@spare-technologies/spare-link 0.1.0-beta.1 → 1.0.1

package/lib/module/internal/url-parts.js

@@ -0,0 +1,139 @@
+"use strict";
+
+/**
+ * Minimal URL parsing that does not go through the global `URL`.
+ *
+ * React Native ships a stub: every component accessor — `protocol`, `hostname`,
+ * `port`, `origin`, `search`, `pathname` — throws "not implemented", and
+ * `searchParams` returns a fresh empty instance that never reads the URL it was
+ * constructed from (`react-native/Libraries/Blob/URL.js`, installed globally by
+ * `setUpXHR.js`). Code written against the standard therefore behaves correctly
+ * under Jest, which runs on Node's real `URL`, and silently reads nothing on a
+ * device.
+ *
+ * The SDK parses what it needs itself rather than asking the host app to install
+ * a polyfill whose presence it cannot verify — an origin check that quietly
+ * stops comparing hosts is worse than one that was never written.
+ */
+
+/** The parts of a URL this SDK compares origins on. */
+
+/** Scheme plus authority. Anything without an authority has no origin to compare. */
+const SCHEME_AND_AUTHORITY = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)/;
+const DEFAULT_PORTS = {
+  http: 80,
+  https: 443
+};
+
+/**
+ * Splits [url] into the parts an origin comparison needs, or null if it has no
+ * authority to compare.
+ */
+export function parseUrlParts(url) {
+  const match = SCHEME_AND_AUTHORITY.exec(url.trim());
+  if (!match?.[1] || match[2] === undefined) return null;
+  const scheme = match[1].toLowerCase();
+
+  // Everything up to the last `@` is userinfo, not host. `https://api.real.example@evil.example`
+  // is a request to evil.example, and reading the left half would accept it as the real one.
+  const authority = match[2].slice(match[2].lastIndexOf('@') + 1);
+  const hostAndPort = splitHostAndPort(authority);
+  if (!hostAndPort) return null;
+  const {
+    host,
+    portText
+  } = hostAndPort;
+  if (host.length === 0) return null;
+
+  // An empty port (`https://host:/x`) means the scheme's default, as does no port.
+  if (portText === undefined || portText.length === 0) {
+    return {
+      scheme,
+      host: host.toLowerCase(),
+      port: DEFAULT_PORTS[scheme]
+    };
+  }
+  if (!/^\d+$/.test(portText)) return null;
+  const port = Number.parseInt(portText, 10);
+  if (port > 65535) return null;
+  return {
+    scheme,
+    host: host.toLowerCase(),
+    port
+  };
+}
+
+/**
+ * Whether two URLs share a scheme, host and port.
+ *
+ * Both must carry an authority, so a relative path never matches an absolute
+ * URL: `/link/payment/x` names no origin and must not be read as naming this one.
+ */
+export function isSameOrigin(a, b) {
+  const left = parseUrlParts(a);
+  const right = parseUrlParts(b);
+  if (!left || !right) return false;
+  return left.scheme === right.scheme && left.host === right.host && left.port === right.port;
+}
+
+/**
+ * Reads the query string of [url] into a plain object.
+ *
+ * The first occurrence of a repeated key wins, matching `URLSearchParams.get`.
+ * A value the SDK cannot decode is kept in its raw form rather than dropping the
+ * parameter: callers compare against known literals, and a mangled value should
+ * fail that comparison rather than read as absent.
+ */
+export function parseQueryParams(url) {
+  const params = {};
+  const start = url.indexOf('?');
+  if (start === -1) return params;
+  const fragment = url.indexOf('#', start);
+  const query = fragment === -1 ? url.slice(start + 1) : url.slice(start + 1, fragment);
+  for (const pair of query.split('&')) {
+    if (pair.length === 0) continue;
+    const eq = pair.indexOf('=');
+    const rawKey = eq === -1 ? pair : pair.slice(0, eq);
+    const rawValue = eq === -1 ? '' : pair.slice(eq + 1);
+    const key = decodeFormComponent(rawKey);
+    if (key.length === 0 || Object.hasOwn(params, key)) continue;
+    params[key] = decodeFormComponent(rawValue);
+  }
+  return params;
+}
+function splitHostAndPort(authority) {
+  // An IPv6 literal carries colons of its own, so its brackets close the host.
+  if (authority.startsWith('[')) {
+    const close = authority.indexOf(']');
+    if (close === -1) return null;
+    const host = authority.slice(0, close + 1);
+    const rest = authority.slice(close + 1);
+    if (rest.length === 0) return {
+      host,
+      portText: undefined
+    };
+    if (!rest.startsWith(':')) return null;
+    return {
+      host,
+      portText: rest.slice(1)
+    };
+  }
+  const colon = authority.indexOf(':');
+  if (colon === -1) return {
+    host: authority,
+    portText: undefined
+  };
+  return {
+    host: authority.slice(0, colon),
+    portText: authority.slice(colon + 1)
+  };
+}
+function decodeFormComponent(value) {
+  const plusesAsSpaces = value.replace(/\+/g, ' ');
+  try {
+    return decodeURIComponent(plusesAsSpaces);
+  } catch {
+    return plusesAsSpaces;
+  }
+}
+//# sourceMappingURL=url-parts.js.map

package/lib/module/internal/url-parts.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["SCHEME_AND_AUTHORITY","DEFAULT_PORTS","http","https","parseUrlParts","url","match","exec","trim","undefined","scheme","toLowerCase","authority","slice","lastIndexOf","hostAndPort","splitHostAndPort","host","portText","length","port","test","Number","parseInt","isSameOrigin","a","b","left","right","parseQueryParams","params","start","indexOf","fragment","query","pair","split","eq","rawKey","rawValue","key","decodeFormComponent","Object","hasOwn","startsWith","close","rest","colon","value","plusesAsSpaces","replace","decodeURIComponent"],"sourceRoot":"../../../src","sources":["internal/url-parts.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAUA;AACA,MAAMA,oBAAoB,GAAG,0CAA0C;AAEvE,MAAMC,aAA+C,GAAG;EAAEC,IAAI,EAAE,EAAE;EAAEC,KAAK,EAAE;AAAI,CAAC;;AAEhF;AACA;AACA;AACA;AACA,OAAO,SAASC,aAAaA,CAACC,GAAW,EAAmB;EAC1D,MAAMC,KAAK,GAAGN,oBAAoB,CAACO,IAAI,CAACF,GAAG,CAACG,IAAI,CAAC,CAAC,CAAC;EACnD,IAAI,CAACF,KAAK,GAAG,CAAC,CAAC,IAAIA,KAAK,CAAC,CAAC,CAAC,KAAKG,SAAS,EAAE,OAAO,IAAI;EAEtD,MAAMC,MAAM,GAAGJ,KAAK,CAAC,CAAC,CAAC,CAACK,WAAW,CAAC,CAAC;;EAErC;EACA;EACA,MAAMC,SAAS,GAAGN,KAAK,CAAC,CAAC,CAAC,CAACO,KAAK,CAACP,KAAK,CAAC,CAAC,CAAC,CAACQ,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;EAE/D,MAAMC,WAAW,GAAGC,gBAAgB,CAACJ,SAAS,CAAC;EAC/C,IAAI,CAACG,WAAW,EAAE,OAAO,IAAI;EAE7B,MAAM;IAAEE,IAAI;IAAEC;EAAS,CAAC,GAAGH,WAAW;EACtC,IAAIE,IAAI,CAACE,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;;EAElC;EACA,IAAID,QAAQ,KAAKT,SAAS,IAAIS,QAAQ,CAACC,MAAM,KAAK,CAAC,EAAE;IACnD,OAAO;MAAET,MAAM;MAAEO,IAAI,EAAEA,IAAI,CAACN,WAAW,CAAC,CAAC;MAAES,IAAI,EAAEnB,aAAa,CAACS,MAAM;IAAE,CAAC;EAC1E;EAEA,IAAI,CAAC,OAAO,CAACW,IAAI,CAACH,QAAQ,CAAC,EAAE,OAAO,IAAI;EACxC,MAAME,IAAI,GAAGE,MAAM,CAACC,QAAQ,CAACL,QAAQ,EAAE,EAAE,CAAC;EAC1C,IAAIE,IAAI,GAAG,KAAK,EAAE,OAAO,IAAI;EAE7B,OAAO;IAAEV,MAAM;IAAEO,IAAI,EAAEA,IAAI,CAACN,WAAW,CAAC,CAAC;IAAES;EAAK,CAAC;AACnD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASI,YAAYA,CAACC,CAAS,EAAEC,CAAS,EAAW;EAC1D,MAAMC,IAAI,GAAGvB,aAAa,CAACqB,CAAC,CAAC;EAC7B,MAAMG,KAAK,GAAGxB,aAAa,CAACsB,CAAC,CAAC;EAC9B,IAAI,CAACC,IAAI,IAAI,CAACC,KAAK,EAAE,OAAO,KAAK;EACjC,OAAOD,IAAI,CAACjB,MAAM,KAAKkB,KAAK,CAAClB,MAAM,IAAIiB,IAAI,CAACV,IAAI,KAAKW,KAAK,CAACX,IAAI,IAAIU,IAAI,CAACP,IAAI,KAAKQ,KAAK,CAACR,IAAI;AAC7F;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASS,gBAAgBA,CAACxB,GAAW,EAA0B;EACpE,MAAMyB,MAA8B,GAAG,CAAC,CAAC;EAEzC,MAAMC,KAAK,GAAG1B,GAAG,CAAC2B,OAAO,CAAC,GAAG,CAAC;EAC9B,IAAID,KAAK,KAAK,CAAC,CAAC,EAAE,OAAOD,MAAM;EAE/B,MAAMG,QAAQ,GAAG5B,GAAG,CAAC2B,OAAO,CAAC,GAAG,EAAED,KAAK,CAAC;EACxC,MAAMG,KAAK,GAAGD,QAAQ,KAAK,CAAC,CAAC,GAAG5B,GAAG,CAACQ,KAAK,CAACkB,KAAK,GAAG,CAAC,CAAC,GAAG1B,GAAG,CAACQ,KAAK,CAACkB,KAAK,GAAG,CAAC,EAAEE,QAAQ,CAAC;EAErF,KAAK,MAAME,IAAI,IAAID,KAAK,CAACE,KAAK,CAAC,GAAG,CAAC,EAAE;IACnC,IAAID,IAAI,CAAChB,MAAM,KAAK,CAAC,EAAE;IACvB,MAAMkB,EAAE,GAAGF,IAAI,CAACH,OAAO,CAAC,GAAG,CAAC;IAC5B,MAAMM,MAAM,GAAGD,EAAE,KAAK,CAAC,CAAC,GAAGF,IAAI,GAAGA,IAAI,CAACtB,KAAK,CAAC,CAAC,EAAEwB,EAAE,CAAC;IACnD,MAAME,QAAQ,GAAGF,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,GAAGF,IAAI,CAACtB,KAAK,CAACwB,EAAE,GAAG,CAAC,CAAC;IAEpD,MAAMG,GAAG,GAAGC,mBAAmB,CAACH,MAAM,CAAC;IACvC,IAAIE,GAAG,CAACrB,MAAM,KAAK,CAAC,IAAIuB,MAAM,CAACC,MAAM,CAACb,MAAM,EAAEU,GAAG,CAAC,EAAE;IACpDV,MAAM,CAACU,GAAG,CAAC,GAAGC,mBAAmB,CAACF,QAAQ,CAAC;EAC7C;EAEA,OAAOT,MAAM;AACf;AAEA,SAASd,gBAAgBA,CACvBJ,SAAiB,EACsC;EACvD;EACA,IAAIA,SAAS,CAACgC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC7B,MAAMC,KAAK,GAAGjC,SAAS,CAACoB,OAAO,CAAC,GAAG,CAAC;IACpC,IAAIa,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI;IAC7B,MAAM5B,IAAI,GAAGL,SAAS,CAACC,KAAK,CAAC,CAAC,EAAEgC,KAAK,GAAG,CAAC,CAAC;IAC1C,MAAMC,IAAI,GAAGlC,SAAS,CAACC,KAAK,CAACgC,KAAK,GAAG,CAAC,CAAC;IACvC,IAAIC,IAAI,CAAC3B,MAAM,KAAK,CAAC,EAAE,OAAO;MAAEF,IAAI;MAAEC,QAAQ,EAAET;IAAU,CAAC;IAC3D,IAAI,CAACqC,IAAI,CAACF,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI;IACtC,OAAO;MAAE3B,IAAI;MAAEC,QAAQ,EAAE4B,IAAI,CAACjC,KAAK,CAAC,CAAC;IAAE,CAAC;EAC1C;EAEA,MAAMkC,KAAK,GAAGnC,SAAS,CAACoB,OAAO,CAAC,GAAG,CAAC;EACpC,IAAIe,KAAK,KAAK,CAAC,CAAC,EAAE,OAAO;IAAE9B,IAAI,EAAEL,SAAS;IAAEM,QAAQ,EAAET;EAAU,CAAC;EACjE,OAAO;IAAEQ,IAAI,EAAEL,SAAS,CAACC,KAAK,CAAC,CAAC,EAAEkC,KAAK,CAAC;IAAE7B,QAAQ,EAAEN,SAAS,CAACC,KAAK,CAACkC,KAAK,GAAG,CAAC;EAAE,CAAC;AAClF;AAEA,SAASN,mBAAmBA,CAACO,KAAa,EAAU;EAClD,MAAMC,cAAc,GAAGD,KAAK,CAACE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;EAChD,IAAI;IACF,OAAOC,kBAAkB,CAACF,cAAc,CAAC;EAC3C,CAAC,CAAC,MAAM;IACN,OAAOA,cAAc;EACvB;AACF","ignoreList":[]}

package/lib/module/public/index.js

@@ -1,11 +1,10 @@
 "use strict";
 
-export { defaultBaseUrlFor, tenantCountryCode, resolvedBaseUrl, resolvedResumeBaseUrl, assertValidConfig } from "./spare-link-config.js";
+export { defaultBaseUrlFor, tenantCountryCode, resolvedBaseUrl, assertValidConfig } from "./spare-link-config.js";
 export { SPARE_LINK_EVENT_TYPES, isSpareLinkEvent, SpareLinkEvents } from "./spare-link-event.js";
 export { paymentSuccess, paymentCancelled, paymentFailed, paymentAbandoned } from "./payment-result.js";
-export { isSessionRecovered, isNoRecoveryNeeded, isRecoveryAwaitingUser } from "./recovery-result.js";
+export { isSessionRecovered, isNoRecoveryNeeded } from "./recovery-result.js";
 export { SpareLinkSession } from "./spare-link-session.js";
 export { SpareLink } from "./spare-link-instance.js";
-export { kMaxRecoveryAttempts, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_AWAITING_CALLBACK_TIMEOUT_MS, DEFAULT_AWAITING_CALLBACK_POLL_MS } from "./constants.js";
 export { configureSpareLinkLogging, createLogger } from "../internal/logger.js";
 //# sourceMappingURL=index.js.map

package/lib/module/public/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["defaultBaseUrlFor","tenantCountryCode","resolvedBaseUrl","resolvedResumeBaseUrl","assertValidConfig","SPARE_LINK_EVENT_TYPES","isSpareLinkEvent","SpareLinkEvents","paymentSuccess","paymentCancelled","paymentFailed","paymentAbandoned","isSessionRecovered","isNoRecoveryNeeded","isRecoveryAwaitingUser","SpareLinkSession","SpareLink","kMaxRecoveryAttempts","DEFAULT_REQUEST_TIMEOUT_MS","DEFAULT_AWAITING_CALLBACK_TIMEOUT_MS","DEFAULT_AWAITING_CALLBACK_POLL_MS","configureSpareLinkLogging","createLogger"],"sourceRoot":"../../../src","sources":["public/index.ts"],"mappings":";;AAAA,SAKEA,iBAAiB,EACjBC,iBAAiB,EACjBC,eAAe,EACfC,qBAAqB,EACrBC,iBAAiB,QACZ,wBAAqB;AAE5B,SAYEC,sBAAsB,EACtBC,gBAAgB,EAChBC,eAAe,QACV,uBAAoB;AAE3B,SAOEC,cAAc,EACdC,gBAAgB,EAChBC,aAAa,EACbC,gBAAgB,QACX,qBAAkB;AAgBzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,sBAAsB,QACjB,sBAAmB;AAE1B,SAASC,gBAAgB,QAAQ,yBAAsB;AACvD,SAASC,SAAS,QAA+B,0BAAuB;AAExE,SACEC,oBAAoB,EACpBC,0BAA0B,EAC1BC,oCAAoC,EACpCC,iCAAiC,QAC5B,gBAAa;AAEpB,SACEC,yBAAyB,EACzBC,YAAY,QAKP,uBAAoB","ignoreList":[]}
+{"version":3,"names":["defaultBaseUrlFor","tenantCountryCode","resolvedBaseUrl","assertValidConfig","SPARE_LINK_EVENT_TYPES","isSpareLinkEvent","SpareLinkEvents","paymentSuccess","paymentCancelled","paymentFailed","paymentAbandoned","isSessionRecovered","isNoRecoveryNeeded","SpareLinkSession","SpareLink","configureSpareLinkLogging","createLogger"],"sourceRoot":"../../../src","sources":["public/index.ts"],"mappings":";;AAAA,SAIEA,iBAAiB,EACjBC,iBAAiB,EACjBC,eAAe,EACfC,iBAAiB,QACZ,wBAAqB;AAE5B,SAWEC,sBAAsB,EACtBC,gBAAgB,EAChBC,eAAe,QACV,uBAAoB;AAE3B,SAOEC,cAAc,EACdC,gBAAgB,EAChBC,aAAa,EACbC,gBAAgB,QACX,qBAAkB;AAQzB,SAASC,kBAAkB,EAAEC,kBAAkB,QAAQ,sBAAmB;AAE1E,SAASC,gBAAgB,QAAQ,yBAAsB;AACvD,SAASC,SAAS,QAA+B,0BAAuB;AAExE,SACEC,yBAAyB,EACzBC,YAAY,QAKP,uBAAoB","ignoreList":[]}

package/lib/module/public/payment-result.js

@@ -2,15 +2,27 @@
 
 /**
  * Terminal outcome of a payment flow — narrow on the `status` field.
+ *
+ * Every result here is read off a deep link, which is interceptable by design
+ * and names no bank identifiers. It reports what happened rather than attesting
+ * to it: confirm with your backend via `GET /payment-requests/{reference}`
+ * before acting on one.
  */
 
-/** Payment completed at the bank. `exchangeCode` may be null when recovered
- * via status polling (the bank delivered the code straight to the merchant
- * backend, bypassing the SDK). */
+/**
+ * The return reported a completed payment.
+ *
+ * Treat this as a prompt to confirm with your backend, not as settlement.
+ */
 
 /** Payment failed. Always has an `errorCode` so merchants can map to UI copy. */
 
-/** Flow abandoned mid-flight (app killed, host removed the SDK navigator). */
+/**
+ * The payer left before the flow resolved either way.
+ *
+ * A payment already at the bank may still complete after this, so it is not a
+ * failure — only your backend knows how it ended.
+ */
 
 // ---- Constructor helpers ---------------------------------------------------
 

package/lib/module/public/payment-result.js.map

@@ -1 +1 @@
-{"version":3,"names":["paymentSuccess","args","status","paymentCancelled","paymentFailed","paymentAbandoned"],"sourceRoot":"../../../src","sources":["public/payment-result.ts"],"mappings":";;AAAA;AACA;AACA;;AAcA;AACA;AACA;;AAaA;;AAMA;;AAOA;;AAEA,OAAO,SAASA,cAAcA,CAACC,IAAoC,EAAkB;EACnF,OAAO;IAAEC,MAAM,EAAE,SAAS;IAAE,GAAGD;EAAK,CAAC;AACvC;AAEA,OAAO,SAASE,gBAAgBA,CAACF,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC;AAEA,OAAO,SAASG,aAAaA,CAACH,IAAmC,EAAiB;EAChF,OAAO;IAAEC,MAAM,EAAE,QAAQ;IAAE,GAAGD;EAAK,CAAC;AACtC;AAEA,OAAO,SAASI,gBAAgBA,CAACJ,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC","ignoreList":[]}
+{"version":3,"names":["paymentSuccess","args","status","paymentCancelled","paymentFailed","paymentAbandoned"],"sourceRoot":"../../../src","sources":["public/payment-result.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA4CA;AACA;AACA;AACA;AACA;;AASA;;AAMA;AACA;AACA;AACA;AACA;AACA;;AAOA;;AAEA,OAAO,SAASA,cAAcA,CAACC,IAAoC,EAAkB;EACnF,OAAO;IAAEC,MAAM,EAAE,SAAS;IAAE,GAAGD;EAAK,CAAC;AACvC;AAEA,OAAO,SAASE,gBAAgBA,CAACF,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC;AAEA,OAAO,SAASG,aAAaA,CAACH,IAAmC,EAAiB;EAChF,OAAO;IAAEC,MAAM,EAAE,QAAQ;IAAE,GAAGD;EAAK,CAAC;AACtC;AAEA,OAAO,SAASI,gBAAgBA,CAACJ,IAAsC,EAAoB;EACzF,OAAO;IAAEC,MAAM,EAAE,WAAW;IAAE,GAAGD;EAAK,CAAC;AACzC","ignoreList":[]}

package/lib/module/public/recovery-result.js

@@ -2,25 +2,18 @@
 
 /**
  * Why {@link SpareLink.resumeIfNeeded} did not recover a terminal session.
- * Mirrors Flutter's `NoRecoveryReason`.
- */
-
-/**
- * Outcome of {@link SpareLink.resumeIfNeeded}.
  *
- * Discriminated union aligned with Flutter's sealed `RecoveryResult`.
+ * `outcomeUnknown` is the one that carries weight: a payment was pending and no
+ * return arrived, so **it may have completed**. The SDK holds no credentials and
+ * has nothing to ask with — the reference is handed back for your backend to
+ * resolve.
  */
 
-/** No pending session was recovered. */
+/** Outcome of {@link SpareLink.resumeIfNeeded}. */
 
-/** A pending session was recovered to a terminal {@link PaymentResult}. */
+/** No pending payment was resolved to a terminal outcome. */
 
-/**
- * A pending session is non-terminal and the SDK opened its recovery UI —
- * the integrator should treat this as in-progress, not "nothing happened".
- * The terminal outcome arrives later via `SpareLink.events` /
- * `spareLink.emitTerminal`, not as a second `resumeIfNeeded` resolution.
- */
+/** A pending payment was resolved to a terminal {@link PaymentResult}. */
 
 export function isSessionRecovered(r) {
   return r.kind === 'recovered';
@@ -28,7 +21,4 @@ export function isSessionRecovered(r) {
 export function isNoRecoveryNeeded(r) {
   return r.kind === 'none';
 }
-export function isRecoveryAwaitingUser(r) {
-  return r.kind === 'awaitingUser';
-}
 //# sourceMappingURL=recovery-result.js.map

package/lib/module/public/recovery-result.js.map

@@ -1 +1 @@
-{"version":3,"names":["isSessionRecovered","r","kind","isNoRecoveryNeeded","isRecoveryAwaitingUser"],"sourceRoot":"../../../src","sources":["public/recovery-result.ts"],"mappings":";;AAEA;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;;AAGA;;AAMA;;AAMA;AACA;AACA;AACA;AACA;AACA;;AAMA,OAAO,SAASA,kBAAkBA,CAACC,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,WAAW;AAC/B;AAEA,OAAO,SAASC,kBAAkBA,CAACF,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,MAAM;AAC1B;AAEA,OAAO,SAASE,sBAAsBA,CAACH,CAAiB,EAA6B;EACnF,OAAOA,CAAC,CAACC,IAAI,KAAK,cAAc;AAClC","ignoreList":[]}
+{"version":3,"names":["isSessionRecovered","r","kind","isNoRecoveryNeeded"],"sourceRoot":"../../../src","sources":["public/recovery-result.ts"],"mappings":";;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;;AAGA;;AAQA;;AAMA,OAAO,SAASA,kBAAkBA,CAACC,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,WAAW;AAC/B;AAEA,OAAO,SAASC,kBAAkBA,CAACF,CAAiB,EAAyB;EAC3E,OAAOA,CAAC,CAACC,IAAI,KAAK,MAAM;AAC1B","ignoreList":[]}

package/lib/module/public/spare-link-config.js

@@ -1,18 +1,40 @@
 "use strict";
 
+import { Platform } from 'react-native';
+
+/**
+ * Deployment environment for the Spare Link API, which is also where the hosted
+ * payment page is served from.
+ */
+
+/** Default port an Encore app serves on. */
+const LOCAL_PORT = 4000;
+
 /**
- * Deployment environment for the Spare Link API.
+ * A Spare API running on the developer's own machine.
  *
- * Each value maps to a default base URL
- * the SDK will hit unless `baseUrl` is overridden in {@link SpareLinkConfig}.
+ * The host differs by platform because an emulator's `localhost` is the emulator,
+ * not the machine hosting it. A **physical device** reaches neither, so pass
+ * `baseUrl` with your machine's address on the local network instead.
+ *
+ * Serves over plain HTTP, which both platforms block by default. See the
+ * integration notes for the debug-only exceptions that allow it.
  */
+function localBaseUrl() {
+  return Platform.OS === 'android' ? `http://10.0.2.2:${LOCAL_PORT}` : `http://localhost:${LOCAL_PORT}`;
+}
 
+/**
+ * `dev` is Spare's own integration environment, not one an integrator would ship
+ * against. Unlike the others its host names a single tenant, so it serves UAE alone.
+ */
 const DEFAULT_BASE_URLS = {
+  dev: 'https://api-dev-uae.tryspare.ae',
   sandbox: 'https://api.sandbox.tryspare.ae',
   production: 'https://api.tryspare.ae'
 };
 export function defaultBaseUrlFor(env) {
-  return DEFAULT_BASE_URLS[env];
+  return env === 'local' ? localBaseUrl() : DEFAULT_BASE_URLS[env];
 }
 
 /** Spare API tenant — one country per tenant. */
@@ -26,7 +48,7 @@ export function tenantCountryCode(t) {
   return TENANT_COUNTRY_CODES[t];
 }
 
-/** Configuration to start a Spare Link payment flow. */
+/** Configuration for a Spare Link instance. */
 
 /** Resolved base URL: explicit `baseUrl` if provided, else the environment default. */
 export function resolvedBaseUrl(config) {
@@ -34,21 +56,26 @@ export function resolvedBaseUrl(config) {
 }
 
 /**
- * Recovery config — like {@link SpareLinkConfig} but without `linkToken`
- * (read from the persisted record).
+ * The tenants the hosted flow can actually serve.
+ *
+ * `tenant` accepts the others because the API surface outlives this list, but
+ * accepting one the page cannot serve would put a payer in front of the wrong
+ * country's flow rather than telling the integrator at construction time.
  */
+const SUPPORTED_TENANTS = ['uae'];
 
-export function resolvedResumeBaseUrl(config) {
-  return config.baseUrl ?? defaultBaseUrlFor(config.environment);
-}
-
-/** Throws if a SpareLinkConfig is structurally invalid. */
+/**
+ * Throws if a config cannot be honoured.
+ *
+ * Called from {@link SpareLink}'s constructor, so a bad value fails where it was
+ * written rather than reaching the webview as a URL nobody meant.
+ */
 export function assertValidConfig(config) {
-  if (!config.linkToken) {
-    throw new Error('SpareLinkConfig: linkToken must not be empty');
-  }
   if (config.baseUrl && !/^https?:\/\//.test(config.baseUrl)) {
     throw new Error('SpareLinkConfig: baseUrl must start with http:// or https://');
   }
+  if (!SUPPORTED_TENANTS.includes(config.tenant)) {
+    throw new Error(`SpareLinkConfig: the hosted flow does not serve tenant '${config.tenant}' yet ` + `(supported: ${SUPPORTED_TENANTS.join(', ')})`);
+  }
 }
 //# sourceMappingURL=spare-link-config.js.map

package/lib/module/public/spare-link-config.js.map

@@ -1 +1 @@
-{"version":3,"names":["DEFAULT_BASE_URLS","sandbox","production","defaultBaseUrlFor","env","TENANT_COUNTRY_CODES","ksa","uae","bah","tenantCountryCode","t","resolvedBaseUrl","config","baseUrl","environment","resolvedResumeBaseUrl","assertValidConfig","linkToken","Error","test"],"sourceRoot":"../../../src","sources":["public/spare-link-config.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;;AAGA,MAAMA,iBAAqD,GAAG;EAC5DC,OAAO,EAAE,iCAAiC;EAC1CC,UAAU,EAAE;AACd,CAAC;AAED,OAAO,SAASC,iBAAiBA,CAACC,GAAuB,EAAU;EACjE,OAAOJ,iBAAiB,CAACI,GAAG,CAAC;AAC/B;;AAEA;;AAGA,MAAMC,oBAAoD,GAAG;EAC3DC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE;AACP,CAAC;AAED,OAAO,SAASC,iBAAiBA,CAACC,CAAiB,EAAU;EAC3D,OAAOL,oBAAoB,CAACK,CAAC,CAAC;AAChC;;AAEA;;AA2BA;AACA,OAAO,SAASC,eAAeA,CAACC,MAAuB,EAAU;EAC/D,OAAOA,MAAM,CAACC,OAAO,IAAIV,iBAAiB,CAACS,MAAM,CAACE,WAAW,CAAC;AAChE;;AAEA;AACA;AACA;AACA;;AASA,OAAO,SAASC,qBAAqBA,CAACH,MAA6B,EAAU;EAC3E,OAAOA,MAAM,CAACC,OAAO,IAAIV,iBAAiB,CAACS,MAAM,CAACE,WAAW,CAAC;AAChE;;AAEA;AACA,OAAO,SAASE,iBAAiBA,CAACJ,MAAuB,EAAQ;EAC/D,IAAI,CAACA,MAAM,CAACK,SAAS,EAAE;IACrB,MAAM,IAAIC,KAAK,CAAC,8CAA8C,CAAC;EACjE;EACA,IAAIN,MAAM,CAACC,OAAO,IAAI,CAAC,cAAc,CAACM,IAAI,CAACP,MAAM,CAACC,OAAO,CAAC,EAAE;IAC1D,MAAM,IAAIK,KAAK,CAAC,8DAA8D,CAAC;EACjF;AACF","ignoreList":[]}
+{"version":3,"names":["Platform","LOCAL_PORT","localBaseUrl","OS","DEFAULT_BASE_URLS","dev","sandbox","production","defaultBaseUrlFor","env","TENANT_COUNTRY_CODES","ksa","uae","bah","tenantCountryCode","t","resolvedBaseUrl","config","baseUrl","environment","SUPPORTED_TENANTS","assertValidConfig","test","Error","includes","tenant","join"],"sourceRoot":"../../../src","sources":["public/spare-link-config.ts"],"mappings":";;AAAA,SAASA,QAAQ,QAAQ,cAAc;;AAEvC;AACA;AACA;AACA;;AAGA;AACA,MAAMC,UAAU,GAAG,IAAI;;AAEvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,YAAYA,CAAA,EAAW;EAC9B,OAAOF,QAAQ,CAACG,EAAE,KAAK,SAAS,GAC5B,mBAAmBF,UAAU,EAAE,GAC/B,oBAAoBA,UAAU,EAAE;AACtC;;AAEA;AACA;AACA;AACA;AACA,MAAMG,iBAAiF,GAAG;EACxFC,GAAG,EAAE,iCAAiC;EACtCC,OAAO,EAAE,iCAAiC;EAC1CC,UAAU,EAAE;AACd,CAAC;AAED,OAAO,SAASC,iBAAiBA,CAACC,GAAuB,EAAU;EACjE,OAAOA,GAAG,KAAK,OAAO,GAAGP,YAAY,CAAC,CAAC,GAAGE,iBAAiB,CAACK,GAAG,CAAC;AAClE;;AAEA;;AAGA,MAAMC,oBAA8D,GAAG;EACrEC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE,KAAK;EACVC,GAAG,EAAE;AACP,CAAC;AAED,OAAO,SAASC,iBAAiBA,CAACC,CAAiB,EAAU;EAC3D,OAAOL,oBAAoB,CAACK,CAAC,CAAC;AAChC;;AAEA;;AAeA;AACA,OAAO,SAASC,eAAeA,CAACC,MAAuB,EAAU;EAC/D,OAAOA,MAAM,CAACC,OAAO,IAAIV,iBAAiB,CAACS,MAAM,CAACE,WAAW,CAAC;AAChE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,iBAA4C,GAAG,CAAC,KAAK,CAAC;;AAE5D;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAACJ,MAAuB,EAAQ;EAC/D,IAAIA,MAAM,CAACC,OAAO,IAAI,CAAC,cAAc,CAACI,IAAI,CAACL,MAAM,CAACC,OAAO,CAAC,EAAE;IAC1D,MAAM,IAAIK,KAAK,CAAC,8DAA8D,CAAC;EACjF;EACA,IAAI,CAACH,iBAAiB,CAACI,QAAQ,CAACP,MAAM,CAACQ,MAAM,CAAC,EAAE;IAC9C,MAAM,IAAIF,KAAK,CACb,2DAA2DN,MAAM,CAACQ,MAAM,QAAQ,GAC9E,eAAeL,iBAAiB,CAACM,IAAI,CAAC,IAAI,CAAC,GAC/C,CAAC;EACH;AACF","ignoreList":[]}

package/lib/module/public/spare-link-event.js

@@ -3,20 +3,21 @@
 /**
  * Lifecycle events emitted on {@link SpareLink.events}.
  *
- * This is a discriminated union (TypeScript's equivalent to Dart sealed classes).
- * Use a switch on the `type` field for exhaustive handling:
+ * Analytics only — never required to drive the flow. This is a discriminated
+ * union (TypeScript's equivalent to Dart sealed classes); switch on `type` for
+ * exhaustive handling:
  *
  * ```ts
  * spareLink.events.subscribe((event) => {
  *   switch (event.type) {
  *     case 'initialized':
- *       console.log('Started flow for', event.linkToken);
+ *       console.log('Started flow for', event.reference);
  *       break;
- *     case 'sessionLoaded':
- *       console.log('Session loaded', event.linkSessionId);
+ *     case 'pageReady':
+ *       console.log('Payer can act on the page');
  *       break;
  *     case 'succeeded':
- *       console.log('Payment succeeded', event.result.exchangeCode);
+ *       console.log('Reported success for', event.result.reference);
  *       break;
  *     // ...
  *   }
@@ -26,24 +27,27 @@
 
 /** The SDK has started a payment flow. */
 
-/** The payment session was loaded from the server. */
-
-/** The user confirmed consent and a consent request was submitted. */
+/**
+ * The hosted page is interactive and the payer has something to act on.
+ *
+ * The steps after this — choosing a bank, the payee check, reading the consent —
+ * happen inside the page, which does not report them.
+ */
 
-/** The user is being redirected to their bank's authorization page. */
+/** The payer is being handed to their bank, outside the WebView. */
 
 /** The bank has redirected back with a callback URI. */
 
-/** The payment completed successfully and the flow is about to resolve. */
+/** The return reported a completed payment and the flow is about to resolve. */
 
 /** The payment failed and the flow is about to resolve. */
 
-/** The user cancelled the payment and the flow is about to resolve. */
+/** The payer cancelled the payment and the flow is about to resolve. */
 
-/** The flow was abandoned without an explicit user action. */
+/** The payer left before the flow resolved either way. */
 
 /** All possible event type strings for type narrowing. */
-export const SPARE_LINK_EVENT_TYPES = ['initialized', 'sessionLoaded', 'consentStarted', 'redirectToBank', 'bankCallbackReceived', 'succeeded', 'failed', 'cancelled', 'abandoned'];
+export const SPARE_LINK_EVENT_TYPES = ['initialized', 'pageReady', 'redirectToBank', 'bankCallbackReceived', 'succeeded', 'failed', 'cancelled', 'abandoned'];
 /** Type guard for SpareLinkEvent. */
 export function isSpareLinkEvent(value) {
   if (typeof value !== 'object' || value === null) return false;
@@ -53,38 +57,28 @@ export function isSpareLinkEvent(value) {
 
 /** Factory functions for creating events (internal use). */
 export const SpareLinkEvents = {
-  initialized(linkToken) {
+  initialized(reference) {
     return {
       type: 'initialized',
-      linkToken
-    };
-  },
-  sessionLoaded(linkToken, linkSessionId) {
-    return linkSessionId ? {
-      type: 'sessionLoaded',
-      linkToken,
-      linkSessionId
-    } : {
-      type: 'sessionLoaded',
-      linkToken
+      reference
     };
   },
-  consentStarted(linkToken) {
+  pageReady(reference) {
     return {
-      type: 'consentStarted',
-      linkToken
+      type: 'pageReady',
+      reference
     };
   },
-  redirectToBank(linkToken) {
+  redirectToBank(reference) {
     return {
       type: 'redirectToBank',
-      linkToken
+      reference
     };
   },
-  bankCallbackReceived(linkToken) {
+  bankCallbackReceived(reference) {
     return {
       type: 'bankCallbackReceived',
-      linkToken
+      reference
     };
   },
   succeeded(result) {

package/lib/module/public/spare-link-event.js.map

@@ -1 +1 @@
-{"version":3,"names":["SPARE_LINK_EVENT_TYPES","isSpareLinkEvent","value","type","includes","SpareLinkEvents","initialized","linkToken","sessionLoaded","linkSessionId","consentStarted","redirectToBank","bankCallbackReceived","succeeded","result","failed","cancelled","abandoned"],"sourceRoot":"../../../src","sources":["public/spare-link-event.ts"],"mappings":";;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA;;AAMA;;AAQA;;AAMA;;AAMA;;AAMA;;AAMA;;AAMA;;AAMA;;AAMA;AACA,OAAO,MAAMA,sBAAsB,GAAG,CACpC,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,WAAW,EACX,WAAW,CACH;AAIV;AACA,OAAO,SAASC,gBAAgBA,CAACC,KAAc,EAA2B;EACxE,IAAI,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK;EAC7D,MAAMC,IAAI,GAAID,KAAK,CAAwBC,IAAI;EAC/C,OAAO,OAAOA,IAAI,KAAK,QAAQ,IAAIH,sBAAsB,CAACI,QAAQ,CAACD,IAA0B,CAAC;AAChG;;AAEA;AACA,OAAO,MAAME,eAAe,GAAG;EAC7BC,WAAWA,CAACC,SAAiB,EAAwB;IACnD,OAAO;MAAEJ,IAAI,EAAE,aAAa;MAAEI;IAAU,CAAC;EAC3C,CAAC;EACDC,aAAaA,CAACD,SAAiB,EAAEE,aAAsB,EAA0B;IAC/E,OAAOA,aAAa,GAChB;MAAEN,IAAI,EAAE,eAAe;MAAEI,SAAS;MAAEE;IAAc,CAAC,GACnD;MAAEN,IAAI,EAAE,eAAe;MAAEI;IAAU,CAAC;EAC1C,CAAC;EACDG,cAAcA,CAACH,SAAiB,EAA2B;IACzD,OAAO;MAAEJ,IAAI,EAAE,gBAAgB;MAAEI;IAAU,CAAC;EAC9C,CAAC;EACDI,cAAcA,CAACJ,SAAiB,EAA2B;IACzD,OAAO;MAAEJ,IAAI,EAAE,gBAAgB;MAAEI;IAAU,CAAC;EAC9C,CAAC;EACDK,oBAAoBA,CAACL,SAAiB,EAAiC;IACrE,OAAO;MAAEJ,IAAI,EAAE,sBAAsB;MAAEI;IAAU,CAAC;EACpD,CAAC;EACDM,SAASA,CAACC,MAAqB,EAAsB;IACnD,OAAO;MAAEX,IAAI,EAAE,WAAW;MAAEW;IAAO,CAAC;EACtC,CAAC;EACDC,MAAMA,CAACD,MAAqB,EAAmB;IAC7C,OAAO;MAAEX,IAAI,EAAE,QAAQ;MAAEW;IAAO,CAAC;EACnC,CAAC;EACDE,SAASA,CAACF,MAAqB,EAAsB;IACnD,OAAO;MAAEX,IAAI,EAAE,WAAW;MAAEW;IAAO,CAAC;EACtC,CAAC;EACDG,SAASA,CAACH,MAAqB,EAAsB;IACnD,OAAO;MAAEX,IAAI,EAAE,WAAW;MAAEW;IAAO,CAAC;EACtC;AACF,CAAU","ignoreList":[]}
+{"version":3,"names":["SPARE_LINK_EVENT_TYPES","isSpareLinkEvent","value","type","includes","SpareLinkEvents","initialized","reference","pageReady","redirectToBank","bankCallbackReceived","succeeded","result","failed","cancelled","abandoned"],"sourceRoot":"../../../src","sources":["public/spare-link-event.ts"],"mappings":";;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAWA;;AAMA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AAMA;;AAMA;;AAMA;;AAMA;;AAMA;;AAMA;AACA,OAAO,MAAMA,sBAAsB,GAAG,CACpC,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,WAAW,EACX,WAAW,CACH;AAIV;AACA,OAAO,SAASC,gBAAgBA,CAACC,KAAc,EAA2B;EACxE,IAAI,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK;EAC7D,MAAMC,IAAI,GAAID,KAAK,CAAwBC,IAAI;EAC/C,OAAO,OAAOA,IAAI,KAAK,QAAQ,IAAIH,sBAAsB,CAACI,QAAQ,CAACD,IAA0B,CAAC;AAChG;;AAEA;AACA,OAAO,MAAME,eAAe,GAAG;EAC7BC,WAAWA,CAACC,SAAiB,EAAwB;IACnD,OAAO;MAAEJ,IAAI,EAAE,aAAa;MAAEI;IAAU,CAAC;EAC3C,CAAC;EACDC,SAASA,CAACD,SAAiB,EAAsB;IAC/C,OAAO;MAAEJ,IAAI,EAAE,WAAW;MAAEI;IAAU,CAAC;EACzC,CAAC;EACDE,cAAcA,CAACF,SAAiB,EAA2B;IACzD,OAAO;MAAEJ,IAAI,EAAE,gBAAgB;MAAEI;IAAU,CAAC;EAC9C,CAAC;EACDG,oBAAoBA,CAACH,SAAiB,EAAiC;IACrE,OAAO;MAAEJ,IAAI,EAAE,sBAAsB;MAAEI;IAAU,CAAC;EACpD,CAAC;EACDI,SAASA,CAACC,MAAqB,EAAsB;IACnD,OAAO;MAAET,IAAI,EAAE,WAAW;MAAES;IAAO,CAAC;EACtC,CAAC;EACDC,MAAMA,CAACD,MAAqB,EAAmB;IAC7C,OAAO;MAAET,IAAI,EAAE,QAAQ;MAAES;IAAO,CAAC;EACnC,CAAC;EACDE,SAASA,CAACF,MAAqB,EAAsB;IACnD,OAAO;MAAET,IAAI,EAAE,WAAW;MAAES;IAAO,CAAC;EACtC,CAAC;EACDG,SAASA,CAACH,MAAqB,EAAsB;IACnD,OAAO;MAAET,IAAI,EAAE,WAAW;MAAES;IAAO,CAAC;EACtC;AACF,CAAU","ignoreList":[]}