@asteby/storefront-react 0.8.0 → 0.9.0

package/README.md

@@ -481,6 +481,43 @@ return Response.json(result)    // PaymentAttemptResult; 409/422/429 se devuelve
 - **Tema**: `--sf-pay-text`, `-text-muted`, `-background`, `-input-background`, `-primary`, `-primary-contrast`, `-error`, `-success`, `-outline`, `-radius` se leen al montar y se pasan al Brick; `--sf-pay-min-height` reserva el alto (sin saltos).
 - **Otro proveedor**: implementa `PaymentFormAdapter` (`load`, `mount → { collect, unmount }`) y pásalo en `adapter`/`adapters={{ stripe_elements: … }}`.
 
+### «Método de pago» híbrido (`PaymentMethodSection` + `/payments/server`)
+
+Lo que hace falta alrededor del Brick, listo para usar: filas por opción que publica OPS (tarjeta, efectivo, cuenta del proveedor, pagos sin tarjeta), tarjeta con el formulario seguro DENTRO de la página, efectivo con puntos de pago y ficha, y redirección para el resto. Sin JavaScript, o si el formulario no carga, todo cae al envío normal del formulario de la página (redirección). Textos, rutas, iconos y clases por props; el total es siempre `cart.cost.total` de OPS (nunca se suma ni se recalcula).
+
+```tsx
+// loader: filas desde GET payment-methods (la tienda oculta lo que no ofrece)
+import { buildPayChoices } from '@asteby/storefront-react/payments'
+const choices = buildPayChoices(payment.methods, { hide: ['manual'] })
+
+// componente, dentro del <form> de /pagar
+import '@asteby/storefront-react/payments.css'   // opcional: muestra el panel de la fila marcada sin JS
+<PaymentMethodSection
+  choices={choices} amount={cart.cost.total} scope={cart.id} formRef={formRef}
+  payUrl="/pagar/cobrar" statusUrl="/pagar/estado" nonce={nonce}
+  delivery={delivery} deliveryReady={delivery !== '' && !delivery.startsWith('ship:')}
+  syncDelivery={saveDeliveryAndReloadCart}     // guarda la entrega en el carrito de OPS y resuelve true al releer el total
+  onAmountChanged={revalidate} onDone={() => navigate('/pagar/gracias')}
+  rebuildHref="/carrito" messages={{ legend: 'Método de pago' }} icons={{ card: <CardIcon /> }}
+  classNames={{ radioLabel: '...', submit: 'btn-primary' }} />
+```
+
+```ts
+// servidor: dos rutas de recurso (POST JSON) y el efectivo del formulario
+import { createEmbeddedPayHandlers, paymentCspHeaders, paymentCspMode, paymentNonce } from '@asteby/storefront-react/payments/server'
+export const pay = createEmbeddedPayHandlers({
+  client, site, returnPath: '/pagar/gracias', readCartId, readSession, serializeSession,
+  validateFields, prepareCart, createDraft, settle, hide: ['manual'],
+})
+// action de /pagar/cobrar -> pay.pay(request); action de /pagar/estado -> pay.status(request)
+// efectivo (en la action de /pagar): const out = await pay.cash({ sf, request, cartId, fields, choice, before })
+```
+
+- La tienda aporta lo suyo por callbacks: cookies (`readSession`/`serializeSession`), qué campos exige (`validateFields`), cómo guarda contacto, dirección y entrega (`prepareCart`), el comprobante (`createDraft`) y cuándo queda cerrado el pedido (`settle`: añade las cookies y devuelve `true` si fue aprobado, en revisión o ficha).
+- El servidor decide qué se paga en la página: un `payment_choice` falsificado u oculto se rechaza (422), un punto de efectivo se arma de la lista del proveedor, el monto nunca viaja en `provider_data`, el reintento reutiliza el checkout y la llave de pago, hay límite por IP y validación de origen.
+- CSP solo para `/pagar`: `paymentCspHeaders([client], { mode: paymentCspMode(env.PAY_CSP, isProd), nonce: paymentNonce(), scriptHashes, imgHttps })` y `paymentNonceFromHeaders` para `ServerRouter`.
+- Accesibilidad: un `fieldset` con leyenda y radios nativos, avisos en `role="status"`/`alert`, botón de 44 px que explica su estado ocupado; pruebas con axe.
+
 ## Promociones y venta cruzada (`@asteby/storefront-react/promotions`)
 
 Mecanismos sin contenido: los textos y montos llegan como datos de OPS (`Cart.promotions`, `GET /storefront/promotions`, `carts.recommendations`).
@@ -566,7 +603,7 @@ La cookie, el formulario y el redirect son de la tienda; `safeRedirect` valida e
 | `defineSection`, `SectionRegistry`, `createSectionRegistry`, `Sections`, `resolveSectionProps`, `sectionJsonSchema` | Content sections |
 | `themeToCss`, `themeToCssVariables`, `ThemeStyle`, `themeFontsHref`, `tokenName` | SSR theme |
 | `ProductImage`, `ProductMockup`, `MockupProvider`, `createMockupRegistry`, `registerMockup`, `BUILTIN_MOCKUPS`, `MockupFrame`, `MockupText`, `TireMockup`, `PartMockup`, `SupplementMockup`, `GenericMockup` | Mockups de respaldo (subpath `/mockups`) |
-| `PaymentBrick`, `useEmbeddedPayment`, `VoucherCard`, `PaymentChallenge`, `createFetchTransport`, `mercadoPagoBricksAdapter`, `loadPaymentSdk`, `paymentCsp`, `readPaymentTheme` | Pago integrado (subpath `/payments`) |
+| `PaymentMethodSection`, `buildPayChoices`, `createEmbeddedPayHandlers` (`/payments/server`), `PaymentBrick`, `useEmbeddedPayment`, `VoucherCard`, `PaymentChallenge`, `createFetchTransport`, `mercadoPagoBricksAdapter`, `loadPaymentSdk`, `paymentCsp`, `readPaymentTheme` | Pago integrado (subpath `/payments`) |
 | `PromoPopup`, `CartProgressBars`, `PromoProgressBar`, `CrossSellModal`, `OrderNote`, `isExcludedPath`, `frequencyAllows`, `isCrawler` | Promociones y venta cruzada (subpath `/promotions`) |
 
 ## `@asteby/storefront-react/ui`

package/dist/choices-DEPE9KRq.d.cts

@@ -0,0 +1,130 @@
+import { PaymentClient, PaymentOptionKey, PaymentPoint, PaymentMethod, CheckoutResult, PaymentAttemptResult } from '@asteby/storefront';
+
+type PaymentCspOptions = {
+    /** Per-request nonce; also set it on the inserted `<script>` and on `<Scripts nonce>`. */
+    nonce?: string;
+    /** Extra origins by directive (e.g. your image CDN). */
+    extra?: {
+        script?: string[];
+        frame?: string[];
+        connect?: string[];
+        img?: string[];
+        form?: string[];
+    };
+    /** `report-uri` / `report-to` target for the report-only rollout. */
+    reportUri?: string;
+    /** Inline scripts allowed by hash (`'sha256-…'`), e.g. a theme bootstrap that runs before paint. */
+    scriptHashes?: string[];
+    /** Allow any https image source (product photos from a CDN). */
+    imgHttps?: boolean;
+};
+/**
+ * Builds the Content-Security-Policy for the payment routes from what each provider declares
+ * (`PaymentClient.csp`), so the shop never hard-codes provider hosts. Meant for `/pagar` only,
+ * never for the whole site. Roll out as `Content-Security-Policy-Report-Only` first.
+ *
+ * No SRI on purpose: provider SDK URLs are unversioned and a hash would break payments on any update.
+ */
+declare function paymentCsp(clients: readonly (PaymentClient | null | undefined)[], options?: PaymentCspOptions): string;
+/** `Content-Security-Policy` or, during the rollout week, `Content-Security-Policy-Report-Only`. */
+declare function paymentCspHeaderName(reportOnly: boolean): string;
+type PaymentCspMode = 'off' | 'report-only' | 'enforce';
+/** `PAYMENT_CSP`-style value: `off`, `report-only` or `enforce`. Unset: report-only in production, off elsewhere (dev servers inject scripts). */
+declare function paymentCspMode(value: string | null | undefined, production: boolean): PaymentCspMode;
+/** Fresh per-request nonce (128 bits, base64). Works in Node, edge and browsers. */
+declare function paymentNonce(): string;
+/** Header ready for the response (`{}` when `off`): policy from the providers' `client.csp`, never the whole site. */
+declare function paymentCspHeaders(clients: readonly (PaymentClient | null | undefined)[], options: PaymentCspOptions & {
+    mode: PaymentCspMode;
+}): Record<string, string>;
+/** The nonce the route left in the CSP header, to hand to `ServerRouter` / `<Scripts>`. */
+declare function paymentNonceFromHeaders(headers: Headers): string | undefined;
+
+/**
+ * "Payment method" rows for a hybrid checkout: pure functions, no DOM and no server, so the loader, the action and the
+ * browser share them.
+ *
+ * Rules (embedded-payment contract 1.2):
+ * - Rows come ONLY from what the server publishes (`payment-methods[].options` and `.client`). No provider names and no
+ *   amounts live here.
+ * - Card and cash are paid in the page; `wallet` and `credits` redirect to the provider.
+ * - Without `client`, or with the card flagged `redirect: true`, the server does not offer `embedded`: the shop falls
+ *   back to the usual redirect flow.
+ */
+
+/** One row of "Payment method". `value` is what travels in the form (`payment_choice`). */
+type PayChoice = {
+    value: string;
+    /** Server method key (`payment_method` of the checkout). */
+    methodKey: string;
+    /** Provider option; `null` for a method without options (the plain flow). */
+    option: PaymentOptionKey | null;
+    /** `card` (form in the page), `cash` (voucher), `redirect` (leaves to the gateway) or `plain`. */
+    mode: 'card' | 'cash' | 'redirect' | 'plain';
+    /** The provider's own text (`option.label`); the shop supplies its own when missing. */
+    label: string | null;
+    points: PaymentPoint[];
+    maxInstallments: number | null;
+};
+type PayChoices = {
+    choices: PayChoice[];
+    /** Public data to mount the card form; `null` when the server does not offer `embedded`. */
+    cardClient: PaymentClient | null;
+    defaultValue: string | null;
+};
+type BuildPayChoicesOptions = {
+    /** Method keys this shop never offers even when the server publishes them (e.g. a manual transfer). */
+    hide?: Iterable<string>;
+};
+declare function choiceValue(methodKey: string, option: PaymentOptionKey | null): string;
+/** `"mercadopago|card"` becomes method and option. A value without `|` is a method without options. */
+declare function parseChoice(value: string | null | undefined): {
+    methodKey: string;
+    option: PaymentOptionKey | null;
+} | null;
+/**
+ * Rows from `GET payment-methods`. A method with `options` unfolds into one row per option (server order); one without
+ * is a single plain row. `cardClient` only exists when the card is paid in the page.
+ */
+declare function buildPayChoices(methods: readonly PaymentMethod[], options?: BuildPayChoicesOptions): PayChoices;
+/** Chosen cash point becomes the cash `provider_data`, built on the server from the provider's list. */
+declare function cashProviderData(points: readonly PaymentPoint[], pointId: string | null | undefined): Record<string, string> | null;
+/**
+ * A checkout (`GET checkouts/:id`) as an attempt result, for polling a 3DS challenge or a payment under review.
+ * It only translates server states: it never decides a payment.
+ */
+declare function checkoutToAttempt(result: CheckoutResult): PaymentAttemptResult;
+/** Body `{ error: { code, message, details } }` that `createFetchTransport` understands. */
+type PayErrorBody = {
+    error: {
+        code: string;
+        message: string;
+        details?: unknown;
+    };
+};
+type ErrorLike = {
+    status?: number;
+    code?: string;
+    field?: string;
+    message?: string;
+    details?: unknown;
+};
+/**
+ * Server error becomes a JSON response for the browser. Keeps the codes the SDK knows how to read (`price_mismatch`,
+ * `payment_in_progress`, `expired`, `too_many_attempts`); the mock sends "in progress" in `field`, so that is checked too.
+ */
+declare function payErrorResponse(err: ErrorLike): {
+    status: number;
+    body: PayErrorBody;
+};
+type VoucherRowLabels = {
+    point: string;
+    reference: string;
+    clabe: string;
+    barcode: string;
+    expires: string;
+};
+/** Cookie receipt rows for a payment under review or with a voucher (shown on the thank-you page). */
+declare function voucherRows(voucher: NonNullable<NonNullable<PaymentAttemptResult['payment']['action']>['voucher']> | null | undefined, labels: VoucherRowLabels, locale: string): [label: string, value: string][];
+
+export { type BuildPayChoicesOptions as B, type PayChoice as P, type VoucherRowLabels as V, type PayChoices as a, type PayErrorBody as b, type PaymentCspMode as c, type PaymentCspOptions as d, buildPayChoices as e, cashProviderData as f, checkoutToAttempt as g, choiceValue as h, payErrorResponse as i, paymentCsp as j, paymentCspHeaderName as k, paymentCspHeaders as l, paymentCspMode as m, paymentNonce as n, paymentNonceFromHeaders as o, parseChoice as p, voucherRows as v };

package/dist/choices-DEPE9KRq.d.ts

@@ -0,0 +1,130 @@
+import { PaymentClient, PaymentOptionKey, PaymentPoint, PaymentMethod, CheckoutResult, PaymentAttemptResult } from '@asteby/storefront';
+
+type PaymentCspOptions = {
+    /** Per-request nonce; also set it on the inserted `<script>` and on `<Scripts nonce>`. */
+    nonce?: string;
+    /** Extra origins by directive (e.g. your image CDN). */
+    extra?: {
+        script?: string[];
+        frame?: string[];
+        connect?: string[];
+        img?: string[];
+        form?: string[];
+    };
+    /** `report-uri` / `report-to` target for the report-only rollout. */
+    reportUri?: string;
+    /** Inline scripts allowed by hash (`'sha256-…'`), e.g. a theme bootstrap that runs before paint. */
+    scriptHashes?: string[];
+    /** Allow any https image source (product photos from a CDN). */
+    imgHttps?: boolean;
+};
+/**
+ * Builds the Content-Security-Policy for the payment routes from what each provider declares
+ * (`PaymentClient.csp`), so the shop never hard-codes provider hosts. Meant for `/pagar` only,
+ * never for the whole site. Roll out as `Content-Security-Policy-Report-Only` first.
+ *
+ * No SRI on purpose: provider SDK URLs are unversioned and a hash would break payments on any update.
+ */
+declare function paymentCsp(clients: readonly (PaymentClient | null | undefined)[], options?: PaymentCspOptions): string;
+/** `Content-Security-Policy` or, during the rollout week, `Content-Security-Policy-Report-Only`. */
+declare function paymentCspHeaderName(reportOnly: boolean): string;
+type PaymentCspMode = 'off' | 'report-only' | 'enforce';
+/** `PAYMENT_CSP`-style value: `off`, `report-only` or `enforce`. Unset: report-only in production, off elsewhere (dev servers inject scripts). */
+declare function paymentCspMode(value: string | null | undefined, production: boolean): PaymentCspMode;
+/** Fresh per-request nonce (128 bits, base64). Works in Node, edge and browsers. */
+declare function paymentNonce(): string;
+/** Header ready for the response (`{}` when `off`): policy from the providers' `client.csp`, never the whole site. */
+declare function paymentCspHeaders(clients: readonly (PaymentClient | null | undefined)[], options: PaymentCspOptions & {
+    mode: PaymentCspMode;
+}): Record<string, string>;
+/** The nonce the route left in the CSP header, to hand to `ServerRouter` / `<Scripts>`. */
+declare function paymentNonceFromHeaders(headers: Headers): string | undefined;
+
+/**
+ * "Payment method" rows for a hybrid checkout: pure functions, no DOM and no server, so the loader, the action and the
+ * browser share them.
+ *
+ * Rules (embedded-payment contract 1.2):
+ * - Rows come ONLY from what the server publishes (`payment-methods[].options` and `.client`). No provider names and no
+ *   amounts live here.
+ * - Card and cash are paid in the page; `wallet` and `credits` redirect to the provider.
+ * - Without `client`, or with the card flagged `redirect: true`, the server does not offer `embedded`: the shop falls
+ *   back to the usual redirect flow.
+ */
+
+/** One row of "Payment method". `value` is what travels in the form (`payment_choice`). */
+type PayChoice = {
+    value: string;
+    /** Server method key (`payment_method` of the checkout). */
+    methodKey: string;
+    /** Provider option; `null` for a method without options (the plain flow). */
+    option: PaymentOptionKey | null;
+    /** `card` (form in the page), `cash` (voucher), `redirect` (leaves to the gateway) or `plain`. */
+    mode: 'card' | 'cash' | 'redirect' | 'plain';
+    /** The provider's own text (`option.label`); the shop supplies its own when missing. */
+    label: string | null;
+    points: PaymentPoint[];
+    maxInstallments: number | null;
+};
+type PayChoices = {
+    choices: PayChoice[];
+    /** Public data to mount the card form; `null` when the server does not offer `embedded`. */
+    cardClient: PaymentClient | null;
+    defaultValue: string | null;
+};
+type BuildPayChoicesOptions = {
+    /** Method keys this shop never offers even when the server publishes them (e.g. a manual transfer). */
+    hide?: Iterable<string>;
+};
+declare function choiceValue(methodKey: string, option: PaymentOptionKey | null): string;
+/** `"mercadopago|card"` becomes method and option. A value without `|` is a method without options. */
+declare function parseChoice(value: string | null | undefined): {
+    methodKey: string;
+    option: PaymentOptionKey | null;
+} | null;
+/**
+ * Rows from `GET payment-methods`. A method with `options` unfolds into one row per option (server order); one without
+ * is a single plain row. `cardClient` only exists when the card is paid in the page.
+ */
+declare function buildPayChoices(methods: readonly PaymentMethod[], options?: BuildPayChoicesOptions): PayChoices;
+/** Chosen cash point becomes the cash `provider_data`, built on the server from the provider's list. */
+declare function cashProviderData(points: readonly PaymentPoint[], pointId: string | null | undefined): Record<string, string> | null;
+/**
+ * A checkout (`GET checkouts/:id`) as an attempt result, for polling a 3DS challenge or a payment under review.
+ * It only translates server states: it never decides a payment.
+ */
+declare function checkoutToAttempt(result: CheckoutResult): PaymentAttemptResult;
+/** Body `{ error: { code, message, details } }` that `createFetchTransport` understands. */
+type PayErrorBody = {
+    error: {
+        code: string;
+        message: string;
+        details?: unknown;
+    };
+};
+type ErrorLike = {
+    status?: number;
+    code?: string;
+    field?: string;
+    message?: string;
+    details?: unknown;
+};
+/**
+ * Server error becomes a JSON response for the browser. Keeps the codes the SDK knows how to read (`price_mismatch`,
+ * `payment_in_progress`, `expired`, `too_many_attempts`); the mock sends "in progress" in `field`, so that is checked too.
+ */
+declare function payErrorResponse(err: ErrorLike): {
+    status: number;
+    body: PayErrorBody;
+};
+type VoucherRowLabels = {
+    point: string;
+    reference: string;
+    clabe: string;
+    barcode: string;
+    expires: string;
+};
+/** Cookie receipt rows for a payment under review or with a voucher (shown on the thank-you page). */
+declare function voucherRows(voucher: NonNullable<NonNullable<PaymentAttemptResult['payment']['action']>['voucher']> | null | undefined, labels: VoucherRowLabels, locale: string): [label: string, value: string][];
+
+export { type BuildPayChoicesOptions as B, type PayChoice as P, type VoucherRowLabels as V, type PayChoices as a, type PayErrorBody as b, type PaymentCspMode as c, type PaymentCspOptions as d, buildPayChoices as e, cashProviderData as f, checkoutToAttempt as g, choiceValue as h, payErrorResponse as i, paymentCsp as j, paymentCspHeaderName as k, paymentCspHeaders as l, paymentCspMode as m, paymentNonce as n, paymentNonceFromHeaders as o, parseChoice as p, voucherRows as v };

package/dist/chunk-ISEOCKIR.js

@@ -0,0 +1,160 @@
+// src/payments/csp.ts
+var ORIGIN = /^https:\/\/(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*(:\d{1,5})?$/i;
+function origins(...lists) {
+  const out = /* @__PURE__ */ new Set();
+  for (const list of lists) for (const o of list ?? []) if (ORIGIN.test(o)) out.add(o);
+  return [...out];
+}
+function paymentCsp(clients, options = {}) {
+  const list = clients.filter((c) => !!c);
+  const pick = (k) => list.map((c) => c.csp?.[k]);
+  const nonce = options.nonce && /^[A-Za-z0-9+/=_-]+$/.test(options.nonce) ? options.nonce : void 0;
+  const sdkOrigins = list.flatMap((c) => {
+    try {
+      const u = new URL(c.sdk_url);
+      return u.protocol === "https:" ? [u.origin] : [];
+    } catch {
+      return [];
+    }
+  });
+  const dir = (name, values) => `${name} ${values.join(" ")}`;
+  const parts = [
+    "default-src 'self'",
+    dir("script-src", ["'self'", ...(options.scriptHashes ?? []).filter((h) => /^'sha(256|384|512)-[A-Za-z0-9+/=]+'$/.test(h)), ...nonce ? [`'nonce-${nonce}'`] : [], ...origins(sdkOrigins, ...pick("script"), options.extra?.script)]),
+    dir("frame-src", origins(...pick("frame"), options.extra?.frame).length ? origins(...pick("frame"), options.extra?.frame) : ["'none'"]),
+    dir("connect-src", ["'self'", ...origins(...pick("connect"), options.extra?.connect)]),
+    dir("img-src", ["'self'", "data:", ...options.imgHttps ? ["https:"] : [], ...origins(...pick("img"), options.extra?.img)]),
+    "style-src 'self' 'unsafe-inline'",
+    dir("form-action", ["'self'", ...origins(...pick("form"), options.extra?.form)]),
+    "frame-ancestors 'none'",
+    "base-uri 'self'",
+    "object-src 'none'"
+  ];
+  if (options.reportUri && /^(https:\/\/|\/)[^\s;,]+$/.test(options.reportUri)) parts.push(`report-uri ${options.reportUri}`);
+  return parts.join("; ");
+}
+function paymentCspHeaderName(reportOnly) {
+  return reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy";
+}
+function paymentCspMode(value, production) {
+  const raw = (value ?? "").trim().toLowerCase();
+  if (raw === "off" || raw === "report-only" || raw === "enforce") return raw;
+  return production ? "report-only" : "off";
+}
+function paymentNonce() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function paymentCspHeaders(clients, options) {
+  if (options.mode === "off") return {};
+  return { [paymentCspHeaderName(options.mode === "report-only")]: paymentCsp(clients, options) };
+}
+function paymentNonceFromHeaders(headers) {
+  const csp = headers.get("Content-Security-Policy") ?? headers.get("Content-Security-Policy-Report-Only") ?? "";
+  return /'nonce-([A-Za-z0-9+/=_-]+)'/.exec(csp)?.[1];
+}
+
+// src/payments/choices.ts
+var SEP = "|";
+function choiceValue(methodKey, option) {
+  return option ? `${methodKey}${SEP}${option}` : methodKey;
+}
+function parseChoice(value) {
+  const raw = (value ?? "").trim();
+  if (!raw) return null;
+  const i = raw.lastIndexOf(SEP);
+  if (i === -1) return { methodKey: raw, option: null };
+  const option = raw.slice(i + 1);
+  if (option !== "card" && option !== "cash" && option !== "wallet" && option !== "credits") return null;
+  return { methodKey: raw.slice(0, i), option };
+}
+function modeOf(option) {
+  if (option.redirect || option.key === "wallet" || option.key === "credits") return "redirect";
+  return option.key === "cash" ? "cash" : "card";
+}
+function buildPayChoices(methods, options = {}) {
+  const hidden = new Set(options.hide ?? []);
+  const choices = [];
+  let cardClient = null;
+  let defaultValue = null;
+  for (const method of methods) {
+    if (hidden.has(method.key)) continue;
+    const opts = method.options ?? [];
+    if (opts.length === 0) {
+      const value = choiceValue(method.key, null);
+      choices.push({ value, methodKey: method.key, option: null, mode: "plain", label: null, points: [], maxInstallments: null });
+      if (method.default && !defaultValue) defaultValue = value;
+      continue;
+    }
+    opts.forEach((option, i) => {
+      const mode = modeOf(option);
+      const value = choiceValue(method.key, option.key);
+      choices.push({
+        value,
+        methodKey: method.key,
+        option: option.key,
+        mode,
+        label: option.label?.trim() || null,
+        points: option.key === "cash" ? option.points ?? [] : [],
+        maxInstallments: option.max_installments ?? null
+      });
+      if (mode === "card" && method.client && !cardClient) cardClient = method.client;
+      if (method.default && i === 0 && !defaultValue) defaultValue = value;
+    });
+  }
+  const usable = choices.map((c) => c.mode === "card" && !cardClient ? { ...c, mode: "redirect" } : c);
+  return { choices: usable, cardClient, defaultValue: defaultValue ?? usable[0]?.value ?? null };
+}
+function cashProviderData(points, pointId) {
+  const point = points.find((p) => p.id === pointId) ?? (pointId ? null : points[0]);
+  if (!point) return null;
+  return {
+    payment_method_id: point.payment_method_id,
+    ...point.payment_point ? { payment_point: point.payment_point } : {}
+  };
+}
+function checkoutToAttempt(result) {
+  const { checkout, payment, order } = result;
+  const action = payment.action ?? null;
+  const base = { checkout, ...order ? { order } : {} };
+  const status = (checkout.status ?? "").toLowerCase();
+  if (status === "paid" || status === "converted") return { ...base, payment: { provider: payment.provider, status: "paid", outcome: "approved" } };
+  if (status === "cancelled" || status === "canceled") return { ...base, payment: { provider: payment.provider, status: "cancelled" } };
+  if (status === "expired") return { ...base, payment: { provider: payment.provider, status: "expired" } };
+  if (status === "failed") {
+    const decline = payment.decline_code ?? "declined";
+    return { ...base, payment: { provider: payment.provider, status: "failed", outcome: "rejected", decline_code: decline, retryable: true } };
+  }
+  if (action?.type === "challenge") return { ...base, payment: { provider: payment.provider, status: "requires_action", outcome: "challenge", action } };
+  return { ...base, payment: { provider: payment.provider, status: "pending", outcome: "pending", action: action ?? { type: "none" } } };
+}
+function payErrorResponse(err) {
+  const status = typeof err.status === "number" && err.status >= 400 ? err.status : 503;
+  let code = err.code ?? "server_error";
+  if (status === 409 && err.field === "payment_in_progress") code = "payment_in_progress";
+  if (status === 429) code = "too_many_attempts";
+  if (status === 422 && err.field === "expected_total") code = "price_mismatch";
+  return { status, body: { error: { code, message: err.message ?? "", ...err.details !== void 0 ? { details: err.details } : {} } } };
+}
+function voucherRows(voucher, labels, locale) {
+  if (!voucher) return [];
+  const rows = [];
+  if (voucher.payment_point) rows.push([labels.point, String(voucher.payment_point).slice(0, 60)]);
+  if (voucher.reference) rows.push([labels.reference, String(voucher.reference).slice(0, 80)]);
+  if (voucher.clabe) rows.push([labels.clabe, String(voucher.clabe).slice(0, 40)]);
+  if (voucher.barcode) rows.push([labels.barcode, String(voucher.barcode).slice(0, 80)]);
+  if (voucher.expires_at) {
+    const d = new Date(voucher.expires_at);
+    if (!Number.isNaN(d.getTime())) {
+      rows.push([labels.expires, new Intl.DateTimeFormat(locale, { dateStyle: "long", timeStyle: "short", timeZone: "UTC" }).format(d) + " UTC"]);
+    }
+  }
+  return rows;
+}
+
+export { buildPayChoices, cashProviderData, checkoutToAttempt, choiceValue, parseChoice, payErrorResponse, paymentCsp, paymentCspHeaderName, paymentCspHeaders, paymentCspMode, paymentNonce, paymentNonceFromHeaders, voucherRows };
+//# sourceMappingURL=chunk-ISEOCKIR.js.map
+//# sourceMappingURL=chunk-ISEOCKIR.js.map

package/dist/chunk-ISEOCKIR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/payments/csp.ts","../src/payments/choices.ts"],"names":[],"mappings":";AAgBA,IAAM,MAAA,GAAS,gGAAA;AAEf,SAAS,WAAW,KAAA,EAAoD;AACtE,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAY;AAC5B,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,KAAA,MAAW,CAAA,IAAK,QAAQ,EAAC,EAAG,IAAI,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAG,GAAA,CAAI,IAAI,CAAC,CAAA;AACnF,EAAA,OAAO,CAAC,GAAG,GAAG,CAAA;AAChB;AASO,SAAS,UAAA,CAAW,OAAA,EAAwD,OAAA,GAA6B,EAAC,EAAW;AAC1H,EAAA,MAAM,OAAO,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAA0B,CAAC,CAAC,CAAC,CAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAA+C,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,GAAM,CAAC,CAAC,CAAA;AACvF,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,qBAAA,CAAsB,KAAK,OAAA,CAAQ,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,GAAQ,MAAA;AAC3F,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,KAAM;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,CAAA,CAAE,OAAO,CAAA;AAC3B,MAAA,OAAO,EAAE,QAAA,KAAa,QAAA,GAAW,CAAC,CAAA,CAAE,MAAM,IAAI,EAAC;AAAA,IACjD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAC;AAAA,IACV;AAAA,EACF,CAAC,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,EAAc,MAAA,KAAqB,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAC3E,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,oBAAA;AAAA,IACA,IAAI,YAAA,EAAc,CAAC,QAAA,EAAU,GAAA,CAAI,QAAQ,YAAA,IAAgB,EAAC,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,sCAAA,CAAuC,IAAA,CAAK,CAAC,CAAC,CAAA,EAAG,GAAI,KAAA,GAAQ,CAAC,UAAU,KAAK,CAAA,CAAA,CAAG,CAAA,GAAI,IAAK,GAAG,OAAA,CAAQ,UAAA,EAAY,GAAG,KAAK,QAAQ,CAAA,EAAG,QAAQ,KAAA,EAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IACrO,GAAA,CAAI,aAAa,OAAA,CAAQ,GAAG,KAAK,OAAO,CAAA,EAAG,OAAA,CAAQ,KAAA,EAAO,KAAK,CAAA,CAAE,SAAS,OAAA,CAAQ,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,OAAA,CAAQ,OAAO,KAAK,CAAA,GAAI,CAAC,QAAQ,CAAC,CAAA;AAAA,IACtI,GAAA,CAAI,aAAA,EAAe,CAAC,QAAA,EAAU,GAAG,OAAA,CAAQ,GAAG,IAAA,CAAK,SAAS,CAAA,EAAG,OAAA,CAAQ,KAAA,EAAO,OAAO,CAAC,CAAC,CAAA;AAAA,IACrF,GAAA,CAAI,WAAW,CAAC,QAAA,EAAU,SAAS,GAAI,OAAA,CAAQ,QAAA,GAAW,CAAC,QAAQ,CAAA,GAAI,EAAC,EAAI,GAAG,OAAA,CAAQ,GAAG,IAAA,CAAK,KAAK,GAAG,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAC,CAAC,CAAA;AAAA,IAC3H,kCAAA;AAAA,IACA,GAAA,CAAI,aAAA,EAAe,CAAC,QAAA,EAAU,GAAG,OAAA,CAAQ,GAAG,IAAA,CAAK,MAAM,CAAA,EAAG,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAC,CAAC,CAAA;AAAA,IAC/E,wBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,2BAAA,CAA4B,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,CAAA,WAAA,EAAc,OAAA,CAAQ,SAAS,CAAA,CAAE,CAAA;AAC1H,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAGO,SAAS,qBAAqB,UAAA,EAA6B;AAChE,EAAA,OAAO,aAAa,qCAAA,GAAwC,yBAAA;AAC9D;AAKO,SAAS,cAAA,CAAe,OAAkC,UAAA,EAAqC;AACpG,EAAA,MAAM,GAAA,GAAA,CAAO,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAC7C,EAAA,IAAI,QAAQ,KAAA,IAAS,GAAA,KAAQ,aAAA,IAAiB,GAAA,KAAQ,WAAW,OAAO,GAAA;AACxE,EAAA,OAAO,aAAa,aAAA,GAAgB,KAAA;AACtC;AAGO,SAAS,YAAA,GAAuB;AACrC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,IAAO,MAAA,CAAO,aAAa,CAAC,CAAA;AACnD,EAAA,OAAO,KAAK,GAAG,CAAA;AACjB;AAGO,SAAS,iBAAA,CACd,SACA,OAAA,EACwB;AACxB,EAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,KAAA,EAAO,OAAO,EAAC;AACpC,EAAA,OAAO,EAAE,CAAC,oBAAA,CAAqB,OAAA,CAAQ,IAAA,KAAS,aAAa,CAAC,GAAG,UAAA,CAAW,OAAA,EAAS,OAAO,CAAA,EAAE;AAChG;AAGO,SAAS,wBAAwB,OAAA,EAAsC;AAC5E,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,CAAI,yBAAyB,KAAK,OAAA,CAAQ,GAAA,CAAI,qCAAqC,CAAA,IAAK,EAAA;AAC5G,EAAA,OAAO,6BAAA,CAA8B,IAAA,CAAK,GAAG,CAAA,GAAI,CAAC,CAAA;AACpD;;;AChDA,IAAM,GAAA,GAAM,GAAA;AAEL,SAAS,WAAA,CAAY,WAAmB,MAAA,EAAyC;AACtF,EAAA,OAAO,SAAS,CAAA,EAAG,SAAS,GAAG,GAAG,CAAA,EAAG,MAAM,CAAA,CAAA,GAAK,SAAA;AAClD;AAGO,SAAS,YAAY,KAAA,EAAiG;AAC3H,EAAA,MAAM,GAAA,GAAA,CAAO,KAAA,IAAS,EAAA,EAAI,IAAA,EAAK;AAC/B,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,WAAA,CAAY,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,EAAA,EAAI,OAAO,EAAE,SAAA,EAAW,GAAA,EAAK,QAAQ,IAAA,EAAK;AACpD,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA;AAC9B,EAAA,IAAI,MAAA,KAAW,UAAU,MAAA,KAAW,MAAA,IAAU,WAAW,QAAA,IAAY,MAAA,KAAW,WAAW,OAAO,IAAA;AAClG,EAAA,OAAO,EAAE,SAAA,EAAW,GAAA,CAAI,MAAM,CAAA,EAAG,CAAC,GAAG,MAAA,EAAO;AAC9C;AAEA,SAAS,OAAO,MAAA,EAA0C;AACxD,EAAA,IAAI,MAAA,CAAO,YAAY,MAAA,CAAO,GAAA,KAAQ,YAAY,MAAA,CAAO,GAAA,KAAQ,WAAW,OAAO,UAAA;AACnF,EAAA,OAAO,MAAA,CAAO,GAAA,KAAQ,MAAA,GAAS,MAAA,GAAS,MAAA;AAC1C;AAMO,SAAS,eAAA,CAAgB,OAAA,EAAmC,OAAA,GAAkC,EAAC,EAAe;AACnH,EAAA,MAAM,SAAS,IAAI,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,EAAE,CAAA;AACzC,EAAA,MAAM,UAAuB,EAAC;AAC9B,EAAA,IAAI,UAAA,GAAmC,IAAA;AACvC,EAAA,IAAI,YAAA,GAA8B,IAAA;AAClC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,OAAA,IAAW,EAAC;AAChC,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,MAAA,CAAO,GAAA,EAAK,IAAI,CAAA;AAC1C,MAAA,OAAA,CAAQ,KAAK,EAAE,KAAA,EAAO,SAAA,EAAW,MAAA,CAAO,KAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,OAAO,IAAA,EAAM,MAAA,EAAQ,EAAC,EAAG,eAAA,EAAiB,MAAM,CAAA;AAC1H,MAAA,IAAI,MAAA,CAAO,OAAA,IAAW,CAAC,YAAA,EAAc,YAAA,GAAe,KAAA;AACpD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,CAAC,MAAA,EAAQ,CAAA,KAAM;AAC1B,MAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,MAAA,CAAO,GAAA,EAAK,OAAO,GAAG,CAAA;AAChD,MAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,QACX,KAAA;AAAA,QACA,WAAW,MAAA,CAAO,GAAA;AAAA,QAClB,QAAQ,MAAA,CAAO,GAAA;AAAA,QACf,IAAA;AAAA,QACA,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,IAAA,EAAK,IAAK,IAAA;AAAA,QAC/B,MAAA,EAAQ,OAAO,GAAA,KAAQ,MAAA,GAAU,OAAO,MAAA,IAAU,KAAM,EAAC;AAAA,QACzD,eAAA,EAAiB,OAAO,gBAAA,IAAoB;AAAA,OAC7C,CAAA;AACD,MAAA,IAAI,SAAS,MAAA,IAAU,MAAA,CAAO,UAAU,CAAC,UAAA,eAAyB,MAAA,CAAO,MAAA;AACzE,MAAA,IAAI,OAAO,OAAA,IAAW,CAAA,KAAM,CAAA,IAAK,CAAC,cAAc,YAAA,GAAe,KAAA;AAAA,IACjE,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAO,EAAE,IAAA,KAAS,MAAA,IAAU,CAAC,UAAA,GAAa,EAAE,GAAG,CAAA,EAAG,IAAA,EAAM,UAAA,KAAwB,CAAE,CAAA;AAC9G,EAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,UAAA,EAAY,YAAA,EAAc,gBAAgB,MAAA,CAAO,CAAC,CAAA,EAAG,KAAA,IAAS,IAAA,EAAK;AAC/F;AAGO,SAAS,gBAAA,CAAiB,QAAiC,OAAA,EAAmE;AACnI,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,OAAO,CAAA,KAAM,OAAA,GAAU,IAAA,GAAO,MAAA,CAAO,CAAC,CAAA,CAAA;AAChF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,OAAO;AAAA,IACL,mBAAmB,KAAA,CAAM,iBAAA;AAAA,IACzB,GAAI,MAAM,aAAA,GAAgB,EAAE,eAAe,KAAA,CAAM,aAAA,KAAkB;AAAC,GACtE;AACF;AAMO,SAAS,kBAAkB,MAAA,EAA8C;AAC9E,EAAA,MAAM,EAAE,QAAA,EAAU,OAAA,EAAS,KAAA,EAAM,GAAI,MAAA;AACrC,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,IAAA;AACjC,EAAA,MAAM,IAAA,GAAO,EAAE,QAAA,EAAU,GAAI,QAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAG;AACrD,EAAA,MAAM,MAAA,GAAA,CAAU,QAAA,CAAS,MAAA,IAAU,EAAA,EAAI,WAAA,EAAY;AACnD,EAAA,IAAI,WAAW,MAAA,IAAU,MAAA,KAAW,WAAA,EAAa,OAAO,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,EAAE,UAAU,OAAA,CAAQ,QAAA,EAAU,QAAQ,MAAA,EAAQ,OAAA,EAAS,YAAW,EAAE;AAChJ,EAAA,IAAI,MAAA,KAAW,WAAA,IAAe,MAAA,KAAW,UAAA,SAAmB,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ,aAAY,EAAE;AACpI,EAAA,IAAI,MAAA,KAAW,SAAA,EAAW,OAAO,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ,WAAU,EAAE;AACvG,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,MAAM,OAAA,GAAW,QAA+E,YAAA,IAAgB,UAAA;AAChH,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,EAAE,UAAU,OAAA,CAAQ,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,SAAS,UAAA,EAAY,YAAA,EAAc,OAAA,EAAS,SAAA,EAAW,MAAK,EAAE;AAAA,EAC3I;AAEA,EAAA,IAAI,QAAQ,IAAA,KAAS,WAAA,EAAa,OAAO,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,EAAE,QAAA,EAAU,QAAQ,QAAA,EAAU,MAAA,EAAQ,mBAAmB,OAAA,EAAS,WAAA,EAAa,QAAO,EAAE;AACrJ,EAAA,OAAO,EAAE,GAAG,IAAA,EAAM,SAAS,EAAE,QAAA,EAAU,QAAQ,QAAA,EAAU,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,WAAW,MAAA,EAAQ,MAAA,IAAU,EAAE,IAAA,EAAM,MAAA,IAAS,EAAE;AACvI;AAWO,SAAS,iBAAiB,GAAA,EAAwD;AACvF,EAAA,MAAM,MAAA,GAAS,OAAO,GAAA,CAAI,MAAA,KAAW,YAAY,GAAA,CAAI,MAAA,IAAU,GAAA,GAAM,GAAA,CAAI,MAAA,GAAS,GAAA;AAClF,EAAA,IAAI,IAAA,GAAO,IAAI,IAAA,IAAQ,cAAA;AACvB,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,KAAA,KAAU,uBAAuB,IAAA,GAAO,qBAAA;AAClE,EAAA,IAAI,MAAA,KAAW,KAAK,IAAA,GAAO,mBAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,KAAA,KAAU,kBAAkB,IAAA,GAAO,gBAAA;AAC7D,EAAA,OAAO,EAAE,QAAQ,IAAA,EAAM,EAAE,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,IAAW,EAAA,EAAI,GAAI,GAAA,CAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,GAAA,CAAI,SAAQ,GAAI,EAAC,EAAG,EAAE,EAAE;AACzI;AAKO,SAAS,WAAA,CACd,OAAA,EACA,MAAA,EACA,MAAA,EACkC;AAClC,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAC;AACtB,EAAA,MAAM,OAA2B,EAAC;AAClC,EAAA,IAAI,OAAA,CAAQ,aAAA,EAAe,IAAA,CAAK,IAAA,CAAK,CAAC,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,OAAA,CAAQ,aAAa,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA;AAC/F,EAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,IAAA,CAAK,IAAA,CAAK,CAAC,MAAA,CAAO,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA;AAC3F,EAAA,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,CAAC,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA;AAC/E,EAAA,IAAI,OAAA,CAAQ,OAAA,EAAS,IAAA,CAAK,IAAA,CAAK,CAAC,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAC,CAAA;AACrF,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAA,MAAM,CAAA,GAAI,IAAI,IAAA,CAAK,OAAA,CAAQ,UAAU,CAAA;AACrC,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,CAAA,CAAE,OAAA,EAAS,CAAA,EAAG;AAC9B,MAAA,IAAA,CAAK,IAAA,CAAK,CAAC,MAAA,CAAO,OAAA,EAAS,IAAI,IAAA,CAAK,cAAA,CAAe,QAAQ,EAAE,SAAA,EAAW,QAAQ,SAAA,EAAW,OAAA,EAAS,UAAU,KAAA,EAAO,EAAE,MAAA,CAAO,CAAC,CAAA,GAAI,MAAM,CAAC,CAAA;AAAA,IAC5I;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-ISEOCKIR.js","sourcesContent":["import type { PaymentClient } from '@asteby/storefront'\n\nexport type PaymentCspOptions = {\n  /** Per-request nonce; also set it on the inserted `<script>` and on `<Scripts nonce>`. */\n  nonce?: string\n  /** Extra origins by directive (e.g. your image CDN). */\n  extra?: { script?: string[]; frame?: string[]; connect?: string[]; img?: string[]; form?: string[] }\n  /** `report-uri` / `report-to` target for the report-only rollout. */\n  reportUri?: string\n  /** Inline scripts allowed by hash (`'sha256-…'`), e.g. a theme bootstrap that runs before paint. */\n  scriptHashes?: string[]\n  /** Allow any https image source (product photos from a CDN). */\n  imgHttps?: boolean\n}\n\n/** One origin source: `https://host`, `https://*.host`, optional port. Anything else (`;`, spaces, `'unsafe-eval'`) is dropped. */\nconst ORIGIN = /^https:\\/\\/(\\*\\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*(:\\d{1,5})?$/i\n\nfunction origins(...lists: (readonly string[] | undefined)[]): string[] {\n  const out = new Set<string>()\n  for (const list of lists) for (const o of list ?? []) if (ORIGIN.test(o)) out.add(o)\n  return [...out]\n}\n\n/**\n * Builds the Content-Security-Policy for the payment routes from what each provider declares\n * (`PaymentClient.csp`), so the shop never hard-codes provider hosts. Meant for `/pagar` only,\n * never for the whole site. Roll out as `Content-Security-Policy-Report-Only` first.\n *\n * No SRI on purpose: provider SDK URLs are unversioned and a hash would break payments on any update.\n */\nexport function paymentCsp(clients: readonly (PaymentClient | null | undefined)[], options: PaymentCspOptions = {}): string {\n  const list = clients.filter((c): c is PaymentClient => !!c)\n  const pick = (k: keyof NonNullable<PaymentClient['csp']>) => list.map((c) => c.csp?.[k])\n  const nonce = options.nonce && /^[A-Za-z0-9+/=_-]+$/.test(options.nonce) ? options.nonce : undefined\n  const sdkOrigins = list.flatMap((c) => {\n    try {\n      const u = new URL(c.sdk_url)\n      return u.protocol === 'https:' ? [u.origin] : []\n    } catch {\n      return []\n    }\n  })\n  const dir = (name: string, values: string[]) => `${name} ${values.join(' ')}`\n  const parts = [\n    \"default-src 'self'\",\n    dir('script-src', [\"'self'\", ...(options.scriptHashes ?? []).filter((h) => /^'sha(256|384|512)-[A-Za-z0-9+/=]+'$/.test(h)), ...(nonce ? [`'nonce-${nonce}'`] : []), ...origins(sdkOrigins, ...pick('script'), options.extra?.script)]),\n    dir('frame-src', origins(...pick('frame'), options.extra?.frame).length ? origins(...pick('frame'), options.extra?.frame) : [\"'none'\"]),\n    dir('connect-src', [\"'self'\", ...origins(...pick('connect'), options.extra?.connect)]),\n    dir('img-src', [\"'self'\", 'data:', ...(options.imgHttps ? ['https:'] : []), ...origins(...pick('img'), options.extra?.img)]),\n    \"style-src 'self' 'unsafe-inline'\",\n    dir('form-action', [\"'self'\", ...origins(...pick('form'), options.extra?.form)]),\n    \"frame-ancestors 'none'\",\n    \"base-uri 'self'\",\n    \"object-src 'none'\",\n  ]\n  if (options.reportUri && /^(https:\\/\\/|\\/)[^\\s;,]+$/.test(options.reportUri)) parts.push(`report-uri ${options.reportUri}`)\n  return parts.join('; ')\n}\n\n/** `Content-Security-Policy` or, during the rollout week, `Content-Security-Policy-Report-Only`. */\nexport function paymentCspHeaderName(reportOnly: boolean): string {\n  return reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy'\n}\n\nexport type PaymentCspMode = 'off' | 'report-only' | 'enforce'\n\n/** `PAYMENT_CSP`-style value: `off`, `report-only` or `enforce`. Unset: report-only in production, off elsewhere (dev servers inject scripts). */\nexport function paymentCspMode(value: string | null | undefined, production: boolean): PaymentCspMode {\n  const raw = (value ?? '').trim().toLowerCase()\n  if (raw === 'off' || raw === 'report-only' || raw === 'enforce') return raw\n  return production ? 'report-only' : 'off'\n}\n\n/** Fresh per-request nonce (128 bits, base64). Works in Node, edge and browsers. */\nexport function paymentNonce(): string {\n  const bytes = new Uint8Array(16)\n  crypto.getRandomValues(bytes)\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  return btoa(bin)\n}\n\n/** Header ready for the response (`{}` when `off`): policy from the providers' `client.csp`, never the whole site. */\nexport function paymentCspHeaders(\n  clients: readonly (PaymentClient | null | undefined)[],\n  options: PaymentCspOptions & { mode: PaymentCspMode },\n): Record<string, string> {\n  if (options.mode === 'off') return {}\n  return { [paymentCspHeaderName(options.mode === 'report-only')]: paymentCsp(clients, options) }\n}\n\n/** The nonce the route left in the CSP header, to hand to `ServerRouter` / `<Scripts>`. */\nexport function paymentNonceFromHeaders(headers: Headers): string | undefined {\n  const csp = headers.get('Content-Security-Policy') ?? headers.get('Content-Security-Policy-Report-Only') ?? ''\n  return /'nonce-([A-Za-z0-9+/=_-]+)'/.exec(csp)?.[1]\n}\n","/**\n * \"Payment method\" rows for a hybrid checkout: pure functions, no DOM and no server, so the loader, the action and the\n * browser share them.\n *\n * Rules (embedded-payment contract 1.2):\n * - Rows come ONLY from what the server publishes (`payment-methods[].options` and `.client`). No provider names and no\n *   amounts live here.\n * - Card and cash are paid in the page; `wallet` and `credits` redirect to the provider.\n * - Without `client`, or with the card flagged `redirect: true`, the server does not offer `embedded`: the shop falls\n *   back to the usual redirect flow.\n */\nimport type {\n  CheckoutResult,\n  PaymentAttemptResult,\n  PaymentClient,\n  PaymentMethod,\n  PaymentOption,\n  PaymentOptionKey,\n  PaymentPoint,\n} from '@asteby/storefront'\n\n/** One row of \"Payment method\". `value` is what travels in the form (`payment_choice`). */\nexport type PayChoice = {\n  value: string\n  /** Server method key (`payment_method` of the checkout). */\n  methodKey: string\n  /** Provider option; `null` for a method without options (the plain flow). */\n  option: PaymentOptionKey | null\n  /** `card` (form in the page), `cash` (voucher), `redirect` (leaves to the gateway) or `plain`. */\n  mode: 'card' | 'cash' | 'redirect' | 'plain'\n  /** The provider's own text (`option.label`); the shop supplies its own when missing. */\n  label: string | null\n  points: PaymentPoint[]\n  maxInstallments: number | null\n}\n\nexport type PayChoices = {\n  choices: PayChoice[]\n  /** Public data to mount the card form; `null` when the server does not offer `embedded`. */\n  cardClient: PaymentClient | null\n  defaultValue: string | null\n}\n\nexport type BuildPayChoicesOptions = {\n  /** Method keys this shop never offers even when the server publishes them (e.g. a manual transfer). */\n  hide?: Iterable<string>\n}\n\nconst SEP = '|'\n\nexport function choiceValue(methodKey: string, option: PaymentOptionKey | null): string {\n  return option ? `${methodKey}${SEP}${option}` : methodKey\n}\n\n/** `\"mercadopago|card\"` becomes method and option. A value without `|` is a method without options. */\nexport function parseChoice(value: string | null | undefined): { methodKey: string; option: PaymentOptionKey | null } | null {\n  const raw = (value ?? '').trim()\n  if (!raw) return null\n  const i = raw.lastIndexOf(SEP)\n  if (i === -1) return { methodKey: raw, option: null }\n  const option = raw.slice(i + 1)\n  if (option !== 'card' && option !== 'cash' && option !== 'wallet' && option !== 'credits') return null\n  return { methodKey: raw.slice(0, i), option }\n}\n\nfunction modeOf(option: PaymentOption): PayChoice['mode'] {\n  if (option.redirect || option.key === 'wallet' || option.key === 'credits') return 'redirect'\n  return option.key === 'cash' ? 'cash' : 'card'\n}\n\n/**\n * Rows from `GET payment-methods`. A method with `options` unfolds into one row per option (server order); one without\n * is a single plain row. `cardClient` only exists when the card is paid in the page.\n */\nexport function buildPayChoices(methods: readonly PaymentMethod[], options: BuildPayChoicesOptions = {}): PayChoices {\n  const hidden = new Set(options.hide ?? [])\n  const choices: PayChoice[] = []\n  let cardClient: PaymentClient | null = null\n  let defaultValue: string | null = null\n  for (const method of methods) {\n    if (hidden.has(method.key)) continue\n    const opts = method.options ?? []\n    if (opts.length === 0) {\n      const value = choiceValue(method.key, null)\n      choices.push({ value, methodKey: method.key, option: null, mode: 'plain', label: null, points: [], maxInstallments: null })\n      if (method.default && !defaultValue) defaultValue = value\n      continue\n    }\n    opts.forEach((option, i) => {\n      const mode = modeOf(option)\n      const value = choiceValue(method.key, option.key)\n      choices.push({\n        value,\n        methodKey: method.key,\n        option: option.key,\n        mode,\n        label: option.label?.trim() || null,\n        points: option.key === 'cash' ? (option.points ?? []) : [],\n        maxInstallments: option.max_installments ?? null,\n      })\n      if (mode === 'card' && method.client && !cardClient) cardClient = method.client\n      if (method.default && i === 0 && !defaultValue) defaultValue = value\n    })\n  }\n  // A card meant for the page but without `client` cannot be mounted: it is paid by redirect.\n  const usable = choices.map((c) => (c.mode === 'card' && !cardClient ? { ...c, mode: 'redirect' as const } : c))\n  return { choices: usable, cardClient, defaultValue: defaultValue ?? usable[0]?.value ?? null }\n}\n\n/** Chosen cash point becomes the cash `provider_data`, built on the server from the provider's list. */\nexport function cashProviderData(points: readonly PaymentPoint[], pointId: string | null | undefined): Record<string, string> | null {\n  const point = points.find((p) => p.id === pointId) ?? (pointId ? null : points[0])\n  if (!point) return null\n  return {\n    payment_method_id: point.payment_method_id,\n    ...(point.payment_point ? { payment_point: point.payment_point } : {}),\n  }\n}\n\n/**\n * A checkout (`GET checkouts/:id`) as an attempt result, for polling a 3DS challenge or a payment under review.\n * It only translates server states: it never decides a payment.\n */\nexport function checkoutToAttempt(result: CheckoutResult): PaymentAttemptResult {\n  const { checkout, payment, order } = result\n  const action = payment.action ?? null\n  const base = { checkout, ...(order ? { order } : {}) }\n  const status = (checkout.status ?? '').toLowerCase()\n  if (status === 'paid' || status === 'converted') return { ...base, payment: { provider: payment.provider, status: 'paid', outcome: 'approved' } }\n  if (status === 'cancelled' || status === 'canceled') return { ...base, payment: { provider: payment.provider, status: 'cancelled' } }\n  if (status === 'expired') return { ...base, payment: { provider: payment.provider, status: 'expired' } }\n  if (status === 'failed') {\n    const decline = (payment as { decline_code?: PaymentAttemptResult['payment']['decline_code'] }).decline_code ?? 'declined'\n    return { ...base, payment: { provider: payment.provider, status: 'failed', outcome: 'rejected', decline_code: decline, retryable: true } }\n  }\n  // Still pending: same as the last attempt left it (challenge or review), so the screen does not change.\n  if (action?.type === 'challenge') return { ...base, payment: { provider: payment.provider, status: 'requires_action', outcome: 'challenge', action } }\n  return { ...base, payment: { provider: payment.provider, status: 'pending', outcome: 'pending', action: action ?? { type: 'none' } } }\n}\n\n/** Body `{ error: { code, message, details } }` that `createFetchTransport` understands. */\nexport type PayErrorBody = { error: { code: string; message: string; details?: unknown } }\n\ntype ErrorLike = { status?: number; code?: string; field?: string; message?: string; details?: unknown }\n\n/**\n * Server error becomes a JSON response for the browser. Keeps the codes the SDK knows how to read (`price_mismatch`,\n * `payment_in_progress`, `expired`, `too_many_attempts`); the mock sends \"in progress\" in `field`, so that is checked too.\n */\nexport function payErrorResponse(err: ErrorLike): { status: number; body: PayErrorBody } {\n  const status = typeof err.status === 'number' && err.status >= 400 ? err.status : 503\n  let code = err.code ?? 'server_error'\n  if (status === 409 && err.field === 'payment_in_progress') code = 'payment_in_progress'\n  if (status === 429) code = 'too_many_attempts'\n  if (status === 422 && err.field === 'expected_total') code = 'price_mismatch'\n  return { status, body: { error: { code, message: err.message ?? '', ...(err.details !== undefined ? { details: err.details } : {}) } } }\n}\n\nexport type VoucherRowLabels = { point: string; reference: string; clabe: string; barcode: string; expires: string }\n\n/** Cookie receipt rows for a payment under review or with a voucher (shown on the thank-you page). */\nexport function voucherRows(\n  voucher: NonNullable<NonNullable<PaymentAttemptResult['payment']['action']>['voucher']> | null | undefined,\n  labels: VoucherRowLabels,\n  locale: string,\n): [label: string, value: string][] {\n  if (!voucher) return []\n  const rows: [string, string][] = []\n  if (voucher.payment_point) rows.push([labels.point, String(voucher.payment_point).slice(0, 60)])\n  if (voucher.reference) rows.push([labels.reference, String(voucher.reference).slice(0, 80)])\n  if (voucher.clabe) rows.push([labels.clabe, String(voucher.clabe).slice(0, 40)])\n  if (voucher.barcode) rows.push([labels.barcode, String(voucher.barcode).slice(0, 80)])\n  if (voucher.expires_at) {\n    const d = new Date(voucher.expires_at)\n    if (!Number.isNaN(d.getTime())) {\n      rows.push([labels.expires, new Intl.DateTimeFormat(locale, { dateStyle: 'long', timeStyle: 'short', timeZone: 'UTC' }).format(d) + ' UTC'])\n    }\n  }\n  return rows\n}\n"]}