@spare-technologies/spare-link 0.1.0-beta.0

package/CHANGELOG.md

@@ -0,0 +1,66 @@
+# @spare-technologies/spare-link
+
+## 0.1.0-beta.0
+
+### Minor Changes
+
+- [#1](https://github.com/spare-technologies/link-rn/pull/1) [`bc3040c`](https://github.com/spare-technologies/link-rn/commit/bc3040c58ab63934d81f1ead0083293f2e0ed164) Thanks [@bdspare](https://github.com/bdspare)! - Initial public beta of `@spare-technologies/spare-link` — the React Native SDK for Spare Link open-banking payments (port of the Flutter `spare_link` SDK, with byte-for-byte parity on retry/timeout/state-machine semantics).
+
+  - Instance-based API: construct one `SpareLink`, mount one `<SpareLinkHost>`, and call `spareLink.start({ linkToken })` — `session.result` resolves to a discriminated `PaymentResult` (`success | cancelled | failed | abandoned`).
+  - 9-phase `PaymentFlowController` with a 5-minute awaiting-callback timeout, single/multi-payment (mandate) and international consent UIs, and Confirmation-of-Payee gating.
+  - Cold-start recovery via `spareLink.resumeIfNeeded()` returning a typed `RecoveryResult` (`recovered | awaitingUser | none`), backed by `SecureStorePendingSessionStore` (capped at 3 attempts via `kMaxRecoveryAttempts`).
+  - `LinkApiClient` with full header parity (`x-link-token`, `X-Tenant`, stable `Idempotency-Key`), retry on 408/502/503, and a 15s default timeout.
+  - Deep-link wiring via `useSpareLinkDeepLinks(spareLink)` and `spareLink.handleRedirect(uri)`.
+  - Expo config plugin (`@spare-technologies/spare-link/expo-plugin`) shipping iOS + Android permission and deep-link setup.
+  - Ships compiled CommonJS + ESM + TypeScript declarations, with `src` retained for Metro consumers.
+  - Companion `@spare-technologies/link-test-harness` MSW mock Link server for TDD.
+
+## Unreleased
+
+### Changed
+
+- Package name finalized as `@spare-technologies/spare-link`, aligned with the Flutter `spare_link` package. Earlier pre-release development used a different scope and a `link-rn` suffix; nothing was published under those names, so no consumer action is required.
+
+### Fixed
+
+- Payment flow recovery now buffers bank-return URIs on cold start, clears pending sessions on completion, and polls `/link/status` every 10s while awaiting the bank (production + sandbox).
+- Sandbox auto-success on status poll only applies after `callback_received` (bank returned), not while still `redirected` — fixes false success on app restart before bank authorization.
+- Failed-screen copy is sanitized via `userFriendlyMessageFor` — raw backend messages are no longer shown.
+- Cancel during bank processing now shows a confirmation dialog (Flutter parity).
+
+### Added
+
+- Instance-based `SpareLink` + `SpareLinkHost` API (Flutter-aligned: one instance, one host), replacing the earlier static `SpareLink.start`/`SpareLinkProvider` shape.
+- `spareLink.resumeIfNeeded()` returning typed `RecoveryResult` (`recovered` | `awaitingUser` | `none`).
+- `merchantRef` on `PaymentSuccess` when present in the bank callback URI.
+- `abandoned` lifecycle event when the modal dismiss control is used mid-flow.
+- Corrected CTA copy: `Proceed using Altareq` / `Pay using Altareq` (was `AlTareq` on some screens).
+- Accordion section headers, chevron color, and dividers now match Flutter consent UI.
+- Payment setup card border radius aligned with Flutter (12px).
+
+### Added
+
+- MetroSans font assets loaded automatically by `SpareLinkHost`.
+- `showDismissButton` prop on `SpareLinkHost` (default `true`; merchant demo sets `false` for Flutter parity).
+- Multi-payment (mandate) consent UI for all six schedule types, porting Flutter `spare_link` parity.
+- International payment consent UI with read-only charge bearer display.
+- `MandateSetupSuccessScreen` recap before the success callback for mandate flows.
+- `summaryFromState()` returning discriminated `ConsentSummaryData` (`singlePayment` | `international` | `multiPayment`).
+- CoP skipped for international payments.
+- Test harness scenarios `multipaymentFixedOnDemand`, `multipaymentFixedDefinedSchedule`, and `internationalPayment`.
+
+## 0.1.0-beta.1
+
+### Initial public beta
+
+- `SpareLink.start({ config, callbacks? })` — launches the native Link payment Modal and resolves with a `PaymentResult`.
+- `SpareLink.handleRedirect(uri)` — forwards bank-return URIs to the active flow.
+- `SpareLink.resumeIfNeeded({ config, callbacks? })` — recovers in-flight sessions on cold-start; auto-fails after `kMaxRecoveryAttempts` (3).
+- `SpareLink.delegate` swap point for tests.
+- `SpareLinkProvider` host component mounting the SDK Modal + delegating `start/handleRedirect/resumeIfNeeded`.
+- `useSpareLinkDeepLinks()` hook wiring `Linking` to `SpareLink.handleRedirect`.
+- `SecureStorePendingSessionStore` backed by `expo-secure-store`.
+- Expo config plugin (`@spare-technologies/spare-link/expo-plugin`) injecting iOS location permission + URL scheme + Android permissions + intent-filters.
+- 9-phase `PaymentFlowController` with 5-minute awaiting-callback timeout.
+- `LinkApiClient` with header parity, retry/timeout, and stable Idempotency-Key for POST `/link/consent`.
+- 34 jest tests + 25 harness tests at green.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Spare Financial
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,173 @@
+# @spare-technologies/spare-link
+
+React Native SDK for [Spare Link](https://tryspare.com) — drop-in open-banking payments via a native checkout sheet.
+
+```sh
+bun add @spare-technologies/spare-link
+# or
+npm i @spare-technologies/spare-link
+```
+
+## Quickstart
+
+The SDK is instance-based (mirrors the Flutter `spare_link` API): create one `SpareLink`
+instance, mount one `SpareLinkHost` near your app root, and pass that instance to every
+screen that starts a payment.
+
+```tsx
+import { SpareLink, SpareLinkHost, useSpareLinkDeepLinks } from '@spare-technologies/spare-link';
+import { useMemo } from 'react';
+
+function App() {
+  const spareLink = useMemo(
+    () => new SpareLink({ environment: 'sandbox', tenant: 'uae' }),
+    [],
+  );
+  useSpareLinkDeepLinks(spareLink);
+
+  return (
+    <SpareLinkHost spareLink={spareLink}>
+      <YourApp spareLink={spareLink} />
+    </SpareLinkHost>
+  );
+}
+
+async function pay(spareLink: SpareLink, linkToken: string) {
+  const unsub = spareLink.events.subscribe((event) => console.log('event', event.type));
+  const session = await spareLink.start({ linkToken });
+  const result = await session.result;
+  unsub();
+  if (result.status === 'success') {
+    // exchange `result.exchangeCode` on your backend → /link/exchange
+  }
+}
+```
+
+## Expo plugin
+
+Add to `app.config.ts`:
+
+```ts
+plugins: [
+  [
+    '@spare-technologies/spare-link/expo-plugin',
+    {
+      locationUsageDescription: 'We use your location to verify the payment.',
+      merchantScheme: 'sparemerchantrn',
+      merchantHost: 'callback',
+    },
+  ],
+]
+```
+
+The plugin injects:
+
+- **iOS**: `NSLocationWhenInUseUsageDescription` + `CFBundleURLSchemes` entry for the merchant scheme.
+- **Android**: `ACCESS_FINE_LOCATION` permission + intent-filter for `sparemerchantrn://callback` (and an optional `autoVerify=true` App Link for the Spare universal-link host).
+
+## Deep-link handling
+
+`SpareLinkHost` forwards bank-return URIs to the SDK via `spareLink.handleRedirect(url)`. The `useSpareLinkDeepLinks(spareLink)` hook wires `Linking.addEventListener('url', …)` + `Linking.getInitialURL()` for you.
+
+## Cold-start recovery
+
+Construct the instance with a `pendingSessionStore` and call `spareLink.resumeIfNeeded()` on `AppState === 'active'`:
+
+```tsx
+import { SecureStorePendingSessionStore, SpareLink, SpareLinkHost } from '@spare-technologies/spare-link';
+
+const store = new SecureStorePendingSessionStore();
+const spareLink = new SpareLink({ environment: 'sandbox', tenant: 'uae', pendingSessionStore: store });
+
+<SpareLinkHost spareLink={spareLink}>
+  …
+</SpareLinkHost>
+```
+
+```ts
+import { AppState } from 'react-native';
+
+AppState.addEventListener('change', (state) => {
+  if (state !== 'active') return;
+  void spareLink.resumeIfNeeded().then((recovery) => {
+    if (recovery.kind === 'recovered') {
+      // recovery.result is the terminal PaymentResult
+    }
+    // kind === 'awaitingUser' means the SDK opened its own recovery UI —
+    // the terminal outcome arrives later via `spareLink.events`.
+  });
+});
+```
+
+`spareLink.resumeIfNeeded()` reads the persisted record, polls `GET /link/status`, and resolves a `RecoveryResult`:
+
+- `{ kind: 'recovered', result }` — the session reached a terminal state; `result` is the `PaymentResult`.
+- `{ kind: 'awaitingUser', linkToken }` — the session is still non-terminal and the SDK opened its recovery UI (mounted by `SpareLinkHost`); the terminal outcome arrives later via `spareLink.events` / the `succeeded`/`failed`/`cancelled`/`abandoned` events.
+- `{ kind: 'none', reason }` — nothing to recover (`noPendingSession` | `flowAlreadyActive` | `persistenceUnavailable`).
+
+After `kMaxRecoveryAttempts` (3) non-terminal attempts the SDK resolves `PaymentFailed('recovery_exhausted')` and clears the record.
+
+## Testing with the harness
+
+Add `@spare-technologies/link-test-harness` as a dev dep — it ships a stateful MSW mock Link API with tofa-accurate `{ data }` envelopes:
+
+```ts
+import { setupMockLinkApi } from '@spare-technologies/link-test-harness';
+
+const server = setupMockLinkApi({ scenario: 'happyPath' });
+beforeAll(() => server.start());
+afterAll(() => server.stop());
+afterEach(() => server.reset());
+```
+
+Available scenarios: `happyPath`, `sessionAlreadyInitialized`, `networkTimeout`, `consentRetry`, `sessionTimeout`, `recoveryViaStatus`, `appReturn`, `terminalCompleted | Failed | Cancelled | Expired`, `tenantMismatch`, `providerUnavailable`, `multipaymentFixedOnDemand`, `multipaymentFixedDefinedSchedule`, `internationalPayment`.
+
+For tests that don't want to mount `SpareLinkHost`, drive the instance's internal host delegate directly (see `SpareLink._attachHost` usage in the SDK's own `spare-link-instance.test.ts` for the pattern), or stub the app-level function that wraps `spareLink.start(...)` in your own integration layer.
+
+## API reference
+
+### `new SpareLink(options)`
+
+| Field | Type | Notes |
+| --- | --- | --- |
+| `environment` | `'sandbox' \| 'production'` | Default base URL is derived from this. |
+| `tenant` | `'ksa' \| 'uae' \| 'bah'` | Sent as the `X-Tenant` header. |
+| `baseUrl` | `string?` | Override the base URL (dev only). |
+| `fetch` | `typeof fetch?` | Inject a custom fetch for cert pinning. |
+| `requestTimeoutMs` | `number?` | Default `15_000`. |
+| `pendingSessionStore` | `PendingSessionStore?` | Enables cold-start recovery, e.g. `SecureStorePendingSessionStore`. |
+
+### `spareLink.start({ linkToken })`
+
+Returns a `Promise<SpareLinkSession>` immediately; await `session.result` for the terminal `PaymentResult`. Never throws — invalid input resolves to `PaymentAbandoned` so callers don't need a try/catch.
+
+### `PaymentResult` discriminated union
+
+```ts
+type PaymentResult =
+  | PaymentSuccess     // { status: 'success', linkToken, exchangeCode?, merchantRef?, linkSessionId?, ... }
+  | PaymentCancelled   // { status: 'cancelled', linkToken, ... }
+  | PaymentFailed      // { status: 'failed', linkToken, errorCode, ... }
+  | PaymentAbandoned   // { status: 'abandoned', linkToken, ... }
+```
+
+### `SpareLinkEvent`
+
+Subscribe via `spareLink.events.subscribe((event) => ...)`. `event.type` is one of:
+
+```ts
+type SpareLinkEventType =
+  | 'initialized' | 'sessionLoaded' | 'consentStarted'
+  | 'redirectToBank' | 'bankCallbackReceived'
+  | 'succeeded' | 'failed' | 'cancelled' | 'abandoned';
+```
+
+## Supported versions
+
+- **Expo SDK** ≥ 52 (tested with 52.0.x)
+- **React Native** ≥ 0.76
+- **React** ≥ 18.3
+
+## License
+
+MIT — see [LICENSE](../../LICENSE).

package/lib/commonjs/core/client/link-api-client.js

@@ -0,0 +1,297 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.LinkApiClient = void 0;
+var _logger = require("../../internal/logger.js");
+var _constants = require("../../public/constants.js");
+var _spareLinkConfig = require("../../public/spare-link-config.js");
+var _version = require("../../version.js");
+var _paymentApiError = require("../errors/payment-api-error.js");
+var _wireMappers = require("../models/wire-mappers.js");
+const RETRYABLE_ERROR_CODES = new Set(['network_timeout', 'consent_creation_failed', 'bank_unavailable', 'network_error']);
+const DEFAULT_USER_AGENT = `@spare-technologies/spare-link/${_version.SDK_VERSION}`;
+const log = (0, _logger.createLogger)('LinkApiClient');
+function isCryptoCapable(g) {
+  return typeof g.crypto !== 'undefined' && typeof g.crypto.randomUUID === 'function';
+}
+function isCryptoRandom(g) {
+  return typeof g.crypto !== 'undefined' && typeof g.crypto.getRandomValues === 'function';
+}
+function defaultUuid() {
+  if (isCryptoCapable(globalThis)) {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (isCryptoRandom(globalThis)) {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < 16; i += 1) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  bytes[6] = (bytes[6] ?? 0) & 0x0f | 0x40;
+  bytes[8] = (bytes[8] ?? 0) & 0x3f | 0x80;
+  const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+
+/** Full client for all Link-origin endpoints — headers, retry rules, and error mapping. */
+class LinkApiClient {
+  aborters = new Set();
+  disposed = false;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.endsWith('/') ? opts.baseUrl.slice(0, -1) : opts.baseUrl;
+    this.tenantHeader = typeof opts.tenant === 'string' && /^[A-Z]+$/.test(opts.tenant) ? opts.tenant : (0, _spareLinkConfig.tenantCountryCode)(opts.tenant);
+    this.requestTimeoutMs = opts.requestTimeoutMs ?? _constants.DEFAULT_REQUEST_TIMEOUT_MS;
+    this.fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+    this.uuid = opts.uuid ?? defaultUuid;
+    this.userAgent = opts.userAgent ?? DEFAULT_USER_AGENT;
+  }
+
+  /** Aborts in-flight requests and rejects further work. */
+  dispose() {
+    this.disposed = true;
+    for (const c of this.aborters) c.abort();
+    this.aborters.clear();
+  }
+  headers(linkToken, extra) {
+    return {
+      'x-link-token': linkToken,
+      'Content-Type': 'application/json',
+      'X-Tenant': this.tenantHeader,
+      'User-Agent': this.userAgent,
+      ...(extra ?? {})
+    };
+  }
+  url(path) {
+    return `${this.baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
+  }
+
+  /**
+   * Wraps a single attempt with a per-request `AbortController`. Times out after
+   * `requestTimeoutMs`. Classifies any thrown non-{@link PaymentApiError} as
+   * `network_error` so callers always see a typed error.
+   */
+  async withTimeout(body) {
+    if (this.disposed) {
+      throw new _paymentApiError.PaymentApiError('client_disposed', 'API client has been disposed.');
+    }
+    const controller = new AbortController();
+    this.aborters.add(controller);
+    const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);
+    try {
+      return await body(controller.signal);
+    } catch (err) {
+      if ((0, _paymentApiError.isPaymentApiError)(err)) throw err;
+      const name = err.name;
+      if (name === 'AbortError') {
+        log.severe(`request timed out after ${this.requestTimeoutMs}ms${this.disposed ? ' (client disposed)' : ''}`);
+        throw new _paymentApiError.PaymentApiError(this.disposed ? 'client_disposed' : 'network_timeout', this.disposed ? 'API client was disposed mid-request.' : 'The request timed out. Please check your connection and try again.');
+      }
+      // Catch-all: DNS, refused, malformed response, JSON parse failure, etc.
+      // We surface the message for debugging but a stable code for branching.
+      const message = err instanceof Error ? err.message : String(err);
+      throw new _paymentApiError.PaymentApiError('network_error', `Network error: ${message}`);
+    } finally {
+      clearTimeout(timer);
+      this.aborters.delete(controller);
+    }
+  }
+
+  /** Idempotent retry helper (max 2 attempts, 500ms + 1000ms backoff). */
+  async withRetry(body, maxAttempts = 2) {
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+      try {
+        return await this.withTimeout(body);
+      } catch (err) {
+        if ((0, _paymentApiError.isPaymentApiError)(err) && RETRYABLE_ERROR_CODES.has(err.code) && attempt < maxAttempts) {
+          lastError = err;
+          await delay(attempt === 1 ? 500 : 1000);
+          continue;
+        }
+        throw err;
+      }
+    }
+    throw lastError ?? new _paymentApiError.PaymentApiError('network_error', 'A network error occurred. Please try again.');
+  }
+  async parseAndHandle(res, mapper, endpoint) {
+    if (!res.ok) {
+      await this.throwForError(res);
+    }
+    let body;
+    try {
+      body = await res.json();
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new _paymentApiError.PaymentApiError(`${endpoint}_payload_invalid`, `${endpoint} response body is not valid JSON: ${message}`);
+    }
+    try {
+      return mapper((0, _wireMappers.unwrap)(body));
+    } catch (err) {
+      if ((0, _paymentApiError.isPaymentApiError)(err)) throw err;
+      const message = err instanceof Error ? err.message : String(err);
+      throw new _paymentApiError.PaymentApiError(`${endpoint}_payload_invalid`, `${endpoint} response payload is invalid: ${message}`);
+    }
+  }
+  async throwForError(res) {
+    const text = await res.text().catch(() => '');
+    let parsed;
+    try {
+      parsed = text ? JSON.parse(text) : undefined;
+    } catch {
+      parsed = undefined;
+    }
+    const errorCode = parsed?.error_code ?? parsed?.code ?? (typeof parsed?.error === 'string' ? parsed.error : undefined);
+    switch (res.status) {
+      case 401:
+        log.severe('HTTP 401: link token invalid or expired');
+        throw new _paymentApiError.PaymentApiError('invalid_token', 'The link token is invalid or has expired.');
+      case 410:
+        if (errorCode === 'SESSION_CANCELLED') {
+          log.severe('HTTP 410: session cancelled');
+          throw new _paymentApiError.PaymentApiError('session_cancelled', 'The payment session was cancelled.');
+        }
+        log.severe('HTTP 410: session expired');
+        throw _paymentApiError.PaymentApiError.sessionExpired();
+      case 409:
+        log.severe('HTTP 409: session already completed');
+        throw new _paymentApiError.PaymentApiError('session_already_completed', 'The payment session has already been completed.');
+      case 503:
+        log.severe('HTTP 503: bank unavailable');
+        throw new _paymentApiError.PaymentApiError('bank_unavailable', 'Bank is temporarily unavailable. Please try again.');
+      case 502:
+        log.severe('HTTP 502: consent creation failed');
+        throw new _paymentApiError.PaymentApiError('consent_creation_failed', 'Unable to create payment authorization. Please try again.');
+      case 408:
+        log.severe('HTTP 408: request timeout');
+        throw new _paymentApiError.PaymentApiError('network_timeout', 'The server timed out processing the request. Please try again.');
+      case 429:
+        log.severe('HTTP 429: rate limit exceeded');
+        throw new _paymentApiError.PaymentApiError('rate_limit_exceeded', 'Too many requests. Please wait and try again.');
+      default:
+        log.severe(`HTTP ${res.status}: unexpected error`);
+        throw new _paymentApiError.PaymentApiError('network_error', `Unexpected status ${res.status} from Link API.`);
+    }
+  }
+
+  // ---- Endpoints ----------------------------------------------------------
+
+  /** `GET /link` — one-time session hydration. */
+  async getSession(linkToken) {
+    log.info('GET /link');
+    return this.withRetry(async signal => {
+      const res = await this.fetchImpl(this.url('/link'), {
+        method: 'GET',
+        headers: this.headers(linkToken),
+        signal
+      });
+      return this.parseAndHandle(res, _wireMappers.mapLinkSessionResponse, 'session');
+    });
+  }
+
+  /** `GET /link/status` — read-only session status. */
+  async getStatus(linkToken) {
+    log.info('GET /link/status');
+    return this.withRetry(async signal => {
+      const res = await this.fetchImpl(this.url('/link/status'), {
+        method: 'GET',
+        headers: this.headers(linkToken),
+        signal
+      });
+      return this.parseAndHandle(res, _wireMappers.mapLinkStatusResponse, 'status');
+    });
+  }
+
+  /** `GET /link/providers` — bank list for the session jurisdiction. */
+  async getProviders(linkToken) {
+    log.info('GET /link/providers');
+    return this.withRetry(async signal => {
+      const res = await this.fetchImpl(this.url('/link/providers'), {
+        method: 'GET',
+        headers: this.headers(linkToken),
+        signal
+      });
+      return this.parseAndHandle(res, _wireMappers.mapProvidersResponse, 'providers');
+    });
+  }
+
+  /** `POST /link/telemetry` — device/risk signals (best-effort). */
+  async postTelemetry(args) {
+    log.info('POST /link/telemetry');
+    return this.withRetry(async signal => {
+      const res = await this.fetchImpl(this.url('/link/telemetry'), {
+        method: 'POST',
+        headers: this.headers(args.linkToken),
+        body: JSON.stringify(args.payload),
+        signal
+      });
+      return this.parseAndHandle(res, _wireMappers.mapTelemetryResponse, 'telemetry');
+    });
+  }
+
+  /** `GET /link/cop` — Confirmation of Payee. Accepts an optional providerId override. */
+  async getConfirmPayee(linkToken, providerId) {
+    log.info(`GET /link/cop${providerId ? ` (providerId: ${providerId})` : ''}`);
+    return this.withRetry(async signal => {
+      const path = providerId ? `/link/cop?providerId=${encodeURIComponent(providerId)}` : '/link/cop';
+      const res = await this.fetchImpl(this.url(path), {
+        method: 'GET',
+        headers: this.headers(linkToken),
+        signal
+      });
+      return this.parseAndHandle(res, _wireMappers.mapCopResponse, 'cop');
+    });
+  }
+
+  /**
+   * `POST /link/consent` — creates a consent and returns the bank redirect URL.
+   *
+   * NEVER retried — the Idempotency-Key header guarantees safe retries at the
+   * caller level if they re-invoke with the SAME key.
+   */
+  async postConsent(args) {
+    const key = args.idempotencyKey ?? this.uuid();
+    log.info(`POST /link/consent (bankId: ${args.bankId ?? 'n/a'}, idempotencyKey: ${key})`);
+    return this.withTimeout(async signal => {
+      const body = args.bankId ? JSON.stringify({
+        provider_id: args.bankId
+      }) : '{}';
+      const res = await this.fetchImpl(this.url('/link/consent'), {
+        method: 'POST',
+        headers: this.headers(args.linkToken, {
+          'Idempotency-Key': key
+        }),
+        body,
+        signal
+      });
+      return this.parseAndHandle(res, _wireMappers.mapConsentResponse, 'consent');
+    });
+  }
+
+  /** `PATCH /link` — cancel or report an error on the session. */
+  async patchToken(args) {
+    log.info(`PATCH /link (action: ${args.action}, errorCode: ${args.errorCode ?? 'n/a'})`);
+    return this.withRetry(async signal => {
+      const body = {
+        action: args.action
+      };
+      if (args.errorCode) body.code = args.errorCode;
+      // Tag SDK-originated error reports so the backend can distinguish them
+      // from hosted/provider-return reports in its dashboards.
+      if (args.action === 'error') body.source = 'sdk';
+      const res = await this.fetchImpl(this.url('/link'), {
+        method: 'PATCH',
+        headers: this.headers(args.linkToken),
+        body: JSON.stringify(body),
+        signal
+      });
+      return this.parseAndHandle(res, _wireMappers.mapPatchTokenResponse, 'patch_token');
+    });
+  }
+}
+exports.LinkApiClient = LinkApiClient;
+function delay(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=link-api-client.js.map

package/lib/commonjs/core/client/link-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_logger","require","_constants","_spareLinkConfig","_version","_paymentApiError","_wireMappers","RETRYABLE_ERROR_CODES","Set","DEFAULT_USER_AGENT","SDK_VERSION","log","createLogger","isCryptoCapable","g","crypto","randomUUID","isCryptoRandom","getRandomValues","defaultUuid","globalThis","bytes","Uint8Array","i","Math","floor","random","hex","Array","from","b","toString","padStart","join","slice","LinkApiClient","aborters","disposed","constructor","opts","baseUrl","endsWith","tenantHeader","tenant","test","tenantCountryCode","requestTimeoutMs","DEFAULT_REQUEST_TIMEOUT_MS","fetchImpl","fetch","bind","uuid","userAgent","dispose","c","abort","clear","headers","linkToken","extra","url","path","startsWith","withTimeout","body","PaymentApiError","controller","AbortController","add","timer","setTimeout","signal","err","isPaymentApiError","name","severe","message","Error","String","clearTimeout","delete","withRetry","maxAttempts","lastError","attempt","has","code","delay","parseAndHandle","res","mapper","endpoint","ok","throwForError","json","unwrap","text","catch","parsed","JSON","parse","undefined","errorCode","error_code","error","status","sessionExpired","getSession","info","method","mapLinkSessionResponse","getStatus","mapLinkStatusResponse","getProviders","mapProvidersResponse","postTelemetry","args","stringify","payload","mapTelemetryResponse","getConfirmPayee","providerId","encodeURIComponent","mapCopResponse","postConsent","key","idempotencyKey","bankId","provider_id","mapConsentResponse","patchToken","action","source","mapPatchTokenResponse","exports","ms","Promise","resolve"],"sourceRoot":"../../../../src","sources":["core/client/link-api-client.ts"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,gBAAA,GAAAF,OAAA;AACA,IAAAG,QAAA,GAAAH,OAAA;AACA,IAAAI,gBAAA,GAAAJ,OAAA;AAUA,IAAAK,YAAA,GAAAL,OAAA;AAuBA,MAAMM,qBAAqB,GAAG,IAAIC,GAAG,CAAC,CACpC,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,CAChB,CAAC;AAEF,MAAMC,kBAAkB,GAAG,kCAAkCC,oBAAW,EAAE;AAC1E,MAAMC,GAAG,GAAG,IAAAC,oBAAY,EAAC,eAAe,CAAC;AAEzC,SAASC,eAAeA,CAACC,CAAoB,EAE3C;EACA,OACE,OAAOA,CAAC,CAACC,MAAM,KAAK,WAAW,IAC/B,OAAQD,CAAC,CAACC,MAAM,CAAmCC,UAAU,KAAK,UAAU;AAEhF;AAEA,SAASC,cAAcA,CAACH,CAAoB,EAE1C;EACA,OACE,OAAOA,CAAC,CAACC,MAAM,KAAK,WAAW,IAC/B,OAAQD,CAAC,CAACC,MAAM,CAAyDG,eAAe,KACtF,UAAU;AAEhB;AAEA,SAASC,WAAWA,CAAA,EAAW;EAC7B,IAAIN,eAAe,CAACO,UAAU,CAAC,EAAE;IAC/B,OAAOA,UAAU,CAACL,MAAM,CAACC,UAAU,CAAC,CAAC;EACvC;EACA,MAAMK,KAAK,GAAG,IAAIC,UAAU,CAAC,EAAE,CAAC;EAChC,IAAIL,cAAc,CAACG,UAAU,CAAC,EAAE;IAC9BA,UAAU,CAACL,MAAM,CAACG,eAAe,CAACG,KAAK,CAAC;EAC1C,CAAC,MAAM;IACL,KAAK,IAAIE,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG,EAAE,EAAEA,CAAC,IAAI,CAAC,EAAEF,KAAK,CAACE,CAAC,CAAC,GAAGC,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC;EAC5E;EACAL,KAAK,CAAC,CAAC,CAAC,GAAI,CAACA,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAI,IAAI;EAC1CA,KAAK,CAAC,CAAC,CAAC,GAAI,CAACA,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAI,IAAI;EAC1C,MAAMM,GAAG,GAAGC,KAAK,CAACC,IAAI,CAACR,KAAK,EAAGS,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAAC,EAAE,CAAC,CAACC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAACC,IAAI,CAAC,EAAE,CAAC;EAC9E,OAAO,GAAGN,GAAG,CAACO,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAIP,GAAG,CAACO,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAIP,GAAG,CAACO,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAIP,GAAG,CAACO,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAIP,GAAG,CAACO,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;AAChH;;AAEA;AACO,MAAMC,aAAa,CAAC;EAQRC,QAAQ,GAAG,IAAI5B,GAAG,CAAkB,CAAC;EAC9C6B,QAAQ,GAAG,KAAK;EAExBC,WAAWA,CAACC,IAA0B,EAAE;IACtC,IAAI,CAACC,OAAO,GAAGD,IAAI,CAACC,OAAO,CAACC,QAAQ,CAAC,GAAG,CAAC,GAAGF,IAAI,CAACC,OAAO,CAACN,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAGK,IAAI,CAACC,OAAO;IACpF,IAAI,CAACE,YAAY,GACf,OAAOH,IAAI,CAACI,MAAM,KAAK,QAAQ,IAAI,UAAU,CAACC,IAAI,CAACL,IAAI,CAACI,MAAM,CAAC,GAC3DJ,IAAI,CAACI,MAAM,GACX,IAAAE,kCAAiB,EAACN,IAAI,CAACI,MAAwB,CAAC;IACtD,IAAI,CAACG,gBAAgB,GAAGP,IAAI,CAACO,gBAAgB,IAAIC,qCAA0B;IAC3E,IAAI,CAACC,SAAS,GAAGT,IAAI,CAACU,KAAK,IAAI7B,UAAU,CAAC6B,KAAK,CAACC,IAAI,CAAC9B,UAAU,CAAC;IAChE,IAAI,CAAC+B,IAAI,GAAGZ,IAAI,CAACY,IAAI,IAAIhC,WAAW;IACpC,IAAI,CAACiC,SAAS,GAAGb,IAAI,CAACa,SAAS,IAAI3C,kBAAkB;EACvD;;EAEA;EACA4C,OAAOA,CAAA,EAAS;IACd,IAAI,CAAChB,QAAQ,GAAG,IAAI;IACpB,KAAK,MAAMiB,CAAC,IAAI,IAAI,CAAClB,QAAQ,EAAEkB,CAAC,CAACC,KAAK,CAAC,CAAC;IACxC,IAAI,CAACnB,QAAQ,CAACoB,KAAK,CAAC,CAAC;EACvB;EAEQC,OAAOA,CAACC,SAAiB,EAAEC,KAA8B,EAAe;IAC9E,OAAO;MACL,cAAc,EAAED,SAAS;MACzB,cAAc,EAAE,kBAAkB;MAClC,UAAU,EAAE,IAAI,CAAChB,YAAY;MAC7B,YAAY,EAAE,IAAI,CAACU,SAAS;MAC5B,IAAIO,KAAK,IAAI,CAAC,CAAC;IACjB,CAAC;EACH;EAEQC,GAAGA,CAACC,IAAY,EAAU;IAChC,OAAO,GAAG,IAAI,CAACrB,OAAO,GAAGqB,IAAI,CAACC,UAAU,CAAC,GAAG,CAAC,GAAGD,IAAI,GAAG,IAAIA,IAAI,EAAE,EAAE;EACrE;;EAEA;AACF;AACA;AACA;AACA;EACE,MAAcE,WAAWA,CAAIC,IAAyC,EAAc;IAClF,IAAI,IAAI,CAAC3B,QAAQ,EAAE;MACjB,MAAM,IAAI4B,gCAAe,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;IAC/E;IACA,MAAMC,UAAU,GAAG,IAAIC,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC/B,QAAQ,CAACgC,GAAG,CAACF,UAAU,CAAC;IAC7B,MAAMG,KAAK,GAAGC,UAAU,CAAC,MAAMJ,UAAU,CAACX,KAAK,CAAC,CAAC,EAAE,IAAI,CAACT,gBAAgB,CAAC;IACzE,IAAI;MACF,OAAO,MAAMkB,IAAI,CAACE,UAAU,CAACK,MAAM,CAAC;IACtC,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,IAAI,IAAAC,kCAAiB,EAACD,GAAG,CAAC,EAAE,MAAMA,GAAG;MACrC,MAAME,IAAI,GAAIF,GAAG,CAAuBE,IAAI;MAC5C,IAAIA,IAAI,KAAK,YAAY,EAAE;QACzB/D,GAAG,CAACgE,MAAM,CACR,2BAA2B,IAAI,CAAC7B,gBAAgB,KAAK,IAAI,CAACT,QAAQ,GAAG,oBAAoB,GAAG,EAAE,EAChG,CAAC;QACD,MAAM,IAAI4B,gCAAe,CACvB,IAAI,CAAC5B,QAAQ,GAAG,iBAAiB,GAAG,iBAAiB,EACrD,IAAI,CAACA,QAAQ,GACT,sCAAsC,GACtC,oEACN,CAAC;MACH;MACA;MACA;MACA,MAAMuC,OAAO,GAAGJ,GAAG,YAAYK,KAAK,GAAGL,GAAG,CAACI,OAAO,GAAGE,MAAM,CAACN,GAAG,CAAC;MAChE,MAAM,IAAIP,gCAAe,CAAC,eAAe,EAAE,kBAAkBW,OAAO,EAAE,CAAC;IACzE,CAAC,SAAS;MACRG,YAAY,CAACV,KAAK,CAAC;MACnB,IAAI,CAACjC,QAAQ,CAAC4C,MAAM,CAACd,UAAU,CAAC;IAClC;EACF;;EAEA;EACA,MAAce,SAASA,CACrBjB,IAAyC,EACzCkB,WAAW,GAAG,CAAC,EACH;IACZ,IAAIC,SAAsC;IAC1C,KAAK,IAAIC,OAAO,GAAG,CAAC,EAAEA,OAAO,IAAIF,WAAW,EAAEE,OAAO,IAAI,CAAC,EAAE;MAC1D,IAAI;QACF,OAAO,MAAM,IAAI,CAACrB,WAAW,CAACC,IAAI,CAAC;MACrC,CAAC,CAAC,OAAOQ,GAAG,EAAE;QACZ,IACE,IAAAC,kCAAiB,EAACD,GAAG,CAAC,IACtBjE,qBAAqB,CAAC8E,GAAG,CAACb,GAAG,CAACc,IAAI,CAAC,IACnCF,OAAO,GAAGF,WAAW,EACrB;UACAC,SAAS,GAAGX,GAAG;UACf,MAAMe,KAAK,CAACH,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;UACvC;QACF;QACA,MAAMZ,GAAG;MACX;IACF;IACA,MACEW,SAAS,IACT,IAAIlB,gCAAe,CAAC,eAAe,EAAE,6CAA6C,CAAC;EAEvF;EAEA,MAAcuB,cAAcA,CAC1BC,GAAa,EACbC,MAA2B,EAC3BC,QAAgB,EACJ;IACZ,IAAI,CAACF,GAAG,CAACG,EAAE,EAAE;MACX,MAAM,IAAI,CAACC,aAAa,CAACJ,GAAG,CAAC;IAC/B;IACA,IAAIzB,IAAa;IACjB,IAAI;MACFA,IAAI,GAAI,MAAMyB,GAAG,CAACK,IAAI,CAAC,CAAa;IACtC,CAAC,CAAC,OAAOtB,GAAG,EAAE;MACZ,MAAMI,OAAO,GAAGJ,GAAG,YAAYK,KAAK,GAAGL,GAAG,CAACI,OAAO,GAAGE,MAAM,CAACN,GAAG,CAAC;MAChE,MAAM,IAAIP,gCAAe,CACvB,GAAG0B,QAAQ,kBAAkB,EAC7B,GAAGA,QAAQ,qCAAqCf,OAAO,EACzD,CAAC;IACH;IACA,IAAI;MACF,OAAOc,MAAM,CAAC,IAAAK,mBAAM,EAAC/B,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,OAAOQ,GAAG,EAAE;MACZ,IAAI,IAAAC,kCAAiB,EAACD,GAAG,CAAC,EAAE,MAAMA,GAAG;MACrC,MAAMI,OAAO,GAAGJ,GAAG,YAAYK,KAAK,GAAGL,GAAG,CAACI,OAAO,GAAGE,MAAM,CAACN,GAAG,CAAC;MAChE,MAAM,IAAIP,gCAAe,CACvB,GAAG0B,QAAQ,kBAAkB,EAC7B,GAAGA,QAAQ,iCAAiCf,OAAO,EACrD,CAAC;IACH;EACF;EAEA,MAAciB,aAAaA,CAACJ,GAAa,EAAkB;IACzD,MAAMO,IAAI,GAAG,MAAMP,GAAG,CAACO,IAAI,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7C,IAAIC,MAES;IACb,IAAI;MACFA,MAAM,GAAGF,IAAI,GAAIG,IAAI,CAACC,KAAK,CAACJ,IAAI,CAAC,GAAqBK,SAAS;IACjE,CAAC,CAAC,MAAM;MACNH,MAAM,GAAGG,SAAS;IACpB;IACA,MAAMC,SAAS,GACbJ,MAAM,EAAEK,UAAU,IAClBL,MAAM,EAAEZ,IAAI,KACX,OAAOY,MAAM,EAAEM,KAAK,KAAK,QAAQ,GAAGN,MAAM,CAACM,KAAK,GAAGH,SAAS,CAAC;IAEhE,QAAQZ,GAAG,CAACgB,MAAM;MAChB,KAAK,GAAG;QACN9F,GAAG,CAACgE,MAAM,CAAC,yCAAyC,CAAC;QACrD,MAAM,IAAIV,gCAAe,CAAC,eAAe,EAAE,2CAA2C,CAAC;MACzF,KAAK,GAAG;QACN,IAAIqC,SAAS,KAAK,mBAAmB,EAAE;UACrC3F,GAAG,CAACgE,MAAM,CAAC,6BAA6B,CAAC;UACzC,MAAM,IAAIV,gCAAe,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;QACtF;QACAtD,GAAG,CAACgE,MAAM,CAAC,2BAA2B,CAAC;QACvC,MAAMV,gCAAe,CAACyC,cAAc,CAAC,CAAC;MACxC,KAAK,GAAG;QACN/F,GAAG,CAACgE,MAAM,CAAC,qCAAqC,CAAC;QACjD,MAAM,IAAIV,gCAAe,CACvB,2BAA2B,EAC3B,iDACF,CAAC;MACH,KAAK,GAAG;QACNtD,GAAG,CAACgE,MAAM,CAAC,4BAA4B,CAAC;QACxC,MAAM,IAAIV,gCAAe,CACvB,kBAAkB,EAClB,oDACF,CAAC;MACH,KAAK,GAAG;QACNtD,GAAG,CAACgE,MAAM,CAAC,mCAAmC,CAAC;QAC/C,MAAM,IAAIV,gCAAe,CACvB,yBAAyB,EACzB,2DACF,CAAC;MACH,KAAK,GAAG;QACNtD,GAAG,CAACgE,MAAM,CAAC,2BAA2B,CAAC;QACvC,MAAM,IAAIV,gCAAe,CACvB,iBAAiB,EACjB,gEACF,CAAC;MACH,KAAK,GAAG;QACNtD,GAAG,CAACgE,MAAM,CAAC,+BAA+B,CAAC;QAC3C,MAAM,IAAIV,gCAAe,CACvB,qBAAqB,EACrB,+CACF,CAAC;MACH;QACEtD,GAAG,CAACgE,MAAM,CAAC,QAAQc,GAAG,CAACgB,MAAM,oBAAoB,CAAC;QAClD,MAAM,IAAIxC,gCAAe,CACvB,eAAe,EACf,qBAAqBwB,GAAG,CAACgB,MAAM,iBACjC,CAAC;IACL;EACF;;EAEA;;EAEA;EACA,MAAME,UAAUA,CAACjD,SAAiB,EAAgC;IAChE/C,GAAG,CAACiG,IAAI,CAAC,WAAW,CAAC;IACrB,OAAO,IAAI,CAAC3B,SAAS,CAAC,MAAOV,MAAM,IAAK;MACtC,MAAMkB,GAAG,GAAG,MAAM,IAAI,CAACzC,SAAS,CAAC,IAAI,CAACY,GAAG,CAAC,OAAO,CAAC,EAAE;QAClDiD,MAAM,EAAE,KAAK;QACbpD,OAAO,EAAE,IAAI,CAACA,OAAO,CAACC,SAAS,CAAC;QAChCa;MACF,CAAC,CAAC;MACF,OAAO,IAAI,CAACiB,cAAc,CAACC,GAAG,EAAEqB,mCAAsB,EAAE,SAAS,CAAC;IACpE,CAAC,CAAC;EACJ;;EAEA;EACA,MAAMC,SAASA,CAACrD,SAAiB,EAA+B;IAC9D/C,GAAG,CAACiG,IAAI,CAAC,kBAAkB,CAAC;IAC5B,OAAO,IAAI,CAAC3B,SAAS,CAAC,MAAOV,MAAM,IAAK;MACtC,MAAMkB,GAAG,GAAG,MAAM,IAAI,CAACzC,SAAS,CAAC,IAAI,CAACY,GAAG,CAAC,cAAc,CAAC,EAAE;QACzDiD,MAAM,EAAE,KAAK;QACbpD,OAAO,EAAE,IAAI,CAACA,OAAO,CAACC,SAAS,CAAC;QAChCa;MACF,CAAC,CAAC;MACF,OAAO,IAAI,CAACiB,cAAc,CAACC,GAAG,EAAEuB,kCAAqB,EAAE,QAAQ,CAAC;IAClE,CAAC,CAAC;EACJ;;EAEA;EACA,MAAMC,YAAYA,CAACvD,SAAiB,EAA8B;IAChE/C,GAAG,CAACiG,IAAI,CAAC,qBAAqB,CAAC;IAC/B,OAAO,IAAI,CAAC3B,SAAS,CAAC,MAAOV,MAAM,IAAK;MACtC,MAAMkB,GAAG,GAAG,MAAM,IAAI,CAACzC,SAAS,CAAC,IAAI,CAACY,GAAG,CAAC,iBAAiB,CAAC,EAAE;QAC5DiD,MAAM,EAAE,KAAK;QACbpD,OAAO,EAAE,IAAI,CAACA,OAAO,CAACC,SAAS,CAAC;QAChCa;MACF,CAAC,CAAC;MACF,OAAO,IAAI,CAACiB,cAAc,CAACC,GAAG,EAAEyB,iCAAoB,EAAE,WAAW,CAAC;IACpE,CAAC,CAAC;EACJ;;EAEA;EACA,MAAMC,aAAaA,CAACC,IAGnB,EAA8B;IAC7BzG,GAAG,CAACiG,IAAI,CAAC,sBAAsB,CAAC;IAChC,OAAO,IAAI,CAAC3B,SAAS,CAAC,MAAOV,MAAM,IAAK;MACtC,MAAMkB,GAAG,GAAG,MAAM,IAAI,CAACzC,SAAS,CAAC,IAAI,CAACY,GAAG,CAAC,iBAAiB,CAAC,EAAE;QAC5DiD,MAAM,EAAE,MAAM;QACdpD,OAAO,EAAE,IAAI,CAACA,OAAO,CAAC2D,IAAI,CAAC1D,SAAS,CAAC;QACrCM,IAAI,EAAEmC,IAAI,CAACkB,SAAS,CAACD,IAAI,CAACE,OAAO,CAAC;QAClC/C;MACF,CAAC,CAAC;MACF,OAAO,IAAI,CAACiB,cAAc,CAACC,GAAG,EAAE8B,iCAAoB,EAAE,WAAW,CAAC;IACpE,CAAC,CAAC;EACJ;;EAEA;EACA,MAAMC,eAAeA,CAAC9D,SAAiB,EAAE+D,UAAmB,EAAwB;IAClF9G,GAAG,CAACiG,IAAI,CAAC,gBAAgBa,UAAU,GAAG,iBAAiBA,UAAU,GAAG,GAAG,EAAE,EAAE,CAAC;IAC5E,OAAO,IAAI,CAACxC,SAAS,CAAC,MAAOV,MAAM,IAAK;MACtC,MAAMV,IAAI,GAAG4D,UAAU,GACnB,wBAAwBC,kBAAkB,CAACD,UAAU,CAAC,EAAE,GACxD,WAAW;MACf,MAAMhC,GAAG,GAAG,MAAM,IAAI,CAACzC,SAAS,CAAC,IAAI,CAACY,GAAG,CAACC,IAAI,CAAC,EAAE;QAC/CgD,MAAM,EAAE,KAAK;QACbpD,OAAO,EAAE,IAAI,CAACA,OAAO,CAACC,SAAS,CAAC;QAChCa;MACF,CAAC,CAAC;MACF,OAAO,IAAI,CAACiB,cAAc,CAACC,GAAG,EAAEkC,2BAAc,EAAE,KAAK,CAAC;IACxD,CAAC,CAAC;EACJ;;EAEA;AACF;AACA;AACA;AACA;AACA;EACE,MAAMC,WAAWA,CAACR,IAIjB,EAA4B;IAC3B,MAAMS,GAAG,GAAGT,IAAI,CAACU,cAAc,IAAI,IAAI,CAAC3E,IAAI,CAAC,CAAC;IAC9CxC,GAAG,CAACiG,IAAI,CAAC,+BAA+BQ,IAAI,CAACW,MAAM,IAAI,KAAK,qBAAqBF,GAAG,GAAG,CAAC;IACxF,OAAO,IAAI,CAAC9D,WAAW,CAAC,MAAOQ,MAAM,IAAK;MACxC,MAAMP,IAAI,GAAGoD,IAAI,CAACW,MAAM,GAAG5B,IAAI,CAACkB,SAAS,CAAC;QAAEW,WAAW,EAAEZ,IAAI,CAACW;MAAO,CAAC,CAAC,GAAG,IAAI;MAC9E,MAAMtC,GAAG,GAAG,MAAM,IAAI,CAACzC,SAAS,CAAC,IAAI,CAACY,GAAG,CAAC,eAAe,CAAC,EAAE;QAC1DiD,MAAM,EAAE,MAAM;QACdpD,OAAO,EAAE,IAAI,CAACA,OAAO,CAAC2D,IAAI,CAAC1D,SAAS,EAAE;UAAE,iBAAiB,EAAEmE;QAAI,CAAC,CAAC;QACjE7D,IAAI;QACJO;MACF,CAAC,CAAC;MACF,OAAO,IAAI,CAACiB,cAAc,CAACC,GAAG,EAAEwC,+BAAkB,EAAE,SAAS,CAAC;IAChE,CAAC,CAAC;EACJ;;EAEA;EACA,MAAMC,UAAUA,CAACd,IAIhB,EAA+B;IAC9BzG,GAAG,CAACiG,IAAI,CAAC,wBAAwBQ,IAAI,CAACe,MAAM,gBAAgBf,IAAI,CAACd,SAAS,IAAI,KAAK,GAAG,CAAC;IACvF,OAAO,IAAI,CAACrB,SAAS,CAAC,MAAOV,MAAM,IAAK;MACtC,MAAMP,IAAwD,GAAG;QAAEmE,MAAM,EAAEf,IAAI,CAACe;MAAO,CAAC;MACxF,IAAIf,IAAI,CAACd,SAAS,EAAEtC,IAAI,CAACsB,IAAI,GAAG8B,IAAI,CAACd,SAAS;MAC9C;MACA;MACA,IAAIc,IAAI,CAACe,MAAM,KAAK,OAAO,EAAEnE,IAAI,CAACoE,MAAM,GAAG,KAAK;MAChD,MAAM3C,GAAG,GAAG,MAAM,IAAI,CAACzC,SAAS,CAAC,IAAI,CAACY,GAAG,CAAC,OAAO,CAAC,EAAE;QAClDiD,MAAM,EAAE,OAAO;QACfpD,OAAO,EAAE,IAAI,CAACA,OAAO,CAAC2D,IAAI,CAAC1D,SAAS,CAAC;QACrCM,IAAI,EAAEmC,IAAI,CAACkB,SAAS,CAACrD,IAAI,CAAC;QAC1BO;MACF,CAAC,CAAC;MACF,OAAO,IAAI,CAACiB,cAAc,CAACC,GAAG,EAAE4C,kCAAqB,EAAE,aAAa,CAAC;IACvE,CAAC,CAAC;EACJ;AACF;AAACC,OAAA,CAAAnG,aAAA,GAAAA,aAAA;AAED,SAASoD,KAAKA,CAACgD,EAAU,EAAiB;EACxC,OAAO,IAAIC,OAAO,CAAEC,OAAO,IAAKnE,UAAU,CAACmE,OAAO,EAAEF,EAAE,CAAC,CAAC;AAC1D","ignoreList":[]}

package/lib/commonjs/core/errors/payment-api-error.js

@@ -0,0 +1,35 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.PaymentApiError = void 0;
+exports.isPaymentApiError = isPaymentApiError;
+/**
+ * Errors emitted by the SDK's API client.
+ *
+ * The `code` field is stable wire-of-record for merchant analytics/logging.
+ * The `message` field is intentionally generic and safe to display to end users.
+ */
+class PaymentApiError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = 'PaymentApiError';
+    this.code = code;
+    // Preserve the prototype chain across compile targets.
+    Object.setPrototypeOf(this, PaymentApiError.prototype);
+  }
+  toString() {
+    return `PaymentApiError(${this.code}): ${this.message}`;
+  }
+  static sessionExpired() {
+    return new PaymentApiError('session_expired', 'The payment session has expired.');
+  }
+}
+
+/** Type guard so consumers can narrow without instanceof. */
+exports.PaymentApiError = PaymentApiError;
+function isPaymentApiError(err) {
+  return err instanceof PaymentApiError || typeof err === 'object' && err !== null && err.name === 'PaymentApiError';
+}
+//# sourceMappingURL=payment-api-error.js.map

package/lib/commonjs/core/errors/payment-api-error.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["PaymentApiError","Error","constructor","code","message","name","Object","setPrototypeOf","prototype","toString","sessionExpired","exports","isPaymentApiError","err"],"sourceRoot":"../../../../src","sources":["core/errors/payment-api-error.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMA,eAAe,SAASC,KAAK,CAAC;EAGzCC,WAAWA,CAACC,IAAY,EAAEC,OAAe,EAAE;IACzC,KAAK,CAACA,OAAO,CAAC;IACd,IAAI,CAACC,IAAI,GAAG,iBAAiB;IAC7B,IAAI,CAACF,IAAI,GAAGA,IAAI;IAChB;IACAG,MAAM,CAACC,cAAc,CAAC,IAAI,EAAEP,eAAe,CAACQ,SAAS,CAAC;EACxD;EAESC,QAAQA,CAAA,EAAW;IAC1B,OAAO,mBAAmB,IAAI,CAACN,IAAI,MAAM,IAAI,CAACC,OAAO,EAAE;EACzD;EAEA,OAAOM,cAAcA,CAAA,EAAoB;IACvC,OAAO,IAAIV,eAAe,CAAC,iBAAiB,EAAE,kCAAkC,CAAC;EACnF;AACF;;AAEA;AAAAW,OAAA,CAAAX,eAAA,GAAAA,eAAA;AACO,SAASY,iBAAiBA,CAACC,GAAY,EAA0B;EACtE,OACEA,GAAG,YAAYb,eAAe,IAC7B,OAAOa,GAAG,KAAK,QAAQ,IACtBA,GAAG,KAAK,IAAI,IACXA,GAAG,CAAuBR,IAAI,KAAK,iBAAkB;AAE5D","ignoreList":[]}

package/lib/commonjs/core/models/index.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=index.js.map

package/lib/commonjs/core/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../../../src","sources":["core/models/index.ts"],"mappings":"","ignoreList":[]}