@spare-technologies/spare-link 1.0.0 → 1.1.0

package/lib/module/ui/hosted/hosted-payment-page.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","useEffect","useRef","ActivityIndicator","StyleSheet","Text","View","isTerminalPhase","useHostedFlowState","PageUnavailableScreen","RedirectHandoffScreen","ResultScreen","ResumeProcessingScreen","Colors","Spacing","Typography","HostedPaymentWebView","jsx","_jsx","jsxs","_jsxs","RESULT_DWELL_MS","HostedPaymentPage","props","controller","baseUrl","onResolved","state","awaitingSinceMs","undefined","phase","current","Date","now","wasNeverReached","errorCode","resolved","timer","setTimeout","clearTimeout","handleBridgeMessage","message","handleLoadFailure","failToLoad","handlePageMounted","reportPageMounted","handleRetry","retry","handleGiveUp","giveUp","style","styles","fill","children","accessibilityElementsHidden","importantForAccessibility","reference","onBridgeMessage","onLoadFailure","onMounted","attempt","loadingCover","testID","size","color","spareBlue","bodyMuted","loadingLabel","onRetry","onCancel","awaitingCallbackStartedAtMs","abandon","title","isSuccess","onDone","create","flex","backgroundColor","surfacePage","absoluteFillObject","alignItems","justifyContent","gap","lg","textAlign"],"sourceRoot":"../../../../src","sources":["ui/hosted/hosted-payment-page.tsx"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,EAAEC,MAAM,QAAQ,OAAO;AACtD,SAASC,iBAAiB,EAAEC,UAAU,EAAEC,IAAI,EAAEC,IAAI,QAAQ,cAAc;AAExE,SAASC,eAAe,QAAQ,0CAAuC;AACvE,SAASC,kBAAkB,QAAQ,mCAAgC;AACnE,SAASC,qBAAqB,QAAQ,uCAAoC;AAC1E,SAASC,qBAAqB,QAAQ,uCAAoC;AAC1E,SAASC,YAAY,QAAQ,6BAA0B;AACvD,SAASC,sBAAsB,QAAQ,wCAAqC;AAC5E,SAASC,MAAM,EAAEC,OAAO,EAAEC,UAAU,QAAQ,mBAAU;AACtD,SAASC,oBAAoB,QAAQ,6BAA0B;;AAE/D;AAAA,SAAAC,GAAA,IAAAC,IAAA,EAAAC,IAAA,IAAAC,KAAA;AACA,MAAMC,eAAe,GAAG,IAAI;AAU5B;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAACC,KAA6B,EAAe;EAC5E,MAAM;IAAEC,UAAU;IAAEC,OAAO;IAAEC;EAAW,CAAC,GAAGH,KAAK;EACjD,MAAMI,KAAK,GAAGnB,kBAAkB,CAACgB,UAAU,CAAC;;EAE5C;AACF;AACA;AACA;AACA;AACA;AACA;EACE,MAAMI,eAAe,GAAG1B,MAAM,CAAqB2B,SAAS,CAAC;EAC7D,IAAIF,KAAK,CAACG,KAAK,KAAK,kBAAkB,IAAIF,eAAe,CAACG,OAAO,KAAKF,SAAS,EAAE;IAC/ED,eAAe,CAACG,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;EACtC;;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMC,eAAe,GAAGP,KAAK,CAACQ,SAAS,KAAK,kBAAkB;;EAE9D;EACA;EACA;EACA,MAAMC,QAAQ,GAAG7B,eAAe,CAACoB,KAAK,CAACG,KAAK,CAAC;EAC7C7B,SAAS,CAAC,MAAM;IACd,IAAI,CAACmC,QAAQ,EAAE;IACf,MAAMC,KAAK,GAAGC,UAAU,CAACZ,UAAU,EAAEQ,eAAe,GAAG,CAAC,GAAGb,eAAe,CAAC;IAC3E,OAAO,MAAMkB,YAAY,CAACF,KAAK,CAAC;EAClC,CAAC,EAAE,CAACD,QAAQ,EAAEV,UAAU,EAAEQ,eAAe,CAAC,CAAC;EAE3C,MAAMM,mBAAmB,GAAGxC,WAAW,CACpCyC,OAAgB,IAAK;IACpB,KAAKjB,UAAU,CAACgB,mBAAmB,CAACC,OAAO,CAAC;EAC9C,CAAC,EACD,CAACjB,UAAU,CACb,CAAC;EAED,MAAMkB,iBAAiB,GAAG1C,WAAW,CAAC,MAAM;IAC1CwB,UAAU,CAACmB,UAAU,CAAC,CAAC;EACzB,CAAC,EAAE,CAACnB,UAAU,CAAC,CAAC;EAEhB,MAAMoB,iBAAiB,GAAG5C,WAAW,CAAC,MAAM;IAC1CwB,UAAU,CAACqB,iBAAiB,CAAC,CAAC;EAChC,CAAC,EAAE,CAACrB,UAAU,CAAC,CAAC;EAEhB,MAAMsB,WAAW,GAAG9C,WAAW,CAAC,MAAM;IACpCwB,UAAU,CAACuB,KAAK,CAAC,CAAC;EACpB,CAAC,EAAE,CAACvB,UAAU,CAAC,CAAC;EAEhB,MAAMwB,YAAY,GAAGhD,WAAW,CAAC,MAAM;IACrCwB,UAAU,CAACyB,MAAM,CAAC,CAAC;EACrB,CAAC,EAAE,CAACzB,UAAU,CAAC,CAAC;EAEhB,QAAQG,KAAK,CAACG,KAAK;IACjB,KAAK,SAAS;IACd,KAAK,QAAQ;MACX,oBACEV,KAAA,CAACd,IAAI;QAAC4C,KAAK,EAAEC,MAAM,CAACC,IAAK;QAAAC,QAAA,gBACvBnC,IAAA,CAACZ,IAAI;UACH4C,KAAK,EAAEC,MAAM,CAACC;UACd;UACA;UAAA;UACAE,2BAA2B,EAAE3B,KAAK,CAACG,KAAK,KAAK,SAAU;UACvDyB,yBAAyB,EAAE5B,KAAK,CAACG,KAAK,KAAK,SAAS,GAAG,qBAAqB,GAAG,MAAO;UAAAuB,QAAA,eAEtFnC,IAAA,CAACF;UACC;UACA;UAAA;YAEAS,OAAO,EAAEA,OAAQ;YACjB+B,SAAS,EAAEhC,UAAU,CAACgC,SAAU;YAChCC,eAAe,EAAEjB,mBAAoB;YACrCkB,aAAa,EAAEhB,iBAAkB;YACjCiB,SAAS,EAAEf;UAAkB,GALxBjB,KAAK,CAACiC,OAMZ;QAAC,CACE,CAAC,EAMNjC,KAAK,CAACG,KAAK,KAAK,SAAS,gBACxBV,KAAA,CAACd,IAAI;UAAC4C,KAAK,EAAEC,MAAM,CAACU,YAAa;UAACC,MAAM,EAAC,wBAAwB;UAAAT,QAAA,gBAM/DnC,IAAA,CAACf,iBAAiB;YAChB4D,IAAI,EAAC,OAAO;YACZC,KAAK,EAAEnD,MAAM,CAACoD,SAAU;YACxBH,MAAM,EAAC;UAAgC,CACxC,CAAC,eACF5C,IAAA,CAACb,IAAI;YAAC6C,KAAK,EAAE,CAACnC,UAAU,CAACmD,SAAS,EAAEf,MAAM,CAACgB,YAAY,CAAE;YAAAd,QAAA,EACtD1B,KAAK,CAACiC,OAAO,GAAG,CAAC,GAAG,eAAe,GAAG;UAAuB,CAC1D,CAAC;QAAA,CACH,CAAC,GACL,IAAI;MAAA,CACJ,CAAC;IAEX,KAAK,aAAa;MAChB,oBAAO1C,IAAA,CAACT,qBAAqB;QAAC2D,OAAO,EAAEtB,WAAY;QAACuB,QAAQ,EAAErB;MAAa,CAAE,CAAC;IAChF,KAAK,aAAa;MAChB,oBAAO9B,IAAA,CAACR,qBAAqB,IAAE,CAAC;IAClC,KAAK,kBAAkB;MACrB,oBACEQ,IAAA,CAACN,sBAAsB;QAAA,IAChBgB,eAAe,CAACG,OAAO,KAAKF,SAAS,GACtC;UAAEyC,2BAA2B,EAAE1C,eAAe,CAACG;QAAQ,CAAC,GACxD,CAAC,CAAC;QACN;QACA;QACA;QACA;QACAsC,QAAQ,EAAEA,CAAA,KAAM7C,UAAU,CAAC+C,OAAO,CAAC;MAAE,CACtC,CAAC;IAEN,KAAK,WAAW;MACd,oBAAOrD,IAAA,CAACP,YAAY;QAAC6D,KAAK,EAAC,kBAAkB;QAACC,SAAS;QAACC,MAAM,EAAEhD;MAAW,CAAE,CAAC;IAChF,KAAK,QAAQ;MACX,OAAOQ,eAAe,gBACpBhB,IAAA,CAACT,qBAAqB;QAAC2D,OAAO,EAAEtB,WAAY;QAACuB,QAAQ,EAAErB;MAAa,CAAE,CAAC,gBAEvE9B,IAAA,CAACP,YAAY;QAAC6D,KAAK,EAAC,gBAAgB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAEhD;MAAW,CAAE,CAC7E;IACH,KAAK,WAAW;MACd,oBAAOR,IAAA,CAACP,YAAY;QAAC6D,KAAK,EAAC,mBAAmB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAEhD;MAAW,CAAE,CAAC;IACzF,KAAK,WAAW;MACd,oBAAOR,IAAA,CAACP,YAAY;QAAC6D,KAAK,EAAC,uBAAuB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAEhD;MAAW,CAAE,CAAC;EAC/F;AACF;AAEA,MAAMyB,MAAM,GAAG/C,UAAU,CAACuE,MAAM,CAAC;EAC/BvB,IAAI,EAAE;IAAEwB,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAEhE,MAAM,CAACiE;EAAY,CAAC;EACtDjB,YAAY,EAAE;IACZ,GAAGzD,UAAU,CAAC2E,kBAAkB;IAChCC,UAAU,EAAE,QAAQ;IACpBC,cAAc,EAAE,QAAQ;IACxBC,GAAG,EAAEpE,OAAO,CAACqE,EAAE;IACfN,eAAe,EAAEhE,MAAM,CAACiE;EAC1B,CAAC;EACDX,YAAY,EAAE;IAAEiB,SAAS,EAAE;EAAS;AACtC,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["useCallback","useEffect","useRef","ActivityIndicator","StyleSheet","Text","View","isTerminalPhase","collectRiskTelemetry","createRiskTelemetryProbes","useHostedFlowState","PageUnavailableScreen","RedirectHandoffScreen","ResultScreen","ResumeProcessingScreen","Colors","Spacing","Typography","HostedPaymentWebView","jsx","_jsx","jsxs","_jsxs","RESULT_DWELL_MS","HostedPaymentPage","props","controller","baseUrl","onResolved","state","awaitingSinceMs","undefined","phase","current","Date","now","wasNeverReached","errorCode","resolved","timer","setTimeout","clearTimeout","handleBridgeMessage","message","handleTelemetryRequest","handleLoadFailure","failToLoad","handlePageMounted","reportPageMounted","handleRetry","retry","handleGiveUp","giveUp","style","styles","fill","children","accessibilityElementsHidden","importantForAccessibility","reference","onBridgeMessage","onTelemetryRequest","onLoadFailure","onMounted","attempt","loadingCover","testID","size","color","spareBlue","bodyMuted","loadingLabel","onRetry","onCancel","awaitingCallbackStartedAtMs","abandon","title","isSuccess","onDone","create","flex","backgroundColor","surfacePage","absoluteFillObject","alignItems","justifyContent","gap","lg","textAlign"],"sourceRoot":"../../../../src","sources":["ui/hosted/hosted-payment-page.tsx"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,EAAEC,MAAM,QAAQ,OAAO;AACtD,SAASC,iBAAiB,EAAEC,UAAU,EAAEC,IAAI,EAAEC,IAAI,QAAQ,cAAc;AAExE,SAASC,eAAe,QAAQ,0CAAuC;AACvE,SAASC,oBAAoB,QAAQ,sDAAmD;AACxF,SAASC,yBAAyB,QAAQ,mDAAgD;AAC1F,SAASC,kBAAkB,QAAQ,mCAAgC;AACnE,SAASC,qBAAqB,QAAQ,uCAAoC;AAC1E,SAASC,qBAAqB,QAAQ,uCAAoC;AAC1E,SAASC,YAAY,QAAQ,6BAA0B;AACvD,SAASC,sBAAsB,QAAQ,wCAAqC;AAC5E,SAASC,MAAM,EAAEC,OAAO,EAAEC,UAAU,QAAQ,mBAAU;AACtD,SAASC,oBAAoB,QAAQ,6BAA0B;;AAE/D;AAAA,SAAAC,GAAA,IAAAC,IAAA,EAAAC,IAAA,IAAAC,KAAA;AACA,MAAMC,eAAe,GAAG,IAAI;AAU5B;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAACC,KAA6B,EAAe;EAC5E,MAAM;IAAEC,UAAU;IAAEC,OAAO;IAAEC;EAAW,CAAC,GAAGH,KAAK;EACjD,MAAMI,KAAK,GAAGnB,kBAAkB,CAACgB,UAAU,CAAC;;EAE5C;AACF;AACA;AACA;AACA;AACA;AACA;EACE,MAAMI,eAAe,GAAG5B,MAAM,CAAqB6B,SAAS,CAAC;EAC7D,IAAIF,KAAK,CAACG,KAAK,KAAK,kBAAkB,IAAIF,eAAe,CAACG,OAAO,KAAKF,SAAS,EAAE;IAC/ED,eAAe,CAACG,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;EACtC;;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMC,eAAe,GAAGP,KAAK,CAACQ,SAAS,KAAK,kBAAkB;;EAE9D;EACA;EACA;EACA,MAAMC,QAAQ,GAAG/B,eAAe,CAACsB,KAAK,CAACG,KAAK,CAAC;EAC7C/B,SAAS,CAAC,MAAM;IACd,IAAI,CAACqC,QAAQ,EAAE;IACf,MAAMC,KAAK,GAAGC,UAAU,CAACZ,UAAU,EAAEQ,eAAe,GAAG,CAAC,GAAGb,eAAe,CAAC;IAC3E,OAAO,MAAMkB,YAAY,CAACF,KAAK,CAAC;EAClC,CAAC,EAAE,CAACD,QAAQ,EAAEV,UAAU,EAAEQ,eAAe,CAAC,CAAC;EAE3C,MAAMM,mBAAmB,GAAG1C,WAAW,CACpC2C,OAAgB,IAAK;IACpB,KAAKjB,UAAU,CAACgB,mBAAmB,CAACC,OAAO,CAAC;EAC9C,CAAC,EACD,CAACjB,UAAU,CACb,CAAC;;EAED;EACA,MAAMkB,sBAAsB,GAAG5C,WAAW,CAAC,MAAM;IAC/C,OAAOQ,oBAAoB,CAACC,yBAAyB,CAAC,CAAC,CAAC;EAC1D,CAAC,EAAE,EAAE,CAAC;EAEN,MAAMoC,iBAAiB,GAAG7C,WAAW,CAAC,MAAM;IAC1C0B,UAAU,CAACoB,UAAU,CAAC,CAAC;EACzB,CAAC,EAAE,CAACpB,UAAU,CAAC,CAAC;EAEhB,MAAMqB,iBAAiB,GAAG/C,WAAW,CAAC,MAAM;IAC1C0B,UAAU,CAACsB,iBAAiB,CAAC,CAAC;EAChC,CAAC,EAAE,CAACtB,UAAU,CAAC,CAAC;EAEhB,MAAMuB,WAAW,GAAGjD,WAAW,CAAC,MAAM;IACpC0B,UAAU,CAACwB,KAAK,CAAC,CAAC;EACpB,CAAC,EAAE,CAACxB,UAAU,CAAC,CAAC;EAEhB,MAAMyB,YAAY,GAAGnD,WAAW,CAAC,MAAM;IACrC0B,UAAU,CAAC0B,MAAM,CAAC,CAAC;EACrB,CAAC,EAAE,CAAC1B,UAAU,CAAC,CAAC;EAEhB,QAAQG,KAAK,CAACG,KAAK;IACjB,KAAK,SAAS;IACd,KAAK,QAAQ;MACX,oBACEV,KAAA,CAAChB,IAAI;QAAC+C,KAAK,EAAEC,MAAM,CAACC,IAAK;QAAAC,QAAA,gBACvBpC,IAAA,CAACd,IAAI;UACH+C,KAAK,EAAEC,MAAM,CAACC;UACd;UACA;UAAA;UACAE,2BAA2B,EAAE5B,KAAK,CAACG,KAAK,KAAK,SAAU;UACvD0B,yBAAyB,EAAE7B,KAAK,CAACG,KAAK,KAAK,SAAS,GAAG,qBAAqB,GAAG,MAAO;UAAAwB,QAAA,eAEtFpC,IAAA,CAACF;UACC;UACA;UAAA;YAEAS,OAAO,EAAEA,OAAQ;YACjBgC,SAAS,EAAEjC,UAAU,CAACiC,SAAU;YAChCC,eAAe,EAAElB,mBAAoB;YACrCmB,kBAAkB,EAAEjB,sBAAuB;YAC3CkB,aAAa,EAAEjB,iBAAkB;YACjCkB,SAAS,EAAEhB;UAAkB,GANxBlB,KAAK,CAACmC,OAOZ;QAAC,CACE,CAAC,EAMNnC,KAAK,CAACG,KAAK,KAAK,SAAS,gBACxBV,KAAA,CAAChB,IAAI;UAAC+C,KAAK,EAAEC,MAAM,CAACW,YAAa;UAACC,MAAM,EAAC,wBAAwB;UAAAV,QAAA,gBAM/DpC,IAAA,CAACjB,iBAAiB;YAChBgE,IAAI,EAAC,OAAO;YACZC,KAAK,EAAErD,MAAM,CAACsD,SAAU;YACxBH,MAAM,EAAC;UAAgC,CACxC,CAAC,eACF9C,IAAA,CAACf,IAAI;YAACgD,KAAK,EAAE,CAACpC,UAAU,CAACqD,SAAS,EAAEhB,MAAM,CAACiB,YAAY,CAAE;YAAAf,QAAA,EACtD3B,KAAK,CAACmC,OAAO,GAAG,CAAC,GAAG,eAAe,GAAG;UAAuB,CAC1D,CAAC;QAAA,CACH,CAAC,GACL,IAAI;MAAA,CACJ,CAAC;IAEX,KAAK,aAAa;MAChB,oBAAO5C,IAAA,CAACT,qBAAqB;QAAC6D,OAAO,EAAEvB,WAAY;QAACwB,QAAQ,EAAEtB;MAAa,CAAE,CAAC;IAChF,KAAK,aAAa;MAChB,oBAAO/B,IAAA,CAACR,qBAAqB,IAAE,CAAC;IAClC,KAAK,kBAAkB;MACrB,oBACEQ,IAAA,CAACN,sBAAsB;QAAA,IAChBgB,eAAe,CAACG,OAAO,KAAKF,SAAS,GACtC;UAAE2C,2BAA2B,EAAE5C,eAAe,CAACG;QAAQ,CAAC,GACxD,CAAC,CAAC;QACN;QACA;QACA;QACA;QACAwC,QAAQ,EAAEA,CAAA,KAAM/C,UAAU,CAACiD,OAAO,CAAC;MAAE,CACtC,CAAC;IAEN,KAAK,WAAW;MACd,oBAAOvD,IAAA,CAACP,YAAY;QAAC+D,KAAK,EAAC,kBAAkB;QAACC,SAAS;QAACC,MAAM,EAAElD;MAAW,CAAE,CAAC;IAChF,KAAK,QAAQ;MACX,OAAOQ,eAAe,gBACpBhB,IAAA,CAACT,qBAAqB;QAAC6D,OAAO,EAAEvB,WAAY;QAACwB,QAAQ,EAAEtB;MAAa,CAAE,CAAC,gBAEvE/B,IAAA,CAACP,YAAY;QAAC+D,KAAK,EAAC,gBAAgB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAElD;MAAW,CAAE,CAC7E;IACH,KAAK,WAAW;MACd,oBAAOR,IAAA,CAACP,YAAY;QAAC+D,KAAK,EAAC,mBAAmB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAElD;MAAW,CAAE,CAAC;IACzF,KAAK,WAAW;MACd,oBAAOR,IAAA,CAACP,YAAY;QAAC+D,KAAK,EAAC,uBAAuB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAElD;MAAW,CAAE,CAAC;EAC/F;AACF;AAEA,MAAM0B,MAAM,GAAGlD,UAAU,CAAC2E,MAAM,CAAC;EAC/BxB,IAAI,EAAE;IAAEyB,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAElE,MAAM,CAACmE;EAAY,CAAC;EACtDjB,YAAY,EAAE;IACZ,GAAG7D,UAAU,CAAC+E,kBAAkB;IAChCC,UAAU,EAAE,QAAQ;IACpBC,cAAc,EAAE,QAAQ;IACxBC,GAAG,EAAEtE,OAAO,CAACuE,EAAE;IACfN,eAAe,EAAElE,MAAM,CAACmE;EAC1B,CAAC;EACDX,YAAY,EAAE;IAAEiB,SAAS,EAAE;EAAS;AACtC,CAAC,CAAC","ignoreList":[]}

package/lib/module/ui/hosted/hosted-payment-webview.js

@@ -1,10 +1,12 @@
 "use strict";
 
-import { useCallback, useEffect } from 'react';
+import { useCallback, useEffect, useRef } from 'react';
 import { StyleSheet, View } from 'react-native';
 import { WebView } from 'react-native-webview';
+import { parseHostedBridgeMessage } from "../../internal/hosted/bridge-message.js";
 import { buildHostedPaymentUrl, isHostedOriginUrl } from "../../internal/hosted/hosted-url.js";
 import { createLogger } from "../../internal/logger.js";
+import { createTelemetryRequestHandler } from "../../internal/telemetry/native-telemetry-reply.js";
 import { parseUrlParts } from "../../internal/url-parts.js";
 import { Colors } from "../theme/index.js";
 import { jsx as _jsx } from "react/jsx-runtime";
@@ -47,6 +49,7 @@ export function HostedPaymentWebView(props) {
     baseUrl,
     reference,
     onBridgeMessage,
+    onTelemetryRequest,
     onLoadFailure,
     onMounted
   } = props;
@@ -54,6 +57,7 @@ export function HostedPaymentWebView(props) {
     baseUrl,
     reference
   });
+  const webViewRef = useRef(null);
 
   // This reports that *this* webview exists, and a retry mounts a fresh instance
   // which reports itself anew. Re-running on a new callback identity would
@@ -63,8 +67,21 @@ export function HostedPaymentWebView(props) {
     onMounted?.();
   }, []);
   const handleMessage = useCallback(event => {
-    onBridgeMessage(event.nativeEvent.data);
-  }, [onBridgeMessage]);
+    const raw = event.nativeEvent.data;
+
+    // The telemetry request is answered here, where the webview reference
+    // lives, because the reply is delivered by injecting script — a channel
+    // only this component holds. Everything else stays the caller's.
+    if (onTelemetryRequest && parseHostedBridgeMessage(raw)?.type === 'telemetryRequest') {
+      const respond = createTelemetryRequestHandler({
+        collect: onTelemetryRequest,
+        inject: script => webViewRef.current?.injectJavaScript(script)
+      });
+      void respond();
+      return;
+    }
+    onBridgeMessage(raw);
+  }, [onBridgeMessage, onTelemetryRequest]);
 
   // Every navigation is routed through here rather than through `originWhitelist`.
   // A URL that fails the whitelist is handed to `Linking.openURL` by
@@ -88,6 +105,7 @@ export function HostedPaymentWebView(props) {
       style: styles.container,
       testID: "hosted-payment-webview",
       children: /*#__PURE__*/_jsx(WebView, {
+        ref: webViewRef,
         source: {
           uri
         },
@@ -133,6 +151,17 @@ export function HostedPaymentWebView(props) {
         style: styles.webview,
         javaScriptEnabled: true,
         domStorageEnabled: true
+        // Lets the page's consent screen ask for a coarse location fix, which it
+        // attaches to the payment as a risk signal. Android only; iOS raises its
+        // own per-origin system prompt, gated by the host app's usage-description
+        // entry. This toggle is frame-wide — the platform offers no per-origin
+        // answer here — so the scope rests on `handleShouldStartLoad` above
+        // refusing every off-origin document in this frame. The toggle alone also
+        // reveals nothing: the host application must hold the user-facing location
+        // permission, and without it the page's request fails and the payment
+        // proceeds without the signal.
+        ,
+        geolocationEnabled: true
         // The page holds a payment in progress and nothing else should share its
         // storage, on this device or between payers on it.
         ,

package/lib/module/ui/hosted/hosted-payment-webview.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","useEffect","StyleSheet","View","WebView","buildHostedPaymentUrl","isHostedOriginUrl","createLogger","parseUrlParts","Colors","jsx","_jsx","log","safeOrigin","url","parts","scheme","host","shouldAllowHostedNavigation","args","HostedPaymentWebView","props","baseUrl","reference","onBridgeMessage","onLoadFailure","onMounted","uri","handleMessage","event","nativeEvent","data","handleShouldStartLoad","style","styles","container","testID","children","source","onMessage","originWhitelist","ALLOW_ALL_ORIGINS","onShouldStartLoadWithRequest","onError","severe","description","code","onHttpError","statusCode","onContentProcessDidTerminate","onRenderProcessGone","didCrash","webview","javaScriptEnabled","domStorageEnabled","incognito","setSupportMultipleWindows","allowFileAccess","allowUniversalAccessFromFileURLs","allowFileAccessFromFileURLs","create","flex","backgroundColor","surfacePage"],"sourceRoot":"../../../../src","sources":["ui/hosted/hosted-payment-webview.tsx"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,QAAQ,OAAO;AAC9C,SAASC,UAAU,EAAEC,IAAI,QAAQ,cAAc;AAC/C,SAASC,OAAO,QAAkC,sBAAsB;AACxE,SAASC,qBAAqB,EAAEC,iBAAiB,QAAQ,qCAAkC;AAC3F,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,aAAa,QAAQ,6BAA0B;AACxD,SAASC,MAAM,QAAQ,mBAAU;AAAC,SAAAC,GAAA,IAAAC,IAAA;AAElC,MAAMC,GAAG,GAAGL,YAAY,CAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASM,UAAUA,CAACC,GAAW,EAAU;EACvC,MAAMC,KAAK,GAAGP,aAAa,CAACM,GAAG,CAAC;EAChC,OAAOC,KAAK,GAAG,GAAGA,KAAK,CAACC,MAAM,MAAMD,KAAK,CAACE,IAAI,EAAE,GAAG,mBAAmB;AACxE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,2BAA2BA,CAACC,IAAsC,EAAW;EAC3F,OAAOb,iBAAiB,CAACa,IAAI,CAAC;AAChC;AAuBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAACC,KAAgC,EAAe;EAClF,MAAM;IAAEC,OAAO;IAAEC,SAAS;IAAEC,eAAe;IAAEC,aAAa;IAAEC;EAAU,CAAC,GAAGL,KAAK;EAC/E,MAAMM,GAAG,GAAGtB,qBAAqB,CAAC;IAAEiB,OAAO;IAAEC;EAAU,CAAC,CAAC;;EAEzD;EACA;EACA;EACA;EACAtB,SAAS,CAAC,MAAM;IACdyB,SAAS,GAAG,CAAC;EACf,CAAC,EAAE,EAAE,CAAC;EAEN,MAAME,aAAa,GAAG5B,WAAW,CAC9B6B,KAA0B,IAAK;IAC9BL,eAAe,CAACK,KAAK,CAACC,WAAW,CAACC,IAAI,CAAC;EACzC,CAAC,EACD,CAACP,eAAe,CAClB,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMQ,qBAAqB,GAAGhC,WAAW,CACvC,CAAC;IAAEc;EAAqB,CAAC,KAAKI,2BAA2B,CAAC;IAAEI,OAAO;IAAER;EAAI,CAAC,CAAC,EAC3E,CAACQ,OAAO,CACV,CAAC;EAED;IAAA;IACE;IACA;IACA;IACAX,IAAA,CAACR,IAAI;MAAC8B,KAAK,EAAEC,MAAM,CAACC,SAAU;MAACC,MAAM,EAAC,wBAAwB;MAAAC,QAAA,eAC5D1B,IAAA,CAACP,OAAO;QACNkC,MAAM,EAAE;UAAEX;QAAI,CAAE;QAChBY,SAAS,EAAEX,aAAc;QACzBY,eAAe,EAAEC,iBAAkB;QACnCC,4BAA4B,EAAEV;QAC9B;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QAAA;QACAW,OAAO,EAAEA,CAAC;UAAEb;QAAY,CAAC,KAAK;UAC5BlB,GAAG,CAACgC,MAAM,CACR,wCAAwC/B,UAAU,CAACc,GAAG,CAAC,GAAG,GACxD,IAAIG,WAAW,CAACe,WAAW,IAAI,QAAQf,WAAW,CAACgB,IAAI,EAAE,GAC7D,CAAC;UACDrB,aAAa,GAAG,CAAC;QACnB,CAAE;QACFsB,WAAW,EAAEA,CAAC;UAAEjB;QAAY,CAAC,KAAK;UAChClB,GAAG,CAACgC,MAAM,CACR,uBAAuB/B,UAAU,CAACc,GAAG,CAAC,YAAY,GAAG,QAAQG,WAAW,CAACkB,UAAU,EACrF,CAAC;UACDvB,aAAa,GAAG,CAAC;QACnB;QACA;QACA;QACA;QACA;QAAA;QACAwB,4BAA4B,EAAEA,CAAA,KAAM;UAClCrC,GAAG,CAACgC,MAAM,CAAC,6DAA6D,CAAC;UACzEnB,aAAa,GAAG,CAAC;QACnB,CAAE;QACFyB,mBAAmB,EAAEA,CAAC;UAAEpB;QAAY,CAAC,KAAK;UACxClB,GAAG,CAACgC,MAAM,CACR,wDAAwDd,WAAW,CAACqB,QAAQ,GAC9E,CAAC;UACD1B,aAAa,GAAG,CAAC;QACnB,CAAE;QACFQ,KAAK,EAAEC,MAAM,CAACkB,OAAQ;QACtBC,iBAAiB;QACjBC,iBAAiB;QACjB;QACA;QAAA;QACAC,SAAS;QACT;QACA;QAAA;QACAC,yBAAyB,EAAE,KAAM;QACjCC,eAAe,EAAE,KAAM;QACvBC,gCAAgC,EAAE,KAAM;QACxCC,2BAA2B,EAAE,KAAM;QACnCvB,MAAM,EAAC;MAAiC,CACzC;IAAC,CACE;EAAC;AAEX;AAEA,MAAMK,iBAAiB,GAAG,CAAC,GAAG,CAAC;AAE/B,MAAMP,MAAM,GAAGhC,UAAU,CAAC0D,MAAM,CAAC;EAC/BzB,SAAS,EAAE;IAAE0B,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAErD,MAAM,CAACsD;EAAY,CAAC;EAC3DX,OAAO,EAAE;IAAES,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAErD,MAAM,CAACsD;EAAY;AAC1D,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["useCallback","useEffect","useRef","StyleSheet","View","WebView","parseHostedBridgeMessage","buildHostedPaymentUrl","isHostedOriginUrl","createLogger","createTelemetryRequestHandler","parseUrlParts","Colors","jsx","_jsx","log","safeOrigin","url","parts","scheme","host","shouldAllowHostedNavigation","args","HostedPaymentWebView","props","baseUrl","reference","onBridgeMessage","onTelemetryRequest","onLoadFailure","onMounted","uri","webViewRef","handleMessage","event","raw","nativeEvent","data","type","respond","collect","inject","script","current","injectJavaScript","handleShouldStartLoad","style","styles","container","testID","children","ref","source","onMessage","originWhitelist","ALLOW_ALL_ORIGINS","onShouldStartLoadWithRequest","onError","severe","description","code","onHttpError","statusCode","onContentProcessDidTerminate","onRenderProcessGone","didCrash","webview","javaScriptEnabled","domStorageEnabled","geolocationEnabled","incognito","setSupportMultipleWindows","allowFileAccess","allowUniversalAccessFromFileURLs","allowFileAccessFromFileURLs","create","flex","backgroundColor","surfacePage"],"sourceRoot":"../../../../src","sources":["ui/hosted/hosted-payment-webview.tsx"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,EAAEC,MAAM,QAAQ,OAAO;AACtD,SAASC,UAAU,EAAEC,IAAI,QAAQ,cAAc;AAC/C,SAASC,OAAO,QAAkC,sBAAsB;AACxE,SAASC,wBAAwB,QAAQ,yCAAsC;AAC/E,SAASC,qBAAqB,EAAEC,iBAAiB,QAAQ,qCAAkC;AAC3F,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,6BAA6B,QAAQ,oDAAiD;AAC/F,SAASC,aAAa,QAAQ,6BAA0B;AACxD,SAASC,MAAM,QAAQ,mBAAU;AAAC,SAAAC,GAAA,IAAAC,IAAA;AAElC,MAAMC,GAAG,GAAGN,YAAY,CAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASO,UAAUA,CAACC,GAAW,EAAU;EACvC,MAAMC,KAAK,GAAGP,aAAa,CAACM,GAAG,CAAC;EAChC,OAAOC,KAAK,GAAG,GAAGA,KAAK,CAACC,MAAM,MAAMD,KAAK,CAACE,IAAI,EAAE,GAAG,mBAAmB;AACxE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,2BAA2BA,CAACC,IAAsC,EAAW;EAC3F,OAAOd,iBAAiB,CAACc,IAAI,CAAC;AAChC;AAgCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAACC,KAAgC,EAAe;EAClF,MAAM;IAAEC,OAAO;IAAEC,SAAS;IAAEC,eAAe;IAAEC,kBAAkB;IAAEC,aAAa;IAAEC;EAAU,CAAC,GACzFN,KAAK;EACP,MAAMO,GAAG,GAAGxB,qBAAqB,CAAC;IAAEkB,OAAO;IAAEC;EAAU,CAAC,CAAC;EACzD,MAAMM,UAAU,GAAG9B,MAAM,CAAU,IAAI,CAAC;;EAExC;EACA;EACA;EACA;EACAD,SAAS,CAAC,MAAM;IACd6B,SAAS,GAAG,CAAC;EACf,CAAC,EAAE,EAAE,CAAC;EAEN,MAAMG,aAAa,GAAGjC,WAAW,CAC9BkC,KAA0B,IAAK;IAC9B,MAAMC,GAAG,GAAGD,KAAK,CAACE,WAAW,CAACC,IAAI;;IAElC;IACA;IACA;IACA,IAAIT,kBAAkB,IAAItB,wBAAwB,CAAC6B,GAAG,CAAC,EAAEG,IAAI,KAAK,kBAAkB,EAAE;MACpF,MAAMC,OAAO,GAAG7B,6BAA6B,CAAC;QAC5C8B,OAAO,EAAEZ,kBAAkB;QAC3Ba,MAAM,EAAGC,MAAM,IAAKV,UAAU,CAACW,OAAO,EAAEC,gBAAgB,CAACF,MAAM;MACjE,CAAC,CAAC;MACF,KAAKH,OAAO,CAAC,CAAC;MACd;IACF;IAEAZ,eAAe,CAACQ,GAAG,CAAC;EACtB,CAAC,EACD,CAACR,eAAe,EAAEC,kBAAkB,CACtC,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMiB,qBAAqB,GAAG7C,WAAW,CACvC,CAAC;IAAEiB;EAAqB,CAAC,KAAKI,2BAA2B,CAAC;IAAEI,OAAO;IAAER;EAAI,CAAC,CAAC,EAC3E,CAACQ,OAAO,CACV,CAAC;EAED;IAAA;IACE;IACA;IACA;IACAX,IAAA,CAACV,IAAI;MAAC0C,KAAK,EAAEC,MAAM,CAACC,SAAU;MAACC,MAAM,EAAC,wBAAwB;MAAAC,QAAA,eAC5DpC,IAAA,CAACT,OAAO;QACN8C,GAAG,EAAEnB,UAAW;QAChBoB,MAAM,EAAE;UAAErB;QAAI,CAAE;QAChBsB,SAAS,EAAEpB,aAAc;QACzBqB,eAAe,EAAEC,iBAAkB;QACnCC,4BAA4B,EAAEX;QAC9B;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QAAA;QACAY,OAAO,EAAEA,CAAC;UAAErB;QAAY,CAAC,KAAK;UAC5BrB,GAAG,CAAC2C,MAAM,CACR,wCAAwC1C,UAAU,CAACe,GAAG,CAAC,GAAG,GACxD,IAAIK,WAAW,CAACuB,WAAW,IAAI,QAAQvB,WAAW,CAACwB,IAAI,EAAE,GAC7D,CAAC;UACD/B,aAAa,GAAG,CAAC;QACnB,CAAE;QACFgC,WAAW,EAAEA,CAAC;UAAEzB;QAAY,CAAC,KAAK;UAChCrB,GAAG,CAAC2C,MAAM,CACR,uBAAuB1C,UAAU,CAACe,GAAG,CAAC,YAAY,GAAG,QAAQK,WAAW,CAAC0B,UAAU,EACrF,CAAC;UACDjC,aAAa,GAAG,CAAC;QACnB;QACA;QACA;QACA;QACA;QAAA;QACAkC,4BAA4B,EAAEA,CAAA,KAAM;UAClChD,GAAG,CAAC2C,MAAM,CAAC,6DAA6D,CAAC;UACzE7B,aAAa,GAAG,CAAC;QACnB,CAAE;QACFmC,mBAAmB,EAAEA,CAAC;UAAE5B;QAAY,CAAC,KAAK;UACxCrB,GAAG,CAAC2C,MAAM,CACR,wDAAwDtB,WAAW,CAAC6B,QAAQ,GAC9E,CAAC;UACDpC,aAAa,GAAG,CAAC;QACnB,CAAE;QACFiB,KAAK,EAAEC,MAAM,CAACmB,OAAQ;QACtBC,iBAAiB;QACjBC,iBAAiB;QACjB;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QAAA;QACAC,kBAAkB;QAClB;QACA;QAAA;QACAC,SAAS;QACT;QACA;QAAA;QACAC,yBAAyB,EAAE,KAAM;QACjCC,eAAe,EAAE,KAAM;QACvBC,gCAAgC,EAAE,KAAM;QACxCC,2BAA2B,EAAE,KAAM;QACnCzB,MAAM,EAAC;MAAiC,CACzC;IAAC,CACE;EAAC;AAEX;AAEA,MAAMM,iBAAiB,GAAG,CAAC,GAAG,CAAC;AAE/B,MAAMR,MAAM,GAAG5C,UAAU,CAACwE,MAAM,CAAC;EAC/B3B,SAAS,EAAE;IAAE4B,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAEjE,MAAM,CAACkE;EAAY,CAAC;EAC3DZ,OAAO,EAAE;IAAEU,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAEjE,MAAM,CAACkE;EAAY;AAC1D,CAAC,CAAC","ignoreList":[]}

package/lib/module/version.js

@@ -8,5 +8,5 @@
  * `changeset version`). The src/index.ts smoke test asserts this matches
  * package.json's version.
  */
-export const SDK_VERSION = '1.0.0';
+export const SDK_VERSION = '1.1.0';
 //# sourceMappingURL=version.js.map

package/lib/typescript/commonjs/core/services/hosted-flow-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-flow-controller.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,eAAe,EAAqC,MAAM,qBAAqB,CAAC;AAI9F,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,UAAU,CAA4C;gBAElD,OAAO,EAAE,2BAA2B;IAQhD;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAKzB,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACG,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4CzD;;;;;OAKG;IACH,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAKvB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IA4CrC;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,IAAI;IA2BlB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAWb;;;;;OAKG;IACH,MAAM,IAAI,IAAI;IAed;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAmBf,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;OAOG;YACW,QAAQ;IAiCtB,OAAO,CAAC,MAAM;CAcf"}
+{"version":3,"file":"hosted-flow-controller.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,eAAe,EAAqC,MAAM,qBAAqB,CAAC;AAI9F,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,UAAU,CAA4C;gBAElD,OAAO,EAAE,2BAA2B;IAQhD;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAKzB,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACG,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiDzD;;;;;OAKG;IACH,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAKvB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IA4CrC;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,IAAI;IA2BlB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAWb;;;;;OAKG;IACH,MAAM,IAAI,IAAI;IAed;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAmBf,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;OAOG;YACW,QAAQ;IAiCtB,OAAO,CAAC,MAAM;CAcf"}

package/lib/typescript/commonjs/internal/bank-redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bank-redirect.d.ts","sourceRoot":"","sources":["../../../../src/internal/bank-redirect.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAcD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B9E"}
+{"version":3,"file":"bank-redirect.d.ts","sourceRoot":"","sources":["../../../../src/internal/bank-redirect.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAcD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC9E"}

package/lib/typescript/commonjs/internal/hosted/bridge-message.d.ts

@@ -8,7 +8,7 @@
  * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
  * which arrives here as `event.nativeEvent.data`.
  */
-export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError;
+export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError | HostedTelemetryRequest;
 /** The payable page is interactive. */
 export interface HostedReady {
     readonly type: 'ready';
@@ -33,6 +33,17 @@ export interface HostedError {
     readonly type: 'error';
     readonly code: string;
 }
+/**
+ * The page is asking for this device's native risk facts.
+ *
+ * The one message that expects an answer — not over this channel, which cannot
+ * reply, but through the `window.__spareLinkNativeTelemetry` callback the page
+ * exposes and the shell invokes by injecting script. A shell that stays silent
+ * costs the page one bounded timeout and nothing else.
+ */
+export interface HostedTelemetryRequest {
+    readonly type: 'telemetryRequest';
+}
 /**
  * Parses a message posted by the hosted page.
  *

package/lib/typescript/commonjs/internal/hosted/bridge-message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,WAAW,CAAC;AAE3F,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAyBjF"}
+{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,aAAa,GACb,YAAY,GACZ,WAAW,GACX,sBAAsB,CAAC;AAE3B,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA2BjF"}

package/lib/typescript/commonjs/internal/telemetry/native-telemetry-reply.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Delivers a telemetry reply into the hosted page.
+ *
+ * The WebView message channel is one-way, so the reply travels the other way:
+ * the page exposes `window.__spareLinkNativeTelemetry` before it asks, and the
+ * shell answers by injecting a call to it. A page without the callback — an
+ * older page, or one that already gave up waiting — receives nothing and the
+ * injected chunk evaluates to a harmless literal.
+ */
+/** Page-exposed global the shell invokes with its telemetry reply. */
+export declare const NATIVE_TELEMETRY_CALLBACK_NAME = "__spareLinkNativeTelemetry";
+/**
+ * Builds the script that hands [payload] to the page's telemetry callback.
+ *
+ * The payload is embedded as a JSON literal. U+2028 and U+2029 are legal inside
+ * a JSON string but terminate a statement when evaluated as script, so they are
+ * escaped; the result is a single expression that is inert on a page without
+ * the callback.
+ */
+export declare function buildNativeTelemetryReplyScript(payload: Record<string, unknown>): string;
+/**
+ * Builds the handler the webview runs when the page asks for telemetry.
+ *
+ * Collection and injection are injected so the handler is a pure seam: the
+ * component wires the real collector and the WebView reference into it. A
+ * collector that answers nothing, or throws, injects nothing — the page's own
+ * timeout settles the request.
+ */
+export declare function createTelemetryRequestHandler(deps: {
+    collect: () => Promise<Record<string, unknown> | null>;
+    inject: (script: string) => void;
+}): () => Promise<void>;
+//# sourceMappingURL=native-telemetry-reply.d.ts.map

package/lib/typescript/commonjs/internal/telemetry/native-telemetry-reply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-telemetry-reply.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/native-telemetry-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQxF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAgBtB"}

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-collector.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Collects this device's native risk facts for the hosted payment page.
+ *
+ * Every probe is injected, so the collector runs under Jest with fakes and the
+ * module wiring lives in `risk-telemetry-probes`. Every probe is also allowed to
+ * fail or hang: a throwing or slow reading leaves its fact absent, because a risk
+ * reading must never delay or break a payment.
+ *
+ * The payload mirrors the page's own risk contract: camelCase keys under a
+ * `deviceInformation` block, facts only, nothing fabricated.
+ */
+/** How long any single probe may take before its fact is given up on. */
+export declare const TELEMETRY_PROBE_BUDGET_MS = 800;
+/** Identity and build facts read from the platform. */
+export interface RiskDeviceSnapshot {
+    readonly operatingSystem: string | null;
+    readonly operatingSystemVersion: string | null;
+    readonly model: string | null;
+    readonly manufacturer: string | null;
+    /** A per-vendor install-stable identifier, when the platform offers one. */
+    readonly vendorIdentifier: string | null;
+    /** False on simulators and emulators. */
+    readonly isPhysicalDevice: boolean | null;
+}
+/** A battery reading, with the level as a 0 to 1 fraction. */
+export interface RiskBatteryReading {
+    readonly levelFraction: number | null;
+    readonly isCharging: boolean | null;
+}
+/** The network medium classes the risk payload distinguishes. */
+export type RiskConnectionKind = 'wifi' | 'cellular' | 'other';
+/** The probes the collector runs. Each may answer null, throw, or hang. */
+export interface RiskTelemetryProbes {
+    loadDeviceSnapshot(): Promise<RiskDeviceSnapshot | null>;
+    loadBattery(): Promise<RiskBatteryReading | null>;
+    loadConnection(): Promise<RiskConnectionKind | null>;
+    localeTag(): string | null;
+    localDateTime(): string | null;
+}
+/**
+ * Collects whatever the device answered within the per-probe budget.
+ *
+ * Returns null when nothing answered, so a caller hands the page nothing rather
+ * than an empty block.
+ */
+export declare function collectRiskTelemetry(probes: RiskTelemetryProbes): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=risk-telemetry-collector.d.ts.map

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-collector.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yCAAyC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3C;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAClD,cAAc,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACrD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,IAAI,MAAM,GAAG,IAAI,CAAC;CAChC;AA4BD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAgDzC"}

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-probes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The real device probes behind `collectRiskTelemetry`.
+ *
+ * Every expo module here is an optional peer, loaded lazily inside a try/catch:
+ * a host app that ships without one simply reports that fact as absent, and no
+ * import of this file can throw for want of a native module. Structural `*Like`
+ * types keep this file honest about how little of each module it relies on.
+ */
+import type { RiskTelemetryProbes } from './risk-telemetry-collector';
+/**
+ * Formats a date as local-time ISO 8601 with a numeric UTC offset, e.g.
+ * `2026-08-25T10:45:46.319+05:30` — never the UTC `Z` form. This keeps the
+ * timestamp on the payer's own clock so it reads the same as the device shows,
+ * and matches the Flutter SDK's `deviceLocalDateTime`.
+ */
+export declare function formatLocalIsoWithOffset(date: Date): string;
+/** The production probe set, ready for `collectRiskTelemetry`. */
+export declare function createRiskTelemetryProbes(): RiskTelemetryProbes;
+//# sourceMappingURL=risk-telemetry-probes.d.ts.map

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-probes.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAIV,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AA8GpC;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAc3D;AAUD,kEAAkE;AAClE,wBAAgB,yBAAyB,IAAI,mBAAmB,CAE/D"}

package/lib/typescript/commonjs/ui/hosted/hosted-payment-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAavF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAuI5E"}
+{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAevF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CA6I5E"}

package/lib/typescript/commonjs/ui/hosted/hosted-payment-webview.d.ts

@@ -22,6 +22,15 @@ export interface HostedPaymentWebViewProps {
      * this component stays a transport.
      */
     onBridgeMessage: (message: unknown) => void;
+    /**
+     * Answers the page's telemetry request with this device's native risk facts.
+     *
+     * The reply travels back by injected script rather than a return value, so it
+     * is handled here where the webview reference lives, and the message never
+     * reaches [onBridgeMessage]. Absent, or answering null, means the page
+     * proceeds with what the browser alone can see.
+     */
+    onTelemetryRequest?: () => Promise<Record<string, unknown> | null>;
     /** Called when the page itself could not be loaded. */
     onLoadFailure?: () => void;
     /**

package/lib/typescript/commonjs/ui/hosted/hosted-payment-webview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAsBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CA4FlF"}
+{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CAuHlF"}

package/lib/typescript/commonjs/version.d.ts

@@ -6,5 +6,5 @@
  * `changeset version`). The src/index.ts smoke test asserts this matches
  * package.json's version.
  */
-export declare const SDK_VERSION: "1.0.0";
+export declare const SDK_VERSION: "1.1.0";
 //# sourceMappingURL=version.d.ts.map

package/lib/typescript/module/core/services/hosted-flow-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-flow-controller.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,eAAe,EAAqC,MAAM,wBAAqB,CAAC;AAI9F,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,UAAU,CAA4C;gBAElD,OAAO,EAAE,2BAA2B;IAQhD;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAKzB,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACG,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4CzD;;;;;OAKG;IACH,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAKvB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IA4CrC;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,IAAI;IA2BlB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAWb;;;;;OAKG;IACH,MAAM,IAAI,IAAI;IAed;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAmBf,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;OAOG;YACW,QAAQ;IAiCtB,OAAO,CAAC,MAAM;CAcf"}
+{"version":3,"file":"hosted-flow-controller.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,eAAe,EAAqC,MAAM,wBAAqB,CAAC;AAI9F,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,UAAU,CAA4C;gBAElD,OAAO,EAAE,2BAA2B;IAQhD;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAKzB,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACG,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiDzD;;;;;OAKG;IACH,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAKvB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IA4CrC;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,IAAI;IA2BlB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAWb;;;;;OAKG;IACH,MAAM,IAAI,IAAI;IAed;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAmBf,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;OAOG;YACW,QAAQ;IAiCtB,OAAO,CAAC,MAAM;CAcf"}

package/lib/typescript/module/internal/bank-redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bank-redirect.d.ts","sourceRoot":"","sources":["../../../../src/internal/bank-redirect.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAcD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B9E"}
+{"version":3,"file":"bank-redirect.d.ts","sourceRoot":"","sources":["../../../../src/internal/bank-redirect.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAcD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC9E"}

package/lib/typescript/module/internal/hosted/bridge-message.d.ts

@@ -8,7 +8,7 @@
  * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
  * which arrives here as `event.nativeEvent.data`.
  */
-export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError;
+export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError | HostedTelemetryRequest;
 /** The payable page is interactive. */
 export interface HostedReady {
     readonly type: 'ready';
@@ -33,6 +33,17 @@ export interface HostedError {
     readonly type: 'error';
     readonly code: string;
 }
+/**
+ * The page is asking for this device's native risk facts.
+ *
+ * The one message that expects an answer — not over this channel, which cannot
+ * reply, but through the `window.__spareLinkNativeTelemetry` callback the page
+ * exposes and the shell invokes by injecting script. A shell that stays silent
+ * costs the page one bounded timeout and nothing else.
+ */
+export interface HostedTelemetryRequest {
+    readonly type: 'telemetryRequest';
+}
 /**
  * Parses a message posted by the hosted page.
  *

package/lib/typescript/module/internal/hosted/bridge-message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,WAAW,CAAC;AAE3F,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAyBjF"}
+{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,aAAa,GACb,YAAY,GACZ,WAAW,GACX,sBAAsB,CAAC;AAE3B,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA2BjF"}

package/lib/typescript/module/internal/telemetry/native-telemetry-reply.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Delivers a telemetry reply into the hosted page.
+ *
+ * The WebView message channel is one-way, so the reply travels the other way:
+ * the page exposes `window.__spareLinkNativeTelemetry` before it asks, and the
+ * shell answers by injecting a call to it. A page without the callback — an
+ * older page, or one that already gave up waiting — receives nothing and the
+ * injected chunk evaluates to a harmless literal.
+ */
+/** Page-exposed global the shell invokes with its telemetry reply. */
+export declare const NATIVE_TELEMETRY_CALLBACK_NAME = "__spareLinkNativeTelemetry";
+/**
+ * Builds the script that hands [payload] to the page's telemetry callback.
+ *
+ * The payload is embedded as a JSON literal. U+2028 and U+2029 are legal inside
+ * a JSON string but terminate a statement when evaluated as script, so they are
+ * escaped; the result is a single expression that is inert on a page without
+ * the callback.
+ */
+export declare function buildNativeTelemetryReplyScript(payload: Record<string, unknown>): string;
+/**
+ * Builds the handler the webview runs when the page asks for telemetry.
+ *
+ * Collection and injection are injected so the handler is a pure seam: the
+ * component wires the real collector and the WebView reference into it. A
+ * collector that answers nothing, or throws, injects nothing — the page's own
+ * timeout settles the request.
+ */
+export declare function createTelemetryRequestHandler(deps: {
+    collect: () => Promise<Record<string, unknown> | null>;
+    inject: (script: string) => void;
+}): () => Promise<void>;
+//# sourceMappingURL=native-telemetry-reply.d.ts.map

package/lib/typescript/module/internal/telemetry/native-telemetry-reply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-telemetry-reply.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/native-telemetry-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQxF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAgBtB"}

package/lib/typescript/module/internal/telemetry/risk-telemetry-collector.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Collects this device's native risk facts for the hosted payment page.
+ *
+ * Every probe is injected, so the collector runs under Jest with fakes and the
+ * module wiring lives in `risk-telemetry-probes`. Every probe is also allowed to
+ * fail or hang: a throwing or slow reading leaves its fact absent, because a risk
+ * reading must never delay or break a payment.
+ *
+ * The payload mirrors the page's own risk contract: camelCase keys under a
+ * `deviceInformation` block, facts only, nothing fabricated.
+ */
+/** How long any single probe may take before its fact is given up on. */
+export declare const TELEMETRY_PROBE_BUDGET_MS = 800;
+/** Identity and build facts read from the platform. */
+export interface RiskDeviceSnapshot {
+    readonly operatingSystem: string | null;
+    readonly operatingSystemVersion: string | null;
+    readonly model: string | null;
+    readonly manufacturer: string | null;
+    /** A per-vendor install-stable identifier, when the platform offers one. */
+    readonly vendorIdentifier: string | null;
+    /** False on simulators and emulators. */
+    readonly isPhysicalDevice: boolean | null;
+}
+/** A battery reading, with the level as a 0 to 1 fraction. */
+export interface RiskBatteryReading {
+    readonly levelFraction: number | null;
+    readonly isCharging: boolean | null;
+}
+/** The network medium classes the risk payload distinguishes. */
+export type RiskConnectionKind = 'wifi' | 'cellular' | 'other';
+/** The probes the collector runs. Each may answer null, throw, or hang. */
+export interface RiskTelemetryProbes {
+    loadDeviceSnapshot(): Promise<RiskDeviceSnapshot | null>;
+    loadBattery(): Promise<RiskBatteryReading | null>;
+    loadConnection(): Promise<RiskConnectionKind | null>;
+    localeTag(): string | null;
+    localDateTime(): string | null;
+}
+/**
+ * Collects whatever the device answered within the per-probe budget.
+ *
+ * Returns null when nothing answered, so a caller hands the page nothing rather
+ * than an empty block.
+ */
+export declare function collectRiskTelemetry(probes: RiskTelemetryProbes): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=risk-telemetry-collector.d.ts.map

package/lib/typescript/module/internal/telemetry/risk-telemetry-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-collector.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yCAAyC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3C;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAClD,cAAc,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACrD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,IAAI,MAAM,GAAG,IAAI,CAAC;CAChC;AA4BD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAgDzC"}

package/lib/typescript/module/internal/telemetry/risk-telemetry-probes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The real device probes behind `collectRiskTelemetry`.
+ *
+ * Every expo module here is an optional peer, loaded lazily inside a try/catch:
+ * a host app that ships without one simply reports that fact as absent, and no
+ * import of this file can throw for want of a native module. Structural `*Like`
+ * types keep this file honest about how little of each module it relies on.
+ */
+import type { RiskTelemetryProbes } from './risk-telemetry-collector.js';
+/**
+ * Formats a date as local-time ISO 8601 with a numeric UTC offset, e.g.
+ * `2026-08-25T10:45:46.319+05:30` — never the UTC `Z` form. This keeps the
+ * timestamp on the payer's own clock so it reads the same as the device shows,
+ * and matches the Flutter SDK's `deviceLocalDateTime`.
+ */
+export declare function formatLocalIsoWithOffset(date: Date): string;
+/** The production probe set, ready for `collectRiskTelemetry`. */
+export declare function createRiskTelemetryProbes(): RiskTelemetryProbes;
+//# sourceMappingURL=risk-telemetry-probes.d.ts.map

package/lib/typescript/module/internal/telemetry/risk-telemetry-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-probes.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAIV,mBAAmB,EACpB,MAAM,+BAA4B,CAAC;AA8GpC;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAc3D;AAUD,kEAAkE;AAClE,wBAAgB,yBAAyB,IAAI,mBAAmB,CAE/D"}

package/lib/typescript/module/ui/hosted/hosted-payment-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA4C,CAAC;AAavF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAuI5E"}
+{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA4C,CAAC;AAevF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CA6I5E"}

package/lib/typescript/module/ui/hosted/hosted-payment-webview.d.ts

@@ -22,6 +22,15 @@ export interface HostedPaymentWebViewProps {
      * this component stays a transport.
      */
     onBridgeMessage: (message: unknown) => void;
+    /**
+     * Answers the page's telemetry request with this device's native risk facts.
+     *
+     * The reply travels back by injected script rather than a return value, so it
+     * is handled here where the webview reference lives, and the message never
+     * reaches [onBridgeMessage]. Absent, or answering null, means the page
+     * proceeds with what the browser alone can see.
+     */
+    onTelemetryRequest?: () => Promise<Record<string, unknown> | null>;
     /** Called when the page itself could not be loaded. */
     onLoadFailure?: () => void;
     /**

package/lib/typescript/module/ui/hosted/hosted-payment-webview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAsBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CA4FlF"}
+{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CAuHlF"}

package/lib/typescript/module/version.d.ts

@@ -6,5 +6,5 @@
  * `changeset version`). The src/index.ts smoke test asserts this matches
  * package.json's version.
  */
-export declare const SDK_VERSION: "1.0.0";
+export declare const SDK_VERSION: "1.1.0";
 //# sourceMappingURL=version.d.ts.map