@spare-technologies/spare-link 0.1.0-beta.1 → 1.0.0

package/lib/commonjs/internal/secure-store-pending-session-store.js

@@ -6,18 +6,21 @@ Object.defineProperty(exports, "__esModule", {
 exports.SecureStorePendingSessionStore = void 0;
 var _logger = require("./logger.js");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
- * Production `PendingSessionStore` backed by expo-secure-store. Persists a
- * single in-flight payment session so the SDK can recover after cold start.
+ * Production `PendingSessionStore` backed by expo-secure-store. Persists the
+ * reference of a single in-flight payment so a cold start knows which payment
+ * was under way.
  */
 const log = (0, _logger.createLogger)('SecureStorePendingSessionStore');
-const KEYS = {
-  sessionId: 'spare_link_session_id',
-  bankId: 'spare_link_bank_id',
-  authUrl: 'spare_link_auth_url',
-  consentAt: 'spare_link_consent_at',
-  recoveryAttempts: 'spare_link_recovery_attempts',
-  merchantRef: 'spare_link_merchant_ref'
-};
+const KEY_REFERENCE = 'spare_link_reference';
+
+/**
+ * Keys earlier versions wrote, cleared alongside our own.
+ *
+ * An app upgrading mid-payment would otherwise keep a token and session it can
+ * never resolve — the endpoints they addressed are gone — and the secure store
+ * outlives the version that wrote to it.
+ */
+const RETIRED_KEYS = ['spare_link_token', 'spare_link_session_id', 'spare_link_bank_id', 'spare_link_auth_url', 'spare_link_consent_at', 'spare_link_recovery_attempts', 'spare_link_merchant_ref'];
 async function defaultLoader() {
   try {
     return await Promise.resolve().then(() => _interopRequireWildcard(require('expo-secure-store')));
@@ -57,34 +60,26 @@ class SecureStorePendingSessionStore {
   save(record) {
     return this.enqueueWrite(async () => {
       const s = await this.module;
-      await Promise.all([s.setItemAsync(KEYS.sessionId, record.sessionId), s.setItemAsync(KEYS.bankId, record.selectedBankId), s.setItemAsync(KEYS.authUrl, record.authorizationUrl), record.consentAt !== undefined ? s.setItemAsync(KEYS.consentAt, String(record.consentAt)) : s.deleteItemAsync(KEYS.consentAt), s.setItemAsync(KEYS.recoveryAttempts, String(record.recoveryAttempts)), record.merchantRef ? s.setItemAsync(KEYS.merchantRef, record.merchantRef) : s.deleteItemAsync(KEYS.merchantRef)]);
+      await s.setItemAsync(KEY_REFERENCE, record.reference);
     });
   }
   async load() {
     // Wait for any pending writes to settle so we read a consistent snapshot.
     await this.writeQueue.catch(() => undefined);
     const s = await this.module;
-    const [sessionId, bankId, authUrl, consentAtRaw, attemptsRaw, merchantRef] = await Promise.all([s.getItemAsync(KEYS.sessionId), s.getItemAsync(KEYS.bankId), s.getItemAsync(KEYS.authUrl), s.getItemAsync(KEYS.consentAt), s.getItemAsync(KEYS.recoveryAttempts), s.getItemAsync(KEYS.merchantRef)]);
-    if (!sessionId || !bankId || !authUrl) {
-      log.fine('load: no pending session found');
+    const reference = await s.getItemAsync(KEY_REFERENCE);
+    if (!reference) {
+      log.fine('load: no pending payment found');
       return null;
     }
-    const consentAt = consentAtRaw ? Number(consentAtRaw) : undefined;
-    const recoveryAttempts = attemptsRaw ? Number(attemptsRaw) : 0;
-    const record = {
-      sessionId,
-      selectedBankId: bankId,
-      authorizationUrl: authUrl,
-      recoveryAttempts: Number.isFinite(recoveryAttempts) ? recoveryAttempts : 0
+    return {
+      reference
     };
-    if (consentAt !== undefined && Number.isFinite(consentAt)) record.consentAt = consentAt;
-    if (merchantRef) record.merchantRef = merchantRef;
-    return record;
   }
   clear() {
     return this.enqueueWrite(async () => {
       const s = await this.module;
-      await Promise.all([s.deleteItemAsync(KEYS.sessionId), s.deleteItemAsync(KEYS.bankId), s.deleteItemAsync(KEYS.authUrl), s.deleteItemAsync(KEYS.consentAt), s.deleteItemAsync(KEYS.recoveryAttempts), s.deleteItemAsync(KEYS.merchantRef)]);
+      await Promise.all([s.deleteItemAsync(KEY_REFERENCE), ...RETIRED_KEYS.map(key => s.deleteItemAsync(key))]);
     });
   }
 }

package/lib/commonjs/internal/secure-store-pending-session-store.js.map

@@ -1 +1 @@
-{"version":3,"names":["_logger","require","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","log","createLogger","KEYS","sessionId","bankId","authUrl","consentAt","recoveryAttempts","merchantRef","defaultLoader","Promise","resolve","then","err","Error","message","String","SecureStorePendingSessionStore","secureStore","writeQueue","constructor","moduleLoader","loader","module","enqueueWrite","op","next","catch","save","record","s","all","setItemAsync","selectedBankId","authorizationUrl","undefined","deleteItemAsync","load","consentAtRaw","attemptsRaw","getItemAsync","fine","Number","isFinite","clear","exports"],"sourceRoot":"../../../src","sources":["internal/secure-store-pending-session-store.ts"],"mappings":";;;;;;AAOA,IAAAA,OAAA,GAAAC,OAAA;AAAwC,SAAAC,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAPxC;AACA;AACA;AACA;AAMA,MAAMkB,GAAG,GAAG,IAAAC,oBAAY,EAAC,gCAAgC,CAAC;AAE1D,MAAMC,IAAI,GAAG;EACXC,SAAS,EAAE,uBAAuB;EAClCC,MAAM,EAAE,oBAAoB;EAC5BC,OAAO,EAAE,qBAAqB;EAC9BC,SAAS,EAAE,uBAAuB;EAClCC,gBAAgB,EAAE,8BAA8B;EAChDC,WAAW,EAAE;AACf,CAAU;AAQV,eAAeC,aAAaA,CAAA,EAA+B;EACzD,IAAI;IACF,OAAQ,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAAhC,uBAAA,CAAAD,OAAA,CAAa,mBAAmB,GAAC;EAC3C,CAAC,CAAC,OAAOkC,GAAG,EAAE;IACZ,MAAM,IAAIC,KAAK,CACb,0FACED,GAAG,YAAYC,KAAK,GAAGD,GAAG,CAACE,OAAO,GAAGC,MAAM,CAACH,GAAG,CAAC,GAEpD,CAAC;EACH;AACF;AAEO,MAAMI,8BAA8B,CAAgC;EACjEC,WAAW,GAAsC,IAAI;EAE7D;AACF;AACA;AACA;EACUC,UAAU,GAAkBT,OAAO,CAACC,OAAO,CAAC,CAAC;;EAErD;AACF;AACA;AACA;AACA;EACES,WAAWA,CAACC,YAA8C,GAAGZ,aAAa,EAAE;IAC1E,IAAI,CAACa,MAAM,GAAGD,YAAY;EAC5B;EAEA,IAAYE,MAAMA,CAAA,EAA+B;IAC/C,IAAI,CAAC,IAAI,CAACL,WAAW,EAAE,IAAI,CAACA,WAAW,GAAG,IAAI,CAACI,MAAM,CAAC,CAAC;IACvD,OAAO,IAAI,CAACJ,WAAW;EACzB;;EAEA;EACQM,YAAYA,CAACC,EAAuB,EAAiB;IAC3D,MAAMC,IAAI,GAAG,IAAI,CAACP,UAAU,CAACP,IAAI,CAACa,EAAE,EAAEA,EAAE,CAAC;IACzC,IAAI,CAACN,UAAU,GAAGO,IAAI,CAACC,KAAK,CAAC,MAAM;MACjC;IAAA,CACD,CAAC;IACF,OAAOD,IAAI;EACb;EAEAE,IAAIA,CAACC,MAA4B,EAAiB;IAChD,OAAO,IAAI,CAACL,YAAY,CAAC,YAAY;MACnC,MAAMM,CAAC,GAAG,MAAM,IAAI,CAACP,MAAM;MAC3B,MAAMb,OAAO,CAACqB,GAAG,CAAC,CAChBD,CAAC,CAACE,YAAY,CAAC9B,IAAI,CAACC,SAAS,EAAE0B,MAAM,CAAC1B,SAAS,CAAC,EAChD2B,CAAC,CAACE,YAAY,CAAC9B,IAAI,CAACE,MAAM,EAAEyB,MAAM,CAACI,cAAc,CAAC,EAClDH,CAAC,CAACE,YAAY,CAAC9B,IAAI,CAACG,OAAO,EAAEwB,MAAM,CAACK,gBAAgB,CAAC,EACrDL,MAAM,CAACvB,SAAS,KAAK6B,SAAS,GAC1BL,CAAC,CAACE,YAAY,CAAC9B,IAAI,CAACI,SAAS,EAAEU,MAAM,CAACa,MAAM,CAACvB,SAAS,CAAC,CAAC,GACxDwB,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACI,SAAS,CAAC,EACrCwB,CAAC,CAACE,YAAY,CAAC9B,IAAI,CAACK,gBAAgB,EAAES,MAAM,CAACa,MAAM,CAACtB,gBAAgB,CAAC,CAAC,EACtEsB,MAAM,CAACrB,WAAW,GACdsB,CAAC,CAACE,YAAY,CAAC9B,IAAI,CAACM,WAAW,EAAEqB,MAAM,CAACrB,WAAW,CAAC,GACpDsB,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACM,WAAW,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC;EACJ;EAEA,MAAM6B,IAAIA,CAAA,EAAyC;IACjD;IACA,MAAM,IAAI,CAAClB,UAAU,CAACQ,KAAK,CAAC,MAAMQ,SAAS,CAAC;IAC5C,MAAML,CAAC,GAAG,MAAM,IAAI,CAACP,MAAM;IAC3B,MAAM,CAACpB,SAAS,EAAEC,MAAM,EAAEC,OAAO,EAAEiC,YAAY,EAAEC,WAAW,EAAE/B,WAAW,CAAC,GAAG,MAAME,OAAO,CAACqB,GAAG,CAAC,CAC7FD,CAAC,CAACU,YAAY,CAACtC,IAAI,CAACC,SAAS,CAAC,EAC9B2B,CAAC,CAACU,YAAY,CAACtC,IAAI,CAACE,MAAM,CAAC,EAC3B0B,CAAC,CAACU,YAAY,CAACtC,IAAI,CAACG,OAAO,CAAC,EAC5ByB,CAAC,CAACU,YAAY,CAACtC,IAAI,CAACI,SAAS,CAAC,EAC9BwB,CAAC,CAACU,YAAY,CAACtC,IAAI,CAACK,gBAAgB,CAAC,EACrCuB,CAAC,CAACU,YAAY,CAACtC,IAAI,CAACM,WAAW,CAAC,CACjC,CAAC;IACF,IAAI,CAACL,SAAS,IAAI,CAACC,MAAM,IAAI,CAACC,OAAO,EAAE;MACrCL,GAAG,CAACyC,IAAI,CAAC,gCAAgC,CAAC;MAC1C,OAAO,IAAI;IACb;IACA,MAAMnC,SAAS,GAAGgC,YAAY,GAAGI,MAAM,CAACJ,YAAY,CAAC,GAAGH,SAAS;IACjE,MAAM5B,gBAAgB,GAAGgC,WAAW,GAAGG,MAAM,CAACH,WAAW,CAAC,GAAG,CAAC;IAC9D,MAAMV,MAA4B,GAAG;MACnC1B,SAAS;MACT8B,cAAc,EAAE7B,MAAM;MACtB8B,gBAAgB,EAAE7B,OAAO;MACzBE,gBAAgB,EAAEmC,MAAM,CAACC,QAAQ,CAACpC,gBAAgB,CAAC,GAAGA,gBAAgB,GAAG;IAC3E,CAAC;IACD,IAAID,SAAS,KAAK6B,SAAS,IAAIO,MAAM,CAACC,QAAQ,CAACrC,SAAS,CAAC,EAAEuB,MAAM,CAACvB,SAAS,GAAGA,SAAS;IACvF,IAAIE,WAAW,EAAEqB,MAAM,CAACrB,WAAW,GAAGA,WAAW;IACjD,OAAOqB,MAAM;EACf;EAEAe,KAAKA,CAAA,EAAkB;IACrB,OAAO,IAAI,CAACpB,YAAY,CAAC,YAAY;MACnC,MAAMM,CAAC,GAAG,MAAM,IAAI,CAACP,MAAM;MAC3B,MAAMb,OAAO,CAACqB,GAAG,CAAC,CAChBD,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACC,SAAS,CAAC,EACjC2B,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACE,MAAM,CAAC,EAC9B0B,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACG,OAAO,CAAC,EAC/ByB,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACI,SAAS,CAAC,EACjCwB,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACK,gBAAgB,CAAC,EACxCuB,CAAC,CAACM,eAAe,CAAClC,IAAI,CAACM,WAAW,CAAC,CACpC,CAAC;IACJ,CAAC,CAAC;EACJ;AACF;AAACqC,OAAA,CAAA5B,8BAAA,GAAAA,8BAAA","ignoreList":[]}
+{"version":3,"names":["_logger","require","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","log","createLogger","KEY_REFERENCE","RETIRED_KEYS","defaultLoader","Promise","resolve","then","err","Error","message","String","SecureStorePendingSessionStore","secureStore","writeQueue","constructor","moduleLoader","loader","module","enqueueWrite","op","next","catch","save","record","s","setItemAsync","reference","load","undefined","getItemAsync","fine","clear","all","deleteItemAsync","map","key","exports"],"sourceRoot":"../../../src","sources":["internal/secure-store-pending-session-store.ts"],"mappings":";;;;;;AAQA,IAAAA,OAAA,GAAAC,OAAA;AAAwC,SAAAC,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KARxC;AACA;AACA;AACA;AACA;AAMA,MAAMkB,GAAG,GAAG,IAAAC,oBAAY,EAAC,gCAAgC,CAAC;AAE1D,MAAMC,aAAa,GAAG,sBAAsB;;AAE5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,YAAY,GAAG,CACnB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,8BAA8B,EAC9B,yBAAyB,CACjB;AAQV,eAAeC,aAAaA,CAAA,EAA+B;EACzD,IAAI;IACF,OAAQ,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA3B,uBAAA,CAAAD,OAAA,CAAa,mBAAmB,GAAC;EAC3C,CAAC,CAAC,OAAO6B,GAAG,EAAE;IACZ,MAAM,IAAIC,KAAK,CACb,0FACED,GAAG,YAAYC,KAAK,GAAGD,GAAG,CAACE,OAAO,GAAGC,MAAM,CAACH,GAAG,CAAC,GAEpD,CAAC;EACH;AACF;AAEO,MAAMI,8BAA8B,CAAgC;EACjEC,WAAW,GAAsC,IAAI;EAE7D;AACF;AACA;AACA;EACUC,UAAU,GAAkBT,OAAO,CAACC,OAAO,CAAC,CAAC;;EAErD;AACF;AACA;AACA;AACA;EACES,WAAWA,CAACC,YAA8C,GAAGZ,aAAa,EAAE;IAC1E,IAAI,CAACa,MAAM,GAAGD,YAAY;EAC5B;EAEA,IAAYE,MAAMA,CAAA,EAA+B;IAC/C,IAAI,CAAC,IAAI,CAACL,WAAW,EAAE,IAAI,CAACA,WAAW,GAAG,IAAI,CAACI,MAAM,CAAC,CAAC;IACvD,OAAO,IAAI,CAACJ,WAAW;EACzB;;EAEA;EACQM,YAAYA,CAACC,EAAuB,EAAiB;IAC3D,MAAMC,IAAI,GAAG,IAAI,CAACP,UAAU,CAACP,IAAI,CAACa,EAAE,EAAEA,EAAE,CAAC;IACzC,IAAI,CAACN,UAAU,GAAGO,IAAI,CAACC,KAAK,CAAC,MAAM;MACjC;IAAA,CACD,CAAC;IACF,OAAOD,IAAI;EACb;EAEAE,IAAIA,CAACC,MAA4B,EAAiB;IAChD,OAAO,IAAI,CAACL,YAAY,CAAC,YAAY;MACnC,MAAMM,CAAC,GAAG,MAAM,IAAI,CAACP,MAAM;MAC3B,MAAMO,CAAC,CAACC,YAAY,CAACxB,aAAa,EAAEsB,MAAM,CAACG,SAAS,CAAC;IACvD,CAAC,CAAC;EACJ;EAEA,MAAMC,IAAIA,CAAA,EAAyC;IACjD;IACA,MAAM,IAAI,CAACd,UAAU,CAACQ,KAAK,CAAC,MAAMO,SAAS,CAAC;IAC5C,MAAMJ,CAAC,GAAG,MAAM,IAAI,CAACP,MAAM;IAC3B,MAAMS,SAAS,GAAG,MAAMF,CAAC,CAACK,YAAY,CAAC5B,aAAa,CAAC;IACrD,IAAI,CAACyB,SAAS,EAAE;MACd3B,GAAG,CAAC+B,IAAI,CAAC,gCAAgC,CAAC;MAC1C,OAAO,IAAI;IACb;IACA,OAAO;MAAEJ;IAAU,CAAC;EACtB;EAEAK,KAAKA,CAAA,EAAkB;IACrB,OAAO,IAAI,CAACb,YAAY,CAAC,YAAY;MACnC,MAAMM,CAAC,GAAG,MAAM,IAAI,CAACP,MAAM;MAC3B,MAAMb,OAAO,CAAC4B,GAAG,CAAC,CAChBR,CAAC,CAACS,eAAe,CAAChC,aAAa,CAAC,EAChC,GAAGC,YAAY,CAACgC,GAAG,CAAEC,GAAG,IAAKX,CAAC,CAACS,eAAe,CAACE,GAAG,CAAC,CAAC,CACrD,CAAC;IACJ,CAAC,CAAC;EACJ;AACF;AAACC,OAAA,CAAAzB,8BAAA,GAAAA,8BAAA","ignoreList":[]}

package/lib/commonjs/internal/url-parts.js

@@ -0,0 +1,145 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.isSameOrigin = isSameOrigin;
+exports.parseQueryParams = parseQueryParams;
+exports.parseUrlParts = parseUrlParts;
+/**
+ * Minimal URL parsing that does not go through the global `URL`.
+ *
+ * React Native ships a stub: every component accessor — `protocol`, `hostname`,
+ * `port`, `origin`, `search`, `pathname` — throws "not implemented", and
+ * `searchParams` returns a fresh empty instance that never reads the URL it was
+ * constructed from (`react-native/Libraries/Blob/URL.js`, installed globally by
+ * `setUpXHR.js`). Code written against the standard therefore behaves correctly
+ * under Jest, which runs on Node's real `URL`, and silently reads nothing on a
+ * device.
+ *
+ * The SDK parses what it needs itself rather than asking the host app to install
+ * a polyfill whose presence it cannot verify — an origin check that quietly
+ * stops comparing hosts is worse than one that was never written.
+ */
+
+/** The parts of a URL this SDK compares origins on. */
+
+/** Scheme plus authority. Anything without an authority has no origin to compare. */
+const SCHEME_AND_AUTHORITY = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)/;
+const DEFAULT_PORTS = {
+  http: 80,
+  https: 443
+};
+
+/**
+ * Splits [url] into the parts an origin comparison needs, or null if it has no
+ * authority to compare.
+ */
+function parseUrlParts(url) {
+  const match = SCHEME_AND_AUTHORITY.exec(url.trim());
+  if (!match?.[1] || match[2] === undefined) return null;
+  const scheme = match[1].toLowerCase();
+
+  // Everything up to the last `@` is userinfo, not host. `https://api.real.example@evil.example`
+  // is a request to evil.example, and reading the left half would accept it as the real one.
+  const authority = match[2].slice(match[2].lastIndexOf('@') + 1);
+  const hostAndPort = splitHostAndPort(authority);
+  if (!hostAndPort) return null;
+  const {
+    host,
+    portText
+  } = hostAndPort;
+  if (host.length === 0) return null;
+
+  // An empty port (`https://host:/x`) means the scheme's default, as does no port.
+  if (portText === undefined || portText.length === 0) {
+    return {
+      scheme,
+      host: host.toLowerCase(),
+      port: DEFAULT_PORTS[scheme]
+    };
+  }
+  if (!/^\d+$/.test(portText)) return null;
+  const port = Number.parseInt(portText, 10);
+  if (port > 65535) return null;
+  return {
+    scheme,
+    host: host.toLowerCase(),
+    port
+  };
+}
+
+/**
+ * Whether two URLs share a scheme, host and port.
+ *
+ * Both must carry an authority, so a relative path never matches an absolute
+ * URL: `/link/payment/x` names no origin and must not be read as naming this one.
+ */
+function isSameOrigin(a, b) {
+  const left = parseUrlParts(a);
+  const right = parseUrlParts(b);
+  if (!left || !right) return false;
+  return left.scheme === right.scheme && left.host === right.host && left.port === right.port;
+}
+
+/**
+ * Reads the query string of [url] into a plain object.
+ *
+ * The first occurrence of a repeated key wins, matching `URLSearchParams.get`.
+ * A value the SDK cannot decode is kept in its raw form rather than dropping the
+ * parameter: callers compare against known literals, and a mangled value should
+ * fail that comparison rather than read as absent.
+ */
+function parseQueryParams(url) {
+  const params = {};
+  const start = url.indexOf('?');
+  if (start === -1) return params;
+  const fragment = url.indexOf('#', start);
+  const query = fragment === -1 ? url.slice(start + 1) : url.slice(start + 1, fragment);
+  for (const pair of query.split('&')) {
+    if (pair.length === 0) continue;
+    const eq = pair.indexOf('=');
+    const rawKey = eq === -1 ? pair : pair.slice(0, eq);
+    const rawValue = eq === -1 ? '' : pair.slice(eq + 1);
+    const key = decodeFormComponent(rawKey);
+    if (key.length === 0 || Object.hasOwn(params, key)) continue;
+    params[key] = decodeFormComponent(rawValue);
+  }
+  return params;
+}
+function splitHostAndPort(authority) {
+  // An IPv6 literal carries colons of its own, so its brackets close the host.
+  if (authority.startsWith('[')) {
+    const close = authority.indexOf(']');
+    if (close === -1) return null;
+    const host = authority.slice(0, close + 1);
+    const rest = authority.slice(close + 1);
+    if (rest.length === 0) return {
+      host,
+      portText: undefined
+    };
+    if (!rest.startsWith(':')) return null;
+    return {
+      host,
+      portText: rest.slice(1)
+    };
+  }
+  const colon = authority.indexOf(':');
+  if (colon === -1) return {
+    host: authority,
+    portText: undefined
+  };
+  return {
+    host: authority.slice(0, colon),
+    portText: authority.slice(colon + 1)
+  };
+}
+function decodeFormComponent(value) {
+  const plusesAsSpaces = value.replace(/\+/g, ' ');
+  try {
+    return decodeURIComponent(plusesAsSpaces);
+  } catch {
+    return plusesAsSpaces;
+  }
+}
+//# sourceMappingURL=url-parts.js.map

package/lib/commonjs/internal/url-parts.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["SCHEME_AND_AUTHORITY","DEFAULT_PORTS","http","https","parseUrlParts","url","match","exec","trim","undefined","scheme","toLowerCase","authority","slice","lastIndexOf","hostAndPort","splitHostAndPort","host","portText","length","port","test","Number","parseInt","isSameOrigin","a","b","left","right","parseQueryParams","params","start","indexOf","fragment","query","pair","split","eq","rawKey","rawValue","key","decodeFormComponent","Object","hasOwn","startsWith","close","rest","colon","value","plusesAsSpaces","replace","decodeURIComponent"],"sourceRoot":"../../../src","sources":["internal/url-parts.ts"],"mappings":";;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAUA;AACA,MAAMA,oBAAoB,GAAG,0CAA0C;AAEvE,MAAMC,aAA+C,GAAG;EAAEC,IAAI,EAAE,EAAE;EAAEC,KAAK,EAAE;AAAI,CAAC;;AAEhF;AACA;AACA;AACA;AACO,SAASC,aAAaA,CAACC,GAAW,EAAmB;EAC1D,MAAMC,KAAK,GAAGN,oBAAoB,CAACO,IAAI,CAACF,GAAG,CAACG,IAAI,CAAC,CAAC,CAAC;EACnD,IAAI,CAACF,KAAK,GAAG,CAAC,CAAC,IAAIA,KAAK,CAAC,CAAC,CAAC,KAAKG,SAAS,EAAE,OAAO,IAAI;EAEtD,MAAMC,MAAM,GAAGJ,KAAK,CAAC,CAAC,CAAC,CAACK,WAAW,CAAC,CAAC;;EAErC;EACA;EACA,MAAMC,SAAS,GAAGN,KAAK,CAAC,CAAC,CAAC,CAACO,KAAK,CAACP,KAAK,CAAC,CAAC,CAAC,CAACQ,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;EAE/D,MAAMC,WAAW,GAAGC,gBAAgB,CAACJ,SAAS,CAAC;EAC/C,IAAI,CAACG,WAAW,EAAE,OAAO,IAAI;EAE7B,MAAM;IAAEE,IAAI;IAAEC;EAAS,CAAC,GAAGH,WAAW;EACtC,IAAIE,IAAI,CAACE,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;;EAElC;EACA,IAAID,QAAQ,KAAKT,SAAS,IAAIS,QAAQ,CAACC,MAAM,KAAK,CAAC,EAAE;IACnD,OAAO;MAAET,MAAM;MAAEO,IAAI,EAAEA,IAAI,CAACN,WAAW,CAAC,CAAC;MAAES,IAAI,EAAEnB,aAAa,CAACS,MAAM;IAAE,CAAC;EAC1E;EAEA,IAAI,CAAC,OAAO,CAACW,IAAI,CAACH,QAAQ,CAAC,EAAE,OAAO,IAAI;EACxC,MAAME,IAAI,GAAGE,MAAM,CAACC,QAAQ,CAACL,QAAQ,EAAE,EAAE,CAAC;EAC1C,IAAIE,IAAI,GAAG,KAAK,EAAE,OAAO,IAAI;EAE7B,OAAO;IAAEV,MAAM;IAAEO,IAAI,EAAEA,IAAI,CAACN,WAAW,CAAC,CAAC;IAAES;EAAK,CAAC;AACnD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,YAAYA,CAACC,CAAS,EAAEC,CAAS,EAAW;EAC1D,MAAMC,IAAI,GAAGvB,aAAa,CAACqB,CAAC,CAAC;EAC7B,MAAMG,KAAK,GAAGxB,aAAa,CAACsB,CAAC,CAAC;EAC9B,IAAI,CAACC,IAAI,IAAI,CAACC,KAAK,EAAE,OAAO,KAAK;EACjC,OAAOD,IAAI,CAACjB,MAAM,KAAKkB,KAAK,CAAClB,MAAM,IAAIiB,IAAI,CAACV,IAAI,KAAKW,KAAK,CAACX,IAAI,IAAIU,IAAI,CAACP,IAAI,KAAKQ,KAAK,CAACR,IAAI;AAC7F;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASS,gBAAgBA,CAACxB,GAAW,EAA0B;EACpE,MAAMyB,MAA8B,GAAG,CAAC,CAAC;EAEzC,MAAMC,KAAK,GAAG1B,GAAG,CAAC2B,OAAO,CAAC,GAAG,CAAC;EAC9B,IAAID,KAAK,KAAK,CAAC,CAAC,EAAE,OAAOD,MAAM;EAE/B,MAAMG,QAAQ,GAAG5B,GAAG,CAAC2B,OAAO,CAAC,GAAG,EAAED,KAAK,CAAC;EACxC,MAAMG,KAAK,GAAGD,QAAQ,KAAK,CAAC,CAAC,GAAG5B,GAAG,CAACQ,KAAK,CAACkB,KAAK,GAAG,CAAC,CAAC,GAAG1B,GAAG,CAACQ,KAAK,CAACkB,KAAK,GAAG,CAAC,EAAEE,QAAQ,CAAC;EAErF,KAAK,MAAME,IAAI,IAAID,KAAK,CAACE,KAAK,CAAC,GAAG,CAAC,EAAE;IACnC,IAAID,IAAI,CAAChB,MAAM,KAAK,CAAC,EAAE;IACvB,MAAMkB,EAAE,GAAGF,IAAI,CAACH,OAAO,CAAC,GAAG,CAAC;IAC5B,MAAMM,MAAM,GAAGD,EAAE,KAAK,CAAC,CAAC,GAAGF,IAAI,GAAGA,IAAI,CAACtB,KAAK,CAAC,CAAC,EAAEwB,EAAE,CAAC;IACnD,MAAME,QAAQ,GAAGF,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,GAAGF,IAAI,CAACtB,KAAK,CAACwB,EAAE,GAAG,CAAC,CAAC;IAEpD,MAAMG,GAAG,GAAGC,mBAAmB,CAACH,MAAM,CAAC;IACvC,IAAIE,GAAG,CAACrB,MAAM,KAAK,CAAC,IAAIuB,MAAM,CAACC,MAAM,CAACb,MAAM,EAAEU,GAAG,CAAC,EAAE;IACpDV,MAAM,CAACU,GAAG,CAAC,GAAGC,mBAAmB,CAACF,QAAQ,CAAC;EAC7C;EAEA,OAAOT,MAAM;AACf;AAEA,SAASd,gBAAgBA,CACvBJ,SAAiB,EACsC;EACvD;EACA,IAAIA,SAAS,CAACgC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC7B,MAAMC,KAAK,GAAGjC,SAAS,CAACoB,OAAO,CAAC,GAAG,CAAC;IACpC,IAAIa,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI;IAC7B,MAAM5B,IAAI,GAAGL,SAAS,CAACC,KAAK,CAAC,CAAC,EAAEgC,KAAK,GAAG,CAAC,CAAC;IAC1C,MAAMC,IAAI,GAAGlC,SAAS,CAACC,KAAK,CAACgC,KAAK,GAAG,CAAC,CAAC;IACvC,IAAIC,IAAI,CAAC3B,MAAM,KAAK,CAAC,EAAE,OAAO;MAAEF,IAAI;MAAEC,QAAQ,EAAET;IAAU,CAAC;IAC3D,IAAI,CAACqC,IAAI,CAACF,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI;IACtC,OAAO;MAAE3B,IAAI;MAAEC,QAAQ,EAAE4B,IAAI,CAACjC,KAAK,CAAC,CAAC;IAAE,CAAC;EAC1C;EAEA,MAAMkC,KAAK,GAAGnC,SAAS,CAACoB,OAAO,CAAC,GAAG,CAAC;EACpC,IAAIe,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO;IAAE9B,IAAI,EAAEL,SAAS;IAAEM,QAAQ,EAAET;EAAU,CAAC;EACjE,OAAO;IAAEQ,IAAI,EAAEL,SAAS,CAACC,KAAK,CAAC,CAAC,EAAEkC,KAAK,CAAC;IAAE7B,QAAQ,EAAEN,SAAS,CAACC,KAAK,CAACkC,KAAK,GAAG,CAAC;EAAE,CAAC;AAClF;AAEA,SAASN,mBAAmBA,CAACO,KAAa,EAAU;EAClD,MAAMC,cAAc,GAAGD,KAAK,CAACE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;EAChD,IAAI;IACF,OAAOC,kBAAkB,CAACF,cAAc,CAAC;EAC3C,CAAC,CAAC,MAAM;IACN,OAAOA,cAAc;EACvB;AACF","ignoreList":[]}

package/lib/commonjs/public/index.js

@@ -3,24 +3,6 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-Object.defineProperty(exports, "DEFAULT_AWAITING_CALLBACK_POLL_MS", {
-  enumerable: true,
-  get: function () {
-    return _constants.DEFAULT_AWAITING_CALLBACK_POLL_MS;
-  }
-});
-Object.defineProperty(exports, "DEFAULT_AWAITING_CALLBACK_TIMEOUT_MS", {
-  enumerable: true,
-  get: function () {
-    return _constants.DEFAULT_AWAITING_CALLBACK_TIMEOUT_MS;
-  }
-});
-Object.defineProperty(exports, "DEFAULT_REQUEST_TIMEOUT_MS", {
-  enumerable: true,
-  get: function () {
-    return _constants.DEFAULT_REQUEST_TIMEOUT_MS;
-  }
-});
 Object.defineProperty(exports, "SPARE_LINK_EVENT_TYPES", {
   enumerable: true,
   get: function () {
@@ -75,12 +57,6 @@ Object.defineProperty(exports, "isNoRecoveryNeeded", {
     return _recoveryResult.isNoRecoveryNeeded;
   }
 });
-Object.defineProperty(exports, "isRecoveryAwaitingUser", {
-  enumerable: true,
-  get: function () {
-    return _recoveryResult.isRecoveryAwaitingUser;
-  }
-});
 Object.defineProperty(exports, "isSessionRecovered", {
   enumerable: true,
   get: function () {
@@ -93,12 +69,6 @@ Object.defineProperty(exports, "isSpareLinkEvent", {
     return _spareLinkEvent.isSpareLinkEvent;
   }
 });
-Object.defineProperty(exports, "kMaxRecoveryAttempts", {
-  enumerable: true,
-  get: function () {
-    return _constants.kMaxRecoveryAttempts;
-  }
-});
 Object.defineProperty(exports, "paymentAbandoned", {
   enumerable: true,
   get: function () {
@@ -129,12 +99,6 @@ Object.defineProperty(exports, "resolvedBaseUrl", {
     return _spareLinkConfig.resolvedBaseUrl;
   }
 });
-Object.defineProperty(exports, "resolvedResumeBaseUrl", {
-  enumerable: true,
-  get: function () {
-    return _spareLinkConfig.resolvedResumeBaseUrl;
-  }
-});
 Object.defineProperty(exports, "tenantCountryCode", {
   enumerable: true,
   get: function () {
@@ -147,6 +111,5 @@ var _paymentResult = require("./payment-result.js");
 var _recoveryResult = require("./recovery-result.js");
 var _spareLinkSession = require("./spare-link-session.js");
 var _spareLinkInstance = require("./spare-link-instance.js");
-var _constants = require("./constants.js");
 var _logger = require("../internal/logger.js");
 //# sourceMappingURL=index.js.map

package/lib/commonjs/public/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_spareLinkConfig","require","_spareLinkEvent","_paymentResult","_recoveryResult","_spareLinkSession","_spareLinkInstance","_constants","_logger"],"sourceRoot":"../../../src","sources":["public/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,gBAAA,GAAAC,OAAA;AAYA,IAAAC,eAAA,GAAAD,OAAA;AAiBA,IAAAE,cAAA,GAAAF,OAAA;AA2BA,IAAAG,eAAA,GAAAH,OAAA;AAMA,IAAAI,iBAAA,GAAAJ,OAAA;AACA,IAAAK,kBAAA,GAAAL,OAAA;AAEA,IAAAM,UAAA,GAAAN,OAAA;AAOA,IAAAO,OAAA,GAAAP,OAAA","ignoreList":[]}
+{"version":3,"names":["_spareLinkConfig","require","_spareLinkEvent","_paymentResult","_recoveryResult","_spareLinkSession","_spareLinkInstance","_logger"],"sourceRoot":"../../../src","sources":["public/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,gBAAA,GAAAC,OAAA;AAUA,IAAAC,eAAA,GAAAD,OAAA;AAgBA,IAAAE,cAAA,GAAAF,OAAA;AAmBA,IAAAG,eAAA,GAAAH,OAAA;AAEA,IAAAI,iBAAA,GAAAJ,OAAA;AACA,IAAAK,kBAAA,GAAAL,OAAA;AAEA,IAAAM,OAAA,GAAAN,OAAA","ignoreList":[]}

package/lib/commonjs/public/payment-result.js

@@ -9,15 +9,27 @@ exports.paymentFailed = paymentFailed;
 exports.paymentSuccess = paymentSuccess;
 /**
  * Terminal outcome of a payment flow — narrow on the `status` field.
+ *
+ * Every result here is read off a deep link, which is interceptable by design
+ * and names no bank identifiers. It reports what happened rather than attesting
+ * to it: confirm with your backend via `GET /payment-requests/{reference}`
+ * before acting on one.
  */
 
-/** Payment completed at the bank. `exchangeCode` may be null when recovered
- * via status polling (the bank delivered the code straight to the merchant
- * backend, bypassing the SDK). */
+/**
+ * The return reported a completed payment.
+ *
+ * Treat this as a prompt to confirm with your backend, not as settlement.
+ */
 
 /** Payment failed. Always has an `errorCode` so merchants can map to UI copy. */
 
-/** Flow abandoned mid-flight (app killed, host removed the SDK navigator). */
+/**
+ * The payer left before the flow resolved either way.
+ *
+ * A payment already at the bank may still complete after this, so it is not a
+ * failure — only your backend knows how it ended.
+ */
 
 // ---- Constructor helpers ---------------------------------------------------
 

package/lib/commonjs/public/payment-result.js.map

@@ -1 +1 @@
-{"version":3,"names":["paymentSuccess","args","status","paymentCancelled","paymentFailed","paymentAbandoned"],"sourceRoot":"../../../src","sources":["public/payment-result.ts"],"mappings":";;;;;;;;;AAAA;AACA;AACA;;AAcA;AACA;AACA;;AAaA;;AAMA;;AAOA;;AAEO,SAASA,cAAcA,CAACC,IAAoC,EAAkB;EACnF,OAAO;IAAEC,MAAM,EAAE,SAAS;IAAE,GAAGD;EAAK,CAAC;AACvC;AAEO,SAASE,gBAAgBA,CAACF,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC;AAEO,SAASG,aAAaA,CAACH,IAAmC,EAAiB;EAChF,OAAO;IAAEC,MAAM,EAAE,QAAQ;IAAE,GAAGD;EAAK,CAAC;AACtC;AAEO,SAASI,gBAAgBA,CAACJ,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC","ignoreList":[]}
+{"version":3,"names":["paymentSuccess","args","status","paymentCancelled","paymentFailed","paymentAbandoned"],"sourceRoot":"../../../src","sources":["public/payment-result.ts"],"mappings":";;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA4CA;AACA;AACA;AACA;AACA;;AASA;;AAMA;AACA;AACA;AACA;AACA;AACA;;AAOA;;AAEO,SAASA,cAAcA,CAACC,IAAoC,EAAkB;EACnF,OAAO;IAAEC,MAAM,EAAE,SAAS;IAAE,GAAGD;EAAK,CAAC;AACvC;AAEO,SAASE,gBAAgBA,CAACF,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC;AAEO,SAASG,aAAaA,CAACH,IAAmC,EAAiB;EAChF,OAAO;IAAEC,MAAM,EAAE,QAAQ;IAAE,GAAGD;EAAK,CAAC;AACtC;AAEO,SAASI,gBAAgBA,CAACJ,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC","ignoreList":[]}

package/lib/commonjs/public/recovery-result.js

@@ -4,29 +4,21 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.isNoRecoveryNeeded = isNoRecoveryNeeded;
-exports.isRecoveryAwaitingUser = isRecoveryAwaitingUser;
 exports.isSessionRecovered = isSessionRecovered;
 /**
  * Why {@link SpareLink.resumeIfNeeded} did not recover a terminal session.
- * Mirrors Flutter's `NoRecoveryReason`.
- */
-
-/**
- * Outcome of {@link SpareLink.resumeIfNeeded}.
  *
- * Discriminated union aligned with Flutter's sealed `RecoveryResult`.
+ * `outcomeUnknown` is the one that carries weight: a payment was pending and no
+ * return arrived, so **it may have completed**. The SDK holds no credentials and
+ * has nothing to ask with — the reference is handed back for your backend to
+ * resolve.
  */
 
-/** No pending session was recovered. */
+/** Outcome of {@link SpareLink.resumeIfNeeded}. */
 
-/** A pending session was recovered to a terminal {@link PaymentResult}. */
+/** No pending payment was resolved to a terminal outcome. */
 
-/**
- * A pending session is non-terminal and the SDK opened its recovery UI —
- * the integrator should treat this as in-progress, not "nothing happened".
- * The terminal outcome arrives later via `SpareLink.events` /
- * `spareLink.emitTerminal`, not as a second `resumeIfNeeded` resolution.
- */
+/** A pending payment was resolved to a terminal {@link PaymentResult}. */
 
 function isSessionRecovered(r) {
   return r.kind === 'recovered';
@@ -34,7 +26,4 @@ function isSessionRecovered(r) {
 function isNoRecoveryNeeded(r) {
   return r.kind === 'none';
 }
-function isRecoveryAwaitingUser(r) {
-  return r.kind === 'awaitingUser';
-}
 //# sourceMappingURL=recovery-result.js.map

package/lib/commonjs/public/recovery-result.js.map

@@ -1 +1 @@
-{"version":3,"names":["isSessionRecovered","r","kind","isNoRecoveryNeeded","isRecoveryAwaitingUser"],"sourceRoot":"../../../src","sources":["public/recovery-result.ts"],"mappings":";;;;;;;;AAEA;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;;AAGA;;AAMA;;AAMA;AACA;AACA;AACA;AACA;AACA;;AAMO,SAASA,kBAAkBA,CAACC,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,WAAW;AAC/B;AAEO,SAASC,kBAAkBA,CAACF,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,MAAM;AAC1B;AAEO,SAASE,sBAAsBA,CAACH,CAAiB,EAA6B;EACnF,OAAOA,CAAC,CAACC,IAAI,KAAK,cAAc;AAClC","ignoreList":[]}
+{"version":3,"names":["isSessionRecovered","r","kind","isNoRecoveryNeeded"],"sourceRoot":"../../../src","sources":["public/recovery-result.ts"],"mappings":";;;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;;AAGA;;AAQA;;AAMO,SAASA,kBAAkBA,CAACC,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,WAAW;AAC/B;AAEO,SAASC,kBAAkBA,CAACF,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,MAAM;AAC1B","ignoreList":[]}

package/lib/commonjs/public/spare-link-config.js

@@ -6,21 +6,41 @@ Object.defineProperty(exports, "__esModule", {
 exports.assertValidConfig = assertValidConfig;
 exports.defaultBaseUrlFor = defaultBaseUrlFor;
 exports.resolvedBaseUrl = resolvedBaseUrl;
-exports.resolvedResumeBaseUrl = resolvedResumeBaseUrl;
 exports.tenantCountryCode = tenantCountryCode;
+var _reactNative = require("react-native");
 /**
- * Deployment environment for the Spare Link API.
+ * Deployment environment for the Spare Link API, which is also where the hosted
+ * payment page is served from.
+ */
+
+/** Default port an Encore app serves on. */
+const LOCAL_PORT = 4000;
+
+/**
+ * A Spare API running on the developer's own machine.
+ *
+ * The host differs by platform because an emulator's `localhost` is the emulator,
+ * not the machine hosting it. A **physical device** reaches neither, so pass
+ * `baseUrl` with your machine's address on the local network instead.
  *
- * Each value maps to a default base URL
- * the SDK will hit unless `baseUrl` is overridden in {@link SpareLinkConfig}.
+ * Serves over plain HTTP, which both platforms block by default. See the
+ * integration notes for the debug-only exceptions that allow it.
  */
+function localBaseUrl() {
+  return _reactNative.Platform.OS === 'android' ? `http://10.0.2.2:${LOCAL_PORT}` : `http://localhost:${LOCAL_PORT}`;
+}
 
+/**
+ * `dev` is Spare's own integration environment, not one an integrator would ship
+ * against. Unlike the others its host names a single tenant, so it serves UAE alone.
+ */
 const DEFAULT_BASE_URLS = {
+  dev: 'https://api-dev-uae.tryspare.ae',
   sandbox: 'https://api.sandbox.tryspare.ae',
   production: 'https://api.tryspare.ae'
 };
 function defaultBaseUrlFor(env) {
-  return DEFAULT_BASE_URLS[env];
+  return env === 'local' ? localBaseUrl() : DEFAULT_BASE_URLS[env];
 }
 
 /** Spare API tenant — one country per tenant. */
@@ -34,7 +54,7 @@ function tenantCountryCode(t) {
   return TENANT_COUNTRY_CODES[t];
 }
 
-/** Configuration to start a Spare Link payment flow. */
+/** Configuration for a Spare Link instance. */
 
 /** Resolved base URL: explicit `baseUrl` if provided, else the environment default. */
 function resolvedBaseUrl(config) {
@@ -42,21 +62,26 @@ function resolvedBaseUrl(config) {
 }
 
 /**
- * Recovery config — like {@link SpareLinkConfig} but without `linkToken`
- * (read from the persisted record).
+ * The tenants the hosted flow can actually serve.
+ *
+ * `tenant` accepts the others because the API surface outlives this list, but
+ * accepting one the page cannot serve would put a payer in front of the wrong
+ * country's flow rather than telling the integrator at construction time.
  */
+const SUPPORTED_TENANTS = ['uae'];
 
-function resolvedResumeBaseUrl(config) {
-  return config.baseUrl ?? defaultBaseUrlFor(config.environment);
-}
-
-/** Throws if a SpareLinkConfig is structurally invalid. */
+/**
+ * Throws if a config cannot be honoured.
+ *
+ * Called from {@link SpareLink}'s constructor, so a bad value fails where it was
+ * written rather than reaching the webview as a URL nobody meant.
+ */
 function assertValidConfig(config) {
-  if (!config.linkToken) {
-    throw new Error('SpareLinkConfig: linkToken must not be empty');
-  }
   if (config.baseUrl && !/^https?:\/\//.test(config.baseUrl)) {
     throw new Error('SpareLinkConfig: baseUrl must start with http:// or https://');
   }
+  if (!SUPPORTED_TENANTS.includes(config.tenant)) {
+    throw new Error(`SpareLinkConfig: the hosted flow does not serve tenant '${config.tenant}' yet ` + `(supported: ${SUPPORTED_TENANTS.join(', ')})`);
+  }
 }
 //# sourceMappingURL=spare-link-config.js.map

package/lib/commonjs/public/spare-link-config.js.map

@@ -1 +1 @@
-{"version":3,"names":["DEFAULT_BASE_URLS","sandbox","production","defaultBaseUrlFor","env","TENANT_COUNTRY_CODES","ksa","uae","bah","tenantCountryCode","t","resolvedBaseUrl","config","baseUrl","environment","resolvedResumeBaseUrl","assertValidConfig","linkToken","Error","test"],"sourceRoot":"../../../src","sources":["public/spare-link-config.ts"],"mappings":";;;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;;AAGA,MAAMA,iBAAqD,GAAG;EAC5DC,OAAO,EAAE,iCAAiC;EAC1CC,UAAU,EAAE;AACd,CAAC;AAEM,SAASC,iBAAiBA,CAACC,GAAuB,EAAU;EACjE,OAAOJ,iBAAiB,CAACI,GAAG,CAAC;AAC/B;;AAEA;;AAGA,MAAMC,oBAAoD,GAAG;EAC3DC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE;AACP,CAAC;AAEM,SAASC,iBAAiBA,CAACC,CAAiB,EAAU;EAC3D,OAAOL,oBAAoB,CAACK,CAAC,CAAC;AAChC;;AAEA;;AA2BA;AACO,SAASC,eAAeA,CAACC,MAAuB,EAAU;EAC/D,OAAOA,MAAM,CAACC,OAAO,IAAIV,iBAAiB,CAACS,MAAM,CAACE,WAAW,CAAC;AAChE;;AAEA;AACA;AACA;AACA;;AASO,SAASC,qBAAqBA,CAACH,MAA6B,EAAU;EAC3E,OAAOA,MAAM,CAACC,OAAO,IAAIV,iBAAiB,CAACS,MAAM,CAACE,WAAW,CAAC;AAChE;;AAEA;AACO,SAASE,iBAAiBA,CAACJ,MAAuB,EAAQ;EAC/D,IAAI,CAACA,MAAM,CAACK,SAAS,EAAE;IACrB,MAAM,IAAIC,KAAK,CAAC,8CAA8C,CAAC;EACjE;EACA,IAAIN,MAAM,CAACC,OAAO,IAAI,CAAC,cAAc,CAACM,IAAI,CAACP,MAAM,CAACC,OAAO,CAAC,EAAE;IAC1D,MAAM,IAAIK,KAAK,CAAC,8DAA8D,CAAC;EACjF;AACF","ignoreList":[]}
+{"version":3,"names":["_reactNative","require","LOCAL_PORT","localBaseUrl","Platform","OS","DEFAULT_BASE_URLS","dev","sandbox","production","defaultBaseUrlFor","env","TENANT_COUNTRY_CODES","ksa","uae","bah","tenantCountryCode","t","resolvedBaseUrl","config","baseUrl","environment","SUPPORTED_TENANTS","assertValidConfig","test","Error","includes","tenant","join"],"sourceRoot":"../../../src","sources":["public/spare-link-config.ts"],"mappings":";;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACA;;AAGA;AACA,MAAMC,UAAU,GAAG,IAAI;;AAEvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,YAAYA,CAAA,EAAW;EAC9B,OAAOC,qBAAQ,CAACC,EAAE,KAAK,SAAS,GAC5B,mBAAmBH,UAAU,EAAE,GAC/B,oBAAoBA,UAAU,EAAE;AACtC;;AAEA;AACA;AACA;AACA;AACA,MAAMI,iBAAiF,GAAG;EACxFC,GAAG,EAAE,iCAAiC;EACtCC,OAAO,EAAE,iCAAiC;EAC1CC,UAAU,EAAE;AACd,CAAC;AAEM,SAASC,iBAAiBA,CAACC,GAAuB,EAAU;EACjE,OAAOA,GAAG,KAAK,OAAO,GAAGR,YAAY,CAAC,CAAC,GAAGG,iBAAiB,CAACK,GAAG,CAAC;AAClE;;AAEA;;AAGA,MAAMC,oBAA8D,GAAG;EACrEC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE;AACP,CAAC;AAEM,SAASC,iBAAiBA,CAACC,CAAiB,EAAU;EAC3D,OAAOL,oBAAoB,CAACK,CAAC,CAAC;AAChC;;AAEA;;AAeA;AACO,SAASC,eAAeA,CAACC,MAAuB,EAAU;EAC/D,OAAOA,MAAM,CAACC,OAAO,IAAIV,iBAAiB,CAACS,MAAM,CAACE,WAAW,CAAC;AAChE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,iBAA4C,GAAG,CAAC,KAAK,CAAC;;AAE5D;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAACJ,MAAuB,EAAQ;EAC/D,IAAIA,MAAM,CAACC,OAAO,IAAI,CAAC,cAAc,CAACI,IAAI,CAACL,MAAM,CAACC,OAAO,CAAC,EAAE;IAC1D,MAAM,IAAIK,KAAK,CAAC,8DAA8D,CAAC;EACjF;EACA,IAAI,CAACH,iBAAiB,CAACI,QAAQ,CAACP,MAAM,CAACQ,MAAM,CAAC,EAAE;IAC9C,MAAM,IAAIF,KAAK,CACb,2DAA2DN,MAAM,CAACQ,MAAM,QAAQ,GAC9E,eAAeL,iBAAiB,CAACM,IAAI,CAAC,IAAI,CAAC,GAC/C,CAAC;EACH;AACF","ignoreList":[]}

package/lib/commonjs/public/spare-link-event.js

@@ -8,20 +8,21 @@ exports.isSpareLinkEvent = isSpareLinkEvent;
 /**
  * Lifecycle events emitted on {@link SpareLink.events}.
  *
- * This is a discriminated union (TypeScript's equivalent to Dart sealed classes).
- * Use a switch on the `type` field for exhaustive handling:
+ * Analytics only — never required to drive the flow. This is a discriminated
+ * union (TypeScript's equivalent to Dart sealed classes); switch on `type` for
+ * exhaustive handling:
  *
  * ```ts
  * spareLink.events.subscribe((event) => {
  *   switch (event.type) {
  *     case 'initialized':
- *       console.log('Started flow for', event.linkToken);
+ *       console.log('Started flow for', event.reference);
  *       break;
- *     case 'sessionLoaded':
- *       console.log('Session loaded', event.linkSessionId);
+ *     case 'pageReady':
+ *       console.log('Payer can act on the page');
  *       break;
  *     case 'succeeded':
- *       console.log('Payment succeeded', event.result.exchangeCode);
+ *       console.log('Reported success for', event.result.reference);
  *       break;
  *     // ...
  *   }
@@ -31,24 +32,27 @@ exports.isSpareLinkEvent = isSpareLinkEvent;
 
 /** The SDK has started a payment flow. */
 
-/** The payment session was loaded from the server. */
-
-/** The user confirmed consent and a consent request was submitted. */
+/**
+ * The hosted page is interactive and the payer has something to act on.
+ *
+ * The steps after this — choosing a bank, the payee check, reading the consent —
+ * happen inside the page, which does not report them.
+ */
 
-/** The user is being redirected to their bank's authorization page. */
+/** The payer is being handed to their bank, outside the WebView. */
 
 /** The bank has redirected back with a callback URI. */
 
-/** The payment completed successfully and the flow is about to resolve. */
+/** The return reported a completed payment and the flow is about to resolve. */
 
 /** The payment failed and the flow is about to resolve. */
 
-/** The user cancelled the payment and the flow is about to resolve. */
+/** The payer cancelled the payment and the flow is about to resolve. */
 
-/** The flow was abandoned without an explicit user action. */
+/** The payer left before the flow resolved either way. */
 
 /** All possible event type strings for type narrowing. */
-const SPARE_LINK_EVENT_TYPES = exports.SPARE_LINK_EVENT_TYPES = ['initialized', 'sessionLoaded', 'consentStarted', 'redirectToBank', 'bankCallbackReceived', 'succeeded', 'failed', 'cancelled', 'abandoned'];
+const SPARE_LINK_EVENT_TYPES = exports.SPARE_LINK_EVENT_TYPES = ['initialized', 'pageReady', 'redirectToBank', 'bankCallbackReceived', 'succeeded', 'failed', 'cancelled', 'abandoned'];
 /** Type guard for SpareLinkEvent. */
 function isSpareLinkEvent(value) {
   if (typeof value !== 'object' || value === null) return false;
@@ -58,38 +62,28 @@ function isSpareLinkEvent(value) {
 
 /** Factory functions for creating events (internal use). */
 const SpareLinkEvents = exports.SpareLinkEvents = {
-  initialized(linkToken) {
+  initialized(reference) {
     return {
       type: 'initialized',
-      linkToken
-    };
-  },
-  sessionLoaded(linkToken, linkSessionId) {
-    return linkSessionId ? {
-      type: 'sessionLoaded',
-      linkToken,
-      linkSessionId
-    } : {
-      type: 'sessionLoaded',
-      linkToken
+      reference
     };
   },
-  consentStarted(linkToken) {
+  pageReady(reference) {
     return {
-      type: 'consentStarted',
-      linkToken
+      type: 'pageReady',
+      reference
     };
   },
-  redirectToBank(linkToken) {
+  redirectToBank(reference) {
     return {
       type: 'redirectToBank',
-      linkToken
+      reference
     };
   },
-  bankCallbackReceived(linkToken) {
+  bankCallbackReceived(reference) {
     return {
       type: 'bankCallbackReceived',
-      linkToken
+      reference
     };
   },
   succeeded(result) {