feat: expose showBillingZIPField config for PCI-sandboxed postal code input

[arstiefel]

Description

Adds a showBillingZIPField config option to CreditCard.useController() that enables Storm's existing PCI-sandboxed postal code field inside the credit card input iframe. When enabled, the SDK sends the flag in the SetConfig message on FrameInitialized, causing Storm's iframe to render CardPostalField alongside the card fields. Also restructures the 3DS message payloads (FetchReferenceID and TriggerAuthWithConfig) to nest credit card and config data under dedicated sub-objects, matching Storm's expected message shapes. Fixes sub-iframe navigation handling in the WebView (Cardinal Commerce DDC, 3DS step-up challenges) and adds a forwarding mechanism in the injected bridge so real DOM postMessage events from sub-iframes reach captured listeners. Includes minor CI workflow labeling and implementation plan updates.

Testing

• New unit test in useCreditCardController.test.ts verifies that SetConfig carries showBillingZIPField: true when configured.
• Updated tests in useThreeDSecure.test.tsx cover the restructured FetchReferenceID payload (nested creditCard object), TriggerAuthWithConfig (nested config object), VerificationIDResult using success field instead of referenceID, and a new test for Result error propagation when the DDC JWT call fails (error code 1010).
• The example app's Add Card screen initializes with showBillingZIPField: true for manual verification on device.
• Manual testing recommended: confirm postal code field renders inside the WebView, and that 3DS DDC / step-up challenge iframes load correctly with the sub-frame navigation fix.

Security Review

Important

A security review is required for every PR in this repository to comply with PCI requirements.

• I have considered and reviewed security implications of this PR and included the summary below.

Security Impact Summary

This PR deliberately keeps postal code collection inside the PCI-sandboxed iframe, consistent with Storm's existing architecture. The showBillingZIPField flag is passed via the existing SetConfig message channel — no new network calls, storage, or data pathways are introduced. The sub-iframe navigation change (BoltPaymentWebView.tsx) allows non-top-frame navigations (e.g., Cardinal Commerce DDC form submissions, 3DS step-up challenges) while continuing to restrict top-level navigation to the Bolt domain. The injected bridge forwarding only passes through non-bridge DOM events to captured listeners — bridge envelopes are explicitly skipped. The 3DS message restructuring is a shape change only (nesting fields under creditCard and config keys); no new data is sent. The example app's publishable key was swapped to a 3DS-enabled staging key for testing purposes.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Adds an SDK-level configuration flag to expose Storm’s PCI-sandboxed postal code field within the credit card input iframe, and wires it through the existing SetConfig bridge message. Also updates the example app and supporting docs/CI labeling.

Changes:

• Add showBillingZIPField?: boolean to CreditCard.useController() options and include it in the SetConfig payload sent on frame initialization.
• Update example app to enable the postal code field for manual verification.
• Add/adjust unit test and update implementation plan + CI workflow job naming.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/payments/useCreditCardController.ts	Adds showBillingZIPField option and forwards it via SetConfig.
src/__tests__/useCreditCardController.test.ts	Adds a unit test intended to validate showBillingZIPField messaging behavior.
example/src/App.tsx	Enables showBillingZIPField: true in the demo Add Card screen.
example/ios/Podfile.lock	Updates example iOS pod lockfile for the SDK version bump.
IMPLEMENTATION_PLAN.md	Updates plan/status notes for postal code field work and other checklist items.
.github/workflows/main-release.yml	Adds a clearer display name for the reusable CI job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Adds a showBillingZIPField option to the Credit Card controller so the Storm iframe can render its PCI-sandboxed postal code field, and includes related bridge/3DS adjustments plus example/test updates.

Changes:

• Expose showBillingZIPField?: boolean on CreditCard.useController() and forward it via SetConfig.
• Update 3DS bridge message handling/payload shapes and add additional message forwarding + navigation allowances for subframes.
• Update unit tests, example app configuration, workflow labeling, and implementation plan docs.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/payments/useCreditCardController.ts	Adds showBillingZIPField option and forwards it in SetConfig on frame init.
src/tests/useCreditCardController.test.ts	Adds a test intended to validate showBillingZIPField behavior (currently not exercising hook wiring).
example/src/App.tsx	Enables showBillingZIPField: true in the example Add Card screen for manual verification.
src/payments/useThreeDSecure.tsx	Adjusts 3DS message parsing and changes outbound message payload shapes.
src/tests/useThreeDSecure.test.tsx	Updates tests to match the new 3DS payload/message shapes.
src/bridge/injectedBridge.ts	Forwards real DOM message events to captured listeners (sub-iframe support).
src/bridge/BoltPaymentWebView.tsx	Allows sub-frame navigations; keeps top-frame navigation restricted (but see comment re: isTopFrame).
.github/workflows/main-release.yml	Adds a job display name for the reusable CI workflow.
example/ios/Podfile.lock	Bumps example pod lock to BoltReactNativeSdk (0.2.0).
IMPLEMENTATION_PLAN.md	Updates plan/status notes, including postal-code phase documentation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.