@spare-technologies/spare-link 0.1.0-beta.1 → 1.0.1

package/lib/commonjs/index.js

@@ -5,125 +5,37 @@ Object.defineProperty(exports, "__esModule", {
 });
 var _exportNames = {
   SDK_VERSION: true,
-  PaymentApiError: true,
-  isPaymentApiError: true,
   isPaymentReturnCallbackUri: true,
+  readPaymentReturn: true,
   extractPaymentReturnErrorCode: true,
-  LinkApiClient: true,
-  PaymentFlowController: true,
-  PaymentFlowStates: true,
-  presentConsent: true,
-  summaryFromState: true,
-  formatAmount: true,
-  formatCop: true,
-  buildMultiPaymentRules: true,
-  rulesSectionTitle: true,
-  isMultiPayment: true,
-  isInternational: true,
-  supportsConfirmationOfPayee: true,
-  resolvedPaymentType: true,
-  consentUiVariant: true,
-  PaymentType: true,
+  extractPaymentReturnErrorDescription: true,
+  extractPaymentReturnErrorReason: true,
+  extractPaymentReturnPaymentId: true,
+  extractPaymentReturnMandateId: true,
+  extractPaymentReturnReference: true,
+  extractPaymentReturnMerchantRef: true,
+  extractPaymentReturnSignature: true,
+  isPaymentReturnSuccess: true,
+  paymentReturnParams: true,
   SpareLinkHost: true,
-  PaymentFlowPage: true,
-  usePaymentFlowState: true,
-  BankSelectionScreen: true,
-  ConsentDetailsScreen: true,
-  RedirectHandoffScreen: true,
-  ResumeProcessingScreen: true,
-  ResultScreen: true,
-  MandateSetupSuccessScreen: true,
   Colors: true,
   Typography: true,
   Spacing: true,
   FONT_FAMILY: true,
-  collectTelemetry: true,
   launchBankRedirect: true,
   SecureStorePendingSessionStore: true,
   useSpareLinkDeepLinks: true
 };
-Object.defineProperty(exports, "BankSelectionScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.BankSelectionScreen;
-  }
-});
 Object.defineProperty(exports, "Colors", {
   enumerable: true,
   get: function () {
-    return _index3.Colors;
-  }
-});
-Object.defineProperty(exports, "ConsentDetailsScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.ConsentDetailsScreen;
+    return _index2.Colors;
   }
 });
 Object.defineProperty(exports, "FONT_FAMILY", {
   enumerable: true,
   get: function () {
-    return _index3.FONT_FAMILY;
-  }
-});
-Object.defineProperty(exports, "LinkApiClient", {
-  enumerable: true,
-  get: function () {
-    return _linkApiClient.LinkApiClient;
-  }
-});
-Object.defineProperty(exports, "MandateSetupSuccessScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.MandateSetupSuccessScreen;
-  }
-});
-Object.defineProperty(exports, "PaymentApiError", {
-  enumerable: true,
-  get: function () {
-    return _paymentApiError.PaymentApiError;
-  }
-});
-Object.defineProperty(exports, "PaymentFlowController", {
-  enumerable: true,
-  get: function () {
-    return _paymentFlowController.PaymentFlowController;
-  }
-});
-Object.defineProperty(exports, "PaymentFlowPage", {
-  enumerable: true,
-  get: function () {
-    return _paymentFlowPage.PaymentFlowPage;
-  }
-});
-Object.defineProperty(exports, "PaymentFlowStates", {
-  enumerable: true,
-  get: function () {
-    return _paymentFlowState.PaymentFlowStates;
-  }
-});
-Object.defineProperty(exports, "PaymentType", {
-  enumerable: true,
-  get: function () {
-    return _paymentType.PaymentType;
-  }
-});
-Object.defineProperty(exports, "RedirectHandoffScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.RedirectHandoffScreen;
-  }
-});
-Object.defineProperty(exports, "ResultScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.ResultScreen;
-  }
-});
-Object.defineProperty(exports, "ResumeProcessingScreen", {
-  enumerable: true,
-  get: function () {
-    return _index2.ResumeProcessingScreen;
+    return _index2.FONT_FAMILY;
   }
 });
 Object.defineProperty(exports, "SDK_VERSION", {
@@ -135,13 +47,13 @@ Object.defineProperty(exports, "SDK_VERSION", {
 Object.defineProperty(exports, "SecureStorePendingSessionStore", {
   enumerable: true,
   get: function () {
-    return _index4.SecureStorePendingSessionStore;
+    return _index3.SecureStorePendingSessionStore;
   }
 });
 Object.defineProperty(exports, "Spacing", {
   enumerable: true,
   get: function () {
-    return _index3.Spacing;
+    return _index2.Spacing;
   }
 });
 Object.defineProperty(exports, "SpareLinkHost", {
@@ -153,25 +65,7 @@ Object.defineProperty(exports, "SpareLinkHost", {
 Object.defineProperty(exports, "Typography", {
   enumerable: true,
   get: function () {
-    return _index3.Typography;
-  }
-});
-Object.defineProperty(exports, "buildMultiPaymentRules", {
-  enumerable: true,
-  get: function () {
-    return _multiPaymentRulesPresenter.buildMultiPaymentRules;
-  }
-});
-Object.defineProperty(exports, "collectTelemetry", {
-  enumerable: true,
-  get: function () {
-    return _index4.collectTelemetry;
-  }
-});
-Object.defineProperty(exports, "consentUiVariant", {
-  enumerable: true,
-  get: function () {
-    return _paymentType.consentUiVariant;
+    return _index2.Typography;
   }
 });
 Object.defineProperty(exports, "extractPaymentReturnErrorCode", {
@@ -180,88 +74,82 @@ Object.defineProperty(exports, "extractPaymentReturnErrorCode", {
     return _paymentReturnParams.extractPaymentReturnErrorCode;
   }
 });
-Object.defineProperty(exports, "formatAmount", {
+Object.defineProperty(exports, "extractPaymentReturnErrorDescription", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.formatAmount;
+    return _paymentReturnParams.extractPaymentReturnErrorDescription;
   }
 });
-Object.defineProperty(exports, "formatCop", {
+Object.defineProperty(exports, "extractPaymentReturnErrorReason", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.formatCop;
+    return _paymentReturnParams.extractPaymentReturnErrorReason;
   }
 });
-Object.defineProperty(exports, "isInternational", {
+Object.defineProperty(exports, "extractPaymentReturnMandateId", {
   enumerable: true,
   get: function () {
-    return _paymentType.isInternational;
+    return _paymentReturnParams.extractPaymentReturnMandateId;
   }
 });
-Object.defineProperty(exports, "isMultiPayment", {
+Object.defineProperty(exports, "extractPaymentReturnMerchantRef", {
   enumerable: true,
   get: function () {
-    return _paymentType.isMultiPayment;
+    return _paymentReturnParams.extractPaymentReturnMerchantRef;
   }
 });
-Object.defineProperty(exports, "isPaymentApiError", {
+Object.defineProperty(exports, "extractPaymentReturnPaymentId", {
   enumerable: true,
   get: function () {
-    return _paymentApiError.isPaymentApiError;
+    return _paymentReturnParams.extractPaymentReturnPaymentId;
   }
 });
-Object.defineProperty(exports, "isPaymentReturnCallbackUri", {
+Object.defineProperty(exports, "extractPaymentReturnReference", {
   enumerable: true,
   get: function () {
-    return _paymentReturnParams.isPaymentReturnCallbackUri;
+    return _paymentReturnParams.extractPaymentReturnReference;
   }
 });
-Object.defineProperty(exports, "launchBankRedirect", {
-  enumerable: true,
-  get: function () {
-    return _index4.launchBankRedirect;
-  }
-});
-Object.defineProperty(exports, "presentConsent", {
+Object.defineProperty(exports, "extractPaymentReturnSignature", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.presentConsent;
+    return _paymentReturnParams.extractPaymentReturnSignature;
   }
 });
-Object.defineProperty(exports, "resolvedPaymentType", {
+Object.defineProperty(exports, "isPaymentReturnCallbackUri", {
   enumerable: true,
   get: function () {
-    return _paymentType.resolvedPaymentType;
+    return _paymentReturnParams.isPaymentReturnCallbackUri;
   }
 });
-Object.defineProperty(exports, "rulesSectionTitle", {
+Object.defineProperty(exports, "isPaymentReturnSuccess", {
   enumerable: true,
   get: function () {
-    return _multiPaymentRulesPresenter.rulesSectionTitle;
+    return _paymentReturnParams.isPaymentReturnSuccess;
   }
 });
-Object.defineProperty(exports, "summaryFromState", {
+Object.defineProperty(exports, "launchBankRedirect", {
   enumerable: true,
   get: function () {
-    return _consentPresenter.summaryFromState;
+    return _index3.launchBankRedirect;
   }
 });
-Object.defineProperty(exports, "supportsConfirmationOfPayee", {
+Object.defineProperty(exports, "paymentReturnParams", {
   enumerable: true,
   get: function () {
-    return _paymentType.supportsConfirmationOfPayee;
+    return _paymentReturnParams.paymentReturnParams;
   }
 });
-Object.defineProperty(exports, "usePaymentFlowState", {
+Object.defineProperty(exports, "readPaymentReturn", {
   enumerable: true,
   get: function () {
-    return _usePaymentFlowState.usePaymentFlowState;
+    return _paymentReturnParams.readPaymentReturn;
   }
 });
 Object.defineProperty(exports, "useSpareLinkDeepLinks", {
   enumerable: true,
   get: function () {
-    return _index4.useSpareLinkDeepLinks;
+    return _index3.useSpareLinkDeepLinks;
   }
 });
 var _version = require("./version.js");
@@ -277,18 +165,8 @@ Object.keys(_index).forEach(function (key) {
     }
   });
 });
-var _paymentApiError = require("./core/errors/payment-api-error.js");
 var _paymentReturnParams = require("./core/models/payment-return-params.js");
-var _linkApiClient = require("./core/client/link-api-client.js");
-var _paymentFlowController = require("./core/services/payment-flow-controller.js");
-var _paymentFlowState = require("./core/services/payment-flow-state.js");
-var _consentPresenter = require("./core/services/consent-presenter.js");
-var _multiPaymentRulesPresenter = require("./core/services/multi-payment-rules-presenter.js");
-var _paymentType = require("./core/models/payment-type.js");
 var _spareLinkHost = require("./ui/spare-link-host.js");
-var _paymentFlowPage = require("./ui/payment-flow-page.js");
-var _usePaymentFlowState = require("./ui/hooks/use-payment-flow-state.js");
-var _index2 = require("./ui/screens/index.js");
-var _index3 = require("./ui/theme/index.js");
-var _index4 = require("./internal/index.js");
+var _index2 = require("./ui/theme/index.js");
+var _index3 = require("./internal/index.js");
 //# sourceMappingURL=index.js.map

package/lib/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_version","require","_index","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_paymentApiError","_paymentReturnParams","_linkApiClient","_paymentFlowController","_paymentFlowState","_consentPresenter","_multiPaymentRulesPresenter","_paymentType","_spareLinkHost","_paymentFlowPage","_usePaymentFlowState","_index2","_index3","_index4"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,IAAAA,QAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AAGA,IAAAS,gBAAA,GAAAd,OAAA;AAwBA,IAAAe,oBAAA,GAAAf,OAAA;AAMA,IAAAgB,cAAA,GAAAhB,OAAA;AAGA,IAAAiB,sBAAA,GAAAjB,OAAA;AAKA,IAAAkB,iBAAA,GAAAlB,OAAA;AAUA,IAAAmB,iBAAA,GAAAnB,OAAA;AAcA,IAAAoB,2BAAA,GAAApB,OAAA;AAMA,IAAAqB,YAAA,GAAArB,OAAA;AAWA,IAAAsB,cAAA,GAAAtB,OAAA;AAIA,IAAAuB,gBAAA,GAAAvB,OAAA;AACA,IAAAwB,oBAAA,GAAAxB,OAAA;AACA,IAAAyB,OAAA,GAAAzB,OAAA;AAaA,IAAA0B,OAAA,GAAA1B,OAAA;AAGA,IAAA2B,OAAA,GAAA3B,OAAA","ignoreList":[]}
+{"version":3,"names":["_version","require","_index","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_paymentReturnParams","_spareLinkHost","_index2","_index3"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,IAAAA,QAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AAIA,IAAAS,oBAAA,GAAAd,OAAA;AA4BA,IAAAe,cAAA,GAAAf,OAAA;AACA,IAAAgB,OAAA,GAAAhB,OAAA;AAGA,IAAAiB,OAAA,GAAAjB,OAAA","ignoreList":[]}

package/lib/commonjs/internal/bank-redirect.js

@@ -14,9 +14,15 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
  *   1. If `mobileAppUrl` is provided (e.g. `altareq://authorize?...`), try
  *      `Linking.openURL` after checking `canOpenURL` — this launches the
  *      bank's app directly without a browser tab.
- *   2. Otherwise (or if step 1 fails) open `authorizationUrl` via
- *      `expo-web-browser`'s in-app browser if installed; fall back to the
- *      system browser via `Linking.openURL`.
+ *   2. Otherwise (or if step 1 fails) hand `authorizationUrl` to the OS with
+ *      `Linking.openURL`, so the bank's app opens it where one claims the URL.
+ *   3. Only if that throws, retry in `expo-web-browser`'s in-app browser tab.
+ *
+ * Steps 2 and 3 are in that order because the redirection guide requires it:
+ * https://nebras-open-finance.com/tech/tpp-standards/security/fapi/opening-the-redirect
+ * An in-app browser tab is a permitted fallback — it is a real browser surface,
+ * not an embedded webview — but it takes the routing decision away from the OS,
+ * so preferring it means app-to-app redirection never gets the chance to happen.
  */
 const log = (0, _logger.createLogger)('BankRedirect');
 async function loadWebBrowser() {
@@ -41,13 +47,18 @@ async function launchBankRedirect(args) {
       log.warning(`launch: mobile deep link failed (${e instanceof Error ? e.message : String(e)}) — falling back`);
     }
   }
-  const wb = await loadWebBrowser();
-  if (wb?.openBrowserAsync) {
-    log.info('launch: opening authorization URL in in-app browser');
-    await wb.openBrowserAsync(args.authorizationUrl);
+  try {
+    await _reactNative.Linking.openURL(args.authorizationUrl);
+    log.info('launch: authorization URL handed to the OS');
     return;
+  } catch (e) {
+    log.warning(`launch: OS could not open the authorization URL (${e instanceof Error ? e.message : String(e)}) — retrying in an in-app browser tab`);
+  }
+  const wb = await loadWebBrowser();
+  if (!wb?.openBrowserAsync) {
+    throw new Error('Unable to open bank authorization URL');
   }
-  log.info('launch: opening authorization URL in system browser');
-  await _reactNative.Linking.openURL(args.authorizationUrl);
+  log.info('launch: opening authorization URL in in-app browser tab');
+  await wb.openBrowserAsync(args.authorizationUrl);
 }
 //# sourceMappingURL=bank-redirect.js.map

package/lib/commonjs/internal/bank-redirect.js.map

@@ -1 +1 @@
-{"version":3,"names":["_reactNative","require","_logger","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","log","createLogger","loadWebBrowser","Promise","resolve","then","launchBankRedirect","args","mobileAppUrl","info","can","Linking","canOpenURL","openURL","warning","Error","message","String","wb","openBrowserAsync","authorizationUrl"],"sourceRoot":"../../../src","sources":["internal/bank-redirect.ts"],"mappings":";;;;;;AAYA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAAwC,SAAAE,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAbxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA,MAAMkB,GAAG,GAAG,IAAAC,oBAAY,EAAC,cAAc,CAAC;AAWxC,eAAeC,cAAcA,CAAA,EAAmC;EAC9D,IAAI;IACF,OAAQ,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAAzB,uBAAA,CAAAF,OAAA,CAAa,kBAAkB,GAAC;EAC1C,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;AAEO,eAAe4B,kBAAkBA,CAACC,IAAsB,EAAiB;EAC9E,IAAIA,IAAI,CAACC,YAAY,EAAE;IACrBR,GAAG,CAACS,IAAI,CAAC,qCAAqC,CAAC;IAC/C,IAAI;MACF,MAAMC,GAAG,GAAG,MAAMC,oBAAO,CAACC,UAAU,CAACL,IAAI,CAACC,YAAY,CAAC;MACvD,IAAIE,GAAG,EAAE;QACP,MAAMC,oBAAO,CAACE,OAAO,CAACN,IAAI,CAACC,YAAY,CAAC;QACxCR,GAAG,CAACS,IAAI,CAAC,wCAAwC,CAAC;QAClD;MACF;MACAT,GAAG,CAACc,OAAO,CAAC,gEAAgE,CAAC;IAC/E,CAAC,CAAC,OAAOjC,CAAC,EAAE;MACVmB,GAAG,CAACc,OAAO,CACT,oCAAoCjC,CAAC,YAAYkC,KAAK,GAAGlC,CAAC,CAACmC,OAAO,GAAGC,MAAM,CAACpC,CAAC,CAAC,kBAChF,CAAC;IACH;EACF;EAEA,MAAMqC,EAAE,GAAG,MAAMhB,cAAc,CAAC,CAAC;EACjC,IAAIgB,EAAE,EAAEC,gBAAgB,EAAE;IACxBnB,GAAG,CAACS,IAAI,CAAC,qDAAqD,CAAC;IAC/D,MAAMS,EAAE,CAACC,gBAAgB,CAACZ,IAAI,CAACa,gBAAgB,CAAC;IAChD;EACF;EACApB,GAAG,CAACS,IAAI,CAAC,qDAAqD,CAAC;EAC/D,MAAME,oBAAO,CAACE,OAAO,CAACN,IAAI,CAACa,gBAAgB,CAAC;AAC9C","ignoreList":[]}
+{"version":3,"names":["_reactNative","require","_logger","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","log","createLogger","loadWebBrowser","Promise","resolve","then","launchBankRedirect","args","mobileAppUrl","info","can","Linking","canOpenURL","openURL","warning","Error","message","String","authorizationUrl","wb","openBrowserAsync"],"sourceRoot":"../../../src","sources":["internal/bank-redirect.ts"],"mappings":";;;;;;AAkBA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAAwC,SAAAE,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAnBxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA,MAAMkB,GAAG,GAAG,IAAAC,oBAAY,EAAC,cAAc,CAAC;AAWxC,eAAeC,cAAcA,CAAA,EAAmC;EAC9D,IAAI;IACF,OAAQ,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAAzB,uBAAA,CAAAF,OAAA,CAAa,kBAAkB,GAAC;EAC1C,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;AAEO,eAAe4B,kBAAkBA,CAACC,IAAsB,EAAiB;EAC9E,IAAIA,IAAI,CAACC,YAAY,EAAE;IACrBR,GAAG,CAACS,IAAI,CAAC,qCAAqC,CAAC;IAC/C,IAAI;MACF,MAAMC,GAAG,GAAG,MAAMC,oBAAO,CAACC,UAAU,CAACL,IAAI,CAACC,YAAY,CAAC;MACvD,IAAIE,GAAG,EAAE;QACP,MAAMC,oBAAO,CAACE,OAAO,CAACN,IAAI,CAACC,YAAY,CAAC;QACxCR,GAAG,CAACS,IAAI,CAAC,wCAAwC,CAAC;QAClD;MACF;MACAT,GAAG,CAACc,OAAO,CAAC,gEAAgE,CAAC;IAC/E,CAAC,CAAC,OAAOjC,CAAC,EAAE;MACVmB,GAAG,CAACc,OAAO,CACT,oCAAoCjC,CAAC,YAAYkC,KAAK,GAAGlC,CAAC,CAACmC,OAAO,GAAGC,MAAM,CAACpC,CAAC,CAAC,kBAChF,CAAC;IACH;EACF;EAEA,IAAI;IACF,MAAM8B,oBAAO,CAACE,OAAO,CAACN,IAAI,CAACW,gBAAgB,CAAC;IAC5ClB,GAAG,CAACS,IAAI,CAAC,4CAA4C,CAAC;IACtD;EACF,CAAC,CAAC,OAAO5B,CAAC,EAAE;IACVmB,GAAG,CAACc,OAAO,CACT,oDAAoDjC,CAAC,YAAYkC,KAAK,GAAGlC,CAAC,CAACmC,OAAO,GAAGC,MAAM,CAACpC,CAAC,CAAC,uCAChG,CAAC;EACH;EAEA,MAAMsC,EAAE,GAAG,MAAMjB,cAAc,CAAC,CAAC;EACjC,IAAI,CAACiB,EAAE,EAAEC,gBAAgB,EAAE;IACzB,MAAM,IAAIL,KAAK,CAAC,uCAAuC,CAAC;EAC1D;EACAf,GAAG,CAACS,IAAI,CAAC,yDAAyD,CAAC;EACnE,MAAMU,EAAE,CAACC,gBAAgB,CAACb,IAAI,CAACW,gBAAgB,CAAC;AAClD","ignoreList":[]}

package/lib/commonjs/internal/hosted/bridge-message.js

@@ -0,0 +1,107 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.parseHostedBridgeMessage = parseHostedBridgeMessage;
+var _urlParts = require("../url-parts.js");
+/**
+ * Messages the hosted payment page sends to this SDK.
+ *
+ * The contract is one-way. The page never waits on a reply, so a message this
+ * version does not recognise is dropped rather than treated as a failure — the
+ * page continues, and a newer page stays usable by an older app.
+ *
+ * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
+ * which arrives here as `event.nativeEvent.data`.
+ */
+
+/** The payable page is interactive. */
+
+/**
+ * A consent exists and the bank must now be opened outside the WebView.
+ *
+ * Banks commonly refuse to serve their authorization pages inside an embedded
+ * browser, and the address bar is what lets a payer tell a real bank page from
+ * a convincing copy.
+ */
+
+/** The payer cancelled, and the request is already rejected server-side. */
+
+/** The flow cannot continue. [code] is the key the page itself renders. */
+
+/**
+ * Parses a message posted by the hosted page.
+ *
+ * Returns null for anything unrecognised. The message crosses a boundary the
+ * SDK does not control, so nothing here trusts its shape — the WebView message
+ * channel is shared with every script on the page.
+ */
+function parseHostedBridgeMessage(raw) {
+  const message = asRecord(raw);
+  if (!message) return null;
+  const type = message.type;
+  if (typeof type !== 'string') return null;
+  switch (type) {
+    case 'spare.ready':
+      return {
+        type: 'ready'
+      };
+    case 'spare.open_url':
+      {
+        const url = message.url;
+        if (typeof url !== 'string' || !isHttpsUrl(url)) return null;
+        return {
+          type: 'openUrl',
+          url
+        };
+      }
+    case 'spare.cancel':
+      return {
+        type: 'cancel'
+      };
+    case 'spare.error':
+      {
+        const code = message.code;
+        if (typeof code !== 'string' || code.trim().length === 0) return null;
+        return {
+          type: 'error',
+          code
+        };
+      }
+    default:
+      return null;
+  }
+}
+
+/**
+ * Reads the message out of whatever the WebView handed over.
+ *
+ * The page stringifies its payload, but a plain object is accepted too so the
+ * transport is not the thing that decides whether a valid message is understood.
+ */
+function asRecord(raw) {
+  if (typeof raw === 'string') {
+    try {
+      return asRecord(JSON.parse(raw));
+    } catch {
+      return null;
+    }
+  }
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return null;
+  return raw;
+}
+
+/**
+ * Whether [url] is an absolute https URL.
+ *
+ * Required before handing a URL to the OS browser: the page is trusted to name
+ * a bank, not to name a scheme that could reach something else on the device.
+ * Parsed rather than pattern-matched so `https:/\/evil` and friends cannot pass
+ * for an absolute URL.
+ */
+function isHttpsUrl(url) {
+  const parts = (0, _urlParts.parseUrlParts)(url);
+  return parts !== null && parts.scheme === 'https' && parts.host.length > 0;
+}
+//# sourceMappingURL=bridge-message.js.map

package/lib/commonjs/internal/hosted/bridge-message.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_urlParts","require","parseHostedBridgeMessage","raw","message","asRecord","type","url","isHttpsUrl","code","trim","length","JSON","parse","Array","isArray","parts","parseUrlParts","scheme","host"],"sourceRoot":"../../../../src","sources":["internal/hosted/bridge-message.ts"],"mappings":";;;;;;AAAA,IAAAA,SAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AAKA;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,wBAAwBA,CAACC,GAAY,EAA8B;EACjF,MAAMC,OAAO,GAAGC,QAAQ,CAACF,GAAG,CAAC;EAC7B,IAAI,CAACC,OAAO,EAAE,OAAO,IAAI;EAEzB,MAAME,IAAI,GAAGF,OAAO,CAACE,IAAI;EACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;EAEzC,QAAQA,IAAI;IACV,KAAK,aAAa;MAChB,OAAO;QAAEA,IAAI,EAAE;MAAQ,CAAC;IAC1B,KAAK,gBAAgB;MAAE;QACrB,MAAMC,GAAG,GAAGH,OAAO,CAACG,GAAG;QACvB,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAI,CAACC,UAAU,CAACD,GAAG,CAAC,EAAE,OAAO,IAAI;QAC5D,OAAO;UAAED,IAAI,EAAE,SAAS;UAAEC;QAAI,CAAC;MACjC;IACA,KAAK,cAAc;MACjB,OAAO;QAAED,IAAI,EAAE;MAAS,CAAC;IAC3B,KAAK,aAAa;MAAE;QAClB,MAAMG,IAAI,GAAGL,OAAO,CAACK,IAAI;QACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAIA,IAAI,CAACC,IAAI,CAAC,CAAC,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;QACrE,OAAO;UAAEL,IAAI,EAAE,OAAO;UAAEG;QAAK,CAAC;MAChC;IACA;MACE,OAAO,IAAI;EACf;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASJ,QAAQA,CAACF,GAAY,EAAkC;EAC9D,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3B,IAAI;MACF,OAAOE,QAAQ,CAACO,IAAI,CAACC,KAAK,CAACV,GAAG,CAAY,CAAC;IAC7C,CAAC,CAAC,MAAM;MACN,OAAO,IAAI;IACb;EACF;EACA,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAIA,GAAG,KAAK,IAAI,IAAIW,KAAK,CAACC,OAAO,CAACZ,GAAG,CAAC,EAAE,OAAO,IAAI;EAC9E,OAAOA,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASK,UAAUA,CAACD,GAAW,EAAW;EACxC,MAAMS,KAAK,GAAG,IAAAC,uBAAa,EAACV,GAAG,CAAC;EAChC,OAAOS,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACE,MAAM,KAAK,OAAO,IAAIF,KAAK,CAACG,IAAI,CAACR,MAAM,GAAG,CAAC;AAC5E","ignoreList":[]}

package/lib/commonjs/internal/hosted/hosted-url.js

@@ -0,0 +1,41 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.HOSTED_ORIGIN_CHANNEL = void 0;
+exports.buildHostedPaymentUrl = buildHostedPaymentUrl;
+exports.isHostedOriginUrl = isHostedOriginUrl;
+var _urlParts = require("../url-parts.js");
+/**
+ * Origin channel this SDK identifies as to the hosted page.
+ *
+ * The same value must be recorded on the payment request by the merchant's
+ * backend, because the bank redirect that completes a payment carries no query
+ * string of ours and the return path is decided from the stored row.
+ */
+const HOSTED_ORIGIN_CHANNEL = exports.HOSTED_ORIGIN_CHANNEL = 'sdk_react_native';
+
+/**
+ * Builds the hosted payment page URL for a payment request reference.
+ *
+ * The reference is the only credential the page needs; everything else is
+ * resolved server-side from the row it names.
+ */
+function buildHostedPaymentUrl(args) {
+  const base = args.baseUrl.trim().replace(/\/+$/, '');
+  const reference = encodeURIComponent(args.reference.trim());
+  return `${base}/link/payment/${reference}?channel=${HOSTED_ORIGIN_CHANNEL}`;
+}
+
+/**
+ * Whether [url] belongs to the hosted origin derived from [baseUrl].
+ *
+ * The WebView loads only the hosted origin. Bank authentication deliberately
+ * happens outside it, so anything else navigating in-frame is refused rather
+ * than followed.
+ */
+function isHostedOriginUrl(args) {
+  return (0, _urlParts.isSameOrigin)(args.baseUrl, args.url);
+}
+//# sourceMappingURL=hosted-url.js.map

package/lib/commonjs/internal/hosted/hosted-url.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_urlParts","require","HOSTED_ORIGIN_CHANNEL","exports","buildHostedPaymentUrl","args","base","baseUrl","trim","replace","reference","encodeURIComponent","isHostedOriginUrl","isSameOrigin","url"],"sourceRoot":"../../../../src","sources":["internal/hosted/hosted-url.ts"],"mappings":";;;;;;;;AAAA,IAAAA,SAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,qBAAqB,GAAAC,OAAA,CAAAD,qBAAA,GAAG,kBAAkB;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,qBAAqBA,CAACC,IAA4C,EAAU;EAC1F,MAAMC,IAAI,GAAGD,IAAI,CAACE,OAAO,CAACC,IAAI,CAAC,CAAC,CAACC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;EACpD,MAAMC,SAAS,GAAGC,kBAAkB,CAACN,IAAI,CAACK,SAAS,CAACF,IAAI,CAAC,CAAC,CAAC;EAC3D,OAAO,GAAGF,IAAI,iBAAiBI,SAAS,YAAYR,qBAAqB,EAAE;AAC7E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASU,iBAAiBA,CAACP,IAAsC,EAAW;EACjF,OAAO,IAAAQ,sBAAY,EAACR,IAAI,CAACE,OAAO,EAAEF,IAAI,CAACS,GAAG,CAAC;AAC7C","ignoreList":[]}

package/lib/commonjs/internal/index.js

@@ -9,12 +9,6 @@ Object.defineProperty(exports, "SecureStorePendingSessionStore", {
     return _secureStorePendingSessionStore.SecureStorePendingSessionStore;
   }
 });
-Object.defineProperty(exports, "collectTelemetry", {
-  enumerable: true,
-  get: function () {
-    return _telemetryCollector.collectTelemetry;
-  }
-});
 Object.defineProperty(exports, "launchBankRedirect", {
   enumerable: true,
   get: function () {
@@ -27,7 +21,6 @@ Object.defineProperty(exports, "useSpareLinkDeepLinks", {
     return _deepLinkListener.useSpareLinkDeepLinks;
   }
 });
-var _telemetryCollector = require("./telemetry-collector.js");
 var _bankRedirect = require("./bank-redirect.js");
 var _secureStorePendingSessionStore = require("./secure-store-pending-session-store.js");
 var _deepLinkListener = require("./deep-link-listener.js");

package/lib/commonjs/internal/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_telemetryCollector","require","_bankRedirect","_secureStorePendingSessionStore","_deepLinkListener"],"sourceRoot":"../../../src","sources":["internal/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,mBAAA,GAAAC,OAAA;AACA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,+BAAA,GAAAF,OAAA;AACA,IAAAG,iBAAA,GAAAH,OAAA","ignoreList":[]}
+{"version":3,"names":["_bankRedirect","require","_secureStorePendingSessionStore","_deepLinkListener"],"sourceRoot":"../../../src","sources":["internal/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,aAAA,GAAAC,OAAA;AACA,IAAAC,+BAAA,GAAAD,OAAA;AACA,IAAAE,iBAAA,GAAAF,OAAA","ignoreList":[]}

package/lib/commonjs/internal/redact-uri.js

@@ -4,22 +4,66 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.redactPaymentReturnUri = redactPaymentReturnUri;
-const SENSITIVE_QUERY_KEYS = new Set(['exchange_code', 'error_description']);
+/**
+ * Redacts the query of a bank-return URI before it is logged.
+ *
+ * Every value goes except the few that describe the outcome rather than identify
+ * anyone — see {@link KEPT_KEYS}. Redaction is a denylist by default rather than
+ * an allowlist of names to remove: an earlier version named the two keys to
+ * redact, so anything else the return ever carried was logged in full, and one of
+ * the names it knew (`exchange_code`) is not even in the contract any more.
+ *
+ * What is worth keeping in a log is the shape of the URI — its scheme, its path,
+ * which parameters were present — plus enough to explain the outcome.
+ *
+ * It also cannot use the global `URL`. React Native's is a stub whose
+ * `searchParams` returns a fresh empty instance, so `has()` was always false and
+ * this function returned the URI untouched on a device while redacting correctly
+ * under Jest, which runs on Node.
+ *
+ * The query is split here rather than read through `parseQueryParams`, because
+ * that decodes values and keeps only the first of a repeated key — fine for
+ * reading an outcome, wrong for reproducing a URI whose shape is the point.
+ */
 
-/** Redacts sensitive query params before logging bank-return URIs. */
+const REDACTED = '[REDACTED]';
+
+/**
+ * Parameters whose values are kept, because they say what happened rather than to
+ * whom.
+ *
+ * Redacting these made the log useless for the one question it gets asked. A
+ * return that resolves as unresolved does so because of its `status`, and a log
+ * reading `status=[REDACTED]` cannot tell anyone which value was not recognised.
+ *
+ * None of these identifies a payer, a payment or a request: `status` is one of a
+ * fixed vocabulary, and `errorCode` and `error` are keys from a fixed list. The
+ * identifiers — `reference`, `merchantRef`, `paymentId` — and the signature stay
+ * redacted, as does `error_description`, which is prose and could name a person.
+ */
+const KEPT_KEYS = new Set(['status', 'errorCode', 'error']);
 function redactPaymentReturnUri(uri) {
-  try {
-    const parsed = new URL(uri);
-    let changed = false;
-    for (const key of SENSITIVE_QUERY_KEYS) {
-      if (parsed.searchParams.has(key)) {
-        parsed.searchParams.set(key, '[REDACTED]');
-        changed = true;
-      }
-    }
-    return changed ? parsed.toString() : uri;
-  } catch {
-    return '[invalid-uri]';
-  }
+  const queryStart = uri.indexOf('?');
+  const fragmentStart = uri.indexOf('#');
+
+  // No query and no fragment: nothing here carries a value.
+  if (queryStart === -1 && fragmentStart === -1) return uri;
+  const queryEnd = fragmentStart !== -1 && fragmentStart > queryStart ? fragmentStart : uri.length;
+  const beforeQuery = queryStart === -1 ? uri.slice(0, fragmentStart) : uri.slice(0, queryStart);
+  const query = queryStart === -1 ? '' : uri.slice(queryStart + 1, queryEnd);
+
+  // A fragment is dropped whole. Nothing in this SDK reads one, so its shape is
+  // not worth keeping, and a return that ever carried a token in one — as OAuth
+  // implicit flows do — must not put it in a log.
+  const hadFragment = fragmentStart !== -1;
+  const redactedQuery = query.split('&').filter(pair => pair.length > 0).map(pair => {
+    const eq = pair.indexOf('=');
+    const key = eq === -1 ? pair : pair.slice(0, eq);
+    if (KEPT_KEYS.has(key)) return pair;
+    return `${key}=${REDACTED}`;
+  }).join('&');
+  const rebuiltQuery = redactedQuery.length > 0 ? `?${redactedQuery}` : '';
+  const rebuiltFragment = hadFragment ? `#${REDACTED}` : '';
+  return `${beforeQuery}${rebuiltQuery}${rebuiltFragment}`;
 }
 //# sourceMappingURL=redact-uri.js.map