@rovela-ai/sdk 0.24.1 → 0.25.1

package/dist/checkout/api/manual.js

@@ -48,7 +48,11 @@ export async function POST(request) {
                 code: 'GUEST_CHECKOUT_DISABLED',
             }, { status: 403 });
         }
-        const email = body.customerEmail?.trim().toLowerCase();
+        // Same session-email fallback as the external providers (0.25.1): a
+        // signed-in customer's checkout body may carry no email — the trusted
+        // identity already holds it. Fixes manual/COD orders 400-ing on stores
+        // with guest checkout disabled.
+        const email = body.customerEmail?.trim().toLowerCase() || trustedCustomer?.email?.trim().toLowerCase();
         if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
             return bad('A valid email is required');
         }

package/dist/checkout/api/manual.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual.js","sourceRoot":"","sources":["../../../src/checkout/api/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAsCzD,SAAS,GAAG,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,iBAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AACnF,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA8B,CAAA;QAEhE,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;QAErC,qEAAqE;QACrE,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,eAAe,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAEvD,MAAM,kBAAkB,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAA;QAC1D,IAAI,CAAC,kBAAkB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,yDAAyD;gBAChE,IAAI,EAAE,yBAAkC;aACzC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACtD,IAAI,CAAC,KAAK,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,2BAA2B,CAAC,CAAA;QACzC,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,GAAG,CAAC,6BAA6B,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAA;QACzD,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YAChF,OAAO,GAAG,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAA;QACzD,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,KAAK,CAAA;QACT,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,UAAU,CACtB;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,WAAW,EAAE,qBAAqB;gBAClC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;gBACvC,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,IAAI;gBACvC,eAAe,EAAE,eAAe,EAAE,OAAO,IAAI,IAAI;gBACjD,aAAa,EAAE,KAAK;aACrB,EACD,EAAE,QAAQ,EAAE,CACb,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;gBAChC,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAA;YACH,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QAED,MAAM,aAAa,GAAuB,KAAK,CAAC,KAAK,CAAA;QACrD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;QACzC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;QAEnC,4EAA4E;QAC5E,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;QACjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClE,MAAM,SAAS,GAAG,UAAU,OAAO,IAAI,UAAU,EAAE,EAAE,CAAA;QAErD,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,oBAAoB,GAAY,KAAK,CAAC,aAAa;YACvD,CAAC,CAAC;gBACE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACxF,QAAQ,EACN,IAAI,CAAC,eAAe,EAAE,QAAQ;oBAC9B,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACpD,EAAE;gBACJ,GAAG,KAAK,CAAC,aAAa;aACvB;YACH,CAAC,CAAC,KAAK,CAAC,YAAY;gBAClB,CAAC,CAAC;oBACE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE;oBAChD,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,IAAI,EAAE;oBAC9C,GAAG,KAAK,CAAC,YAAY;oBACrB,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK;iBACnC;gBACH,CAAC,CAAE,IAAI,CAAC,eAA2B,CAAA;QAEvC,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,mBAAmB,GACvB,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAA;QAElF,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAEvE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;YACvD,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,SAAS;YACpB,KAAK;YACL,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,aAAa;YACvB,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,SAAS;YAC7C,cAAc,EAAE,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzE,eAAe,EAAE,oBAAoB;YACrC,cAAc,EAAE,mBAAmB;YACnC,qBAAqB,EAAE,SAAS;YAChC,UAAU,EAAE,eAAe,EAAE,EAAE;YAC/B,cAAc,EAAE,KAAK,CAAC,kBAAkB;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;YACrD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;YAC/B,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,QAAQ;YACzB,eAAe,EAAE,MAAM,CAAC,EAAE;YAC1B,kBAAkB,EAAE,MAAM,CAAC,IAAI;SAChC,CAAC,CAAA;QAEF,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,KAAK,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,wBAAwB,CAAC;wBAC7B,UAAU,EAAE,OAAO,CAAC,EAAE;wBACtB,OAAO;wBACP,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,IAAI;wBACvC,KAAK;wBACL,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6BAA6B;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAA;YACtD,uEAAuE;YACvE,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAC/D,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,GAAG,iEAAiE,CAAA;YAChF,MAAM,UAAU,GAAqB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7D,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;gBAClD,QAAQ,EAAE,CAAC,CAAC,KAAK;gBACjB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpE,eAAe,EAAE,CAAC,CAAC,aAAa;aACjC,CAAC,CAAC,CAAA;YACH,sEAAsE;YACtE,mEAAmE;YACnE,yCAAyC;YACzC,MAAM,IAAI,GAAG,oBAAoB,CAAA;YACjC,MAAM,YAAY,GAAiB;gBACjC,IAAI,EAAE,KAAK,CAAC,aAAa;oBACvB,CAAC,CAAC,YAAY,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;oBAChF,CAAC,CAAC,KAAK,CAAC,KAAK;wBACX,CAAC,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;wBACtC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAA;YACD,IAAI,CAAC;gBACH,MAAM,qBAAqB,CAAC;oBAC1B,MAAM,EAAE,WAAW;oBACnB,EAAE,EAAE,KAAK;oBACT,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU;oBACjE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC;oBACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB;oBAChC,SAAS,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;oBACjC,aAAa,EAAE,aAAa,MAAM,CAAC,IAAI,EAAE;oBACzC,KAAK,EAAE,UAAU;oBACjB,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;oBAC3D,QAAQ,EACN,KAAK,CAAC,aAAa,GAAG,CAAC;wBACrB,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,EAAE;wBAC/D,CAAC,CAAC,SAAS;oBACf,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,SAAS;oBAC7C,YAAY,EACV,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM;oBAChF,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;oBACjD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;wBACjD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;yBACvD,CAAC,CAAC;wBACL,CAAC,CAAC,SAAS;oBACf,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;oBACrD,eAAe,EAAE,YAAY;oBAC7B,gBAAgB,EAAE,GAAG,QAAQ,mBAAmB,OAAO,EAAE;oBACzD,mBAAmB,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;iBACtD,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAA;YACpE,CAAC;YAED,uEAAuE;YACvE,yEAAyE;YACzE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAA;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAA;YAClD,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC;wBAChB,KAAK,EAAE;4BACL,KAAK,EAAE,UAAU;4BACjB,UAAU,EAAE,SAAS;4BACrB,UAAU,EAAE,SAAS;4BACrB,QAAQ,EAAE,OAAO;4BACjB,WAAW,EAAE,UAAU;4BACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,IAAI,EAAE,mBAAmB;yBAC1B;wBACD,MAAM,EAAE,IAAI;wBACZ,OAAO,EAAE,IAAI;qBACd,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,IAAI;YACb,OAAO;YACP,SAAS;YACT,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE;SACxF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;QACpD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,8CAA8C,EAAE,IAAI,EAAE,gBAAyB,EAAE,EAC1F,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"manual.js","sourceRoot":"","sources":["../../../src/checkout/api/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAsCzD,SAAS,GAAG,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,iBAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AACnF,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA8B,CAAA;QAEhE,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;QAErC,qEAAqE;QACrE,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,eAAe,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAEvD,MAAM,kBAAkB,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAA;QAC1D,IAAI,CAAC,kBAAkB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,yDAAyD;gBAChE,IAAI,EAAE,yBAAkC;aACzC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,gCAAgC;QAChC,MAAM,KAAK,GACT,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC1F,IAAI,CAAC,KAAK,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,2BAA2B,CAAC,CAAA;QACzC,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,GAAG,CAAC,6BAA6B,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAA;QACzD,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YAChF,OAAO,GAAG,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAA;QACzD,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,KAAK,CAAA;QACT,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,UAAU,CACtB;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,WAAW,EAAE,qBAAqB;gBAClC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;gBACvC,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,IAAI;gBACvC,eAAe,EAAE,eAAe,EAAE,OAAO,IAAI,IAAI;gBACjD,aAAa,EAAE,KAAK;aACrB,EACD,EAAE,QAAQ,EAAE,CACb,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;gBAChC,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAA;YACH,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QAED,MAAM,aAAa,GAAuB,KAAK,CAAC,KAAK,CAAA;QACrD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;QACzC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;QAEnC,4EAA4E;QAC5E,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;QACjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClE,MAAM,SAAS,GAAG,UAAU,OAAO,IAAI,UAAU,EAAE,EAAE,CAAA;QAErD,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,oBAAoB,GAAY,KAAK,CAAC,aAAa;YACvD,CAAC,CAAC;gBACE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACxF,QAAQ,EACN,IAAI,CAAC,eAAe,EAAE,QAAQ;oBAC9B,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACpD,EAAE;gBACJ,GAAG,KAAK,CAAC,aAAa;aACvB;YACH,CAAC,CAAC,KAAK,CAAC,YAAY;gBAClB,CAAC,CAAC;oBACE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE;oBAChD,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,IAAI,EAAE;oBAC9C,GAAG,KAAK,CAAC,YAAY;oBACrB,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK;iBACnC;gBACH,CAAC,CAAE,IAAI,CAAC,eAA2B,CAAA;QAEvC,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,mBAAmB,GACvB,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAA;QAElF,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAEvE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;YACvD,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,SAAS;YACpB,KAAK;YACL,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,aAAa;YACvB,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,SAAS;YAC7C,cAAc,EAAE,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzE,eAAe,EAAE,oBAAoB;YACrC,cAAc,EAAE,mBAAmB;YACnC,qBAAqB,EAAE,SAAS;YAChC,UAAU,EAAE,eAAe,EAAE,EAAE;YAC/B,cAAc,EAAE,KAAK,CAAC,kBAAkB;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;YACrD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;YAC/B,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,QAAQ;YACzB,eAAe,EAAE,MAAM,CAAC,EAAE;YAC1B,kBAAkB,EAAE,MAAM,CAAC,IAAI;SAChC,CAAC,CAAA;QAEF,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,KAAK,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,wBAAwB,CAAC;wBAC7B,UAAU,EAAE,OAAO,CAAC,EAAE;wBACtB,OAAO;wBACP,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,IAAI;wBACvC,KAAK;wBACL,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6BAA6B;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAA;YACtD,uEAAuE;YACvE,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAC/D,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,GAAG,iEAAiE,CAAA;YAChF,MAAM,UAAU,GAAqB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7D,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;gBAClD,QAAQ,EAAE,CAAC,CAAC,KAAK;gBACjB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpE,eAAe,EAAE,CAAC,CAAC,aAAa;aACjC,CAAC,CAAC,CAAA;YACH,sEAAsE;YACtE,mEAAmE;YACnE,yCAAyC;YACzC,MAAM,IAAI,GAAG,oBAAoB,CAAA;YACjC,MAAM,YAAY,GAAiB;gBACjC,IAAI,EAAE,KAAK,CAAC,aAAa;oBACvB,CAAC,CAAC,YAAY,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;oBAChF,CAAC,CAAC,KAAK,CAAC,KAAK;wBACX,CAAC,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;wBACtC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAA;YACD,IAAI,CAAC;gBACH,MAAM,qBAAqB,CAAC;oBAC1B,MAAM,EAAE,WAAW;oBACnB,EAAE,EAAE,KAAK;oBACT,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU;oBACjE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC;oBACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB;oBAChC,SAAS,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;oBACjC,aAAa,EAAE,aAAa,MAAM,CAAC,IAAI,EAAE;oBACzC,KAAK,EAAE,UAAU;oBACjB,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;oBAC3D,QAAQ,EACN,KAAK,CAAC,aAAa,GAAG,CAAC;wBACrB,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,EAAE;wBAC/D,CAAC,CAAC,SAAS;oBACf,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,SAAS;oBAC7C,YAAY,EACV,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM;oBAChF,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;oBACjD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;wBACjD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;yBACvD,CAAC,CAAC;wBACL,CAAC,CAAC,SAAS;oBACf,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;oBACrD,eAAe,EAAE,YAAY;oBAC7B,gBAAgB,EAAE,GAAG,QAAQ,mBAAmB,OAAO,EAAE;oBACzD,mBAAmB,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;iBACtD,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAA;YACpE,CAAC;YAED,uEAAuE;YACvE,yEAAyE;YACzE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAA;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAA;YAClD,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC;wBAChB,KAAK,EAAE;4BACL,KAAK,EAAE,UAAU;4BACjB,UAAU,EAAE,SAAS;4BACrB,UAAU,EAAE,SAAS;4BACrB,QAAQ,EAAE,OAAO;4BACjB,WAAW,EAAE,UAAU;4BACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,IAAI,EAAE,mBAAmB;yBAC1B;wBACD,MAAM,EAAE,IAAI;wBACZ,OAAO,EAAE,IAAI;qBACd,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,IAAI;YACb,OAAO;YACP,SAAS;YACT,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE;SACxF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;QACpD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,8CAA8C,EAAE,IAAI,EAAE,gBAAyB,EAAE,EAC1F,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/checkout/api/payment-methods.d.ts

@@ -6,6 +6,14 @@
  * Instructions are included so the confirmation UI can show them (they are
  * merchant-authored customer-facing copy, not secrets).
  *
+ * External payment PROVIDERS (SDK 0.25.0 — PayPal, Up2pay e-Transactions)
+ * surface here as SYNTHETIC entries (kind='external'), the way native
+ * Stripe is implicit: presence = configured + enabled in Admin → Payments,
+ * no payment_methods row to keep in sync with the enable toggle. The only
+ * config that crosses this public surface is PayPal's client id +
+ * environment — public by design (they parameterize the buttons script);
+ * secrets never leave the server.
+ *
  * Usage:
  * ```typescript
  * // app/api/checkout/payment-methods/route.ts
@@ -13,13 +21,22 @@
  * ```
  */
 import { NextResponse } from 'next/server';
+export interface PublicPaymentMethod {
+    id: string;
+    kind: string;
+    name: string;
+    instructions: string | null;
+    /** 'paypal' | 'up2pay' on synthetic provider entries; absent on registry rows. */
+    provider?: 'paypal' | 'up2pay';
+    /** PayPal buttons parameters (public by design). */
+    paypal?: {
+        clientId: string;
+        environment: 'sandbox' | 'production';
+    };
+}
 export declare function GET(): Promise<NextResponse<{
     success: boolean;
-    methods: {
-        id: string;
-        kind: string;
-        name: string;
-        instructions: string | null;
-    }[];
+    stripeAvailable: boolean;
+    methods: PublicPaymentMethod[];
 }>>;
 //# sourceMappingURL=payment-methods.d.ts.map

package/dist/checkout/api/payment-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payment-methods.d.ts","sourceRoot":"","sources":["../../../src/checkout/api/payment-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI1C,wBAAsB,GAAG;;;;;;;;IAoBxB"}
+{"version":3,"file":"payment-methods.d.ts","sourceRoot":"","sources":["../../../src/checkout/api/payment-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO1C,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC9B,oDAAoD;IACpD,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,GAAG,YAAY,CAAA;KAAE,CAAA;CACrE;AAkBD,wBAAsB,GAAG;;;;IAuDxB"}

package/dist/checkout/api/payment-methods.js

@@ -6,6 +6,14 @@
  * Instructions are included so the confirmation UI can show them (they are
  * merchant-authored customer-facing copy, not secrets).
  *
+ * External payment PROVIDERS (SDK 0.25.0 — PayPal, Up2pay e-Transactions)
+ * surface here as SYNTHETIC entries (kind='external'), the way native
+ * Stripe is implicit: presence = configured + enabled in Admin → Payments,
+ * no payment_methods row to keep in sync with the enable toggle. The only
+ * config that crosses this public surface is PayPal's client id +
+ * environment — public by design (they parameterize the buttons script);
+ * secrets never leave the server.
+ *
  * Usage:
  * ```typescript
  * // app/api/checkout/payment-methods/route.ts
@@ -13,28 +21,79 @@
  * ```
  */
 import { NextResponse } from 'next/server';
-import { findEnabledPaymentMethods } from '../../core/db/queries';
+import { findEnabledPaymentMethods, findSettings } from '../../core/db/queries';
 import { resolveCheckoutCustomer } from '../server/checkout-customer';
+import { resolvePaypalCredentials } from '../server/paypal';
+import { resolveUp2payCredentials } from '../server/up2pay';
+import { hasConnectedAccount } from '../stripe/client';
+/**
+ * Whether native Stripe card payment is available on THIS store — the same
+ * env truth `createCheckoutSession` runs on (connected account + secret
+ * key). Env-only, so it works even inside the fail-open catch: a DB hiccup
+ * still degrades to Stripe-only on stores that HAVE Stripe, and never
+ * offers a card option on stores that don't (0.25.1 — the checkout used to
+ * hardcode the card radio and eject shoppers into a dead Stripe path).
+ */
+function stripeIsAvailable() {
+    try {
+        return !!process.env.STRIPE_SECRET_KEY && hasConnectedAccount();
+    }
+    catch {
+        return false;
+    }
+}
 export async function GET() {
+    const stripeAvailable = stripeIsAvailable();
     try {
         // Group-gated methods are hidden from guests and non-members — the group
         // comes from the SESSION (resolveCheckoutCustomer), never from the client.
         const customer = await resolveCheckoutCustomer();
         const methods = await findEnabledPaymentMethods(customer?.groupId ?? null);
-        return NextResponse.json({
-            success: true,
-            methods: methods.map((m) => ({
+        const out = [];
+        // External providers render FIRST (card-adjacent), then manual methods.
+        // Each is guarded so a provider hiccup can never hide the others.
+        try {
+            const settings = await findSettings();
+            const paypal = resolvePaypalCredentials(settings);
+            if (paypal) {
+                out.push({
+                    id: 'paypal',
+                    kind: 'external',
+                    provider: 'paypal',
+                    name: 'PayPal',
+                    instructions: null,
+                    paypal: { clientId: paypal.clientId, environment: paypal.environment },
+                });
+            }
+            const up2pay = resolveUp2payCredentials(settings);
+            if (up2pay) {
+                out.push({
+                    id: 'up2pay',
+                    kind: 'external',
+                    provider: 'up2pay',
+                    name: 'Carte bancaire (Crédit Agricole)',
+                    instructions: null,
+                });
+            }
+        }
+        catch (err) {
+            console.error('[Checkout Payment Methods API] provider resolution failed:', err);
+        }
+        for (const m of methods) {
+            out.push({
                 id: m.id,
                 kind: m.kind,
                 name: m.name,
                 instructions: m.instructions ?? null,
-            })),
-        });
+            });
+        }
+        return NextResponse.json({ success: true, stripeAvailable, methods: out });
     }
     catch (error) {
         console.error('[Checkout Payment Methods API] list error:', error);
-        // Fail-open to "no extra methods" — checkout falls back to Stripe-only.
-        return NextResponse.json({ success: true, methods: [] });
+        // Fail-open to "no extra methods" — checkout falls back to Stripe-only
+        // WHEN Stripe exists (env-derived, unaffected by the DB error).
+        return NextResponse.json({ success: true, stripeAvailable, methods: [] });
     }
 }
 //# sourceMappingURL=payment-methods.js.map

package/dist/checkout/api/payment-methods.js.map

@@ -1 +1 @@
-{"version":3,"file":"payment-methods.js","sourceRoot":"","sources":["../../../src/checkout/api/payment-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,IAAI,CAAC;QACH,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAChD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC,CAAA;QAC1E,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;aACrC,CAAC,CAAC;SACJ,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAA;QAClE,wEAAwE;QACxE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"payment-methods.js","sourceRoot":"","sources":["../../../src/checkout/api/payment-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAatD;;;;;;;GAOG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,mBAAmB,EAAE,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAA;IAC3C,IAAI,CAAC;QACH,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAChD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC,CAAA;QAE1E,MAAM,GAAG,GAA0B,EAAE,CAAA;QAErC,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;YACrC,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAA;YACjD,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC;oBACP,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,QAAQ;oBACd,YAAY,EAAE,IAAI;oBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;iBACvE,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAA;YACjD,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC;oBACP,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,kCAAkC;oBACxC,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4DAA4D,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;aACrC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAA;QAClE,uEAAuE;QACvE,gEAAgE;QAChE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC"}

package/dist/checkout/api/paypal-capture.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @rovela/sdk/checkout/api/paypal-capture
+ *
+ * The PayPal proof-of-payment legs:
+ *  - POST /api/checkout/paypal/capture — Smart Buttons onApprove leg.
+ *  - GET  /api/checkout/paypal/return  — redirect-fallback return leg
+ *    (PayPal appends ?token={paypalOrderId}), exported as ReturnGET.
+ *
+ * Both capture server-side then flip the pending order through the shared
+ * confirm helper (atomic claim — the two legs racing each other, or a
+ * webhook racing either, produce exactly one confirmation). The client
+ * never reports amounts; the capture's own amount is checked against the
+ * DB order.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/checkout/paypal/capture/route.ts
+ * export { POST } from '@rovela-ai/sdk/checkout/api/paypal-capture'
+ * // app/api/checkout/paypal/return/route.ts
+ * export { ReturnGET as GET } from '@rovela-ai/sdk/checkout/api/paypal-capture'
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { CheckoutApiError } from '../types';
+interface PaypalCaptureResponse {
+    success: true;
+    orderId: string;
+}
+/** Smart Buttons onApprove leg. */
+export declare function POST(request: NextRequest): Promise<NextResponse<PaypalCaptureResponse | CheckoutApiError>>;
+/**
+ * Redirect-fallback return leg. Always ends in a browser redirect: success →
+ * the success page (which clears the cart), anything else → back to checkout
+ * with the cart intact.
+ */
+export declare function ReturnGET(request: NextRequest): Promise<NextResponse>;
+export {};
+//# sourceMappingURL=paypal-capture.d.ts.map

package/dist/checkout/api/paypal-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal-capture.d.ts","sourceRoot":"","sources":["../../../src/checkout/api/paypal-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAKvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,UAAU,qBAAqB;IAC7B,OAAO,EAAE,IAAI,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAuDD,mCAAmC;AACnC,wBAAsB,IAAI,CACxB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,CAAC,CAgDjE;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAsB3E"}

package/dist/checkout/api/paypal-capture.js

@@ -0,0 +1,126 @@
+/**
+ * @rovela/sdk/checkout/api/paypal-capture
+ *
+ * The PayPal proof-of-payment legs:
+ *  - POST /api/checkout/paypal/capture — Smart Buttons onApprove leg.
+ *  - GET  /api/checkout/paypal/return  — redirect-fallback return leg
+ *    (PayPal appends ?token={paypalOrderId}), exported as ReturnGET.
+ *
+ * Both capture server-side then flip the pending order through the shared
+ * confirm helper (atomic claim — the two legs racing each other, or a
+ * webhook racing either, produce exactly one confirmation). The client
+ * never reports amounts; the capture's own amount is checked against the
+ * DB order.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/checkout/paypal/capture/route.ts
+ * export { POST } from '@rovela-ai/sdk/checkout/api/paypal-capture'
+ * // app/api/checkout/paypal/return/route.ts
+ * export { ReturnGET as GET } from '@rovela-ai/sdk/checkout/api/paypal-capture'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { findSettings } from '../../core/db/queries';
+import { resolveStoreBaseUrl } from '../server/external-checkout';
+import { resolvePaypalCredentials, capturePaypalOrder, PaypalApiError } from '../server/paypal';
+import { confirmExternalOrderPaid } from '../server/confirm-order';
+async function captureAndConfirm(paypalOrderId) {
+    const settings = await findSettings();
+    const credentials = resolvePaypalCredentials(settings);
+    if (!credentials)
+        return { kind: 'unavailable' };
+    const capture = await capturePaypalOrder(credentials, paypalOrderId);
+    if (capture.status !== 'COMPLETED') {
+        // Not captured (declined, or a pending review state). The order stays
+        // pending; PAYMENT.CAPTURE.COMPLETED via webhook confirms late captures.
+        console.warn(`[PayPal Capture] order ${paypalOrderId} status=${capture.status} — not confirming`);
+        return { kind: 'not_completed', status: capture.status };
+    }
+    if (!capture.invoiceId) {
+        console.error(`[PayPal Capture] COMPLETED capture without invoice_id for ${paypalOrderId}`);
+        return { kind: 'not_found' };
+    }
+    const result = await confirmExternalOrderPaid({
+        reference: capture.invoiceId,
+        expectedProvider: 'paypal',
+        providerLabel: 'PayPal',
+        paidAmountCents: capture.amountCents,
+        paidCurrency: capture.currency,
+        transaction: [
+            { key: 'paypal_order_id', label: 'PayPal order', value: paypalOrderId },
+            ...(capture.captureId
+                ? [{ key: 'paypal_capture_id', label: 'PayPal capture', value: capture.captureId }]
+                : []),
+            ...(capture.payerEmail
+                ? [{ key: 'paypal_payer', label: 'PayPal payer', value: capture.payerEmail }]
+                : []),
+        ],
+    });
+    switch (result.status) {
+        case 'confirmed':
+        case 'already_processed':
+            return { kind: 'paid', orderId: result.orderId };
+        case 'amount_mismatch':
+            return { kind: 'mismatch' };
+        default:
+            return { kind: 'not_found' };
+    }
+}
+/** Smart Buttons onApprove leg. */
+export async function POST(request) {
+    try {
+        const body = (await request.json().catch(() => null));
+        const paypalOrderId = body?.paypalOrderId?.trim();
+        if (!paypalOrderId || paypalOrderId.length > 64) {
+            return NextResponse.json({ error: 'paypalOrderId is required', code: 'INVALID_REQUEST' }, { status: 400 });
+        }
+        const outcome = await captureAndConfirm(paypalOrderId);
+        switch (outcome.kind) {
+            case 'paid':
+                return NextResponse.json({ success: true, orderId: outcome.orderId });
+            case 'not_completed':
+                return NextResponse.json({
+                    error: 'The payment was not completed. Please try again.',
+                    code: 'PAYMENT_NOT_COMPLETED',
+                }, { status: 402 });
+            case 'unavailable':
+                return NextResponse.json({ error: 'This payment method is not available', code: 'INVALID_REQUEST' }, { status: 400 });
+            default:
+                return NextResponse.json({ error: 'This payment could not be confirmed.', code: 'CHECKOUT_ERROR' }, { status: 409 });
+        }
+    }
+    catch (error) {
+        if (error instanceof PaypalApiError) {
+            console.error('[PayPal Capture API] PayPal error:', error.status, error.issue, error.body);
+            return NextResponse.json({ error: 'PayPal could not complete this payment.', code: 'CHECKOUT_ERROR' }, { status: 502 });
+        }
+        console.error('[PayPal Capture API] error:', error);
+        return NextResponse.json({ error: 'Failed to confirm the payment.', code: 'CHECKOUT_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * Redirect-fallback return leg. Always ends in a browser redirect: success →
+ * the success page (which clears the cart), anything else → back to checkout
+ * with the cart intact.
+ */
+export async function ReturnGET(request) {
+    const base = resolveStoreBaseUrl(request.nextUrl.origin);
+    const paypalOrderId = request.nextUrl.searchParams.get('token')?.trim();
+    if (!paypalOrderId || paypalOrderId.length > 64) {
+        return NextResponse.redirect(`${base}/checkout?payment=failed`, 307);
+    }
+    try {
+        const outcome = await captureAndConfirm(paypalOrderId);
+        if (outcome.kind === 'paid') {
+            return NextResponse.redirect(`${base}/checkout/success?orderId=${encodeURIComponent(outcome.orderId)}`, 307);
+        }
+        console.warn(`[PayPal Return] capture outcome ${outcome.kind} for ${paypalOrderId}`);
+        return NextResponse.redirect(`${base}/checkout?payment=failed`, 307);
+    }
+    catch (error) {
+        console.error('[PayPal Return] error:', error);
+        return NextResponse.redirect(`${base}/checkout?payment=failed`, 307);
+    }
+}
+//# sourceMappingURL=paypal-capture.js.map

package/dist/checkout/api/paypal-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal-capture.js","sourceRoot":"","sources":["../../../src/checkout/api/paypal-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAC/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAelE,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IACpD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;IACrC,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAA;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAEhD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IAEpE,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,sEAAsE;QACtE,yEAAyE;QACzE,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,WAAW,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAA;QACjG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,EAAE,CAAC,CAAA;QAC3F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,gBAAgB,EAAE,QAAQ;QAC1B,aAAa,EAAE,QAAQ;QACvB,eAAe,EAAE,OAAO,CAAC,WAAW;QACpC,YAAY,EAAE,OAAO,CAAC,QAAQ;QAC9B,WAAW,EAAE;YACX,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE;YACvE,GAAG,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnF,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC7E,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAA;IAEF,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,WAAW,CAAC;QACjB,KAAK,mBAAmB;YACtB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;QAClD,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QAC7B;YACE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAChC,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAsC,CAAA;QAC1F,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;QACjD,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,iBAA0B,EAAE,EACxE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAA;QACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YACvE,KAAK,eAAe;gBAClB,OAAO,YAAY,CAAC,IAAI,CACtB;oBACE,KAAK,EAAE,kDAAkD;oBACzD,IAAI,EAAE,uBAAgC;iBACvC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,KAAK,aAAa;gBAChB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,iBAA0B,EAAE,EACnF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH;gBACE,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,gBAAyB,EAAE,EAClF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAC1F,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,yCAAyC,EAAE,IAAI,EAAE,gBAAyB,EAAE,EACrF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,gCAAgC,EAAE,IAAI,EAAE,gBAAyB,EAAE,EAC5E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAoB;IAClD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAA;IAEvE,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAChD,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,IAAI,0BAA0B,EAAE,GAAG,CAAC,CAAA;IACtE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAA;QACtD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,YAAY,CAAC,QAAQ,CAC1B,GAAG,IAAI,6BAA6B,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EACzE,GAAG,CACJ,CAAA;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,mCAAmC,OAAO,CAAC,IAAI,QAAQ,aAAa,EAAE,CAAC,CAAA;QACpF,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,IAAI,0BAA0B,EAAE,GAAG,CAAC,CAAA;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;QAC9C,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,IAAI,0BAA0B,EAAE,GAAG,CAAC,CAAA;IACtE,CAAC;AACH,CAAC"}

package/dist/checkout/api/paypal-webhook.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @rovela/sdk/checkout/api/paypal-webhook
+ *
+ * POST /api/checkout/paypal/webhook — the async BACKSTOP, never the primary
+ * payment path (the capture legs are). Confirms captures the client never
+ * reported (buyer closed the tab between approval and capture) and records
+ * PayPal-side refunds. Every event is verified through PayPal's
+ * verify-webhook-signature endpoint — which requires the merchant's
+ * webhook id (Admin → Payments → PayPal); without it events are
+ * acknowledged but IGNORED.
+ *
+ * Idempotent by construction: confirmation goes through the same atomic
+ * claim as the capture legs, and PayPal retries non-2xx up to 25 times
+ * over 3 days — so processed events always 200.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/checkout/paypal/webhook/route.ts
+ * export { POST } from '@rovela-ai/sdk/checkout/api/paypal-webhook'
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+export declare function POST(request: NextRequest): Promise<NextResponse>;
+//# sourceMappingURL=paypal-webhook.d.ts.map

package/dist/checkout/api/paypal-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal-webhook.d.ts","sourceRoot":"","sources":["../../../src/checkout/api/paypal-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAsBvD,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CA4GtE"}

package/dist/checkout/api/paypal-webhook.js

@@ -0,0 +1,122 @@
+/**
+ * @rovela/sdk/checkout/api/paypal-webhook
+ *
+ * POST /api/checkout/paypal/webhook — the async BACKSTOP, never the primary
+ * payment path (the capture legs are). Confirms captures the client never
+ * reported (buyer closed the tab between approval and capture) and records
+ * PayPal-side refunds. Every event is verified through PayPal's
+ * verify-webhook-signature endpoint — which requires the merchant's
+ * webhook id (Admin → Payments → PayPal); without it events are
+ * acknowledged but IGNORED.
+ *
+ * Idempotent by construction: confirmation goes through the same atomic
+ * claim as the capture legs, and PayPal retries non-2xx up to 25 times
+ * over 3 days — so processed events always 200.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/checkout/paypal/webhook/route.ts
+ * export { POST } from '@rovela-ai/sdk/checkout/api/paypal-webhook'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { findSettings, findOrderByPaymentIntent, updateOrderStatus, updateOrderRefundAmount } from '../../core/db/queries';
+import { resolvePaypalCredentials, verifyPaypalWebhook, readPaypalWebhookHeaders, } from '../server/paypal';
+import { confirmExternalOrderPaid } from '../server/confirm-order';
+export async function POST(request) {
+    try {
+        const rawBody = await request.text();
+        let event;
+        try {
+            event = JSON.parse(rawBody);
+        }
+        catch {
+            return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 });
+        }
+        const settings = await findSettings();
+        const credentials = resolvePaypalCredentials(settings);
+        if (!credentials) {
+            // Provider disabled/unconfigured but a webhook is still registered at
+            // PayPal — acknowledge so PayPal stops retrying, process nothing.
+            console.warn('[PayPal Webhook] event received while provider not configured — ignored');
+            return NextResponse.json({ received: true, ignored: true });
+        }
+        if (!credentials.webhookId) {
+            console.warn('[PayPal Webhook] no webhook id configured — event NOT verified, ignored. Set it in Admin → Payments → PayPal.');
+            return NextResponse.json({ received: true, ignored: true });
+        }
+        const verified = await verifyPaypalWebhook(credentials, credentials.webhookId, readPaypalWebhookHeaders(request.headers), event);
+        if (!verified) {
+            console.error('[PayPal Webhook] signature verification FAILED — nothing processed');
+            return NextResponse.json({ error: 'Verification failed' }, { status: 400 });
+        }
+        const resource = event.resource ?? {};
+        const reference = resource.invoice_id ?? resource.custom_id ?? null;
+        switch (event.event_type) {
+            case 'PAYMENT.CAPTURE.COMPLETED': {
+                if (!reference || !reference.startsWith('paypal_')) {
+                    console.warn(`[PayPal Webhook] capture completed without a usable reference (${reference})`);
+                    break;
+                }
+                const amountValue = resource.amount?.value;
+                const result = await confirmExternalOrderPaid({
+                    reference,
+                    expectedProvider: 'paypal',
+                    providerLabel: 'PayPal',
+                    paidAmountCents: amountValue != null ? Math.round(parseFloat(amountValue) * 100) : null,
+                    paidCurrency: resource.amount?.currency_code ?? null,
+                    transaction: [
+                        ...(resource.id
+                            ? [{ key: 'paypal_capture_id', label: 'PayPal capture', value: resource.id }]
+                            : []),
+                        ...(resource.supplementary_data?.related_ids?.order_id
+                            ? [
+                                {
+                                    key: 'paypal_order_id',
+                                    label: 'PayPal order',
+                                    value: resource.supplementary_data.related_ids.order_id,
+                                },
+                            ]
+                            : []),
+                    ],
+                });
+                console.log(`[PayPal Webhook] capture completed ref=${reference} → ${result.status}`);
+                break;
+            }
+            case 'PAYMENT.CAPTURE.REFUNDED':
+            case 'PAYMENT.CAPTURE.REVERSED': {
+                if (!reference || !reference.startsWith('paypal_'))
+                    break;
+                const order = await findOrderByPaymentIntent(reference);
+                if (!order || order.paymentProvider !== 'paypal')
+                    break;
+                const refundValue = resource.amount?.value;
+                const refundCents = refundValue != null ? Math.round(parseFloat(refundValue) * 100) : null;
+                if (refundCents != null && refundCents > 0) {
+                    await updateOrderRefundAmount(order.id, refundCents);
+                    const totalCents = Math.round(parseFloat(order.total) * 100);
+                    const priorRefundCents = order.refundAmount
+                        ? Math.round(parseFloat(order.refundAmount) * 100)
+                        : 0;
+                    if (priorRefundCents + refundCents >= totalCents && order.status !== 'refunded') {
+                        await updateOrderStatus(order.id, 'refunded');
+                    }
+                    console.log(`[PayPal Webhook] refund recorded ref=${reference} amount=${refundCents} (prior ${priorRefundCents})`);
+                }
+                break;
+            }
+            case 'PAYMENT.CAPTURE.DENIED':
+                console.warn(`[PayPal Webhook] capture DENIED ref=${reference ?? 'unknown'} — order stays pending`);
+                break;
+            default:
+                // Unsubscribed/uninteresting event types are acknowledged silently.
+                break;
+        }
+        return NextResponse.json({ received: true, event: event.event_type ?? null });
+    }
+    catch (error) {
+        console.error('[PayPal Webhook] error:', error);
+        return NextResponse.json({ error: 'Webhook processing failed' }, { status: 500 });
+    }
+}
+//# sourceMappingURL=paypal-webhook.js.map

package/dist/checkout/api/paypal-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal-webhook.js","sourceRoot":"","sources":["../../../src/checkout/api/paypal-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC1H,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAelE,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,KAAyB,CAAA;QAC7B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;QACrC,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,sEAAsE;YACtE,kEAAkE;YAClE,OAAO,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;YACvF,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CACV,+GAA+G,CAChH,CAAA;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,WAAW,EACX,WAAW,CAAC,SAAS,EACrB,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,EACzC,KAAK,CACN,CAAA;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAA;YACnF,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7E,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAA;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAA;QAEnE,QAAQ,KAAK,CAAC,UAAU,EAAE,CAAC;YACzB,KAAK,2BAA2B,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnD,OAAO,CAAC,IAAI,CAAC,kEAAkE,SAAS,GAAG,CAAC,CAAA;oBAC5F,MAAK;gBACP,CAAC;gBACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;gBAC1C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;oBAC5C,SAAS;oBACT,gBAAgB,EAAE,QAAQ;oBAC1B,aAAa,EAAE,QAAQ;oBACvB,eAAe,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;oBACvF,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;oBACpD,WAAW,EAAE;wBACX,GAAG,CAAC,QAAQ,CAAC,EAAE;4BACb,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;4BAC7E,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,CAAC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,EAAE,QAAQ;4BACpD,CAAC,CAAC;gCACE;oCACE,GAAG,EAAE,iBAAiB;oCACtB,KAAK,EAAE,cAAc;oCACrB,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,WAAW,CAAC,QAAQ;iCACxD;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF,CAAC,CAAA;gBACF,OAAO,CAAC,GAAG,CAAC,0CAA0C,SAAS,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;gBACrF,MAAK;YACP,CAAC;YAED,KAAK,0BAA0B,CAAC;YAChC,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;oBAAE,MAAK;gBACzD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAA;gBACvD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,eAAe,KAAK,QAAQ;oBAAE,MAAK;gBACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;gBAC1C,MAAM,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC1F,IAAI,WAAW,IAAI,IAAI,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;oBAC3C,MAAM,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;oBACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAA;oBAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,YAAY;wBACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC;wBAClD,CAAC,CAAC,CAAC,CAAA;oBACL,IAAI,gBAAgB,GAAG,WAAW,IAAI,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;wBAChF,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;oBAC/C,CAAC;oBACD,OAAO,CAAC,GAAG,CACT,wCAAwC,SAAS,WAAW,WAAW,WAAW,gBAAgB,GAAG,CACtG,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,CAAC;YAED,KAAK,wBAAwB;gBAC3B,OAAO,CAAC,IAAI,CAAC,uCAAuC,SAAS,IAAI,SAAS,wBAAwB,CAAC,CAAA;gBACnG,MAAK;YAEP;gBACE,oEAAoE;gBACpE,MAAK;QACT,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAA;QAC/C,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC"}

package/dist/checkout/api/paypal.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @rovela/sdk/checkout/api/paypal
+ *
+ * POST /api/checkout/paypal — start a PayPal payment. Creates the order
+ * 'pending' (server-priced, §55) and a matching PayPal order (Orders v2,
+ * invoice_id = our reference). The client either renders the Smart Buttons
+ * popup (paypalOrderId) or redirects to approveUrl (fallback). Payment
+ * truth arrives via the capture leg (checkout/api/paypal-capture) with the
+ * webhook as async backstop — never via this route.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/checkout/paypal/route.ts
+ * export { POST } from '@rovela-ai/sdk/checkout/api/paypal'
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { CheckoutApiError } from '../types';
+export declare const PAYPAL_METHOD_LABEL = "PayPal";
+interface PaypalCheckoutResponse {
+    success: true;
+    orderId: string;
+    reference: string;
+    paypalOrderId: string;
+    /** Hosted approval link — the no-JS redirect fallback. */
+    approveUrl: string | null;
+}
+export declare function POST(request: NextRequest): Promise<NextResponse<PaypalCheckoutResponse | CheckoutApiError>>;
+export {};
+//# sourceMappingURL=paypal.d.ts.map

package/dist/checkout/api/paypal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal.d.ts","sourceRoot":"","sources":["../../../src/checkout/api/paypal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAOvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD,eAAO,MAAM,mBAAmB,WAAW,CAAA;AAE3C,UAAU,sBAAsB;IAC9B,OAAO,EAAE,IAAI,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAsB,IAAI,CACxB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,sBAAsB,GAAG,gBAAgB,CAAC,CAAC,CA6DlE"}