@morapay/nextjs 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Morapay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,42 @@
+# @morapay/nextjs
+
+Next.js App Router helpers for Morapay public BFF routes (payment links, fiat, catalog).
+
+```bash
+npm install @morapay/sdk @morapay/nextjs
+```
+
+Peer dependency: `@morapay/sdk@^0.1.0`.
+
+## Browser checkout
+
+Prefer **`@morapay/sdk/widget`** for opening checkout (widget + redirect):
+
+```ts
+import { openPaymentLinkCheckout } from "@morapay/sdk/widget";
+
+await openPaymentLinkCheckout({
+  publicCode: link.publicCode,
+  checkoutMode: "widget",
+  widgetExperience: "live",
+  checkoutBaseUrl: process.env.NEXT_PUBLIC_CHECKOUT_BASE_URL,
+});
+```
+
+## Public API BFF
+
+Wire route handlers to these proxies (same paths as `create-morapay-app` Next templates):
+
+```ts
+import { proxyPublicPaymentLinkGet } from "@morapay/nextjs/server/proxyPublicApi";
+// also: proxyPublicFiatInitializePost, proxyPublicCatalogGet, …
+```
+
+| Your route | Helper |
+|------------|--------|
+| `GET /api/public/payment-links/[code]` | `proxyPublicPaymentLinkGet` |
+| `POST /api/public/payment-links/[code]/sessions` | `proxyPublicPaymentLinkSessionPost` |
+| `POST /api/public/fiat/payments/initialize` | `proxyPublicFiatInitializePost` |
+| `GET /api/public/catalog/chains` \| `tokens` | `proxyPublicCatalogGet` |
+
+Default widget script: `https://checkout.morapay.io/widget/morapay-checkout.js`.

package/dist/client/loadWidget.d.ts

@@ -0,0 +1,3 @@
+/** @deprecated Import from `../features/widget/client` — backward-compatible path. */
+export * from "../features/widget/client/loadWidget.js";
+//# sourceMappingURL=loadWidget.d.ts.map

package/dist/client/loadWidget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadWidget.d.ts","sourceRoot":"","sources":["../../client/loadWidget.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,cAAc,yCAAyC,CAAC"}

package/dist/client/loadWidget.js

@@ -0,0 +1,2 @@
+/** @deprecated Import from `../features/widget/client` — backward-compatible path. */
+export * from "../features/widget/client/loadWidget.js";

package/dist/client/openPaymentLinkCheckout.d.ts

@@ -0,0 +1,3 @@
+/** @deprecated Import from `../features/widget/client` — backward-compatible path. */
+export * from "../features/widget/client/openPaymentLinkCheckout.js";
+//# sourceMappingURL=openPaymentLinkCheckout.d.ts.map

package/dist/client/openPaymentLinkCheckout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openPaymentLinkCheckout.d.ts","sourceRoot":"","sources":["../../client/openPaymentLinkCheckout.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,cAAc,sDAAsD,CAAC"}

package/dist/client/openPaymentLinkCheckout.js

@@ -0,0 +1,2 @@
+/** @deprecated Import from `../features/widget/client` — backward-compatible path. */
+export * from "../features/widget/client/openPaymentLinkCheckout.js";

package/dist/constants.d.ts

@@ -0,0 +1,5 @@
+/** Default hosted widget script — drop-in, no npm install for the bundle itself. */
+export declare const MORAPAY_WIDGET_SCRIPT_URL = "https://checkout.morapay.io/widget/morapay-checkout.js";
+/** Same-origin BFF prefix for widget preview (payment link + quotes). */
+export declare const MORAPAY_PUBLIC_API_BASE = "/api/public";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../constants.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,2DACoB,CAAC;AAE3D,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,gBAAgB,CAAC"}

package/dist/constants.js

@@ -0,0 +1,4 @@
+/** Default hosted widget script — drop-in, no npm install for the bundle itself. */
+export const MORAPAY_WIDGET_SCRIPT_URL = "https://checkout.morapay.io/widget/morapay-checkout.js";
+/** Same-origin BFF prefix for widget preview (payment link + quotes). */
+export const MORAPAY_PUBLIC_API_BASE = "/api/public";

package/dist/features/publicApi/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./server/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/features/publicApi/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../features/publicApi/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/features/publicApi/index.js

@@ -0,0 +1 @@
+export * from "./server/index.js";

package/dist/features/publicApi/server/catalogSquidProxy.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Hosted checkout uses /api/squid/chains|tokens (full Squid catalog).
+ * Widget BFF prefers that source over Morapay public catalog (~15 DB tokens).
+ */
+type UnknownRecord = Record<string, unknown>;
+export declare function mapSquidChainsToPublicCatalog(payload: unknown): UnknownRecord[];
+export declare function mapSquidTokensToPublicCatalog(payload: unknown): UnknownRecord[];
+export declare function fetchCheckoutSquidCatalog(checkoutBaseUrl: string, resource: "chains" | "tokens", environment: "TEST" | "LIVE"): Promise<UnknownRecord[] | null>;
+export type CheckoutPickerCatalogPayload = {
+    environment: "TEST" | "LIVE";
+    selectorFiltered: boolean;
+    chains: UnknownRecord[];
+    tokens: UnknownRecord[];
+    featured: UnknownRecord | null;
+};
+/** Unified selector-filtered catalog from backend (preferred over raw Squid + client filter). */
+export declare function fetchCheckoutPickerCatalog(apiBaseUrl: string, environment: "TEST" | "LIVE"): Promise<CheckoutPickerCatalogPayload | null>;
+export {};
+//# sourceMappingURL=catalogSquidProxy.d.ts.map

package/dist/features/publicApi/server/catalogSquidProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogSquidProxy.d.ts","sourceRoot":"","sources":["../../../../features/publicApi/server/catalogSquidProxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA2B7C,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,EAAE,CA0B/E;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,EAAE,CAsB/E;AAED,wBAAsB,yBAAyB,CAC7C,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAC7B,WAAW,EAAE,MAAM,GAAG,MAAM,GAC3B,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAgBjC;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,iGAAiG;AACjG,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAAG,MAAM,GAC3B,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CA6B9C"}

package/dist/features/publicApi/server/catalogSquidProxy.js

@@ -0,0 +1,137 @@
+/**
+ * Hosted checkout uses /api/squid/chains|tokens (full Squid catalog).
+ * Widget BFF prefers that source over Morapay public catalog (~15 DB tokens).
+ */
+function pickArray(payload, keys) {
+    if (Array.isArray(payload))
+        return payload;
+    if (!payload || typeof payload !== "object")
+        return [];
+    const record = payload;
+    for (const key of keys) {
+        const direct = record[key];
+        if (Array.isArray(direct))
+            return direct;
+    }
+    const data = record.data;
+    if (data && typeof data === "object") {
+        const nested = data;
+        for (const key of keys) {
+            const arr = nested[key];
+            if (Array.isArray(arr))
+                return arr;
+        }
+    }
+    return [];
+}
+function chainIdStr(value) {
+    if (value == null)
+        return "";
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return String(value).trim();
+}
+export function mapSquidChainsToPublicCatalog(payload) {
+    return pickArray(payload, ["chains"]).flatMap((row) => {
+        if (!row || typeof row !== "object")
+            return [];
+        const item = row;
+        const chainId = chainIdStr(item.chainId);
+        const name = String(item.chainName ?? item.networkName ?? item.name ?? "").trim();
+        if (!chainId || !name)
+            return [];
+        const iconUrl = String(item.chainIconURI ?? item.chainIconUri ?? item.iconURI ?? item.iconUri ?? "").trim();
+        const native = item.nativeCurrency;
+        const nativeSymbol = native && typeof native === "object"
+            ? String(native.symbol ?? "").trim()
+            : "";
+        const shortName = String(item.shortName ?? nativeSymbol ?? name).trim();
+        return [
+            {
+                id: chainId,
+                chainId,
+                name,
+                shortName,
+                chainIconURI: iconUrl,
+            },
+        ];
+    });
+}
+export function mapSquidTokensToPublicCatalog(payload) {
+    return pickArray(payload, ["tokens"]).flatMap((row) => {
+        if (!row || typeof row !== "object")
+            return [];
+        const item = row;
+        const chainId = chainIdStr(item.chainId);
+        const symbol = String(item.symbol ?? "").trim();
+        const address = String(item.address ?? item.tokenAddress ?? "").trim();
+        if (!chainId || !symbol)
+            return [];
+        const name = String(item.name ?? symbol).trim();
+        const logoUrl = String(item.logoURI ?? item.logoUri ?? "").trim();
+        const id = address ? `${address}-${chainId}` : `${symbol}-${chainId}`.toLowerCase();
+        return [
+            {
+                id,
+                chainId,
+                symbol: symbol.toUpperCase(),
+                name,
+                address,
+                logoURI: logoUrl,
+            },
+        ];
+    });
+}
+export async function fetchCheckoutSquidCatalog(checkoutBaseUrl, resource, environment) {
+    const base = checkoutBaseUrl.replace(/\/+$/, "");
+    const qs = new URLSearchParams({ environment });
+    const res = await fetch(`${base}/api/squid/${resource}?${qs}`, {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        cache: "no-store",
+    });
+    if (!res.ok)
+        return null;
+    const payload = await res.json().catch(() => null);
+    if (!payload)
+        return null;
+    const rows = resource === "chains"
+        ? mapSquidChainsToPublicCatalog(payload)
+        : mapSquidTokensToPublicCatalog(payload);
+    return rows.length > 0 ? rows : null;
+}
+/** Unified selector-filtered catalog from backend (preferred over raw Squid + client filter). */
+export async function fetchCheckoutPickerCatalog(apiBaseUrl, environment) {
+    const base = apiBaseUrl.replace(/\/+$/, "");
+    const qs = new URLSearchParams({ environment });
+    const res = await fetch(`${base}/api/public/catalog/checkout?${qs}`, {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        cache: "no-store",
+    });
+    if (!res.ok)
+        return null;
+    const payload = await res.json().catch(() => null);
+    if (!payload || typeof payload !== "object")
+        return null;
+    const record = payload;
+    if (record.success === false)
+        return null;
+    const data = record.data;
+    if (!data || typeof data !== "object")
+        return null;
+    const catalog = data;
+    const chains = Array.isArray(catalog.chains) ? catalog.chains : [];
+    const tokens = Array.isArray(catalog.tokens) ? catalog.tokens : [];
+    if (chains.length === 0 && tokens.length === 0)
+        return null;
+    return {
+        environment: catalog.environment === "TEST" ? "TEST" : "LIVE",
+        selectorFiltered: catalog.selectorFiltered === true,
+        chains: chains,
+        tokens: tokens,
+        featured: catalog.featured && typeof catalog.featured === "object"
+            ? catalog.featured
+            : null,
+    };
+}

package/dist/features/publicApi/server/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./proxyPublicApi.js";
+export * from "./catalogSquidProxy.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/features/publicApi/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../features/publicApi/server/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC"}

package/dist/features/publicApi/server/index.js

@@ -0,0 +1,2 @@
+export * from "./proxyPublicApi.js";
+export * from "./catalogSquidProxy.js";

package/dist/features/publicApi/server/proxyPublicApi.d.ts

@@ -0,0 +1,20 @@
+type ApiBaseUrlResolver = () => string;
+type CheckoutBaseUrlResolver = () => string;
+/** GET /api/public/payment-links/:code — widget preview loads link details here. */
+export declare function proxyPublicPaymentLinkGet(request: Request, code: string, getApiBaseUrl: ApiBaseUrlResolver): Promise<Response>;
+/** GET /api/public/catalog/chains|tokens — widget token picker catalog. */
+export declare function proxyPublicCatalogGet(request: Request, resource: "chains" | "tokens", getApiBaseUrl: ApiBaseUrlResolver, getCheckoutBaseUrl?: CheckoutBaseUrlResolver): Promise<Response>;
+/** POST /api/public/quotes/checkout — widget preview loads token rows here. */
+export declare function proxyPublicQuotesCheckoutPost(request: Request, getApiBaseUrl: ApiBaseUrlResolver): Promise<Response>;
+/** POST /api/public/payment-links/:code/sessions — ephemeral checkout session before fiat pay. */
+export declare function proxyPublicPaymentLinkSessionPost(request: Request, code: string, getApiBaseUrl: ApiBaseUrlResolver): Promise<Response>;
+/** POST /api/public/commerce/fiat — payer fiat quote for cross-currency checkout. */
+export declare function proxyPublicCommerceFiatPost(request: Request, getApiBaseUrl: ApiBaseUrlResolver): Promise<Response>;
+/** POST /api/public/fiat/payments/initialize — MoMo, bank, or card checkout. */
+export declare function proxyPublicFiatInitializePost(request: Request, getApiBaseUrl: ApiBaseUrlResolver): Promise<Response>;
+/** GET /api/public/fiat/transactions/verify/:reference — poll payment status. */
+export declare function proxyPublicFiatVerifyGet(request: Request, reference: string, getApiBaseUrl: ApiBaseUrlResolver): Promise<Response>;
+/** POST /api/public/fiat/payments/test-confirm — TEST bank transfer confirm. */
+export declare function proxyPublicFiatTestConfirmPost(request: Request, getApiBaseUrl: ApiBaseUrlResolver): Promise<Response>;
+export {};
+//# sourceMappingURL=proxyPublicApi.d.ts.map

package/dist/features/publicApi/server/proxyPublicApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyPublicApi.d.ts","sourceRoot":"","sources":["../../../../features/publicApi/server/proxyPublicApi.ts"],"names":[],"mappings":"AAMA,KAAK,kBAAkB,GAAG,MAAM,MAAM,CAAC;AACvC,KAAK,uBAAuB,GAAG,MAAM,MAAM,CAAC;AAqB5C,oFAAoF;AACpF,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,kBAAkB,qBA0BlC;AAED,2EAA2E;AAC3E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAC7B,aAAa,EAAE,kBAAkB,EACjC,kBAAkB,CAAC,EAAE,uBAAuB,qBAsD7C;AAED,+EAA+E;AAC/E,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,kBAAkB,qBAiBlC;AAED,kGAAkG;AAClG,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,kBAAkB,qBAwBlC;AAED,qFAAqF;AACrF,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,kBAAkB,qBAiBlC;AAED,gFAAgF;AAChF,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,kBAAkB,qBAiBlC;AAED,iFAAiF;AACjF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,kBAAkB,qBAoBlC;AAED,gFAAgF;AAChF,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,kBAAkB,qBAiBlC"}

package/dist/features/publicApi/server/proxyPublicApi.js

@@ -0,0 +1,208 @@
+import { isMorapayError } from "@morapay/sdk";
+import { fetchCheckoutPickerCatalog, fetchCheckoutSquidCatalog, mapSquidChainsToPublicCatalog, mapSquidTokensToPublicCatalog } from "./catalogSquidProxy.js";
+function morapayErrorResponse(err) {
+    if (isMorapayError(err)) {
+        return Response.json({
+            success: false,
+            error: err.displayMessage,
+            safeMessage: err.safeMessage,
+            displayMessage: err.displayMessage,
+            uiHint: err.uiHint,
+            code: err.code,
+            requestId: err.requestId,
+        }, { status: err.status >= 400 ? err.status : 500 });
+    }
+    const message = err instanceof Error ? err.message : "Request failed.";
+    return Response.json({ success: false, error: message }, { status: 500 });
+}
+/** GET /api/public/payment-links/:code — widget preview loads link details here. */
+export async function proxyPublicPaymentLinkGet(request, code, getApiBaseUrl) {
+    const trimmed = code?.trim();
+    if (!trimmed) {
+        return Response.json({ success: false, error: "Invalid code." }, { status: 400 });
+    }
+    try {
+        const { searchParams } = new URL(request.url);
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const fwd = new URLSearchParams();
+        const wallet = searchParams.get("wallet");
+        const checkoutSessionId = searchParams.get("checkoutSessionId");
+        if (wallet?.trim())
+            fwd.set("wallet", wallet.trim());
+        if (checkoutSessionId?.trim())
+            fwd.set("checkoutSessionId", checkoutSessionId.trim());
+        const qs = fwd.toString();
+        const res = await fetch(`${base}/api/public/payment-links/${encodeURIComponent(trimmed)}${qs ? `?${qs}` : ""}`, { method: "GET", headers: { Accept: "application/json" }, cache: "no-store" });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}
+/** GET /api/public/catalog/chains|tokens — widget token picker catalog. */
+export async function proxyPublicCatalogGet(request, resource, getApiBaseUrl, getCheckoutBaseUrl) {
+    try {
+        const { searchParams } = new URL(request.url);
+        const environment = searchParams.get("environment")?.trim().toUpperCase() === "TEST" ? "TEST" : "LIVE";
+        const unified = await fetchCheckoutPickerCatalog(getApiBaseUrl(), environment);
+        if (unified?.selectorFiltered) {
+            const rows = resource === "chains"
+                ? mapSquidChainsToPublicCatalog({ chains: unified.chains })
+                : mapSquidTokensToPublicCatalog({ tokens: unified.tokens });
+            return Response.json({
+                success: true,
+                data: resource === "chains"
+                    ? { chains: rows, selectorFiltered: true }
+                    : { tokens: rows, selectorFiltered: true },
+            });
+        }
+        if (getCheckoutBaseUrl) {
+            try {
+                const rows = await fetchCheckoutSquidCatalog(getCheckoutBaseUrl(), resource, environment);
+                if (rows) {
+                    return Response.json({
+                        success: true,
+                        data: resource === "chains" ? { chains: rows } : { tokens: rows },
+                    });
+                }
+            }
+            catch {
+                // Fall through to Morapay public catalog.
+            }
+        }
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const qs = searchParams.toString();
+        const path = `${base}/api/public/catalog/${resource}${qs ? `?${qs}` : ""}`;
+        const res = await fetch(path, {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            cache: "no-store",
+        });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}
+/** POST /api/public/quotes/checkout — widget preview loads token rows here. */
+export async function proxyPublicQuotesCheckoutPost(request, getApiBaseUrl) {
+    try {
+        const body = await request.json();
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const res = await fetch(`${base}/api/public/quotes/checkout`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            body: JSON.stringify(body),
+            cache: "no-store",
+        });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}
+/** POST /api/public/payment-links/:code/sessions — ephemeral checkout session before fiat pay. */
+export async function proxyPublicPaymentLinkSessionPost(request, code, getApiBaseUrl) {
+    const trimmed = code?.trim();
+    if (!trimmed) {
+        return Response.json({ success: false, error: "Invalid code." }, { status: 400 });
+    }
+    try {
+        const body = await request.json().catch(() => ({}));
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const res = await fetch(`${base}/api/public/payment-links/${encodeURIComponent(trimmed)}/sessions`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            body: JSON.stringify(body),
+            cache: "no-store",
+        });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}
+/** POST /api/public/commerce/fiat — payer fiat quote for cross-currency checkout. */
+export async function proxyPublicCommerceFiatPost(request, getApiBaseUrl) {
+    try {
+        const body = await request.json();
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const res = await fetch(`${base}/api/public/commerce/fiat`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            body: JSON.stringify(body),
+            cache: "no-store",
+        });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}
+/** POST /api/public/fiat/payments/initialize — MoMo, bank, or card checkout. */
+export async function proxyPublicFiatInitializePost(request, getApiBaseUrl) {
+    try {
+        const body = await request.json();
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const res = await fetch(`${base}/api/public/fiat/payments/initialize`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            body: JSON.stringify(body),
+            cache: "no-store",
+        });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}
+/** GET /api/public/fiat/transactions/verify/:reference — poll payment status. */
+export async function proxyPublicFiatVerifyGet(request, reference, getApiBaseUrl) {
+    const trimmed = reference?.trim();
+    if (!trimmed) {
+        return Response.json({ success: false, error: "Invalid reference." }, { status: 400 });
+    }
+    try {
+        const { searchParams } = new URL(request.url);
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const qs = searchParams.toString();
+        const res = await fetch(`${base}/api/public/fiat/transactions/verify/${encodeURIComponent(trimmed)}${qs ? `?${qs}` : ""}`, { method: "GET", headers: { Accept: "application/json" }, cache: "no-store" });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}
+/** POST /api/public/fiat/payments/test-confirm — TEST bank transfer confirm. */
+export async function proxyPublicFiatTestConfirmPost(request, getApiBaseUrl) {
+    try {
+        const body = await request.json();
+        const base = getApiBaseUrl().replace(/\/+$/, "");
+        const res = await fetch(`${base}/api/public/fiat/payments/test-confirm`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            body: JSON.stringify(body),
+            cache: "no-store",
+        });
+        const payload = await res.json().catch(() => ({}));
+        return Response.json(payload, { status: res.status });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Could not reach the Morapay API.";
+        return Response.json({ success: false, error: message }, { status: 502 });
+    }
+}

package/dist/features/widget/client/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./loadWidget.js";
+export * from "./openPaymentLinkCheckout.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/features/widget/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../features/widget/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,8BAA8B,CAAC"}

package/dist/features/widget/client/index.js

@@ -0,0 +1,2 @@
+export * from "./loadWidget.js";
+export * from "./openPaymentLinkCheckout.js";

package/dist/features/widget/client/loadWidget.d.ts

@@ -0,0 +1,23 @@
+export type MorapayWidgetCustomization = {
+    theme?: string;
+    colorMode?: "light" | "dark";
+    accentColor?: string;
+    borderRadius?: "none" | "sm" | "md" | "lg" | "xl";
+    fontScale?: "compact" | "default" | "large";
+    showMerchantLogo?: boolean;
+    /** Shell layout — bottom sheet on mobile when `auto`. */
+    presentation?: "auto" | "bottom-sheet" | "modal";
+};
+export type MorapayCheckoutWidget = {
+    openPreviewModal?: (options: Record<string, unknown>) => HTMLElement;
+    closePreviewModal?: () => void;
+    openModal?: (options: Record<string, unknown>) => HTMLElement;
+    closeModal?: () => void;
+};
+declare global {
+    interface Window {
+        MorapayCheckout?: MorapayCheckoutWidget;
+    }
+}
+export declare function loadMorapayWidget(scriptUrl: string): Promise<MorapayCheckoutWidget>;
+//# sourceMappingURL=loadWidget.d.ts.map

package/dist/features/widget/client/loadWidget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadWidget.d.ts","sourceRoot":"","sources":["../../../../features/widget/client/loadWidget.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAClD,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,OAAO,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,WAAW,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,WAAW,CAAC;IAC9D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB,CAAC;AAEF,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,eAAe,CAAC,EAAE,qBAAqB,CAAC;KACzC;CACF;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgDnF"}

package/dist/features/widget/client/loadWidget.js

@@ -0,0 +1,42 @@
+export function loadMorapayWidget(scriptUrl) {
+    if (typeof document === "undefined") {
+        return Promise.reject(new Error("loadMorapayWidget requires a browser environment."));
+    }
+    return new Promise((resolve, reject) => {
+        const ready = () => {
+            const widget = window.MorapayCheckout;
+            if (widget?.openPreviewModal && widget?.openModal) {
+                resolve(widget);
+                return;
+            }
+            if (widget?.openModal) {
+                resolve(widget);
+                return;
+            }
+            fail(`MorapayCheckout widget failed to initialize. Expected openModal from ${scriptUrl}.`);
+        };
+        const fail = (message) => {
+            document.querySelector('script[data-morapay-widget="1"]')?.remove();
+            reject(new Error(message));
+        };
+        if (window.MorapayCheckout?.openModal || window.MorapayCheckout?.openPreviewModal) {
+            ready();
+            return;
+        }
+        const existing = document.querySelector('script[data-morapay-widget="1"]');
+        if (existing) {
+            existing.addEventListener("load", ready, { once: true });
+            existing.addEventListener("error", () => fail(`Could not load widget from ${scriptUrl}`), {
+                once: true,
+            });
+            return;
+        }
+        const script = document.createElement("script");
+        script.src = scriptUrl;
+        script.async = true;
+        script.dataset.morapayWidget = "1";
+        script.onload = ready;
+        script.onerror = () => fail(`Could not load widget from ${scriptUrl}`);
+        document.body.appendChild(script);
+    });
+}

package/dist/features/widget/client/openPaymentLinkCheckout.d.ts

@@ -0,0 +1,37 @@
+import { type MorapayWidgetCustomization } from "./loadWidget.js";
+export type PaymentLinkCheckoutMode = "preview" | "live";
+export type OpenPaymentLinkCheckoutParams = {
+    /** Public payment link code from `link.create()` / `products.link()` — not the internal UUID. */
+    publicCode: string;
+    widgetScriptUrl: string;
+    /** Preview: loads link + quotes via your BFF. Live: opens checkout iframe. */
+    mode: PaymentLinkCheckoutMode;
+    /** Required for live mode — hosted checkout host (e.g. http://localhost:3002). */
+    checkoutBaseUrl?: string;
+    /** BFF prefix on your app. Default `/api/public`. */
+    apiBaseUrl?: string;
+    customization?: MorapayWidgetCustomization;
+    /** Shell layout — overrides `customization.presentation`. Default `auto`. */
+    presentation?: "auto" | "bottom-sheet" | "modal";
+    /** Optional fallbacks before preview fetch completes. */
+    businessName?: string;
+    linkTitle?: string;
+    amount?: string | null;
+    currency?: string;
+    onSuccess?: (payload: unknown) => void;
+    onFailure?: (payload: {
+        code: string;
+        message: string;
+    }) => void;
+    onClose?: () => void;
+    onWalletConnected?: (address: string) => void;
+    onTokenSelect?: (rowId: string) => void;
+};
+/**
+ * Single entry point for payment-link checkout — preview (staging) or live (iframe).
+ *
+ * Preview passes `publicCode` + `apiBaseUrl`; the widget fetches authoritative link data.
+ * Live passes `publicCode` + `checkoutBaseUrl` for real payments.
+ */
+export declare function openPaymentLinkCheckout(params: OpenPaymentLinkCheckoutParams): Promise<void>;
+//# sourceMappingURL=openPaymentLinkCheckout.d.ts.map

package/dist/features/widget/client/openPaymentLinkCheckout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openPaymentLinkCheckout.d.ts","sourceRoot":"","sources":["../../../../features/widget/client/openPaymentLinkCheckout.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAErF,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEzD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,IAAI,EAAE,uBAAuB,CAAC;IAC9B,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,OAAO,CAAC;IACjD,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAmDf"}

package/dist/features/widget/client/openPaymentLinkCheckout.js

@@ -0,0 +1,57 @@
+import { MORAPAY_PUBLIC_API_BASE } from "../../../constants.js";
+import { loadMorapayWidget } from "./loadWidget.js";
+/**
+ * Single entry point for payment-link checkout — preview (staging) or live (iframe).
+ *
+ * Preview passes `publicCode` + `apiBaseUrl`; the widget fetches authoritative link data.
+ * Live passes `publicCode` + `checkoutBaseUrl` for real payments.
+ */
+export async function openPaymentLinkCheckout(params) {
+    const code = params.publicCode.trim();
+    if (!code)
+        throw new Error("publicCode is required.");
+    const widget = await loadMorapayWidget(params.widgetScriptUrl);
+    const apiBaseUrl = (params.apiBaseUrl ?? MORAPAY_PUBLIC_API_BASE).replace(/\/+$/, "");
+    if (params.mode === "preview") {
+        if (!widget.openPreviewModal) {
+            throw new Error("MorapayCheckout.openPreviewModal is not available on this widget build.");
+        }
+        window.MorapayCheckout?.closePreviewModal?.();
+        widget.openPreviewModal({
+            businessName: params.businessName?.trim() || "Merchant",
+            linkTitle: params.linkTitle?.trim() || "Payment",
+            amount: params.amount ?? null,
+            currency: params.currency ?? "USD",
+            customization: params.customization,
+            presentation: params.presentation ?? params.customization?.presentation,
+            publicCode: code,
+            apiBaseUrl,
+            checkoutBaseUrl: params.checkoutBaseUrl?.trim(),
+            onWalletConnected: params.onWalletConnected,
+            onTokenSelect: params.onTokenSelect,
+            onClose: params.onClose,
+            onSuccess: params.onSuccess,
+            onFailure: params.onFailure,
+        });
+        return;
+    }
+    if (!widget.openModal) {
+        throw new Error("MorapayCheckout.openModal is not available on this widget build.");
+    }
+    const checkoutBaseUrl = params.checkoutBaseUrl?.trim();
+    if (!checkoutBaseUrl) {
+        throw new Error("checkoutBaseUrl is required for live checkout.");
+    }
+    window.MorapayCheckout?.closeModal?.();
+    widget.openModal({
+        mode: "payment-link",
+        title: params.linkTitle?.trim() || "Checkout",
+        checkoutBaseUrl,
+        publicCode: code,
+        customization: params.customization,
+        presentation: params.presentation ?? params.customization?.presentation,
+        onSuccess: params.onSuccess,
+        onFailure: params.onFailure,
+        onClose: params.onClose,
+    });
+}

package/dist/features/widget/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./client/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/features/widget/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../features/widget/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/features/widget/index.js

@@ -0,0 +1 @@
+export * from "./client/index.js";

package/dist/server/catalogSquidProxy.d.ts

@@ -0,0 +1,2 @@
+export * from "../features/publicApi/server/catalogSquidProxy.js";
+//# sourceMappingURL=catalogSquidProxy.d.ts.map

package/dist/server/catalogSquidProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogSquidProxy.d.ts","sourceRoot":"","sources":["../../server/catalogSquidProxy.ts"],"names":[],"mappings":"AAAA,cAAc,mDAAmD,CAAC"}

package/dist/server/catalogSquidProxy.js

@@ -0,0 +1 @@
+export * from "../features/publicApi/server/catalogSquidProxy.js";

package/dist/server/proxyPublicApi.d.ts

@@ -0,0 +1,3 @@
+export * from "../features/publicApi/server/proxyPublicApi.js";
+export * from "../features/publicApi/server/catalogSquidProxy.js";
+//# sourceMappingURL=proxyPublicApi.d.ts.map

package/dist/server/proxyPublicApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyPublicApi.d.ts","sourceRoot":"","sources":["../../server/proxyPublicApi.ts"],"names":[],"mappings":"AAAA,cAAc,gDAAgD,CAAC;AAC/D,cAAc,mDAAmD,CAAC"}

package/dist/server/proxyPublicApi.js

@@ -0,0 +1,2 @@
+export * from "../features/publicApi/server/proxyPublicApi.js";
+export * from "../features/publicApi/server/catalogSquidProxy.js";

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "@morapay/nextjs",
+  "version": "0.1.0",
+  "description": "Next.js BFF helpers for Morapay public API proxies (payment links, fiat, catalog)",
+  "license": "MIT",
+  "homepage": "https://docs.morapay.io/products/sdk",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/morapay-app/sdk.git",
+    "directory": "nextjs"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "type": "module",
+  "main": "./dist/features/publicApi/server/index.js",
+  "types": "./dist/features/publicApi/server/index.d.ts",
+  "exports": {
+    "./server/proxyPublicApi": {
+      "types": "./dist/server/proxyPublicApi.d.ts",
+      "import": "./dist/server/proxyPublicApi.js"
+    },
+    "./server/catalogSquidProxy": {
+      "types": "./dist/server/catalogSquidProxy.d.ts",
+      "import": "./dist/server/catalogSquidProxy.js"
+    },
+    "./features/publicApi/server": {
+      "types": "./dist/features/publicApi/server/index.d.ts",
+      "import": "./dist/features/publicApi/server/index.js"
+    },
+    "./features/publicApi/server/*": {
+      "types": "./dist/features/publicApi/server/*.d.ts",
+      "import": "./dist/features/publicApi/server/*.js"
+    },
+    "./client/loadWidget": {
+      "types": "./dist/client/loadWidget.d.ts",
+      "import": "./dist/client/loadWidget.js"
+    },
+    "./client/openPaymentLinkCheckout": {
+      "types": "./dist/client/openPaymentLinkCheckout.d.ts",
+      "import": "./dist/client/openPaymentLinkCheckout.js"
+    },
+    "./constants": {
+      "types": "./dist/constants.d.ts",
+      "import": "./dist/constants.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "pnpm run build"
+  },
+  "peerDependencies": {
+    "@morapay/sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@morapay/sdk": "workspace:*",
+    "@types/node": "^22.15.0",
+    "typescript": "^5.9.3"
+  },
+  "keywords": [
+    "morapay",
+    "nextjs",
+    "payments",
+    "checkout"
+  ],
+  "engines": {
+    "node": ">=20"
+  }
+}