@mj-biz-apps/orders-server 0.0.1 → 5.2.0

package/dist/__tests__/checkout-host-page.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-host-page.test.js","sourceRoot":"","sources":["../../src/__tests__/checkout-host-page.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACH,2BAA2B,EAC3B,UAAU,EACV,UAAU,EACV,2BAA2B,EAC3B,sBAAsB,GACzB,MAAM,0BAA0B,CAAC;AAElC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC9F,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAClF,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,sBAAsB,CAAC;YAChC,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,2BAA2B;YACvC,QAAQ,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACnF,MAAM,IAAI,GAAG,2CAA2C,CAAC;QACzD,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8EAA8E,CAAC,CAAC;QACvG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC3F,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACrI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAClE,MAAM,IAAI,GAAG,2BAA2B,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACzE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/server-extensions-manifest.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=server-extensions-manifest.test.d.ts.map

package/dist/__tests__/server-extensions-manifest.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-extensions-manifest.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/server-extensions-manifest.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/server-extensions-manifest.test.js

@@ -0,0 +1,29 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+import { MJ_SERVER_EXTENSIONS } from '../server-extensions-manifest.js';
+const pkgJsonPath = join(dirname(fileURLToPath(import.meta.url)), '../../package.json');
+describe('MJ_SERVER_EXTENSIONS', () => {
+    it('declares the webhook and checkout edge with the same DriverClass/RootPath as mj.config.cjs', () => {
+        expect(MJ_SERVER_EXTENSIONS).toEqual([
+            {
+                Enabled: true,
+                DriverClass: 'OrdersPaymentWebhook',
+                RootPath: '/webhooks/payments',
+                Settings: {},
+            },
+            {
+                Enabled: true,
+                DriverClass: 'OrdersCheckoutEdge',
+                RootPath: '/checkout',
+                Settings: {},
+            },
+        ]);
+    });
+    it('mirrors package.json memberjunction.serverExtensions so static introspection matches the export', () => {
+        const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
+        expect(pkg.memberjunction?.serverExtensions).toEqual(MJ_SERVER_EXTENSIONS);
+    });
+});
+//# sourceMappingURL=server-extensions-manifest.test.js.map

package/dist/__tests__/server-extensions-manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-extensions-manifest.test.js","sourceRoot":"","sources":["../../src/__tests__/server-extensions-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAExF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QAClG,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;YACjC;gBACI,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,sBAAsB;gBACnC,QAAQ,EAAE,oBAAoB;gBAC9B,QAAQ,EAAE,EAAE;aACf;YACD;gBACI,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,oBAAoB;gBACjC,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,EAAE;aACf;SACJ,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAEvD,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/checkout-edge-policy.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Pure helpers for the anonymous checkout edge: slug validation and origin allowlist.
+ * Extracted so unit tests do not have to boot Express or the ClassFactory.
+ */
+/** POST route suffixes that must never be treated as a distribution slug. */
+export declare const CHECKOUT_RESERVED_SLUGS: ReadonlySet<string>;
+/**
+ * Public distribution slugs: short, URL-safe, not colliding with the POST verbs
+ * mounted on the same root.
+ */
+export declare function isValidCheckoutSlug(slug: string): boolean;
+/**
+ * True when the browser Origin is the same host:port as this request (the
+ * first-party `GET /checkout/:slug` page posting back to MJAPI).
+ */
+export declare function isSameOrigin(origin: string, hostHeader: string | undefined): boolean;
+export interface CheckoutOriginPolicy {
+    allowedOrigins?: string[];
+}
+/**
+ * Widget `allowedOrigins` is a **cross-origin embed** allowlist. Same-origin
+ * posts from the MJAPI-hosted public page always pass. When the allowlist is
+ * absent or empty, any origin is allowed (the distribution slug remains the
+ * access control).
+ */
+/**
+ * Client IP for rate limiting and Turnstile.
+ *
+ * `TrustedProxyHops` is the number of reverse proxies that append to
+ * `X-Forwarded-For`. 0 (the default) ignores XFF entirely and uses the socket
+ * address — the leftmost XFF hop is client-supplied and must never key a
+ * security decision. When hops is N, the Nth-from-the-right entry is used
+ * (the address the outermost trusted proxy observed).
+ */
+export declare function resolveClientIp(req: {
+    headers: {
+        [key: string]: unknown;
+    };
+    socket?: {
+        remoteAddress?: string;
+    };
+}, trustedProxyHops?: number): string;
+export declare function originAllowed(origin: string, policy: CheckoutOriginPolicy, hostHeader?: string): boolean;
+//# sourceMappingURL=checkout-edge-policy.d.ts.map

package/dist/checkout-edge-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-edge-policy.d.ts","sourceRoot":"","sources":["../src/checkout-edge-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAKtD,CAAC;AAIH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUpF;AAED,MAAM,WAAW,oBAAoB;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE;IAAE,OAAO,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACjF,gBAAgB,SAAI,GACrB,MAAM,CAgBR;AAED,wBAAgB,aAAa,CACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,EAC5B,UAAU,CAAC,EAAE,MAAM,GACpB,OAAO,CAWT"}

package/dist/checkout-edge-policy.js

@@ -0,0 +1,84 @@
+/**
+ * Pure helpers for the anonymous checkout edge: slug validation and origin allowlist.
+ * Extracted so unit tests do not have to boot Express or the ClassFactory.
+ */
+/** POST route suffixes that must never be treated as a distribution slug. */
+export const CHECKOUT_RESERVED_SLUGS = new Set([
+    'initialize',
+    'draft',
+    'payment-intent',
+    'complete',
+]);
+const SLUG_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/**
+ * Public distribution slugs: short, URL-safe, not colliding with the POST verbs
+ * mounted on the same root.
+ */
+export function isValidCheckoutSlug(slug) {
+    if (!slug || slug.length > 128) {
+        return false;
+    }
+    if (CHECKOUT_RESERVED_SLUGS.has(slug.toLowerCase())) {
+        return false;
+    }
+    return SLUG_PATTERN.test(slug);
+}
+/**
+ * True when the browser Origin is the same host:port as this request (the
+ * first-party `GET /checkout/:slug` page posting back to MJAPI).
+ */
+export function isSameOrigin(origin, hostHeader) {
+    if (!origin || !hostHeader) {
+        return false;
+    }
+    try {
+        const url = new URL(origin);
+        return url.host.toLowerCase() === hostHeader.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Widget `allowedOrigins` is a **cross-origin embed** allowlist. Same-origin
+ * posts from the MJAPI-hosted public page always pass. When the allowlist is
+ * absent or empty, any origin is allowed (the distribution slug remains the
+ * access control).
+ */
+/**
+ * Client IP for rate limiting and Turnstile.
+ *
+ * `TrustedProxyHops` is the number of reverse proxies that append to
+ * `X-Forwarded-For`. 0 (the default) ignores XFF entirely and uses the socket
+ * address — the leftmost XFF hop is client-supplied and must never key a
+ * security decision. When hops is N, the Nth-from-the-right entry is used
+ * (the address the outermost trusted proxy observed).
+ */
+export function resolveClientIp(req, trustedProxyHops = 0) {
+    const socket = req.socket?.remoteAddress ?? 'unknown';
+    if (!Number.isInteger(trustedProxyHops) || trustedProxyHops < 1) {
+        return socket;
+    }
+    const fwd = req.headers['x-forwarded-for'];
+    const raw = Array.isArray(fwd) ? fwd.join(',') : typeof fwd === 'string' ? fwd : undefined;
+    if (!raw) {
+        return socket;
+    }
+    const hops = raw.split(',').map((h) => h.trim()).filter((h) => h.length > 0);
+    const idx = hops.length - trustedProxyHops;
+    if (idx < 0 || idx >= hops.length) {
+        return socket;
+    }
+    return hops[idx];
+}
+export function originAllowed(origin, policy, hostHeader) {
+    if (isSameOrigin(origin, hostHeader)) {
+        return true;
+    }
+    if (!policy.allowedOrigins || policy.allowedOrigins.length === 0) {
+        return true;
+    }
+    const normalized = origin.replace(/\/+$/, '').toLowerCase();
+    return policy.allowedOrigins.some((allowed) => allowed.replace(/\/+$/, '').toLowerCase() === normalized);
+}
+//# sourceMappingURL=checkout-edge-policy.js.map

package/dist/checkout-edge-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-edge-policy.js","sourceRoot":"","sources":["../src/checkout-edge-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAChE,YAAY;IACZ,OAAO;IACP,gBAAgB;IAChB,UAAU;CACb,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,UAA8B;IACvE,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAMD;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC3B,GAAiF,EACjF,gBAAgB,GAAG,CAAC;IAEpB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;IAC3C,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CACzB,MAAc,EACd,MAA4B,EAC5B,UAAmB;IAEnB,IAAI,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CACxE,CAAC;AACN,CAAC"}

package/dist/checkout-host-page.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Public checkout host page — a self-contained HTML document that drives
+ * `OrdersCheckoutEdge` POSTs from a browser with no Explorer shell and no
+ * custom-element bundle.
+ *
+ * All per-request values reach the boot script via HTML-escaped `data-*`
+ * attributes (Forms host-page XSS rule): nothing attacker-controlled is
+ * interpolated into the inline `<script>`.
+ */
+export interface CheckoutHostPageOptions {
+    /** Distribution slug from `GET /checkout/:slug`. */
+    slug: string;
+    /**
+     * URL prefix the boot script POSTs to (the extension RootPath, e.g. `/checkout`).
+     * Relative so the page works behind whatever public origin MJAPI is served on.
+     */
+    apiRoot: string;
+    /** Browser tab title before initialize returns the widget name. */
+    pageTitle?: string;
+    /** Per-response CSP nonce. Required so a caller cannot emit a nonce-less page. */
+    cspNonce: string;
+    /**
+     * Relative URL of the `<mj-orders-checkout>` Angular Element bundle.
+     * When set, the page hosts the reusable Angular widget (customUI, introspected
+     * extension fields). When omitted, a vanilla fallback form is used.
+     */
+    elementSrc?: string;
+}
+export interface CheckoutHostErrorOptions {
+    message: string;
+    pageTitle?: string;
+    /** Per-response CSP nonce. Required so a caller cannot emit a nonce-less page. */
+    cspNonce: string;
+}
+/** Headers for the public checkout host / error pages (CSP is nonce-based). */
+export declare function checkoutHostSecurityHeaders(nonce: string): Record<string, string>;
+/** Escape a string for safe insertion into HTML text content. */
+export declare function escapeHtml(value: string): string;
+/** Escape a string for safe insertion into a double-quoted HTML attribute. */
+export declare function escapeAttr(value: string): string;
+export declare function renderCheckoutHostPage(options: CheckoutHostPageOptions): string;
+export declare function renderCheckoutHostErrorPage(options: CheckoutHostErrorOptions): string;
+//# sourceMappingURL=checkout-host-page.d.ts.map

package/dist/checkout-host-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-host-page.d.ts","sourceRoot":"","sources":["../src/checkout-host-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,uBAAuB;IACpC,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoBjF;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAwC/E;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAmBrF"}