@pandait.tech/payment-nuvei 1.0.1 → 1.1.0

package/dist/handlers/index.cjs

@@ -189,7 +189,207 @@ async function verifyThreeDS(params) {
   return nuveiRequest("/v2/transaction/verify/", "POST", body);
 }
 
-// src/handlers/charge.ts
+// src/handlers/charge/validate-order.ts
+async function validateStandardOrder({
+  db,
+  getPriceDisplay,
+  orderData,
+  amount
+}) {
+  const orderItems = orderData.items ?? [];
+  let verifiedSubtotal = 0;
+  for (const item of orderItems) {
+    const productDoc = await db.collection("products").doc(item.productId).get();
+    if (!productDoc.exists || !productDoc.data()?.isActive) {
+      return json(
+        { error: `El producto "${item.name}" ya no est\xE1 disponible` },
+        { status: 409 }
+      );
+    }
+    const productData = productDoc.data();
+    const isDigital = productData.isDigital === true;
+    const stock = productData.stock ?? 0;
+    if (!isDigital && stock < item.quantity) {
+      return json(
+        {
+          error: `Stock insuficiente para "${item.name}" (disponible: ${stock})`
+        },
+        { status: 409 }
+      );
+    }
+    const display = getPriceDisplay({
+      price: productData.price ?? 0,
+      autoDiscounts: productData.autoDiscounts
+    });
+    const expectedItemSubtotal = display.finalSubtotal;
+    if (Math.abs(expectedItemSubtotal - item.price) > 0.02) {
+      return json(
+        {
+          error: `El precio de "${item.name}" cambi\xF3. Recarg\xE1 la p\xE1gina para ver el precio actualizado.`
+        },
+        { status: 409 }
+      );
+    }
+    verifiedSubtotal += expectedItemSubtotal * item.quantity;
+  }
+  let verifiedDiscount = 0;
+  const orderDiscount = orderData.discount ?? 0;
+  const orderPromotionId = orderData.promotionId;
+  if (orderPromotionId && orderDiscount > 0) {
+    const promoDoc = await db.collection("promotions").doc(orderPromotionId).get();
+    if (!promoDoc.exists || !promoDoc.data()?.isActive) {
+      return json(
+        { error: "El cupon aplicado ya no es valido. Remuevelo y vuelve a intentar." },
+        { status: 409 }
+      );
+    }
+    const promo = promoDoc.data();
+    const now = /* @__PURE__ */ new Date();
+    const validFrom = promo.rules.validFrom.toDate ? promo.rules.validFrom.toDate() : new Date(promo.rules.validFrom);
+    const validUntil = promo.rules.validUntil.toDate ? promo.rules.validUntil.toDate() : new Date(promo.rules.validUntil);
+    if (now < validFrom || now > validUntil) {
+      return json(
+        { error: "El cupon aplicado ha expirado. Remuevelo y vuelve a intentar." },
+        { status: 409 }
+      );
+    }
+    if (promo.rules.maxTotalUses && promo.currentUses >= promo.rules.maxTotalUses) {
+      return json(
+        { error: "El cupon aplicado ya alcanzo su limite de usos." },
+        { status: 409 }
+      );
+    }
+    if (promo.type === "percentage") {
+      verifiedDiscount = verifiedSubtotal * (promo.value / 100);
+      if (promo.maxDiscountAmount) {
+        verifiedDiscount = Math.min(verifiedDiscount, promo.maxDiscountAmount);
+      }
+    } else if (promo.type === "fixed_amount") {
+      verifiedDiscount = Math.min(promo.value, verifiedSubtotal);
+    }
+    verifiedDiscount = Math.round(verifiedDiscount * 100) / 100;
+  }
+  const verifiedDiscountedSubtotal = Math.max(0, verifiedSubtotal - verifiedDiscount);
+  const verifiedVat = Math.round(verifiedDiscountedSubtotal * 0.15 * 100) / 100;
+  const verifiedTotal = Math.round((verifiedDiscountedSubtotal + verifiedVat) * 100) / 100;
+  if (verifiedTotal !== amount) {
+    return json(
+      {
+        error: "El monto no coincide con los precios actuales. Actualiza tu carrito."
+      },
+      { status: 409 }
+    );
+  }
+  return null;
+}
+async function finalizePaidOrder(deps, ctx) {
+  const { db, logger } = deps;
+  const {
+    orderId,
+    transactionId,
+    rawAuthCode,
+    debitResponse,
+    auditResponseLabel,
+    installments,
+    installmentsType,
+    userId,
+    userEmail,
+    vat,
+    amount,
+    token,
+    deleteCardAfterPayment,
+    extraOrderFields,
+    preReadOrder,
+    includePostPurchaseNote
+  } = ctx;
+  const hasValidAuthCode = typeof rawAuthCode === "string" && rawAuthCode.trim().length > 0 && rawAuthCode !== "null";
+  const batch = db.batch();
+  const orderRef = db.collection("orders").doc(orderId);
+  if (hasValidAuthCode) {
+    batch.update(orderRef, {
+      status: "paid",
+      paymentTransactionId: transactionId,
+      authorizationCode: rawAuthCode,
+      ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
+      chargeResponseAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date(),
+      ...extraOrderFields ?? {}
+    });
+  } else {
+    logger.error(
+      `[AUDIT:MISSING_AUTH_CODE] orderId=${orderId} txId=${transactionId} ${auditResponseLabel ?? "debitResponse"}=${JSON.stringify(debitResponse)}`
+    );
+    batch.update(orderRef, {
+      status: "paid",
+      paymentTransactionId: transactionId,
+      missingAuthCodeFlagged: true,
+      missingAuthCodeLoggedAt: /* @__PURE__ */ new Date(),
+      emailPending: true,
+      ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
+      chargeResponseAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date(),
+      ...extraOrderFields ?? {}
+    });
+  }
+  const orderInfo = preReadOrder ?? ((await orderRef.get()).data() ?? {});
+  if (orderInfo.promotionId) {
+    const promoRef = db.collection("promotions").doc(orderInfo.promotionId);
+    batch.update(promoRef, {
+      currentUses: firestore.FieldValue.increment(1)
+    });
+    const usageRef = promoRef.collection("usages").doc();
+    batch.set(usageRef, {
+      userId: orderInfo.userId,
+      orderId,
+      discountApplied: orderInfo.discount || 0,
+      usedAt: /* @__PURE__ */ new Date()
+    });
+  }
+  await batch.commit();
+  if (deps.onPaymentSucceeded) {
+    try {
+      await deps.onPaymentSucceeded({ ...orderInfo, id: orderId });
+    } catch (err) {
+      logger.error(
+        `[charge] onPaymentSucceeded hook failed for order ${orderId}:`,
+        err
+      );
+    }
+  }
+  let emailSent = false;
+  if (hasValidAuthCode) {
+    const emailResult = await deps.email.sendPaymentConfirmation({
+      to: userEmail,
+      customerName: orderInfo.shippingAddress?.fullName || "",
+      orderId,
+      transactionId,
+      authorizationCode: rawAuthCode,
+      items: orderInfo.items || [],
+      subtotal: orderInfo.subtotal || amount,
+      discount: orderInfo.discount || void 0,
+      couponCode: orderInfo.couponCode,
+      vat: orderInfo.vat || vat,
+      total: amount,
+      ...includePostPurchaseNote !== false && orderInfo.postPurchaseNote ? { postPurchaseNote: orderInfo.postPurchaseNote } : {}
+    }).catch(() => ({ success: false }));
+    emailSent = emailResult.success;
+    if (emailSent) {
+      await orderRef.update({ emailSentAt: /* @__PURE__ */ new Date() });
+    }
+  }
+  if (deleteCardAfterPayment && token) {
+    deleteCard(token, userId).catch(
+      (err) => logger.error("[charge] Failed to delete card after payment:", err)
+    );
+  }
+  return {
+    transactionId,
+    authorizationCode: hasValidAuthCode ? rawAuthCode : null,
+    emailSent
+  };
+}
+
+// src/handlers/charge/error-messages.ts
 var NUVEI_ERROR_MESSAGES = {
   0: "Error del procesador de pagos. Intenta de nuevo.",
   // 1 = review/pending — handled separately, not shown as error
@@ -235,6 +435,141 @@ function getNuveiUserMessage(statusDetail, rawMessage) {
   }
   return "No se pudo procesar el pago. Verifica los datos de tu tarjeta o intenta con otra.";
 }
+
+// src/handlers/charge/handle-3ds-results.ts
+async function handleNonSuccessResult(deps, ctx) {
+  const { db, logger } = deps;
+  const { nuveiData, orderId, userEmail, amount, token, deleteCardAfterPayment } = ctx;
+  if (nuveiData.transaction?.status === "pending" && nuveiData.transaction?.status_detail === 1) {
+    await db.collection("orders").doc(orderId).update({
+      status: "processing",
+      paymentTransactionId: nuveiData.transaction.id || null,
+      chargeResponseAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    return json({
+      review: true,
+      orderId,
+      transactionId: nuveiData.transaction.id
+    });
+  }
+  const persistDeleteOnPaid = deleteCardAfterPayment ? { deleteCardAfterPayment: true, paymentToken: token } : {};
+  if (nuveiData.transaction?.status_detail === 35) {
+    const threeDSData = nuveiData["3ds"];
+    const hiddenIframeHtml = threeDSData?.browser_response?.hidden_iframe || "";
+    await db.collection("orders").doc(orderId).update({
+      status: "3ds-pending",
+      isDeviceFingerprint: true,
+      nuveiTransactionId: nuveiData.transaction.id || null,
+      ...persistDeleteOnPaid,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    return json({
+      challenge: true,
+      challengeHtml: hiddenIframeHtml,
+      isDeviceFingerprint: true,
+      orderId,
+      nuveiTransactionId: nuveiData.transaction.id,
+      statusDetail: 35
+    });
+  }
+  if (nuveiData.transaction?.status_detail === 31) {
+    await db.collection("orders").doc(orderId).update({
+      status: "otp-pending",
+      nuveiTransactionId: nuveiData.transaction.id || null,
+      ...persistDeleteOnPaid,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    return json({
+      otpRequired: true,
+      orderId,
+      nuveiTransactionId: nuveiData.transaction.id,
+      statusDetail: 31
+    });
+  }
+  if (nuveiData.transaction?.status_detail === 36 || nuveiData.transaction?.status_detail === 37) {
+    const threeDSData = nuveiData["3ds"];
+    const challengeHtml = threeDSData?.browser_response?.challenge_request || threeDSData?.browser_response?.hidden_iframe || "";
+    const rawDebit = nuveiData;
+    const debitCres = rawDebit["3ds"]?.authentication?.["cres"] || rawDebit["3ds"]?.browser_response?.["cres"] || rawDebit["3ds"]?.["cres"] || rawDebit.transaction?.["cres"] || rawDebit["cres"] || rawDebit["value"] || null;
+    logger.log(
+      `[charge] status ${nuveiData.transaction.status_detail} \u2014 debitCres captured: ${debitCres ? "YES (len=" + debitCres.length + ")" : "NO"}`
+    );
+    if (challengeHtml) {
+      await db.collection("orders").doc(orderId).update({
+        status: "3ds-pending",
+        nuveiTransactionId: nuveiData.transaction?.id || null,
+        ...debitCres ? { threeDSCres: debitCres } : {},
+        ...persistDeleteOnPaid,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return json({
+        challenge: true,
+        challengeHtml,
+        isDeviceFingerprint: false,
+        orderId,
+        nuveiTransactionId: nuveiData.transaction?.id,
+        statusDetail: nuveiData.transaction?.status_detail
+      });
+    }
+  }
+  const threeDSStatus = nuveiData["3ds"]?.authentication?.status;
+  if (threeDSStatus && THREEDS_AUTH_MESSAGES[threeDSStatus]) {
+    const threeDSErrorMsg = THREEDS_AUTH_MESSAGES[threeDSStatus];
+    const currentOrder2 = await db.collection("orders").doc(orderId).get();
+    const currentOrderData2 = currentOrder2.data() ?? {};
+    if (currentOrderData2.status === "pending") {
+      await db.collection("orders").doc(orderId).update({
+        status: "failed",
+        chargeResponseAt: /* @__PURE__ */ new Date(),
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+    }
+    if (userEmail) {
+      const retryUrl = deps.getRetryUrl?.({ ...currentOrderData2, id: orderId });
+      deps.email.sendPaymentFailed({
+        to: userEmail,
+        customerName: currentOrderData2.shippingAddress?.fullName || "",
+        orderId,
+        errorMessage: threeDSErrorMsg,
+        items: currentOrderData2.items || [],
+        total: currentOrderData2.total || amount,
+        ...retryUrl ? { retryUrl } : {}
+      }).catch(() => {
+      });
+    }
+    return json({ error: threeDSErrorMsg }, { status: 400 });
+  }
+  const failedErrorMsg = getNuveiUserMessage(
+    nuveiData.transaction?.status_detail,
+    nuveiData.transaction?.message || nuveiData.error?.description
+  );
+  const currentOrder = await db.collection("orders").doc(orderId).get();
+  const currentOrderData = currentOrder.data() ?? {};
+  if (currentOrderData.status === "pending") {
+    await db.collection("orders").doc(orderId).update({
+      status: "failed",
+      chargeResponseAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+  }
+  if (userEmail) {
+    const retryUrl = deps.getRetryUrl?.({ ...currentOrderData, id: orderId });
+    deps.email.sendPaymentFailed({
+      to: userEmail,
+      customerName: currentOrderData.shippingAddress?.fullName || "",
+      orderId,
+      errorMessage: failedErrorMsg,
+      items: currentOrderData.items || [],
+      total: currentOrderData.total || amount,
+      ...retryUrl ? { retryUrl } : {}
+    }).catch(() => {
+    });
+  }
+  return json({ error: failedErrorMsg }, { status: 400 });
+}
+
+// src/handlers/charge.ts
 function createChargeHandler(deps) {
   const logger = deps.logger ?? console;
   const { db, auth } = deps.firebase;
@@ -290,6 +625,7 @@ function createChargeHandler(deps) {
         orderId,
         amount,
         vat,
+        taxableAmount,
         description,
         userId,
         userEmail,
@@ -338,89 +674,14 @@ function createChargeHandler(deps) {
         }
       }
       if (runStandardValidation) {
-        const orderItems = orderData.items ?? [];
-        let verifiedSubtotal = 0;
-        for (const item of orderItems) {
-          const productDoc = await db.collection("products").doc(item.productId).get();
-          if (!productDoc.exists || !productDoc.data()?.isActive) {
-            return json(
-              { error: `El producto "${item.name}" ya no est\xE1 disponible` },
-              { status: 409 }
-            );
-          }
-          const productData = productDoc.data();
-          const isDigital = productData.isDigital === true;
-          const stock = productData.stock ?? 0;
-          if (!isDigital && stock < item.quantity) {
-            return json(
-              {
-                error: `Stock insuficiente para "${item.name}" (disponible: ${stock})`
-              },
-              { status: 409 }
-            );
-          }
-          const display = deps.getPriceDisplay({
-            price: productData.price ?? 0,
-            autoDiscounts: productData.autoDiscounts
-          });
-          const expectedItemSubtotal = display.finalSubtotal;
-          if (Math.abs(expectedItemSubtotal - item.price) > 0.02) {
-            return json(
-              {
-                error: `El precio de "${item.name}" cambi\xF3. Recarg\xE1 la p\xE1gina para ver el precio actualizado.`
-              },
-              { status: 409 }
-            );
-          }
-          verifiedSubtotal += expectedItemSubtotal * item.quantity;
-        }
-        let verifiedDiscount = 0;
-        const orderDiscount = orderData.discount ?? 0;
-        const orderPromotionId = orderData.promotionId;
-        if (orderPromotionId && orderDiscount > 0) {
-          const promoDoc = await db.collection("promotions").doc(orderPromotionId).get();
-          if (!promoDoc.exists || !promoDoc.data()?.isActive) {
-            return json(
-              { error: "El cupon aplicado ya no es valido. Remuevelo y vuelve a intentar." },
-              { status: 409 }
-            );
-          }
-          const promo = promoDoc.data();
-          const now = /* @__PURE__ */ new Date();
-          const validFrom = promo.rules.validFrom.toDate ? promo.rules.validFrom.toDate() : new Date(promo.rules.validFrom);
-          const validUntil = promo.rules.validUntil.toDate ? promo.rules.validUntil.toDate() : new Date(promo.rules.validUntil);
-          if (now < validFrom || now > validUntil) {
-            return json(
-              { error: "El cupon aplicado ha expirado. Remuevelo y vuelve a intentar." },
-              { status: 409 }
-            );
-          }
-          if (promo.rules.maxTotalUses && promo.currentUses >= promo.rules.maxTotalUses) {
-            return json(
-              { error: "El cupon aplicado ya alcanzo su limite de usos." },
-              { status: 409 }
-            );
-          }
-          if (promo.type === "percentage") {
-            verifiedDiscount = verifiedSubtotal * (promo.value / 100);
-            if (promo.maxDiscountAmount) {
-              verifiedDiscount = Math.min(verifiedDiscount, promo.maxDiscountAmount);
-            }
-          } else if (promo.type === "fixed_amount") {
-            verifiedDiscount = Math.min(promo.value, verifiedSubtotal);
-          }
-          verifiedDiscount = Math.round(verifiedDiscount * 100) / 100;
-        }
-        const verifiedDiscountedSubtotal = Math.max(0, verifiedSubtotal - verifiedDiscount);
-        const verifiedVat = Math.round(verifiedDiscountedSubtotal * 0.15 * 100) / 100;
-        const verifiedTotal = Math.round((verifiedDiscountedSubtotal + verifiedVat) * 100) / 100;
-        if (verifiedTotal !== amount) {
-          return json(
-            {
-              error: "El monto no coincide con los precios actuales. Actualiza tu carrito."
-            },
-            { status: 409 }
-          );
+        const validationError = await validateStandardOrder({
+          db,
+          getPriceDisplay: deps.getPriceDisplay,
+          orderData,
+          amount
+        });
+        if (validationError) {
+          return validationError;
         }
       }
       const functionsBase = deps.cloudFunctionsBaseUrl ?? process.env.CLOUD_FUNCTIONS_BASE_URL;
@@ -432,7 +693,7 @@ function createChargeHandler(deps) {
       }
       const clientIp = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request.headers.get("x-real-ip") || "127.0.0.1";
       const enrichedBrowserInfo = browserInfo ? { ...browserInfo, ip_address: clientIp } : void 0;
-      const discountedSubtotalForTax = amount - (vat ?? 0);
+      const discountedSubtotalForTax = taxableAmount ?? amount - (vat ?? 0);
       const nuveiData = await debitWithToken({
         userId,
         userEmail,
@@ -446,7 +707,6 @@ function createChargeHandler(deps) {
         ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
         ...enrichedBrowserInfo && termUrl ? { browserInfo: enrichedBrowserInfo, termUrl } : {}
       });
-      logger.log("[charge] Nuvei debit response FULL:", JSON.stringify(nuveiData));
       logger.log(
         "[charge] Nuvei debit response summary:",
         JSON.stringify({
@@ -458,221 +718,52 @@ function createChargeHandler(deps) {
         })
       );
       if (nuveiData.transaction && nuveiData.transaction.status === "success" && nuveiData.transaction.status_detail === 3) {
-        const rawAuthCode = nuveiData.transaction.authorization_code;
-        const hasValidAuthCode = typeof rawAuthCode === "string" && rawAuthCode.trim().length > 0 && rawAuthCode !== "null";
-        const batch = db.batch();
-        const orderRef = db.collection("orders").doc(orderId);
-        if (hasValidAuthCode) {
-          batch.update(orderRef, {
-            status: "paid",
-            paymentTransactionId: nuveiData.transaction.id,
-            authorizationCode: rawAuthCode,
-            ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
-            chargeResponseAt: /* @__PURE__ */ new Date(),
-            updatedAt: /* @__PURE__ */ new Date()
-          });
-        } else {
-          logger.error(
-            `[AUDIT:MISSING_AUTH_CODE] orderId=${orderId} txId=${nuveiData.transaction.id} debitResponse=${JSON.stringify(nuveiData)}`
-          );
-          batch.update(orderRef, {
-            status: "paid",
-            paymentTransactionId: nuveiData.transaction.id,
-            missingAuthCodeFlagged: true,
-            missingAuthCodeLoggedAt: /* @__PURE__ */ new Date(),
-            emailPending: true,
-            ...installments ? { installments, installmentsType: installmentsType ?? 0 } : {},
-            chargeResponseAt: /* @__PURE__ */ new Date(),
-            updatedAt: /* @__PURE__ */ new Date()
-          });
-        }
-        const orderSnap = await orderRef.get();
-        const orderInfo = orderSnap.data() ?? {};
-        if (orderInfo.promotionId) {
-          const promoRef = db.collection("promotions").doc(orderInfo.promotionId);
-          batch.update(promoRef, {
-            currentUses: firestore.FieldValue.increment(1)
-          });
-          const usageRef = promoRef.collection("usages").doc();
-          batch.set(usageRef, {
-            userId: orderInfo.userId,
-            orderId,
-            discountApplied: orderInfo.discount || 0,
-            usedAt: /* @__PURE__ */ new Date()
-          });
-        }
-        await batch.commit();
-        if (deps.onPaymentSucceeded) {
-          try {
-            await deps.onPaymentSucceeded({ ...orderInfo, id: orderId });
-          } catch (err) {
-            logger.error(
-              `[charge] onPaymentSucceeded hook failed for order ${orderId}:`,
-              err
-            );
-          }
-        }
-        let emailSent = false;
-        if (hasValidAuthCode) {
-          const emailResult = await deps.email.sendPaymentConfirmation({
-            to: userEmail,
-            customerName: orderInfo.shippingAddress?.fullName || "",
+        const finalizeResult = await finalizePaidOrder(
+          {
+            db,
+            email: deps.email,
+            onPaymentSucceeded: deps.onPaymentSucceeded,
+            logger
+          },
+          {
             orderId,
             transactionId: nuveiData.transaction.id,
-            authorizationCode: rawAuthCode,
-            items: orderInfo.items || [],
-            subtotal: orderInfo.subtotal || amount,
-            discount: orderInfo.discount || void 0,
-            couponCode: orderInfo.couponCode,
-            vat: orderInfo.vat || vat,
-            total: amount,
-            ...orderInfo.postPurchaseNote ? { postPurchaseNote: orderInfo.postPurchaseNote } : {}
-          }).catch(() => ({ success: false }));
-          emailSent = emailResult.success;
-          if (emailSent) {
-            await orderRef.update({ emailSentAt: /* @__PURE__ */ new Date() });
+            rawAuthCode: nuveiData.transaction.authorization_code,
+            debitResponse: nuveiData,
+            installments,
+            installmentsType,
+            userId,
+            userEmail,
+            vat,
+            amount,
+            token,
+            deleteCardAfterPayment: body.deleteCardAfterPayment
           }
-        }
-        if (body.deleteCardAfterPayment && token) {
-          deleteCard(token, userId).catch(
-            (err) => logger.error("[charge] Failed to delete card after payment:", err)
-          );
-        }
+        );
         return json({
           success: true,
-          transactionId: nuveiData.transaction.id,
-          authorizationCode: hasValidAuthCode ? rawAuthCode : null,
-          orderId,
-          emailSent
-        });
-      }
-      if (nuveiData.transaction?.status === "pending" && nuveiData.transaction?.status_detail === 1) {
-        await db.collection("orders").doc(orderId).update({
-          status: "processing",
-          paymentTransactionId: nuveiData.transaction.id || null,
-          chargeResponseAt: /* @__PURE__ */ new Date(),
-          updatedAt: /* @__PURE__ */ new Date()
-        });
-        return json({
-          review: true,
+          transactionId: finalizeResult.transactionId,
+          authorizationCode: finalizeResult.authorizationCode,
           orderId,
-          transactionId: nuveiData.transaction.id
+          emailSent: finalizeResult.emailSent
         });
       }
-      const persistDeleteOnPaid = body.deleteCardAfterPayment ? { deleteCardAfterPayment: true, paymentToken: token } : {};
-      if (nuveiData.transaction?.status_detail === 35) {
-        const threeDSData = nuveiData["3ds"];
-        const hiddenIframeHtml = threeDSData?.browser_response?.hidden_iframe || "";
-        await db.collection("orders").doc(orderId).update({
-          status: "3ds-pending",
-          isDeviceFingerprint: true,
-          nuveiTransactionId: nuveiData.transaction.id || null,
-          ...persistDeleteOnPaid,
-          updatedAt: /* @__PURE__ */ new Date()
-        });
-        return json({
-          challenge: true,
-          challengeHtml: hiddenIframeHtml,
-          isDeviceFingerprint: true,
-          orderId,
-          nuveiTransactionId: nuveiData.transaction.id,
-          statusDetail: 35
-        });
-      }
-      if (nuveiData.transaction?.status_detail === 31) {
-        await db.collection("orders").doc(orderId).update({
-          status: "otp-pending",
-          nuveiTransactionId: nuveiData.transaction.id || null,
-          ...persistDeleteOnPaid,
-          updatedAt: /* @__PURE__ */ new Date()
-        });
-        return json({
-          otpRequired: true,
+      return handleNonSuccessResult(
+        {
+          db,
+          email: deps.email,
+          getRetryUrl: deps.getRetryUrl,
+          logger
+        },
+        {
+          nuveiData,
           orderId,
-          nuveiTransactionId: nuveiData.transaction.id,
-          statusDetail: 31
-        });
-      }
-      if (nuveiData.transaction?.status_detail === 36 || nuveiData.transaction?.status_detail === 37) {
-        const threeDSData = nuveiData["3ds"];
-        const challengeHtml = threeDSData?.browser_response?.challenge_request || threeDSData?.browser_response?.hidden_iframe || "";
-        const rawDebit = nuveiData;
-        const debitCres = rawDebit["3ds"]?.authentication?.["cres"] || rawDebit["3ds"]?.browser_response?.["cres"] || rawDebit["3ds"]?.["cres"] || rawDebit.transaction?.["cres"] || rawDebit["cres"] || rawDebit["value"] || null;
-        logger.log(
-          `[charge] status ${nuveiData.transaction.status_detail} \u2014 debitCres captured: ${debitCres ? "YES (len=" + debitCres.length + ")" : "NO"}`
-        );
-        if (challengeHtml) {
-          await db.collection("orders").doc(orderId).update({
-            status: "3ds-pending",
-            nuveiTransactionId: nuveiData.transaction?.id || null,
-            ...debitCres ? { threeDSCres: debitCres } : {},
-            ...persistDeleteOnPaid,
-            updatedAt: /* @__PURE__ */ new Date()
-          });
-          return json({
-            challenge: true,
-            challengeHtml,
-            isDeviceFingerprint: false,
-            orderId,
-            nuveiTransactionId: nuveiData.transaction?.id,
-            statusDetail: nuveiData.transaction?.status_detail
-          });
-        }
-      }
-      const threeDSStatus = nuveiData["3ds"]?.authentication?.status;
-      if (threeDSStatus && THREEDS_AUTH_MESSAGES[threeDSStatus]) {
-        const threeDSErrorMsg = THREEDS_AUTH_MESSAGES[threeDSStatus];
-        const currentOrder2 = await db.collection("orders").doc(orderId).get();
-        const currentOrderData2 = currentOrder2.data() ?? {};
-        if (currentOrderData2.status === "pending") {
-          await db.collection("orders").doc(orderId).update({
-            status: "failed",
-            chargeResponseAt: /* @__PURE__ */ new Date(),
-            updatedAt: /* @__PURE__ */ new Date()
-          });
-        }
-        if (userEmail) {
-          const retryUrl = deps.getRetryUrl?.({ ...currentOrderData2, id: orderId });
-          deps.email.sendPaymentFailed({
-            to: userEmail,
-            customerName: currentOrderData2.shippingAddress?.fullName || "",
-            orderId,
-            errorMessage: threeDSErrorMsg,
-            items: currentOrderData2.items || [],
-            total: currentOrderData2.total || amount,
-            ...retryUrl ? { retryUrl } : {}
-          }).catch(() => {
-          });
+          userEmail,
+          amount,
+          token,
+          deleteCardAfterPayment: body.deleteCardAfterPayment
         }
-        return json({ error: threeDSErrorMsg }, { status: 400 });
-      }
-      const failedErrorMsg = getNuveiUserMessage(
-        nuveiData.transaction?.status_detail,
-        nuveiData.transaction?.message || nuveiData.error?.description
       );
-      const currentOrder = await db.collection("orders").doc(orderId).get();
-      const currentOrderData = currentOrder.data() ?? {};
-      if (currentOrderData.status === "pending") {
-        await db.collection("orders").doc(orderId).update({
-          status: "failed",
-          chargeResponseAt: /* @__PURE__ */ new Date(),
-          updatedAt: /* @__PURE__ */ new Date()
-        });
-      }
-      if (userEmail) {
-        const retryUrl = deps.getRetryUrl?.({ ...currentOrderData, id: orderId });
-        deps.email.sendPaymentFailed({
-          to: userEmail,
-          customerName: currentOrderData.shippingAddress?.fullName || "",
-          orderId,
-          errorMessage: failedErrorMsg,
-          items: currentOrderData.items || [],
-          total: currentOrderData.total || amount,
-          ...retryUrl ? { retryUrl } : {}
-        }).catch(() => {
-        });
-      }
-      return json({ error: failedErrorMsg }, { status: 400 });
     } catch (error) {
       logger.error("Payment charge error:", error);
       return json(
@@ -771,72 +862,28 @@ function createWebhookHandler(deps) {
           const vTxId = verifyResult.transaction?.id ?? raw["transaction_id"] ?? orderDataEarly.nuveiTransactionId ?? transaction.id;
           const verifySuccess = (vStatus === "success" || vStatus === 1) && vDetail === 3;
           if (verifySuccess) {
-            const hasAuth = typeof vAuthCode === "string" && vAuthCode.trim().length > 0 && vAuthCode !== "null";
-            const batch = db.batch();
-            batch.update(orderRef, {
-              status: "paid",
-              paymentTransactionId: vTxId,
-              ...hasAuth ? { authorizationCode: vAuthCode } : {
-                missingAuthCodeFlagged: true,
-                missingAuthCodeLoggedAt: /* @__PURE__ */ new Date(),
-                emailPending: true
-              },
-              chargeResponseAt: /* @__PURE__ */ new Date(),
-              updatedAt: /* @__PURE__ */ new Date(),
-              threeDSCres: firestore.FieldValue.delete(),
-              threeDSTransStatus: firestore.FieldValue.delete()
-            });
-            if (orderDataEarly.promotionId) {
-              const promoRef = db.collection("promotions").doc(orderDataEarly.promotionId);
-              batch.update(promoRef, {
-                currentUses: firestore.FieldValue.increment(1)
-              });
-              const usageRef = promoRef.collection("usages").doc();
-              batch.set(usageRef, {
-                userId: orderDataEarly.userId,
-                orderId,
-                discountApplied: orderDataEarly.discount || 0,
-                usedAt: /* @__PURE__ */ new Date()
-              });
-            }
-            await batch.commit();
-            if (hasAuth && orderDataEarly.userEmail) {
-              await deps.email.sendPaymentConfirmation({
-                to: orderDataEarly.userEmail,
-                customerName: orderDataEarly.shippingAddress?.fullName || "",
+            await finalizePaidOrder(
+              { db, email: deps.email, onPaymentSucceeded: deps.onPaymentSucceeded, logger },
+              {
                 orderId,
                 transactionId: vTxId,
-                authorizationCode: vAuthCode,
-                items: orderDataEarly.items || [],
-                subtotal: orderDataEarly.subtotal || orderDataEarly.total || 0,
-                discount: orderDataEarly.discount || void 0,
-                couponCode: orderDataEarly.couponCode,
-                vat: orderDataEarly.vat || 0,
-                total: orderDataEarly.total || 0
-              }).catch(() => ({ success: false }));
-              await orderRef.update({ emailSentAt: /* @__PURE__ */ new Date() });
-            }
-            if (orderDataEarly.deleteCardAfterPayment && orderDataEarly.paymentToken) {
-              deleteCard(
-                orderDataEarly.paymentToken,
-                orderDataEarly.userId
-              ).catch(
-                (err) => logger.error(
-                  "[webhook] Failed to delete card after payment:",
-                  err
-                )
-              );
-            }
-            if (deps.onPaymentSucceeded) {
-              try {
-                await deps.onPaymentSucceeded({ ...orderDataEarly, id: orderId });
-              } catch (err) {
-                logger.error(
-                  `[webhook] onPaymentSucceeded hook failed for ${orderId}:`,
-                  err
-                );
+                rawAuthCode: vAuthCode ?? null,
+                debitResponse: verifyResult,
+                auditResponseLabel: "verifyResponse",
+                userId: orderDataEarly.userId,
+                userEmail: orderDataEarly.userEmail || "",
+                vat: 0,
+                amount: orderDataEarly.total || 0,
+                token: orderDataEarly.paymentToken,
+                deleteCardAfterPayment: orderDataEarly.deleteCardAfterPayment,
+                preReadOrder: orderDataEarly,
+                includePostPurchaseNote: false,
+                extraOrderFields: {
+                  threeDSCres: firestore.FieldValue.delete(),
+                  threeDSTransStatus: firestore.FieldValue.delete()
+                }
               }
-            }
+            );
             return json({ received: true, verifiedFromWebhook: true });
           }
         } catch (err) {
@@ -1212,94 +1259,39 @@ function create3dsCompleteHandler(deps) {
         return json({ stillPending: true });
       }
       if (isSuccess) {
-        const hasValidAuthCode = typeof txAuthCode === "string" && txAuthCode.trim().length > 0 && txAuthCode !== "null";
-        const batch = db.batch();
-        if (hasValidAuthCode) {
-          batch.update(orderRef, {
-            status: "paid",
-            paymentTransactionId: txId,
-            authorizationCode: txAuthCode,
-            chargeResponseAt: /* @__PURE__ */ new Date(),
-            updatedAt: /* @__PURE__ */ new Date(),
-            threeDSCres: firestore.FieldValue.delete(),
-            threeDSTransStatus: firestore.FieldValue.delete(),
-            isDeviceFingerprint: firestore.FieldValue.delete()
-          });
-        } else {
-          logger.error(
-            `[AUDIT:MISSING_AUTH_CODE] orderId=${orderId} txId=${txId} verifyResponse=${JSON.stringify(verifyResult)}`
-          );
-          batch.update(orderRef, {
-            status: "paid",
-            paymentTransactionId: txId,
-            missingAuthCodeFlagged: true,
-            missingAuthCodeLoggedAt: /* @__PURE__ */ new Date(),
-            emailPending: true,
-            chargeResponseAt: /* @__PURE__ */ new Date(),
-            updatedAt: /* @__PURE__ */ new Date(),
-            threeDSCres: firestore.FieldValue.delete(),
-            threeDSTransStatus: firestore.FieldValue.delete(),
-            isDeviceFingerprint: firestore.FieldValue.delete()
-          });
-        }
-        if (orderData.promotionId) {
-          const promoRef = db.collection("promotions").doc(orderData.promotionId);
-          batch.update(promoRef, {
-            currentUses: firestore.FieldValue.increment(1)
-          });
-          const usageRef = promoRef.collection("usages").doc();
-          batch.set(usageRef, {
-            userId: orderData.userId,
-            orderId,
-            discountApplied: orderData.discount || 0,
-            usedAt: /* @__PURE__ */ new Date()
-          });
-        }
-        await batch.commit();
-        if (deps.onPaymentSucceeded) {
-          try {
-            await deps.onPaymentSucceeded({ ...orderData, id: orderId });
-          } catch (err) {
-            logger.error(
-              `[3ds-complete] onPaymentSucceeded hook failed for ${orderId}:`,
-              err
-            );
-          }
-        }
-        let emailSent = false;
-        if (hasValidAuthCode) {
-          const userEmail2 = orderData.userEmail || decodedToken.email || "";
-          const emailResult = await deps.email.sendPaymentConfirmation({
-            to: userEmail2,
-            customerName: orderData.shippingAddress?.fullName || "",
+        const finalizeResult = await finalizePaidOrder(
+          {
+            db,
+            email: deps.email,
+            onPaymentSucceeded: deps.onPaymentSucceeded,
+            logger
+          },
+          {
             orderId,
             transactionId: txId,
-            authorizationCode: txAuthCode,
-            items: orderData.items || [],
-            subtotal: orderData.subtotal || orderData.total || 0,
-            discount: orderData.discount || void 0,
-            couponCode: orderData.couponCode,
-            vat: orderData.vat || 0,
-            total: orderData.total || 0
-          }).catch(() => ({ success: false }));
-          emailSent = emailResult.success;
-          if (emailSent) {
-            await orderRef.update({ emailSentAt: /* @__PURE__ */ new Date() });
+            rawAuthCode: txAuthCode,
+            debitResponse: verifyResult,
+            auditResponseLabel: "verifyResponse",
+            userId: orderData.userId,
+            userEmail: orderData.userEmail || decodedToken.email || "",
+            vat: 0,
+            amount: orderData.total || 0,
+            token: orderData.paymentToken,
+            deleteCardAfterPayment: orderData.deleteCardAfterPayment,
+            preReadOrder: orderData,
+            includePostPurchaseNote: false,
+            extraOrderFields: {
+              threeDSCres: firestore.FieldValue.delete(),
+              threeDSTransStatus: firestore.FieldValue.delete(),
+              isDeviceFingerprint: firestore.FieldValue.delete()
+            }
           }
-        }
-        if (orderData.deleteCardAfterPayment && orderData.paymentToken) {
-          deleteCard(
-            orderData.paymentToken,
-            orderData.userId
-          ).catch(
-            (err) => logger.error("[3ds-complete] Failed to delete card after payment:", err)
-          );
-        }
+        );
         return json({
           success: true,
-          transactionId: txId,
-          authorizationCode: hasValidAuthCode ? txAuthCode : null,
-          emailSent,
+          transactionId: finalizeResult.transactionId,
+          authorizationCode: finalizeResult.authorizationCode,
+          emailSent: finalizeResult.emailSent,
           orderId
         });
       }