@spare-technologies/spare-link 0.1.0-beta.1 → 1.0.1

package/lib/typescript/commonjs/core/models/index.d.ts

@@ -1,124 +1,2 @@
-/**
- * SDK-side models. These are the camelCase shapes returned from the
- * {@link LinkApiClient} — translated from the snake_case wire format defined
- * by tofa (see harness `src/types/wire.ts` for the raw wire shapes).
- */
-export interface AmountDto {
-    amount: string;
-    currency: string;
-}
-export interface PaymentScheduleEntry {
-    amount?: AmountDto;
-    maxAmount?: AmountDto;
-    paymentExecutionDate?: string;
-}
-export interface PeriodicControls {
-    maxCumulativeAmountPerPeriod?: AmountDto;
-    maxCumulativeNumberOfPaymentsPerPeriod?: number;
-}
-export interface PeriodicSchedule {
-    frequency?: string;
-    startDate?: string;
-    endDate?: string;
-    amount?: AmountDto;
-    maxAmount?: AmountDto;
-    controls?: PeriodicControls;
-}
-export interface CurrencyRequest {
-    priority?: string;
-    purpose?: string;
-    chargeBearer?: string;
-}
-export interface PaymentInstructions {
-    amount?: AmountDto;
-    isInternationalPayment?: boolean;
-    maxCumulativeNumberOfPayments?: number;
-    maxCumulativeAmount?: AmountDto;
-    paymentSchedule?: PaymentScheduleEntry[];
-    periodicSchedule?: PeriodicSchedule;
-    currencyRequest?: CurrencyRequest;
-}
-/** Payment request DTO as carried by GET /link. */
-export interface CreatePaymentRequestInput {
-    id: string;
-    internalReference: string;
-    status: string;
-    type: string;
-    creditorType: string;
-    purpose: string;
-    creditorReference?: string;
-    merchantReference: string;
-    createdAt: string;
-    updatedAt: string;
-    isCopVerified: boolean;
-    creditorAccount: {
-        schemeName: string;
-        identification: string;
-        name?: string;
-    };
-    instructions: PaymentInstructions;
-}
-export interface LinkSessionResponse {
-    request: CreatePaymentRequestInput;
-    providerId?: string;
-}
-export interface ConsentResponse {
-    redirectUrl: string;
-    mobileAppUrl?: string;
-}
-export interface LinkStatusResponse {
-    linkSessionId: string;
-    /** created | initialized | redirected | callback_received | completed | failed | cancelled | expired */
-    status: string;
-    /** payment | account */
-    intent: string;
-    /** sip | multipayment | account */
-    resourceType: string;
-    expiresAt: string;
-    failureCode?: string;
-    cancelledAt?: string;
-    completedAt?: string;
-    failedAt?: string;
-}
-export interface CopResponse {
-    /** `Match` | `NoMatch` | `Unavailable` */
-    matchIndicator: string;
-    maskedName?: string;
-}
-export interface TelemetryResponse {
-    accepted?: boolean;
-    linkSessionId?: string;
-}
-export interface PatchTokenResponse {
-    status: string;
-    linkSession?: {
-        linkSessionId: string;
-        status: string;
-        cancelledAt: string | null;
-        failedAt: string | null;
-        failureCode: string | null;
-    };
-}
-export interface ProviderCountry {
-    englishName: string;
-    iso3166Code: string;
-}
-export interface ProviderSummary {
-    id: string;
-    code: string;
-    name: string;
-    logoUrl: string;
-    status: string;
-    country: ProviderCountry;
-}
-/** Persisted record describing an in-flight payment for cold-start recovery. */
-export interface PendingSessionRecord {
-    sessionId: string;
-    selectedBankId: string;
-    authorizationUrl: string;
-    consentAt?: number;
-    recoveryAttempts: number;
-    /** Merchant reference from the link session, used to bind buffered return URIs. */
-    merchantRef?: string;
-}
+export type { PendingSessionRecord } from './pending-session-record';
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/core/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/models/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B,CAAC,EAAE,SAAS,CAAC;IACzC,sCAAsC,CAAC,EAAE,MAAM,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,mBAAmB,CAAC,EAAE,SAAS,CAAC;IAChC,eAAe,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACzC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,mDAAmD;AACnD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,YAAY,EAAE,mBAAmB,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,yBAAyB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE;QACZ,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/models/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC"}

package/lib/typescript/commonjs/core/models/payment-return-params.d.ts

@@ -1,15 +1,98 @@
+export declare function isPaymentReturnCallbackUri(uri: URL | string): boolean;
+/** Reads the query of a return URI into the shape the extractors below take. */
+export declare function paymentReturnParams(uri: URL | string): Record<string, string>;
 /**
- * Query-parameter helpers for bank / authorize return URIs.
+ * Whether the return URI reports a completed payment.
  *
- * The Link service appends `exchange_code` on success and `error_code` on
- * authorize failure (legacy integrations may still send `error`).
+ * Only a known settled status counts. Absent, in-flight or a status this version
+ * has not been taught is read as not-a-success: a payer returned without one has
+ * not been told their payment succeeded, and neither should the app.
  */
-export declare function isPaymentReturnCallbackUri(uri: URL | string): boolean;
+export declare function isPaymentReturnSuccess(params: Record<string, string>): boolean;
+/** The payment request reference, if the return URI named one. */
+export declare function extractPaymentReturnReference(params: Record<string, string>): string | undefined;
+/** The merchant's own reference for the attempt, if present. */
+export declare function extractPaymentReturnMerchantRef(params: Record<string, string>): string | undefined;
+/**
+ * Spare's identifier for the payment itself, present on a success.
+ *
+ * Distinct from the reference, which names the *request*. This is what a merchant
+ * records against the order.
+ */
+export declare function extractPaymentReturnPaymentId(params: Record<string, string>): string | undefined;
+/**
+ * Spare's identifier for a mandate, present on a mandate's success.
+ *
+ * A return carries this or {@link extractPaymentReturnPaymentId}, never both: a
+ * single payment names a payment, every mandate type names a mandate. Read
+ * whichever is present rather than assuming which one the flow produced.
+ */
+export declare function extractPaymentReturnMandateId(params: Record<string, string>): string | undefined;
+/**
+ * The signature over this return, if it carried one.
+ *
+ * An ES256 JWS whose payload is the return URL. Handed to the caller unverified —
+ * checking it needs Spare's public key, which the SDK does not hold.
+ */
+export declare function extractPaymentReturnSignature(params: Record<string, string>): string | undefined;
+/**
+ * The failure code from a payment return URI.
+ *
+ * A return that says only that it failed, naming no key, still yields something a
+ * merchant can branch on.
+ */
+export declare function extractPaymentReturnErrorCode(params: Record<string, string>): string | undefined;
+/**
+ * The machine-readable reason a payment did not complete, e.g. `user_cancelled`.
+ *
+ * Kept alongside the code because the code is often generic where this is not.
+ */
+export declare function extractPaymentReturnErrorReason(params: Record<string, string>): string | undefined;
+/**
+ * The human-readable failure text, if the return carried one.
+ *
+ * For the merchant's logs and their own copy decisions — not shown to the payer
+ * by this SDK, which cannot verify anything the link says.
+ */
+export declare function extractPaymentReturnErrorDescription(params: Record<string, string>): string | undefined;
+/**
+ * Everything a return said, gathered once.
+ *
+ * Carried whole through the flow so a new parameter reaches the caller by being
+ * read here, rather than by being threaded through every state factory.
+ */
+export interface PaymentReturnReport {
+    /**
+     * The payment request this return is about.
+     *
+     * Compared against the payment in flight before the outcome is applied: a
+     * delayed or spoofed callback naming another payment must not resolve this one.
+     */
+    readonly reference?: string;
+    readonly merchantRef?: string;
+    readonly paymentId?: string;
+    /**
+     * Spare's identifier for a mandate. Set instead of `paymentId` when the flow
+     * created a mandate rather than a single payment.
+     */
+    readonly mandateId?: string;
+    readonly signature?: string;
+    readonly errorCode?: string;
+    readonly errorReason?: string;
+    readonly errorDescription?: string;
+}
 /**
- * Extract the failure code from a payment-return URI, if present.
+ * What a return said about the payment.
  *
- * `error_code` takes precedence over the legacy `error` query param. A
- * `status=failure` with no other code resolves to `'authorize_failed'`.
+ * `unknown` is not a failure. The status vocabulary grows, and a payment the
+ * service has not finished deciding on must not be reported as one that failed —
+ * the merchant's backend is what resolves it.
  */
-export declare function extractPaymentReturnErrorCode(params: URLSearchParams): string | undefined;
+export type PaymentReturnOutcome = 'processed' | 'rejected' | 'unknown';
+export declare function paymentReturnOutcome(params: Record<string, string>): PaymentReturnOutcome;
+/** Reads a return URI into an outcome and everything it reported. */
+export declare function readPaymentReturn(uri: URL | string): {
+    outcome: PaymentReturnOutcome;
+    report: PaymentReturnReport;
+};
 //# sourceMappingURL=payment-return-params.d.ts.map

package/lib/typescript/commonjs/core/models/payment-return-params.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payment-return-params.d.ts","sourceRoot":"","sources":["../../../../../src/core/models/payment-return-params.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,CAarE;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAKzF"}
+{"version":3,"file":"payment-return-params.d.ts","sourceRoot":"","sources":["../../../../../src/core/models/payment-return-params.ts"],"names":[],"mappings":"AAqEA,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,CAUrE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAG9E;AAED,kEAAkE;AAClE,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAEhG;AAED,gEAAgE;AAChE,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAEhG;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAEhG;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAEhG;AAsBD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAMhG;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AAExE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,oBAAoB,CAiBzF;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG;IACpD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAeA"}

package/lib/typescript/commonjs/core/models/pending-session-record.d.ts

@@ -0,0 +1,11 @@
+/**
+ * What the SDK remembers about a payment that was still in flight.
+ *
+ * Only the reference: the SDK holds no credentials and can ask the service
+ * nothing, so the record exists to tell a cold start which payment to hand the
+ * merchant's backend for resolution — not to resume the flow itself.
+ */
+export interface PendingSessionRecord {
+    reference: string;
+}
+//# sourceMappingURL=pending-session-record.d.ts.map

package/lib/typescript/commonjs/core/models/pending-session-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-session-record.d.ts","sourceRoot":"","sources":["../../../../../src/core/models/pending-session-record.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/lib/typescript/commonjs/core/services/hosted-flow-controller.d.ts

@@ -0,0 +1,119 @@
+import { type HostedFlowState } from './hosted-flow-state';
+/** Opens a bank authorization URL outside the WebView. */
+export type BankLauncher = (url: string) => Promise<void>;
+/**
+ * How long the page has to become interactive, measured from when the webview
+ * mounts.
+ *
+ * A page can load and still never speak: its script can fail to fetch, or throw
+ * before it posts `spare.ready`. Nothing else would notice, and the payer would
+ * hold a blank frame for as long as they were willing to.
+ *
+ * Measured from the webview rather than from this controller, because a
+ * controller is built before the screen is: the sheet's animation and whatever
+ * the host waits on before rendering would otherwise be charged against the
+ * page's budget, and a page that merely loads slowly would be called unreachable.
+ */
+export declare const DEFAULT_READY_TIMEOUT_MS = 20000;
+export interface HostedFlowControllerOptions {
+    reference: string;
+    bankLauncher?: BankLauncher;
+    /** Override the readiness timeout. Tests set this alongside fake timers. */
+    readyTimeoutMs?: number;
+}
+/**
+ * Drives a hosted payment from the messages the page sends and the deep link
+ * the OS delivers when the payer comes back.
+ *
+ * The SDK makes no API calls of its own: the page creates the consent, and the
+ * merchant's backend reads the result. So this controller only ever reacts —
+ * which is why every transition here is guarded against arriving after the flow
+ * has already resolved.
+ */
+export declare class HostedFlowController {
+    readonly reference: string;
+    private readonly bankLauncher;
+    private readonly listeners;
+    private readonly readyTimeoutMs;
+    private currentState;
+    private readyTimer;
+    constructor(options: HostedFlowControllerOptions);
+    /**
+     * Records that the webview carrying the page is on screen.
+     *
+     * Starts the clock the page has to become interactive. Called on mount rather
+     * than on load, so a document that never finishes arriving is covered too.
+     */
+    reportPageMounted(): void;
+    get state(): HostedFlowState;
+    /** Subscribe to state changes. Returns an unsubscribe function. */
+    subscribe(listener: () => void): () => void;
+    /**
+     * Reacts to a message from the hosted page.
+     *
+     * Resolves to whether the message was understood, so a caller can log what it
+     * dropped. An unrecognised message is not a failure: the page keeps working
+     * and the payer is unaffected.
+     */
+    handleBridgeMessage(raw: unknown): Promise<boolean>;
+    /**
+     * Resolves the flow from the deep link the payer returned through.
+     *
+     * The outcome is read from the link rather than inferred: it is the only
+     * report of what the bank and the payment actually did.
+     */
+    /** Whether the page is still the thing on screen and may still be believed. */
+    private isPagePresented;
+    handleReturn(uri: URL | string): void;
+    /**
+     * Records that the payment page could not be loaded.
+     *
+     * Only meaningful before the bank is opened. Once the payer is away, a load
+     * error is the WebView behind them and says nothing about their payment.
+     *
+     * Before the page has spoken this does not resolve the flow: nothing has been
+     * attempted, so the payer is offered the page again rather than told their
+     * payment failed.
+     *
+     * After it has spoken, it does. By then the payer may have chosen a bank and
+     * the page may have created a consent for it, and reloading from the start
+     * could create a second one while silently discarding what they entered.
+     */
+    failToLoad(): void;
+    /**
+     * Asks for the page again after it could not be reached.
+     *
+     * The attempt is counted so the screen mounts a fresh webview: reusing the one
+     * that failed would show the payer the same dead frame.
+     */
+    retry(): void;
+    /**
+     * Records that the payer gave up on a page that could not be reached.
+     *
+     * Reported as a failure rather than abandonment: the payer did not leave a
+     * payment in progress, the SDK never managed to present one.
+     */
+    giveUp(): void;
+    /**
+     * Records that the payer left before the flow resolved.
+     *
+     * A payment already at the bank may still complete after this, so it is
+     * reported as abandoned rather than failed: the merchant's backend, not the
+     * app, is what knows.
+     */
+    abandon(): void;
+    dispose(): void;
+    private watchForReadiness;
+    private stopWatchingForReadiness;
+    /**
+     * Opens the bank and waits for the payer to be sent back.
+     *
+     * The URL is opened exactly once, and never once the flow has resolved. The
+     * page posts on render, so a rebuild can repeat the message; opening a second
+     * browser — or one for a payment the payer has already left — would leave them
+     * authorizing in a window whose return nobody is waiting for.
+     */
+    private openBank;
+    private moveTo;
+}
+//# sourceMappingURL=hosted-flow-controller.d.ts.map

package/lib/typescript/commonjs/core/services/hosted-flow-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-flow-controller.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,eAAe,EAAqC,MAAM,qBAAqB,CAAC;AAI9F,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,UAAU,CAA4C;gBAElD,OAAO,EAAE,2BAA2B;IAQhD;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAKzB,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACG,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4CzD;;;;;OAKG;IACH,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAKvB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IA4CrC;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,IAAI;IA2BlB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAWb;;;;;OAKG;IACH,MAAM,IAAI,IAAI;IAed;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAmBf,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;OAOG;YACW,QAAQ;IAiCtB,OAAO,CAAC,MAAM;CAcf"}

package/lib/typescript/commonjs/core/services/hosted-flow-state.d.ts

@@ -0,0 +1,75 @@
+import type { PaymentReturnReport } from '../models/payment-return-params';
+/**
+ * Where a hosted payment has got to.
+ *
+ * The phases the payer spends most of their time in — choosing a bank, reading
+ * the consent, confirming the payee — are all `hosted`: they happen inside the
+ * page, which does not report them, and the SDK has nothing to decide there.
+ */
+export type HostedFlowPhase = 
+/** The page is being fetched. Nothing is interactive yet. */
+'loading'
+/** The page is interactive and the payer is working through it. */
+ | 'hosted'
+/**
+ * The page could not be loaded, or loaded and never became interactive.
+ *
+ * Deliberately not terminal. Nothing has been attempted — no consent, no bank,
+ * no money — so the payer is offered the page again rather than told their
+ * payment failed, and the flow stays open while they decide.
+ */
+ | 'unreachable'
+/** A consent exists and the bank is being opened outside the WebView. */
+ | 'redirecting'
+/** The bank has the payer. The next thing to happen is a deep link home. */
+ | 'awaitingCallback' | 'succeeded' | 'failed' | 'cancelled'
+/** The payer left before the flow resolved either way. */
+ | 'abandoned';
+/** Immutable snapshot of a hosted payment. */
+export interface HostedFlowState {
+    readonly phase: HostedFlowPhase;
+    /**
+     * The payment request this flow is paying. Also what the merchant's backend
+     * reads the authoritative result by.
+     */
+    readonly reference: string;
+    /**
+     * Everything the return deep link reported — the merchant's reference, the
+     * payment id, the signature, the failure detail.
+     *
+     * Carried whole so a parameter added to the return contract reaches the caller
+     * without threading a new field through every factory below.
+     */
+    readonly report?: PaymentReturnReport;
+    readonly errorCode?: string;
+    /**
+     * How many times the page has been asked for, starting at 1.
+     *
+     * The screen keys the webview on this so a retry mounts a fresh one; reusing
+     * the failed instance would show the payer the same dead frame.
+     */
+    readonly attempt: number;
+}
+export declare function isTerminalPhase(phase: HostedFlowPhase): boolean;
+/** Factories for each phase, so no caller assembles a state by hand. */
+export declare const HostedFlowStates: {
+    readonly loading: (reference: string, attempt?: number) => HostedFlowState;
+    readonly hosted: (reference: string, attempt?: number) => HostedFlowState;
+    readonly unreachable: (reference: string, attempt?: number) => HostedFlowState;
+    readonly redirecting: (reference: string, attempt?: number) => HostedFlowState;
+    readonly awaitingCallback: (reference: string, attempt?: number) => HostedFlowState;
+    readonly succeeded: (args: {
+        reference: string;
+        report?: PaymentReturnReport;
+        attempt?: number;
+    }) => HostedFlowState;
+    readonly failed: (args: {
+        reference: string;
+        errorCode: string;
+        report?: PaymentReturnReport;
+        attempt?: number;
+    }) => HostedFlowState;
+    readonly cancelled: (reference: string, attempt?: number) => HostedFlowState;
+    readonly abandoned: (reference: string, attempt?: number) => HostedFlowState;
+};
+//# sourceMappingURL=hosted-flow-state.d.ts.map

package/lib/typescript/commonjs/core/services/hosted-flow-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-flow-state.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,MAAM,eAAe;AACzB,6DAA6D;AAC3D,SAAS;AACX,mEAAmE;GACjE,QAAQ;AACV;;;;;;GAMG;GACD,aAAa;AACf,yEAAyE;GACvE,aAAa;AACf,4EAA4E;GAC1E,kBAAkB,GAClB,WAAW,GACX,QAAQ,GACR,WAAW;AACb,0DAA0D;GACxD,WAAW,CAAC;AAEhB,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAE/D;AAED,wEAAwE;AACxE,eAAO,MAAM,gBAAgB;kCACR,MAAM,uBAAgB,eAAe;iCAGtC,MAAM,uBAAgB,eAAe;sCAGhC,MAAM,uBAAgB,eAAe;sCAGrC,MAAM,uBAAgB,eAAe;2CAGhC,MAAM,uBAAgB,eAAe;+BAGjD;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KAAG,eAAe;4BAQN;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,mBAAmB,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KAAG,eAAe;oCASE,MAAM,uBAAgB,eAAe;oCAGrC,MAAM,uBAAgB,eAAe;CAGlD,CAAC"}

package/lib/typescript/commonjs/index.d.ts

@@ -1,19 +1,10 @@
 export { SDK_VERSION } from './version';
 export * from './public';
-export { PaymentApiError, isPaymentApiError } from './core/errors/payment-api-error';
-export type { CreatePaymentRequestInput, AmountDto, PaymentInstructions, PaymentScheduleEntry, PeriodicSchedule, PeriodicControls, CurrencyRequest, LinkSessionResponse, ConsentResponse, LinkStatusResponse, CopResponse, TelemetryResponse, PatchTokenResponse, ProviderCountry, ProviderSummary, PendingSessionRecord, } from './core/models';
-export { isPaymentReturnCallbackUri, extractPaymentReturnErrorCode, } from './core/models/payment-return-params';
-export { LinkApiClient, type LinkApiClientOptions } from './core/client/link-api-client';
-export { PaymentFlowController, type PaymentFlowControllerOptions, type Clock, } from './core/services/payment-flow-controller';
-export { PaymentFlowStates, type PaymentFlowPhase, type PaymentFlowState, } from './core/services/payment-flow-state';
+export { type PaymentReturnReport, isPaymentReturnCallbackUri, readPaymentReturn, extractPaymentReturnErrorCode, extractPaymentReturnErrorDescription, extractPaymentReturnErrorReason, extractPaymentReturnPaymentId, extractPaymentReturnMandateId, extractPaymentReturnReference, extractPaymentReturnMerchantRef, extractPaymentReturnSignature, isPaymentReturnSuccess, paymentReturnParams, } from './core/models/payment-return-params';
+export type { HostedFlowPhase, HostedFlowState } from './core/services/hosted-flow-state';
 export type { PendingSessionStore } from './core/services/pending-session-store';
-export { presentConsent, summaryFromState, formatAmount, formatCop, type ConsentSummaryData, type SinglePaymentSummaryData, type InternationalPaymentSummaryData, type MultiPaymentSummaryData, type ConsentDisplayData, type CopDisplayData, type CopMatchIndicator, } from './core/services/consent-presenter';
-export { buildMultiPaymentRules, rulesSectionTitle, type LabelValueRow, } from './core/services/multi-payment-rules-presenter';
-export { isMultiPayment, isInternational, supportsConfirmationOfPayee, resolvedPaymentType, consentUiVariant, PaymentType, type ConsentUiVariant, } from './core/models/payment-type';
-export { SpareLinkHost, type SpareLinkHostProps, } from './ui/spare-link-host';
-export { PaymentFlowPage, type PaymentFlowPageProps } from './ui/payment-flow-page';
-export { usePaymentFlowState } from './ui/hooks/use-payment-flow-state';
-export { BankSelectionScreen, type BankSelectionScreenProps, ConsentDetailsScreen, type ConsentDetailsScreenProps, RedirectHandoffScreen, ResumeProcessingScreen, type ResumeProcessingScreenProps, ResultScreen, type ResultScreenProps, MandateSetupSuccessScreen, type MandateSetupSuccessScreenProps, } from './ui/screens';
+export type { PendingSessionRecord } from './core/models';
+export { SpareLinkHost, type SpareLinkHostProps } from './ui/spare-link-host';
 export { Colors, Typography, Spacing, FONT_FAMILY } from './ui/theme';
-export { collectTelemetry, launchBankRedirect, type BankRedirectArgs, SecureStorePendingSessionStore, useSpareLinkDeepLinks, } from './internal';
+export { launchBankRedirect, type BankRedirectArgs, SecureStorePendingSessionStore, useSpareLinkDeepLinks, } from './internal';
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,cAAc,UAAU,CAAC;AAGzB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGrF,YAAY,EACV,yBAAyB,EACzB,SAAS,EACT,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGzF,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,KAAK,KAAK,GACX,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,YAAY,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAGjF,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,EACL,cAAc,EACd,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,KAAK,gBAAgB,GACtB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,aAAa,EACb,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,YAAY,EACZ,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,KAAK,8BAA8B,GACpC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGtE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,cAAc,UAAU,CAAC;AAIzB,OAAO,EACL,KAAK,mBAAmB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,6BAA6B,EAC7B,oCAAoC,EACpC,+BAA+B,EAC/B,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,EAC7B,+BAA+B,EAC/B,6BAA6B,EAC7B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAO7C,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAG1F,YAAY,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AACjF,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGtE,OAAO,EACL,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,YAAY,CAAC"}

package/lib/typescript/commonjs/internal/bank-redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bank-redirect.d.ts","sourceRoot":"","sources":["../../../../src/internal/bank-redirect.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAcD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B9E"}
+{"version":3,"file":"bank-redirect.d.ts","sourceRoot":"","sources":["../../../../src/internal/bank-redirect.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAcD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC9E"}

package/lib/typescript/commonjs/internal/hosted/bridge-message.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Messages the hosted payment page sends to this SDK.
+ *
+ * The contract is one-way. The page never waits on a reply, so a message this
+ * version does not recognise is dropped rather than treated as a failure — the
+ * page continues, and a newer page stays usable by an older app.
+ *
+ * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
+ * which arrives here as `event.nativeEvent.data`.
+ */
+export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError;
+/** The payable page is interactive. */
+export interface HostedReady {
+    readonly type: 'ready';
+}
+/**
+ * A consent exists and the bank must now be opened outside the WebView.
+ *
+ * Banks commonly refuse to serve their authorization pages inside an embedded
+ * browser, and the address bar is what lets a payer tell a real bank page from
+ * a convincing copy.
+ */
+export interface HostedOpenUrl {
+    readonly type: 'openUrl';
+    readonly url: string;
+}
+/** The payer cancelled, and the request is already rejected server-side. */
+export interface HostedCancel {
+    readonly type: 'cancel';
+}
+/** The flow cannot continue. [code] is the key the page itself renders. */
+export interface HostedError {
+    readonly type: 'error';
+    readonly code: string;
+}
+/**
+ * Parses a message posted by the hosted page.
+ *
+ * Returns null for anything unrecognised. The message crosses a boundary the
+ * SDK does not control, so nothing here trusts its shape — the WebView message
+ * channel is shared with every script on the page.
+ */
+export declare function parseHostedBridgeMessage(raw: unknown): HostedBridgeMessage | null;
+//# sourceMappingURL=bridge-message.d.ts.map

package/lib/typescript/commonjs/internal/hosted/bridge-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,WAAW,CAAC;AAE3F,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAyBjF"}

package/lib/typescript/commonjs/internal/hosted/hosted-url.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Origin channel this SDK identifies as to the hosted page.
+ *
+ * The same value must be recorded on the payment request by the merchant's
+ * backend, because the bank redirect that completes a payment carries no query
+ * string of ours and the return path is decided from the stored row.
+ */
+export declare const HOSTED_ORIGIN_CHANNEL = "sdk_react_native";
+/**
+ * Builds the hosted payment page URL for a payment request reference.
+ *
+ * The reference is the only credential the page needs; everything else is
+ * resolved server-side from the row it names.
+ */
+export declare function buildHostedPaymentUrl(args: {
+    baseUrl: string;
+    reference: string;
+}): string;
+/**
+ * Whether [url] belongs to the hosted origin derived from [baseUrl].
+ *
+ * The WebView loads only the hosted origin. Bank authentication deliberately
+ * happens outside it, so anything else navigating in-frame is refused rather
+ * than followed.
+ */
+export declare function isHostedOriginUrl(args: {
+    baseUrl: string;
+    url: string;
+}): boolean;
+//# sourceMappingURL=hosted-url.d.ts.map

package/lib/typescript/commonjs/internal/hosted/hosted-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-url.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/hosted-url.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAI1F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAEjF"}

package/lib/typescript/commonjs/internal/index.d.ts

@@ -1,4 +1,3 @@
-export { collectTelemetry } from './telemetry-collector';
 export { launchBankRedirect, type BankRedirectArgs } from './bank-redirect';
 export { SecureStorePendingSessionStore } from './secure-store-pending-session-store';
 export { useSpareLinkDeepLinks } from './deep-link-listener';

package/lib/typescript/commonjs/internal/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/internal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/internal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}

package/lib/typescript/commonjs/internal/redact-uri.d.ts

@@ -1,3 +1,23 @@
-/** Redacts sensitive query params before logging bank-return URIs. */
+/**
+ * Redacts the query of a bank-return URI before it is logged.
+ *
+ * Every value goes except the few that describe the outcome rather than identify
+ * anyone — see {@link KEPT_KEYS}. Redaction is a denylist by default rather than
+ * an allowlist of names to remove: an earlier version named the two keys to
+ * redact, so anything else the return ever carried was logged in full, and one of
+ * the names it knew (`exchange_code`) is not even in the contract any more.
+ *
+ * What is worth keeping in a log is the shape of the URI — its scheme, its path,
+ * which parameters were present — plus enough to explain the outcome.
+ *
+ * It also cannot use the global `URL`. React Native's is a stub whose
+ * `searchParams` returns a fresh empty instance, so `has()` was always false and
+ * this function returned the URI untouched on a device while redacting correctly
+ * under Jest, which runs on Node.
+ *
+ * The query is split here rather than read through `parseQueryParams`, because
+ * that decodes values and keeps only the first of a repeated key — fine for
+ * reading an outcome, wrong for reproducing a URI whose shape is the point.
+ */
 export declare function redactPaymentReturnUri(uri: string): string;
 //# sourceMappingURL=redact-uri.d.ts.map

package/lib/typescript/commonjs/internal/redact-uri.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact-uri.d.ts","sourceRoot":"","sources":["../../../../src/internal/redact-uri.ts"],"names":[],"mappings":"AAEA,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAc1D"}
+{"version":3,"file":"redact-uri.d.ts","sourceRoot":"","sources":["../../../../src/internal/redact-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAmBH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgC1D"}