@whop/elements-react-native 0.1.0

package/ios/generated/WhopPlatformPayModule.mm

@@ -0,0 +1,51 @@
+// GENERATED by scripts/codegen-shims.mjs — do not edit, do not commit.
+// Source of truth: src/specs/. Implementations are Swift, in ios/Sources/WhopElements.
+
+#import "WhopPlatformPayModule.h"
+#import "WhopElementsShims.h"
+
+@implementation WhopPlatformPayModule {
+  WhopPlatformPayImpl *_impl;
+}
+
+// The JS name, explicitly: bare RCT_EXPORT_MODULE() registers under the CLASS name
+// ("WhopPlatformPayModule"), and TurboModuleRegistry then cannot find "WhopPlatformPay".
+RCT_EXPORT_MODULE(WhopPlatformPay)
+
+- (instancetype)init
+{
+  if (self = [super init]) {
+    _impl = [WhopPlatformPayImpl new];
+  }
+  return self;
+}
+
+- (std::shared_ptr<facebook::react::TurboModule>)getTurboModule:
+    (const facebook::react::ObjCTurboModule::InitParams &)params
+{
+  return std::make_shared<facebook::react::NativeWhopPlatformPaySpecJSI>(params);
+}
+
+- (NSString *)capability
+{
+  return [_impl capability];
+}
+
+- (void)canPay:(NSString *)configJson resolve:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject
+{
+  [_impl canPay:configJson resolve:^(id _Nullable value) { resolve(value); }
+              reject:^(NSString *code, NSString *message) { reject(code, message, nil); }];
+}
+
+- (void)present:(NSString *)requestJson resolve:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject
+{
+  [_impl present:requestJson resolve:^(id _Nullable value) { resolve(value); }
+               reject:^(NSString *code, NSString *message) { reject(code, message, nil); }];
+}
+
+- (void)complete:(BOOL)success
+{
+  [_impl complete:success];
+}
+
+@end

package/lib/module/api/client.js

@@ -0,0 +1,139 @@
+"use strict";
+
+/**
+ * The API origin is an ENUM over two Whop-owned hosts, never a consumer-supplied string.
+ *
+ * A consumer-settable origin would let the embedding app point a payment surface at a host it
+ * controls and read everything a buyer types into it. The web elements hold the same line
+ * (`elements-framework/src/builder/api-base.ts`); this is that rule on React Native.
+ */
+export const API_BASES = {
+  production: 'https://api.whop.com',
+  sandbox: 'https://api.sandbox.whop.com'
+};
+/**
+ * Pinned so a server-side schema roll cannot change what a shipped app parses.
+ *
+ * Must be a REAL released version: the API rejects an unknown date outright, before it even looks
+ * at the request. The published list is `Api::Versioning::RELEASED` in
+ * backend/lib/api/versioning.rb — bump this to a date from there, never to today's date.
+ */
+const API_VERSION_DATE = '2026-08-25';
+export class WhopError extends Error {
+  /** Alias of `status`; the ported payments error helpers read this name. */
+
+  constructor(message, status, code, body) {
+    super(message);
+    this.name = 'WhopError';
+    this.status = status;
+    this.statusCode = status;
+    this.code = code;
+    this.body = body;
+  }
+}
+const RETRYABLE = new Set([408, 429, 500, 502, 503, 504]);
+export class WhopClient {
+  constructor(options = {}) {
+    this.options = options;
+    this.baseUrl = API_BASES[options.environment ?? 'production'];
+    this.doFetch = options.fetch ?? globalThis.fetch;
+  }
+  async request(method, path, opts = {}) {
+    const url = new URL(`/api/v1${path}`, this.baseUrl);
+    for (const [key, value] of Object.entries(opts.query ?? {})) {
+      if (value !== undefined) url.searchParams.set(key, String(value));
+    }
+    const token = opts.token !== undefined ? opts.token : await this.options.getToken?.();
+    const sessionKey = this.options.getSessionKey?.();
+    const headers = {
+      accept: 'application/json',
+      'api-version-date': API_VERSION_DATE
+    };
+    if (opts.body !== undefined) headers['content-type'] = 'application/json';
+    if (token) headers.authorization = `Bearer ${token}`;
+    if (sessionKey) headers['x-ssk'] = sessionKey;
+    const maxRetries = opts.maxRetries ?? 2;
+    let lastError;
+    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+      let response;
+      try {
+        response = await this.doFetch(url.toString(), {
+          method,
+          headers,
+          body: opts.body === undefined ? undefined : JSON.stringify(opts.body),
+          signal: opts.signal
+        });
+      } catch (err) {
+        lastError = new WhopError(err instanceof Error ? err.message : 'the network request failed', 0, 'NETWORK_UNAVAILABLE');
+        if (attempt === maxRetries) throw lastError;
+        await backoff(attempt);
+        continue;
+      }
+      if (response.ok) {
+        if (response.status === 204) return undefined;
+        return await response.json();
+      }
+      const body = await response.json().catch(() => undefined);
+      const error = new WhopError(errorMessage(body, response.status), response.status, errorCode(body), body);
+      if (!RETRYABLE.has(response.status) || attempt === maxRetries) throw error;
+      lastError = error;
+      await backoff(attempt);
+    }
+    throw lastError instanceof Error ? lastError : new WhopError('the request failed', 0);
+  }
+  plans = {
+    retrieve: id => this.request('GET', `/plans/${encodeURIComponent(id)}`)
+  };
+  paymentMethodTypes = {
+    list: query => this.request('GET', '/payment_method_types', {
+      query
+    }),
+    retrieve: (type, query) => this.request('GET', `/payment_method_types/${encodeURIComponent(type)}`, {
+      query
+    }),
+    /** Authorizes a Basis Theory session against the nonce-derived card-assembly container. */
+    createSession: (type, body) => this.request('POST', `/payment_method_types/${encodeURIComponent(type)}/session`, {
+      body
+    })
+  };
+  confirmationTokens = {
+    create: body => this.request('POST', '/confirmation_tokens', {
+      body,
+      maxRetries: 0
+    }),
+    retrieve: id => this.request('GET', `/confirmation_tokens/${encodeURIComponent(id)}`)
+  };
+  payments = {
+    /** The client secret both identifies and authorizes, so no payment id is needed. */
+    retrieveBySecret: clientSecret => this.request('GET', `/payments/${encodeURIComponent(paymentTagFrom(clientSecret))}`, {
+      query: {
+        client_secret: clientSecret
+      }
+    }),
+    updateBySecret: (clientSecret, body) => this.request('PATCH', `/payments/${encodeURIComponent(paymentTagFrom(clientSecret))}`, {
+      query: {
+        client_secret: clientSecret
+      },
+      body,
+      maxRetries: 0
+    })
+  };
+}
+
+/** `pay_<tag>_secret_v<n>` — the tag is embedded, which is why the secret is the whole reference. */
+export function paymentTagFrom(clientSecret) {
+  const marker = clientSecret.indexOf('_secret_');
+  return marker === -1 ? clientSecret : clientSecret.slice(0, marker);
+}
+function errorMessage(body, status) {
+  const detail = body ?? undefined;
+  return detail?.error?.message ?? detail?.message ?? `the request failed with status ${status}`;
+}
+function errorCode(body) {
+  const detail = body ?? undefined;
+  return detail?.error?.code ?? detail?.error?.type;
+}
+function backoff(attempt) {
+  return new Promise(resolve => setTimeout(resolve, 2 ** attempt * 250));
+}
+//# sourceMappingURL=client.js.map

package/lib/module/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["API_BASES","production","sandbox","API_VERSION_DATE","WhopError","Error","constructor","message","status","code","body","name","statusCode","RETRYABLE","Set","WhopClient","options","baseUrl","environment","doFetch","fetch","globalThis","request","method","path","opts","url","URL","key","value","Object","entries","query","undefined","searchParams","set","String","token","getToken","sessionKey","getSessionKey","headers","accept","authorization","maxRetries","lastError","attempt","response","toString","JSON","stringify","signal","err","backoff","ok","json","catch","error","errorMessage","errorCode","has","plans","retrieve","id","encodeURIComponent","paymentMethodTypes","list","type","createSession","confirmationTokens","create","payments","retrieveBySecret","clientSecret","paymentTagFrom","client_secret","updateBySecret","marker","indexOf","slice","detail","Promise","resolve","setTimeout"],"sourceRoot":"../../../src","sources":["api/client.ts"],"mappings":";;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMA,SAAS,GAAG;EACxBC,UAAU,EAAE,sBAAsB;EAClCC,OAAO,EAAE;AACV,CAAU;AAIV;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,gBAAgB,GAAG,YAAY;AAErC,OAAO,MAAMC,SAAS,SAASC,KAAK,CAAC;EAEpC;;EAKAC,WAAWA,CAACC,OAAe,EAAEC,MAAc,EAAEC,IAAa,EAAEC,IAAc,EAAE;IAC3E,KAAK,CAACH,OAAO,CAAC;IACd,IAAI,CAACI,IAAI,GAAG,WAAW;IACvB,IAAI,CAACH,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACI,UAAU,GAAGJ,MAAM;IACxB,IAAI,CAACC,IAAI,GAAGA,IAAI;IAChB,IAAI,CAACC,IAAI,GAAGA,IAAI;EACjB;AACD;AAoBA,MAAMG,SAAS,GAAG,IAAIC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEzD,OAAO,MAAMC,UAAU,CAAC;EAKvBT,WAAWA,CAACU,OAA0B,GAAG,CAAC,CAAC,EAAE;IAC5C,IAAI,CAACA,OAAO,GAAGA,OAAO;IACtB,IAAI,CAACC,OAAO,GAAGjB,SAAS,CAACgB,OAAO,CAACE,WAAW,IAAI,YAAY,CAAC;IAC7D,IAAI,CAACC,OAAO,GAAGH,OAAO,CAACI,KAAK,IAAIC,UAAU,CAACD,KAAK;EACjD;EAEA,MAAME,OAAOA,CAAIC,MAAc,EAAEC,IAAY,EAAEC,IAAoB,GAAG,CAAC,CAAC,EAAc;IACrF,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAC,UAAUH,IAAI,EAAE,EAAE,IAAI,CAACP,OAAO,CAAC;IACnD,KAAK,MAAM,CAACW,GAAG,EAAEC,KAAK,CAAC,IAAIC,MAAM,CAACC,OAAO,CAACN,IAAI,CAACO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE;MAC5D,IAAIH,KAAK,KAAKI,SAAS,EAAEP,GAAG,CAACQ,YAAY,CAACC,GAAG,CAACP,GAAG,EAAEQ,MAAM,CAACP,KAAK,CAAC,CAAC;IAClE;IAEA,MAAMQ,KAAK,GAAGZ,IAAI,CAACY,KAAK,KAAKJ,SAAS,GAAGR,IAAI,CAACY,KAAK,GAAG,MAAM,IAAI,CAACrB,OAAO,CAACsB,QAAQ,GAAG,CAAC;IACrF,MAAMC,UAAU,GAAG,IAAI,CAACvB,OAAO,CAACwB,aAAa,GAAG,CAAC;IAEjD,MAAMC,OAA+B,GAAG;MACvCC,MAAM,EAAE,kBAAkB;MAC1B,kBAAkB,EAAEvC;IACrB,CAAC;IACD,IAAIsB,IAAI,CAACf,IAAI,KAAKuB,SAAS,EAAEQ,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB;IACzE,IAAIJ,KAAK,EAAEI,OAAO,CAACE,aAAa,GAAG,UAAUN,KAAK,EAAE;IACpD,IAAIE,UAAU,EAAEE,OAAO,CAAC,OAAO,CAAC,GAAGF,UAAU;IAE7C,MAAMK,UAAU,GAAGnB,IAAI,CAACmB,UAAU,IAAI,CAAC;IACvC,IAAIC,SAAkB;IAEtB,KAAK,IAAIC,OAAO,GAAG,CAAC,EAAEA,OAAO,IAAIF,UAAU,EAAEE,OAAO,IAAI,CAAC,EAAE;MAC1D,IAAIC,QAAkB;MACtB,IAAI;QACHA,QAAQ,GAAG,MAAM,IAAI,CAAC5B,OAAO,CAACO,GAAG,CAACsB,QAAQ,CAAC,CAAC,EAAE;UAC7CzB,MAAM;UACNkB,OAAO;UACP/B,IAAI,EAAEe,IAAI,CAACf,IAAI,KAAKuB,SAAS,GAAGA,SAAS,GAAGgB,IAAI,CAACC,SAAS,CAACzB,IAAI,CAACf,IAAI,CAAC;UACrEyC,MAAM,EAAE1B,IAAI,CAAC0B;QACd,CAAC,CAAC;MACH,CAAC,CAAC,OAAOC,GAAG,EAAE;QACbP,SAAS,GAAG,IAAIzC,SAAS,CACxBgD,GAAG,YAAY/C,KAAK,GAAG+C,GAAG,CAAC7C,OAAO,GAAG,4BAA4B,EACjE,CAAC,EACD,qBACD,CAAC;QACD,IAAIuC,OAAO,KAAKF,UAAU,EAAE,MAAMC,SAAS;QAC3C,MAAMQ,OAAO,CAACP,OAAO,CAAC;QACtB;MACD;MAEA,IAAIC,QAAQ,CAACO,EAAE,EAAE;QAChB,IAAIP,QAAQ,CAACvC,MAAM,KAAK,GAAG,EAAE,OAAOyB,SAAS;QAC7C,OAAQ,MAAMc,QAAQ,CAACQ,IAAI,CAAC,CAAC;MAC9B;MAEA,MAAM7C,IAAI,GAAG,MAAMqC,QAAQ,CAACQ,IAAI,CAAC,CAAC,CAACC,KAAK,CAAC,MAAMvB,SAAS,CAAC;MACzD,MAAMwB,KAAK,GAAG,IAAIrD,SAAS,CAACsD,YAAY,CAAChD,IAAI,EAAEqC,QAAQ,CAACvC,MAAM,CAAC,EAAEuC,QAAQ,CAACvC,MAAM,EAAEmD,SAAS,CAACjD,IAAI,CAAC,EAAEA,IAAI,CAAC;MACxG,IAAI,CAACG,SAAS,CAAC+C,GAAG,CAACb,QAAQ,CAACvC,MAAM,CAAC,IAAIsC,OAAO,KAAKF,UAAU,EAAE,MAAMa,KAAK;MAC1EZ,SAAS,GAAGY,KAAK;MACjB,MAAMJ,OAAO,CAACP,OAAO,CAAC;IACvB;IAEA,MAAMD,SAAS,YAAYxC,KAAK,GAAGwC,SAAS,GAAG,IAAIzC,SAAS,CAAC,oBAAoB,EAAE,CAAC,CAAC;EACtF;EAESyD,KAAK,GAAG;IAChBC,QAAQ,EAAGC,EAAU,IAA4B,IAAI,CAACzC,OAAO,CAAC,KAAK,EAAE,UAAU0C,kBAAkB,CAACD,EAAE,CAAC,EAAE;EACxG,CAAC;EAEQE,kBAAkB,GAAG;IAC7BC,IAAI,EAAGlC,KAKN,IACA,IAAI,CAACV,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE;MAAEU;IAAM,CAAC,CAAC;IAExD8B,QAAQ,EAAEA,CAACK,IAAY,EAAEnC,KAA8B,KACtD,IAAI,CAACV,OAAO,CAAC,KAAK,EAAE,yBAAyB0C,kBAAkB,CAACG,IAAI,CAAC,EAAE,EAAE;MAAEnC;IAAM,CAAC,CAAC;IAEpF;IACAoC,aAAa,EAAEA,CACdD,IAAY,EACZzD,IAA2C,KAE3C,IAAI,CAACY,OAAO,CAAC,MAAM,EAAE,yBAAyB0C,kBAAkB,CAACG,IAAI,CAAC,UAAU,EAAE;MAAEzD;IAAK,CAAC;EAC5F,CAAC;EAEQ2D,kBAAkB,GAAG;IAC7BC,MAAM,EAAG5D,IAAmC,IAC3C,IAAI,CAACY,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE;MAAEZ,IAAI;MAAEkC,UAAU,EAAE;IAAE,CAAC,CAAC;IAEtEkB,QAAQ,EAAGC,EAAU,IACpB,IAAI,CAACzC,OAAO,CAAC,KAAK,EAAE,wBAAwB0C,kBAAkB,CAACD,EAAE,CAAC,EAAE;EACtE,CAAC;EAEQQ,QAAQ,GAAG;IACnB;IACAC,gBAAgB,EAAGC,YAAoB,IACtC,IAAI,CAACnD,OAAO,CAAC,KAAK,EAAE,aAAa0C,kBAAkB,CAACU,cAAc,CAACD,YAAY,CAAC,CAAC,EAAE,EAAE;MACpFzC,KAAK,EAAE;QAAE2C,aAAa,EAAEF;MAAa;IACtC,CAAC,CAAC;IAEHG,cAAc,EAAEA,CAACH,YAAoB,EAAE/D,IAA6B,KACnE,IAAI,CAACY,OAAO,CAAC,OAAO,EAAE,aAAa0C,kBAAkB,CAACU,cAAc,CAACD,YAAY,CAAC,CAAC,EAAE,EAAE;MACtFzC,KAAK,EAAE;QAAE2C,aAAa,EAAEF;MAAa,CAAC;MACtC/D,IAAI;MACJkC,UAAU,EAAE;IACb,CAAC;EACH,CAAC;AACF;;AAEA;AACA,OAAO,SAAS8B,cAAcA,CAACD,YAAoB,EAAU;EAC5D,MAAMI,MAAM,GAAGJ,YAAY,CAACK,OAAO,CAAC,UAAU,CAAC;EAC/C,OAAOD,MAAM,KAAK,CAAC,CAAC,GAAGJ,YAAY,GAAGA,YAAY,CAACM,KAAK,CAAC,CAAC,EAAEF,MAAM,CAAC;AACpE;AAEA,SAASnB,YAAYA,CAAChD,IAAa,EAAEF,MAAc,EAAU;EAC5D,MAAMwE,MAAM,GAAItE,IAAI,IAAuEuB,SAAS;EACpG,OAAO+C,MAAM,EAAEvB,KAAK,EAAElD,OAAO,IAAIyE,MAAM,EAAEzE,OAAO,IAAI,kCAAkCC,MAAM,EAAE;AAC/F;AAEA,SAASmD,SAASA,CAACjD,IAAa,EAAsB;EACrD,MAAMsE,MAAM,GAAItE,IAAI,IAAiEuB,SAAS;EAC9F,OAAO+C,MAAM,EAAEvB,KAAK,EAAEhD,IAAI,IAAIuE,MAAM,EAAEvB,KAAK,EAAEU,IAAI;AAClD;AAEA,SAASd,OAAOA,CAACP,OAAe,EAAiB;EAChD,OAAO,IAAImC,OAAO,CAAEC,OAAO,IAAKC,UAAU,CAACD,OAAO,EAAE,CAAC,IAAIpC,OAAO,GAAG,GAAG,CAAC,CAAC;AACzE","ignoreList":[]}

package/lib/module/api/client.test.js

@@ -0,0 +1,137 @@
+"use strict";
+
+import { describe, expect, it } from 'vitest';
+import { API_BASES, paymentTagFrom, WhopClient, WhopError } from "./client.js";
+describe('API_BASES', () => {
+  // The origin is an enum over two Whop-owned hosts; a consumer-settable one would let an
+  // embedding app read everything a buyer types.
+  it('is a closed set of Whop origins', () => {
+    expect(Object.keys(API_BASES).sort()).toEqual(['production', 'sandbox']);
+    for (const origin of Object.values(API_BASES)) {
+      expect(origin).toMatch(/^https:\/\/[a-z.]*whop\.com$/);
+    }
+  });
+});
+describe('paymentTagFrom', () => {
+  it('reads the tag embedded in the client secret', () => {
+    expect(paymentTagFrom('pay_abc123_secret_v1')).toBe('pay_abc123');
+  });
+  it('passes a bare id through', () => {
+    expect(paymentTagFrom('pay_abc123')).toBe('pay_abc123');
+  });
+});
+describe('WhopClient', () => {
+  function stub(handler) {
+    const calls = [];
+    const client = new WhopClient({
+      environment: 'sandbox',
+      getToken: () => 'tok_buyer',
+      fetch: async (url, init) => {
+        calls.push({
+          url,
+          init
+        });
+        return handler(url, init);
+      }
+    });
+    return {
+      client,
+      calls
+    };
+  }
+  const ok = body => new Response(JSON.stringify(body), {
+    status: 200,
+    headers: {
+      'content-type': 'application/json'
+    }
+  });
+
+  // The pinned value must be a REAL entry in Api::Versioning::RELEASED
+  // (backend/lib/api/versioning.rb). The API rejects an unknown date before it looks at anything
+  // else, so an invented one 400s every request the SDK makes.
+  it('pins a released api version and forwards the resolved token', async () => {
+    const {
+      client,
+      calls
+    } = stub(() => ok({
+      id: 'plan_1',
+      object: 'plan',
+      currency: 'usd'
+    }));
+    await client.plans.retrieve('plan_1');
+    const headers = calls[0].init.headers;
+    expect(calls[0].url).toBe('https://api.sandbox.whop.com/api/v1/plans/plan_1');
+    expect(headers['api-version-date']).toBe('2026-08-25');
+    expect(headers.authorization).toBe('Bearer tok_buyer');
+    // A date shape, never something like "latest" or a build timestamp.
+    expect(headers['api-version-date']).toMatch(/^\d{4}-\d{2}-\d{2}(-\d+)?$/);
+  });
+  it('drops undefined query values instead of sending the string "undefined"', async () => {
+    const {
+      client,
+      calls
+    } = stub(() => ok({
+      data: [],
+      page_info: {}
+    }));
+    await client.paymentMethodTypes.list({
+      account_id: 'biz_1',
+      currency: 'usd',
+      amount: undefined
+    });
+    expect(calls[0].url).toContain('account_id=biz_1');
+    expect(calls[0].url).toContain('currency=usd');
+    expect(calls[0].url).not.toContain('amount');
+  });
+  it('surfaces the API error message and code', async () => {
+    const {
+      client
+    } = stub(() => new Response(JSON.stringify({
+      error: {
+        message: 'plan not found',
+        code: 'not_found'
+      }
+    }), {
+      status: 404
+    }));
+    await expect(client.plans.retrieve('plan_missing')).rejects.toMatchObject({
+      message: 'plan not found',
+      code: 'not_found',
+      status: 404,
+      statusCode: 404
+    });
+  });
+  it('never retries a confirmation-token create', async () => {
+    let attempts = 0;
+    const {
+      client
+    } = stub(() => {
+      attempts += 1;
+      return new Response(JSON.stringify({
+        error: {
+          message: 'boom'
+        }
+      }), {
+        status: 500
+      });
+    });
+    await expect(client.confirmationTokens.create({
+      account_id: 'biz_1',
+      payment_method: {
+        category: 'card'
+      },
+      billing_details: {}
+    })).rejects.toBeInstanceOf(WhopError);
+    expect(attempts).toBe(1);
+  });
+  it('reports an unreachable network as a coded failure', async () => {
+    const client = new WhopClient({
+      environment: 'sandbox',
+      fetch: () => Promise.reject(new Error('offline'))
+    });
+    await expect(client.plans.retrieve('plan_1')).rejects.toMatchObject({
+      code: 'NETWORK_UNAVAILABLE'
+    });
+  });
+});
+//# sourceMappingURL=client.test.js.map

package/lib/module/api/client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["describe","expect","it","API_BASES","paymentTagFrom","WhopClient","WhopError","Object","keys","sort","toEqual","origin","values","toMatch","toBe","stub","handler","calls","client","environment","getToken","fetch","url","init","push","ok","body","Response","JSON","stringify","status","headers","id","object","currency","plans","retrieve","authorization","data","page_info","paymentMethodTypes","list","account_id","amount","undefined","toContain","not","error","message","code","rejects","toMatchObject","statusCode","attempts","confirmationTokens","create","payment_method","category","billing_details","toBeInstanceOf","Promise","reject","Error"],"sourceRoot":"../../../src","sources":["api/client.test.ts"],"mappings":";;AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,QAAQ;AAE7C,SAASC,SAAS,EAAEC,cAAc,EAAEC,UAAU,EAAEC,SAAS,QAAQ,aAAU;AAE3EN,QAAQ,CAAC,WAAW,EAAE,MAAM;EAC3B;EACA;EACAE,EAAE,CAAC,iCAAiC,EAAE,MAAM;IAC3CD,MAAM,CAACM,MAAM,CAACC,IAAI,CAACL,SAAS,CAAC,CAACM,IAAI,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACxE,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACK,MAAM,CAACT,SAAS,CAAC,EAAE;MAC9CF,MAAM,CAACU,MAAM,CAAC,CAACE,OAAO,CAAC,8BAA8B,CAAC;IACvD;EACD,CAAC,CAAC;AACH,CAAC,CAAC;AAEFb,QAAQ,CAAC,gBAAgB,EAAE,MAAM;EAChCE,EAAE,CAAC,6CAA6C,EAAE,MAAM;IACvDD,MAAM,CAACG,cAAc,CAAC,sBAAsB,CAAC,CAAC,CAACU,IAAI,CAAC,YAAY,CAAC;EAClE,CAAC,CAAC;EAEFZ,EAAE,CAAC,0BAA0B,EAAE,MAAM;IACpCD,MAAM,CAACG,cAAc,CAAC,YAAY,CAAC,CAAC,CAACU,IAAI,CAAC,YAAY,CAAC;EACxD,CAAC,CAAC;AACH,CAAC,CAAC;AAEFd,QAAQ,CAAC,YAAY,EAAE,MAAM;EAC5B,SAASe,IAAIA,CAACC,OAAqD,EAAE;IACpE,MAAMC,KAAgD,GAAG,EAAE;IAC3D,MAAMC,MAAM,GAAG,IAAIb,UAAU,CAAC;MAC7Bc,WAAW,EAAE,SAAS;MACtBC,QAAQ,EAAEA,CAAA,KAAM,WAAW;MAC3BC,KAAK,EAAG,MAAAA,CAAOC,GAAW,EAAEC,IAAiB,KAAK;QACjDN,KAAK,CAACO,IAAI,CAAC;UAAEF,GAAG;UAAEC;QAAK,CAAC,CAAC;QACzB,OAAOP,OAAO,CAACM,GAAG,EAAEC,IAAI,CAAC;MAC1B;IACD,CAAC,CAAC;IACF,OAAO;MAAEL,MAAM;MAAED;IAAM,CAAC;EACzB;EAEA,MAAMQ,EAAE,GAAIC,IAAa,IACxB,IAAIC,QAAQ,CAACC,IAAI,CAACC,SAAS,CAACH,IAAI,CAAC,EAAE;IAAEI,MAAM,EAAE,GAAG;IAAEC,OAAO,EAAE;MAAE,cAAc,EAAE;IAAmB;EAAE,CAAC,CAAC;;EAErG;EACA;EACA;EACA7B,EAAE,CAAC,6DAA6D,EAAE,YAAY;IAC7E,MAAM;MAAEgB,MAAM;MAAED;IAAM,CAAC,GAAGF,IAAI,CAAC,MAAMU,EAAE,CAAC;MAAEO,EAAE,EAAE,QAAQ;MAAEC,MAAM,EAAE,MAAM;MAAEC,QAAQ,EAAE;IAAM,CAAC,CAAC,CAAC;IAC3F,MAAMhB,MAAM,CAACiB,KAAK,CAACC,QAAQ,CAAC,QAAQ,CAAC;IACrC,MAAML,OAAO,GAAGd,KAAK,CAAC,CAAC,CAAC,CAAEM,IAAI,CAACQ,OAAiC;IAChE9B,MAAM,CAACgB,KAAK,CAAC,CAAC,CAAC,CAAEK,GAAG,CAAC,CAACR,IAAI,CAAC,kDAAkD,CAAC;IAC9Eb,MAAM,CAAC8B,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAACjB,IAAI,CAAC,YAAY,CAAC;IACtDb,MAAM,CAAC8B,OAAO,CAACM,aAAa,CAAC,CAACvB,IAAI,CAAC,kBAAkB,CAAC;IACtD;IACAb,MAAM,CAAC8B,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAClB,OAAO,CAAC,4BAA4B,CAAC;EAC1E,CAAC,CAAC;EAEFX,EAAE,CAAC,wEAAwE,EAAE,YAAY;IACxF,MAAM;MAAEgB,MAAM;MAAED;IAAM,CAAC,GAAGF,IAAI,CAAC,MAAMU,EAAE,CAAC;MAAEa,IAAI,EAAE,EAAE;MAAEC,SAAS,EAAE,CAAC;IAAE,CAAC,CAAC,CAAC;IACrE,MAAMrB,MAAM,CAACsB,kBAAkB,CAACC,IAAI,CAAC;MAAEC,UAAU,EAAE,OAAO;MAAER,QAAQ,EAAE,KAAK;MAAES,MAAM,EAAEC;IAAU,CAAC,CAAC;IACjG3C,MAAM,CAACgB,KAAK,CAAC,CAAC,CAAC,CAAEK,GAAG,CAAC,CAACuB,SAAS,CAAC,kBAAkB,CAAC;IACnD5C,MAAM,CAACgB,KAAK,CAAC,CAAC,CAAC,CAAEK,GAAG,CAAC,CAACuB,SAAS,CAAC,cAAc,CAAC;IAC/C5C,MAAM,CAACgB,KAAK,CAAC,CAAC,CAAC,CAAEK,GAAG,CAAC,CAACwB,GAAG,CAACD,SAAS,CAAC,QAAQ,CAAC;EAC9C,CAAC,CAAC;EAEF3C,EAAE,CAAC,yCAAyC,EAAE,YAAY;IACzD,MAAM;MAAEgB;IAAO,CAAC,GAAGH,IAAI,CACtB,MACC,IAAIY,QAAQ,CAACC,IAAI,CAACC,SAAS,CAAC;MAAEkB,KAAK,EAAE;QAAEC,OAAO,EAAE,gBAAgB;QAAEC,IAAI,EAAE;MAAY;IAAE,CAAC,CAAC,EAAE;MAAEnB,MAAM,EAAE;IAAI,CAAC,CAC3G,CAAC;IACD,MAAM7B,MAAM,CAACiB,MAAM,CAACiB,KAAK,CAACC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAACc,OAAO,CAACC,aAAa,CAAC;MACzEH,OAAO,EAAE,gBAAgB;MACzBC,IAAI,EAAE,WAAW;MACjBnB,MAAM,EAAE,GAAG;MACXsB,UAAU,EAAE;IACb,CAAC,CAAC;EACH,CAAC,CAAC;EAEFlD,EAAE,CAAC,2CAA2C,EAAE,YAAY;IAC3D,IAAImD,QAAQ,GAAG,CAAC;IAChB,MAAM;MAAEnC;IAAO,CAAC,GAAGH,IAAI,CAAC,MAAM;MAC7BsC,QAAQ,IAAI,CAAC;MACb,OAAO,IAAI1B,QAAQ,CAACC,IAAI,CAACC,SAAS,CAAC;QAAEkB,KAAK,EAAE;UAAEC,OAAO,EAAE;QAAO;MAAE,CAAC,CAAC,EAAE;QAAElB,MAAM,EAAE;MAAI,CAAC,CAAC;IACrF,CAAC,CAAC;IACF,MAAM7B,MAAM,CACXiB,MAAM,CAACoC,kBAAkB,CAACC,MAAM,CAAC;MAChCb,UAAU,EAAE,OAAO;MACnBc,cAAc,EAAE;QAAEC,QAAQ,EAAE;MAAO,CAAC;MACpCC,eAAe,EAAE,CAAC;IACnB,CAAC,CACF,CAAC,CAACR,OAAO,CAACS,cAAc,CAACrD,SAAS,CAAC;IACnCL,MAAM,CAACoD,QAAQ,CAAC,CAACvC,IAAI,CAAC,CAAC,CAAC;EACzB,CAAC,CAAC;EAEFZ,EAAE,CAAC,mDAAmD,EAAE,YAAY;IACnE,MAAMgB,MAAM,GAAG,IAAIb,UAAU,CAAC;MAC7Bc,WAAW,EAAE,SAAS;MACtBE,KAAK,EAAGA,CAAA,KAAMuC,OAAO,CAACC,MAAM,CAAC,IAAIC,KAAK,CAAC,SAAS,CAAC;IAClD,CAAC,CAAC;IACF,MAAM7D,MAAM,CAACiB,MAAM,CAACiB,KAAK,CAACC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAACc,OAAO,CAACC,aAAa,CAAC;MAAEF,IAAI,EAAE;IAAsB,CAAC,CAAC;EACrG,CAAC,CAAC;AACH,CAAC,CAAC","ignoreList":[]}

package/lib/module/api/types.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=types.js.map

package/lib/module/api/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../../src","sources":["api/types.ts"],"mappings":"","ignoreList":[]}

package/lib/module/controller/actions.js

@@ -0,0 +1,148 @@
+"use strict";
+
+import { mergeBillingWithCollected } from "../core/payments/billing-merge.js";
+import { BrandingRequiredError } from "../core/payments/errors.js";
+import { PaymentsRefusalError } from "../core/payments/refusals.js";
+import { mintConfirmationToken, validateBillingEmail } from "../core/payments/mint.js";
+import { WhopAuthSession } from "../native/index.js";
+/**
+ * The one mint. Resolves the live collection surface, merges the billing block underneath any
+ * explicit input, and posts `POST /confirmation_tokens`.
+ */
+export async function createConfirmationToken(store, input = {}) {
+  const state = store.getSnapshot();
+  if (state.confirmInFlight) {
+    throw new PaymentsRefusalError('CONFIRMATION_IN_FLIGHT', 'A confirmation token is already being created for this handle.');
+  }
+  // Whop is the merchant of record on these sales, so the buyer has to be told so on the screen
+  // where they pay. The web element cannot demand this of already-shipped integrations; a first
+  // release can, and does.
+  if (!state.brandingMounted) {
+    throw new BrandingRequiredError('BRANDING_NOT_MOUNTED', 'Mount <BrandingElement /> alongside your payment surface — it carries the merchant-of-record notice.');
+  }
+  if (!state.charge.configured) {
+    throw new PaymentsRefusalError('CHARGE_CONFIG_MISSING', 'This handle has no charge config — pass a plan or currency and amount.');
+  }
+  const surface = store.liveSurface();
+  if (!surface) {
+    throw new PaymentsRefusalError('NO_COLLECTION_SURFACE', 'No collection surface is mounted — render <PaymentElement />, <CardElement />, or <CardFields>.');
+  }
+  store.patch({
+    confirmInFlight: true
+  });
+  try {
+    const seeded = {
+      ...input.billingDetails,
+      email: input.billingDetails?.email ?? state.buyerEmail
+    };
+    const collected = await surface.collect({
+      billingDetails: seeded
+    });
+
+    // Re-read AFTER collect: card and wallet collection take seconds, and a buyer editing their
+    // address or email meanwhile must have the live values minted, not the pre-collect snapshot.
+    const settled = store.getSnapshot();
+    const email = input.billingDetails?.email ?? settled.buyerEmail ?? seeded.email;
+    const billing = mergeBillingWithCollected({
+      ...collected.billingDetails,
+      ...input.billingDetails,
+      email: email || collected.billingDetails.email
+    }, settled.addressLive ? settled.addressCollected : undefined);
+    return await mintConfirmationToken(store.client, {
+      accountId: settled.accountId,
+      returnUrl: settled.returnUrl,
+      setupFutureUsage: settled.charge.configured ? settled.charge.setupFutureUsage : undefined
+    }, collected.paymentMethod, validateBillingEmail(billing), {
+      ...collected.billingExtra,
+      ...input.billingExtra
+    });
+  } finally {
+    store.patch({
+      confirmInFlight: false
+    });
+  }
+}
+const RESTING = new Set(['succeeded', 'failed', 'canceled', 'cancelled', 'requires_payment_method']);
+
+/**
+ * Completes a confirmed payment's pending step.
+ *
+ * The redirect leg opens the system browser and then **polls the payment to rest**. Polling is the
+ * authority rather than a callback because the API refuses anything but https or loopback for a
+ * return URL (`PaymentsApi::ValidateReturnUrl`), so a custom-scheme deep link back into the app is
+ * not available. Dismissing the browser therefore returns the payment's current status, which may
+ * still be pending — the same contract the web action documents.
+ */
+export async function handleNextAction(store, input) {
+  // One at a time, like the mint. Two overlapping calls each open a system browser and each run
+  // their own poll, and whichever finishes first calls dismiss() — closing the OTHER buyer-facing
+  // challenge mid-flow and orphaning its presentation. A double-tapped submit is enough to do it.
+  if (store.getSnapshot().nextActionInFlight) {
+    throw new PaymentsRefusalError('NEXT_ACTION_IN_FLIGHT', 'A payment step is already being handled for this handle.');
+  }
+  store.patch({
+    nextActionInFlight: true
+  });
+  try {
+    return await runNextAction(store, input);
+  } finally {
+    store.patch({
+      nextActionInFlight: false
+    });
+  }
+}
+async function runNextAction(store, input) {
+  const pollIntervalMs = input.pollIntervalMs ?? 2500;
+  const timeoutMs = input.timeoutMs ?? 300_000;
+  if (input.returnUrl) {
+    // A failed update rejects BEFORE any step runs, so the buyer is never sent somewhere the
+    // payment does not know about.
+    await store.client.payments.updateBySecret(input.clientSecret, {
+      return_url: input.returnUrl
+    });
+  }
+  let payment = await store.client.payments.retrieveBySecret(input.clientSecret);
+  const url = payment.next_action?.redirect?.url;
+  if (!payment.next_action || !url) {
+    return {
+      status: payment.status,
+      redirected: false,
+      lastPaymentError: payment.last_payment_error ?? null
+    };
+  }
+
+  // A mutable box rather than a bare `let`: the assignment happens inside a callback, which control
+  // flow analysis does not see, so a plain binding narrows to `null` at every read below.
+  const presented = {
+    error: null
+  };
+  const presentation = WhopAuthSession.present(url).catch(error => {
+    presented.error = error instanceof Error ? error : new Error(String(error));
+  });
+  const deadline = Date.now() + timeoutMs;
+  try {
+    while (Date.now() < deadline) {
+      await delay(pollIntervalMs);
+      // The buyer cannot be completing a step that never opened. Without this the poll runs the
+      // full timeout and then reports a redirect that never happened.
+      if (presented.error) break;
+      payment = await store.client.payments.retrieveBySecret(input.clientSecret).catch(() => payment);
+      if (RESTING.has(payment.status) || !payment.next_action) break;
+    }
+  } finally {
+    WhopAuthSession.dismiss();
+    await presentation;
+  }
+  if (presented.error) {
+    throw new PaymentsRefusalError('NEXT_ACTION_PRESENTATION_FAILED', `The payment step could not be opened: ${presented.error.message}`);
+  }
+  return {
+    status: payment.status,
+    redirected: true,
+    lastPaymentError: payment.last_payment_error ?? null
+  };
+}
+function delay(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=actions.js.map

package/lib/module/controller/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["mergeBillingWithCollected","BrandingRequiredError","PaymentsRefusalError","mintConfirmationToken","validateBillingEmail","WhopAuthSession","createConfirmationToken","store","input","state","getSnapshot","confirmInFlight","brandingMounted","charge","configured","surface","liveSurface","patch","seeded","billingDetails","email","buyerEmail","collected","collect","settled","billing","addressLive","addressCollected","undefined","client","accountId","returnUrl","setupFutureUsage","paymentMethod","billingExtra","RESTING","Set","handleNextAction","nextActionInFlight","runNextAction","pollIntervalMs","timeoutMs","payments","updateBySecret","clientSecret","return_url","payment","retrieveBySecret","url","next_action","redirect","status","redirected","lastPaymentError","last_payment_error","presented","error","presentation","present","catch","Error","String","deadline","Date","now","delay","has","dismiss","message","ms","Promise","resolve","setTimeout"],"sourceRoot":"../../../src","sources":["controller/actions.ts"],"mappings":";;AACA,SAASA,yBAAyB,QAAQ,mCAAgC;AAC1E,SAASC,qBAAqB,QAAQ,4BAAyB;AAC/D,SAASC,oBAAoB,QAAQ,8BAA2B;AAChE,SAASC,qBAAqB,EAA2BC,oBAAoB,QAAQ,0BAAuB;AAC5G,SAASC,eAAe,QAAQ,oBAAW;AAc3C;AACA;AACA;AACA;AACA,OAAO,eAAeC,uBAAuBA,CAC5CC,KAAoB,EACpBC,KAAmC,GAAG,CAAC,CAAC,EACC;EACzC,MAAMC,KAAK,GAAGF,KAAK,CAACG,WAAW,CAAC,CAAC;EAEjC,IAAID,KAAK,CAACE,eAAe,EAAE;IAC1B,MAAM,IAAIT,oBAAoB,CAC7B,wBAAwB,EACxB,gEACD,CAAC;EACF;EACA;EACA;EACA;EACA,IAAI,CAACO,KAAK,CAACG,eAAe,EAAE;IAC3B,MAAM,IAAIX,qBAAqB,CAC9B,sBAAsB,EACtB,sGACD,CAAC;EACF;EACA,IAAI,CAACQ,KAAK,CAACI,MAAM,CAACC,UAAU,EAAE;IAC7B,MAAM,IAAIZ,oBAAoB,CAC7B,uBAAuB,EACvB,wEACD,CAAC;EACF;EAEA,MAAMa,OAAO,GAAGR,KAAK,CAACS,WAAW,CAAC,CAAC;EACnC,IAAI,CAACD,OAAO,EAAE;IACb,MAAM,IAAIb,oBAAoB,CAC7B,uBAAuB,EACvB,iGACD,CAAC;EACF;EAEAK,KAAK,CAACU,KAAK,CAAC;IAAEN,eAAe,EAAE;EAAK,CAAC,CAAC;EACtC,IAAI;IACH,MAAMO,MAAM,GAAG;MACd,GAAGV,KAAK,CAACW,cAAc;MACvBC,KAAK,EAAEZ,KAAK,CAACW,cAAc,EAAEC,KAAK,IAAIX,KAAK,CAACY;IAC7C,CAAC;IACD,MAAMC,SAAS,GAAG,MAAMP,OAAO,CAACQ,OAAO,CAAC;MAAEJ,cAAc,EAAED;IAAO,CAAC,CAAC;;IAEnE;IACA;IACA,MAAMM,OAAO,GAAGjB,KAAK,CAACG,WAAW,CAAC,CAAC;IACnC,MAAMU,KAAK,GAAGZ,KAAK,CAACW,cAAc,EAAEC,KAAK,IAAII,OAAO,CAACH,UAAU,IAAIH,MAAM,CAACE,KAAK;IAE/E,MAAMK,OAAO,GAAGzB,yBAAyB,CACxC;MAAE,GAAGsB,SAAS,CAACH,cAAc;MAAE,GAAGX,KAAK,CAACW,cAAc;MAAEC,KAAK,EAAEA,KAAK,IAAIE,SAAS,CAACH,cAAc,CAACC;IAAM,CAAC,EACxGI,OAAO,CAACE,WAAW,GAAGF,OAAO,CAACG,gBAAgB,GAAGC,SAClD,CAAC;IAED,OAAO,MAAMzB,qBAAqB,CACjCI,KAAK,CAACsB,MAAM,EACZ;MACCC,SAAS,EAAEN,OAAO,CAACM,SAAS;MAC5BC,SAAS,EAAEP,OAAO,CAACO,SAAS;MAC5BC,gBAAgB,EAAER,OAAO,CAACX,MAAM,CAACC,UAAU,GAAGU,OAAO,CAACX,MAAM,CAACmB,gBAAgB,GAAGJ;IACjF,CAAC,EACDN,SAAS,CAACW,aAAa,EACvB7B,oBAAoB,CAACqB,OAAO,CAAC,EAC7B;MAAE,GAAGH,SAAS,CAACY,YAAY;MAAE,GAAG1B,KAAK,CAAC0B;IAAa,CACpD,CAAC;EACF,CAAC,SAAS;IACT3B,KAAK,CAACU,KAAK,CAAC;MAAEN,eAAe,EAAE;IAAM,CAAC,CAAC;EACxC;AACD;AAkBA,MAAMwB,OAAO,GAAG,IAAIC,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC;;AAEpG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,gBAAgBA,CACrC9B,KAAoB,EACpBC,KAA4B,EACM;EAClC;EACA;EACA;EACA,IAAID,KAAK,CAACG,WAAW,CAAC,CAAC,CAAC4B,kBAAkB,EAAE;IAC3C,MAAM,IAAIpC,oBAAoB,CAC7B,uBAAuB,EACvB,0DACD,CAAC;EACF;EACAK,KAAK,CAACU,KAAK,CAAC;IAAEqB,kBAAkB,EAAE;EAAK,CAAC,CAAC;EAEzC,IAAI;IACH,OAAO,MAAMC,aAAa,CAAChC,KAAK,EAAEC,KAAK,CAAC;EACzC,CAAC,SAAS;IACTD,KAAK,CAACU,KAAK,CAAC;MAAEqB,kBAAkB,EAAE;IAAM,CAAC,CAAC;EAC3C;AACD;AAEA,eAAeC,aAAaA,CAC3BhC,KAAoB,EACpBC,KAA4B,EACM;EAClC,MAAMgC,cAAc,GAAGhC,KAAK,CAACgC,cAAc,IAAI,IAAI;EACnD,MAAMC,SAAS,GAAGjC,KAAK,CAACiC,SAAS,IAAI,OAAO;EAE5C,IAAIjC,KAAK,CAACuB,SAAS,EAAE;IACpB;IACA;IACA,MAAMxB,KAAK,CAACsB,MAAM,CAACa,QAAQ,CAACC,cAAc,CAACnC,KAAK,CAACoC,YAAY,EAAE;MAAEC,UAAU,EAAErC,KAAK,CAACuB;IAAU,CAAC,CAAC;EAChG;EAEA,IAAIe,OAAO,GAAG,MAAMvC,KAAK,CAACsB,MAAM,CAACa,QAAQ,CAACK,gBAAgB,CAACvC,KAAK,CAACoC,YAAY,CAAC;EAC9E,MAAMI,GAAG,GAAGF,OAAO,CAACG,WAAW,EAAEC,QAAQ,EAAEF,GAAG;EAE9C,IAAI,CAACF,OAAO,CAACG,WAAW,IAAI,CAACD,GAAG,EAAE;IACjC,OAAO;MAAEG,MAAM,EAAEL,OAAO,CAACK,MAAM;MAAEC,UAAU,EAAE,KAAK;MAAEC,gBAAgB,EAAEP,OAAO,CAACQ,kBAAkB,IAAI;IAAK,CAAC;EAC3G;;EAEA;EACA;EACA,MAAMC,SAAkC,GAAG;IAAEC,KAAK,EAAE;EAAK,CAAC;EAC1D,MAAMC,YAAY,GAAGpD,eAAe,CAACqD,OAAO,CAACV,GAAG,CAAC,CAACW,KAAK,CAAEH,KAAc,IAAK;IAC3ED,SAAS,CAACC,KAAK,GAAGA,KAAK,YAAYI,KAAK,GAAGJ,KAAK,GAAG,IAAII,KAAK,CAACC,MAAM,CAACL,KAAK,CAAC,CAAC;EAC5E,CAAC,CAAC;EACF,MAAMM,QAAQ,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGvB,SAAS;EAEvC,IAAI;IACH,OAAOsB,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGF,QAAQ,EAAE;MAC7B,MAAMG,KAAK,CAACzB,cAAc,CAAC;MAC3B;MACA;MACA,IAAIe,SAAS,CAACC,KAAK,EAAE;MACrBV,OAAO,GAAG,MAAMvC,KAAK,CAACsB,MAAM,CAACa,QAAQ,CAACK,gBAAgB,CAACvC,KAAK,CAACoC,YAAY,CAAC,CAACe,KAAK,CAAC,MAAMb,OAAO,CAAC;MAC/F,IAAIX,OAAO,CAAC+B,GAAG,CAACpB,OAAO,CAACK,MAAM,CAAC,IAAI,CAACL,OAAO,CAACG,WAAW,EAAE;IAC1D;EACD,CAAC,SAAS;IACT5C,eAAe,CAAC8D,OAAO,CAAC,CAAC;IACzB,MAAMV,YAAY;EACnB;EAEA,IAAIF,SAAS,CAACC,KAAK,EAAE;IACpB,MAAM,IAAItD,oBAAoB,CAC7B,iCAAiC,EACjC,yCAAyCqD,SAAS,CAACC,KAAK,CAACY,OAAO,EACjE,CAAC;EACF;EAEA,OAAO;IAAEjB,MAAM,EAAEL,OAAO,CAACK,MAAM;IAAEC,UAAU,EAAE,IAAI;IAAEC,gBAAgB,EAAEP,OAAO,CAACQ,kBAAkB,IAAI;EAAK,CAAC;AAC1G;AAEA,SAASW,KAAKA,CAACI,EAAU,EAAiB;EACzC,OAAO,IAAIC,OAAO,CAAEC,OAAO,IAAKC,UAAU,CAACD,OAAO,EAAEF,EAAE,CAAC,CAAC;AACzD","ignoreList":[]}

package/lib/module/controller/actions.test.js

@@ -0,0 +1,102 @@
+"use strict";
+
+import { describe, expect, it, vi } from 'vitest';
+
+// `../native` reaches react-native, whose Flow source vitest cannot parse. The redirect leg is not
+// what these tests exercise: they are about the in-flight guard around it.
+vi.mock('../native', () => ({
+  WhopAuthSession: {
+    present: vi.fn(async () => null),
+    dismiss: vi.fn()
+  },
+  WhopPlatformPay: {
+    capability: vi.fn(() => 'none')
+  },
+  WALLET_TYPE_FOR_PLATFORM: 'apple_pay'
+}));
+import { PaymentsRefusalError } from "../core/payments/refusals.js";
+import { handleNextAction } from "./actions.js";
+/**
+ * The store as `handleNextAction` uses it: a state bag it reads and patches, and a client whose
+ * payments resource it polls. Building the real one would open a network client and resolve a
+ * charge, neither of which this behaviour depends on.
+ */
+function fakeStore(payment) {
+  const state = {
+    nextActionInFlight: false
+  };
+  let retrieves = 0;
+  return {
+    store: {
+      getSnapshot: () => state,
+      patch: next => Object.assign(state, next),
+      client: {
+        payments: {
+          updateBySecret: vi.fn(async () => payment),
+          retrieveBySecret: vi.fn(async () => {
+            retrieves += 1;
+            return payment;
+          })
+        }
+      }
+    },
+    state,
+    retrieves: () => retrieves
+  };
+}
+describe('handleNextAction', () => {
+  it('returns without redirecting when the payment has no next action', async () => {
+    const {
+      store,
+      state
+    } = fakeStore({
+      status: 'succeeded',
+      next_action: null,
+      last_payment_error: null
+    });
+    const result = await handleNextAction(store, {
+      clientSecret: 'pay_secret'
+    });
+    expect(result).toEqual({
+      status: 'succeeded',
+      redirected: false,
+      lastPaymentError: null
+    });
+    // the guard always clears, so a second call is not locked out by the first
+    expect(state.nextActionInFlight).toBe(false);
+  });
+  it('refuses a second call while one is in flight', async () => {
+    const {
+      store,
+      state
+    } = fakeStore({
+      status: 'succeeded',
+      next_action: null,
+      last_payment_error: null
+    });
+    state.nextActionInFlight = true;
+    await expect(handleNextAction(store, {
+      clientSecret: 'pay_secret'
+    })).rejects.toThrow(PaymentsRefusalError);
+    await expect(handleNextAction(store, {
+      clientSecret: 'pay_secret'
+    })).rejects.toThrow(/NEXT_ACTION_IN_FLIGHT/);
+  });
+  it('clears the guard even when the call throws', async () => {
+    const {
+      store,
+      state
+    } = fakeStore({
+      status: 'requires_action',
+      next_action: {},
+      last_payment_error: null
+    });
+    store.client.payments.retrieveBySecret.mockRejectedValueOnce(new Error('network'));
+    await expect(handleNextAction(store, {
+      clientSecret: 'pay_secret'
+    })).rejects.toThrow('network');
+    // a failed step must not lock the handle out of every later attempt
+    expect(state.nextActionInFlight).toBe(false);
+  });
+});
+//# sourceMappingURL=actions.test.js.map

package/lib/module/controller/actions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["describe","expect","it","vi","mock","WhopAuthSession","present","fn","dismiss","WhopPlatformPay","capability","WALLET_TYPE_FOR_PLATFORM","PaymentsRefusalError","handleNextAction","fakeStore","payment","state","nextActionInFlight","retrieves","store","getSnapshot","patch","next","Object","assign","client","payments","updateBySecret","retrieveBySecret","status","next_action","last_payment_error","result","clientSecret","toEqual","redirected","lastPaymentError","toBe","rejects","toThrow","mockRejectedValueOnce","Error"],"sourceRoot":"../../../src","sources":["controller/actions.test.ts"],"mappings":";;AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,QAAQ;;AAEjD;AACA;AACAA,EAAE,CAACC,IAAI,CAAC,WAAW,EAAE,OAAO;EAC3BC,eAAe,EAAE;IAAEC,OAAO,EAAEH,EAAE,CAACI,EAAE,CAAC,YAAY,IAAI,CAAC;IAAEC,OAAO,EAAEL,EAAE,CAACI,EAAE,CAAC;EAAE,CAAC;EACvEE,eAAe,EAAE;IAAEC,UAAU,EAAEP,EAAE,CAACI,EAAE,CAAC,MAAM,MAAM;EAAE,CAAC;EACpDI,wBAAwB,EAAE;AAC3B,CAAC,CAAC,CAAC;AAEH,SAASC,oBAAoB,QAAQ,8BAA2B;AAChE,SAASC,gBAAgB,QAAQ,cAAW;AAG5C;AACA;AACA;AACA;AACA;AACA,SAASC,SAASA,CAACC,OAAgC,EAAE;EACpD,MAAMC,KAA8B,GAAG;IAAEC,kBAAkB,EAAE;EAAM,CAAC;EACpE,IAAIC,SAAS,GAAG,CAAC;EACjB,OAAO;IACNC,KAAK,EAAE;MACNC,WAAW,EAAEA,CAAA,KAAMJ,KAAK;MACxBK,KAAK,EAAGC,IAA6B,IAAKC,MAAM,CAACC,MAAM,CAACR,KAAK,EAAEM,IAAI,CAAC;MACpEG,MAAM,EAAE;QACPC,QAAQ,EAAE;UACTC,cAAc,EAAExB,EAAE,CAACI,EAAE,CAAC,YAAYQ,OAAO,CAAC;UAC1Ca,gBAAgB,EAAEzB,EAAE,CAACI,EAAE,CAAC,YAAY;YACnCW,SAAS,IAAI,CAAC;YACd,OAAOH,OAAO;UACf,CAAC;QACF;MACD;IACD,CAA6B;IAC7BC,KAAK;IACLE,SAAS,EAAEA,CAAA,KAAMA;EAClB,CAAC;AACF;AAEAlB,QAAQ,CAAC,kBAAkB,EAAE,MAAM;EAClCE,EAAE,CAAC,iEAAiE,EAAE,YAAY;IACjF,MAAM;MAAEiB,KAAK;MAAEH;IAAM,CAAC,GAAGF,SAAS,CAAC;MAAEe,MAAM,EAAE,WAAW;MAAEC,WAAW,EAAE,IAAI;MAAEC,kBAAkB,EAAE;IAAK,CAAC,CAAC;IAExG,MAAMC,MAAM,GAAG,MAAMnB,gBAAgB,CAACM,KAAK,EAAE;MAAEc,YAAY,EAAE;IAAa,CAAC,CAAC;IAE5EhC,MAAM,CAAC+B,MAAM,CAAC,CAACE,OAAO,CAAC;MAAEL,MAAM,EAAE,WAAW;MAAEM,UAAU,EAAE,KAAK;MAAEC,gBAAgB,EAAE;IAAK,CAAC,CAAC;IAC1F;IACAnC,MAAM,CAACe,KAAK,CAACC,kBAAkB,CAAC,CAACoB,IAAI,CAAC,KAAK,CAAC;EAC7C,CAAC,CAAC;EAEFnC,EAAE,CAAC,8CAA8C,EAAE,YAAY;IAC9D,MAAM;MAAEiB,KAAK;MAAEH;IAAM,CAAC,GAAGF,SAAS,CAAC;MAAEe,MAAM,EAAE,WAAW;MAAEC,WAAW,EAAE,IAAI;MAAEC,kBAAkB,EAAE;IAAK,CAAC,CAAC;IACxGf,KAAK,CAACC,kBAAkB,GAAG,IAAI;IAE/B,MAAMhB,MAAM,CAACY,gBAAgB,CAACM,KAAK,EAAE;MAAEc,YAAY,EAAE;IAAa,CAAC,CAAC,CAAC,CAACK,OAAO,CAACC,OAAO,CAAC3B,oBAAoB,CAAC;IAC3G,MAAMX,MAAM,CAACY,gBAAgB,CAACM,KAAK,EAAE;MAAEc,YAAY,EAAE;IAAa,CAAC,CAAC,CAAC,CAACK,OAAO,CAACC,OAAO,CAAC,uBAAuB,CAAC;EAC/G,CAAC,CAAC;EAEFrC,EAAE,CAAC,4CAA4C,EAAE,YAAY;IAC5D,MAAM;MAAEiB,KAAK;MAAEH;IAAM,CAAC,GAAGF,SAAS,CAAC;MAAEe,MAAM,EAAE,iBAAiB;MAAEC,WAAW,EAAE,CAAC,CAAC;MAAEC,kBAAkB,EAAE;IAAK,CAAC,CAAC;IAC3GZ,KAAK,CAACM,MAAM,CAACC,QAAQ,CAACE,gBAAgB,CAA8BY,qBAAqB,CAAC,IAAIC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEhH,MAAMxC,MAAM,CAACY,gBAAgB,CAACM,KAAK,EAAE;MAAEc,YAAY,EAAE;IAAa,CAAC,CAAC,CAAC,CAACK,OAAO,CAACC,OAAO,CAAC,SAAS,CAAC;IAChG;IACAtC,MAAM,CAACe,KAAK,CAACC,kBAAkB,CAAC,CAACoB,IAAI,CAAC,KAAK,CAAC;EAC7C,CAAC,CAAC;AACH,CAAC,CAAC","ignoreList":[]}