@wirexapp/card-sdk-core 0.1.0-beta.0 → 0.1.0-beta.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @wirexapp/card-sdk-core
 
+## 0.1.0-beta.1
+
+### Minor Changes
+
+- 737c0f8: Named environments replace free-form frame origins: pass
+  `environment: 'dev' | 'uat' | 'prod'` (default `'prod'`) and the SDK resolves
+  the baked-in Wirex frame origin — origins are no longer partner input.
+  `frameOrigin` remains as an explicit local-development override that takes
+  precedence; unknown environments throw at creation time.
+
 ## 0.1.0-beta.0
 
 ### Minor Changes

package/dist/frameUrl.d.ts

@@ -2,19 +2,25 @@
  * Frame-URL building shared by every capability package (topup / oct / reveal)
  * and the umbrella `createPciSdk` factory.
  */
+/** Named environment → the Wirex-operated frame origin baked into the SDK.
+ *  Partners select an environment; they never supply origins. */
+export type PciEnvironment = 'dev' | 'uat' | 'prod';
 export interface PciSdkConfig {
     /**
-     * Origin serving the PCI frames — the dedicated PCI SDK service
-     * (`sdk-service/`, prod `https://card-js.wirexapp.tech`). **Required**,
-     * and it MUST be a different origin than the host app: that cross-origin
-     * boundary is the entire Same-Origin-Policy isolation the SDK relies on. There
-     * is deliberately no same-origin fallback — a same-origin frame would let
-     * host-page XSS read cardholder data, nullifying the SDK.
-     * TODO(pci-sdk): prod split — loader on `js.<domain>`, cookieless frames on
-     * `frames.<domain>` (docs/DESIGN.md §5.5.1).
+     * Which Wirex environment serves the frames. Defaults to `'prod'`. The
+     * origins are baked into the SDK on purpose: an origin is not partner
+     * input, so it can be neither mistyped nor redirected.
      */
-    frameOrigin: string;
-    /** Path prefix of the frame documents on `frameOrigin` (the service serves
+    environment?: PciEnvironment;
+    /**
+     * LOCAL DEVELOPMENT / INTERNAL ONLY — overrides `environment` with an
+     * explicit frame origin (e.g. `http://localhost:4114` while developing the
+     * frames themselves). Never set this in a partner integration: the whole
+     * isolation model relies on the frames being served from a Wirex-operated
+     * origin, cross-origin to the host app.
+     */
+    frameOrigin?: string;
+    /** Path prefix of the frame documents on the origin (the service serves
      *  them at the root, so this is empty by default). */
     framePath?: string;
     /**
@@ -29,7 +35,10 @@ export interface PciSdkConfig {
     clientId?: string;
 }
 export type PciFrameDocument = 'collect' | 'collect-field' | 'reveal';
-export declare const assertFrameOrigin: (config: PciSdkConfig) => void;
+/** Resolve the frame origin: explicit `frameOrigin` override (local dev) wins,
+ *  otherwise the named environment (default `'prod'`). Unknown environments
+ *  throw — a misconfigured host must fail loudly, never fall back silently. */
+export declare const resolveFrameOrigin: (config: PciSdkConfig) => string;
 /** Build the URL of one frame document. `client` MUST be a query param, not the
  *  URL fragment: the frame host reads it server-side to emit the per-client
  *  `frame-ancestors` header, and the fragment is never sent to the server. The

package/dist/frameUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frameUrl.d.ts","sourceRoot":"","sources":["../src/frameUrl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;0DACsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,eAAe,GAAG,QAAQ,CAAC;AAEtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,YAAY,KAAG,IAOxD,CAAC;AAEF;;;2EAG2E;AAC3E,eAAO,MAAM,aAAa,GAAI,QAAQ,YAAY,EAAE,UAAU,gBAAgB,KAAG,MAKhF,CAAC"}
+{"version":3,"file":"frameUrl.d.ts","sourceRoot":"","sources":["../src/frameUrl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;iEACiE;AACjE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAQpD,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;0DACsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,eAAe,GAAG,QAAQ,CAAC;AAEtE;;+EAE+E;AAC/E,eAAO,MAAM,kBAAkB,GAAI,QAAQ,YAAY,KAAG,MAUzD,CAAC;AAEF;;;2EAG2E;AAC3E,eAAO,MAAM,aAAa,GAAI,QAAQ,YAAY,EAAE,UAAU,gBAAgB,KAAG,MAKhF,CAAC"}

package/dist/frameUrl.js

@@ -2,20 +2,32 @@
  * Frame-URL building shared by every capability package (topup / oct / reveal)
  * and the umbrella `createPciSdk` factory.
  */
-export const assertFrameOrigin = (config) => {
-    if (!config.frameOrigin) {
-        throw new Error('PCI SDK: `frameOrigin` is required and must be a dedicated origin, different from the host app. ' +
-            'The Same-Origin-Policy isolation depends on it; a same-origin frame would expose cardholder data to host-page XSS.');
+const ENVIRONMENT_ORIGINS = {
+    dev: 'https://frames-dev.wirexapp.tech',
+    uat: 'https://frames.wirexapp.tech',
+    prod: 'https://frames.wirexapp.com',
+};
+/** Resolve the frame origin: explicit `frameOrigin` override (local dev) wins,
+ *  otherwise the named environment (default `'prod'`). Unknown environments
+ *  throw — a misconfigured host must fail loudly, never fall back silently. */
+export const resolveFrameOrigin = (config) => {
+    if (config.frameOrigin)
+        return config.frameOrigin;
+    const environment = config.environment ?? 'prod';
+    const origin = ENVIRONMENT_ORIGINS[environment];
+    if (!origin) {
+        throw new Error(`PCI SDK: unknown environment "${environment}" — expected 'dev', 'uat' or 'prod'.`);
     }
+    return origin;
 };
 /** Build the URL of one frame document. `client` MUST be a query param, not the
  *  URL fragment: the frame host reads it server-side to emit the per-client
  *  `frame-ancestors` header, and the fragment is never sent to the server. The
  *  channel/parent fragment is appended afterwards by `PciFrameChannel`. */
 export const buildFrameUrl = (config, document) => {
-    assertFrameOrigin(config);
+    const origin = resolveFrameOrigin(config);
     const framePath = config.framePath ?? '';
     const query = config.clientId ? `?client=${encodeURIComponent(config.clientId)}` : '';
-    return `${config.frameOrigin}${framePath}/${document}.html${query}`;
+    return `${origin}${framePath}/${document}.html${query}`;
 };
 //# sourceMappingURL=frameUrl.js.map

package/dist/frameUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"frameUrl.js","sourceRoot":"","sources":["../src/frameUrl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+BH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAoB,EAAQ,EAAE;IAC9D,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,kGAAkG;YAChG,oHAAoH,CACvH,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF;;;2EAG2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,QAA0B,EAAU,EAAE;IACxF,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,GAAG,MAAM,CAAC,WAAW,GAAG,SAAS,IAAI,QAAQ,QAAQ,KAAK,EAAE,CAAC;AACtE,CAAC,CAAC"}
+{"version":3,"file":"frameUrl.js","sourceRoot":"","sources":["../src/frameUrl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,mBAAmB,GAAmC;IAC1D,GAAG,EAAE,kCAAkC;IACvC,GAAG,EAAE,8BAA8B;IACnC,IAAI,EAAE,6BAA6B;CACpC,CAAC;AAkCF;;+EAE+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAoB,EAAU,EAAE;IACjE,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,iCAAiC,WAAW,sCAAsC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;2EAG2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,QAA0B,EAAU,EAAE;IACxF,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,GAAG,MAAM,GAAG,SAAS,IAAI,QAAQ,QAAQ,KAAK,EAAE,CAAC;AAC1D,CAAC,CAAC"}

package/dist/index.d.ts

@@ -14,8 +14,8 @@ export { PciCollectElement } from './collectElement.js';
 export type { PciCollectField, PciCollectGroupConfig } from './collectGroup.js';
 export { PciCollectGroup } from './collectGroup.js';
 export { PciFrameChannel, PciFrameRequestError } from './frameChannel.js';
-export type { PciFrameDocument, PciSdkConfig } from './frameUrl.js';
-export { assertFrameOrigin, buildFrameUrl } from './frameUrl.js';
+export type { PciEnvironment, PciFrameDocument, PciSdkConfig } from './frameUrl.js';
+export { buildFrameUrl, resolveFrameOrigin } from './frameUrl.js';
 export type { PciAppearance, PciAppearanceVariables, PciBrandBadgeAppearance, PciCardBrand, PciCollectChangeState, PciCollectFieldInitConfig, PciCollectFieldName, PciCollectInitConfig, PciCollectProfile, PciFrameAuth, PciFrameError, PciFrameStrings, PciFrameToHostMessage, PciHostToFrameMessage, PciInitConfig, PciRevealField, PciRevealInitConfig, PciRevealState, PciRevealStatus, PciTokenizeOctRequest, PciTokenizeOctResult, PciTokenizeRequest, PciTokenizeTopUpRequest, PciTokenizeTopUpResult, } from './protocol.js';
 export { PCI_PROTOCOL_VERSION } from './protocol.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAClE,YAAY,EACV,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -12,6 +12,6 @@
 export { PciCollectElement } from './collectElement.js';
 export { PciCollectGroup } from './collectGroup.js';
 export { PciFrameChannel, PciFrameRequestError } from './frameChannel.js';
-export { assertFrameOrigin, buildFrameUrl } from './frameUrl.js';
+export { buildFrameUrl, resolveFrameOrigin } from './frameUrl.js';
 export { PCI_PROTOCOL_VERSION } from './protocol.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA2BjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AA2BlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirexapp/card-sdk-core",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.1",
   "type": "module",
   "description": "Shared foundation of the Wirex PCI card SDK: postMessage protocol, frame channel, frame-URL building, collect machinery. CHD-free.",
   "license": "UNLICENSED",