@spare-technologies/spare-link 1.0.1 → 1.1.0

package/lib/typescript/commonjs/internal/hosted/bridge-message.d.ts

@@ -8,7 +8,7 @@
  * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
  * which arrives here as `event.nativeEvent.data`.
  */
-export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError;
+export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError | HostedTelemetryRequest;
 /** The payable page is interactive. */
 export interface HostedReady {
     readonly type: 'ready';
@@ -33,6 +33,17 @@ export interface HostedError {
     readonly type: 'error';
     readonly code: string;
 }
+/**
+ * The page is asking for this device's native risk facts.
+ *
+ * The one message that expects an answer — not over this channel, which cannot
+ * reply, but through the `window.__spareLinkNativeTelemetry` callback the page
+ * exposes and the shell invokes by injecting script. A shell that stays silent
+ * costs the page one bounded timeout and nothing else.
+ */
+export interface HostedTelemetryRequest {
+    readonly type: 'telemetryRequest';
+}
 /**
  * Parses a message posted by the hosted page.
  *

package/lib/typescript/commonjs/internal/hosted/bridge-message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,WAAW,CAAC;AAE3F,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAyBjF"}
+{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,aAAa,GACb,YAAY,GACZ,WAAW,GACX,sBAAsB,CAAC;AAE3B,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA2BjF"}

package/lib/typescript/commonjs/internal/telemetry/native-telemetry-reply.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Delivers a telemetry reply into the hosted page.
+ *
+ * The WebView message channel is one-way, so the reply travels the other way:
+ * the page exposes `window.__spareLinkNativeTelemetry` before it asks, and the
+ * shell answers by injecting a call to it. A page without the callback — an
+ * older page, or one that already gave up waiting — receives nothing and the
+ * injected chunk evaluates to a harmless literal.
+ */
+/** Page-exposed global the shell invokes with its telemetry reply. */
+export declare const NATIVE_TELEMETRY_CALLBACK_NAME = "__spareLinkNativeTelemetry";
+/**
+ * Builds the script that hands [payload] to the page's telemetry callback.
+ *
+ * The payload is embedded as a JSON literal. U+2028 and U+2029 are legal inside
+ * a JSON string but terminate a statement when evaluated as script, so they are
+ * escaped; the result is a single expression that is inert on a page without
+ * the callback.
+ */
+export declare function buildNativeTelemetryReplyScript(payload: Record<string, unknown>): string;
+/**
+ * Builds the handler the webview runs when the page asks for telemetry.
+ *
+ * Collection and injection are injected so the handler is a pure seam: the
+ * component wires the real collector and the WebView reference into it. A
+ * collector that answers nothing, or throws, injects nothing — the page's own
+ * timeout settles the request.
+ */
+export declare function createTelemetryRequestHandler(deps: {
+    collect: () => Promise<Record<string, unknown> | null>;
+    inject: (script: string) => void;
+}): () => Promise<void>;
+//# sourceMappingURL=native-telemetry-reply.d.ts.map

package/lib/typescript/commonjs/internal/telemetry/native-telemetry-reply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-telemetry-reply.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/native-telemetry-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQxF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAgBtB"}

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-collector.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Collects this device's native risk facts for the hosted payment page.
+ *
+ * Every probe is injected, so the collector runs under Jest with fakes and the
+ * module wiring lives in `risk-telemetry-probes`. Every probe is also allowed to
+ * fail or hang: a throwing or slow reading leaves its fact absent, because a risk
+ * reading must never delay or break a payment.
+ *
+ * The payload mirrors the page's own risk contract: camelCase keys under a
+ * `deviceInformation` block, facts only, nothing fabricated.
+ */
+/** How long any single probe may take before its fact is given up on. */
+export declare const TELEMETRY_PROBE_BUDGET_MS = 800;
+/** Identity and build facts read from the platform. */
+export interface RiskDeviceSnapshot {
+    readonly operatingSystem: string | null;
+    readonly operatingSystemVersion: string | null;
+    readonly model: string | null;
+    readonly manufacturer: string | null;
+    /** A per-vendor install-stable identifier, when the platform offers one. */
+    readonly vendorIdentifier: string | null;
+    /** False on simulators and emulators. */
+    readonly isPhysicalDevice: boolean | null;
+}
+/** A battery reading, with the level as a 0 to 1 fraction. */
+export interface RiskBatteryReading {
+    readonly levelFraction: number | null;
+    readonly isCharging: boolean | null;
+}
+/** The network medium classes the risk payload distinguishes. */
+export type RiskConnectionKind = 'wifi' | 'cellular' | 'other';
+/** The probes the collector runs. Each may answer null, throw, or hang. */
+export interface RiskTelemetryProbes {
+    loadDeviceSnapshot(): Promise<RiskDeviceSnapshot | null>;
+    loadBattery(): Promise<RiskBatteryReading | null>;
+    loadConnection(): Promise<RiskConnectionKind | null>;
+    localeTag(): string | null;
+    localDateTime(): string | null;
+}
+/**
+ * Collects whatever the device answered within the per-probe budget.
+ *
+ * Returns null when nothing answered, so a caller hands the page nothing rather
+ * than an empty block.
+ */
+export declare function collectRiskTelemetry(probes: RiskTelemetryProbes): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=risk-telemetry-collector.d.ts.map

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-collector.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yCAAyC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3C;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAClD,cAAc,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACrD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,IAAI,MAAM,GAAG,IAAI,CAAC;CAChC;AA4BD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAgDzC"}

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-probes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The real device probes behind `collectRiskTelemetry`.
+ *
+ * Every expo module here is an optional peer, loaded lazily inside a try/catch:
+ * a host app that ships without one simply reports that fact as absent, and no
+ * import of this file can throw for want of a native module. Structural `*Like`
+ * types keep this file honest about how little of each module it relies on.
+ */
+import type { RiskTelemetryProbes } from './risk-telemetry-collector';
+/**
+ * Formats a date as local-time ISO 8601 with a numeric UTC offset, e.g.
+ * `2026-08-25T10:45:46.319+05:30` — never the UTC `Z` form. This keeps the
+ * timestamp on the payer's own clock so it reads the same as the device shows,
+ * and matches the Flutter SDK's `deviceLocalDateTime`.
+ */
+export declare function formatLocalIsoWithOffset(date: Date): string;
+/** The production probe set, ready for `collectRiskTelemetry`. */
+export declare function createRiskTelemetryProbes(): RiskTelemetryProbes;
+//# sourceMappingURL=risk-telemetry-probes.d.ts.map

package/lib/typescript/commonjs/internal/telemetry/risk-telemetry-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-probes.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAIV,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AA8GpC;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAc3D;AAUD,kEAAkE;AAClE,wBAAgB,yBAAyB,IAAI,mBAAmB,CAE/D"}

package/lib/typescript/commonjs/ui/hosted/hosted-payment-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAavF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAuI5E"}
+{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAevF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CA6I5E"}

package/lib/typescript/commonjs/ui/hosted/hosted-payment-webview.d.ts

@@ -22,6 +22,15 @@ export interface HostedPaymentWebViewProps {
      * this component stays a transport.
      */
     onBridgeMessage: (message: unknown) => void;
+    /**
+     * Answers the page's telemetry request with this device's native risk facts.
+     *
+     * The reply travels back by injected script rather than a return value, so it
+     * is handled here where the webview reference lives, and the message never
+     * reaches [onBridgeMessage]. Absent, or answering null, means the page
+     * proceeds with what the browser alone can see.
+     */
+    onTelemetryRequest?: () => Promise<Record<string, unknown> | null>;
     /** Called when the page itself could not be loaded. */
     onLoadFailure?: () => void;
     /**

package/lib/typescript/commonjs/ui/hosted/hosted-payment-webview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAsBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CA4FlF"}
+{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CAuHlF"}

package/lib/typescript/commonjs/version.d.ts

@@ -6,5 +6,5 @@
  * `changeset version`). The src/index.ts smoke test asserts this matches
  * package.json's version.
  */
-export declare const SDK_VERSION: "1.0.1";
+export declare const SDK_VERSION: "1.1.0";
 //# sourceMappingURL=version.d.ts.map

package/lib/typescript/module/core/services/hosted-flow-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-flow-controller.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,eAAe,EAAqC,MAAM,wBAAqB,CAAC;AAI9F,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,UAAU,CAA4C;gBAElD,OAAO,EAAE,2BAA2B;IAQhD;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAKzB,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACG,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4CzD;;;;;OAKG;IACH,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAKvB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IA4CrC;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,IAAI;IA2BlB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAWb;;;;;OAKG;IACH,MAAM,IAAI,IAAI;IAed;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAmBf,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;OAOG;YACW,QAAQ;IAiCtB,OAAO,CAAC,MAAM;CAcf"}
+{"version":3,"file":"hosted-flow-controller.d.ts","sourceRoot":"","sources":["../../../../../src/core/services/hosted-flow-controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,eAAe,EAAqC,MAAM,wBAAqB,CAAC;AAI9F,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,UAAU,CAA4C;gBAElD,OAAO,EAAE,2BAA2B;IAQhD;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI;IAKzB,IAAI,KAAK,IAAI,eAAe,CAE3B;IAED,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACG,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiDzD;;;;;OAKG;IACH,+EAA+E;IAC/E,OAAO,CAAC,eAAe;IAKvB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IA4CrC;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,IAAI;IA2BlB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAWb;;;;;OAKG;IACH,MAAM,IAAI,IAAI;IAed;;;;;;OAMG;IACH,OAAO,IAAI,IAAI;IAmBf,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;OAOG;YACW,QAAQ;IAiCtB,OAAO,CAAC,MAAM;CAcf"}

package/lib/typescript/module/internal/hosted/bridge-message.d.ts

@@ -8,7 +8,7 @@
  * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
  * which arrives here as `event.nativeEvent.data`.
  */
-export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError;
+export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError | HostedTelemetryRequest;
 /** The payable page is interactive. */
 export interface HostedReady {
     readonly type: 'ready';
@@ -33,6 +33,17 @@ export interface HostedError {
     readonly type: 'error';
     readonly code: string;
 }
+/**
+ * The page is asking for this device's native risk facts.
+ *
+ * The one message that expects an answer — not over this channel, which cannot
+ * reply, but through the `window.__spareLinkNativeTelemetry` callback the page
+ * exposes and the shell invokes by injecting script. A shell that stays silent
+ * costs the page one bounded timeout and nothing else.
+ */
+export interface HostedTelemetryRequest {
+    readonly type: 'telemetryRequest';
+}
 /**
  * Parses a message posted by the hosted page.
  *

package/lib/typescript/module/internal/hosted/bridge-message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,WAAW,CAAC;AAE3F,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAyBjF"}
+{"version":3,"file":"bridge-message.d.ts","sourceRoot":"","sources":["../../../../../src/internal/hosted/bridge-message.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,aAAa,GACb,YAAY,GACZ,WAAW,GACX,sBAAsB,CAAC;AAE3B,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA2BjF"}

package/lib/typescript/module/internal/telemetry/native-telemetry-reply.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Delivers a telemetry reply into the hosted page.
+ *
+ * The WebView message channel is one-way, so the reply travels the other way:
+ * the page exposes `window.__spareLinkNativeTelemetry` before it asks, and the
+ * shell answers by injecting a call to it. A page without the callback — an
+ * older page, or one that already gave up waiting — receives nothing and the
+ * injected chunk evaluates to a harmless literal.
+ */
+/** Page-exposed global the shell invokes with its telemetry reply. */
+export declare const NATIVE_TELEMETRY_CALLBACK_NAME = "__spareLinkNativeTelemetry";
+/**
+ * Builds the script that hands [payload] to the page's telemetry callback.
+ *
+ * The payload is embedded as a JSON literal. U+2028 and U+2029 are legal inside
+ * a JSON string but terminate a statement when evaluated as script, so they are
+ * escaped; the result is a single expression that is inert on a page without
+ * the callback.
+ */
+export declare function buildNativeTelemetryReplyScript(payload: Record<string, unknown>): string;
+/**
+ * Builds the handler the webview runs when the page asks for telemetry.
+ *
+ * Collection and injection are injected so the handler is a pure seam: the
+ * component wires the real collector and the WebView reference into it. A
+ * collector that answers nothing, or throws, injects nothing — the page's own
+ * timeout settles the request.
+ */
+export declare function createTelemetryRequestHandler(deps: {
+    collect: () => Promise<Record<string, unknown> | null>;
+    inject: (script: string) => void;
+}): () => Promise<void>;
+//# sourceMappingURL=native-telemetry-reply.d.ts.map

package/lib/typescript/module/internal/telemetry/native-telemetry-reply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-telemetry-reply.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/native-telemetry-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQxF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAgBtB"}

package/lib/typescript/module/internal/telemetry/risk-telemetry-collector.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Collects this device's native risk facts for the hosted payment page.
+ *
+ * Every probe is injected, so the collector runs under Jest with fakes and the
+ * module wiring lives in `risk-telemetry-probes`. Every probe is also allowed to
+ * fail or hang: a throwing or slow reading leaves its fact absent, because a risk
+ * reading must never delay or break a payment.
+ *
+ * The payload mirrors the page's own risk contract: camelCase keys under a
+ * `deviceInformation` block, facts only, nothing fabricated.
+ */
+/** How long any single probe may take before its fact is given up on. */
+export declare const TELEMETRY_PROBE_BUDGET_MS = 800;
+/** Identity and build facts read from the platform. */
+export interface RiskDeviceSnapshot {
+    readonly operatingSystem: string | null;
+    readonly operatingSystemVersion: string | null;
+    readonly model: string | null;
+    readonly manufacturer: string | null;
+    /** A per-vendor install-stable identifier, when the platform offers one. */
+    readonly vendorIdentifier: string | null;
+    /** False on simulators and emulators. */
+    readonly isPhysicalDevice: boolean | null;
+}
+/** A battery reading, with the level as a 0 to 1 fraction. */
+export interface RiskBatteryReading {
+    readonly levelFraction: number | null;
+    readonly isCharging: boolean | null;
+}
+/** The network medium classes the risk payload distinguishes. */
+export type RiskConnectionKind = 'wifi' | 'cellular' | 'other';
+/** The probes the collector runs. Each may answer null, throw, or hang. */
+export interface RiskTelemetryProbes {
+    loadDeviceSnapshot(): Promise<RiskDeviceSnapshot | null>;
+    loadBattery(): Promise<RiskBatteryReading | null>;
+    loadConnection(): Promise<RiskConnectionKind | null>;
+    localeTag(): string | null;
+    localDateTime(): string | null;
+}
+/**
+ * Collects whatever the device answered within the per-probe budget.
+ *
+ * Returns null when nothing answered, so a caller hands the page nothing rather
+ * than an empty block.
+ */
+export declare function collectRiskTelemetry(probes: RiskTelemetryProbes): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=risk-telemetry-collector.d.ts.map

package/lib/typescript/module/internal/telemetry/risk-telemetry-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-collector.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yCAAyC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3C;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAClD,cAAc,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACrD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,IAAI,MAAM,GAAG,IAAI,CAAC;CAChC;AA4BD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAgDzC"}

package/lib/typescript/module/internal/telemetry/risk-telemetry-probes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The real device probes behind `collectRiskTelemetry`.
+ *
+ * Every expo module here is an optional peer, loaded lazily inside a try/catch:
+ * a host app that ships without one simply reports that fact as absent, and no
+ * import of this file can throw for want of a native module. Structural `*Like`
+ * types keep this file honest about how little of each module it relies on.
+ */
+import type { RiskTelemetryProbes } from './risk-telemetry-collector.js';
+/**
+ * Formats a date as local-time ISO 8601 with a numeric UTC offset, e.g.
+ * `2026-08-25T10:45:46.319+05:30` — never the UTC `Z` form. This keeps the
+ * timestamp on the payer's own clock so it reads the same as the device shows,
+ * and matches the Flutter SDK's `deviceLocalDateTime`.
+ */
+export declare function formatLocalIsoWithOffset(date: Date): string;
+/** The production probe set, ready for `collectRiskTelemetry`. */
+export declare function createRiskTelemetryProbes(): RiskTelemetryProbes;
+//# sourceMappingURL=risk-telemetry-probes.d.ts.map

package/lib/typescript/module/internal/telemetry/risk-telemetry-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-telemetry-probes.d.ts","sourceRoot":"","sources":["../../../../../src/internal/telemetry/risk-telemetry-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAIV,mBAAmB,EACpB,MAAM,+BAA4B,CAAC;AA8GpC;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAc3D;AAUD,kEAAkE;AAClE,wBAAgB,yBAAyB,IAAI,mBAAmB,CAE/D"}

package/lib/typescript/module/ui/hosted/hosted-payment-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA4C,CAAC;AAavF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CAuI5E"}
+{"version":3,"file":"hosted-payment-page.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-page.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA4C,CAAC;AAevF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,GAAG,CAAC,OAAO,CA6I5E"}

package/lib/typescript/module/ui/hosted/hosted-payment-webview.d.ts

@@ -22,6 +22,15 @@ export interface HostedPaymentWebViewProps {
      * this component stays a transport.
      */
     onBridgeMessage: (message: unknown) => void;
+    /**
+     * Answers the page's telemetry request with this device's native risk facts.
+     *
+     * The reply travels back by injected script rather than a return value, so it
+     * is handled here where the webview reference lives, and the message never
+     * reaches [onBridgeMessage]. Absent, or answering null, means the page
+     * proceeds with what the browser alone can see.
+     */
+    onTelemetryRequest?: () => Promise<Record<string, unknown> | null>;
     /** Called when the page itself could not be loaded. */
     onLoadFailure?: () => void;
     /**

package/lib/typescript/module/ui/hosted/hosted-payment-webview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAsBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CA4FlF"}
+{"version":3,"file":"hosted-payment-webview.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hosted/hosted-payment-webview.tsx"],"names":[],"mappings":"AAwBA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,CAuHlF"}

package/lib/typescript/module/version.d.ts

@@ -6,5 +6,5 @@
  * `changeset version`). The src/index.ts smoke test asserts this matches
  * package.json's version.
  */
-export declare const SDK_VERSION: "1.0.1";
+export declare const SDK_VERSION: "1.1.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spare-technologies/spare-link",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "React Native SDK for Spare Link — open-banking payments for iOS and Android.",
   "main": "./lib/commonjs/index.js",
   "module": "./lib/module/index.js",
@@ -83,18 +83,34 @@
   "peerDependencies": {
     "@expo/vector-icons": "~14.0.0",
     "expo": ">=52.0.0 <53.0.0",
+    "expo-application": "~6.0.0",
+    "expo-battery": "~9.0.0",
+    "expo-device": "~7.0.0",
     "expo-font": "~13.0.0",
     "expo-linear-gradient": "~14.0.0",
+    "expo-network": "~7.0.0",
     "expo-secure-store": "~14.0.0",
     "expo-web-browser": "~14.0.0",
     "react": ">=18.3.0 <19.0.0",
     "react-native": ">=0.76.0 <0.77.0",
     "react-native-safe-area-context": "~4.12.0",
-    "react-native-webview": "~13.12.5",
     "react-native-screens": "~4.4.0",
-    "react-native-svg": "^15.8.0"
+    "react-native-svg": "^15.8.0",
+    "react-native-webview": "~13.12.5"
   },
   "peerDependenciesMeta": {
+    "expo-application": {
+      "optional": true
+    },
+    "expo-battery": {
+      "optional": true
+    },
+    "expo-device": {
+      "optional": true
+    },
+    "expo-network": {
+      "optional": true
+    },
     "react-native-svg": {
       "optional": true
     }
@@ -106,9 +122,13 @@
     "@types/react": "~18.3.0",
     "del-cli": "^7.0.0",
     "expo": "~52.0.0",
+    "expo-application": "~6.0.2",
+    "expo-battery": "~9.0.2",
+    "expo-device": "~7.0.3",
     "expo-font": "~13.0.0",
     "expo-linear-gradient": "~14.0.0",
     "expo-linking": "~7.0.0",
+    "expo-network": "~7.0.5",
     "expo-secure-store": "~14.0.0",
     "expo-web-browser": "~14.0.0",
     "jest": "^29.7.0",
@@ -117,8 +137,8 @@
     "react-native": "0.76.9",
     "react-native-builder-bob": "^0.43.0",
     "react-native-safe-area-context": "~4.12.0",
-    "react-native-webview": "~13.12.5",
     "react-native-screens": "~4.4.0",
+    "react-native-webview": "~13.12.5",
     "react-test-renderer": "18.3.1",
     "typescript": "^5.6.2"
   }

package/plugins/with-spare-link.js

@@ -11,9 +11,14 @@
  * ]
  * ```
  *
- * All this registers is the deep link the payer returns through. The SDK asks
- * for no runtime permissions: the hosted page collects the bank's risk signals
- * itself, so nothing here reads the device.
+ * This registers the deep link the payer returns through, and declares the
+ * device data the SDK collects in the app's iOS privacy manifest. The SDK still
+ * asks for no runtime permissions of its own — the optional risk-telemetry
+ * probes read only what the platform exposes to any app, and the payment page's
+ * coarse-location fix is gated by a permission the host app chooses to hold — but
+ * that data still has to be disclosed for App Store review, so the collected-data
+ * types are merged into `ios.privacyManifests` here rather than left to each
+ * integrator to rediscover.
  *
  * Written as plain CJS so the Expo CLI's plugin loader (which `require()`s
  * this file) works regardless of whether Node loads it as ESM or CJS.
@@ -25,15 +30,83 @@
 
 const { withAndroidManifest, withInfoPlist } = require('@expo/config-plugins');
 
+const APP_FUNCTIONALITY = 'NSPrivacyCollectedDataTypePurposeAppFunctionality';
+
+/**
+ * The data types this SDK is responsible for collecting on iOS, for the app's
+ * `PrivacyInfo.xcprivacy`. Both are unlinked (not tied to a user identity by the
+ * SDK) and never used for tracking; the purpose is fraud prevention, which Apple
+ * files under App Functionality.
+ *
+ * - Device ID: the iOS vendor identifier (IDFV), read by the risk-telemetry
+ *   probe via `expo-application` when that optional peer is installed.
+ * - Coarse location: the payment page may attach an approximate fix as a risk
+ *   signal, gated by a location permission the host app holds.
+ */
+const SPARE_COLLECTED_DATA_TYPES = [
+  {
+    NSPrivacyCollectedDataType: 'NSPrivacyCollectedDataTypeDeviceID',
+    NSPrivacyCollectedDataTypeLinked: false,
+    NSPrivacyCollectedDataTypeTracking: false,
+    NSPrivacyCollectedDataTypePurposes: [APP_FUNCTIONALITY],
+  },
+  {
+    NSPrivacyCollectedDataType: 'NSPrivacyCollectedDataTypeCoarseLocation',
+    NSPrivacyCollectedDataTypeLinked: false,
+    NSPrivacyCollectedDataTypeTracking: false,
+    NSPrivacyCollectedDataTypePurposes: [APP_FUNCTIONALITY],
+  },
+];
+
+/**
+ * Merges the SDK's collected-data declarations into `ios.privacyManifests`,
+ * which Expo's own prebuild step writes into `PrivacyInfo.xcprivacy`.
+ *
+ * Additive and idempotent: a data type the app already declares is left as the
+ * app set it, ours are added only when absent, and a second pass changes
+ * nothing. `NSPrivacyTracking` is set to false only when the app has not already
+ * made its own (possibly true) declaration.
+ *
+ * @param {import('@expo/config-plugins').ExpoConfig} config
+ */
+function withRiskTelemetryPrivacyManifest(config) {
+  if (!config.ios) {
+    config.ios = {};
+  }
+  if (!config.ios.privacyManifests) {
+    config.ios.privacyManifests = {};
+  }
+  const manifests = config.ios.privacyManifests;
+
+  if (manifests.NSPrivacyTracking === undefined) {
+    manifests.NSPrivacyTracking = false;
+  }
+
+  if (!manifests.NSPrivacyCollectedDataTypes) {
+    manifests.NSPrivacyCollectedDataTypes = [];
+  }
+  const declared = manifests.NSPrivacyCollectedDataTypes;
+  for (const dataType of SPARE_COLLECTED_DATA_TYPES) {
+    const already = declared.some(
+      (entry) => entry.NSPrivacyCollectedDataType === dataType.NSPrivacyCollectedDataType,
+    );
+    if (!already) {
+      declared.push(dataType);
+    }
+  }
+
+  return config;
+}
+
 /**
  * @param {import('@expo/config-plugins').ExpoConfig} config
  * @param {SpareLinkPluginOptions | undefined} [props]
  */
 function withSpareLink(config, props) {
   const opts = props ?? {};
-  let next = config;
+  let next = withRiskTelemetryPrivacyManifest(config);
 
-  // iOS — the return URL scheme, and nothing else.
+  // iOS — the return URL scheme.
   next = withInfoPlist(next, (cfg) => {
     if (opts.merchantScheme) {
       const types = cfg.modResults.CFBundleURLTypes ?? [];

package/src/core/services/hosted-flow-controller.ts

@@ -130,6 +130,11 @@ export class HostedFlowController {
           }),
         );
         break;
+      case 'telemetryRequest':
+        // Answered by the webview layer, which owns the injection channel the
+        // reply travels back on. Reaching here means no telemetry handler was
+        // wired, and the page's own timeout settles the request.
+        break;
     }
     return true;
   }

package/src/internal/hosted/bridge-message.ts

@@ -10,7 +10,12 @@ import { parseUrlParts } from '../url-parts';
  * The page posts to `window.ReactNativeWebView.postMessage` as a JSON string,
  * which arrives here as `event.nativeEvent.data`.
  */
-export type HostedBridgeMessage = HostedReady | HostedOpenUrl | HostedCancel | HostedError;
+export type HostedBridgeMessage =
+  | HostedReady
+  | HostedOpenUrl
+  | HostedCancel
+  | HostedError
+  | HostedTelemetryRequest;
 
 /** The payable page is interactive. */
 export interface HostedReady {
@@ -40,6 +45,18 @@ export interface HostedError {
   readonly code: string;
 }
 
+/**
+ * The page is asking for this device's native risk facts.
+ *
+ * The one message that expects an answer — not over this channel, which cannot
+ * reply, but through the `window.__spareLinkNativeTelemetry` callback the page
+ * exposes and the shell invokes by injecting script. A shell that stays silent
+ * costs the page one bounded timeout and nothing else.
+ */
+export interface HostedTelemetryRequest {
+  readonly type: 'telemetryRequest';
+}
+
 /**
  * Parses a message posted by the hosted page.
  *
@@ -64,6 +81,8 @@ export function parseHostedBridgeMessage(raw: unknown): HostedBridgeMessage | nu
     }
     case 'spare.cancel':
       return { type: 'cancel' };
+    case 'spare.telemetry_request':
+      return { type: 'telemetryRequest' };
     case 'spare.error': {
       const code = message.code;
       if (typeof code !== 'string' || code.trim().length === 0) return null;