@spare-technologies/spare-link 0.1.0-beta.0 → 1.0.0

package/lib/commonjs/index.js

@@ -5,125 +5,37 @@ Object.defineProperty(exports, "__esModule", {
 });
 var _exportNames = {
   SDK_VERSION: true,
-  PaymentApiError: true,
-  isPaymentApiError: true,
   isPaymentReturnCallbackUri: true,
+  readPaymentReturn: true,
   extractPaymentReturnErrorCode: true,
-  LinkApiClient: true,
-  PaymentFlowController: true,
-  PaymentFlowStates: true,
-  presentConsent: true,
-  summaryFromState: true,
-  formatAmount: true,
-  formatCop: true,
-  buildMultiPaymentRules: true,
-  rulesSectionTitle: true,
-  isMultiPayment: true,
-  isInternational: true,
-  supportsConfirmationOfPayee: true,
-  resolvedPaymentType: true,
-  consentUiVariant: true,
-  PaymentType: true,
+  extractPaymentReturnErrorDescription: true,
+  extractPaymentReturnErrorReason: true,
+  extractPaymentReturnPaymentId: true,
+  extractPaymentReturnMandateId: true,
+  extractPaymentReturnReference: true,
+  extractPaymentReturnMerchantRef: true,
+  extractPaymentReturnSignature: true,
+  isPaymentReturnSuccess: true,
+  paymentReturnParams: true,
   SpareLinkHost: true,
-  PaymentFlowPage: true,
-  usePaymentFlowState: true,
-  BankSelectionScreen: true,
-  ConsentDetailsScreen: true,
-  RedirectHandoffScreen: true,
-  ResumeProcessingScreen: true,
-  ResultScreen: true,
-  MandateSetupSuccessScreen: true,
   Colors: true,
   Typography: true,
   Spacing: true,
   FONT_FAMILY: true,
-  collectTelemetry: true,
   launchBankRedirect: true,
   SecureStorePendingSessionStore: true,
   useSpareLinkDeepLinks: true
 };
-Object.defineProperty(exports, "BankSelectionScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.BankSelectionScreen;
-  }
-});
 Object.defineProperty(exports, "Colors", {
   enumerable: true,
   get: function () {
-    return _index3.Colors;
-  }
-});
-Object.defineProperty(exports, "ConsentDetailsScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.ConsentDetailsScreen;
+    return _index2.Colors;
   }
 });
 Object.defineProperty(exports, "FONT_FAMILY", {
   enumerable: true,
   get: function () {
-    return _index3.FONT_FAMILY;
-  }
-});
-Object.defineProperty(exports, "LinkApiClient", {
-  enumerable: true,
-  get: function () {
-    return _linkApiClient.LinkApiClient;
-  }
-});
-Object.defineProperty(exports, "MandateSetupSuccessScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.MandateSetupSuccessScreen;
-  }
-});
-Object.defineProperty(exports, "PaymentApiError", {
-  enumerable: true,
-  get: function () {
-    return _paymentApiError.PaymentApiError;
-  }
-});
-Object.defineProperty(exports, "PaymentFlowController", {
-  enumerable: true,
-  get: function () {
-    return _paymentFlowController.PaymentFlowController;
-  }
-});
-Object.defineProperty(exports, "PaymentFlowPage", {
-  enumerable: true,
-  get: function () {
-    return _paymentFlowPage.PaymentFlowPage;
-  }
-});
-Object.defineProperty(exports, "PaymentFlowStates", {
-  enumerable: true,
-  get: function () {
-    return _paymentFlowState.PaymentFlowStates;
-  }
-});
-Object.defineProperty(exports, "PaymentType", {
-  enumerable: true,
-  get: function () {
-    return _paymentType.PaymentType;
-  }
-});
-Object.defineProperty(exports, "RedirectHandoffScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.RedirectHandoffScreen;
-  }
-});
-Object.defineProperty(exports, "ResultScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.ResultScreen;
-  }
-});
-Object.defineProperty(exports, "ResumeProcessingScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.ResumeProcessingScreen;
+    return _index2.FONT_FAMILY;
   }
 });
 Object.defineProperty(exports, "SDK_VERSION", {
@@ -135,13 +47,13 @@ Object.defineProperty(exports, "SDK_VERSION", {
 Object.defineProperty(exports, "SecureStorePendingSessionStore", {
   enumerable: true,
   get: function () {
-    return _index4.SecureStorePendingSessionStore;
+    return _index3.SecureStorePendingSessionStore;
   }
 });
 Object.defineProperty(exports, "Spacing", {
   enumerable: true,
   get: function () {
-    return _index3.Spacing;
+    return _index2.Spacing;
   }
 });
 Object.defineProperty(exports, "SpareLinkHost", {
@@ -153,25 +65,7 @@ Object.defineProperty(exports, "SpareLinkHost", {
 Object.defineProperty(exports, "Typography", {
   enumerable: true,
   get: function () {
-    return _index3.Typography;
-  }
-});
-Object.defineProperty(exports, "buildMultiPaymentRules", {
-  enumerable: true,
-  get: function () {
-    return _multiPaymentRulesPresenter.buildMultiPaymentRules;
-  }
-});
-Object.defineProperty(exports, "collectTelemetry", {
-  enumerable: true,
-  get: function () {
-    return _index4.collectTelemetry;
-  }
-});
-Object.defineProperty(exports, "consentUiVariant", {
-  enumerable: true,
-  get: function () {
-    return _paymentType.consentUiVariant;
+    return _index2.Typography;
   }
 });
 Object.defineProperty(exports, "extractPaymentReturnErrorCode", {
@@ -180,88 +74,82 @@ Object.defineProperty(exports, "extractPaymentReturnErrorCode", {
     return _paymentReturnParams.extractPaymentReturnErrorCode;
   }
 });
-Object.defineProperty(exports, "formatAmount", {
+Object.defineProperty(exports, "extractPaymentReturnErrorDescription", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.formatAmount;
+    return _paymentReturnParams.extractPaymentReturnErrorDescription;
   }
 });
-Object.defineProperty(exports, "formatCop", {
+Object.defineProperty(exports, "extractPaymentReturnErrorReason", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.formatCop;
+    return _paymentReturnParams.extractPaymentReturnErrorReason;
   }
 });
-Object.defineProperty(exports, "isInternational", {
+Object.defineProperty(exports, "extractPaymentReturnMandateId", {
   enumerable: true,
   get: function () {
-    return _paymentType.isInternational;
+    return _paymentReturnParams.extractPaymentReturnMandateId;
   }
 });
-Object.defineProperty(exports, "isMultiPayment", {
+Object.defineProperty(exports, "extractPaymentReturnMerchantRef", {
   enumerable: true,
   get: function () {
-    return _paymentType.isMultiPayment;
+    return _paymentReturnParams.extractPaymentReturnMerchantRef;
   }
 });
-Object.defineProperty(exports, "isPaymentApiError", {
+Object.defineProperty(exports, "extractPaymentReturnPaymentId", {
   enumerable: true,
   get: function () {
-    return _paymentApiError.isPaymentApiError;
+    return _paymentReturnParams.extractPaymentReturnPaymentId;
   }
 });
-Object.defineProperty(exports, "isPaymentReturnCallbackUri", {
+Object.defineProperty(exports, "extractPaymentReturnReference", {
   enumerable: true,
   get: function () {
-    return _paymentReturnParams.isPaymentReturnCallbackUri;
+    return _paymentReturnParams.extractPaymentReturnReference;
   }
 });
-Object.defineProperty(exports, "launchBankRedirect", {
-  enumerable: true,
-  get: function () {
-    return _index4.launchBankRedirect;
-  }
-});
-Object.defineProperty(exports, "presentConsent", {
+Object.defineProperty(exports, "extractPaymentReturnSignature", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.presentConsent;
+    return _paymentReturnParams.extractPaymentReturnSignature;
   }
 });
-Object.defineProperty(exports, "resolvedPaymentType", {
+Object.defineProperty(exports, "isPaymentReturnCallbackUri", {
   enumerable: true,
   get: function () {
-    return _paymentType.resolvedPaymentType;
+    return _paymentReturnParams.isPaymentReturnCallbackUri;
   }
 });
-Object.defineProperty(exports, "rulesSectionTitle", {
+Object.defineProperty(exports, "isPaymentReturnSuccess", {
   enumerable: true,
   get: function () {
-    return _multiPaymentRulesPresenter.rulesSectionTitle;
+    return _paymentReturnParams.isPaymentReturnSuccess;
   }
 });
-Object.defineProperty(exports, "summaryFromState", {
+Object.defineProperty(exports, "launchBankRedirect", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.summaryFromState;
+    return _index3.launchBankRedirect;
   }
 });
-Object.defineProperty(exports, "supportsConfirmationOfPayee", {
+Object.defineProperty(exports, "paymentReturnParams", {
   enumerable: true,
   get: function () {
-    return _paymentType.supportsConfirmationOfPayee;
+    return _paymentReturnParams.paymentReturnParams;
   }
 });
-Object.defineProperty(exports, "usePaymentFlowState", {
+Object.defineProperty(exports, "readPaymentReturn", {
   enumerable: true,
   get: function () {
-    return _usePaymentFlowState.usePaymentFlowState;
+    return _paymentReturnParams.readPaymentReturn;
   }
 });
 Object.defineProperty(exports, "useSpareLinkDeepLinks", {
   enumerable: true,
   get: function () {
-    return _index4.useSpareLinkDeepLinks;
+    return _index3.useSpareLinkDeepLinks;
   }
 });
 var _version = require("./version.js");
@@ -277,18 +165,8 @@ Object.keys(_index).forEach(function (key) {
     }
   });
 });
-var _paymentApiError = require("./core/errors/payment-api-error.js");
 var _paymentReturnParams = require("./core/models/payment-return-params.js");
-var _linkApiClient = require("./core/client/link-api-client.js");
-var _paymentFlowController = require("./core/services/payment-flow-controller.js");
-var _paymentFlowState = require("./core/services/payment-flow-state.js");
-var _consentPresenter = require("./core/services/consent-presenter.js");
-var _multiPaymentRulesPresenter = require("./core/services/multi-payment-rules-presenter.js");
-var _paymentType = require("./core/models/payment-type.js");
 var _spareLinkHost = require("./ui/spare-link-host.js");
-var _paymentFlowPage = require("./ui/payment-flow-page.js");
-var _usePaymentFlowState = require("./ui/hooks/use-payment-flow-state.js");
-var _index2 = require("./ui/screens/index.js");
-var _index3 = require("./ui/theme/index.js");
-var _index4 = require("./internal/index.js");
+var _index2 = require("./ui/theme/index.js");
+var _index3 = require("./internal/index.js");
 //# sourceMappingURL=index.js.map

package/lib/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_version","require","_index","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_paymentApiError","_paymentReturnParams","_linkApiClient","_paymentFlowController","_paymentFlowState","_consentPresenter","_multiPaymentRulesPresenter","_paymentType","_spareLinkHost","_paymentFlowPage","_usePaymentFlowState","_index2","_index3","_index4"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,IAAAA,QAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AAGA,IAAAS,gBAAA,GAAAd,OAAA;AAwBA,IAAAe,oBAAA,GAAAf,OAAA;AAMA,IAAAgB,cAAA,GAAAhB,OAAA;AAGA,IAAAiB,sBAAA,GAAAjB,OAAA;AAKA,IAAAkB,iBAAA,GAAAlB,OAAA;AAUA,IAAAmB,iBAAA,GAAAnB,OAAA;AAcA,IAAAoB,2BAAA,GAAApB,OAAA;AAMA,IAAAqB,YAAA,GAAArB,OAAA;AAWA,IAAAsB,cAAA,GAAAtB,OAAA;AAIA,IAAAuB,gBAAA,GAAAvB,OAAA;AACA,IAAAwB,oBAAA,GAAAxB,OAAA;AACA,IAAAyB,OAAA,GAAAzB,OAAA;AAaA,IAAA0B,OAAA,GAAA1B,OAAA;AAGA,IAAA2B,OAAA,GAAA3B,OAAA","ignoreList":[]}
+{"version":3,"names":["_version","require","_index","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_paymentReturnParams","_spareLinkHost","_index2","_index3"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,IAAAA,QAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AAIA,IAAAS,oBAAA,GAAAd,OAAA;AA4BA,IAAAe,cAAA,GAAAf,OAAA;AACA,IAAAgB,OAAA,GAAAhB,OAAA;AAGA,IAAAiB,OAAA,GAAAjB,OAAA","ignoreList":[]}

package/lib/commonjs/internal/hosted/bridge-message.js

@@ -0,0 +1,107 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.parseHostedBridgeMessage = parseHostedBridgeMessage;
+var _urlParts = require("../url-parts.js");
+/**
+ * Messages the hosted payment page sends to this SDK.
+ *
+ * The contract is one-way. The page never waits on a reply, so a message this
+ * version does not recognise is dropped rather than treated as a failure — the
+ * page continues, and a newer page stays usable by an older app.
+ *
+ * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
+ * which arrives here as `event.nativeEvent.data`.
+ */
+
+/** The payable page is interactive. */
+
+/**
+ * A consent exists and the bank must now be opened outside the WebView.
+ *
+ * Banks commonly refuse to serve their authorization pages inside an embedded
+ * browser, and the address bar is what lets a payer tell a real bank page from
+ * a convincing copy.
+ */
+
+/** The payer cancelled, and the request is already rejected server-side. */
+
+/** The flow cannot continue. [code] is the key the page itself renders. */
+
+/**
+ * Parses a message posted by the hosted page.
+ *
+ * Returns null for anything unrecognised. The message crosses a boundary the
+ * SDK does not control, so nothing here trusts its shape — the WebView message
+ * channel is shared with every script on the page.
+ */
+function parseHostedBridgeMessage(raw) {
+  const message = asRecord(raw);
+  if (!message) return null;
+  const type = message.type;
+  if (typeof type !== 'string') return null;
+  switch (type) {
+    case 'spare.ready':
+      return {
+        type: 'ready'
+      };
+    case 'spare.open_url':
+      {
+        const url = message.url;
+        if (typeof url !== 'string' || !isHttpsUrl(url)) return null;
+        return {
+          type: 'openUrl',
+          url
+        };
+      }
+    case 'spare.cancel':
+      return {
+        type: 'cancel'
+      };
+    case 'spare.error':
+      {
+        const code = message.code;
+        if (typeof code !== 'string' || code.trim().length === 0) return null;
+        return {
+          type: 'error',
+          code
+        };
+      }
+    default:
+      return null;
+  }
+}
+
+/**
+ * Reads the message out of whatever the WebView handed over.
+ *
+ * The page stringifies its payload, but a plain object is accepted too so the
+ * transport is not the thing that decides whether a valid message is understood.
+ */
+function asRecord(raw) {
+  if (typeof raw === 'string') {
+    try {
+      return asRecord(JSON.parse(raw));
+    } catch {
+      return null;
+    }
+  }
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return null;
+  return raw;
+}
+
+/**
+ * Whether [url] is an absolute https URL.
+ *
+ * Required before handing a URL to the OS browser: the page is trusted to name
+ * a bank, not to name a scheme that could reach something else on the device.
+ * Parsed rather than pattern-matched so `https:/\/evil` and friends cannot pass
+ * for an absolute URL.
+ */
+function isHttpsUrl(url) {
+  const parts = (0, _urlParts.parseUrlParts)(url);
+  return parts !== null && parts.scheme === 'https' && parts.host.length > 0;
+}
+//# sourceMappingURL=bridge-message.js.map

package/lib/commonjs/internal/hosted/bridge-message.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_urlParts","require","parseHostedBridgeMessage","raw","message","asRecord","type","url","isHttpsUrl","code","trim","length","JSON","parse","Array","isArray","parts","parseUrlParts","scheme","host"],"sourceRoot":"../../../../src","sources":["internal/hosted/bridge-message.ts"],"mappings":";;;;;;AAAA,IAAAA,SAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AAKA;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,wBAAwBA,CAACC,GAAY,EAA8B;EACjF,MAAMC,OAAO,GAAGC,QAAQ,CAACF,GAAG,CAAC;EAC7B,IAAI,CAACC,OAAO,EAAE,OAAO,IAAI;EAEzB,MAAME,IAAI,GAAGF,OAAO,CAACE,IAAI;EACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;EAEzC,QAAQA,IAAI;IACV,KAAK,aAAa;MAChB,OAAO;QAAEA,IAAI,EAAE;MAAQ,CAAC;IAC1B,KAAK,gBAAgB;MAAE;QACrB,MAAMC,GAAG,GAAGH,OAAO,CAACG,GAAG;QACvB,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAI,CAACC,UAAU,CAACD,GAAG,CAAC,EAAE,OAAO,IAAI;QAC5D,OAAO;UAAED,IAAI,EAAE,SAAS;UAAEC;QAAI,CAAC;MACjC;IACA,KAAK,cAAc;MACjB,OAAO;QAAED,IAAI,EAAE;MAAS,CAAC;IAC3B,KAAK,aAAa;MAAE;QAClB,MAAMG,IAAI,GAAGL,OAAO,CAACK,IAAI;QACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAIA,IAAI,CAACC,IAAI,CAAC,CAAC,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;QACrE,OAAO;UAAEL,IAAI,EAAE,OAAO;UAAEG;QAAK,CAAC;MAChC;IACA;MACE,OAAO,IAAI;EACf;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASJ,QAAQA,CAACF,GAAY,EAAkC;EAC9D,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3B,IAAI;MACF,OAAOE,QAAQ,CAACO,IAAI,CAACC,KAAK,CAACV,GAAG,CAAY,CAAC;IAC7C,CAAC,CAAC,MAAM;MACN,OAAO,IAAI;IACb;EACF;EACA,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAIA,GAAG,KAAK,IAAI,IAAIW,KAAK,CAACC,OAAO,CAACZ,GAAG,CAAC,EAAE,OAAO,IAAI;EAC9E,OAAOA,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASK,UAAUA,CAACD,GAAW,EAAW;EACxC,MAAMS,KAAK,GAAG,IAAAC,uBAAa,EAACV,GAAG,CAAC;EAChC,OAAOS,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACE,MAAM,KAAK,OAAO,IAAIF,KAAK,CAACG,IAAI,CAACR,MAAM,GAAG,CAAC;AAC5E","ignoreList":[]}

package/lib/commonjs/internal/hosted/hosted-url.js

@@ -0,0 +1,41 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.HOSTED_ORIGIN_CHANNEL = void 0;
+exports.buildHostedPaymentUrl = buildHostedPaymentUrl;
+exports.isHostedOriginUrl = isHostedOriginUrl;
+var _urlParts = require("../url-parts.js");
+/**
+ * Origin channel this SDK identifies as to the hosted page.
+ *
+ * The same value must be recorded on the payment request by the merchant's
+ * backend, because the bank redirect that completes a payment carries no query
+ * string of ours and the return path is decided from the stored row.
+ */
+const HOSTED_ORIGIN_CHANNEL = exports.HOSTED_ORIGIN_CHANNEL = 'sdk_react_native';
+
+/**
+ * Builds the hosted payment page URL for a payment request reference.
+ *
+ * The reference is the only credential the page needs; everything else is
+ * resolved server-side from the row it names.
+ */
+function buildHostedPaymentUrl(args) {
+  const base = args.baseUrl.trim().replace(/\/+$/, '');
+  const reference = encodeURIComponent(args.reference.trim());
+  return `${base}/link/payment/${reference}?channel=${HOSTED_ORIGIN_CHANNEL}`;
+}
+
+/**
+ * Whether [url] belongs to the hosted origin derived from [baseUrl].
+ *
+ * The WebView loads only the hosted origin. Bank authentication deliberately
+ * happens outside it, so anything else navigating in-frame is refused rather
+ * than followed.
+ */
+function isHostedOriginUrl(args) {
+  return (0, _urlParts.isSameOrigin)(args.baseUrl, args.url);
+}
+//# sourceMappingURL=hosted-url.js.map

package/lib/commonjs/internal/hosted/hosted-url.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_urlParts","require","HOSTED_ORIGIN_CHANNEL","exports","buildHostedPaymentUrl","args","base","baseUrl","trim","replace","reference","encodeURIComponent","isHostedOriginUrl","isSameOrigin","url"],"sourceRoot":"../../../../src","sources":["internal/hosted/hosted-url.ts"],"mappings":";;;;;;;;AAAA,IAAAA,SAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,qBAAqB,GAAAC,OAAA,CAAAD,qBAAA,GAAG,kBAAkB;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,qBAAqBA,CAACC,IAA4C,EAAU;EAC1F,MAAMC,IAAI,GAAGD,IAAI,CAACE,OAAO,CAACC,IAAI,CAAC,CAAC,CAACC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;EACpD,MAAMC,SAAS,GAAGC,kBAAkB,CAACN,IAAI,CAACK,SAAS,CAACF,IAAI,CAAC,CAAC,CAAC;EAC3D,OAAO,GAAGF,IAAI,iBAAiBI,SAAS,YAAYR,qBAAqB,EAAE;AAC7E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASU,iBAAiBA,CAACP,IAAsC,EAAW;EACjF,OAAO,IAAAQ,sBAAY,EAACR,IAAI,CAACE,OAAO,EAAEF,IAAI,CAACS,GAAG,CAAC;AAC7C","ignoreList":[]}

package/lib/commonjs/internal/index.js

@@ -9,12 +9,6 @@ Object.defineProperty(exports, "SecureStorePendingSessionStore", {
     return _secureStorePendingSessionStore.SecureStorePendingSessionStore;
   }
 });
-Object.defineProperty(exports, "collectTelemetry", {
-  enumerable: true,
-  get: function () {
-    return _telemetryCollector.collectTelemetry;
-  }
-});
 Object.defineProperty(exports, "launchBankRedirect", {
   enumerable: true,
   get: function () {
@@ -27,7 +21,6 @@ Object.defineProperty(exports, "useSpareLinkDeepLinks", {
     return _deepLinkListener.useSpareLinkDeepLinks;
   }
 });
-var _telemetryCollector = require("./telemetry-collector.js");
 var _bankRedirect = require("./bank-redirect.js");
 var _secureStorePendingSessionStore = require("./secure-store-pending-session-store.js");
 var _deepLinkListener = require("./deep-link-listener.js");

package/lib/commonjs/internal/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_telemetryCollector","require","_bankRedirect","_secureStorePendingSessionStore","_deepLinkListener"],"sourceRoot":"../../../src","sources":["internal/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,mBAAA,GAAAC,OAAA;AACA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,+BAAA,GAAAF,OAAA;AACA,IAAAG,iBAAA,GAAAH,OAAA","ignoreList":[]}
+{"version":3,"names":["_bankRedirect","require","_secureStorePendingSessionStore","_deepLinkListener"],"sourceRoot":"../../../src","sources":["internal/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,aAAA,GAAAC,OAAA;AACA,IAAAC,+BAAA,GAAAD,OAAA;AACA,IAAAE,iBAAA,GAAAF,OAAA","ignoreList":[]}

package/lib/commonjs/internal/redact-uri.js

@@ -4,22 +4,66 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.redactPaymentReturnUri = redactPaymentReturnUri;
-const SENSITIVE_QUERY_KEYS = new Set(['exchange_code', 'error_description']);
+/**
+ * Redacts the query of a bank-return URI before it is logged.
+ *
+ * Every value goes except the few that describe the outcome rather than identify
+ * anyone — see {@link KEPT_KEYS}. Redaction is a denylist by default rather than
+ * an allowlist of names to remove: an earlier version named the two keys to
+ * redact, so anything else the return ever carried was logged in full, and one of
+ * the names it knew (`exchange_code`) is not even in the contract any more.
+ *
+ * What is worth keeping in a log is the shape of the URI — its scheme, its path,
+ * which parameters were present — plus enough to explain the outcome.
+ *
+ * It also cannot use the global `URL`. React Native's is a stub whose
+ * `searchParams` returns a fresh empty instance, so `has()` was always false and
+ * this function returned the URI untouched on a device while redacting correctly
+ * under Jest, which runs on Node.
+ *
+ * The query is split here rather than read through `parseQueryParams`, because
+ * that decodes values and keeps only the first of a repeated key — fine for
+ * reading an outcome, wrong for reproducing a URI whose shape is the point.
+ */
 
-/** Redacts sensitive query params before logging bank-return URIs. */
+const REDACTED = '[REDACTED]';
+
+/**
+ * Parameters whose values are kept, because they say what happened rather than to
+ * whom.
+ *
+ * Redacting these made the log useless for the one question it gets asked. A
+ * return that resolves as unresolved does so because of its `status`, and a log
+ * reading `status=[REDACTED]` cannot tell anyone which value was not recognised.
+ *
+ * None of these identifies a payer, a payment or a request: `status` is one of a
+ * fixed vocabulary, and `errorCode` and `error` are keys from a fixed list. The
+ * identifiers — `reference`, `merchantRef`, `paymentId` — and the signature stay
+ * redacted, as does `error_description`, which is prose and could name a person.
+ */
+const KEPT_KEYS = new Set(['status', 'errorCode', 'error']);
 function redactPaymentReturnUri(uri) {
-  try {
-    const parsed = new URL(uri);
-    let changed = false;
-    for (const key of SENSITIVE_QUERY_KEYS) {
-      if (parsed.searchParams.has(key)) {
-        parsed.searchParams.set(key, '[REDACTED]');
-        changed = true;
-      }
-    }
-    return changed ? parsed.toString() : uri;
-  } catch {
-    return '[invalid-uri]';
-  }
+  const queryStart = uri.indexOf('?');
+  const fragmentStart = uri.indexOf('#');
+
+  // No query and no fragment: nothing here carries a value.
+  if (queryStart === -1 && fragmentStart === -1) return uri;
+  const queryEnd = fragmentStart !== -1 && fragmentStart > queryStart ? fragmentStart : uri.length;
+  const beforeQuery = queryStart === -1 ? uri.slice(0, fragmentStart) : uri.slice(0, queryStart);
+  const query = queryStart === -1 ? '' : uri.slice(queryStart + 1, queryEnd);
+
+  // A fragment is dropped whole. Nothing in this SDK reads one, so its shape is
+  // not worth keeping, and a return that ever carried a token in one — as OAuth
+  // implicit flows do — must not put it in a log.
+  const hadFragment = fragmentStart !== -1;
+  const redactedQuery = query.split('&').filter(pair => pair.length > 0).map(pair => {
+    const eq = pair.indexOf('=');
+    const key = eq === -1 ? pair : pair.slice(0, eq);
+    if (KEPT_KEYS.has(key)) return pair;
+    return `${key}=${REDACTED}`;
+  }).join('&');
+  const rebuiltQuery = redactedQuery.length > 0 ? `?${redactedQuery}` : '';
+  const rebuiltFragment = hadFragment ? `#${REDACTED}` : '';
+  return `${beforeQuery}${rebuiltQuery}${rebuiltFragment}`;
 }
 //# sourceMappingURL=redact-uri.js.map

package/lib/commonjs/internal/redact-uri.js.map

@@ -1 +1 @@
-{"version":3,"names":["SENSITIVE_QUERY_KEYS","Set","redactPaymentReturnUri","uri","parsed","URL","changed","key","searchParams","has","set","toString"],"sourceRoot":"../../../src","sources":["internal/redact-uri.ts"],"mappings":";;;;;;AAAA,MAAMA,oBAAoB,GAAG,IAAIC,GAAG,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;;AAE5E;AACO,SAASC,sBAAsBA,CAACC,GAAW,EAAU;EAC1D,IAAI;IACF,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAACF,GAAG,CAAC;IAC3B,IAAIG,OAAO,GAAG,KAAK;IACnB,KAAK,MAAMC,GAAG,IAAIP,oBAAoB,EAAE;MACtC,IAAII,MAAM,CAACI,YAAY,CAACC,GAAG,CAACF,GAAG,CAAC,EAAE;QAChCH,MAAM,CAACI,YAAY,CAACE,GAAG,CAACH,GAAG,EAAE,YAAY,CAAC;QAC1CD,OAAO,GAAG,IAAI;MAChB;IACF;IACA,OAAOA,OAAO,GAAGF,MAAM,CAACO,QAAQ,CAAC,CAAC,GAAGR,GAAG;EAC1C,CAAC,CAAC,MAAM;IACN,OAAO,eAAe;EACxB;AACF","ignoreList":[]}
+{"version":3,"names":["REDACTED","KEPT_KEYS","Set","redactPaymentReturnUri","uri","queryStart","indexOf","fragmentStart","queryEnd","length","beforeQuery","slice","query","hadFragment","redactedQuery","split","filter","pair","map","eq","key","has","join","rebuiltQuery","rebuiltFragment"],"sourceRoot":"../../../src","sources":["internal/redact-uri.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,MAAMA,QAAQ,GAAG,YAAY;;AAE7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,SAA8B,GAAG,IAAIC,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAEzE,SAASC,sBAAsBA,CAACC,GAAW,EAAU;EAC1D,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAAC,GAAG,CAAC;EACnC,MAAMC,aAAa,GAAGH,GAAG,CAACE,OAAO,CAAC,GAAG,CAAC;;EAEtC;EACA,IAAID,UAAU,KAAK,CAAC,CAAC,IAAIE,aAAa,KAAK,CAAC,CAAC,EAAE,OAAOH,GAAG;EAEzD,MAAMI,QAAQ,GAAGD,aAAa,KAAK,CAAC,CAAC,IAAIA,aAAa,GAAGF,UAAU,GAAGE,aAAa,GAAGH,GAAG,CAACK,MAAM;EAEhG,MAAMC,WAAW,GAAGL,UAAU,KAAK,CAAC,CAAC,GAAGD,GAAG,CAACO,KAAK,CAAC,CAAC,EAAEJ,aAAa,CAAC,GAAGH,GAAG,CAACO,KAAK,CAAC,CAAC,EAAEN,UAAU,CAAC;EAC9F,MAAMO,KAAK,GAAGP,UAAU,KAAK,CAAC,CAAC,GAAG,EAAE,GAAGD,GAAG,CAACO,KAAK,CAACN,UAAU,GAAG,CAAC,EAAEG,QAAQ,CAAC;;EAE1E;EACA;EACA;EACA,MAAMK,WAAW,GAAGN,aAAa,KAAK,CAAC,CAAC;EAExC,MAAMO,aAAa,GAAGF,KAAK,CACxBG,KAAK,CAAC,GAAG,CAAC,CACVC,MAAM,CAAEC,IAAI,IAAKA,IAAI,CAACR,MAAM,GAAG,CAAC,CAAC,CACjCS,GAAG,CAAED,IAAI,IAAK;IACb,MAAME,EAAE,GAAGF,IAAI,CAACX,OAAO,CAAC,GAAG,CAAC;IAC5B,MAAMc,GAAG,GAAGD,EAAE,KAAK,CAAC,CAAC,GAAGF,IAAI,GAAGA,IAAI,CAACN,KAAK,CAAC,CAAC,EAAEQ,EAAE,CAAC;IAChD,IAAIlB,SAAS,CAACoB,GAAG,CAACD,GAAG,CAAC,EAAE,OAAOH,IAAI;IACnC,OAAO,GAAGG,GAAG,IAAIpB,QAAQ,EAAE;EAC7B,CAAC,CAAC,CACDsB,IAAI,CAAC,GAAG,CAAC;EAEZ,MAAMC,YAAY,GAAGT,aAAa,CAACL,MAAM,GAAG,CAAC,GAAG,IAAIK,aAAa,EAAE,GAAG,EAAE;EACxE,MAAMU,eAAe,GAAGX,WAAW,GAAG,IAAIb,QAAQ,EAAE,GAAG,EAAE;EAEzD,OAAO,GAAGU,WAAW,GAAGa,YAAY,GAAGC,eAAe,EAAE;AAC1D","ignoreList":[]}