a
+ * failure — only your backend knows how it ended.
+ */
 export interface PaymentAbandoned extends PaymentResultBase {
     status: 'abandoned';
 }

package/lib/typescript/module/public/payment-result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payment-result.d.ts","sourceRoot":"","sources":["../../../../src/public/payment-result.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE7E,UAAU,iBAAiB;IACzB,MAAM,EAAE,aAAa,CAAC;IACtB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;kCAEkC;AAClC,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,MAAM,EAAE,QAAQ,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAIjG,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,cAAc,CAEnF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,gBAAgB,CAEzF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,aAAa,CAEhF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,gBAAgB,CAEzF"}
+{"version":3,"file":"payment-result.d.ts","sourceRoot":"","sources":["../../../../src/public/payment-result.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE7E,UAAU,iBAAiB;IACzB,MAAM,EAAE,aAAa,CAAC;IACtB;mCAC+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,MAAM,EAAE,QAAQ,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAIjG,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,cAAc,CAEnF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,gBAAgB,CAEzF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,aAAa,CAEhF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,gBAAgB,CAEzF"}

package/lib/typescript/module/public/recovery-result.d.ts

@@ -1,36 +1,27 @@
 import type { PaymentResult } from './payment-result.js';
 /**
  * Why {@link SpareLink.resumeIfNeeded} did not recover a terminal session.
- * Mirrors Flutter's `NoRecoveryReason`.
- */
-export type NoRecoveryReason = 'noPendingSession' | 'flowAlreadyActive' | 'persistenceUnavailable';
-/**
- * Outcome of {@link SpareLink.resumeIfNeeded}.
  *
- * Discriminated union aligned with Flutter's sealed `RecoveryResult`.
+ * `outcomeUnknown` is the one that carries weight: a payment was pending and no
+ * return arrived, so **it may have completed**. The SDK holds no credentials and
+ * has nothing to ask with — the reference is handed back for your backend to
+ * resolve.
  */
-export type RecoveryResult = NoRecoveryNeeded | SessionRecovered | RecoveryAwaitingUser;
-/** No pending session was recovered. */
+export type NoRecoveryReason = 'noPendingSession' | 'flowAlreadyActive' | 'persistenceUnavailable' | 'outcomeUnknown';
+/** Outcome of {@link SpareLink.resumeIfNeeded}. */
+export type RecoveryResult = NoRecoveryNeeded | SessionRecovered;
+/** No pending payment was resolved to a terminal outcome. */
 export interface NoRecoveryNeeded {
     readonly kind: 'none';
     readonly reason: NoRecoveryReason;
+    /** The pending payment's reference, when `reason` is `outcomeUnknown`. */
+    readonly reference?: string;
 }
-/** A pending session was recovered to a terminal {@link PaymentResult}. */
+/** A pending payment was resolved to a terminal {@link PaymentResult}. */
 export interface SessionRecovered {
     readonly kind: 'recovered';
     readonly result: PaymentResult;
 }
-/**
- * A pending session is non-terminal and the SDK opened its recovery UI —
- * the integrator should treat this as in-progress, not "nothing happened".
- * The terminal outcome arrives later via `SpareLink.events` /
- * `spareLink.emitTerminal`, not as a second `resumeIfNeeded` resolution.
- */
-export interface RecoveryAwaitingUser {
-    readonly kind: 'awaitingUser';
-    readonly linkToken: string;
-}
 export declare function isSessionRecovered(r: RecoveryResult): r is SessionRecovered;
 export declare function isNoRecoveryNeeded(r: RecoveryResult): r is NoRecoveryNeeded;
-export declare function isRecoveryAwaitingUser(r: RecoveryResult): r is RecoveryAwaitingUser;
 //# sourceMappingURL=recovery-result.d.ts.map

package/lib/typescript/module/public/recovery-result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery-result.d.ts","sourceRoot":"","sources":["../../../../src/public/recovery-result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAkB,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,wBAAwB,CAAC;AAEnG;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAExF,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,IAAI,gBAAgB,CAE3E;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,IAAI,gBAAgB,CAE3E;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,IAAI,oBAAoB,CAEnF"}
+{"version":3,"file":"recovery-result.d.ts","sourceRoot":"","sources":["../../../../src/public/recovery-result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAkB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,mBAAmB,GACnB,wBAAwB,GACxB,gBAAgB,CAAC;AAErB,mDAAmD;AACnD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAEjE,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,IAAI,gBAAgB,CAE3E;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,IAAI,gBAAgB,CAE3E"}

package/lib/typescript/module/public/spare-link-config.d.ts

@@ -1,49 +1,31 @@
 /**
- * Deployment environment for the Spare Link API.
- *
- * Each value maps to a default base URL
- * the SDK will hit unless `baseUrl` is overridden in {@link SpareLinkConfig}.
+ * Deployment environment for the Spare Link API, which is also where the hosted
+ * payment page is served from.
  */
-export type PaymentEnvironment = 'sandbox' | 'production';
+export type PaymentEnvironment = 'local' | 'dev' | 'sandbox' | 'production';
 export declare function defaultBaseUrlFor(env: PaymentEnvironment): string;
 /** Spare API tenant — one country per tenant. */
 export type SpareApiTenant = 'ksa' | 'uae' | 'bah';
 export declare function tenantCountryCode(t: SpareApiTenant): string;
-/** Configuration to start a Spare Link payment flow. */
+/** Configuration for a Spare Link instance. */
 export interface SpareLinkConfig {
-    /** One-time link token minted by the merchant backend via POST /link/token/payment. */
-    linkToken: string;
-    /** Target environment (sandbox vs production). */
+    /** Target environment. Selects the host the hosted page is loaded from. */
     environment: PaymentEnvironment;
-    /** Tenant (country). */
-    tenant: SpareApiTenant;
     /**
-     * Override the base URL. Set only for local dev (e.g. `http://localhost:4000`)
-     * — production should rely on the environment-derived default.
+     * Tenant (country). The hosted flow currently serves UAE only; the value is
+     * kept for that selection and for the tenants that follow.
      */
+    tenant: SpareApiTenant;
+    /** Override the host. Set for a physical device pointed at a local API. */
     baseUrl?: string;
-    /**
-     * Inject a custom fetch implementation for advanced cases (cert pinning,
-     * request logging). Defaults to `globalThis.fetch`.
-     */
-    fetch?: typeof fetch;
-    /** Per-request timeout in milliseconds. Defaults to 15000. */
-    requestTimeoutMs?: number;
 }
 /** Resolved base URL: explicit `baseUrl` if provided, else the environment default. */
 export declare function resolvedBaseUrl(config: SpareLinkConfig): string;
 /**
- * Recovery config — like {@link SpareLinkConfig} but without `linkToken`
- * (read from the persisted record).
+ * Throws if a config cannot be honoured.
+ *
+ * Called from {@link SpareLink}'s constructor, so a bad value fails where it was
+ * written rather than reaching the webview as a URL nobody meant.
  */
-export interface SpareLinkResumeConfig {
-    environment: PaymentEnvironment;
-    tenant: SpareApiTenant;
-    baseUrl?: string;
-    fetch?: typeof fetch;
-    requestTimeoutMs?: number;
-}
-export declare function resolvedResumeBaseUrl(config: SpareLinkResumeConfig): string;
-/** Throws if a SpareLinkConfig is structurally invalid. */
 export declare function assertValidConfig(config: SpareLinkConfig): void;
 //# sourceMappingURL=spare-link-config.d.ts.map

package/lib/typescript/module/public/spare-link-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spare-link-config.d.ts","sourceRoot":"","sources":["../../../../src/public/spare-link-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,YAAY,CAAC;AAO1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAEjE;AAED,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAQnD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAElB,kDAAkD;IAClD,WAAW,EAAE,kBAAkB,CAAC;IAEhC,wBAAwB;IACxB,MAAM,EAAE,cAAc,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAErB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAE/D;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,kBAAkB,CAAC;IAChC,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAE3E;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAO/D"}
+{"version":3,"file":"spare-link-config.d.ts","sourceRoot":"","sources":["../../../../src/public/spare-link-config.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AA+B5E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAEjE;AAED,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAQnD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAE3D;AAED,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,WAAW,EAAE,kBAAkB,CAAC;IAEhC;;;OAGG;IACH,MAAM,EAAE,cAAc,CAAC;IAEvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAE/D;AAWD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAU/D"}