@mj-biz-apps/orders-server 5.1.0 → 5.2.0

package/dist/checkout-edge-policy.js

@@ -0,0 +1,84 @@
+/**
+ * Pure helpers for the anonymous checkout edge: slug validation and origin allowlist.
+ * Extracted so unit tests do not have to boot Express or the ClassFactory.
+ */
+/** POST route suffixes that must never be treated as a distribution slug. */
+export const CHECKOUT_RESERVED_SLUGS = new Set([
+    'initialize',
+    'draft',
+    'payment-intent',
+    'complete',
+]);
+const SLUG_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/**
+ * Public distribution slugs: short, URL-safe, not colliding with the POST verbs
+ * mounted on the same root.
+ */
+export function isValidCheckoutSlug(slug) {
+    if (!slug || slug.length > 128) {
+        return false;
+    }
+    if (CHECKOUT_RESERVED_SLUGS.has(slug.toLowerCase())) {
+        return false;
+    }
+    return SLUG_PATTERN.test(slug);
+}
+/**
+ * True when the browser Origin is the same host:port as this request (the
+ * first-party `GET /checkout/:slug` page posting back to MJAPI).
+ */
+export function isSameOrigin(origin, hostHeader) {
+    if (!origin || !hostHeader) {
+        return false;
+    }
+    try {
+        const url = new URL(origin);
+        return url.host.toLowerCase() === hostHeader.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Widget `allowedOrigins` is a **cross-origin embed** allowlist. Same-origin
+ * posts from the MJAPI-hosted public page always pass. When the allowlist is
+ * absent or empty, any origin is allowed (the distribution slug remains the
+ * access control).
+ */
+/**
+ * Client IP for rate limiting and Turnstile.
+ *
+ * `TrustedProxyHops` is the number of reverse proxies that append to
+ * `X-Forwarded-For`. 0 (the default) ignores XFF entirely and uses the socket
+ * address — the leftmost XFF hop is client-supplied and must never key a
+ * security decision. When hops is N, the Nth-from-the-right entry is used
+ * (the address the outermost trusted proxy observed).
+ */
+export function resolveClientIp(req, trustedProxyHops = 0) {
+    const socket = req.socket?.remoteAddress ?? 'unknown';
+    if (!Number.isInteger(trustedProxyHops) || trustedProxyHops < 1) {
+        return socket;
+    }
+    const fwd = req.headers['x-forwarded-for'];
+    const raw = Array.isArray(fwd) ? fwd.join(',') : typeof fwd === 'string' ? fwd : undefined;
+    if (!raw) {
+        return socket;
+    }
+    const hops = raw.split(',').map((h) => h.trim()).filter((h) => h.length > 0);
+    const idx = hops.length - trustedProxyHops;
+    if (idx < 0 || idx >= hops.length) {
+        return socket;
+    }
+    return hops[idx];
+}
+export function originAllowed(origin, policy, hostHeader) {
+    if (isSameOrigin(origin, hostHeader)) {
+        return true;
+    }
+    if (!policy.allowedOrigins || policy.allowedOrigins.length === 0) {
+        return true;
+    }
+    const normalized = origin.replace(/\/+$/, '').toLowerCase();
+    return policy.allowedOrigins.some((allowed) => allowed.replace(/\/+$/, '').toLowerCase() === normalized);
+}
+//# sourceMappingURL=checkout-edge-policy.js.map

package/dist/checkout-edge-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-edge-policy.js","sourceRoot":"","sources":["../src/checkout-edge-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAChE,YAAY;IACZ,OAAO;IACP,gBAAgB;IAChB,UAAU;CACb,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,UAA8B;IACvE,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAMD;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC3B,GAAiF,EACjF,gBAAgB,GAAG,CAAC;IAEpB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;IAC3C,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CACzB,MAAc,EACd,MAA4B,EAC5B,UAAmB;IAEnB,IAAI,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CACxE,CAAC;AACN,CAAC"}

package/dist/checkout-host-page.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Public checkout host page — a self-contained HTML document that drives
+ * `OrdersCheckoutEdge` POSTs from a browser with no Explorer shell and no
+ * custom-element bundle.
+ *
+ * All per-request values reach the boot script via HTML-escaped `data-*`
+ * attributes (Forms host-page XSS rule): nothing attacker-controlled is
+ * interpolated into the inline `<script>`.
+ */
+export interface CheckoutHostPageOptions {
+    /** Distribution slug from `GET /checkout/:slug`. */
+    slug: string;
+    /**
+     * URL prefix the boot script POSTs to (the extension RootPath, e.g. `/checkout`).
+     * Relative so the page works behind whatever public origin MJAPI is served on.
+     */
+    apiRoot: string;
+    /** Browser tab title before initialize returns the widget name. */
+    pageTitle?: string;
+    /** Per-response CSP nonce. Required so a caller cannot emit a nonce-less page. */
+    cspNonce: string;
+    /**
+     * Relative URL of the `<mj-orders-checkout>` Angular Element bundle.
+     * When set, the page hosts the reusable Angular widget (customUI, introspected
+     * extension fields). When omitted, a vanilla fallback form is used.
+     */
+    elementSrc?: string;
+}
+export interface CheckoutHostErrorOptions {
+    message: string;
+    pageTitle?: string;
+    /** Per-response CSP nonce. Required so a caller cannot emit a nonce-less page. */
+    cspNonce: string;
+}
+/** Headers for the public checkout host / error pages (CSP is nonce-based). */
+export declare function checkoutHostSecurityHeaders(nonce: string): Record<string, string>;
+/** Escape a string for safe insertion into HTML text content. */
+export declare function escapeHtml(value: string): string;
+/** Escape a string for safe insertion into a double-quoted HTML attribute. */
+export declare function escapeAttr(value: string): string;
+export declare function renderCheckoutHostPage(options: CheckoutHostPageOptions): string;
+export declare function renderCheckoutHostErrorPage(options: CheckoutHostErrorOptions): string;
+//# sourceMappingURL=checkout-host-page.d.ts.map

package/dist/checkout-host-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-host-page.d.ts","sourceRoot":"","sources":["../src/checkout-host-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,uBAAuB;IACpC,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoBjF;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAwC/E;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAmBrF"}

package/dist/checkout-host-page.js

@@ -0,0 +1,445 @@
+/**
+ * Public checkout host page — a self-contained HTML document that drives
+ * `OrdersCheckoutEdge` POSTs from a browser with no Explorer shell and no
+ * custom-element bundle.
+ *
+ * All per-request values reach the boot script via HTML-escaped `data-*`
+ * attributes (Forms host-page XSS rule): nothing attacker-controlled is
+ * interpolated into the inline `<script>`.
+ */
+/** Headers for the public checkout host / error pages (CSP is nonce-based). */
+export function checkoutHostSecurityHeaders(nonce) {
+    const n = nonce.replace(/[^A-Za-z0-9+/=_-]/g, '');
+    const csp = [
+        "default-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "frame-ancestors 'none'",
+        `script-src 'nonce-${n}' 'self' https://js.stripe.com`,
+        `style-src 'nonce-${n}' 'self'`,
+        "img-src 'self' data: https://*.stripe.com",
+        'frame-src https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com https://*.stripe.com https://*.hcaptcha.com https://newassets.hcaptcha.com',
+        "connect-src 'self' https://api.stripe.com https://m.stripe.network",
+    ].join('; ');
+    return {
+        'Content-Security-Policy': csp,
+        'X-Frame-Options': 'DENY',
+        'Referrer-Policy': 'no-referrer',
+        'X-Content-Type-Options': 'nosniff',
+        'Cache-Control': 'no-store',
+    };
+}
+/** Escape a string for safe insertion into HTML text content. */
+export function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+/** Escape a string for safe insertion into a double-quoted HTML attribute. */
+export function escapeAttr(value) {
+    return escapeHtml(value).replace(/"/g, '&quot;');
+}
+export function renderCheckoutHostPage(options) {
+    const title = escapeHtml(options.pageTitle ?? 'Checkout');
+    const slug = escapeAttr(options.slug);
+    const apiRoot = escapeAttr(options.apiRoot);
+    const nonceAttr = ` nonce="${escapeAttr(options.cspNonce)}"`;
+    const elementSrc = options.elementSrc ? escapeAttr(options.elementSrc) : '';
+    if (elementSrc) {
+        return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+  <meta name="robots" content="noindex" />
+  <title>${title}</title>
+  <style${nonceAttr}>${PAGE_CSS}</style>
+  <script type="module" src="${elementSrc}"${nonceAttr}></script>
+</head>
+<body>
+  <main class="mj-co">
+    <mj-orders-checkout slug="${slug}" api-root="${apiRoot}" csp-nonce="${escapeAttr(options.cspNonce)}"></mj-orders-checkout>
+  </main>
+</body>
+</html>`;
+    }
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+  <meta name="robots" content="noindex" />
+  <title>${title}</title>
+  <style${nonceAttr}>${PAGE_CSS}</style>
+</head>
+<body>
+  <main class="mj-co" id="mj-co" data-slug="${slug}" data-api-root="${apiRoot}">
+    <p class="mj-co__status" role="status">Loading checkout…</p>
+  </main>
+  <script${nonceAttr}>${BOOT_SCRIPT}</script>
+</body>
+</html>`;
+}
+export function renderCheckoutHostErrorPage(options) {
+    const title = escapeHtml(options.pageTitle ?? 'Checkout unavailable');
+    const message = escapeHtml(options.message);
+    const nonceAttr = ` nonce="${escapeAttr(options.cspNonce)}"`;
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+  <meta name="robots" content="noindex" />
+  <title>${title}</title>
+  <style${nonceAttr}>${PAGE_CSS}</style>
+</head>
+<body>
+  <main class="mj-co">
+    <p class="mj-co__error" role="alert">${message}</p>
+  </main>
+</body>
+</html>`;
+}
+const PAGE_CSS = `
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+html, body { margin: 0; padding: 0; min-height: 100%; }
+body {
+  background: var(--mj-bg, #f8fafc);
+  color: var(--mj-text, #0f172a);
+  font-family: var(--mj-font-body, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif);
+  -webkit-text-size-adjust: 100%;
+  min-height: 100vh;
+}
+.mj-co {
+  max-width: 36rem;
+  margin: 0 auto;
+  padding: clamp(1.5rem, 5vw, 3rem) clamp(1rem, 4vw, 2rem);
+}
+.mj-co__status, .mj-co__error, .mj-co__ok {
+  font-size: 1.0625rem;
+  line-height: 1.5;
+}
+.mj-co__error { color: var(--mj-error, #b3261e); }
+.mj-co__ok { color: var(--mj-ok, #0f7b3b); }
+.mj-co h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }
+.mj-co p { margin: 0 0 1rem; }
+.mj-co label { display: block; font-weight: 600; margin: 0.75rem 0 0.25rem; }
+.mj-co input, .mj-co select, .mj-co textarea {
+  width: 100%;
+  padding: 0.5rem 0.65rem;
+  border: 1px solid var(--mj-border, #c9cdd4);
+  border-radius: 6px;
+  font: inherit;
+  background: var(--mj-surface, #fff);
+  color: inherit;
+}
+.mj-co button {
+  margin-top: 1.25rem;
+  padding: 0.65rem 1.1rem;
+  border: 0;
+  border-radius: 6px;
+  background: var(--mj-primary, #2563eb);
+  color: #fff;
+  font: inherit;
+  font-weight: 600;
+  cursor: pointer;
+}
+.mj-co button[disabled] { opacity: 0.6; cursor: not-allowed; }
+.mj-co__total { font-weight: 600; margin-top: 1rem; }
+#mj-co-card { margin-top: 1rem; }
+`;
+/**
+ * Static boot script. Per-request values are read from `#mj-co` data-* attributes
+ * at runtime — never spliced into this string.
+ */
+const BOOT_SCRIPT = `
+(function () {
+  var host = document.getElementById('mj-co');
+  var slug = host.getAttribute('data-slug') || '';
+  var apiRoot = (host.getAttribute('data-api-root') || '/checkout').replace(/\\/+$/, '');
+
+  function showError(msg) {
+    host.innerHTML = '';
+    var p = document.createElement('p');
+    p.className = 'mj-co__error';
+    p.setAttribute('role', 'alert');
+    p.textContent = msg;
+    host.appendChild(p);
+  }
+  function setStatus(msg) {
+    var el = host.querySelector('.mj-co__status');
+    if (el) el.textContent = msg;
+  }
+  function clientKey() {
+    var storageKey = 'mj-checkout-key:' + slug;
+    try {
+      var existing = sessionStorage.getItem(storageKey);
+      if (existing) return existing;
+    } catch (e) {}
+    var key;
+    if (window.crypto && crypto.randomUUID) {
+      key = crypto.randomUUID();
+    } else if (window.crypto && crypto.getRandomValues) {
+      var b = new Uint8Array(16);
+      crypto.getRandomValues(b);
+      b[6] = (b[6] & 0x0f) | 0x40;
+      b[8] = (b[8] & 0x3f) | 0x80;
+      var hex = [];
+      for (var i = 0; i < 16; i++) hex.push(('0' + b[i].toString(16)).slice(-2));
+      key = hex.slice(0, 4).join('') + '-' + hex.slice(4, 6).join('') + '-' + hex.slice(6, 8).join('') + '-' + hex.slice(8, 10).join('') + '-' + hex.slice(10, 16).join('');
+    } else {
+      showError('Checkout requires a secure random source. Open this page over HTTPS.');
+      return '';
+    }
+    try { sessionStorage.setItem(storageKey, key); } catch (e) {}
+    return key;
+  }
+  function post(path, body) {
+    return fetch(apiRoot + path, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      credentials: 'same-origin',
+      body: JSON.stringify(body)
+    }).then(function (res) {
+      return res.json().then(function (json) {
+        json._httpStatus = res.status;
+        return json;
+      });
+    });
+  }
+  function fieldValue(el) {
+    if (el.type === 'checkbox') return el.checked;
+    if (el.type === 'number') return el.value === '' ? '' : Number(el.value);
+    return el.value;
+  }
+  function loadStripe(pk) {
+    return new Promise(function (resolve, reject) {
+      // Reuse the same Stripe instance that created the Card Element. A second
+      // Stripe(pk) object cannot confirm that element (Stripe.js throws).
+      if (stripe) { resolve(stripe); return; }
+      function inst() {
+        stripe = window.Stripe(pk);
+        resolve(stripe);
+      }
+      if (window.Stripe) { inst(); return; }
+      var s = document.createElement('script');
+      s.src = 'https://js.stripe.com/v3/';
+      s.onload = function () {
+        if (!window.Stripe) { reject(new Error('Stripe.js did not load')); return; }
+        inst();
+      };
+      s.onerror = function () { reject(new Error('Could not load Stripe.js')); };
+      document.head.appendChild(s);
+    });
+  }
+
+  if (!slug) {
+    showError('This checkout link is missing its reference. Please check the link and try again.');
+    return;
+  }
+
+  var sessionKey = clientKey();
+  if (!sessionKey) return;
+  var sessionId = '';
+  var config = {};
+  var stripe = null;
+  var cardElement = null;
+
+  post('/initialize', { slug: slug, clientSessionKey: sessionKey }).then(function (init) {
+    if (!init || !init.Success) {
+      showError((init && init.ErrorMessage) || 'This checkout is not available.');
+      return;
+    }
+    sessionId = init.SessionID;
+    config = init.Configuration || {};
+    var productId = config.productId;
+    if (!productId) {
+      showError('This checkout is not configured with a product.');
+      return;
+    }
+
+    host.innerHTML = '';
+    var h1 = document.createElement('h1');
+    h1.textContent = config.title || init.WidgetName || 'Checkout';
+    host.appendChild(h1);
+    if (config.description) {
+      var desc = document.createElement('p');
+      desc.textContent = config.description;
+      host.appendChild(desc);
+    }
+
+    var form = document.createElement('form');
+    form.setAttribute('novalidate', 'novalidate');
+
+    function addField(name, label, type, required, placeholder, options) {
+      var lab = document.createElement('label');
+      lab.setAttribute('for', 'mj-co-' + name);
+      lab.textContent = label + (required ? ' *' : '');
+      form.appendChild(lab);
+      var input;
+      if (type === 'select' && options && options.length) {
+        input = document.createElement('select');
+        var blank = document.createElement('option');
+        blank.value = '';
+        blank.textContent = '';
+        input.appendChild(blank);
+        options.forEach(function (opt) {
+          var o = document.createElement('option');
+          if (typeof opt === 'object' && opt) {
+            o.value = String(opt.value);
+            o.textContent = String(opt.label);
+          } else {
+            o.value = String(opt);
+            o.textContent = String(opt);
+          }
+          input.appendChild(o);
+        });
+      } else if (type === 'textarea') {
+        input = document.createElement('textarea');
+        input.rows = 3;
+      } else if (type === 'boolean') {
+        input = document.createElement('input');
+        input.type = 'checkbox';
+      } else {
+        input = document.createElement('input');
+        input.type = type === 'number' ? 'number' : (type === 'date' ? 'date' : 'text');
+      }
+      input.id = 'mj-co-' + name;
+      input.name = name;
+      if (placeholder && input.placeholder !== undefined) input.placeholder = placeholder;
+      if (required && input.type !== 'checkbox') input.required = true;
+      form.appendChild(input);
+      return input;
+    }
+
+    addField('email', 'Email', 'text', true, 'you@example.com');
+    var qtyInput = null;
+    if (config.allowQuantity !== false) {
+      qtyInput = addField('quantity', 'Quantity', 'number', true, '1');
+      qtyInput.min = '1';
+      qtyInput.value = '1';
+      if (config.maxQuantity) qtyInput.max = String(config.maxQuantity);
+    }
+
+    var extFields = Array.isArray(config.extensionFields) ? config.extensionFields : [];
+    extFields.forEach(function (f) {
+      if (!f || !f.name || f.name === 'email') return;
+      addField(f.name, f.label || f.name, f.type || 'text', !!f.required, f.placeholder || '', f.options);
+    });
+
+    var cardMount = document.createElement('div');
+    cardMount.id = 'mj-co-card';
+    form.appendChild(cardMount);
+
+    var totalEl = document.createElement('p');
+    totalEl.className = 'mj-co__total';
+    form.appendChild(totalEl);
+
+    var status = document.createElement('p');
+    status.className = 'mj-co__status';
+    status.setAttribute('role', 'status');
+    form.appendChild(status);
+
+    var submit = document.createElement('button');
+    submit.type = 'submit';
+    submit.textContent = 'Continue';
+    form.appendChild(submit);
+    host.appendChild(form);
+
+    form.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      submit.disabled = true;
+      status.textContent = 'Pricing…';
+      var emailEl = form.elements.namedItem('email');
+      var email = emailEl && 'value' in emailEl ? String(emailEl.value || '').trim() : '';
+      var qty = qtyInput ? Math.max(1, parseInt(qtyInput.value, 10) || 1) : 1;
+      var extensionFields = {};
+      extFields.forEach(function (f) {
+        if (!f || !f.name) return;
+        var el = form.elements.namedItem(f.name);
+        if (el && 'type' in el) extensionFields[f.name] = fieldValue(el);
+      });
+      var line = { ProductID: productId, Quantity: qty };
+      if (Object.keys(extensionFields).length) {
+        line.ExtensionData = { EntityName: config.extensionEntityName, Fields: extensionFields };
+      }
+      post('/draft', {
+        sessionId: sessionId,
+        clientSessionKey: sessionKey,
+        email: email,
+        lines: [line]
+      }).then(function (draft) {
+        if (!draft || !draft.Success) {
+          throw new Error((draft && draft.ErrorMessage) || 'Could not price this checkout.');
+        }
+        var total = typeof draft.TotalGross === 'number' ? draft.TotalGross : 0;
+        totalEl.textContent = 'Total: ' + total.toFixed(2);
+        if (!draft.RequiresPayment) {
+          status.textContent = 'Completing…';
+          return post('/complete', { sessionId: sessionId, clientSessionKey: sessionKey });
+        }
+        status.textContent = 'Opening payment…';
+        return post('/payment-intent', { sessionId: sessionId, clientSessionKey: sessionKey }).then(function (intent) {
+          if (!intent || !intent.Success || !intent.ClientSecret) {
+            throw new Error((intent && intent.ErrorMessage) || 'Could not start payment.');
+          }
+          var pk = config.stripePublishableKey;
+          if (!pk) {
+            throw new Error('This checkout requires card payment. Configure stripePublishableKey on the widget, or embed the checkout widget on a site that already loads Stripe.');
+          }
+          return loadStripe(pk).then(function (stripeInst) {
+            stripe = stripeInst;
+            if (!cardElement) {
+              var elements = stripe.elements();
+              cardElement = elements.create('card');
+              cardElement.mount('#mj-co-card');
+              status.textContent = 'Enter card details and submit again to pay.';
+              submit.textContent = 'Pay';
+              submit.disabled = false;
+              form.dataset.payReady = '1';
+              return { _waitForCard: true };
+            }
+            status.textContent = 'Confirming payment…';
+            return stripe.confirmCardPayment(intent.ClientSecret, {
+              payment_method: { card: cardElement, billing_details: { email: email } }
+            }).then(function (result) {
+              if (result.error) throw new Error(result.error.message || 'Payment failed.');
+              status.textContent = 'Completing…';
+              return post('/complete', { sessionId: sessionId, clientSessionKey: sessionKey });
+            });
+          });
+        });
+      }).then(function (done) {
+        if (!done || done._waitForCard) return;
+        if (!done.Success) {
+          throw new Error(done.ErrorMessage || 'Could not complete checkout.');
+        }
+        host.innerHTML = '';
+        var ok = document.createElement('p');
+        ok.className = 'mj-co__ok';
+        ok.setAttribute('role', 'status');
+        ok.textContent = config.successMessage || ('Thank you. Order ' + (done.OrderNumber || '') + ' is confirmed.');
+        host.appendChild(ok);
+        if (config.redirectUrl) {
+          window.location.href = config.redirectUrl;
+        }
+      }).catch(function (err) {
+        status.textContent = '';
+        var existing = form.querySelector('.mj-co__error');
+        if (existing) existing.remove();
+        var p = document.createElement('p');
+        p.className = 'mj-co__error';
+        p.setAttribute('role', 'alert');
+        p.textContent = err && err.message ? err.message : 'Checkout failed.';
+        form.insertBefore(p, submit);
+        submit.disabled = false;
+      });
+    });
+  }).catch(function () {
+    showError('Checkout is temporarily unavailable. Please try again.');
+  });
+})();
+`;
+//# sourceMappingURL=checkout-host-page.js.map

package/dist/checkout-host-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-host-page.js","sourceRoot":"","sources":["../src/checkout-host-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6BH,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACrD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG;QACR,oBAAoB;QACpB,iBAAiB;QACjB,oBAAoB;QACpB,wBAAwB;QACxB,qBAAqB,CAAC,gCAAgC;QACtD,oBAAoB,CAAC,UAAU;QAC/B,2CAA2C;QAC3C,6JAA6J;QAC7J,oEAAoE;KACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACH,yBAAyB,EAAE,GAAG;QAC9B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,eAAe,EAAE,UAAU;KAC9B,CAAC;AACN,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,KAAa;IACpC,OAAO,KAAK;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,KAAa;IACpC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,UAAU,EAAE,CAAC;QACb,OAAO;;;;;;WAMJ,KAAK;UACN,SAAS,IAAI,QAAQ;+BACA,UAAU,IAAI,SAAS;;;;gCAItB,IAAI,eAAe,OAAO,gBAAgB,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;;;QAG9F,CAAC;IACL,CAAC;IACD,OAAO;;;;;;WAMA,KAAK;UACN,SAAS,IAAI,QAAQ;;;8CAGe,IAAI,oBAAoB,OAAO;;;WAGlE,SAAS,IAAI,WAAW;;QAE3B,CAAC;AACT,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAiC;IACzE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC7D,OAAO;;;;;;WAMA,KAAK;UACN,SAAS,IAAI,QAAQ;;;;2CAIY,OAAO;;;QAG1C,CAAC;AACT,CAAC;AAED,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDhB,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+RnB,CAAC"}