@pandait.tech/payment-nuvei 0.1.0

package/dist/handlers/index.cjs

@@ -0,0 +1,1671 @@
+'use strict';
+
+var server = require('next/server');
+var firestore = require('firebase-admin/firestore');
+var crypto = require('crypto');
+var zod = require('zod');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var crypto__default = /*#__PURE__*/_interopDefault(crypto);
+
+// src/handlers/charge.ts
+var NUVEI_DOMAIN = "paymentez.com";
+function getBaseUrl() {
+  const env = process.env.NUVEI_ENV === "prod" ? "prod" : "stg";
+  return env === "prod" ? `https://ccapi.${NUVEI_DOMAIN}` : `https://ccapi-stg.${NUVEI_DOMAIN}`;
+}
+function getServerCredentials() {
+  const appCode = process.env.NUVEI_SERVER_APP_CODE;
+  const appKey = process.env.NUVEI_SERVER_APP_KEY;
+  if (!appCode || !appKey) {
+    throw new Error("Nuvei server credentials not configured");
+  }
+  return { appCode, appKey };
+}
+function generateAuthToken() {
+  const { appCode, appKey } = getServerCredentials();
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const uniqToken = crypto__default.default.createHash("sha256").update(`${appKey}${timestamp}`).digest("hex");
+  return Buffer.from(`${appCode};${timestamp};${uniqToken}`).toString(
+    "base64"
+  );
+}
+function getProxyUrl() {
+  return process.env.NUVEI_PROXY_URL || null;
+}
+async function nuveiRequest(path, method, body) {
+  const authToken = generateAuthToken();
+  const proxyUrl = getProxyUrl();
+  if (proxyUrl) {
+    console.log(`[nuvei] ${method} ${path} via proxy`);
+    const proxyResponse = await fetch(proxyUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-nuvei-auth-token": authToken,
+        "x-nuvei-env": process.env.NUVEI_ENV || "stg"
+      },
+      body: JSON.stringify({ path, method, body })
+    });
+    if (!proxyResponse.ok) {
+      const errorBody = await proxyResponse.text();
+      console.error(`[nuvei] ${method} ${path} proxy failed with status ${proxyResponse.status}. Body: ${errorBody}`);
+      try {
+        return JSON.parse(errorBody);
+      } catch {
+        throw new Error(`Nuvei proxy ${method} ${path} failed: ${proxyResponse.status}`);
+      }
+    }
+    return proxyResponse.json();
+  }
+  const url = `${getBaseUrl()}${path}`;
+  const options = {
+    method,
+    headers: {
+      "Content-Type": "application/json",
+      "Auth-Token": authToken
+    }
+  };
+  if (body && method === "POST") {
+    options.body = JSON.stringify(body);
+  }
+  const response = await fetch(url, options);
+  const responseText = await response.text();
+  console.log(`[nuvei] ${method} ${path} \u2192 ${response.status} | body: ${responseText.slice(0, 300)}`);
+  if (!response.ok) {
+    console.error(`[nuvei] ${method} ${path} failed with status ${response.status}`);
+    try {
+      return JSON.parse(responseText);
+    } catch {
+      throw new Error(`Nuvei ${method} ${path} failed: ${response.status}`);
+    }
+  }
+  try {
+    return JSON.parse(responseText);
+  } catch {
+    throw new Error(`Nuvei ${method} ${path}: invalid JSON response`);
+  }
+}
+async function listCards(uid) {
+  return nuveiRequest(`/v2/card/list?uid=${encodeURIComponent(uid)}`, "GET");
+}
+async function deleteCard(token, uid) {
+  return nuveiRequest("/v2/card/delete/", "POST", {
+    card: { token },
+    user: { id: uid }
+  });
+}
+async function refundTransaction(transactionId) {
+  return nuveiRequest("/v2/transaction/refund/", "POST", {
+    transaction: { id: transactionId }
+  });
+}
+async function verifyCard(params) {
+  return nuveiRequest("/v2/transaction/verify/", "POST", {
+    user: {
+      id: params.userId
+    },
+    transaction: {
+      id: params.transactionReference
+    },
+    type: "BY_AMOUNT",
+    value: params.value
+  });
+}
+async function debitWithToken(params) {
+  const order = {
+    amount: params.amount,
+    description: params.description,
+    dev_reference: params.devReference,
+    vat: params.vat ?? 0,
+    taxable_amount: params.taxableAmount ?? params.amount - (params.vat ?? 0),
+    tax_percentage: 15
+  };
+  if (params.installments && params.installments > 0) {
+    order.installments = params.installments;
+    order.installments_type = params.installmentsType ?? 0;
+  }
+  const body = {
+    user: {
+      id: params.userId,
+      email: params.userEmail
+    },
+    order,
+    card: {
+      token: params.cardToken,
+      ...params.cvc ? { cvc: params.cvc } : {}
+    }
+  };
+  if (params.browserInfo && params.termUrl) {
+    body.extra_params = {
+      threeDS2_data: {
+        term_url: params.termUrl,
+        device_type: "browser"
+      },
+      browser_info: params.browserInfo
+    };
+  }
+  return nuveiRequest("/v2/transaction/debit/", "POST", body);
+}
+async function verifyThreeDS(params) {
+  const body = {
+    user: {
+      id: params.userId
+    },
+    transaction: { id: params.transactionId },
+    type: params.type,
+    value: params.value ?? "",
+    more_info: true
+  };
+  return nuveiRequest("/v2/transaction/verify/", "POST", body);
+}
+
+// src/handlers/charge.ts
+var NUVEI_ERROR_MESSAGES = {
+  0: "Error del procesador de pagos. Intenta de nuevo.",
+  // 1 = review/pending — handled separately, not shown as error
+  2: "Error en la validaci\xF3n del banco. Verifica los datos de tu tarjeta.",
+  // 3 = success, not used here
+  4: "Tarjeta rechazada por el banco. Intenta con otra tarjeta.",
+  5: "Transacci\xF3n no permitida por el banco emisor.",
+  6: "Error de comunicaci\xF3n con el banco. Intenta en unos minutos.",
+  7: "Tarjeta reportada como perdida o robada. Contacta a tu banco.",
+  8: "Tarjeta rechazada por seguridad antifraude.",
+  9: "Transacci\xF3n denegada por el banco. Contacta a tu banco o intenta con otra tarjeta.",
+  10: "La tarjeta no pudo ser procesada. Intenta con otra tarjeta.",
+  11: "Transacci\xF3n rechazada por el sistema antifraude.",
+  12: "Tarjeta en lista restringida. Contacta a tu banco.",
+  13: "Tarjeta inv\xE1lida o deshabilitada. Contacta a tu banco.",
+  14: "El monto excede el l\xEDmite permitido por tu tarjeta.",
+  19: "Transacci\xF3n rechazada por filtro antifraude.",
+  20: "Tarjeta vencida. Actualiza tu m\xE9todo de pago.",
+  21: "C\xF3digo de seguridad (CVV) incorrecto.",
+  22: "Tipo de tarjeta no soportado para esta transacci\xF3n.",
+  23: "Transacci\xF3n rechazada. Intenta de nuevo m\xE1s tarde.",
+  31: "Tu banco requiere verificaci\xF3n OTP. Ingresa el c\xF3digo enviado a tu tel\xE9fono.",
+  36: "Tu banco requiere verificaci\xF3n adicional 3DS. Completa el proceso en la ventana emergente.",
+  37: "Tu banco requiere verificaci\xF3n adicional 3DS. Completa el proceso en la ventana emergente."
+};
+var THREEDS_AUTH_MESSAGES = {
+  N: "Autenticaci\xF3n 3DS rechazada por tu banco. Intenta con otra tarjeta.",
+  R: "Tu banco rechaz\xF3 la autenticaci\xF3n 3DS.",
+  U: "No se pudo verificar la autenticaci\xF3n 3DS. Intenta de nuevo."
+};
+function getNuveiUserMessage(statusDetail, rawMessage) {
+  if (statusDetail !== void 0 && NUVEI_ERROR_MESSAGES[statusDetail]) {
+    return NUVEI_ERROR_MESSAGES[statusDetail];
+  }
+  if (rawMessage?.toLowerCase().includes("insufficient")) {
+    return NUVEI_ERROR_MESSAGES[9];
+  }
+  if (rawMessage?.toLowerCase().includes("expired")) {
+    return NUVEI_ERROR_MESSAGES[20];
+  }
+  if (rawMessage?.toLowerCase().includes("cvv")) {
+    return NUVEI_ERROR_MESSAGES[21];
+  }
+  return "No se pudo procesar el pago. Verifica los datos de tu tarjeta o intenta con otra.";
+}
+function createChargeHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db, auth } = deps.firebase;
+  return async function POST(request) {
+    try {
+      const sessionCookie = request.cookies.get("__session")?.value;
+      if (!sessionCookie || !auth) {
+        return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+      }
+      let decodedToken;
+      try {
+        decodedToken = await auth.verifySessionCookie(sessionCookie, true);
+      } catch {
+        return server.NextResponse.json({ error: "Sesion invalida" }, { status: 401 });
+      }
+      const clientIpForLimit = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request.headers.get("x-real-ip") || "unknown";
+      if (deps.rateLimit) {
+        const allowed = await deps.rateLimit(
+          `charge:${clientIpForLimit}`,
+          10,
+          15 * 60 * 1e3
+        );
+        if (!allowed) {
+          return server.NextResponse.json(
+            { error: "Demasiados intentos. Intent\xE1 de nuevo en unos minutos." },
+            { status: 429 }
+          );
+        }
+      }
+      const body = await request.json();
+      if (deps.turnstile) {
+        const turnstileToken = body.turnstileToken;
+        if (!turnstileToken) {
+          return server.NextResponse.json(
+            { error: "Verificaci\xF3n de seguridad faltante. Recarg\xE1 la p\xE1gina." },
+            { status: 403 }
+          );
+        }
+        const turnstileResult = await deps.turnstile(
+          turnstileToken,
+          clientIpForLimit === "unknown" ? void 0 : clientIpForLimit
+        );
+        if (!turnstileResult.success) {
+          return server.NextResponse.json(
+            { error: "No pudimos verificar que sos humano. Recarg\xE1 la p\xE1gina." },
+            { status: 403 }
+          );
+        }
+      }
+      const {
+        token,
+        cvc,
+        orderId,
+        amount,
+        vat,
+        description,
+        userId,
+        userEmail,
+        browserInfo,
+        installments,
+        installmentsType
+      } = body;
+      logger.log("[charge] Request:", {
+        token: token?.substring(0, 10) + "...",
+        orderId,
+        amount,
+        userId: userId?.substring(0, 8) + "..."
+      });
+      if (!token || !orderId || !amount) {
+        return server.NextResponse.json({ error: "Datos incompletos" }, { status: 400 });
+      }
+      if (decodedToken.uid !== userId) {
+        return server.NextResponse.json({ error: "Usuario no coincide" }, { status: 403 });
+      }
+      const orderDoc = await db.collection("orders").doc(orderId).get();
+      if (!orderDoc.exists) {
+        return server.NextResponse.json({ error: "Orden no encontrada" }, { status: 404 });
+      }
+      const orderData = orderDoc.data() ?? {};
+      if (orderData.status !== "pending") {
+        return server.NextResponse.json(
+          { error: "Esta orden ya fue procesada" },
+          { status: 409 }
+        );
+      }
+      let runStandardValidation = true;
+      if (deps.validateCustomOrder) {
+        const customResult = await deps.validateCustomOrder({
+          orderId,
+          orderData,
+          amount
+        });
+        if (customResult.handled) {
+          if (!customResult.valid) {
+            return server.NextResponse.json(
+              { error: customResult.error },
+              { status: customResult.status }
+            );
+          }
+          runStandardValidation = false;
+        }
+      }
+      if (runStandardValidation) {
+        const orderItems = orderData.items ?? [];
+        let verifiedSubtotal = 0;
+        for (const item of orderItems) {
+          const productDoc = await db.collection("products").doc(item.productId).get();
+          if (!productDoc.exists || !productDoc.data()?.isActive) {
+            return server.NextResponse.json(
+              { error: `El producto "${item.name}" ya no est\xE1 disponible` },
+              { status: 409 }
+            );
+          }
+          const productData = productDoc.data();
+          const isDigital = productData.isDigital === true;
+          const stock = productData.stock ?? 0;
+          if (!isDigital && stock < item.quantity) {
+            return server.NextResponse.json(
+              {
+                error: `Stock insuficiente para "${item.name}" (disponible: ${stock})`
+              },
+              { status: 409 }
+            );
+          }
+          const display = deps.getPriceDisplay({
+            price: productData.price ?? 0,
+            autoDiscounts: productData.autoDiscounts
+          });
+          const expectedItemSubtotal = display.finalSubtotal;
+          if (Math.abs(expectedItemSubtotal - item.price) > 0.02) {
+            return server.NextResponse.json(
+              {
+                error: `El precio de "${item.name}" cambi\xF3. Recarg\xE1 la p\xE1gina para ver el precio actualizado.`
+              },
+              { status: 409 }
+            );
+          }
+          verifiedSubtotal += expectedItemSubtotal * item.quantity;
+        }
+        let verifiedDiscount = 0;
+        const orderDiscount = orderData.discount ?? 0;
+        const orderPromotionId = orderData.promotionId;
+        if (orderPromotionId && orderDiscount > 0) {
+          const promoDoc = await db.collection("promotions").doc(orderPromotionId).get();
+          if (!promoDoc.exists || !promoDoc.data()?.isActive) {
+            return server.NextResponse.json(
+              { error: "El cupon aplicado ya no es valido. Remuevelo y vuelve a intentar." },
+              { status: 409 }
+            );
+          }
+          const promo = promoDoc.data();
+          const now = /* @__PURE__ */ new Date();
+          const validFrom = promo.rules.validFrom.toDate ? promo.rules.validFrom.toDate() : new Date(promo.rules.validFrom);
+          const validUntil = promo.rules.validUntil.toDate ? promo.rules.validUntil.toDate() : new Date(promo.rules.validUntil);
+          if (now < validFrom || now > validUntil) {
+            return server.NextResponse.json(
+              { error: "El cupon aplicado ha expirado. Remuevelo y vuelve a intentar." },
+              { status: 409 }
+            );
+          }
+          if (promo.rules.maxTotalUses && promo.currentUses >= promo.rules.maxTotalUses) {
+            return server.NextResponse.json(
+              { error: "El cupon aplicado ya alcanzo su limite de usos." },
+              { status: 409 }
+            );
+          }
+          if (promo.type === "percentage") {
+            verifiedDiscount = verifiedSubtotal * (promo.value / 100);
+            if (promo.maxDiscountAmount) {
+              verifiedDiscount = Math.min(verifiedDiscount, promo.maxDiscountAmount);
+            }
+          } else if (promo.type === "fixed_amount") {
+            verifiedDiscount = Math.min(promo.value, verifiedSubtotal);
+          }
+          verifiedDiscount = Math.round(verifiedDiscount * 100) / 100;
+        }
+        const verifiedDiscountedSubtotal = Math.max(0, verifiedSubtotal - verifiedDiscount);
+        const verifiedVat = Math.round(verifiedDiscountedSubtotal * 0.15 * 100) / 100;
+        const verifiedTotal = Math.round((verifiedDiscountedSubtotal + verifiedVat) * 100) / 100;
+        if (verifiedTotal !== amount) {
+          return server.NextResponse.json(
+            {
+              error: "El monto no coincide con los precios actuales. Actualiza tu carrito."
+            },
+            { status: 409 }
+          );
+        }
+      }
+      const functionsBase = deps.cloudFunctionsBaseUrl ?? process.env.CLOUD_FUNCTIONS_BASE_URL;
+      const termUrl = functionsBase ? `${functionsBase}/threeDSCallback?orderId=${orderId}` : void 0;
+      if (browserInfo && !termUrl) {
+        logger.error(
+          "[charge] browserInfo provided but cloudFunctionsBaseUrl is not configured. 3DS challenges will not initiate. Configure ChargeHandlerDeps.cloudFunctionsBaseUrl (or CLOUD_FUNCTIONS_BASE_URL env var) pointing to your 3DS callback endpoint."
+        );
+      }
+      const clientIp = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request.headers.get("x-real-ip") || "127.0.0.1";
+      const enrichedBrowserInfo = browserInfo ? { ...browserInfo, ip_address: clientIp } : void 0;
+      const discountedSubtotalForTax = amount - (vat ?? 0);
+      const nuveiData = await debitWithToken({
+        userId,
+        userEmail,
+        amount,
+        description: description || deps.merchantName,
+        devReference: orderId,
+        cardToken: token,
+        ...cvc ? { cvc } : {},
+        vat: vat ?? 0,
+        taxableAmount: discountedSubtotalForTax,
+        ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
+        ...enrichedBrowserInfo && termUrl ? { browserInfo: enrichedBrowserInfo, termUrl } : {}
+      });
+      logger.log("[charge] Nuvei debit response FULL:", JSON.stringify(nuveiData));
+      logger.log(
+        "[charge] Nuvei debit response summary:",
+        JSON.stringify({
+          status: nuveiData.transaction?.status,
+          status_detail: nuveiData.transaction?.status_detail,
+          id: nuveiData.transaction?.id,
+          "3ds_auth": nuveiData["3ds"]?.authentication?.status,
+          error: nuveiData.error
+        })
+      );
+      if (nuveiData.transaction && nuveiData.transaction.status === "success" && nuveiData.transaction.status_detail === 3) {
+        const rawAuthCode = nuveiData.transaction.authorization_code;
+        const hasValidAuthCode = typeof rawAuthCode === "string" && rawAuthCode.trim().length > 0 && rawAuthCode !== "null";
+        const batch = db.batch();
+        const orderRef = db.collection("orders").doc(orderId);
+        if (hasValidAuthCode) {
+          batch.update(orderRef, {
+            status: "paid",
+            paymentTransactionId: nuveiData.transaction.id,
+            authorizationCode: rawAuthCode,
+            ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
+            chargeResponseAt: /* @__PURE__ */ new Date(),
+            updatedAt: /* @__PURE__ */ new Date()
+          });
+        } else {
+          logger.error(
+            `[AUDIT:MISSING_AUTH_CODE] orderId=${orderId} txId=${nuveiData.transaction.id} debitResponse=${JSON.stringify(nuveiData)}`
+          );
+          batch.update(orderRef, {
+            status: "paid",
+            paymentTransactionId: nuveiData.transaction.id,
+            missingAuthCodeFlagged: true,
+            missingAuthCodeLoggedAt: /* @__PURE__ */ new Date(),
+            emailPending: true,
+            ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
+            chargeResponseAt: /* @__PURE__ */ new Date(),
+            updatedAt: /* @__PURE__ */ new Date()
+          });
+        }
+        const orderSnap = await orderRef.get();
+        const orderInfo = orderSnap.data() ?? {};
+        if (orderInfo.promotionId) {
+          const promoRef = db.collection("promotions").doc(orderInfo.promotionId);
+          batch.update(promoRef, {
+            currentUses: firestore.FieldValue.increment(1)
+          });
+          const usageRef = promoRef.collection("usages").doc();
+          batch.set(usageRef, {
+            userId: orderInfo.userId,
+            orderId,
+            discountApplied: orderInfo.discount || 0,
+            usedAt: /* @__PURE__ */ new Date()
+          });
+        }
+        await batch.commit();
+        if (deps.onPaymentSucceeded) {
+          try {
+            await deps.onPaymentSucceeded({ ...orderInfo, id: orderId });
+          } catch (err) {
+            logger.error(
+              `[charge] onPaymentSucceeded hook failed for order ${orderId}:`,
+              err
+            );
+          }
+        }
+        let emailSent = false;
+        if (hasValidAuthCode) {
+          const emailResult = await deps.email.sendPaymentConfirmation({
+            to: userEmail,
+            customerName: orderInfo.shippingAddress?.fullName || "",
+            orderId,
+            transactionId: nuveiData.transaction.id,
+            authorizationCode: rawAuthCode,
+            items: orderInfo.items || [],
+            subtotal: orderInfo.subtotal || amount,
+            discount: orderInfo.discount || void 0,
+            couponCode: orderInfo.couponCode,
+            vat: orderInfo.vat || vat,
+            total: amount,
+            ...orderInfo.postPurchaseNote ? { postPurchaseNote: orderInfo.postPurchaseNote } : {}
+          }).catch(() => ({ success: false }));
+          emailSent = emailResult.success;
+          if (emailSent) {
+            await orderRef.update({ emailSentAt: /* @__PURE__ */ new Date() });
+          }
+        }
+        if (body.deleteCardAfterPayment && token) {
+          deleteCard(token, userId).catch(
+            (err) => logger.error("[charge] Failed to delete card after payment:", err)
+          );
+        }
+        return server.NextResponse.json({
+          success: true,
+          transactionId: nuveiData.transaction.id,
+          authorizationCode: hasValidAuthCode ? rawAuthCode : null,
+          orderId,
+          emailSent
+        });
+      }
+      if (nuveiData.transaction?.status === "pending" && nuveiData.transaction?.status_detail === 1) {
+        await db.collection("orders").doc(orderId).update({
+          status: "processing",
+          paymentTransactionId: nuveiData.transaction.id || null,
+          chargeResponseAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        return server.NextResponse.json({
+          review: true,
+          orderId,
+          transactionId: nuveiData.transaction.id
+        });
+      }
+      const persistDeleteOnPaid = body.deleteCardAfterPayment ? { deleteCardAfterPayment: true, paymentToken: token } : {};
+      if (nuveiData.transaction?.status_detail === 35) {
+        const threeDSData = nuveiData["3ds"];
+        const hiddenIframeHtml = threeDSData?.browser_response?.hidden_iframe || "";
+        await db.collection("orders").doc(orderId).update({
+          status: "3ds-pending",
+          isDeviceFingerprint: true,
+          nuveiTransactionId: nuveiData.transaction.id || null,
+          ...persistDeleteOnPaid,
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        return server.NextResponse.json({
+          challenge: true,
+          challengeHtml: hiddenIframeHtml,
+          isDeviceFingerprint: true,
+          orderId,
+          nuveiTransactionId: nuveiData.transaction.id,
+          statusDetail: 35
+        });
+      }
+      if (nuveiData.transaction?.status_detail === 31) {
+        await db.collection("orders").doc(orderId).update({
+          status: "otp-pending",
+          nuveiTransactionId: nuveiData.transaction.id || null,
+          ...persistDeleteOnPaid,
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        return server.NextResponse.json({
+          otpRequired: true,
+          orderId,
+          nuveiTransactionId: nuveiData.transaction.id,
+          statusDetail: 31
+        });
+      }
+      if (nuveiData.transaction?.status_detail === 36 || nuveiData.transaction?.status_detail === 37) {
+        const threeDSData = nuveiData["3ds"];
+        const challengeHtml = threeDSData?.browser_response?.challenge_request || threeDSData?.browser_response?.hidden_iframe || "";
+        const rawDebit = nuveiData;
+        const debitCres = rawDebit["3ds"]?.authentication?.["cres"] || rawDebit["3ds"]?.browser_response?.["cres"] || rawDebit["3ds"]?.["cres"] || rawDebit.transaction?.["cres"] || rawDebit["cres"] || rawDebit["value"] || null;
+        logger.log(
+          `[charge] status ${nuveiData.transaction.status_detail} \u2014 debitCres captured: ${debitCres ? "YES (len=" + debitCres.length + ")" : "NO"}`
+        );
+        if (challengeHtml) {
+          await db.collection("orders").doc(orderId).update({
+            status: "3ds-pending",
+            nuveiTransactionId: nuveiData.transaction?.id || null,
+            ...debitCres ? { threeDSCres: debitCres } : {},
+            ...persistDeleteOnPaid,
+            updatedAt: /* @__PURE__ */ new Date()
+          });
+          return server.NextResponse.json({
+            challenge: true,
+            challengeHtml,
+            isDeviceFingerprint: false,
+            orderId,
+            nuveiTransactionId: nuveiData.transaction?.id,
+            statusDetail: nuveiData.transaction?.status_detail
+          });
+        }
+      }
+      const threeDSStatus = nuveiData["3ds"]?.authentication?.status;
+      if (threeDSStatus && THREEDS_AUTH_MESSAGES[threeDSStatus]) {
+        const threeDSErrorMsg = THREEDS_AUTH_MESSAGES[threeDSStatus];
+        const currentOrder2 = await db.collection("orders").doc(orderId).get();
+        const currentOrderData2 = currentOrder2.data() ?? {};
+        if (currentOrderData2.status === "pending") {
+          await db.collection("orders").doc(orderId).update({
+            status: "failed",
+            chargeResponseAt: /* @__PURE__ */ new Date(),
+            updatedAt: /* @__PURE__ */ new Date()
+          });
+        }
+        if (userEmail) {
+          const retryUrl = deps.getRetryUrl?.({ ...currentOrderData2, id: orderId });
+          deps.email.sendPaymentFailed({
+            to: userEmail,
+            customerName: currentOrderData2.shippingAddress?.fullName || "",
+            orderId,
+            errorMessage: threeDSErrorMsg,
+            items: currentOrderData2.items || [],
+            total: currentOrderData2.total || amount,
+            ...retryUrl ? { retryUrl } : {}
+          }).catch(() => {
+          });
+        }
+        return server.NextResponse.json({ error: threeDSErrorMsg }, { status: 400 });
+      }
+      const failedErrorMsg = getNuveiUserMessage(
+        nuveiData.transaction?.status_detail,
+        nuveiData.transaction?.message || nuveiData.error?.description
+      );
+      const currentOrder = await db.collection("orders").doc(orderId).get();
+      const currentOrderData = currentOrder.data() ?? {};
+      if (currentOrderData.status === "pending") {
+        await db.collection("orders").doc(orderId).update({
+          status: "failed",
+          chargeResponseAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+      }
+      if (userEmail) {
+        const retryUrl = deps.getRetryUrl?.({ ...currentOrderData, id: orderId });
+        deps.email.sendPaymentFailed({
+          to: userEmail,
+          customerName: currentOrderData.shippingAddress?.fullName || "",
+          orderId,
+          errorMessage: failedErrorMsg,
+          items: currentOrderData.items || [],
+          total: currentOrderData.total || amount,
+          ...retryUrl ? { retryUrl } : {}
+        }).catch(() => {
+        });
+      }
+      return server.NextResponse.json({ error: failedErrorMsg }, { status: 400 });
+    } catch (error) {
+      logger.error("Payment charge error:", error);
+      return server.NextResponse.json(
+        { error: "Error interno del servidor" },
+        { status: 500 }
+      );
+    }
+  };
+}
+function extractCres(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  const p = payload;
+  const candidates = [
+    p["cres"],
+    p["CRes"],
+    p["value"],
+    p["3ds"]?.authentication?.["cres"],
+    p["3ds"]?.browser_response?.["cres"],
+    p["3ds"]?.["cres"],
+    p.transaction?.["cres"],
+    p.transaction?.["3ds"]?.authentication?.["cres"]
+  ];
+  for (const c of candidates) {
+    if (typeof c === "string" && c.trim().length > 0) return c;
+  }
+  return null;
+}
+function createWebhookHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db } = deps.firebase;
+  return async function POST(request) {
+    try {
+      const payload = await request.json();
+      logger.log("[webhook] Full payload:", JSON.stringify(payload));
+      const { transaction } = payload;
+      if (!transaction?.id || !transaction?.dev_reference) {
+        return server.NextResponse.json({ error: "Payload inv\xE1lido" }, { status: 400 });
+      }
+      const incomingCres = extractCres(payload);
+      if (incomingCres) {
+        logger.log(
+          `[webhook] CRES present in webhook payload (len=${incomingCres.length}) for txId=${transaction.id}`
+        );
+      }
+      const devRef = transaction.dev_reference;
+      if (deps.handleCustomDevReference) {
+        const customResponse = await deps.handleCustomDevReference(
+          devRef,
+          transaction,
+          payload
+        );
+        if (customResponse) return customResponse;
+      }
+      const orderId = devRef;
+      const orderRef = db.collection("orders").doc(orderId);
+      const orderDoc = await orderRef.get();
+      if (!orderDoc.exists) {
+        logger.error(`Webhook: Order ${orderId} not found`);
+        return server.NextResponse.json({ error: "Orden no encontrada" }, { status: 404 });
+      }
+      const orderDataEarly = orderDoc.data() ?? {};
+      if (incomingCres && orderDataEarly.status === "3ds-pending" && !orderDataEarly.verifyCalledAt) {
+        try {
+          await db.runTransaction(async (tx) => {
+            const doc = await tx.get(orderRef);
+            if (doc.data()?.verifyCalledAt) throw new Error("ALREADY_CALLED");
+            tx.update(orderRef, {
+              verifyCalledAt: /* @__PURE__ */ new Date(),
+              threeDSCres: incomingCres
+            });
+          });
+          logger.log(`[webhook] Calling verify BY_CRES for order ${orderId}`);
+          const verifyResult = await verifyThreeDS({
+            transactionId: orderDataEarly.nuveiTransactionId || transaction.id,
+            userId: orderDataEarly.userId,
+            type: "BY_CRES",
+            value: incomingCres
+          });
+          logger.log(`[webhook] verify response: ${JSON.stringify(verifyResult)}`);
+          const raw = verifyResult;
+          const vStatus = verifyResult.transaction?.status ?? raw["status"];
+          const vDetail = verifyResult.transaction?.status_detail ?? raw["status_detail"];
+          const vAuthCode = verifyResult.transaction?.authorization_code ?? raw["authorization_code"] ?? null;
+          const vTxId = verifyResult.transaction?.id ?? raw["transaction_id"] ?? orderDataEarly.nuveiTransactionId ?? transaction.id;
+          const verifySuccess = (vStatus === "success" || vStatus === 1) && vDetail === 3;
+          if (verifySuccess) {
+            const hasAuth = typeof vAuthCode === "string" && vAuthCode.trim().length > 0 && vAuthCode !== "null";
+            const batch = db.batch();
+            batch.update(orderRef, {
+              status: "paid",
+              paymentTransactionId: vTxId,
+              ...hasAuth ? { authorizationCode: vAuthCode } : {
+                missingAuthCodeFlagged: true,
+                missingAuthCodeLoggedAt: /* @__PURE__ */ new Date(),
+                emailPending: true
+              },
+              chargeResponseAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date(),
+              threeDSCres: firestore.FieldValue.delete(),
+              threeDSTransStatus: firestore.FieldValue.delete()
+            });
+            if (orderDataEarly.promotionId) {
+              const promoRef = db.collection("promotions").doc(orderDataEarly.promotionId);
+              batch.update(promoRef, {
+                currentUses: firestore.FieldValue.increment(1)
+              });
+              const usageRef = promoRef.collection("usages").doc();
+              batch.set(usageRef, {
+                userId: orderDataEarly.userId,
+                orderId,
+                discountApplied: orderDataEarly.discount || 0,
+                usedAt: /* @__PURE__ */ new Date()
+              });
+            }
+            await batch.commit();
+            if (hasAuth && orderDataEarly.userEmail) {
+              await deps.email.sendPaymentConfirmation({
+                to: orderDataEarly.userEmail,
+                customerName: orderDataEarly.shippingAddress?.fullName || "",
+                orderId,
+                transactionId: vTxId,
+                authorizationCode: vAuthCode,
+                items: orderDataEarly.items || [],
+                subtotal: orderDataEarly.subtotal || orderDataEarly.total || 0,
+                discount: orderDataEarly.discount || void 0,
+                couponCode: orderDataEarly.couponCode,
+                vat: orderDataEarly.vat || 0,
+                total: orderDataEarly.total || 0
+              }).catch(() => ({ success: false }));
+              await orderRef.update({ emailSentAt: /* @__PURE__ */ new Date() });
+            }
+            if (orderDataEarly.deleteCardAfterPayment && orderDataEarly.paymentToken) {
+              deleteCard(
+                orderDataEarly.paymentToken,
+                orderDataEarly.userId
+              ).catch(
+                (err) => logger.error(
+                  "[webhook] Failed to delete card after payment:",
+                  err
+                )
+              );
+            }
+            if (deps.onPaymentSucceeded) {
+              try {
+                await deps.onPaymentSucceeded({ ...orderDataEarly, id: orderId });
+              } catch (err) {
+                logger.error(
+                  `[webhook] onPaymentSucceeded hook failed for ${orderId}:`,
+                  err
+                );
+              }
+            }
+            return server.NextResponse.json({ received: true, verifiedFromWebhook: true });
+          }
+        } catch (err) {
+          if (err.message !== "ALREADY_CALLED") {
+            logger.error(
+              `[webhook] Failed to verify BY_CRES for order ${orderId}:`,
+              err
+            );
+          }
+        }
+      }
+      const isApproved = transaction.status === "success" && transaction.status_detail === 3;
+      const currentStatus = orderDoc.data()?.status;
+      const finalStatuses = ["paid", "delivered", "shipped"];
+      const shouldUpdateStatus = isApproved || !finalStatuses.includes(currentStatus);
+      const orderData = orderDoc.data() ?? {};
+      const webhookAuthCode = transaction.authorization_code;
+      const hasValidAuthCode = typeof webhookAuthCode === "string" && webhookAuthCode.trim().length > 0 && webhookAuthCode !== "null";
+      const updatePayload = {
+        ...shouldUpdateStatus && {
+          status: isApproved ? "paid" : "cancelled"
+        },
+        paymentTransactionId: transaction.id,
+        authorizationCode: webhookAuthCode || null,
+        webhookStatus: transaction.status,
+        webhookStatusDetail: transaction.status_detail,
+        webhookReceivedAt: /* @__PURE__ */ new Date(),
+        updatedAt: /* @__PURE__ */ new Date()
+      };
+      const shouldSendPendingEmail = isApproved && orderData.emailPending === true && hasValidAuthCode && orderData.userEmail;
+      if (shouldSendPendingEmail) {
+        updatePayload.emailPending = firestore.FieldValue.delete();
+        updatePayload.missingAuthCodeFlagged = firestore.FieldValue.delete();
+        updatePayload.emailSentAt = /* @__PURE__ */ new Date();
+      }
+      await orderRef.update(updatePayload);
+      if (shouldSendPendingEmail) {
+        try {
+          await deps.email.sendPaymentConfirmation({
+            to: orderData.userEmail,
+            customerName: orderData.shippingAddress?.fullName || "",
+            orderId,
+            transactionId: transaction.id,
+            authorizationCode: webhookAuthCode,
+            items: orderData.items || [],
+            subtotal: orderData.subtotal || orderData.total || 0,
+            discount: orderData.discount || void 0,
+            couponCode: orderData.couponCode,
+            vat: orderData.vat || 0,
+            total: orderData.total || 0
+          });
+          logger.log(`[webhook] Pending confirmation email sent for order ${orderId}`);
+        } catch (err) {
+          logger.error(`[webhook] Failed to send pending confirmation email:`, err);
+        }
+      } else if (isApproved && orderData.emailPending === true && !hasValidAuthCode && orderData.userEmail) {
+        logger.error(
+          `[AUDIT:EMAIL_SENT_WITHOUT_AUTH_CODE] orderId=${orderId} txId=${transaction.id}`
+        );
+        try {
+          await deps.email.sendPaymentPending({
+            to: orderData.userEmail,
+            customerName: orderData.shippingAddress?.fullName || "",
+            orderId,
+            transactionId: transaction.id,
+            items: orderData.items || [],
+            subtotal: orderData.subtotal || orderData.total || 0,
+            discount: orderData.discount || void 0,
+            couponCode: orderData.couponCode,
+            vat: orderData.vat || 0,
+            total: orderData.total || 0
+          });
+          await orderRef.update({
+            emailPending: firestore.FieldValue.delete(),
+            emailSentAt: /* @__PURE__ */ new Date()
+          });
+        } catch (err) {
+          logger.error(`[webhook] Failed to send pending-status email:`, err);
+        }
+      }
+      const newStatus = shouldUpdateStatus ? isApproved ? "paid" : "cancelled" : currentStatus;
+      logger.log(
+        `Webhook: Order ${orderId} \u2192 ${newStatus} (status_detail: ${transaction.status_detail})`
+      );
+      if (newStatus === "paid" && deps.onPaymentSucceeded) {
+        try {
+          await deps.onPaymentSucceeded({ ...orderData, id: orderId });
+        } catch (err) {
+          logger.error(
+            `[webhook] onPaymentSucceeded hook failed for ${orderId}:`,
+            err
+          );
+        }
+      }
+      return server.NextResponse.json({ received: true });
+    } catch (error) {
+      logger.error("Webhook processing error:", error);
+      return server.NextResponse.json(
+        { error: "Error procesando webhook" },
+        { status: 500 }
+      );
+    }
+  };
+}
+function buildCompletionPage(orderId, transStatus) {
+  const html = `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>3DS Verification</title></head>
+<body>
+<script>
+(function() {
+  var message = {
+    type: "3DS_COMPLETE",
+    orderId: "${orderId}",
+    transStatus: "${transStatus}"
+  };
+  try {
+    if (window.parent && window.parent !== window) {
+      window.parent.postMessage(message, "*");
+    } else if (window.opener) {
+      window.opener.postMessage(message, "*");
+    }
+  } catch(e) {}
+})();
+</script>
+<p style="font-family:sans-serif;color:#666;text-align:center;margin-top:40px">
+Verificando autenticaci&oacute;n...
+</p>
+</body></html>`;
+  return new server.NextResponse(html, {
+    status: 200,
+    headers: { "Content-Type": "text/html; charset=utf-8" }
+  });
+}
+function create3dsCallbackHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db } = deps.firebase;
+  async function storeCres(orderId, cres) {
+    if (orderId && cres) {
+      try {
+        await db.collection("orders").doc(orderId).update({
+          threeDSCres: cres,
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+      } catch (err) {
+        logger.error("Failed to store cres on order:", err);
+      }
+    }
+  }
+  const POST = async function POST2(request) {
+    const { searchParams } = new URL(request.url);
+    const orderId = searchParams.get("orderId") || "";
+    let transStatus = "U";
+    let cres = "";
+    try {
+      const contentType = request.headers.get("content-type") || "";
+      if (contentType.includes("application/x-www-form-urlencoded")) {
+        const text = await request.text();
+        const params = new URLSearchParams(text);
+        transStatus = params.get("transStatus") || "U";
+        cres = params.get("cres") || params.get("CRes") || "";
+      } else {
+        const body = await request.json();
+        transStatus = body.transStatus || "U";
+        cres = body.cres || body.CRes || "";
+      }
+    } catch {
+    }
+    await storeCres(orderId, cres);
+    return buildCompletionPage(orderId, transStatus);
+  };
+  const GET = async function GET2(request) {
+    const { searchParams } = new URL(request.url);
+    const orderId = searchParams.get("orderId") || "";
+    const transStatus = searchParams.get("transStatus") || "Y";
+    const cres = searchParams.get("cres") || searchParams.get("CRes") || "";
+    await storeCres(orderId, cres);
+    return buildCompletionPage(orderId, transStatus);
+  };
+  return { POST, GET };
+}
+var ThreeDSCompleteSchema = zod.z.object({
+  orderId: zod.z.string().min(1),
+  userId: zod.z.string().min(1),
+  type: zod.z.enum(["AUTHENTICATION_CONTINUE", "BY_CRES", "BY_OTP"]),
+  nuveiTransactionId: zod.z.string().optional(),
+  otpCode: zod.z.string().optional()
+});
+function create3dsCompleteHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db, auth } = deps.firebase;
+  return async function POST(request) {
+    try {
+      const sessionCookie = request.cookies.get("__session")?.value;
+      if (!sessionCookie || !auth) {
+        return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+      }
+      let decodedToken;
+      try {
+        decodedToken = await auth.verifySessionCookie(sessionCookie, true);
+      } catch {
+        return server.NextResponse.json({ error: "Sesion invalida" }, { status: 401 });
+      }
+      const rawBody = await request.json();
+      const parsed = ThreeDSCompleteSchema.safeParse(rawBody);
+      if (!parsed.success) {
+        return server.NextResponse.json({ error: "Datos incompletos" }, { status: 400 });
+      }
+      const { orderId, userId, type, nuveiTransactionId: bodyTxId, otpCode } = parsed.data;
+      if (decodedToken.uid !== userId) {
+        return server.NextResponse.json({ error: "Usuario no coincide" }, { status: 403 });
+      }
+      const orderDoc = await db.collection("orders").doc(orderId).get();
+      if (!orderDoc.exists) {
+        return server.NextResponse.json({ error: "Orden no encontrada" }, { status: 404 });
+      }
+      const orderData = orderDoc.data() ?? {};
+      if (orderData.status === "paid") {
+        return server.NextResponse.json({
+          success: true,
+          transactionId: orderData.paymentTransactionId,
+          authorizationCode: orderData.authorizationCode || null,
+          orderId
+        });
+      }
+      if (orderData.verifyCalledAt) {
+        logger.log(
+          `[3ds-complete] verify already called for order ${orderId}, returning current state`
+        );
+        return server.NextResponse.json({ error: "Pago ya procesado" }, { status: 409 });
+      }
+      if (orderData.status !== "3ds-pending" && orderData.status !== "otp-pending") {
+        return server.NextResponse.json(
+          { error: "Esta orden ya fue procesada" },
+          { status: 409 }
+        );
+      }
+      const storedTransStatus = orderData.threeDSTransStatus;
+      if (storedTransStatus && storedTransStatus !== "Y" && storedTransStatus !== "A") {
+        await db.collection("orders").doc(orderId).update({
+          status: "failed",
+          chargeResponseAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        const msg = storedTransStatus === "N" ? "Autenticaci\xF3n 3DS rechazada por tu banco." : storedTransStatus === "R" ? "Tu banco rechaz\xF3 la autenticaci\xF3n 3DS." : "No se pudo verificar la autenticaci\xF3n 3DS.";
+        const userEmail2 = orderData.userEmail || decodedToken.email || "";
+        if (userEmail2) {
+          const retryUrl = deps.getRetryUrl?.({ ...orderData, id: orderId });
+          deps.email.sendPaymentFailed({
+            to: userEmail2,
+            customerName: orderData.shippingAddress?.fullName || "",
+            orderId,
+            errorMessage: msg,
+            items: orderData.items || [],
+            total: orderData.total || 0,
+            ...retryUrl ? { retryUrl } : {}
+          }).catch(() => {
+          });
+        }
+        return server.NextResponse.json({ error: msg }, { status: 400 });
+      }
+      const transactionId = orderData.nuveiTransactionId || bodyTxId;
+      if (!transactionId) {
+        return server.NextResponse.json(
+          { error: "No se encontr\xF3 el ID de transacci\xF3n para verificar" },
+          { status: 400 }
+        );
+      }
+      if (type === "AUTHENTICATION_CONTINUE" && !orderData.threeDSCres && !orderData.isDeviceFingerprint) {
+        logger.log(`[3ds-complete] No CRES yet for order ${orderId} \u2014 still pending`);
+        return server.NextResponse.json({ stillPending: true });
+      }
+      const actualType = type === "AUTHENTICATION_CONTINUE" && orderData.threeDSCres ? "BY_CRES" : type;
+      const cresValue = actualType === "BY_CRES" ? orderData.threeDSCres : void 0;
+      if (actualType === "BY_CRES" && !cresValue) {
+        return server.NextResponse.json(
+          { error: "No se encontr\xF3 el valor de autenticaci\xF3n 3DS (cres)" },
+          { status: 400 }
+        );
+      }
+      if (type === "BY_OTP" && !otpCode) {
+        return server.NextResponse.json(
+          { error: "Debes ingresar el c\xF3digo OTP" },
+          { status: 400 }
+        );
+      }
+      const verifyValue = type === "BY_OTP" ? otpCode : cresValue;
+      const orderRef = db.collection("orders").doc(orderId);
+      await orderRef.update({ lastVerifyAttemptAt: /* @__PURE__ */ new Date() });
+      logger.log(
+        `[3ds-complete] BEFORE verify: orderId=${orderId}, type=${actualType}, hasValue=${!!verifyValue}`
+      );
+      const verifyResult = await verifyThreeDS({
+        transactionId,
+        userId,
+        type: actualType,
+        value: verifyValue
+      });
+      logger.log(
+        `[3ds-complete] AFTER verify: authCode=${verifyResult.transaction?.authorization_code ?? "MISSING"} status=${verifyResult.transaction?.status} detail=${verifyResult.transaction?.status_detail}`
+      );
+      const raw = verifyResult;
+      const txStatus = verifyResult.transaction?.status ?? raw["status"];
+      const txStatusDetail = verifyResult.transaction?.status_detail ?? raw["status_detail"];
+      const txId = verifyResult.transaction?.id ?? raw["transaction_id"] ?? transactionId;
+      const txAuthCode = verifyResult.transaction?.authorization_code ?? raw["authorization_code"] ?? null;
+      const isSuccess = (txStatus === "success" || txStatus === 1) && txStatusDetail === 3;
+      const isStillPending = !isSuccess && (txStatusDetail === 36 || txStatusDetail === 37 || txStatus === "pending");
+      if (isStillPending) {
+        logger.log(
+          `[3ds-complete] Still pending: txStatus=${txStatus} detail=${txStatusDetail}. Polling continues.`
+        );
+        return server.NextResponse.json({ stillPending: true });
+      }
+      if (isSuccess) {
+        const hasValidAuthCode = typeof txAuthCode === "string" && txAuthCode.trim().length > 0 && txAuthCode !== "null";
+        const batch = db.batch();
+        if (hasValidAuthCode) {
+          batch.update(orderRef, {
+            status: "paid",
+            paymentTransactionId: txId,
+            authorizationCode: txAuthCode,
+            chargeResponseAt: /* @__PURE__ */ new Date(),
+            updatedAt: /* @__PURE__ */ new Date(),
+            threeDSCres: firestore.FieldValue.delete(),
+            threeDSTransStatus: firestore.FieldValue.delete(),
+            isDeviceFingerprint: firestore.FieldValue.delete()
+          });
+        } else {
+          logger.error(
+            `[AUDIT:MISSING_AUTH_CODE] orderId=${orderId} txId=${txId} verifyResponse=${JSON.stringify(verifyResult)}`
+          );
+          batch.update(orderRef, {
+            status: "paid",
+            paymentTransactionId: txId,
+            missingAuthCodeFlagged: true,
+            missingAuthCodeLoggedAt: /* @__PURE__ */ new Date(),
+            emailPending: true,
+            chargeResponseAt: /* @__PURE__ */ new Date(),
+            updatedAt: /* @__PURE__ */ new Date(),
+            threeDSCres: firestore.FieldValue.delete(),
+            threeDSTransStatus: firestore.FieldValue.delete(),
+            isDeviceFingerprint: firestore.FieldValue.delete()
+          });
+        }
+        if (orderData.promotionId) {
+          const promoRef = db.collection("promotions").doc(orderData.promotionId);
+          batch.update(promoRef, {
+            currentUses: firestore.FieldValue.increment(1)
+          });
+          const usageRef = promoRef.collection("usages").doc();
+          batch.set(usageRef, {
+            userId: orderData.userId,
+            orderId,
+            discountApplied: orderData.discount || 0,
+            usedAt: /* @__PURE__ */ new Date()
+          });
+        }
+        await batch.commit();
+        if (deps.onPaymentSucceeded) {
+          try {
+            await deps.onPaymentSucceeded({ ...orderData, id: orderId });
+          } catch (err) {
+            logger.error(
+              `[3ds-complete] onPaymentSucceeded hook failed for ${orderId}:`,
+              err
+            );
+          }
+        }
+        let emailSent = false;
+        if (hasValidAuthCode) {
+          const userEmail2 = orderData.userEmail || decodedToken.email || "";
+          const emailResult = await deps.email.sendPaymentConfirmation({
+            to: userEmail2,
+            customerName: orderData.shippingAddress?.fullName || "",
+            orderId,
+            transactionId: txId,
+            authorizationCode: txAuthCode,
+            items: orderData.items || [],
+            subtotal: orderData.subtotal || orderData.total || 0,
+            discount: orderData.discount || void 0,
+            couponCode: orderData.couponCode,
+            vat: orderData.vat || 0,
+            total: orderData.total || 0
+          }).catch(() => ({ success: false }));
+          emailSent = emailResult.success;
+          if (emailSent) {
+            await orderRef.update({ emailSentAt: /* @__PURE__ */ new Date() });
+          }
+        }
+        if (orderData.deleteCardAfterPayment && orderData.paymentToken) {
+          deleteCard(
+            orderData.paymentToken,
+            orderData.userId
+          ).catch(
+            (err) => logger.error("[3ds-complete] Failed to delete card after payment:", err)
+          );
+        }
+        return server.NextResponse.json({
+          success: true,
+          transactionId: txId,
+          authorizationCode: hasValidAuthCode ? txAuthCode : null,
+          emailSent,
+          orderId
+        });
+      }
+      if (txStatusDetail === 36 || txStatusDetail === 37) {
+        const threeDSData = verifyResult["3ds"];
+        const challengeHtml = threeDSData?.browser_response?.challenge_request || threeDSData?.browser_response?.hidden_iframe || "";
+        if (challengeHtml) {
+          await db.collection("orders").doc(orderId).update({
+            nuveiTransactionId: txId,
+            isDeviceFingerprint: firestore.FieldValue.delete(),
+            updatedAt: /* @__PURE__ */ new Date(),
+            threeDSCres: firestore.FieldValue.delete()
+          });
+          return server.NextResponse.json({
+            challenge: true,
+            challengeHtml,
+            isDeviceFingerprint: false,
+            orderId,
+            nuveiTransactionId: txId,
+            statusDetail: txStatusDetail
+          });
+        }
+      }
+      await db.collection("orders").doc(orderId).update({
+        status: "failed",
+        chargeResponseAt: /* @__PURE__ */ new Date(),
+        updatedAt: /* @__PURE__ */ new Date(),
+        threeDSCres: firestore.FieldValue.delete()
+      });
+      const userEmail = orderData.userEmail || decodedToken.email || "";
+      if (userEmail) {
+        const retryUrl = deps.getRetryUrl?.({ ...orderData, id: orderId });
+        deps.email.sendPaymentFailed({
+          to: userEmail,
+          customerName: orderData.shippingAddress?.fullName || "",
+          orderId,
+          errorMessage: "Pago rechazado tras autenticaci\xF3n 3DS.",
+          items: orderData.items || [],
+          total: orderData.total || 0,
+          ...retryUrl ? { retryUrl } : {}
+        }).catch(() => {
+        });
+      }
+      return server.NextResponse.json(
+        { error: "Pago rechazado tras autenticaci\xF3n 3DS." },
+        { status: 400 }
+      );
+    } catch (error) {
+      logger.error("3DS complete error:", error);
+      return server.NextResponse.json(
+        { error: "Error interno del servidor" },
+        { status: 500 }
+      );
+    }
+  };
+}
+function create3dsTimeoutHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db, auth } = deps.firebase;
+  return async function POST(request) {
+    const sessionCookie = request.cookies.get("__session")?.value;
+    if (!sessionCookie || !auth) {
+      return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+    }
+    let decodedToken;
+    try {
+      decodedToken = await auth.verifySessionCookie(sessionCookie, true);
+    } catch {
+      return server.NextResponse.json({ error: "Sesion invalida" }, { status: 401 });
+    }
+    const { orderId } = await request.json();
+    if (!orderId || typeof orderId !== "string") {
+      return server.NextResponse.json({ error: "orderId requerido" }, { status: 400 });
+    }
+    const orderRef = db.collection("orders").doc(orderId);
+    const orderDoc = await orderRef.get();
+    if (!orderDoc.exists) {
+      return server.NextResponse.json({ error: "Orden no encontrada" }, { status: 404 });
+    }
+    const orderData = orderDoc.data() ?? {};
+    if (decodedToken.uid !== orderData.userId) {
+      return server.NextResponse.json({ error: "Usuario no coincide" }, { status: 403 });
+    }
+    if (orderData.status !== "3ds-pending") {
+      return server.NextResponse.json({ alreadyResolved: true });
+    }
+    await orderRef.update({
+      status: "failed",
+      failureReason: "3ds-timeout",
+      chargeResponseAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    const userEmail = orderData.userEmail || decodedToken.email || "";
+    if (userEmail) {
+      const retryUrl = deps.getRetryUrl?.({ ...orderData, id: orderId });
+      deps.email.sendPaymentFailed({
+        to: userEmail,
+        customerName: orderData.shippingAddress?.fullName || "",
+        orderId,
+        errorMessage: "No completaste la verificaci\xF3n 3DS a tiempo. Tu pago no fue procesado. Intenta de nuevo.",
+        items: orderData.items || [],
+        total: orderData.total || 0,
+        ...retryUrl ? { retryUrl } : {}
+      }).catch((err) => logger.error("[3ds-timeout] Failed to send email:", err));
+    }
+    return server.NextResponse.json({ ok: true });
+  };
+}
+function createRefundHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db, auth } = deps.firebase;
+  return async function POST(request) {
+    try {
+      const sessionCookie = request.cookies.get("__session")?.value;
+      if (!sessionCookie || !auth) {
+        return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+      }
+      let decodedToken;
+      try {
+        decodedToken = await auth.verifySessionCookie(sessionCookie, true);
+      } catch {
+        return server.NextResponse.json({ error: "Sesi\xF3n inv\xE1lida" }, { status: 401 });
+      }
+      const { orderId } = await request.json();
+      if (!orderId) {
+        return server.NextResponse.json({ error: "orderId requerido" }, { status: 400 });
+      }
+      const orderDoc = await db.collection("orders").doc(orderId).get();
+      if (!orderDoc.exists) {
+        return server.NextResponse.json({ error: "Orden no encontrada" }, { status: 404 });
+      }
+      const order = orderDoc.data() ?? {};
+      if (order.userId !== decodedToken.uid) {
+        return server.NextResponse.json(
+          { error: "No autorizado para esta orden" },
+          { status: 403 }
+        );
+      }
+      if (order.status !== "paid") {
+        return server.NextResponse.json(
+          { error: "Solo se pueden reembolsar \xF3rdenes pagadas" },
+          { status: 400 }
+        );
+      }
+      const paymentTransactionId = order.paymentTransactionId;
+      if (!paymentTransactionId) {
+        return server.NextResponse.json(
+          { error: "No se encontr\xF3 ID de transacci\xF3n" },
+          { status: 400 }
+        );
+      }
+      const result = await refundTransaction(paymentTransactionId);
+      if (result.status === "success") {
+        await db.collection("orders").doc(orderId).update({
+          status: "cancelled",
+          refundedAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        if (deps.onRefundSucceeded) {
+          try {
+            await deps.onRefundSucceeded({ ...order, id: orderId });
+          } catch (err) {
+            logger.error(
+              `[refund] onRefundSucceeded hook failed for order ${orderId}:`,
+              err
+            );
+          }
+        }
+        return server.NextResponse.json({ success: true, detail: result.detail });
+      }
+      return server.NextResponse.json(
+        { error: result.detail || "Error al procesar reembolso" },
+        { status: 400 }
+      );
+    } catch (error) {
+      logger.error("Refund error:", error);
+      return server.NextResponse.json(
+        { error: "Error interno del servidor" },
+        { status: 500 }
+      );
+    }
+  };
+}
+function createInitCheckoutHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { auth } = deps.firebase;
+  return async function POST(request) {
+    const sessionCookie = request.cookies.get("__session")?.value;
+    if (!sessionCookie || !auth) {
+      return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+    }
+    let decodedToken;
+    try {
+      decodedToken = await auth.verifySessionCookie(sessionCookie, true);
+    } catch {
+      return server.NextResponse.json({ error: "Sesi\xF3n inv\xE1lida" }, { status: 401 });
+    }
+    try {
+      const { amount, vat, description, devReference } = await request.json();
+      if (!amount || !devReference) {
+        return server.NextResponse.json(
+          { error: "amount y devReference son requeridos" },
+          { status: 400 }
+        );
+      }
+      const sessionId = crypto__default.default.randomBytes(16).toString("hex");
+      const result = await nuveiRequest("/v2/transaction/init_reference/", "POST", {
+        locale: "es",
+        session_id: sessionId,
+        order: {
+          amount,
+          description: description || deps.defaultDescription,
+          vat: vat ?? 0,
+          dev_reference: devReference,
+          installments_type: 0
+        },
+        user: {
+          id: decodedToken.uid,
+          email: decodedToken.email || ""
+        },
+        conf: {
+          theme: {
+            primary_color: deps.themeColors.primary,
+            secondary_color: deps.themeColors.secondary
+          }
+        }
+      });
+      if (result.error) {
+        return server.NextResponse.json(
+          { error: result.error.description || "Error al inicializar checkout" },
+          { status: 400 }
+        );
+      }
+      if (!result.reference) {
+        return server.NextResponse.json(
+          { error: "No se recibi\xF3 referencia de checkout" },
+          { status: 500 }
+        );
+      }
+      return server.NextResponse.json({
+        reference: result.reference,
+        checkoutUrl: result.checkout_url
+      });
+    } catch (error) {
+      logger.error("Init checkout error:", error);
+      return server.NextResponse.json(
+        { error: "Error al inicializar checkout" },
+        { status: 500 }
+      );
+    }
+  };
+}
+function createCardsHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db, auth } = deps.firebase;
+  const verifiedCardsEnabled = deps.enableVerifiedCardsTracking !== false;
+  async function verifySession(request) {
+    const sessionCookie = request.cookies.get("__session")?.value;
+    if (!sessionCookie || !auth) return null;
+    try {
+      return await auth.verifySessionCookie(sessionCookie, true);
+    } catch {
+      return null;
+    }
+  }
+  const GET = async function GET2(request) {
+    const decoded = await verifySession(request);
+    if (!decoded) {
+      return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+    }
+    try {
+      const result = await listCards(decoded.uid);
+      logger.log(
+        "[cards/GET] Raw Nuvei response:",
+        JSON.stringify(
+          result.cards?.map((c) => ({
+            token: c.token?.slice(-6),
+            status: c.status,
+            type: c.type,
+            number: c.number
+          }))
+        )
+      );
+      const cards = (result.cards || []).filter(
+        (c) => c.status === "valid" || c.status === "review" || c.status === "pending"
+      );
+      if (verifiedCardsEnabled && cards.some((c) => c.status === "review")) {
+        const verifiedDoc = await db.collection("users").doc(decoded.uid).collection("verifiedCards").get();
+        const verifiedTokens = new Set(verifiedDoc.docs.map((d) => d.id));
+        const enrichedCards = cards.map(
+          (c) => c.status === "review" && verifiedTokens.has(c.token) ? { ...c, status: "valid" } : c
+        );
+        return server.NextResponse.json({ cards: enrichedCards });
+      }
+      return server.NextResponse.json({ cards });
+    } catch (error) {
+      logger.error("Error listing cards:", error);
+      return server.NextResponse.json(
+        { error: "Error al obtener tarjetas" },
+        { status: 500 }
+      );
+    }
+  };
+  const DELETE = async function DELETE2(request) {
+    const decoded = await verifySession(request);
+    if (!decoded) {
+      return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+    }
+    try {
+      const { token } = await request.json();
+      if (!token) {
+        return server.NextResponse.json(
+          { error: "Token de tarjeta requerido" },
+          { status: 400 }
+        );
+      }
+      const result = await deleteCard(token, decoded.uid);
+      logger.log("[cards/DELETE] Nuvei response:", JSON.stringify(result));
+      const resultWithError = result;
+      if (resultWithError.error) {
+        logger.error("[cards/DELETE] Nuvei delete failed:", JSON.stringify(result));
+        return server.NextResponse.json(
+          { error: "No se pudo eliminar la tarjeta en Nuvei", detail: result },
+          { status: 400 }
+        );
+      }
+      if (verifiedCardsEnabled) {
+        try {
+          await db.collection("users").doc(decoded.uid).collection("verifiedCards").doc(token).delete();
+        } catch {
+        }
+      }
+      return server.NextResponse.json(result);
+    } catch (error) {
+      logger.error("Error deleting card:", error);
+      return server.NextResponse.json(
+        { error: "Error al eliminar tarjeta" },
+        { status: 500 }
+      );
+    }
+  };
+  return { GET, DELETE };
+}
+function createVerifyHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { db, auth } = deps.firebase;
+  const verifiedCardsEnabled = deps.enableVerifiedCardsTracking !== false;
+  return async function POST(request) {
+    const sessionCookie = request.cookies.get("__session")?.value;
+    if (!sessionCookie || !auth) {
+      return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+    }
+    let decodedToken;
+    try {
+      decodedToken = await auth.verifySessionCookie(sessionCookie, true);
+    } catch {
+      return server.NextResponse.json({ error: "Sesi\xF3n inv\xE1lida" }, { status: 401 });
+    }
+    try {
+      const { cardToken, transactionReference, value } = await request.json();
+      if (!cardToken && !transactionReference || !value) {
+        return server.NextResponse.json(
+          { error: "transactionReference y value son requeridos" },
+          { status: 400 }
+        );
+      }
+      const result = await verifyCard({
+        userId: decodedToken.uid,
+        transactionReference: transactionReference || cardToken,
+        value
+      });
+      if (result.error) {
+        return server.NextResponse.json(
+          { error: result.error.description || "Error de verificaci\xF3n" },
+          { status: 400 }
+        );
+      }
+      if (verifiedCardsEnabled && cardToken) {
+        try {
+          await db.collection("users").doc(decodedToken.uid).collection("verifiedCards").doc(cardToken).set({ verifiedAt: /* @__PURE__ */ new Date() });
+        } catch (err) {
+          logger.error("Failed to persist verified card:", err);
+        }
+      }
+      return server.NextResponse.json({
+        success: true,
+        transaction: result.transaction
+      });
+    } catch (error) {
+      logger.error("Card verify error:", error);
+      return server.NextResponse.json(
+        { error: "Error al verificar tarjeta" },
+        { status: 500 }
+      );
+    }
+  };
+}
+function createTestChargeHandler(deps) {
+  const logger = deps.logger ?? console;
+  const { auth } = deps.firebase;
+  const defaultDescription = deps.defaultDescription ?? "Test charge";
+  return async function POST(request) {
+    if (process.env.NUVEI_ENV === "prod") {
+      return server.NextResponse.json({ error: "Not available" }, { status: 404 });
+    }
+    const sessionCookie = request.cookies.get("__session")?.value;
+    if (!sessionCookie || !auth) {
+      return server.NextResponse.json({ error: "No autorizado" }, { status: 401 });
+    }
+    let decodedToken;
+    try {
+      decodedToken = await auth.verifySessionCookie(sessionCookie, true);
+    } catch {
+      return server.NextResponse.json({ error: "Sesi\xF3n inv\xE1lida" }, { status: 401 });
+    }
+    try {
+      const { token, amount, vat, description, devReference } = await request.json();
+      if (!token || !amount || !devReference) {
+        return server.NextResponse.json(
+          { error: "token, amount y devReference son requeridos" },
+          { status: 400 }
+        );
+      }
+      const result = await debitWithToken({
+        userId: decodedToken.uid,
+        userEmail: decodedToken.email || "",
+        amount,
+        description: description || defaultDescription,
+        devReference,
+        cardToken: token,
+        vat: vat ?? 0
+      });
+      logger.log("Test charge result:", JSON.stringify(result, null, 2));
+      if (result.transaction && result.transaction.status === "success" && result.transaction.status_detail === 3) {
+        return server.NextResponse.json({
+          success: true,
+          transaction: result.transaction,
+          card: result.card
+        });
+      }
+      return server.NextResponse.json(
+        {
+          success: false,
+          error: result.transaction?.message || result.error?.description || "Pago rechazado",
+          detail: result
+        },
+        { status: 400 }
+      );
+    } catch (error) {
+      logger.error("Test charge error:", error);
+      return server.NextResponse.json(
+        { error: "Error interno del servidor" },
+        { status: 500 }
+      );
+    }
+  };
+}
+
+exports.create3dsCallbackHandler = create3dsCallbackHandler;
+exports.create3dsCompleteHandler = create3dsCompleteHandler;
+exports.create3dsTimeoutHandler = create3dsTimeoutHandler;
+exports.createCardsHandler = createCardsHandler;
+exports.createChargeHandler = createChargeHandler;
+exports.createInitCheckoutHandler = createInitCheckoutHandler;
+exports.createRefundHandler = createRefundHandler;
+exports.createTestChargeHandler = createTestChargeHandler;
+exports.createVerifyHandler = createVerifyHandler;
+exports.createWebhookHandler = createWebhookHandler;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map