@spare-technologies/spare-link 1.0.1 → 1.1.0

package/README.md

@@ -100,7 +100,15 @@ The ranges are deliberately narrow. This release supports **Expo 52 only**, so a
 
 `expo-web-browser` opens the bank, `expo-secure-store` stores the pending payment for recovery, and the rest render the payment flow. `react-native-svg` is an optional peer, loaded only if present; without it the SDK shows a plain activity indicator.
 
-The SDK requires no runtime permissions.
+Four further optional peers feed the payment's device risk signals — facts like device model, OS version and battery state that the payment page cannot see from inside a webview:
+
+```sh
+npx expo install expo-device expo-battery expo-network expo-application
+```
+
+Each is loaded only if present; an app that ships without one simply reports fewer facts, and payments are never delayed or failed by their absence.
+
+The SDK itself requires no runtime permissions and shows no permission dialogs.
 
 ## Expo plugin
 
@@ -118,14 +126,35 @@ plugins: [
 ]
 ```
 
-The plugin registers only the deep link the payer returns through:
+The plugin does two things:
 
-- **iOS**: a `CFBundleURLSchemes` entry for your app scheme.
-- **Android**: an intent-filter for `myapp://callback`.
+- **Deep link** — registers the return URL scheme: a `CFBundleURLSchemes` entry on iOS, an intent-filter on Android.
+- **iOS privacy manifest** — merges the device data the SDK collects into your app's `ios.privacyManifests` (written to `PrivacyInfo.xcprivacy` at prebuild), so App Store review has it. It declares Device ID (the vendor identifier the risk-telemetry probe reads) and coarse location (the fix the payment page may attach), both unlinked, not used for tracking, purpose App Functionality, and `NSPrivacyTracking: false`. The merge is additive and idempotent — a data type you already declare is left as you set it, and it never forces `NSPrivacyTracking` off if you set it on.
 
 Use the same scheme and host your backend sets in `successRedirectUrl` and `failureRedirectUrl`. Rebuild your dev client after adding the plugin, because it changes native configuration.
 
-Earlier versions injected `ACCESS_FINE_LOCATION` and an iOS location usage description for device telemetry. The SDK no longer collects it, and the plugin requests no permissions.
+The plugin requests no runtime permissions; the location signal below is a separate, opt-in host-app permission.
+
+## Location signal (optional)
+
+The payment page asks for a coarse location fix on its consent screen and attaches it to the payment as a fraud-prevention signal. This is opt-in per app: the SDK declares no location permission and shows no dialog of its own, and a payment completes normally when the signal is unavailable.
+
+To enable it, declare the permission in your app and make sure it has been granted before checkout:
+
+```ts
+// app.config.ts
+ios: {
+  infoPlist: {
+    NSLocationWhenInUseUsageDescription:
+      'Your approximate location is attached to the payment as a fraud-prevention signal.',
+  },
+},
+android: {
+  permissions: ['android.permission.ACCESS_COARSE_LOCATION'],
+},
+```
+
+On iOS the system prompts the payer per origin when the page first asks. On Android the reading is enabled for the payment webview as a whole; the SDK's navigation policy keeps any other origin from ever loading in that frame, and coordinates are coarsened to about a kilometre before they are stored.
 
 ## Environments
 

package/lib/commonjs/core/services/hosted-flow-controller.js

@@ -113,6 +113,11 @@ class HostedFlowController {
           attempt: this.currentState.attempt
         }));
         break;
+      case 'telemetryRequest':
+        // Answered by the webview layer, which owns the injection channel the
+        // reply travels back on. Reaching here means no telemetry handler was
+        // wired, and the page's own timeout settles the request.
+        break;
     }
     return true;
   }

package/lib/commonjs/core/services/hosted-flow-controller.js.map

@@ -1 +1 @@
-{"version":3,"names":["_bankRedirect","require","_bridgeMessage","_logger","_paymentReturnParams","_hostedFlowState","log","createLogger","DEFAULT_READY_TIMEOUT_MS","exports","HostedFlowController","listeners","Set","constructor","options","reference","bankLauncher","url","defaultLaunchBankRedirect","authorizationUrl","readyTimeoutMs","currentState","HostedFlowStates","loading","reportPageMounted","phase","watchForReadiness","state","subscribe","listener","add","delete","handleBridgeMessage","raw","message","parseHostedBridgeMessage","info","isPagePresented","type","stopWatchingForReadiness","moveTo","hosted","attempt","openBank","cancelled","failed","errorCode","code","handleReturn","uri","outcome","report","readPaymentReturn","undefined","warning","succeeded","abandoned","failToLoad","severe","unreachable","retry","giveUp","abandon","dispose","clear","readyTimer","setTimeout","clearTimeout","isTerminalPhase","redirecting","awaitingCallback","next"],"sourceRoot":"../../../../src","sources":["core/services/hosted-flow-controller.ts"],"mappings":";;;;;;AAAA,IAAAA,aAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AAIA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,oBAAA,GAAAH,OAAA;AACA,IAAAI,gBAAA,GAAAJ,OAAA;AAEA,MAAMK,GAAG,GAAG,IAAAC,oBAAY,EAAC,sBAAsB,CAAC;;AAEhD;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,wBAAwB,GAAAC,OAAA,CAAAD,wBAAA,GAAG,MAAM;AAS9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,oBAAoB,CAAC;EAIfC,SAAS,GAAG,IAAIC,GAAG,CAAa,CAAC;EAKlDC,WAAWA,CAACC,OAAoC,EAAE;IAChD,IAAI,CAACC,SAAS,GAAGD,OAAO,CAACC,SAAS;IAClC,IAAI,CAACC,YAAY,GACfF,OAAO,CAACE,YAAY,KAAMC,GAAG,IAAK,IAAAC,gCAAyB,EAAC;MAAEC,gBAAgB,EAAEF;IAAI,CAAC,CAAC,CAAC;IACzF,IAAI,CAACG,cAAc,GAAGN,OAAO,CAACM,cAAc,IAAIZ,wBAAwB;IACxE,IAAI,CAACa,YAAY,GAAGC,iCAAgB,CAACC,OAAO,CAACT,OAAO,CAACC,SAAS,CAAC;EACjE;;EAEA;AACF;AACA;AACA;AACA;AACA;EACES,iBAAiBA,CAAA,EAAS;IACxB,IAAI,IAAI,CAACH,YAAY,CAACI,KAAK,KAAK,SAAS,EAAE;IAC3C,IAAI,CAACC,iBAAiB,CAAC,CAAC;EAC1B;EAEA,IAAIC,KAAKA,CAAA,EAAoB;IAC3B,OAAO,IAAI,CAACN,YAAY;EAC1B;;EAEA;EACAO,SAASA,CAACC,QAAoB,EAAc;IAC1C,IAAI,CAAClB,SAAS,CAACmB,GAAG,CAACD,QAAQ,CAAC;IAC5B,OAAO,MAAM;MACX,IAAI,CAAClB,SAAS,CAACoB,MAAM,CAACF,QAAQ,CAAC;IACjC,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;EACE,MAAMG,mBAAmBA,CAACC,GAAY,EAAoB;IACxD,MAAMC,OAAmC,GAAG,IAAAC,uCAAwB,EAACF,GAAG,CAAC;IACzE,IAAI,CAACC,OAAO,EAAE;MACZ5B,GAAG,CAAC8B,IAAI,CAAC,sDAAsD,CAAC;MAChE,OAAO,KAAK;IACd;;IAEA;IACA;IACA;IACA;IACA;IACA,IAAI,CAAC,IAAI,CAACC,eAAe,CAAC,CAAC,EAAE;MAC3B/B,GAAG,CAAC8B,IAAI,CAAC,eAAeF,OAAO,CAACI,IAAI,2CAA2C,CAAC;MAChF,OAAO,KAAK;IACd;IAEA,QAAQJ,OAAO,CAACI,IAAI;MAClB,KAAK,OAAO;QACV,IAAI,CAACC,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CAACC,MAAM,CAAClB,iCAAgB,CAACmB,MAAM,CAAC,IAAI,CAAC1B,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;QAC/E;MACF,KAAK,SAAS;QACZ,MAAM,IAAI,CAACC,QAAQ,CAACT,OAAO,CAACjB,GAAG,CAAC;QAChC;MACF,KAAK,QAAQ;QACX;QACA,IAAI,CAACsB,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CAACC,MAAM,CAAClB,iCAAgB,CAACsB,SAAS,CAAC,IAAI,CAAC7B,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;QAClF;MACF,KAAK,OAAO;QACV,IAAI,CAACH,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CAACC,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;UACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;UACzB+B,SAAS,EAAEZ,OAAO,CAACa,IAAI;UACvBL,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;QAC7B,CAAC,CACH,CAAC;QACD;IACJ;IACA,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;AACA;EACE;EACQL,eAAeA,CAAA,EAAY;IACjC,MAAMZ,KAAK,GAAG,IAAI,CAACJ,YAAY,CAACI,KAAK;IACrC,OAAOA,KAAK,KAAK,SAAS,IAAIA,KAAK,KAAK,QAAQ;EAClD;EAEAuB,YAAYA,CAACC,GAAiB,EAAQ;IACpC,MAAM;MAAEC,OAAO;MAAEC;IAAO,CAAC,GAAG,IAAAC,sCAAiB,EAACH,GAAG,CAAC;;IAElD;IACA;IACA;IACA;IACA,IAAIE,MAAM,CAACpC,SAAS,KAAKsC,SAAS,IAAIF,MAAM,CAACpC,SAAS,KAAK,IAAI,CAACA,SAAS,EAAE;MACzET,GAAG,CAACgD,OAAO,CAAC,kDAAkD,CAAC;MAC/D;IACF;IAEA,IAAI,CAACf,wBAAwB,CAAC,CAAC;IAE/B,IAAIW,OAAO,KAAK,WAAW,EAAE;MAC3B,IAAI,CAACV,MAAM,CACTlB,iCAAgB,CAACiC,SAAS,CAAC;QACzBxC,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB2B,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB,OAAO;QAClCS;MACF,CAAC,CACH,CAAC;MACD;IACF;;IAEA;IACA;IACA;IACA,IAAID,OAAO,KAAK,SAAS,EAAE;MACzB5C,GAAG,CAAC8B,IAAI,CAAC,mEAAmE,CAAC;MAC7E,IAAI,CAACI,MAAM,CAAClB,iCAAgB,CAACkC,SAAS,CAAC,IAAI,CAACzC,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;MAClF;IACF;IAEA,IAAI,CAACF,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;MACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;MACzB+B,SAAS,EAAEK,MAAM,CAACL,SAAS,IAAI,kBAAkB;MACjDJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB,OAAO;MAClCS;IACF,CAAC,CACH,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEM,UAAUA,CAAA,EAAS;IACjB,MAAMhC,KAAK,GAAG,IAAI,CAACJ,YAAY,CAACI,KAAK;IACrC,IAAIA,KAAK,KAAK,SAAS,IAAIA,KAAK,KAAK,QAAQ,EAAE;MAC7CnB,GAAG,CAAC8B,IAAI,CAAC,oDAAoD,CAAC;MAC9D;IACF;IACA,IAAI,CAACG,wBAAwB,CAAC,CAAC;IAE/B,IAAId,KAAK,KAAK,QAAQ,EAAE;MACtBnB,GAAG,CAACoD,MAAM,CAAC,sEAAsE,CAAC;MAClF,IAAI,CAAClB,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;QACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB;QACA;QACA;QACA;QACA+B,SAAS,EAAE,WAAW;QACtBJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;MAC7B,CAAC,CACH,CAAC;MACD;IACF;IAEA,IAAI,CAACF,MAAM,CAAClB,iCAAgB,CAACqC,WAAW,CAAC,IAAI,CAAC5C,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;EACtF;;EAEA;AACF;AACA;AACA;AACA;AACA;EACEkB,KAAKA,CAAA,EAAS;IACZ,IAAI,IAAI,CAACvC,YAAY,CAACI,KAAK,KAAK,aAAa,EAAE;MAC7CnB,GAAG,CAAC8B,IAAI,CAAC,gEAAgE,CAAC;MAC1E;IACF;IACA,MAAMM,OAAO,GAAG,IAAI,CAACrB,YAAY,CAACqB,OAAO,GAAG,CAAC;IAC7CpC,GAAG,CAAC8B,IAAI,CAAC,8CAA8CM,OAAO,GAAG,CAAC;IAClE;IACA,IAAI,CAACF,MAAM,CAAClB,iCAAgB,CAACC,OAAO,CAAC,IAAI,CAACR,SAAS,EAAE2B,OAAO,CAAC,CAAC;EAChE;;EAEA;AACF;AACA;AACA;AACA;AACA;EACEmB,MAAMA,CAAA,EAAS;IACb,IAAI,IAAI,CAACxC,YAAY,CAACI,KAAK,KAAK,aAAa,EAAE;MAC7CnB,GAAG,CAAC8B,IAAI,CAAC,kEAAkE,CAAC;MAC5E;IACF;IACA,IAAI,CAACG,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAACC,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;MACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;MACzB+B,SAAS,EAAE,kBAAkB;MAC7BJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;IAC7B,CAAC,CACH,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;EACEoB,OAAOA,CAAA,EAAS;IACd,IAAI,CAACvB,wBAAwB,CAAC,CAAC;IAE/B,IAAI,IAAI,CAAClB,YAAY,CAACI,KAAK,KAAK,aAAa,EAAE;MAC7C;MACA;MACA,IAAI,CAACe,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;QACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB+B,SAAS,EAAE,kBAAkB;QAC7BJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;MAC7B,CAAC,CACH,CAAC;MACD;IACF;IAEA,IAAI,CAACF,MAAM,CAAClB,iCAAgB,CAACkC,SAAS,CAAC,IAAI,CAACzC,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;EACpF;EAEAqB,OAAOA,CAAA,EAAS;IACd,IAAI,CAACxB,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAAC5B,SAAS,CAACqD,KAAK,CAAC,CAAC;EACxB;EAEQtC,iBAAiBA,CAAA,EAAS;IAChC,IAAI,CAACa,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAAC0B,UAAU,GAAGC,UAAU,CAAC,MAAM;MACjC,IAAI,CAACD,UAAU,GAAGZ,SAAS;MAC3B,IAAI,IAAI,CAAChC,YAAY,CAACI,KAAK,KAAK,SAAS,EAAE;MAC3CnB,GAAG,CAACoD,MAAM,CAAC,wEAAwE,CAAC;MACpF,IAAI,CAAClB,MAAM,CAAClB,iCAAgB,CAACqC,WAAW,CAAC,IAAI,CAAC5C,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;IACtF,CAAC,EAAE,IAAI,CAACtB,cAAc,CAAC;EACzB;EAEQmB,wBAAwBA,CAAA,EAAS;IACvC,IAAI,IAAI,CAAC0B,UAAU,KAAKZ,SAAS,EAAE;IACnCc,YAAY,CAAC,IAAI,CAACF,UAAU,CAAC;IAC7B,IAAI,CAACA,UAAU,GAAGZ,SAAS;EAC7B;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAcV,QAAQA,CAAC1B,GAAW,EAAiB;IACjD,IAAI,IAAAmD,gCAAe,EAAC,IAAI,CAAC/C,YAAY,CAACI,KAAK,CAAC,EAAE;MAC5CnB,GAAG,CAAC8B,IAAI,CAAC,0DAA0D,CAAC;MACpE;IACF;IACA,IACE,IAAI,CAACf,YAAY,CAACI,KAAK,KAAK,aAAa,IACzC,IAAI,CAACJ,YAAY,CAACI,KAAK,KAAK,kBAAkB,EAC9C;MACAnB,GAAG,CAAC8B,IAAI,CAAC,iDAAiD,CAAC;MAC3D;IACF;IAEA,IAAI,CAACG,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAACC,MAAM,CAAClB,iCAAgB,CAAC+C,WAAW,CAAC,IAAI,CAACtD,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;IAEpF,IAAI;MACF,MAAM,IAAI,CAAC1B,YAAY,CAACC,GAAG,CAAC;MAC5B,IAAI,CAACuB,MAAM,CAAClB,iCAAgB,CAACgD,gBAAgB,CAAC,IAAI,CAACvD,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;IAC3F,CAAC,CAAC,MAAM;MACN;MACA;MACApC,GAAG,CAACoD,MAAM,CAAC,yBAAyB,CAAC;MACrC,IAAI,CAAClB,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;QACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB+B,SAAS,EAAE,iBAAiB;QAC5BJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;MAC7B,CAAC,CACH,CAAC;IACH;EACF;EAEQF,MAAMA,CAAC+B,IAAqB,EAAQ;IAC1C,IAAI,IAAAH,gCAAe,EAAC,IAAI,CAAC/C,YAAY,CAACI,KAAK,CAAC,EAAE;MAC5CnB,GAAG,CAAC8B,IAAI,CAAC,qDAAqD,CAAC;MAC/D;IACF;IACA,IAAI,CAACf,YAAY,GAAGkD,IAAI;IACxB,KAAK,MAAM1C,QAAQ,IAAI,IAAI,CAAClB,SAAS,EAAE;MACrC,IAAI;QACFkB,QAAQ,CAAC,CAAC;MACZ,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF;AACF;AAACpB,OAAA,CAAAC,oBAAA,GAAAA,oBAAA","ignoreList":[]}
+{"version":3,"names":["_bankRedirect","require","_bridgeMessage","_logger","_paymentReturnParams","_hostedFlowState","log","createLogger","DEFAULT_READY_TIMEOUT_MS","exports","HostedFlowController","listeners","Set","constructor","options","reference","bankLauncher","url","defaultLaunchBankRedirect","authorizationUrl","readyTimeoutMs","currentState","HostedFlowStates","loading","reportPageMounted","phase","watchForReadiness","state","subscribe","listener","add","delete","handleBridgeMessage","raw","message","parseHostedBridgeMessage","info","isPagePresented","type","stopWatchingForReadiness","moveTo","hosted","attempt","openBank","cancelled","failed","errorCode","code","handleReturn","uri","outcome","report","readPaymentReturn","undefined","warning","succeeded","abandoned","failToLoad","severe","unreachable","retry","giveUp","abandon","dispose","clear","readyTimer","setTimeout","clearTimeout","isTerminalPhase","redirecting","awaitingCallback","next"],"sourceRoot":"../../../../src","sources":["core/services/hosted-flow-controller.ts"],"mappings":";;;;;;AAAA,IAAAA,aAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AAIA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,oBAAA,GAAAH,OAAA;AACA,IAAAI,gBAAA,GAAAJ,OAAA;AAEA,MAAMK,GAAG,GAAG,IAAAC,oBAAY,EAAC,sBAAsB,CAAC;;AAEhD;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,wBAAwB,GAAAC,OAAA,CAAAD,wBAAA,GAAG,MAAM;AAS9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,oBAAoB,CAAC;EAIfC,SAAS,GAAG,IAAIC,GAAG,CAAa,CAAC;EAKlDC,WAAWA,CAACC,OAAoC,EAAE;IAChD,IAAI,CAACC,SAAS,GAAGD,OAAO,CAACC,SAAS;IAClC,IAAI,CAACC,YAAY,GACfF,OAAO,CAACE,YAAY,KAAMC,GAAG,IAAK,IAAAC,gCAAyB,EAAC;MAAEC,gBAAgB,EAAEF;IAAI,CAAC,CAAC,CAAC;IACzF,IAAI,CAACG,cAAc,GAAGN,OAAO,CAACM,cAAc,IAAIZ,wBAAwB;IACxE,IAAI,CAACa,YAAY,GAAGC,iCAAgB,CAACC,OAAO,CAACT,OAAO,CAACC,SAAS,CAAC;EACjE;;EAEA;AACF;AACA;AACA;AACA;AACA;EACES,iBAAiBA,CAAA,EAAS;IACxB,IAAI,IAAI,CAACH,YAAY,CAACI,KAAK,KAAK,SAAS,EAAE;IAC3C,IAAI,CAACC,iBAAiB,CAAC,CAAC;EAC1B;EAEA,IAAIC,KAAKA,CAAA,EAAoB;IAC3B,OAAO,IAAI,CAACN,YAAY;EAC1B;;EAEA;EACAO,SAASA,CAACC,QAAoB,EAAc;IAC1C,IAAI,CAAClB,SAAS,CAACmB,GAAG,CAACD,QAAQ,CAAC;IAC5B,OAAO,MAAM;MACX,IAAI,CAAClB,SAAS,CAACoB,MAAM,CAACF,QAAQ,CAAC;IACjC,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;EACE,MAAMG,mBAAmBA,CAACC,GAAY,EAAoB;IACxD,MAAMC,OAAmC,GAAG,IAAAC,uCAAwB,EAACF,GAAG,CAAC;IACzE,IAAI,CAACC,OAAO,EAAE;MACZ5B,GAAG,CAAC8B,IAAI,CAAC,sDAAsD,CAAC;MAChE,OAAO,KAAK;IACd;;IAEA;IACA;IACA;IACA;IACA;IACA,IAAI,CAAC,IAAI,CAACC,eAAe,CAAC,CAAC,EAAE;MAC3B/B,GAAG,CAAC8B,IAAI,CAAC,eAAeF,OAAO,CAACI,IAAI,2CAA2C,CAAC;MAChF,OAAO,KAAK;IACd;IAEA,QAAQJ,OAAO,CAACI,IAAI;MAClB,KAAK,OAAO;QACV,IAAI,CAACC,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CAACC,MAAM,CAAClB,iCAAgB,CAACmB,MAAM,CAAC,IAAI,CAAC1B,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;QAC/E;MACF,KAAK,SAAS;QACZ,MAAM,IAAI,CAACC,QAAQ,CAACT,OAAO,CAACjB,GAAG,CAAC;QAChC;MACF,KAAK,QAAQ;QACX;QACA,IAAI,CAACsB,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CAACC,MAAM,CAAClB,iCAAgB,CAACsB,SAAS,CAAC,IAAI,CAAC7B,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;QAClF;MACF,KAAK,OAAO;QACV,IAAI,CAACH,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CAACC,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;UACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;UACzB+B,SAAS,EAAEZ,OAAO,CAACa,IAAI;UACvBL,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;QAC7B,CAAC,CACH,CAAC;QACD;MACF,KAAK,kBAAkB;QACrB;QACA;QACA;QACA;IACJ;IACA,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;AACA;EACE;EACQL,eAAeA,CAAA,EAAY;IACjC,MAAMZ,KAAK,GAAG,IAAI,CAACJ,YAAY,CAACI,KAAK;IACrC,OAAOA,KAAK,KAAK,SAAS,IAAIA,KAAK,KAAK,QAAQ;EAClD;EAEAuB,YAAYA,CAACC,GAAiB,EAAQ;IACpC,MAAM;MAAEC,OAAO;MAAEC;IAAO,CAAC,GAAG,IAAAC,sCAAiB,EAACH,GAAG,CAAC;;IAElD;IACA;IACA;IACA;IACA,IAAIE,MAAM,CAACpC,SAAS,KAAKsC,SAAS,IAAIF,MAAM,CAACpC,SAAS,KAAK,IAAI,CAACA,SAAS,EAAE;MACzET,GAAG,CAACgD,OAAO,CAAC,kDAAkD,CAAC;MAC/D;IACF;IAEA,IAAI,CAACf,wBAAwB,CAAC,CAAC;IAE/B,IAAIW,OAAO,KAAK,WAAW,EAAE;MAC3B,IAAI,CAACV,MAAM,CACTlB,iCAAgB,CAACiC,SAAS,CAAC;QACzBxC,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB2B,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB,OAAO;QAClCS;MACF,CAAC,CACH,CAAC;MACD;IACF;;IAEA;IACA;IACA;IACA,IAAID,OAAO,KAAK,SAAS,EAAE;MACzB5C,GAAG,CAAC8B,IAAI,CAAC,mEAAmE,CAAC;MAC7E,IAAI,CAACI,MAAM,CAAClB,iCAAgB,CAACkC,SAAS,CAAC,IAAI,CAACzC,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;MAClF;IACF;IAEA,IAAI,CAACF,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;MACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;MACzB+B,SAAS,EAAEK,MAAM,CAACL,SAAS,IAAI,kBAAkB;MACjDJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB,OAAO;MAClCS;IACF,CAAC,CACH,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEM,UAAUA,CAAA,EAAS;IACjB,MAAMhC,KAAK,GAAG,IAAI,CAACJ,YAAY,CAACI,KAAK;IACrC,IAAIA,KAAK,KAAK,SAAS,IAAIA,KAAK,KAAK,QAAQ,EAAE;MAC7CnB,GAAG,CAAC8B,IAAI,CAAC,oDAAoD,CAAC;MAC9D;IACF;IACA,IAAI,CAACG,wBAAwB,CAAC,CAAC;IAE/B,IAAId,KAAK,KAAK,QAAQ,EAAE;MACtBnB,GAAG,CAACoD,MAAM,CAAC,sEAAsE,CAAC;MAClF,IAAI,CAAClB,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;QACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB;QACA;QACA;QACA;QACA+B,SAAS,EAAE,WAAW;QACtBJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;MAC7B,CAAC,CACH,CAAC;MACD;IACF;IAEA,IAAI,CAACF,MAAM,CAAClB,iCAAgB,CAACqC,WAAW,CAAC,IAAI,CAAC5C,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;EACtF;;EAEA;AACF;AACA;AACA;AACA;AACA;EACEkB,KAAKA,CAAA,EAAS;IACZ,IAAI,IAAI,CAACvC,YAAY,CAACI,KAAK,KAAK,aAAa,EAAE;MAC7CnB,GAAG,CAAC8B,IAAI,CAAC,gEAAgE,CAAC;MAC1E;IACF;IACA,MAAMM,OAAO,GAAG,IAAI,CAACrB,YAAY,CAACqB,OAAO,GAAG,CAAC;IAC7CpC,GAAG,CAAC8B,IAAI,CAAC,8CAA8CM,OAAO,GAAG,CAAC;IAClE;IACA,IAAI,CAACF,MAAM,CAAClB,iCAAgB,CAACC,OAAO,CAAC,IAAI,CAACR,SAAS,EAAE2B,OAAO,CAAC,CAAC;EAChE;;EAEA;AACF;AACA;AACA;AACA;AACA;EACEmB,MAAMA,CAAA,EAAS;IACb,IAAI,IAAI,CAACxC,YAAY,CAACI,KAAK,KAAK,aAAa,EAAE;MAC7CnB,GAAG,CAAC8B,IAAI,CAAC,kEAAkE,CAAC;MAC5E;IACF;IACA,IAAI,CAACG,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAACC,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;MACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;MACzB+B,SAAS,EAAE,kBAAkB;MAC7BJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;IAC7B,CAAC,CACH,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;EACEoB,OAAOA,CAAA,EAAS;IACd,IAAI,CAACvB,wBAAwB,CAAC,CAAC;IAE/B,IAAI,IAAI,CAAClB,YAAY,CAACI,KAAK,KAAK,aAAa,EAAE;MAC7C;MACA;MACA,IAAI,CAACe,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;QACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB+B,SAAS,EAAE,kBAAkB;QAC7BJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;MAC7B,CAAC,CACH,CAAC;MACD;IACF;IAEA,IAAI,CAACF,MAAM,CAAClB,iCAAgB,CAACkC,SAAS,CAAC,IAAI,CAACzC,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;EACpF;EAEAqB,OAAOA,CAAA,EAAS;IACd,IAAI,CAACxB,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAAC5B,SAAS,CAACqD,KAAK,CAAC,CAAC;EACxB;EAEQtC,iBAAiBA,CAAA,EAAS;IAChC,IAAI,CAACa,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAAC0B,UAAU,GAAGC,UAAU,CAAC,MAAM;MACjC,IAAI,CAACD,UAAU,GAAGZ,SAAS;MAC3B,IAAI,IAAI,CAAChC,YAAY,CAACI,KAAK,KAAK,SAAS,EAAE;MAC3CnB,GAAG,CAACoD,MAAM,CAAC,wEAAwE,CAAC;MACpF,IAAI,CAAClB,MAAM,CAAClB,iCAAgB,CAACqC,WAAW,CAAC,IAAI,CAAC5C,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;IACtF,CAAC,EAAE,IAAI,CAACtB,cAAc,CAAC;EACzB;EAEQmB,wBAAwBA,CAAA,EAAS;IACvC,IAAI,IAAI,CAAC0B,UAAU,KAAKZ,SAAS,EAAE;IACnCc,YAAY,CAAC,IAAI,CAACF,UAAU,CAAC;IAC7B,IAAI,CAACA,UAAU,GAAGZ,SAAS;EAC7B;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAcV,QAAQA,CAAC1B,GAAW,EAAiB;IACjD,IAAI,IAAAmD,gCAAe,EAAC,IAAI,CAAC/C,YAAY,CAACI,KAAK,CAAC,EAAE;MAC5CnB,GAAG,CAAC8B,IAAI,CAAC,0DAA0D,CAAC;MACpE;IACF;IACA,IACE,IAAI,CAACf,YAAY,CAACI,KAAK,KAAK,aAAa,IACzC,IAAI,CAACJ,YAAY,CAACI,KAAK,KAAK,kBAAkB,EAC9C;MACAnB,GAAG,CAAC8B,IAAI,CAAC,iDAAiD,CAAC;MAC3D;IACF;IAEA,IAAI,CAACG,wBAAwB,CAAC,CAAC;IAC/B,IAAI,CAACC,MAAM,CAAClB,iCAAgB,CAAC+C,WAAW,CAAC,IAAI,CAACtD,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;IAEpF,IAAI;MACF,MAAM,IAAI,CAAC1B,YAAY,CAACC,GAAG,CAAC;MAC5B,IAAI,CAACuB,MAAM,CAAClB,iCAAgB,CAACgD,gBAAgB,CAAC,IAAI,CAACvD,SAAS,EAAE,IAAI,CAACM,YAAY,CAACqB,OAAO,CAAC,CAAC;IAC3F,CAAC,CAAC,MAAM;MACN;MACA;MACApC,GAAG,CAACoD,MAAM,CAAC,yBAAyB,CAAC;MACrC,IAAI,CAAClB,MAAM,CACTlB,iCAAgB,CAACuB,MAAM,CAAC;QACtB9B,SAAS,EAAE,IAAI,CAACA,SAAS;QACzB+B,SAAS,EAAE,iBAAiB;QAC5BJ,OAAO,EAAE,IAAI,CAACrB,YAAY,CAACqB;MAC7B,CAAC,CACH,CAAC;IACH;EACF;EAEQF,MAAMA,CAAC+B,IAAqB,EAAQ;IAC1C,IAAI,IAAAH,gCAAe,EAAC,IAAI,CAAC/C,YAAY,CAACI,KAAK,CAAC,EAAE;MAC5CnB,GAAG,CAAC8B,IAAI,CAAC,qDAAqD,CAAC;MAC/D;IACF;IACA,IAAI,CAACf,YAAY,GAAGkD,IAAI;IACxB,KAAK,MAAM1C,QAAQ,IAAI,IAAI,CAAClB,SAAS,EAAE;MACrC,IAAI;QACFkB,QAAQ,CAAC,CAAC;MACZ,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF;AACF;AAACpB,OAAA,CAAAC,oBAAA,GAAAA,oBAAA","ignoreList":[]}

package/lib/commonjs/internal/hosted/bridge-message.js

@@ -30,6 +30,15 @@ var _urlParts = require("../url-parts.js");
 
 /** The flow cannot continue. [code] is the key the page itself renders. */
 
+/**
+ * The page is asking for this device's native risk facts.
+ *
+ * The one message that expects an answer — not over this channel, which cannot
+ * reply, but through the `window.__spareLinkNativeTelemetry` callback the page
+ * exposes and the shell invokes by injecting script. A shell that stays silent
+ * costs the page one bounded timeout and nothing else.
+ */
+
 /**
  * Parses a message posted by the hosted page.
  *
@@ -60,6 +69,10 @@ function parseHostedBridgeMessage(raw) {
       return {
         type: 'cancel'
       };
+    case 'spare.telemetry_request':
+      return {
+        type: 'telemetryRequest'
+      };
     case 'spare.error':
       {
         const code = message.code;

package/lib/commonjs/internal/hosted/bridge-message.js.map

@@ -1 +1 @@
-{"version":3,"names":["_urlParts","require","parseHostedBridgeMessage","raw","message","asRecord","type","url","isHttpsUrl","code","trim","length","JSON","parse","Array","isArray","parts","parseUrlParts","scheme","host"],"sourceRoot":"../../../../src","sources":["internal/hosted/bridge-message.ts"],"mappings":";;;;;;AAAA,IAAAA,SAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AAKA;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,wBAAwBA,CAACC,GAAY,EAA8B;EACjF,MAAMC,OAAO,GAAGC,QAAQ,CAACF,GAAG,CAAC;EAC7B,IAAI,CAACC,OAAO,EAAE,OAAO,IAAI;EAEzB,MAAME,IAAI,GAAGF,OAAO,CAACE,IAAI;EACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;EAEzC,QAAQA,IAAI;IACV,KAAK,aAAa;MAChB,OAAO;QAAEA,IAAI,EAAE;MAAQ,CAAC;IAC1B,KAAK,gBAAgB;MAAE;QACrB,MAAMC,GAAG,GAAGH,OAAO,CAACG,GAAG;QACvB,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAI,CAACC,UAAU,CAACD,GAAG,CAAC,EAAE,OAAO,IAAI;QAC5D,OAAO;UAAED,IAAI,EAAE,SAAS;UAAEC;QAAI,CAAC;MACjC;IACA,KAAK,cAAc;MACjB,OAAO;QAAED,IAAI,EAAE;MAAS,CAAC;IAC3B,KAAK,aAAa;MAAE;QAClB,MAAMG,IAAI,GAAGL,OAAO,CAACK,IAAI;QACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAIA,IAAI,CAACC,IAAI,CAAC,CAAC,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;QACrE,OAAO;UAAEL,IAAI,EAAE,OAAO;UAAEG;QAAK,CAAC;MAChC;IACA;MACE,OAAO,IAAI;EACf;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASJ,QAAQA,CAACF,GAAY,EAAkC;EAC9D,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3B,IAAI;MACF,OAAOE,QAAQ,CAACO,IAAI,CAACC,KAAK,CAACV,GAAG,CAAY,CAAC;IAC7C,CAAC,CAAC,MAAM;MACN,OAAO,IAAI;IACb;EACF;EACA,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAIA,GAAG,KAAK,IAAI,IAAIW,KAAK,CAACC,OAAO,CAACZ,GAAG,CAAC,EAAE,OAAO,IAAI;EAC9E,OAAOA,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASK,UAAUA,CAACD,GAAW,EAAW;EACxC,MAAMS,KAAK,GAAG,IAAAC,uBAAa,EAACV,GAAG,CAAC;EAChC,OAAOS,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACE,MAAM,KAAK,OAAO,IAAIF,KAAK,CAACG,IAAI,CAACR,MAAM,GAAG,CAAC;AAC5E","ignoreList":[]}
+{"version":3,"names":["_urlParts","require","parseHostedBridgeMessage","raw","message","asRecord","type","url","isHttpsUrl","code","trim","length","JSON","parse","Array","isArray","parts","parseUrlParts","scheme","host"],"sourceRoot":"../../../../src","sources":["internal/hosted/bridge-message.ts"],"mappings":";;;;;;AAAA,IAAAA,SAAA,GAAAC,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AAKA;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,wBAAwBA,CAACC,GAAY,EAA8B;EACjF,MAAMC,OAAO,GAAGC,QAAQ,CAACF,GAAG,CAAC;EAC7B,IAAI,CAACC,OAAO,EAAE,OAAO,IAAI;EAEzB,MAAME,IAAI,GAAGF,OAAO,CAACE,IAAI;EACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;EAEzC,QAAQA,IAAI;IACV,KAAK,aAAa;MAChB,OAAO;QAAEA,IAAI,EAAE;MAAQ,CAAC;IAC1B,KAAK,gBAAgB;MAAE;QACrB,MAAMC,GAAG,GAAGH,OAAO,CAACG,GAAG;QACvB,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAI,CAACC,UAAU,CAACD,GAAG,CAAC,EAAE,OAAO,IAAI;QAC5D,OAAO;UAAED,IAAI,EAAE,SAAS;UAAEC;QAAI,CAAC;MACjC;IACA,KAAK,cAAc;MACjB,OAAO;QAAED,IAAI,EAAE;MAAS,CAAC;IAC3B,KAAK,yBAAyB;MAC5B,OAAO;QAAEA,IAAI,EAAE;MAAmB,CAAC;IACrC,KAAK,aAAa;MAAE;QAClB,MAAMG,IAAI,GAAGL,OAAO,CAACK,IAAI;QACzB,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAIA,IAAI,CAACC,IAAI,CAAC,CAAC,CAACC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;QACrE,OAAO;UAAEL,IAAI,EAAE,OAAO;UAAEG;QAAK,CAAC;MAChC;IACA;MACE,OAAO,IAAI;EACf;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASJ,QAAQA,CAACF,GAAY,EAAkC;EAC9D,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC3B,IAAI;MACF,OAAOE,QAAQ,CAACO,IAAI,CAACC,KAAK,CAACV,GAAG,CAAY,CAAC;IAC7C,CAAC,CAAC,MAAM;MACN,OAAO,IAAI;IACb;EACF;EACA,IAAI,OAAOA,GAAG,KAAK,QAAQ,IAAIA,GAAG,KAAK,IAAI,IAAIW,KAAK,CAACC,OAAO,CAACZ,GAAG,CAAC,EAAE,OAAO,IAAI;EAC9E,OAAOA,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASK,UAAUA,CAACD,GAAW,EAAW;EACxC,MAAMS,KAAK,GAAG,IAAAC,uBAAa,EAACV,GAAG,CAAC;EAChC,OAAOS,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACE,MAAM,KAAK,OAAO,IAAIF,KAAK,CAACG,IAAI,CAACR,MAAM,GAAG,CAAC;AAC5E","ignoreList":[]}

package/lib/commonjs/internal/telemetry/native-telemetry-reply.js

@@ -0,0 +1,59 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.NATIVE_TELEMETRY_CALLBACK_NAME = void 0;
+exports.buildNativeTelemetryReplyScript = buildNativeTelemetryReplyScript;
+exports.createTelemetryRequestHandler = createTelemetryRequestHandler;
+/**
+ * Delivers a telemetry reply into the hosted page.
+ *
+ * The WebView message channel is one-way, so the reply travels the other way:
+ * the page exposes `window.__spareLinkNativeTelemetry` before it asks, and the
+ * shell answers by injecting a call to it. A page without the callback — an
+ * older page, or one that already gave up waiting — receives nothing and the
+ * injected chunk evaluates to a harmless literal.
+ */
+
+/** Page-exposed global the shell invokes with its telemetry reply. */
+const NATIVE_TELEMETRY_CALLBACK_NAME = exports.NATIVE_TELEMETRY_CALLBACK_NAME = '__spareLinkNativeTelemetry';
+
+/**
+ * Builds the script that hands [payload] to the page's telemetry callback.
+ *
+ * The payload is embedded as a JSON literal. U+2028 and U+2029 are legal inside
+ * a JSON string but terminate a statement when evaluated as script, so they are
+ * escaped; the result is a single expression that is inert on a page without
+ * the callback.
+ */
+function buildNativeTelemetryReplyScript(payload) {
+  const literal = JSON.stringify(payload).replaceAll('\u2028', '\\u2028').replaceAll('\u2029', '\\u2029');
+  return `window.${NATIVE_TELEMETRY_CALLBACK_NAME} && ` + `window.${NATIVE_TELEMETRY_CALLBACK_NAME}(${literal}); true;`;
+}
+
+/**
+ * Builds the handler the webview runs when the page asks for telemetry.
+ *
+ * Collection and injection are injected so the handler is a pure seam: the
+ * component wires the real collector and the WebView reference into it. A
+ * collector that answers nothing, or throws, injects nothing — the page's own
+ * timeout settles the request.
+ */
+function createTelemetryRequestHandler(deps) {
+  return async () => {
+    let payload;
+    try {
+      payload = await deps.collect();
+    } catch {
+      payload = null;
+    }
+    if (payload == null) return;
+    try {
+      deps.inject(buildNativeTelemetryReplyScript(payload));
+    } catch {
+      // A torn-down webview cannot be injected into; the page's timeout answers.
+    }
+  };
+}
+//# sourceMappingURL=native-telemetry-reply.js.map

package/lib/commonjs/internal/telemetry/native-telemetry-reply.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["NATIVE_TELEMETRY_CALLBACK_NAME","exports","buildNativeTelemetryReplyScript","payload","literal","JSON","stringify","replaceAll","createTelemetryRequestHandler","deps","collect","inject"],"sourceRoot":"../../../../src","sources":["internal/telemetry/native-telemetry-reply.ts"],"mappings":";;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACO,MAAMA,8BAA8B,GAAAC,OAAA,CAAAD,8BAAA,GAAG,4BAA4B;;AAE1E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,+BAA+BA,CAACC,OAAgC,EAAU;EACxF,MAAMC,OAAO,GAAGC,IAAI,CAACC,SAAS,CAACH,OAAO,CAAC,CACpCI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC/BA,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;EAClC,OACE,UAAUP,8BAA8B,MAAM,GAC9C,UAAUA,8BAA8B,IAAII,OAAO,UAAU;AAEjE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,6BAA6BA,CAACC,IAG7C,EAAuB;EACtB,OAAO,YAAY;IACjB,IAAIN,OAAuC;IAC3C,IAAI;MACFA,OAAO,GAAG,MAAMM,IAAI,CAACC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,MAAM;MACNP,OAAO,GAAG,IAAI;IAChB;IACA,IAAIA,OAAO,IAAI,IAAI,EAAE;IAErB,IAAI;MACFM,IAAI,CAACE,MAAM,CAACT,+BAA+B,CAACC,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/internal/telemetry/risk-telemetry-collector.js

@@ -0,0 +1,99 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.TELEMETRY_PROBE_BUDGET_MS = void 0;
+exports.collectRiskTelemetry = collectRiskTelemetry;
+/**
+ * Collects this device's native risk facts for the hosted payment page.
+ *
+ * Every probe is injected, so the collector runs under Jest with fakes and the
+ * module wiring lives in `risk-telemetry-probes`. Every probe is also allowed to
+ * fail or hang: a throwing or slow reading leaves its fact absent, because a risk
+ * reading must never delay or break a payment.
+ *
+ * The payload mirrors the page's own risk contract: camelCase keys under a
+ * `deviceInformation` block, facts only, nothing fabricated.
+ */
+
+/** How long any single probe may take before its fact is given up on. */
+const TELEMETRY_PROBE_BUDGET_MS = exports.TELEMETRY_PROBE_BUDGET_MS = 800;
+
+/** Identity and build facts read from the platform. */
+
+/** A battery reading, with the level as a 0 to 1 fraction. */
+
+/** The network medium classes the risk payload distinguishes. */
+
+/** The probes the collector runs. Each may answer null, throw, or hang. */
+
+const CONNECTION_LABELS = {
+  wifi: 'WiFi',
+  cellular: 'Cellular',
+  other: 'Other'
+};
+
+/** Runs a probe under the budget, yielding null on failure or timeout. */
+async function guarded(probe) {
+  try {
+    return await Promise.race([probe(), new Promise(resolve => setTimeout(() => resolve(null), TELEMETRY_PROBE_BUDGET_MS))]);
+  } catch {
+    return null;
+  }
+}
+function read(reader) {
+  try {
+    return reader();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Collects whatever the device answered within the per-probe budget.
+ *
+ * Returns null when nothing answered, so a caller hands the page nothing rather
+ * than an empty block.
+ */
+async function collectRiskTelemetry(probes) {
+  const [snapshot, battery, connection] = await Promise.all([guarded(probes.loadDeviceSnapshot), guarded(probes.loadBattery), guarded(probes.loadConnection)]);
+  const localeTag = read(probes.localeTag);
+  const localDateTime = read(probes.localDateTime);
+  const deviceInformation = {};
+  if (snapshot?.operatingSystem != null) {
+    deviceInformation.deviceOperatingSystem = snapshot.operatingSystem;
+  }
+  if (snapshot?.operatingSystemVersion != null) {
+    deviceInformation.deviceOperatingSystemVersion = snapshot.operatingSystemVersion;
+  }
+  const manufacturer = {};
+  if (snapshot?.model != null) manufacturer.model = snapshot.model;
+  if (snapshot?.manufacturer != null) manufacturer.manufacturer = snapshot.manufacturer;
+  if (Object.keys(manufacturer).length > 0) {
+    deviceInformation.deviceManufacturer = manufacturer;
+  }
+  if (snapshot?.vendorIdentifier != null) {
+    deviceInformation.alternativeDeviceId = snapshot.vendorIdentifier;
+  }
+  if (localeTag != null) deviceInformation.deviceLanguage = localeTag;
+  if (localDateTime != null) deviceInformation.deviceLocalDateTime = localDateTime;
+  if (connection != null) deviceInformation.connectionType = CONNECTION_LABELS[connection];
+  const batteryStatus = {};
+  const level = battery?.levelFraction;
+  if (level != null && level >= 0 && level <= 1) batteryStatus.level = level;
+  if (battery?.isCharging != null) batteryStatus.isCharging = battery.isCharging;
+  if (Object.keys(batteryStatus).length > 0) {
+    deviceInformation.batteryStatus = batteryStatus;
+  }
+  const environmentContext = [];
+  if (snapshot?.isPhysicalDevice === false) environmentContext.push('EmulatorDetected');
+  if (environmentContext.length > 0) {
+    deviceInformation.deviceEnvironmentContext = environmentContext;
+  }
+  if (Object.keys(deviceInformation).length === 0) return null;
+  return {
+    deviceInformation
+  };
+}
+//# sourceMappingURL=risk-telemetry-collector.js.map

package/lib/commonjs/internal/telemetry/risk-telemetry-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["TELEMETRY_PROBE_BUDGET_MS","exports","CONNECTION_LABELS","wifi","cellular","other","guarded","probe","Promise","race","resolve","setTimeout","read","reader","collectRiskTelemetry","probes","snapshot","battery","connection","all","loadDeviceSnapshot","loadBattery","loadConnection","localeTag","localDateTime","deviceInformation","operatingSystem","deviceOperatingSystem","operatingSystemVersion","deviceOperatingSystemVersion","manufacturer","model","Object","keys","length","deviceManufacturer","vendorIdentifier","alternativeDeviceId","deviceLanguage","deviceLocalDateTime","connectionType","batteryStatus","level","levelFraction","isCharging","environmentContext","isPhysicalDevice","push","deviceEnvironmentContext"],"sourceRoot":"../../../../src","sources":["internal/telemetry/risk-telemetry-collector.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACO,MAAMA,yBAAyB,GAAAC,OAAA,CAAAD,yBAAA,GAAG,GAAG;;AAE5C;;AAYA;;AAMA;;AAGA;;AASA,MAAME,iBAAqD,GAAG;EAC5DC,IAAI,EAAE,MAAM;EACZC,QAAQ,EAAE,UAAU;EACpBC,KAAK,EAAE;AACT,CAAC;;AAED;AACA,eAAeC,OAAOA,CAAIC,KAA8B,EAAqB;EAC3E,IAAI;IACF,OAAO,MAAMC,OAAO,CAACC,IAAI,CAAW,CAClCF,KAAK,CAAC,CAAC,EACP,IAAIC,OAAO,CAAQE,OAAO,IAAKC,UAAU,CAAC,MAAMD,OAAO,CAAC,IAAI,CAAC,EAAEV,yBAAyB,CAAC,CAAC,CAC3F,CAAC;EACJ,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;AAEA,SAASY,IAAIA,CAAIC,MAAsB,EAAY;EACjD,IAAI;IACF,OAAOA,MAAM,CAAC,CAAC;EACjB,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,oBAAoBA,CACxCC,MAA2B,EACc;EACzC,MAAM,CAACC,QAAQ,EAAEC,OAAO,EAAEC,UAAU,CAAC,GAAG,MAAMV,OAAO,CAACW,GAAG,CAAC,CACxDb,OAAO,CAACS,MAAM,CAACK,kBAAkB,CAAC,EAClCd,OAAO,CAACS,MAAM,CAACM,WAAW,CAAC,EAC3Bf,OAAO,CAACS,MAAM,CAACO,cAAc,CAAC,CAC/B,CAAC;EACF,MAAMC,SAAS,GAAGX,IAAI,CAACG,MAAM,CAACQ,SAAS,CAAC;EACxC,MAAMC,aAAa,GAAGZ,IAAI,CAACG,MAAM,CAACS,aAAa,CAAC;EAEhD,MAAMC,iBAA0C,GAAG,CAAC,CAAC;EAErD,IAAIT,QAAQ,EAAEU,eAAe,IAAI,IAAI,EAAE;IACrCD,iBAAiB,CAACE,qBAAqB,GAAGX,QAAQ,CAACU,eAAe;EACpE;EACA,IAAIV,QAAQ,EAAEY,sBAAsB,IAAI,IAAI,EAAE;IAC5CH,iBAAiB,CAACI,4BAA4B,GAAGb,QAAQ,CAACY,sBAAsB;EAClF;EAEA,MAAME,YAAqC,GAAG,CAAC,CAAC;EAChD,IAAId,QAAQ,EAAEe,KAAK,IAAI,IAAI,EAAED,YAAY,CAACC,KAAK,GAAGf,QAAQ,CAACe,KAAK;EAChE,IAAIf,QAAQ,EAAEc,YAAY,IAAI,IAAI,EAAEA,YAAY,CAACA,YAAY,GAAGd,QAAQ,CAACc,YAAY;EACrF,IAAIE,MAAM,CAACC,IAAI,CAACH,YAAY,CAAC,CAACI,MAAM,GAAG,CAAC,EAAE;IACxCT,iBAAiB,CAACU,kBAAkB,GAAGL,YAAY;EACrD;EAEA,IAAId,QAAQ,EAAEoB,gBAAgB,IAAI,IAAI,EAAE;IACtCX,iBAAiB,CAACY,mBAAmB,GAAGrB,QAAQ,CAACoB,gBAAgB;EACnE;EACA,IAAIb,SAAS,IAAI,IAAI,EAAEE,iBAAiB,CAACa,cAAc,GAAGf,SAAS;EACnE,IAAIC,aAAa,IAAI,IAAI,EAAEC,iBAAiB,CAACc,mBAAmB,GAAGf,aAAa;EAChF,IAAIN,UAAU,IAAI,IAAI,EAAEO,iBAAiB,CAACe,cAAc,GAAGtC,iBAAiB,CAACgB,UAAU,CAAC;EAExF,MAAMuB,aAAsC,GAAG,CAAC,CAAC;EACjD,MAAMC,KAAK,GAAGzB,OAAO,EAAE0B,aAAa;EACpC,IAAID,KAAK,IAAI,IAAI,IAAIA,KAAK,IAAI,CAAC,IAAIA,KAAK,IAAI,CAAC,EAAED,aAAa,CAACC,KAAK,GAAGA,KAAK;EAC1E,IAAIzB,OAAO,EAAE2B,UAAU,IAAI,IAAI,EAAEH,aAAa,CAACG,UAAU,GAAG3B,OAAO,CAAC2B,UAAU;EAC9E,IAAIZ,MAAM,CAACC,IAAI,CAACQ,aAAa,CAAC,CAACP,MAAM,GAAG,CAAC,EAAE;IACzCT,iBAAiB,CAACgB,aAAa,GAAGA,aAAa;EACjD;EAEA,MAAMI,kBAA4B,GAAG,EAAE;EACvC,IAAI7B,QAAQ,EAAE8B,gBAAgB,KAAK,KAAK,EAAED,kBAAkB,CAACE,IAAI,CAAC,kBAAkB,CAAC;EACrF,IAAIF,kBAAkB,CAACX,MAAM,GAAG,CAAC,EAAE;IACjCT,iBAAiB,CAACuB,wBAAwB,GAAGH,kBAAkB;EACjE;EAEA,IAAIb,MAAM,CAACC,IAAI,CAACR,iBAAiB,CAAC,CAACS,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;EAC5D,OAAO;IAAET;EAAkB,CAAC;AAC9B","ignoreList":[]}

package/lib/commonjs/internal/telemetry/risk-telemetry-probes.js

@@ -0,0 +1,134 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createRiskTelemetryProbes = createRiskTelemetryProbes;
+exports.formatLocalIsoWithOffset = formatLocalIsoWithOffset;
+var _reactNative = require("react-native");
+/**
+ * The real device probes behind `collectRiskTelemetry`.
+ *
+ * Every expo module here is an optional peer, loaded lazily inside a try/catch:
+ * a host app that ships without one simply reports that fact as absent, and no
+ * import of this file can throw for want of a native module. Structural `*Like`
+ * types keep this file honest about how little of each module it relies on.
+ */
+
+function load(moduleName) {
+  try {
+    // Resolved at call time so a host app without the optional peer never pays
+    // for it — bundlers keep the require because the name is static.
+    switch (moduleName) {
+      case 'expo-device':
+        return require('expo-device');
+      case 'expo-battery':
+        return require('expo-battery');
+      case 'expo-network':
+        return require('expo-network');
+      case 'expo-application':
+        return require('expo-application');
+      default:
+        return null;
+    }
+  } catch {
+    return null;
+  }
+}
+async function loadDeviceSnapshot() {
+  const device = load('expo-device');
+  if (device == null) return null;
+
+  // The vendor identifier is iOS-only by design: Android offers no equivalent
+  // scoped identifier worth persisting against a payment.
+  let vendorIdentifier = null;
+  if (_reactNative.Platform.OS === 'ios') {
+    const application = load('expo-application');
+    if (application != null) {
+      try {
+        vendorIdentifier = await application.getIosIdForVendorAsync();
+      } catch {
+        vendorIdentifier = null;
+      }
+    }
+  }
+  return {
+    operatingSystem: _reactNative.Platform.OS === 'ios' ? 'iOS' : 'Android',
+    operatingSystemVersion: device.osVersion ?? null,
+    model: device.modelName ?? null,
+    manufacturer: device.manufacturer ?? null,
+    vendorIdentifier,
+    isPhysicalDevice: typeof device.isDevice === 'boolean' ? device.isDevice : null
+  };
+}
+async function loadBattery() {
+  const battery = load('expo-battery');
+  if (battery == null) return null;
+  const level = await battery.getBatteryLevelAsync();
+  const state = await battery.getBatteryStateAsync();
+  const charging = battery.BatteryState?.CHARGING;
+  const full = battery.BatteryState?.FULL;
+  return {
+    // The module reports -1 when the level cannot be read; the collector's 0..1
+    // bound would drop it anyway, made explicit here.
+    levelFraction: level >= 0 && level <= 1 ? level : null,
+    isCharging: charging != null ? state === charging || state === full : null
+  };
+}
+async function loadConnection() {
+  const network = load('expo-network');
+  if (network == null) return null;
+  const state = await network.getNetworkStateAsync();
+  const type = state.type?.toUpperCase() ?? null;
+  if (type == null || type === 'NONE' || type === 'UNKNOWN') return null;
+  if (type === 'WIFI') return 'wifi';
+  if (type === 'CELLULAR') return 'cellular';
+  return 'other';
+}
+function localeTag() {
+  try {
+    const tag = Intl.DateTimeFormat().resolvedOptions().locale;
+    return typeof tag === 'string' && tag.length > 0 ? tag : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Formats a date as local-time ISO 8601 with a numeric UTC offset, e.g.
+ * `2026-08-25T10:45:46.319+05:30` — never the UTC `Z` form. This keeps the
+ * timestamp on the payer's own clock so it reads the same as the device shows,
+ * and matches the Flutter SDK's `deviceLocalDateTime`.
+ */
+function formatLocalIsoWithOffset(date) {
+  const pad = (value, width = 2) => String(value).padStart(width, '0');
+
+  // getTimezoneOffset is minutes behind UTC, so east-of-UTC zones are negative;
+  // flip the sign to render the conventional offset.
+  const offsetMinutes = -date.getTimezoneOffset();
+  const sign = offsetMinutes >= 0 ? '+' : '-';
+  const absOffset = Math.abs(offsetMinutes);
+  const localDate = `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`;
+  const localTime = `${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}.${pad(date.getMilliseconds(), 3)}`;
+  const offset = `${sign}${pad(Math.floor(absOffset / 60))}:${pad(absOffset % 60)}`;
+  return `${localDate}T${localTime}${offset}`;
+}
+function localDateTime() {
+  try {
+    return formatLocalIsoWithOffset(new Date());
+  } catch {
+    return null;
+  }
+}
+
+/** The production probe set, ready for `collectRiskTelemetry`. */
+function createRiskTelemetryProbes() {
+  return {
+    loadDeviceSnapshot,
+    loadBattery,
+    loadConnection,
+    localeTag,
+    localDateTime
+  };
+}
+//# sourceMappingURL=risk-telemetry-probes.js.map

package/lib/commonjs/internal/telemetry/risk-telemetry-probes.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_reactNative","require","load","moduleName","loadDeviceSnapshot","device","vendorIdentifier","Platform","OS","application","getIosIdForVendorAsync","operatingSystem","operatingSystemVersion","osVersion","model","modelName","manufacturer","isPhysicalDevice","isDevice","loadBattery","battery","level","getBatteryLevelAsync","state","getBatteryStateAsync","charging","BatteryState","CHARGING","full","FULL","levelFraction","isCharging","loadConnection","network","getNetworkStateAsync","type","toUpperCase","localeTag","tag","Intl","DateTimeFormat","resolvedOptions","locale","length","formatLocalIsoWithOffset","date","pad","value","width","String","padStart","offsetMinutes","getTimezoneOffset","sign","absOffset","Math","abs","localDate","getFullYear","getMonth","getDate","localTime","getHours","getMinutes","getSeconds","getMilliseconds","offset","floor","localDateTime","Date","createRiskTelemetryProbes"],"sourceRoot":"../../../../src","sources":["internal/telemetry/risk-telemetry-probes.ts"],"mappings":";;;;;;;AASA,IAAAA,YAAA,GAAAC,OAAA;AATA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA+BA,SAASC,IAAIA,CAAIC,UAAkB,EAAY;EAC7C,IAAI;IACF;IACA;IACA,QAAQA,UAAU;MAChB,KAAK,aAAa;QAChB,OAAOF,OAAO,CAAC,aAAa,CAAC;MAC/B,KAAK,cAAc;QACjB,OAAOA,OAAO,CAAC,cAAc,CAAC;MAChC,KAAK,cAAc;QACjB,OAAOA,OAAO,CAAC,cAAc,CAAC;MAChC,KAAK,kBAAkB;QACrB,OAAOA,OAAO,CAAC,kBAAkB,CAAC;MACpC;QACE,OAAO,IAAI;IACf;EACF,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;AAEA,eAAeG,kBAAkBA,CAAA,EAAuC;EACtE,MAAMC,MAAM,GAAGH,IAAI,CAAmB,aAAa,CAAC;EACpD,IAAIG,MAAM,IAAI,IAAI,EAAE,OAAO,IAAI;;EAE/B;EACA;EACA,IAAIC,gBAA+B,GAAG,IAAI;EAC1C,IAAIC,qBAAQ,CAACC,EAAE,KAAK,KAAK,EAAE;IACzB,MAAMC,WAAW,GAAGP,IAAI,CAAwB,kBAAkB,CAAC;IACnE,IAAIO,WAAW,IAAI,IAAI,EAAE;MACvB,IAAI;QACFH,gBAAgB,GAAG,MAAMG,WAAW,CAACC,sBAAsB,CAAC,CAAC;MAC/D,CAAC,CAAC,MAAM;QACNJ,gBAAgB,GAAG,IAAI;MACzB;IACF;EACF;EAEA,OAAO;IACLK,eAAe,EAAEJ,qBAAQ,CAACC,EAAE,KAAK,KAAK,GAAG,KAAK,GAAG,SAAS;IAC1DI,sBAAsB,EAAEP,MAAM,CAACQ,SAAS,IAAI,IAAI;IAChDC,KAAK,EAAET,MAAM,CAACU,SAAS,IAAI,IAAI;IAC/BC,YAAY,EAAEX,MAAM,CAACW,YAAY,IAAI,IAAI;IACzCV,gBAAgB;IAChBW,gBAAgB,EAAE,OAAOZ,MAAM,CAACa,QAAQ,KAAK,SAAS,GAAGb,MAAM,CAACa,QAAQ,GAAG;EAC7E,CAAC;AACH;AAEA,eAAeC,WAAWA,CAAA,EAAuC;EAC/D,MAAMC,OAAO,GAAGlB,IAAI,CAAoB,cAAc,CAAC;EACvD,IAAIkB,OAAO,IAAI,IAAI,EAAE,OAAO,IAAI;EAEhC,MAAMC,KAAK,GAAG,MAAMD,OAAO,CAACE,oBAAoB,CAAC,CAAC;EAClD,MAAMC,KAAK,GAAG,MAAMH,OAAO,CAACI,oBAAoB,CAAC,CAAC;EAClD,MAAMC,QAAQ,GAAGL,OAAO,CAACM,YAAY,EAAEC,QAAQ;EAC/C,MAAMC,IAAI,GAAGR,OAAO,CAACM,YAAY,EAAEG,IAAI;EAEvC,OAAO;IACL;IACA;IACAC,aAAa,EAAET,KAAK,IAAI,CAAC,IAAIA,KAAK,IAAI,CAAC,GAAGA,KAAK,GAAG,IAAI;IACtDU,UAAU,EAAEN,QAAQ,IAAI,IAAI,GAAGF,KAAK,KAAKE,QAAQ,IAAIF,KAAK,KAAKK,IAAI,GAAG;EACxE,CAAC;AACH;AAEA,eAAeI,cAAcA,CAAA,EAAuC;EAClE,MAAMC,OAAO,GAAG/B,IAAI,CAAoB,cAAc,CAAC;EACvD,IAAI+B,OAAO,IAAI,IAAI,EAAE,OAAO,IAAI;EAEhC,MAAMV,KAAK,GAAG,MAAMU,OAAO,CAACC,oBAAoB,CAAC,CAAC;EAClD,MAAMC,IAAI,GAAGZ,KAAK,CAACY,IAAI,EAAEC,WAAW,CAAC,CAAC,IAAI,IAAI;EAC9C,IAAID,IAAI,IAAI,IAAI,IAAIA,IAAI,KAAK,MAAM,IAAIA,IAAI,KAAK,SAAS,EAAE,OAAO,IAAI;EACtE,IAAIA,IAAI,KAAK,MAAM,EAAE,OAAO,MAAM;EAClC,IAAIA,IAAI,KAAK,UAAU,EAAE,OAAO,UAAU;EAC1C,OAAO,OAAO;AAChB;AAEA,SAASE,SAASA,CAAA,EAAkB;EAClC,IAAI;IACF,MAAMC,GAAG,GAAGC,IAAI,CAACC,cAAc,CAAC,CAAC,CAACC,eAAe,CAAC,CAAC,CAACC,MAAM;IAC1D,OAAO,OAAOJ,GAAG,KAAK,QAAQ,IAAIA,GAAG,CAACK,MAAM,GAAG,CAAC,GAAGL,GAAG,GAAG,IAAI;EAC/D,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASM,wBAAwBA,CAACC,IAAU,EAAU;EAC3D,MAAMC,GAAG,GAAGA,CAACC,KAAa,EAAEC,KAAK,GAAG,CAAC,KAAaC,MAAM,CAACF,KAAK,CAAC,CAACG,QAAQ,CAACF,KAAK,EAAE,GAAG,CAAC;;EAEpF;EACA;EACA,MAAMG,aAAa,GAAG,CAACN,IAAI,CAACO,iBAAiB,CAAC,CAAC;EAC/C,MAAMC,IAAI,GAAGF,aAAa,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG;EAC3C,MAAMG,SAAS,GAAGC,IAAI,CAACC,GAAG,CAACL,aAAa,CAAC;EAEzC,MAAMM,SAAS,GAAG,GAAGZ,IAAI,CAACa,WAAW,CAAC,CAAC,IAAIZ,GAAG,CAACD,IAAI,CAACc,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAIb,GAAG,CAACD,IAAI,CAACe,OAAO,CAAC,CAAC,CAAC,EAAE;EAC5F,MAAMC,SAAS,GAAG,GAAGf,GAAG,CAACD,IAAI,CAACiB,QAAQ,CAAC,CAAC,CAAC,IAAIhB,GAAG,CAACD,IAAI,CAACkB,UAAU,CAAC,CAAC,CAAC,IAAIjB,GAAG,CAACD,IAAI,CAACmB,UAAU,CAAC,CAAC,CAAC,IAAIlB,GAAG,CAACD,IAAI,CAACoB,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;EACjI,MAAMC,MAAM,GAAG,GAAGb,IAAI,GAAGP,GAAG,CAACS,IAAI,CAACY,KAAK,CAACb,SAAS,GAAG,EAAE,CAAC,CAAC,IAAIR,GAAG,CAACQ,SAAS,GAAG,EAAE,CAAC,EAAE;EAEjF,OAAO,GAAGG,SAAS,IAAII,SAAS,GAAGK,MAAM,EAAE;AAC7C;AAEA,SAASE,aAAaA,CAAA,EAAkB;EACtC,IAAI;IACF,OAAOxB,wBAAwB,CAAC,IAAIyB,IAAI,CAAC,CAAC,CAAC;EAC7C,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACO,SAASC,yBAAyBA,CAAA,EAAwB;EAC/D,OAAO;IAAElE,kBAAkB;IAAEe,WAAW;IAAEa,cAAc;IAAEK,SAAS;IAAE+B;EAAc,CAAC;AACtF","ignoreList":[]}

package/lib/commonjs/ui/hosted/hosted-payment-page.js

@@ -7,6 +7,8 @@ exports.HostedPaymentPage = HostedPaymentPage;
 var _react = require("react");
 var _reactNative = require("react-native");
 var _hostedFlowState = require("../../core/services/hosted-flow-state.js");
+var _riskTelemetryCollector = require("../../internal/telemetry/risk-telemetry-collector.js");
+var _riskTelemetryProbes = require("../../internal/telemetry/risk-telemetry-probes.js");
 var _useHostedFlowState = require("../hooks/use-hosted-flow-state.js");
 var _pageUnavailableScreen = require("../screens/page-unavailable-screen.js");
 var _redirectHandoffScreen = require("../screens/redirect-handoff-screen.js");
@@ -64,6 +66,11 @@ function HostedPaymentPage(props) {
   const handleBridgeMessage = (0, _react.useCallback)(message => {
     void controller.handleBridgeMessage(message);
   }, [controller]);
+
+  // One probe set for the page's lifetime; collection itself runs per request.
+  const handleTelemetryRequest = (0, _react.useCallback)(() => {
+    return (0, _riskTelemetryCollector.collectRiskTelemetry)((0, _riskTelemetryProbes.createRiskTelemetryProbes)());
+  }, []);
   const handleLoadFailure = (0, _react.useCallback)(() => {
     controller.failToLoad();
   }, [controller]);
@@ -95,6 +102,7 @@ function HostedPaymentPage(props) {
             baseUrl: baseUrl,
             reference: controller.reference,
             onBridgeMessage: handleBridgeMessage,
+            onTelemetryRequest: handleTelemetryRequest,
             onLoadFailure: handleLoadFailure,
             onMounted: handlePageMounted
           }, state.attempt)

package/lib/commonjs/ui/hosted/hosted-payment-page.js.map

@@ -1 +1 @@
-{"version":3,"names":["_react","require","_reactNative","_hostedFlowState","_useHostedFlowState","_pageUnavailableScreen","_redirectHandoffScreen","_resultScreen","_resumeProcessingScreen","_index","_hostedPaymentWebview","_jsxRuntime","RESULT_DWELL_MS","HostedPaymentPage","props","controller","baseUrl","onResolved","state","useHostedFlowState","awaitingSinceMs","useRef","undefined","phase","current","Date","now","wasNeverReached","errorCode","resolved","isTerminalPhase","useEffect","timer","setTimeout","clearTimeout","handleBridgeMessage","useCallback","message","handleLoadFailure","failToLoad","handlePageMounted","reportPageMounted","handleRetry","retry","handleGiveUp","giveUp","jsxs","View","style","styles","fill","children","jsx","accessibilityElementsHidden","importantForAccessibility","HostedPaymentWebView","reference","onBridgeMessage","onLoadFailure","onMounted","attempt","loadingCover","testID","ActivityIndicator","size","color","Colors","spareBlue","Text","Typography","bodyMuted","loadingLabel","PageUnavailableScreen","onRetry","onCancel","RedirectHandoffScreen","ResumeProcessingScreen","awaitingCallbackStartedAtMs","abandon","ResultScreen","title","isSuccess","onDone","StyleSheet","create","flex","backgroundColor","surfacePage","absoluteFillObject","alignItems","justifyContent","gap","Spacing","lg","textAlign"],"sourceRoot":"../../../../src","sources":["ui/hosted/hosted-payment-page.tsx"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAEA,IAAAE,gBAAA,GAAAF,OAAA;AACA,IAAAG,mBAAA,GAAAH,OAAA;AACA,IAAAI,sBAAA,GAAAJ,OAAA;AACA,IAAAK,sBAAA,GAAAL,OAAA;AACA,IAAAM,aAAA,GAAAN,OAAA;AACA,IAAAO,uBAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,qBAAA,GAAAT,OAAA;AAAgE,IAAAU,WAAA,GAAAV,OAAA;AAEhE,8EACA,MAAMW,eAAe,GAAG,IAAI;AAU5B;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAACC,KAA6B,EAAe;EAC5E,MAAM;IAAEC,UAAU;IAAEC,OAAO;IAAEC;EAAW,CAAC,GAAGH,KAAK;EACjD,MAAMI,KAAK,GAAG,IAAAC,sCAAkB,EAACJ,UAAU,CAAC;;EAE5C;AACF;AACA;AACA;AACA;AACA;AACA;EACE,MAAMK,eAAe,GAAG,IAAAC,aAAM,EAAqBC,SAAS,CAAC;EAC7D,IAAIJ,KAAK,CAACK,KAAK,KAAK,kBAAkB,IAAIH,eAAe,CAACI,OAAO,KAAKF,SAAS,EAAE;IAC/EF,eAAe,CAACI,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;EACtC;;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMC,eAAe,GAAGT,KAAK,CAACU,SAAS,KAAK,kBAAkB;;EAE9D;EACA;EACA;EACA,MAAMC,QAAQ,GAAG,IAAAC,gCAAe,EAACZ,KAAK,CAACK,KAAK,CAAC;EAC7C,IAAAQ,gBAAS,EAAC,MAAM;IACd,IAAI,CAACF,QAAQ,EAAE;IACf,MAAMG,KAAK,GAAGC,UAAU,CAAChB,UAAU,EAAEU,eAAe,GAAG,CAAC,GAAGf,eAAe,CAAC;IAC3E,OAAO,MAAMsB,YAAY,CAACF,KAAK,CAAC;EAClC,CAAC,EAAE,CAACH,QAAQ,EAAEZ,UAAU,EAAEU,eAAe,CAAC,CAAC;EAE3C,MAAMQ,mBAAmB,GAAG,IAAAC,kBAAW,EACpCC,OAAgB,IAAK;IACpB,KAAKtB,UAAU,CAACoB,mBAAmB,CAACE,OAAO,CAAC;EAC9C,CAAC,EACD,CAACtB,UAAU,CACb,CAAC;EAED,MAAMuB,iBAAiB,GAAG,IAAAF,kBAAW,EAAC,MAAM;IAC1CrB,UAAU,CAACwB,UAAU,CAAC,CAAC;EACzB,CAAC,EAAE,CAACxB,UAAU,CAAC,CAAC;EAEhB,MAAMyB,iBAAiB,GAAG,IAAAJ,kBAAW,EAAC,MAAM;IAC1CrB,UAAU,CAAC0B,iBAAiB,CAAC,CAAC;EAChC,CAAC,EAAE,CAAC1B,UAAU,CAAC,CAAC;EAEhB,MAAM2B,WAAW,GAAG,IAAAN,kBAAW,EAAC,MAAM;IACpCrB,UAAU,CAAC4B,KAAK,CAAC,CAAC;EACpB,CAAC,EAAE,CAAC5B,UAAU,CAAC,CAAC;EAEhB,MAAM6B,YAAY,GAAG,IAAAR,kBAAW,EAAC,MAAM;IACrCrB,UAAU,CAAC8B,MAAM,CAAC,CAAC;EACrB,CAAC,EAAE,CAAC9B,UAAU,CAAC,CAAC;EAEhB,QAAQG,KAAK,CAACK,KAAK;IACjB,KAAK,SAAS;IACd,KAAK,QAAQ;MACX,oBACE,IAAAZ,WAAA,CAAAmC,IAAA,EAAC5C,YAAA,CAAA6C,IAAI;QAACC,KAAK,EAAEC,MAAM,CAACC,IAAK;QAAAC,QAAA,gBACvB,IAAAxC,WAAA,CAAAyC,GAAA,EAAClD,YAAA,CAAA6C,IAAI;UACHC,KAAK,EAAEC,MAAM,CAACC;UACd;UACA;UAAA;UACAG,2BAA2B,EAAEnC,KAAK,CAACK,KAAK,KAAK,SAAU;UACvD+B,yBAAyB,EAAEpC,KAAK,CAACK,KAAK,KAAK,SAAS,GAAG,qBAAqB,GAAG,MAAO;UAAA4B,QAAA,eAEtF,IAAAxC,WAAA,CAAAyC,GAAA,EAAC1C,qBAAA,CAAA6C;UACC;UACA;UAAA;YAEAvC,OAAO,EAAEA,OAAQ;YACjBwC,SAAS,EAAEzC,UAAU,CAACyC,SAAU;YAChCC,eAAe,EAAEtB,mBAAoB;YACrCuB,aAAa,EAAEpB,iBAAkB;YACjCqB,SAAS,EAAEnB;UAAkB,GALxBtB,KAAK,CAAC0C,OAMZ;QAAC,CACE,CAAC,EAMN1C,KAAK,CAACK,KAAK,KAAK,SAAS,gBACxB,IAAAZ,WAAA,CAAAmC,IAAA,EAAC5C,YAAA,CAAA6C,IAAI;UAACC,KAAK,EAAEC,MAAM,CAACY,YAAa;UAACC,MAAM,EAAC,wBAAwB;UAAAX,QAAA,gBAM/D,IAAAxC,WAAA,CAAAyC,GAAA,EAAClD,YAAA,CAAA6D,iBAAiB;YAChBC,IAAI,EAAC,OAAO;YACZC,KAAK,EAAEC,aAAM,CAACC,SAAU;YACxBL,MAAM,EAAC;UAAgC,CACxC,CAAC,eACF,IAAAnD,WAAA,CAAAyC,GAAA,EAAClD,YAAA,CAAAkE,IAAI;YAACpB,KAAK,EAAE,CAACqB,iBAAU,CAACC,SAAS,EAAErB,MAAM,CAACsB,YAAY,CAAE;YAAApB,QAAA,EACtDjC,KAAK,CAAC0C,OAAO,GAAG,CAAC,GAAG,eAAe,GAAG;UAAuB,CAC1D,CAAC;QAAA,CACH,CAAC,GACL,IAAI;MAAA,CACJ,CAAC;IAEX,KAAK,aAAa;MAChB,oBAAO,IAAAjD,WAAA,CAAAyC,GAAA,EAAC/C,sBAAA,CAAAmE,qBAAqB;QAACC,OAAO,EAAE/B,WAAY;QAACgC,QAAQ,EAAE9B;MAAa,CAAE,CAAC;IAChF,KAAK,aAAa;MAChB,oBAAO,IAAAjC,WAAA,CAAAyC,GAAA,EAAC9C,sBAAA,CAAAqE,qBAAqB,IAAE,CAAC;IAClC,KAAK,kBAAkB;MACrB,oBACE,IAAAhE,WAAA,CAAAyC,GAAA,EAAC5C,uBAAA,CAAAoE,sBAAsB;QAAA,IAChBxD,eAAe,CAACI,OAAO,KAAKF,SAAS,GACtC;UAAEuD,2BAA2B,EAAEzD,eAAe,CAACI;QAAQ,CAAC,GACxD,CAAC,CAAC;QACN;QACA;QACA;QACA;QACAkD,QAAQ,EAAEA,CAAA,KAAM3D,UAAU,CAAC+D,OAAO,CAAC;MAAE,CACtC,CAAC;IAEN,KAAK,WAAW;MACd,oBAAO,IAAAnE,WAAA,CAAAyC,GAAA,EAAC7C,aAAA,CAAAwE,YAAY;QAACC,KAAK,EAAC,kBAAkB;QAACC,SAAS;QAACC,MAAM,EAAEjE;MAAW,CAAE,CAAC;IAChF,KAAK,QAAQ;MACX,OAAOU,eAAe,gBACpB,IAAAhB,WAAA,CAAAyC,GAAA,EAAC/C,sBAAA,CAAAmE,qBAAqB;QAACC,OAAO,EAAE/B,WAAY;QAACgC,QAAQ,EAAE9B;MAAa,CAAE,CAAC,gBAEvE,IAAAjC,WAAA,CAAAyC,GAAA,EAAC7C,aAAA,CAAAwE,YAAY;QAACC,KAAK,EAAC,gBAAgB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAEjE;MAAW,CAAE,CAC7E;IACH,KAAK,WAAW;MACd,oBAAO,IAAAN,WAAA,CAAAyC,GAAA,EAAC7C,aAAA,CAAAwE,YAAY;QAACC,KAAK,EAAC,mBAAmB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAEjE;MAAW,CAAE,CAAC;IACzF,KAAK,WAAW;MACd,oBAAO,IAAAN,WAAA,CAAAyC,GAAA,EAAC7C,aAAA,CAAAwE,YAAY;QAACC,KAAK,EAAC,uBAAuB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAEjE;MAAW,CAAE,CAAC;EAC/F;AACF;AAEA,MAAMgC,MAAM,GAAGkC,uBAAU,CAACC,MAAM,CAAC;EAC/BlC,IAAI,EAAE;IAAEmC,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAEpB,aAAM,CAACqB;EAAY,CAAC;EACtD1B,YAAY,EAAE;IACZ,GAAGsB,uBAAU,CAACK,kBAAkB;IAChCC,UAAU,EAAE,QAAQ;IACpBC,cAAc,EAAE,QAAQ;IACxBC,GAAG,EAAEC,cAAO,CAACC,EAAE;IACfP,eAAe,EAAEpB,aAAM,CAACqB;EAC1B,CAAC;EACDhB,YAAY,EAAE;IAAEuB,SAAS,EAAE;EAAS;AACtC,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["_react","require","_reactNative","_hostedFlowState","_riskTelemetryCollector","_riskTelemetryProbes","_useHostedFlowState","_pageUnavailableScreen","_redirectHandoffScreen","_resultScreen","_resumeProcessingScreen","_index","_hostedPaymentWebview","_jsxRuntime","RESULT_DWELL_MS","HostedPaymentPage","props","controller","baseUrl","onResolved","state","useHostedFlowState","awaitingSinceMs","useRef","undefined","phase","current","Date","now","wasNeverReached","errorCode","resolved","isTerminalPhase","useEffect","timer","setTimeout","clearTimeout","handleBridgeMessage","useCallback","message","handleTelemetryRequest","collectRiskTelemetry","createRiskTelemetryProbes","handleLoadFailure","failToLoad","handlePageMounted","reportPageMounted","handleRetry","retry","handleGiveUp","giveUp","jsxs","View","style","styles","fill","children","jsx","accessibilityElementsHidden","importantForAccessibility","HostedPaymentWebView","reference","onBridgeMessage","onTelemetryRequest","onLoadFailure","onMounted","attempt","loadingCover","testID","ActivityIndicator","size","color","Colors","spareBlue","Text","Typography","bodyMuted","loadingLabel","PageUnavailableScreen","onRetry","onCancel","RedirectHandoffScreen","ResumeProcessingScreen","awaitingCallbackStartedAtMs","abandon","ResultScreen","title","isSuccess","onDone","StyleSheet","create","flex","backgroundColor","surfacePage","absoluteFillObject","alignItems","justifyContent","gap","Spacing","lg","textAlign"],"sourceRoot":"../../../../src","sources":["ui/hosted/hosted-payment-page.tsx"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAEA,IAAAE,gBAAA,GAAAF,OAAA;AACA,IAAAG,uBAAA,GAAAH,OAAA;AACA,IAAAI,oBAAA,GAAAJ,OAAA;AACA,IAAAK,mBAAA,GAAAL,OAAA;AACA,IAAAM,sBAAA,GAAAN,OAAA;AACA,IAAAO,sBAAA,GAAAP,OAAA;AACA,IAAAQ,aAAA,GAAAR,OAAA;AACA,IAAAS,uBAAA,GAAAT,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,qBAAA,GAAAX,OAAA;AAAgE,IAAAY,WAAA,GAAAZ,OAAA;AAEhE,8EACA,MAAMa,eAAe,GAAG,IAAI;AAU5B;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAACC,KAA6B,EAAe;EAC5E,MAAM;IAAEC,UAAU;IAAEC,OAAO;IAAEC;EAAW,CAAC,GAAGH,KAAK;EACjD,MAAMI,KAAK,GAAG,IAAAC,sCAAkB,EAACJ,UAAU,CAAC;;EAE5C;AACF;AACA;AACA;AACA;AACA;AACA;EACE,MAAMK,eAAe,GAAG,IAAAC,aAAM,EAAqBC,SAAS,CAAC;EAC7D,IAAIJ,KAAK,CAACK,KAAK,KAAK,kBAAkB,IAAIH,eAAe,CAACI,OAAO,KAAKF,SAAS,EAAE;IAC/EF,eAAe,CAACI,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;EACtC;;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMC,eAAe,GAAGT,KAAK,CAACU,SAAS,KAAK,kBAAkB;;EAE9D;EACA;EACA;EACA,MAAMC,QAAQ,GAAG,IAAAC,gCAAe,EAACZ,KAAK,CAACK,KAAK,CAAC;EAC7C,IAAAQ,gBAAS,EAAC,MAAM;IACd,IAAI,CAACF,QAAQ,EAAE;IACf,MAAMG,KAAK,GAAGC,UAAU,CAAChB,UAAU,EAAEU,eAAe,GAAG,CAAC,GAAGf,eAAe,CAAC;IAC3E,OAAO,MAAMsB,YAAY,CAACF,KAAK,CAAC;EAClC,CAAC,EAAE,CAACH,QAAQ,EAAEZ,UAAU,EAAEU,eAAe,CAAC,CAAC;EAE3C,MAAMQ,mBAAmB,GAAG,IAAAC,kBAAW,EACpCC,OAAgB,IAAK;IACpB,KAAKtB,UAAU,CAACoB,mBAAmB,CAACE,OAAO,CAAC;EAC9C,CAAC,EACD,CAACtB,UAAU,CACb,CAAC;;EAED;EACA,MAAMuB,sBAAsB,GAAG,IAAAF,kBAAW,EAAC,MAAM;IAC/C,OAAO,IAAAG,4CAAoB,EAAC,IAAAC,8CAAyB,EAAC,CAAC,CAAC;EAC1D,CAAC,EAAE,EAAE,CAAC;EAEN,MAAMC,iBAAiB,GAAG,IAAAL,kBAAW,EAAC,MAAM;IAC1CrB,UAAU,CAAC2B,UAAU,CAAC,CAAC;EACzB,CAAC,EAAE,CAAC3B,UAAU,CAAC,CAAC;EAEhB,MAAM4B,iBAAiB,GAAG,IAAAP,kBAAW,EAAC,MAAM;IAC1CrB,UAAU,CAAC6B,iBAAiB,CAAC,CAAC;EAChC,CAAC,EAAE,CAAC7B,UAAU,CAAC,CAAC;EAEhB,MAAM8B,WAAW,GAAG,IAAAT,kBAAW,EAAC,MAAM;IACpCrB,UAAU,CAAC+B,KAAK,CAAC,CAAC;EACpB,CAAC,EAAE,CAAC/B,UAAU,CAAC,CAAC;EAEhB,MAAMgC,YAAY,GAAG,IAAAX,kBAAW,EAAC,MAAM;IACrCrB,UAAU,CAACiC,MAAM,CAAC,CAAC;EACrB,CAAC,EAAE,CAACjC,UAAU,CAAC,CAAC;EAEhB,QAAQG,KAAK,CAACK,KAAK;IACjB,KAAK,SAAS;IACd,KAAK,QAAQ;MACX,oBACE,IAAAZ,WAAA,CAAAsC,IAAA,EAACjD,YAAA,CAAAkD,IAAI;QAACC,KAAK,EAAEC,MAAM,CAACC,IAAK;QAAAC,QAAA,gBACvB,IAAA3C,WAAA,CAAA4C,GAAA,EAACvD,YAAA,CAAAkD,IAAI;UACHC,KAAK,EAAEC,MAAM,CAACC;UACd;UACA;UAAA;UACAG,2BAA2B,EAAEtC,KAAK,CAACK,KAAK,KAAK,SAAU;UACvDkC,yBAAyB,EAAEvC,KAAK,CAACK,KAAK,KAAK,SAAS,GAAG,qBAAqB,GAAG,MAAO;UAAA+B,QAAA,eAEtF,IAAA3C,WAAA,CAAA4C,GAAA,EAAC7C,qBAAA,CAAAgD;UACC;UACA;UAAA;YAEA1C,OAAO,EAAEA,OAAQ;YACjB2C,SAAS,EAAE5C,UAAU,CAAC4C,SAAU;YAChCC,eAAe,EAAEzB,mBAAoB;YACrC0B,kBAAkB,EAAEvB,sBAAuB;YAC3CwB,aAAa,EAAErB,iBAAkB;YACjCsB,SAAS,EAAEpB;UAAkB,GANxBzB,KAAK,CAAC8C,OAOZ;QAAC,CACE,CAAC,EAMN9C,KAAK,CAACK,KAAK,KAAK,SAAS,gBACxB,IAAAZ,WAAA,CAAAsC,IAAA,EAACjD,YAAA,CAAAkD,IAAI;UAACC,KAAK,EAAEC,MAAM,CAACa,YAAa;UAACC,MAAM,EAAC,wBAAwB;UAAAZ,QAAA,gBAM/D,IAAA3C,WAAA,CAAA4C,GAAA,EAACvD,YAAA,CAAAmE,iBAAiB;YAChBC,IAAI,EAAC,OAAO;YACZC,KAAK,EAAEC,aAAM,CAACC,SAAU;YACxBL,MAAM,EAAC;UAAgC,CACxC,CAAC,eACF,IAAAvD,WAAA,CAAA4C,GAAA,EAACvD,YAAA,CAAAwE,IAAI;YAACrB,KAAK,EAAE,CAACsB,iBAAU,CAACC,SAAS,EAAEtB,MAAM,CAACuB,YAAY,CAAE;YAAArB,QAAA,EACtDpC,KAAK,CAAC8C,OAAO,GAAG,CAAC,GAAG,eAAe,GAAG;UAAuB,CAC1D,CAAC;QAAA,CACH,CAAC,GACL,IAAI;MAAA,CACJ,CAAC;IAEX,KAAK,aAAa;MAChB,oBAAO,IAAArD,WAAA,CAAA4C,GAAA,EAAClD,sBAAA,CAAAuE,qBAAqB;QAACC,OAAO,EAAEhC,WAAY;QAACiC,QAAQ,EAAE/B;MAAa,CAAE,CAAC;IAChF,KAAK,aAAa;MAChB,oBAAO,IAAApC,WAAA,CAAA4C,GAAA,EAACjD,sBAAA,CAAAyE,qBAAqB,IAAE,CAAC;IAClC,KAAK,kBAAkB;MACrB,oBACE,IAAApE,WAAA,CAAA4C,GAAA,EAAC/C,uBAAA,CAAAwE,sBAAsB;QAAA,IAChB5D,eAAe,CAACI,OAAO,KAAKF,SAAS,GACtC;UAAE2D,2BAA2B,EAAE7D,eAAe,CAACI;QAAQ,CAAC,GACxD,CAAC,CAAC;QACN;QACA;QACA;QACA;QACAsD,QAAQ,EAAEA,CAAA,KAAM/D,UAAU,CAACmE,OAAO,CAAC;MAAE,CACtC,CAAC;IAEN,KAAK,WAAW;MACd,oBAAO,IAAAvE,WAAA,CAAA4C,GAAA,EAAChD,aAAA,CAAA4E,YAAY;QAACC,KAAK,EAAC,kBAAkB;QAACC,SAAS;QAACC,MAAM,EAAErE;MAAW,CAAE,CAAC;IAChF,KAAK,QAAQ;MACX,OAAOU,eAAe,gBACpB,IAAAhB,WAAA,CAAA4C,GAAA,EAAClD,sBAAA,CAAAuE,qBAAqB;QAACC,OAAO,EAAEhC,WAAY;QAACiC,QAAQ,EAAE/B;MAAa,CAAE,CAAC,gBAEvE,IAAApC,WAAA,CAAA4C,GAAA,EAAChD,aAAA,CAAA4E,YAAY;QAACC,KAAK,EAAC,gBAAgB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAErE;MAAW,CAAE,CAC7E;IACH,KAAK,WAAW;MACd,oBAAO,IAAAN,WAAA,CAAA4C,GAAA,EAAChD,aAAA,CAAA4E,YAAY;QAACC,KAAK,EAAC,mBAAmB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAErE;MAAW,CAAE,CAAC;IACzF,KAAK,WAAW;MACd,oBAAO,IAAAN,WAAA,CAAA4C,GAAA,EAAChD,aAAA,CAAA4E,YAAY;QAACC,KAAK,EAAC,uBAAuB;QAACC,SAAS,EAAE,KAAM;QAACC,MAAM,EAAErE;MAAW,CAAE,CAAC;EAC/F;AACF;AAEA,MAAMmC,MAAM,GAAGmC,uBAAU,CAACC,MAAM,CAAC;EAC/BnC,IAAI,EAAE;IAAEoC,IAAI,EAAE,CAAC;IAAEC,eAAe,EAAEpB,aAAM,CAACqB;EAAY,CAAC;EACtD1B,YAAY,EAAE;IACZ,GAAGsB,uBAAU,CAACK,kBAAkB;IAChCC,UAAU,EAAE,QAAQ;IACpBC,cAAc,EAAE,QAAQ;IACxBC,GAAG,EAAEC,cAAO,CAACC,EAAE;IACfP,eAAe,EAAEpB,aAAM,CAACqB;EAC1B,CAAC;EACDhB,YAAY,EAAE;IAAEuB,SAAS,EAAE;EAAS;AACtC,CAAC,CAAC","ignoreList":[]}

package/lib/commonjs/ui/hosted/hosted-payment-webview.js

@@ -8,8 +8,10 @@ exports.shouldAllowHostedNavigation = shouldAllowHostedNavigation;
 var _react = require("react");
 var _reactNative = require("react-native");
 var _reactNativeWebview = require("react-native-webview");
+var _bridgeMessage = require("../../internal/hosted/bridge-message.js");
 var _hostedUrl = require("../../internal/hosted/hosted-url.js");
 var _logger = require("../../internal/logger.js");
+var _nativeTelemetryReply = require("../../internal/telemetry/native-telemetry-reply.js");
 var _urlParts = require("../../internal/url-parts.js");
 var _index = require("../theme/index.js");
 var _jsxRuntime = require("react/jsx-runtime");
@@ -52,6 +54,7 @@ function HostedPaymentWebView(props) {
     baseUrl,
     reference,
     onBridgeMessage,
+    onTelemetryRequest,
     onLoadFailure,
     onMounted
   } = props;
@@ -59,6 +62,7 @@ function HostedPaymentWebView(props) {
     baseUrl,
     reference
   });
+  const webViewRef = (0, _react.useRef)(null);
 
   // This reports that *this* webview exists, and a retry mounts a fresh instance
   // which reports itself anew. Re-running on a new callback identity would
@@ -68,8 +72,21 @@ function HostedPaymentWebView(props) {
     onMounted?.();
   }, []);
   const handleMessage = (0, _react.useCallback)(event => {
-    onBridgeMessage(event.nativeEvent.data);
-  }, [onBridgeMessage]);
+    const raw = event.nativeEvent.data;
+
+    // The telemetry request is answered here, where the webview reference
+    // lives, because the reply is delivered by injecting script — a channel
+    // only this component holds. Everything else stays the caller's.
+    if (onTelemetryRequest && (0, _bridgeMessage.parseHostedBridgeMessage)(raw)?.type === 'telemetryRequest') {
+      const respond = (0, _nativeTelemetryReply.createTelemetryRequestHandler)({
+        collect: onTelemetryRequest,
+        inject: script => webViewRef.current?.injectJavaScript(script)
+      });
+      void respond();
+      return;
+    }
+    onBridgeMessage(raw);
+  }, [onBridgeMessage, onTelemetryRequest]);
 
   // Every navigation is routed through here rather than through `originWhitelist`.
   // A URL that fails the whitelist is handed to `Linking.openURL` by
@@ -93,6 +110,7 @@ function HostedPaymentWebView(props) {
       style: styles.container,
       testID: "hosted-payment-webview",
       children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNativeWebview.WebView, {
+        ref: webViewRef,
         source: {
           uri
         },
@@ -138,6 +156,17 @@ function HostedPaymentWebView(props) {
         style: styles.webview,
         javaScriptEnabled: true,
         domStorageEnabled: true
+        // Lets the page's consent screen ask for a coarse location fix, which it
+        // attaches to the payment as a risk signal. Android only; iOS raises its
+        // own per-origin system prompt, gated by the host app's usage-description
+        // entry. This toggle is frame-wide — the platform offers no per-origin
+        // answer here — so the scope rests on `handleShouldStartLoad` above
+        // refusing every off-origin document in this frame. The toggle alone also
+        // reveals nothing: the host application must hold the user-facing location
+        // permission, and without it the page's request fails and the payment
+        // proceeds without the signal.
+        ,
+        geolocationEnabled: true
         // The page holds a payment in progress and nothing else should share its
         // storage, on this device or between payers on it.
         ,