@m2c/checkout 0.1.0

package/dist/client.js

@@ -0,0 +1,960 @@
+import { runAuction } from './auction.js';
+import { M2CCheckoutError } from './errors.js';
+import { DEFAULT_POLL_CONFIG, pollStatus, realPollDeps } from './poll.js';
+import { checkStatusForSource, resolveStatusSource } from './status.js';
+import { readAndClearResumeRecord, statusSourceRefFor, writeResumeRecord, } from './storage.js';
+import { UUID_RE, validateCheckoutUrl, validateUrl } from './validate.js';
+const DEFAULT_STORAGE_KEY = 'm2c.checkout';
+const POPUP_TARGET = 'm2c_checkout';
+const POPUP_FEATURES = 'popup=yes,width=520,height=720,resizable=yes,scrollbars=yes';
+const RETURN_BRIDGE_KEY = '__m2c_checkout_return__';
+const WINDOW_CLOSED_CHECK_INTERVAL_MS = 100;
+const WINDOW_CLOSED_OBSERVABILITY_GRACE_MS = 300;
+const WINDOW_CLOSED_AFTER_FOCUS_GRACE_MS = 500;
+const RETURN_RESULT_CHECK_INTERVAL_MS = 100;
+const WINDOW_CLOSED_BEFORE_LAUNCH_MESSAGE = 'checkout window was closed before launch';
+// Same-tab redirect tears down the page, so `start*` never resolves in that
+// execution context; the result is obtained from `resume()` on the return page.
+// Returning one shared never-settling promise keeps the documented
+// Promise<CheckoutResult> return type without leaking.
+const PENDING_UNTIL_REDIRECT = new Promise(() => { });
+/** Create a headless checkout client. Safe to import in SSR; lifecycle methods need a DOM. */
+export function createClient(config) {
+    return new CheckoutClientImpl(normalizeConfig(config));
+}
+class CheckoutClientImpl {
+    constructor(config, pollDeps = realPollDeps) {
+        this.config = config;
+        this.state = 'idle';
+        this.listeners = new Set();
+        this.pollDeps = pollDeps;
+    }
+    getState() {
+        return this.state;
+    }
+    onStateChange(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    async start(params) {
+        assertParamsObject(params, 'start params');
+        this.requireLaunchEnvironment();
+        this.requireIdle();
+        this.requireLaunchableStatusSource('client');
+        let launchWindow;
+        try {
+            launchWindow = this.prepareAsyncLaunchWindow();
+        }
+        catch (err) {
+            throw this.fail(err);
+        }
+        this.setState('creating');
+        let session;
+        try {
+            session = await runAuction(this.config, params);
+        }
+        catch (err) {
+            this.closeLaunchWindow(launchWindow);
+            throw this.fail(err);
+        }
+        this.requestId = session.requestId;
+        this.setState('ready');
+        const returnResult = this.waitForReturnResult(session.requestId);
+        try {
+            this.persistAndLaunch('client', session.checkoutUrl, session.requestId, session.ttl, launchWindow);
+            returnResult.watchWindowClosed(launchWindow);
+        }
+        catch (err) {
+            if (isCheckoutWindowClosedBeforeLaunchError(err)) {
+                this.closeLaunchWindow(launchWindow);
+                returnResult.resolveWindowClosed();
+                return returnResult.promise;
+            }
+            returnResult.cancel();
+            this.closeLaunchWindow(launchWindow);
+            throw this.fail(err);
+        }
+        return returnResult.promise;
+    }
+    async startFromSession(params) {
+        assertParamsObject(params, 'startFromSession params');
+        this.requireLaunchEnvironment();
+        this.requireIdle();
+        if (typeof params.requestId !== 'string' || !UUID_RE.test(params.requestId)) {
+            throw new M2CCheckoutError('InvalidRequest', 'requestId must be a canonical UUID');
+        }
+        const checkoutUrl = validateCheckoutUrl(params.checkoutUrl, 'checkoutUrl', this.config.allowInsecureUrls);
+        if (params.ttl !== undefined && (typeof params.ttl !== 'number' || !Number.isFinite(params.ttl))) {
+            throw new M2CCheckoutError('InvalidRequest', 'ttl must be a finite number when supplied');
+        }
+        // Backend-initiated mode cannot re-mint a session, so an already-expired
+        // ttl is terminal here (unlike client-initiated start, which re-runs).
+        if (params.ttl !== undefined && params.ttl <= 0) {
+            throw new M2CCheckoutError('CheckoutExpired', 'the checkout session has expired; create a new one');
+        }
+        this.requireLaunchableStatusSource('session');
+        let launchWindow;
+        try {
+            launchWindow = this.prepareAsyncLaunchWindow();
+        }
+        catch (err) {
+            throw this.fail(err);
+        }
+        this.requestId = params.requestId;
+        this.setState('ready');
+        const returnResult = this.waitForReturnResult(params.requestId);
+        try {
+            this.persistAndLaunch('session', checkoutUrl, params.requestId, params.ttl, launchWindow);
+            returnResult.watchWindowClosed(launchWindow);
+        }
+        catch (err) {
+            if (isCheckoutWindowClosedBeforeLaunchError(err)) {
+                this.closeLaunchWindow(launchWindow);
+                returnResult.resolveWindowClosed();
+                return returnResult.promise;
+            }
+            returnResult.cancel();
+            this.closeLaunchWindow(launchWindow);
+            throw this.fail(err);
+        }
+        return returnResult.promise;
+    }
+    async resume(params = {}) {
+        assertParamsObject(params, 'resume params');
+        const outcome = params.outcome ?? 'success';
+        if (outcome !== 'success' && outcome !== 'cancel') {
+            throw new M2CCheckoutError('InvalidRequest', 'resume outcome must be success or cancel');
+        }
+        this.requireStorage();
+        const storage = this.config.storage;
+        let record;
+        try {
+            record = readAndClearResumeRecord(storage, this.config.storageKey);
+        }
+        catch (err) {
+            throw this.fail(err);
+        }
+        if (!record) {
+            return null;
+        }
+        this.requestId = record.requestId;
+        this.setState('returned');
+        if (outcome === 'cancel') {
+            // A cancel return is authoritative on its own; no poll needed.
+            this.setState('canceled');
+            const result = { status: 'canceled', requestId: record.requestId };
+            this.publishReturnResult(result);
+            return result;
+        }
+        let checkStatus;
+        try {
+            checkStatus = resolveStatusSource(record.statusSourceRef, this.config, params.statusSource);
+        }
+        catch (err) {
+            throw this.fail(err);
+        }
+        this.setState('polling');
+        let status;
+        try {
+            status = await pollStatus(checkStatus, record.requestId, this.config.poll, this.pollDeps);
+        }
+        catch (err) {
+            throw this.fail(err);
+        }
+        const result = resultForStatus(status, record.requestId);
+        this.setState(result.status);
+        this.publishReturnResult(result);
+        return result;
+    }
+    async checkStatus(requestId) {
+        if (typeof requestId !== 'string' || !UUID_RE.test(requestId)) {
+            throw new M2CCheckoutError('InvalidRequest', 'requestId must be a canonical UUID');
+        }
+        // One-shot read via the configured status source. Deliberately leaves
+        // lifecycle state untouched: this reconciles an arbitrary requestId (e.g.
+        // a window_closed / pending_timeout that later completed), not a checkout
+        // flow. The webhook remains the source of truth; this read is advisory.
+        const read = checkStatusForSource(this.config.statusSource, this.config);
+        return read(requestId);
+    }
+    persistAndLaunch(mode, checkoutUrl, requestId, ttl, launchWindow) {
+        const record = {
+            v: 1,
+            requestId,
+            mode,
+            launchMode: this.config.launchMode,
+            statusSourceRef: statusSourceRefFor(this.config.statusSource),
+            startedAt: this.pollDeps.now(),
+            ...(ttl !== undefined ? { ttl } : {}),
+        };
+        if (this.config.launchMode !== 'redirect' && launchWindow && isWindowClosed(launchWindow)) {
+            throw checkoutWindowClosedBeforeLaunchError();
+        }
+        writeResumeRecord(this.config.storage, this.config.storageKey, record);
+        this.setState('launching');
+        this.setState('awaiting_return');
+        try {
+            this.launchCheckout(checkoutUrl, launchWindow);
+        }
+        catch (err) {
+            try {
+                this.config.storage.removeItem(this.config.storageKey);
+            }
+            catch {
+                // The resume record is only useful after checkout launch succeeds.
+            }
+            throw err;
+        }
+    }
+    prepareAsyncLaunchWindow() {
+        if (this.config.launchMode === 'redirect') {
+            return undefined;
+        }
+        return this.openBlankCheckoutWindow();
+    }
+    waitForReturnResult(requestId) {
+        if (this.config.launchMode === 'redirect') {
+            return {
+                promise: PENDING_UNTIL_REDIRECT,
+                cancel: () => { },
+                resolveWindowClosed: () => { },
+                watchWindowClosed: () => { },
+            };
+        }
+        return listenForReturnResult(this.config.storageKey, requestId, this.config.storage, this.config.returnTimeoutMs, (result) => {
+            this.requestId = result.requestId;
+            if (result.status !== 'window_closed') {
+                try {
+                    this.config.storage?.removeItem(this.config.storageKey);
+                }
+                catch {
+                    // Stale-resume cleanup is best effort; the browser outcome still resolves.
+                }
+                this.setState('returned');
+            }
+            this.setState(result.status);
+        });
+    }
+    publishReturnResult(result) {
+        publishReturnResult(this.config.storageKey, result, this.config.storage);
+    }
+    launchCheckout(checkoutUrl, launchWindow) {
+        if (this.config.launchMode === 'redirect') {
+            this.config.navigate(checkoutUrl);
+            return;
+        }
+        const win = launchWindow ?? this.openBlankCheckoutWindow();
+        navigateWindow(win, checkoutUrl);
+    }
+    openBlankCheckoutWindow() {
+        const target = launchTargetFor(this.config.launchMode);
+        const features = launchFeaturesFor(this.config.launchMode);
+        const win = features === undefined
+            ? this.config.openWindow('about:blank', target)
+            : this.config.openWindow('about:blank', target, features);
+        if (!win) {
+            throw new M2CCheckoutError('InvalidRequest', 'checkout window was blocked; call start from a user gesture or use launchMode: "redirect"');
+        }
+        clearOpener(win);
+        return win;
+    }
+    closeLaunchWindow(win) {
+        if (!win) {
+            return;
+        }
+        try {
+            win.close();
+        }
+        catch {
+            // Best effort cleanup for an empty placeholder window after launch fails.
+        }
+    }
+    setState(state, extra = {}) {
+        this.state = state;
+        const ctx = { requestId: this.requestId, ...extra };
+        for (const listener of this.listeners) {
+            // One listener throwing must not abort the transition for the others or
+            // for the SDK's own state-machine progression.
+            try {
+                listener(state, ctx);
+            }
+            catch {
+                // Swallow: rendering errors are the merchant's to handle, not ours.
+            }
+        }
+    }
+    fail(err) {
+        const error = checkoutErrorFromUnknown(err);
+        this.setState('error', { error });
+        return error;
+    }
+    requireIdle() {
+        if (this.state !== 'idle') {
+            throw new M2CCheckoutError('InvalidRequest', `a checkout is already in progress (state: ${this.state}); create a new client`);
+        }
+    }
+    requireStorage() {
+        if (!this.config.storage) {
+            if (this.config.launchMode !== 'redirect') {
+                throw new M2CCheckoutError('InvalidRequest', '@m2c/checkout requires localStorage for popup/new_tab launch mode; use launchMode: "redirect" or inject config.storage');
+            }
+            throw new M2CCheckoutError('InvalidRequest', '@m2c/checkout requires sessionStorage; run in a browser or inject config.storage');
+        }
+    }
+    requireLaunchEnvironment() {
+        this.requireStorage();
+        if (this.config.launchMode === 'redirect' && !this.config.navigate) {
+            throw new M2CCheckoutError('InvalidRequest', '@m2c/checkout requires navigation; run in a browser or inject config.navigate');
+        }
+        if (this.config.launchMode !== 'redirect' && !this.config.openWindow) {
+            throw new M2CCheckoutError('InvalidRequest', '@m2c/checkout requires window.open for popup launch; run in a browser or inject config.openWindow');
+        }
+    }
+    requireLaunchableStatusSource(mode) {
+        if (this.config.statusSource.kind === 'subscribe') {
+            throw new M2CCheckoutError('InvalidRequest', 'the subscribe status source is not supported yet; use m2c, url, or callback');
+        }
+        if (mode === 'session' && this.config.statusSource.kind === 'm2c' && !this.config.publishableKey) {
+            throw new M2CCheckoutError('InvalidRequest', 'backend-initiated checkout requires a statusSource other than m2c, or a publishableKey for m2c status polling');
+        }
+    }
+}
+function resultForStatus(status, requestId) {
+    switch (status) {
+        case 'completed':
+            return { status: 'completed', requestId };
+        case 'failed':
+            return { status: 'failed', requestId };
+        case 'canceled':
+            return { status: 'canceled', requestId };
+        default:
+            // The poll window elapsed while still processing; the webhook is the truth.
+            return { status: 'pending_timeout', requestId };
+    }
+}
+function assertParamsObject(value, name) {
+    if (typeof value !== 'object' || value === null) {
+        throw new M2CCheckoutError('InvalidRequest', `${name} must be an object`);
+    }
+}
+function checkoutErrorFromUnknown(err) {
+    if (err instanceof M2CCheckoutError) {
+        return err;
+    }
+    return new M2CCheckoutError('Unknown', err?.message ?? 'unknown error', { cause: err });
+}
+function launchTargetFor(mode) {
+    return mode === 'popup' ? POPUP_TARGET : '_blank';
+}
+function launchFeaturesFor(mode) {
+    return mode === 'popup' ? POPUP_FEATURES : undefined;
+}
+function clearOpener(win) {
+    try {
+        win.opener = null;
+    }
+    catch {
+        // Some browsers expose opener as read-only on WindowProxy.
+    }
+}
+function navigateWindow(win, url) {
+    if (win.closed) {
+        throw checkoutWindowClosedBeforeLaunchError();
+    }
+    try {
+        win.location.assign(url);
+    }
+    catch {
+        win.location.href = url;
+    }
+}
+function returnBridgeName(storageKey) {
+    return `${RETURN_BRIDGE_KEY}:${storageKey}`;
+}
+function listenForReturnResult(storageKey, requestId, storage, returnTimeoutMs, onResult) {
+    let settled = false;
+    let channel;
+    let removeStorageListener;
+    let removeWindowClosedListener;
+    let removeFocusListener;
+    let storedResultTimer;
+    let returnTimeout;
+    let focusWindowClosedTimer;
+    let resolveResult;
+    const cleanup = () => {
+        try {
+            channel?.close();
+        }
+        catch { }
+        removeStorageListener?.();
+        removeWindowClosedListener?.();
+        removeFocusListener?.();
+        if (storedResultTimer) {
+            globalThis.clearInterval(storedResultTimer);
+        }
+        if (returnTimeout) {
+            globalThis.clearTimeout(returnTimeout);
+        }
+        if (focusWindowClosedTimer) {
+            globalThis.clearTimeout(focusWindowClosedTimer);
+        }
+    };
+    const settle = (result) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        cleanup();
+        removeStoredReturnResult(storageKey, requestId, storage);
+        onResult(result);
+        resolveResult(result);
+    };
+    const settleWindowClosed = () => {
+        const stored = readStoredReturnMessage(storageKey, storage);
+        if (stored && stored.storageKey === storageKey && stored.requestId === requestId) {
+            settle(stored.result);
+            return;
+        }
+        settle({ status: 'window_closed', requestId });
+    };
+    const scheduleWindowClosedAfterFocus = () => {
+        if (settled || focusWindowClosedTimer) {
+            return;
+        }
+        focusWindowClosedTimer = globalThis.setTimeout(() => {
+            focusWindowClosedTimer = undefined;
+            settleWindowClosed();
+        }, WINDOW_CLOSED_AFTER_FOCUS_GRACE_MS);
+    };
+    const watchFocusForWindowClosed = () => {
+        if (settled || removeFocusListener) {
+            return;
+        }
+        removeFocusListener = listenForOpenerFocus(scheduleWindowClosedAfterFocus);
+        if (isOpenerFocused()) {
+            scheduleWindowClosedAfterFocus();
+        }
+    };
+    const handleMessage = (value) => {
+        const message = parseReturnBridgeMessage(value);
+        if (!message || message.storageKey !== storageKey || message.requestId !== requestId) {
+            return;
+        }
+        settle(message.result);
+    };
+    const promise = new Promise((resolve) => {
+        resolveResult = resolve;
+    });
+    channel = openReturnBridgeChannel(storageKey);
+    if (channel) {
+        channel.onmessage = (event) => {
+            handleMessage(event.data);
+        };
+    }
+    removeStorageListener = listenForReturnStorageEvent(storageKey, handleMessage);
+    storedResultTimer = globalThis.setInterval(() => {
+        handleMessage(readStoredReturnMessage(storageKey, storage));
+    }, RETURN_RESULT_CHECK_INTERVAL_MS);
+    handleMessage(readStoredReturnMessage(storageKey, storage));
+    if (returnTimeoutMs !== undefined) {
+        returnTimeout = globalThis.setTimeout(() => {
+            settleWindowClosed();
+        }, returnTimeoutMs);
+    }
+    return {
+        promise,
+        cancel: () => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+        },
+        resolveWindowClosed: () => {
+            settleWindowClosed();
+        },
+        watchWindowClosed: (win) => {
+            if (!win || settled) {
+                return;
+            }
+            removeWindowClosedListener?.();
+            removeWindowClosedListener = listenForWindowClosed(win, settleWindowClosed, watchFocusForWindowClosed);
+        },
+    };
+}
+function publishReturnResult(storageKey, result, storage) {
+    const message = { v: 1, storageKey, requestId: result.requestId, result };
+    const key = returnBridgeName(storageKey);
+    const serialized = JSON.stringify(message);
+    const channel = openReturnBridgeChannel(storageKey);
+    try {
+        storage?.setItem(key, serialized);
+    }
+    catch {
+        // BroadcastChannel or browser localStorage may still deliver the result.
+    }
+    try {
+        globalThis.localStorage.setItem(key, serialized);
+    }
+    catch {
+        // BroadcastChannel may still deliver the result.
+    }
+    try {
+        channel?.postMessage(message);
+    }
+    catch { }
+    globalThis.setTimeout(() => {
+        try {
+            channel?.close();
+        }
+        catch { }
+    }, 0);
+}
+function openReturnBridgeChannel(storageKey) {
+    try {
+        if (typeof globalThis.BroadcastChannel === 'function') {
+            return new globalThis.BroadcastChannel(returnBridgeName(storageKey));
+        }
+    }
+    catch { }
+    return undefined;
+}
+function listenForReturnStorageEvent(storageKey, onMessage) {
+    try {
+        if (typeof globalThis.addEventListener !== 'function') {
+            return undefined;
+        }
+        const key = returnBridgeName(storageKey);
+        const listener = (event) => {
+            if (event.key === key && event.newValue) {
+                onMessage(event.newValue);
+            }
+        };
+        globalThis.addEventListener('storage', listener);
+        return () => {
+            try {
+                globalThis.removeEventListener('storage', listener);
+            }
+            catch { }
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function readStoredReturnMessage(storageKey, storage) {
+    const key = returnBridgeName(storageKey);
+    try {
+        const message = parseReturnBridgeMessage(storage?.getItem(key));
+        if (message) {
+            return message;
+        }
+    }
+    catch {
+        // Fall back to browser localStorage below.
+    }
+    try {
+        return parseReturnBridgeMessage(globalThis.localStorage.getItem(key));
+    }
+    catch {
+        return null;
+    }
+}
+function removeStoredReturnResult(storageKey, requestId, storage) {
+    const key = returnBridgeName(storageKey);
+    try {
+        const message = parseReturnBridgeMessage(storage?.getItem(key));
+        if (message?.requestId === requestId) {
+            storage?.removeItem(key);
+        }
+    }
+    catch {
+        // Best effort cleanup for the injected durable return handoff.
+    }
+    try {
+        const message = parseReturnBridgeMessage(globalThis.localStorage.getItem(key));
+        if (message?.requestId === requestId) {
+            globalThis.localStorage.removeItem(key);
+        }
+    }
+    catch {
+        // Best effort cleanup for the durable return handoff.
+    }
+}
+function parseReturnBridgeMessage(value) {
+    let parsed = value;
+    if (typeof value === 'string') {
+        try {
+            parsed = JSON.parse(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return null;
+    }
+    const message = parsed;
+    if (message.v !== 1 || typeof message.storageKey !== 'string' || typeof message.requestId !== 'string') {
+        return null;
+    }
+    if (!isCheckoutResult(message.result) || message.result.requestId !== message.requestId) {
+        return null;
+    }
+    return {
+        v: 1,
+        storageKey: message.storageKey,
+        requestId: message.requestId,
+        result: message.result,
+    };
+}
+function isCheckoutResult(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const result = value;
+    return (typeof result.requestId === 'string' &&
+        (result.status === 'completed' ||
+            result.status === 'failed' ||
+            result.status === 'canceled' ||
+            result.status === 'pending_timeout' ||
+            result.status === 'window_closed'));
+}
+function listenForWindowClosed(win, onClosed, onUnobservable) {
+    let stopped = false;
+    let armed = false;
+    let timer;
+    let armTimer;
+    const stop = () => {
+        if (stopped) {
+            return;
+        }
+        stopped = true;
+        globalThis.clearInterval(timer);
+        globalThis.clearTimeout(armTimer);
+    };
+    const check = () => {
+        if (stopped) {
+            return;
+        }
+        const closed = isWindowClosed(win);
+        if (!armed) {
+            if (closed) {
+                // Some hosted checkout pages sever opener observability during launch,
+                // making WindowProxy.closed look true while the tab is still alive.
+                stop();
+                onUnobservable();
+            }
+            return;
+        }
+        if (!closed) {
+            return;
+        }
+        stop();
+        onClosed();
+    };
+    timer = globalThis.setInterval(check, WINDOW_CLOSED_CHECK_INTERVAL_MS);
+    armTimer = globalThis.setTimeout(() => {
+        if (stopped) {
+            return;
+        }
+        if (isWindowClosed(win)) {
+            stop();
+            onUnobservable();
+            return;
+        }
+        armed = true;
+    }, WINDOW_CLOSED_OBSERVABILITY_GRACE_MS);
+    check();
+    return stop;
+}
+function listenForOpenerFocus(onFocus) {
+    try {
+        if (typeof globalThis.addEventListener !== 'function') {
+            return () => { };
+        }
+        globalThis.addEventListener('focus', onFocus);
+        globalThis.addEventListener('pageshow', onFocus);
+        const doc = globalThis.document;
+        let visibilityListener;
+        if (doc && typeof doc.addEventListener === 'function') {
+            visibilityListener = () => {
+                if (doc.visibilityState === 'visible') {
+                    onFocus();
+                }
+            };
+            doc.addEventListener('visibilitychange', visibilityListener);
+        }
+        return () => {
+            try {
+                globalThis.removeEventListener('focus', onFocus);
+                globalThis.removeEventListener('pageshow', onFocus);
+                if (visibilityListener && doc && typeof doc.removeEventListener === 'function') {
+                    doc.removeEventListener('visibilitychange', visibilityListener);
+                }
+            }
+            catch { }
+        };
+    }
+    catch {
+        return () => { };
+    }
+}
+function isOpenerFocused() {
+    try {
+        const doc = globalThis.document;
+        if (doc?.visibilityState === 'hidden') {
+            return false;
+        }
+        if (typeof doc?.hasFocus === 'function') {
+            return doc.hasFocus();
+        }
+    }
+    catch { }
+    return false;
+}
+function isWindowClosed(win) {
+    try {
+        return win.closed;
+    }
+    catch {
+        return false;
+    }
+}
+function checkoutWindowClosedBeforeLaunchError() {
+    return new M2CCheckoutError('InvalidRequest', WINDOW_CLOSED_BEFORE_LAUNCH_MESSAGE);
+}
+function isCheckoutWindowClosedBeforeLaunchError(err) {
+    return (err instanceof M2CCheckoutError &&
+        err.code === 'InvalidRequest' &&
+        err.message === WINDOW_CLOSED_BEFORE_LAUNCH_MESSAGE);
+}
+function normalizeConfig(config) {
+    if (!config || typeof config.baseUrl !== 'string' || config.baseUrl === '') {
+        throw new M2CCheckoutError('InvalidRequest', 'baseUrl is required');
+    }
+    const allowInsecureUrls = config.allowInsecureUrls ?? false;
+    // Validate the base URL up front so a misconfiguration surfaces at construction.
+    validateUrl(config.baseUrl, 'baseUrl', allowInsecureUrls);
+    const baseUrl = config.baseUrl.replace(/\/+$/, '');
+    const launchMode = normalizeLaunchMode(config.launchMode);
+    const statusSource = normalizeStatusSource(config.statusSource ?? { kind: 'm2c' });
+    const poll = normalizePollConfig(config.poll);
+    const returnTimeoutMs = normalizeReturnTimeoutMs(config.returnTimeoutMs);
+    const fetchImpl = config.fetch ??
+        (typeof globalThis.fetch === 'function' ? globalThis.fetch.bind(globalThis) : undefined);
+    return {
+        baseUrl,
+        publishableKey: config.publishableKey,
+        statusSource,
+        poll,
+        storageKey: config.storageKey ?? DEFAULT_STORAGE_KEY,
+        fetch: fetchImpl,
+        storage: config.storage ?? defaultStorage(launchMode !== 'redirect'),
+        navigate: config.navigate ?? defaultNavigate(),
+        launchMode,
+        openWindow: config.openWindow ?? defaultOpenWindow(),
+        returnTimeoutMs,
+        allowInsecureUrls,
+    };
+}
+function normalizeLaunchMode(mode) {
+    if (mode === undefined) {
+        return 'redirect';
+    }
+    if (mode === 'redirect' || mode === 'new_tab' || mode === 'popup') {
+        return mode;
+    }
+    throw new M2CCheckoutError('InvalidRequest', 'launchMode must be redirect, new_tab, or popup');
+}
+function normalizeStatusSource(source) {
+    if (typeof source !== 'object' || source === null) {
+        throw new M2CCheckoutError('InvalidRequest', 'statusSource must be an object');
+    }
+    const s = source;
+    switch (s.kind) {
+        case 'm2c':
+            return { kind: 'm2c' };
+        case 'url':
+            if (typeof s.template !== 'string' || s.template === '') {
+                throw new M2CCheckoutError('InvalidRequest', 'statusSource.template must be a non-empty string');
+            }
+            return { kind: 'url', template: s.template };
+        case 'callback':
+            if (typeof s.checkStatus !== 'function') {
+                throw new M2CCheckoutError('InvalidRequest', 'statusSource.checkStatus must be a function');
+            }
+            return { kind: 'callback', checkStatus: s.checkStatus };
+        case 'subscribe':
+            if (typeof s.subscribe !== 'function') {
+                throw new M2CCheckoutError('InvalidRequest', 'statusSource.subscribe must be a function');
+            }
+            return { kind: 'subscribe', subscribe: s.subscribe };
+        default:
+            throw new M2CCheckoutError('InvalidRequest', 'statusSource.kind is not recognized');
+    }
+}
+function normalizePollConfig(overrides) {
+    const poll = { ...DEFAULT_POLL_CONFIG, ...(overrides ?? {}) };
+    assertPollNumber(poll.firstDelayMs, 'firstDelayMs', 1);
+    assertPollNumber(poll.maxDelayMs, 'maxDelayMs', 1);
+    assertPollNumber(poll.factor, 'factor', 1);
+    assertPollNumber(poll.windowMs, 'windowMs', 1);
+    if (poll.maxDelayMs < poll.firstDelayMs) {
+        throw new M2CCheckoutError('InvalidRequest', 'poll.maxDelayMs must be greater than or equal to poll.firstDelayMs');
+    }
+    return poll;
+}
+function assertPollNumber(value, name, min) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value < min) {
+        throw new M2CCheckoutError('InvalidRequest', `poll.${name} must be a finite number >= ${min}`);
+    }
+}
+function normalizeReturnTimeoutMs(value) {
+    if (value === undefined || value === 0) {
+        return undefined;
+    }
+    if (typeof value !== 'number' || !Number.isFinite(value) || value < 1) {
+        throw new M2CCheckoutError('InvalidRequest', 'returnTimeoutMs must be a finite number >= 1, or 0 to disable');
+    }
+    return value;
+}
+/** Resolve browser storage when present. Guarded: some sandboxes throw on access. */
+function defaultStorage(writeCrossTab) {
+    const session = writableBrowserStorage('sessionStorage');
+    const local = writableBrowserStorage('localStorage');
+    if (writeCrossTab && !local) {
+        return undefined;
+    }
+    if (!session && !local) {
+        return undefined;
+    }
+    return {
+        getItem: (key) => {
+            return preferredStorageValue(session?.getItem(key) ?? null, local?.getItem(key) ?? null, writeCrossTab);
+        },
+        setItem: (key, value) => {
+            const primary = session ?? local;
+            if (!primary) {
+                throw new Error('storage unavailable');
+            }
+            if (writeCrossTab && local) {
+                local.setItem(key, value);
+                if (session && session !== local) {
+                    session.setItem(key, value);
+                }
+                return;
+            }
+            primary.setItem(key, value);
+        },
+        removeItem: (key) => {
+            session?.removeItem(key);
+            local?.removeItem(key);
+        },
+    };
+}
+function preferredStorageValue(sessionValue, localValue, preferLocal) {
+    if (preferLocal) {
+        return localValue ?? sessionValue;
+    }
+    if (!sessionValue || !localValue) {
+        return sessionValue ?? localValue;
+    }
+    const sessionRecord = resumeRecordMeta(sessionValue);
+    const localRecord = resumeRecordMeta(localValue);
+    if (!sessionRecord && localRecord) {
+        return localValue;
+    }
+    const sessionCanBeCloned = sessionRecord?.launchMode === 'popup' || sessionRecord?.launchMode === 'new_tab';
+    if (sessionCanBeCloned && localRecord && localRecord.startedAt > sessionRecord.startedAt) {
+        return localValue;
+    }
+    return sessionValue;
+}
+function resumeRecordMeta(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (typeof parsed !== 'object' || parsed === null) {
+            return undefined;
+        }
+        const record = parsed;
+        if (record.v !== 1 || typeof record.requestId !== 'string' || typeof record.startedAt !== 'number') {
+            return undefined;
+        }
+        const launchMode = record.launchMode === 'redirect' || record.launchMode === 'new_tab' || record.launchMode === 'popup'
+            ? record.launchMode
+            : undefined;
+        return { startedAt: record.startedAt, launchMode };
+    }
+    catch {
+        return undefined;
+    }
+}
+function writableBrowserStorage(name) {
+    const storage = browserStorage(name);
+    if (!storage || !canWriteStorage(storage)) {
+        return undefined;
+    }
+    return storage;
+}
+function browserStorage(name) {
+    try {
+        const s = globalThis[name];
+        return s ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function canWriteStorage(storage) {
+    if (!storage) {
+        return false;
+    }
+    const key = `__m2c_checkout_storage_test__${Math.random().toString(36).slice(2)}`;
+    try {
+        storage.setItem(key, '1');
+        storage.removeItem(key);
+        return true;
+    }
+    catch {
+        try {
+            storage.removeItem(key);
+        }
+        catch {
+            // The probe already failed; cleanup is best effort.
+        }
+        return false;
+    }
+}
+/** Resolve a full-page navigator from `location.assign` when present. */
+function defaultNavigate() {
+    try {
+        const loc = globalThis.location;
+        if (loc && typeof loc.assign === 'function') {
+            return (url) => {
+                loc.assign(url);
+            };
+        }
+    }
+    catch {
+        // No DOM (SSR / Node): leave undefined; lifecycle methods will throw clearly.
+    }
+    return undefined;
+}
+function defaultOpenWindow() {
+    try {
+        const w = globalThis.window;
+        if (w && typeof w.open === 'function') {
+            return w.open.bind(w);
+        }
+    }
+    catch {
+        // No DOM (SSR / Node): leave undefined; lifecycle methods will throw clearly.
+    }
+    return undefined;
+}
+// Exported for the test harness so the poll schedule can be driven on a fake
+// clock; not part of the public API.
+export { CheckoutClientImpl, normalizeConfig };