@rovela-ai/sdk 0.24.1 → 0.25.1

package/dist/checkout/server/external-checkout.js

@@ -0,0 +1,187 @@
+/**
+ * @rovela/sdk/checkout/server/external-checkout
+ *
+ * Shared "start an external-provider payment" leg (PayPal, Up2pay): the
+ * same gates → buildQuote → pending-order sequence as the manual path
+ * (checkout/api/manual.ts), minus the confirmation email — external orders
+ * email on CONFIRMED payment (confirm-order.ts), not at creation.
+ *
+ * §55 invariants preserved verbatim: session-resolved identity, the ONE
+ * pricing engine in the ONE mode, PricingError → 4xx, idempotent reference
+ * through the shared payment-intent column. Discount redemptions + purchase
+ * analytics record at CREATE time — deliberate parity with the manual path
+ * (a pending order that is never paid keeps its redemption, exactly like an
+ * unpaid COD order; consistency beats a second bookkeeping model).
+ */
+import { randomUUID } from 'crypto';
+import { NextResponse } from 'next/server';
+import { findSettings, recordDiscountRedemption } from '../../core/db/queries';
+import { buildQuote, PricingError, CHECKOUT_PRICING_MODE } from './pricing';
+import { resolveCheckoutCustomer } from './checkout-customer';
+import { createOrderFromCheckout } from './order-service';
+import { recordEvent } from '../../analytics/server';
+import { isSupportedLocale } from '../../core/i18n/types';
+const bad = (error, status = 400) => ({
+    ok: false,
+    response: NextResponse.json({ error, code: 'INVALID_REQUEST' }, { status }),
+});
+export async function preparePendingExternalOrder(input) {
+    const { body, provider } = input;
+    const settings = await findSettings();
+    // Trusted identity: session cookie, never body (§55).
+    const trustedCustomer = await resolveCheckoutCustomer();
+    const allowGuestCheckout = settings?.guestCheckout ?? true;
+    if (!allowGuestCheckout && !trustedCustomer) {
+        return {
+            ok: false,
+            response: NextResponse.json({
+                error: 'Guest checkout is disabled. Please sign in to continue.',
+                code: 'GUEST_CHECKOUT_DISABLED',
+            }, { status: 403 }),
+        };
+    }
+    // Inline-signed-in customers never type an email (the guest contact field
+    // is skipped), so the body may not carry one — the SESSION-resolved email
+    // is the fallback, and the better truth when present (0.25.1).
+    const email = body.customerEmail?.trim().toLowerCase() || trustedCustomer?.email?.trim().toLowerCase();
+    if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        return bad('A valid email is required');
+    }
+    // ── The Quote: the SAME engine in the SAME mode as every money path ──────
+    let quote;
+    try {
+        quote = await buildQuote({
+            items: body.items,
+            shippingAddress: body.shippingAddress,
+            selectedShipping: body.selectedShipping,
+            pricingMode: CHECKOUT_PRICING_MODE,
+            discountCode: body.discountCode ?? null,
+            customerId: trustedCustomer?.id ?? null,
+            customerGroupId: trustedCustomer?.groupId ?? null,
+            customerEmail: email,
+        }, { settings });
+    }
+    catch (err) {
+        if (err instanceof PricingError) {
+            return {
+                ok: false,
+                response: NextResponse.json({ error: err.message, code: err.code }, { status: err.status }),
+            };
+        }
+        throw err;
+    }
+    // ── Idempotency reference (shared payment-intent column) ─────────────────
+    const rawKey = typeof body.idempotencyKey === 'string' ? body.idempotencyKey : '';
+    const safeKey = rawKey.replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 48);
+    const reference = `${provider}_${safeKey || randomUUID()}`;
+    // ── Address snapshots (identical rules to the manual path) ───────────────
+    const orderShippingAddress = quote.pickupAddress
+        ? {
+            firstName: body.shippingAddress?.firstName || trustedCustomer?.name?.split(' ')[0] || '',
+            lastName: body.shippingAddress?.lastName ||
+                trustedCustomer?.name?.split(' ').slice(1).join(' ') ||
+                '',
+            ...quote.pickupAddress,
+        }
+        : quote.relayAddress
+            ? {
+                firstName: body.shippingAddress?.firstName || '',
+                lastName: body.shippingAddress?.lastName || '',
+                ...quote.relayAddress,
+                phone: body.shippingAddress?.phone,
+            }
+            : body.shippingAddress;
+    const orderBillingAddress = quote.relay && !body.billingAddress ? body.shippingAddress : body.billingAddress;
+    const orderLocale = isSupportedLocale(body.locale) ? body.locale : null;
+    const { orderId, isNew } = await createOrderFromCheckout({
+        locale: orderLocale,
+        sessionId: reference,
+        email,
+        items: quote.lines,
+        subtotal: quote.subtotalCents,
+        tax: quote.taxCents,
+        taxBreakdown: quote.taxBreakdown,
+        shipping: quote.shippingCents,
+        total: quote.totalCents,
+        currency: quote.currency,
+        discountCode: quote.discountCode ?? undefined,
+        discountAmount: quote.discountCents > 0 ? quote.discountCents : undefined,
+        shippingAddress: orderShippingAddress,
+        billingAddress: orderBillingAddress,
+        stripePaymentIntentId: reference,
+        customerId: trustedCustomer?.id,
+        shippingMethod: quote.shippingMethodName,
+        carrier: quote.carrier,
+        shippoRateId: quote.shippoRateId,
+        pickupLocationId: quote.pickupLocationId ?? undefined,
+        relay: quote.relay ?? undefined,
+        status: 'pending',
+        paymentProvider: provider,
+        paymentMethodLabel: input.providerLabel,
+    });
+    if (isNew && quote.appliedDiscounts.length > 0) {
+        for (const applied of quote.appliedDiscounts) {
+            try {
+                await recordDiscountRedemption({
+                    discountId: applied.id,
+                    orderId,
+                    customerId: trustedCustomer?.id ?? null,
+                    email,
+                    amountCents: applied.amountCents,
+                });
+            }
+            catch (err) {
+                console.error(`[${provider} Checkout] redemption record failed:`, err);
+            }
+        }
+    }
+    // Server-side purchase analytics — the (order_id) partial unique index
+    // dedupes; recorded at create (manual-path parity, see file header).
+    if (isNew) {
+        const visitorId = body.metadata?.rovela_visitor_id;
+        const sessionId = body.metadata?.rovela_session_id;
+        if (visitorId && sessionId) {
+            try {
+                await recordEvent({
+                    event: {
+                        event: 'purchase',
+                        visitor_id: visitorId,
+                        session_id: sessionId,
+                        order_id: orderId,
+                        value_cents: quote.totalCents,
+                        currency: quote.currency,
+                        path: '/checkout/success',
+                    },
+                    device: null,
+                    country: null,
+                });
+            }
+            catch (err) {
+                console.error(`[${provider} Checkout] purchase analytics failed:`, err);
+            }
+        }
+    }
+    return {
+        ok: true,
+        orderId,
+        isNew,
+        reference,
+        quote,
+        email,
+        orderLocale,
+        orderShippingAddress,
+        orderBillingAddress,
+        settings,
+    };
+}
+/**
+ * The absolute base URL for return/IPN links handed to a PSP. Prefers the
+ * deployed store's canonical env; falls back to the request origin (sandbox
+ * previews).
+ */
+export function resolveStoreBaseUrl(requestOrigin) {
+    const envUrl = process.env.NEXT_PUBLIC_APP_URL?.trim();
+    const base = envUrl || requestOrigin;
+    return base.replace(/\/$/, '');
+}
+//# sourceMappingURL=external-checkout.js.map

package/dist/checkout/server/external-checkout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-checkout.js","sourceRoot":"","sources":["../../../src/checkout/server/external-checkout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAwCzD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG,EAA8B,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,KAAK;IACT,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,iBAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;CACrF,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEhC,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;IAErC,sDAAsD;IACtD,MAAM,eAAe,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAEvD,MAAM,kBAAkB,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAA;IAC1D,IAAI,CAAC,kBAAkB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,YAAY,CAAC,IAAI,CACzB;gBACE,KAAK,EAAE,yDAAyD;gBAChE,IAAI,EAAE,yBAAkC;aACzC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;SACF,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GACT,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC1F,IAAI,CAAC,KAAK,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,GAAG,CAAC,2BAA2B,CAAC,CAAA;IACzC,CAAC;IAED,4EAA4E;IAC5E,IAAI,KAAY,CAAA;IAChB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,UAAU,CACtB;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,qBAAqB;YAClC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACvC,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,IAAI;YACvC,eAAe,EAAE,eAAe,EAAE,OAAO,IAAI,IAAI;YACjD,aAAa,EAAE,KAAK;SACrB,EACD,EAAE,QAAQ,EAAE,CACb,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;YAChC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;aAC5F,CAAA;QACH,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,OAAO,IAAI,UAAU,EAAE,EAAE,CAAA;IAE1D,4EAA4E;IAC5E,MAAM,oBAAoB,GAAY,KAAK,CAAC,aAAa;QACvD,CAAC,CAAC;YACE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACxF,QAAQ,EACN,IAAI,CAAC,eAAe,EAAE,QAAQ;gBAC9B,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpD,EAAE;YACJ,GAAG,KAAK,CAAC,aAAa;SACvB;QACH,CAAC,CAAC,KAAK,CAAC,YAAY;YAClB,CAAC,CAAC;gBACE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE;gBAChD,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,IAAI,EAAE;gBAC9C,GAAG,KAAK,CAAC,YAAY;gBACrB,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK;aACnC;YACH,CAAC,CAAE,IAAI,CAAC,eAA2B,CAAA;IAEvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAA;IAElF,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAEvE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACvD,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,SAAS;QACpB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,aAAa;QAC7B,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,aAAa;QAC7B,KAAK,EAAE,KAAK,CAAC,UAAU;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,SAAS;QAC7C,cAAc,EAAE,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACzE,eAAe,EAAE,oBAAoB;QACrC,cAAc,EAAE,mBAAmB;QACnC,qBAAqB,EAAE,SAAS;QAChC,UAAU,EAAE,eAAe,EAAE,EAAE;QAC/B,cAAc,EAAE,KAAK,CAAC,kBAAkB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;QACrD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;QAC/B,MAAM,EAAE,SAAS;QACjB,eAAe,EAAE,QAAQ;QACzB,kBAAkB,EAAE,KAAK,CAAC,aAAa;KACxC,CAAC,CAAA;IAEF,IAAI,KAAK,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,wBAAwB,CAAC;oBAC7B,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,OAAO;oBACP,UAAU,EAAE,eAAe,EAAE,EAAE,IAAI,IAAI;oBACvC,KAAK;oBACL,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACxE,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAA;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAA;QAClD,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC;oBAChB,KAAK,EAAE;wBACL,KAAK,EAAE,UAAU;wBACjB,UAAU,EAAE,SAAS;wBACrB,UAAU,EAAE,SAAS;wBACrB,QAAQ,EAAE,OAAO;wBACjB,WAAW,EAAE,KAAK,CAAC,UAAU;wBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,mBAAmB;qBAC1B;oBACD,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,uCAAuC,EAAE,GAAG,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,KAAK;QACL,SAAS;QACT,KAAK;QACL,KAAK;QACL,WAAW;QACX,oBAAoB;QACpB,mBAAmB;QACnB,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IACtD,MAAM,IAAI,GAAG,MAAM,IAAI,aAAa,CAAA;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC"}

package/dist/checkout/server/paypal.d.ts

@@ -0,0 +1,127 @@
+/**
+ * @rovela/sdk/checkout/server/paypal
+ *
+ * PayPal (Orders v2) — hand-rolled fetch client, no PayPal npm SDK (the
+ * Colissimo/GSC house pattern: 4 REST endpoints don't justify a
+ * dependency). Server-side ONLY — PayPal's own guidance: never call the
+ * Orders API from the browser.
+ *
+ * Flow: create order server-priced (invoice_id = our up-front reference,
+ * PayPal-Request-Id idempotency) → buyer approves (Smart Buttons popup, or
+ * the approve-link redirect fallback) → server capture → the shared
+ * confirm-order helper flips the pending order to paid. The webhook is the
+ * async BACKSTOP (buyer closed the tab between approval and capture),
+ * never the primary path.
+ *
+ * SECURITY INVARIANTS (do not weaken):
+ *  - client_secret never crosses a client boundary (server-only
+ *    store_settings column, stripped from the admin settings GET; the
+ *    public clientId is the only client-visible credential).
+ *  - Amounts always come from buildQuote via the DB order — the client
+ *    only ever passes the PayPal order id.
+ *  - Webhook events are only trusted after verify-webhook-signature.
+ */
+declare const PAYPAL_HOSTS: {
+    readonly production: "https://api-m.paypal.com";
+    readonly sandbox: "https://api-m.sandbox.paypal.com";
+};
+export type PaypalEnvironment = keyof typeof PAYPAL_HOSTS;
+/**
+ * Normalize a stored environment value. Accepts BOTH historical vocabularies
+ * ('live' from the retired integrations-registry entry, 'production' from the
+ * retired feature card) — never migrated by sweep, healed at read time.
+ */
+export declare function normalizePaypalEnvironment(value: string | null | undefined): PaypalEnvironment;
+export interface PaypalCredentials {
+    clientId: string;
+    clientSecret: string;
+    environment: PaypalEnvironment;
+    webhookId: string | null;
+}
+/**
+ * Resolve usable credentials from the store settings row, or null when the
+ * provider isn't fully configured + enabled. The ONE availability gate.
+ */
+export declare function resolvePaypalCredentials(settings: {
+    paypalClientId?: string | null;
+    paypalClientSecret?: string | null;
+    paypalEnvironment?: string | null;
+    paypalWebhookId?: string | null;
+    paypalEnabled?: boolean | null;
+} | null): PaypalCredentials | null;
+export declare class PaypalApiError extends Error {
+    status: number;
+    /** PayPal issue code when present (e.g. ORDER_ALREADY_CAPTURED). */
+    issue: string | null;
+    body: unknown;
+    constructor(message: string, status: number, body: unknown);
+}
+/**
+ * Credential probe used by the admin Payments panel's validate-before-persist
+ * (an OAuth token grant is the cheapest authenticated call). Returns an error
+ * message or null when the credentials are accepted.
+ */
+export declare function validatePaypalCredentials(creds: {
+    clientId: string;
+    clientSecret: string;
+    environment: PaypalEnvironment;
+}): Promise<string | null>;
+export interface CreatePaypalOrderInput {
+    credentials: PaypalCredentials;
+    /** Our order reference (paypal_{uuid}) — round-trips via invoice_id. */
+    reference: string;
+    totalCents: number;
+    /** Uppercase ISO currency. */
+    currency: string;
+    storeName: string;
+    returnUrl: string;
+    cancelUrl: string;
+    /** Checkout-collected shipping address; null for pickup (NO_SHIPPING). */
+    shippingAddress?: {
+        firstName?: string;
+        lastName?: string;
+        line1?: string;
+        line2?: string | null;
+        city?: string;
+        state?: string | null;
+        postalCode?: string | null;
+        country?: string;
+    } | null;
+    locale?: string | null;
+}
+export interface CreatePaypalOrderResult {
+    paypalOrderId: string;
+    approveUrl: string | null;
+}
+export declare function createPaypalOrder(input: CreatePaypalOrderInput): Promise<CreatePaypalOrderResult>;
+export interface PaypalCaptureResult {
+    /** 'COMPLETED' = money captured. Anything else = NOT paid (webhook may confirm later). */
+    status: string;
+    captureId: string | null;
+    /** Our order reference (invoice_id round trip). */
+    invoiceId: string | null;
+    amountCents: number | null;
+    currency: string | null;
+    payerEmail: string | null;
+}
+/**
+ * Capture an approved PayPal order. Idempotent: a repeat capture (retry, or
+ * the return-leg racing the buttons leg) resolves via ORDER_ALREADY_CAPTURED
+ * → the order details are fetched and returned as a success.
+ */
+export declare function capturePaypalOrder(credentials: PaypalCredentials, paypalOrderId: string): Promise<PaypalCaptureResult>;
+export interface PaypalWebhookHeaders {
+    transmissionId: string | null;
+    transmissionTime: string | null;
+    certUrl: string | null;
+    authAlgo: string | null;
+    transmissionSig: string | null;
+}
+export declare function readPaypalWebhookHeaders(headers: Headers): PaypalWebhookHeaders;
+/**
+ * Verify a webhook delivery via PayPal's verify-webhook-signature endpoint
+ * (requires the merchant's webhook_id — configured in the Payments panel).
+ */
+export declare function verifyPaypalWebhook(credentials: PaypalCredentials, webhookId: string, headers: PaypalWebhookHeaders, event: unknown): Promise<boolean>;
+export {};
+//# sourceMappingURL=paypal.d.ts.map

package/dist/checkout/server/paypal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal.d.ts","sourceRoot":"","sources":["../../../src/checkout/server/paypal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,QAAA,MAAM,YAAY;;;CAGR,CAAA;AAEV,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,YAAY,CAAA;AAEzD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAE9F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE;IACjD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;CAC/B,GAAG,IAAI,GAAG,iBAAiB,GAAG,IAAI,CAWlC;AAMD,qBAAa,cAAe,SAAQ,KAAK;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,OAAO,CAAA;gBAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;CAO3D;AAiED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,iBAAiB,CAAA;CAC/B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBzB;AA0BD,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,iBAAiB,CAAA;IAC9B,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,eAAe,CAAC,EAAE;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,IAAI,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAgElC;AAED,MAAM,WAAW,mBAAmB;IAClC,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,mDAAmD;IACnD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAgBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,iBAAiB,EAC9B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAqB9B;AAMD,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB,CAQ/E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,iBAAiB,EAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC,CA8BlB"}

package/dist/checkout/server/paypal.js

@@ -0,0 +1,274 @@
+/**
+ * @rovela/sdk/checkout/server/paypal
+ *
+ * PayPal (Orders v2) — hand-rolled fetch client, no PayPal npm SDK (the
+ * Colissimo/GSC house pattern: 4 REST endpoints don't justify a
+ * dependency). Server-side ONLY — PayPal's own guidance: never call the
+ * Orders API from the browser.
+ *
+ * Flow: create order server-priced (invoice_id = our up-front reference,
+ * PayPal-Request-Id idempotency) → buyer approves (Smart Buttons popup, or
+ * the approve-link redirect fallback) → server capture → the shared
+ * confirm-order helper flips the pending order to paid. The webhook is the
+ * async BACKSTOP (buyer closed the tab between approval and capture),
+ * never the primary path.
+ *
+ * SECURITY INVARIANTS (do not weaken):
+ *  - client_secret never crosses a client boundary (server-only
+ *    store_settings column, stripped from the admin settings GET; the
+ *    public clientId is the only client-visible credential).
+ *  - Amounts always come from buildQuote via the DB order — the client
+ *    only ever passes the PayPal order id.
+ *  - Webhook events are only trusted after verify-webhook-signature.
+ */
+// =============================================================================
+// Environments + credentials
+// =============================================================================
+const PAYPAL_HOSTS = {
+    production: 'https://api-m.paypal.com',
+    sandbox: 'https://api-m.sandbox.paypal.com',
+};
+/**
+ * Normalize a stored environment value. Accepts BOTH historical vocabularies
+ * ('live' from the retired integrations-registry entry, 'production' from the
+ * retired feature card) — never migrated by sweep, healed at read time.
+ */
+export function normalizePaypalEnvironment(value) {
+    return value === 'live' || value === 'production' ? 'production' : 'sandbox';
+}
+/**
+ * Resolve usable credentials from the store settings row, or null when the
+ * provider isn't fully configured + enabled. The ONE availability gate.
+ */
+export function resolvePaypalCredentials(settings) {
+    if (!settings?.paypalEnabled)
+        return null;
+    const clientId = settings.paypalClientId?.trim();
+    const clientSecret = settings.paypalClientSecret?.trim();
+    if (!clientId || !clientSecret)
+        return null;
+    return {
+        clientId,
+        clientSecret,
+        environment: normalizePaypalEnvironment(settings.paypalEnvironment),
+        webhookId: settings.paypalWebhookId?.trim() || null,
+    };
+}
+// =============================================================================
+// API plumbing
+// =============================================================================
+export class PaypalApiError extends Error {
+    status;
+    /** PayPal issue code when present (e.g. ORDER_ALREADY_CAPTURED). */
+    issue;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.name = 'PaypalApiError';
+        this.status = status;
+        this.body = body;
+        this.issue = extractIssue(body);
+    }
+}
+function extractIssue(body) {
+    if (!body || typeof body !== 'object')
+        return null;
+    const b = body;
+    return b.details?.[0]?.issue ?? b.name ?? null;
+}
+/**
+ * OAuth token cache — per (environment, clientId), refreshed 60s early.
+ * Module-level: serverless instances reuse it across warm invocations.
+ */
+const tokenCache = new Map();
+async function getAccessToken(creds) {
+    const cacheKey = `${creds.environment}:${creds.clientId}`;
+    const cached = tokenCache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now())
+        return cached.token;
+    const res = await fetch(`${PAYPAL_HOSTS[creds.environment]}/v1/oauth2/token`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Basic ${Buffer.from(`${creds.clientId}:${creds.clientSecret}`).toString('base64')}`,
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: 'grant_type=client_credentials',
+    });
+    const data = (await res.json().catch(() => null));
+    if (!res.ok || !data?.access_token) {
+        throw new PaypalApiError('PayPal authentication failed', res.status, data);
+    }
+    tokenCache.set(cacheKey, {
+        token: data.access_token,
+        expiresAt: Date.now() + Math.max(0, (data.expires_in ?? 0) - 60) * 1000,
+    });
+    return data.access_token;
+}
+async function paypalRequest(creds, method, path, body, headers) {
+    const token = await getAccessToken(creds);
+    const res = await fetch(`${PAYPAL_HOSTS[creds.environment]}${path}`, {
+        method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+            ...headers,
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const data = (await res.json().catch(() => null));
+    if (!res.ok) {
+        throw new PaypalApiError(`PayPal ${method} ${path} failed (${res.status})`, res.status, data);
+    }
+    return data;
+}
+/**
+ * Credential probe used by the admin Payments panel's validate-before-persist
+ * (an OAuth token grant is the cheapest authenticated call). Returns an error
+ * message or null when the credentials are accepted.
+ */
+export async function validatePaypalCredentials(creds) {
+    try {
+        const res = await fetch(`${PAYPAL_HOSTS[creds.environment]}/v1/oauth2/token`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Basic ${Buffer.from(`${creds.clientId}:${creds.clientSecret}`).toString('base64')}`,
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: 'grant_type=client_credentials',
+        });
+        if (res.ok)
+            return null;
+        if (res.status === 401 || res.status === 400) {
+            return 'PayPal rejected these credentials. Check the Client ID, secret and environment.';
+        }
+        return `PayPal returned an unexpected error (${res.status}). Try again shortly.`;
+    }
+    catch {
+        return 'Could not reach PayPal to verify the credentials. Try again shortly.';
+    }
+}
+export async function createPaypalOrder(input) {
+    const value = (input.totalCents / 100).toFixed(2);
+    const address = input.shippingAddress;
+    const hasAddress = !!(address?.line1 && address?.city && address?.country);
+    const data = await paypalRequest(input.credentials, 'POST', '/v2/checkout/orders', {
+        intent: 'CAPTURE',
+        purchase_units: [
+            {
+                reference_id: 'default',
+                invoice_id: input.reference,
+                custom_id: input.reference,
+                amount: { currency_code: input.currency.toUpperCase(), value },
+                ...(hasAddress
+                    ? {
+                        shipping: {
+                            name: {
+                                full_name: `${address.firstName ?? ''} ${address.lastName ?? ''}`.trim() || undefined,
+                            },
+                            address: {
+                                address_line_1: address.line1,
+                                ...(address.line2 ? { address_line_2: address.line2 } : {}),
+                                admin_area_2: address.city,
+                                ...(address.state ? { admin_area_1: address.state } : {}),
+                                ...(address.postalCode ? { postal_code: address.postalCode } : {}),
+                                country_code: address.country.toUpperCase(),
+                            },
+                        },
+                    }
+                    : {}),
+            },
+        ],
+        payment_source: {
+            paypal: {
+                experience_context: {
+                    brand_name: input.storeName.slice(0, 127),
+                    user_action: 'PAY_NOW',
+                    // No eChecks/pending funding — a capture must settle or fail.
+                    payment_method_preference: 'IMMEDIATE_PAYMENT_REQUIRED',
+                    // The buyer cannot swap the address at PayPal — ours is the one
+                    // the quote taxed and priced shipping for.
+                    shipping_preference: hasAddress ? 'SET_PROVIDED_ADDRESS' : 'NO_SHIPPING',
+                    return_url: input.returnUrl,
+                    cancel_url: input.cancelUrl,
+                    ...(input.locale === 'fr' ? { locale: 'fr-FR' } : {}),
+                },
+            },
+        },
+    }, { 'PayPal-Request-Id': input.reference, Prefer: 'return=representation' });
+    if (!data.id) {
+        throw new PaypalApiError('PayPal order creation returned no id', 502, data);
+    }
+    const approve = data.links?.find((l) => l.rel === 'payer-action') ??
+        data.links?.find((l) => l.rel === 'approve');
+    return { paypalOrderId: data.id, approveUrl: approve?.href ?? null };
+}
+function extractCapture(data) {
+    const unit = data.purchase_units?.[0];
+    const capture = unit?.payments?.captures?.[0];
+    const amountValue = capture?.amount?.value;
+    return {
+        status: capture?.status ?? data.status ?? 'UNKNOWN',
+        captureId: capture?.id ?? null,
+        invoiceId: capture?.invoice_id ?? capture?.custom_id ?? unit?.invoice_id ?? unit?.custom_id ?? null,
+        amountCents: amountValue != null ? Math.round(parseFloat(amountValue) * 100) : null,
+        currency: capture?.amount?.currency_code ?? null,
+        payerEmail: data.payer?.email_address ?? null,
+    };
+}
+/**
+ * Capture an approved PayPal order. Idempotent: a repeat capture (retry, or
+ * the return-leg racing the buttons leg) resolves via ORDER_ALREADY_CAPTURED
+ * → the order details are fetched and returned as a success.
+ */
+export async function capturePaypalOrder(credentials, paypalOrderId) {
+    try {
+        const data = await paypalRequest(credentials, 'POST', `/v2/checkout/orders/${encodeURIComponent(paypalOrderId)}/capture`, {}, { 'PayPal-Request-Id': `cap-${paypalOrderId}`, Prefer: 'return=representation' });
+        return extractCapture(data);
+    }
+    catch (err) {
+        if (err instanceof PaypalApiError && err.issue === 'ORDER_ALREADY_CAPTURED') {
+            const data = await paypalRequest(credentials, 'GET', `/v2/checkout/orders/${encodeURIComponent(paypalOrderId)}`);
+            return extractCapture(data);
+        }
+        throw err;
+    }
+}
+export function readPaypalWebhookHeaders(headers) {
+    return {
+        transmissionId: headers.get('paypal-transmission-id'),
+        transmissionTime: headers.get('paypal-transmission-time'),
+        certUrl: headers.get('paypal-cert-url'),
+        authAlgo: headers.get('paypal-auth-algo'),
+        transmissionSig: headers.get('paypal-transmission-sig'),
+    };
+}
+/**
+ * Verify a webhook delivery via PayPal's verify-webhook-signature endpoint
+ * (requires the merchant's webhook_id — configured in the Payments panel).
+ */
+export async function verifyPaypalWebhook(credentials, webhookId, headers, event) {
+    if (!headers.transmissionId ||
+        !headers.transmissionTime ||
+        !headers.certUrl ||
+        !headers.authAlgo ||
+        !headers.transmissionSig) {
+        return false;
+    }
+    try {
+        const data = await paypalRequest(credentials, 'POST', '/v1/notifications/verify-webhook-signature', {
+            transmission_id: headers.transmissionId,
+            transmission_time: headers.transmissionTime,
+            cert_url: headers.certUrl,
+            auth_algo: headers.authAlgo,
+            transmission_sig: headers.transmissionSig,
+            webhook_id: webhookId,
+            webhook_event: event,
+        });
+        return data.verification_status === 'SUCCESS';
+    }
+    catch (err) {
+        console.error('[PayPal] webhook verification call failed:', err);
+        return false;
+    }
+}
+//# sourceMappingURL=paypal.js.map

package/dist/checkout/server/paypal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypal.js","sourceRoot":"","sources":["../../../src/checkout/server/paypal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,MAAM,YAAY,GAAG;IACnB,UAAU,EAAE,0BAA0B;IACtC,OAAO,EAAE,kCAAkC;CACnC,CAAA;AAIV;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAgC;IACzE,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9E,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAMjC;IACN,IAAI,CAAC,QAAQ,EAAE,aAAa;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAC3C,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnE,SAAS,EAAE,QAAQ,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI;KACpD,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,MAAM,CAAQ;IACd,oEAAoE;IACpE,KAAK,CAAe;IACpB,IAAI,CAAS;IAEb,YAAY,OAAe,EAAE,MAAc,EAAE,IAAa;QACxD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;CACF;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,CAAC,GAAG,IAA8D,CAAA;IACxE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAA;AAE1E,KAAK,UAAU,cAAc,CAAC,KAAwB;IACpD,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACvC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IAEhE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,kBAAkB,EAAE;QAC5E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACnG,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,+BAA+B;KACtC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAGxC,CAAA;IACR,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CAAC,8BAA8B,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5E,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;QACvB,KAAK,EAAE,IAAI,CAAC,YAAY;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI;KACxE,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAwB,EACxB,MAAsB,EACtB,IAAY,EACZ,IAAc,EACd,OAAgC;IAEhC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,EAAE;QACnE,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO;SACX;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC5D,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAA;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,cAAc,CAAC,UAAU,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,IAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,kBAAkB,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACnG,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,+BAA+B;SACtC,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,iFAAiF,CAAA;QAC1F,CAAC;QACD,OAAO,wCAAwC,GAAG,CAAC,MAAM,uBAAuB,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sEAAsE,CAAA;IAC/E,CAAC;AACH,CAAC;AAuDD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAA;IACrC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,OAAO,CAAC,CAAA;IAE1E,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,KAAK,CAAC,WAAW,EACjB,MAAM,EACN,qBAAqB,EACrB;QACE,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE;YACd;gBACE,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE;gBAC9D,GAAG,CAAC,UAAU;oBACZ,CAAC,CAAC;wBACE,QAAQ,EAAE;4BACR,IAAI,EAAE;gCACJ,SAAS,EACP,GAAG,OAAQ,CAAC,SAAS,IAAI,EAAE,IAAI,OAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,SAAS;6BAC/E;4BACD,OAAO,EAAE;gCACP,cAAc,EAAE,OAAQ,CAAC,KAAK;gCAC9B,GAAG,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC7D,YAAY,EAAE,OAAQ,CAAC,IAAI;gCAC3B,GAAG,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC3D,GAAG,CAAC,OAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gCACpE,YAAY,EAAE,OAAQ,CAAC,OAAQ,CAAC,WAAW,EAAE;6BAC9C;yBACF;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACD,cAAc,EAAE;YACd,MAAM,EAAE;gBACN,kBAAkB,EAAE;oBAClB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACzC,WAAW,EAAE,SAAS;oBACtB,8DAA8D;oBAC9D,yBAAyB,EAAE,4BAA4B;oBACvD,gEAAgE;oBAChE,2CAA2C;oBAC3C,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa;oBACxE,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD;aACF;SACF;KACF,EACD,EAAE,mBAAmB,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAC1E,CAAA;IAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAA;IAC9C,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;AACtE,CAAC;AAaD,SAAS,cAAc,CAAC,IAAyB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,CAAA;IAC1C,OAAO;QACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QACnD,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI;QAC9B,SAAS,EAAE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,SAAS,IAAI,IAAI;QACnG,WAAW,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QACnF,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;QAChD,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,IAAI;KAC9C,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAA8B,EAC9B,aAAqB;IAErB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,WAAW,EACX,MAAM,EACN,uBAAuB,kBAAkB,CAAC,aAAa,CAAC,UAAU,EAClE,EAAE,EACF,EAAE,mBAAmB,EAAE,OAAO,aAAa,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CACjF,CAAA;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,KAAK,KAAK,wBAAwB,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,WAAW,EACX,KAAK,EACL,uBAAuB,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAC3D,CAAA;YACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAcD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrD,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACzC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;KACxD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAA8B,EAC9B,SAAiB,EACjB,OAA6B,EAC7B,KAAc;IAEd,IACE,CAAC,OAAO,CAAC,cAAc;QACvB,CAAC,OAAO,CAAC,gBAAgB;QACzB,CAAC,OAAO,CAAC,OAAO;QAChB,CAAC,OAAO,CAAC,QAAQ;QACjB,CAAC,OAAO,CAAC,eAAe,EACxB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,WAAW,EACX,MAAM,EACN,4CAA4C,EAC5C;YACE,eAAe,EAAE,OAAO,CAAC,cAAc;YACvC,iBAAiB,EAAE,OAAO,CAAC,gBAAgB;YAC3C,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,OAAO,CAAC,eAAe;YACzC,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,KAAK;SACrB,CACF,CAAA;QACD,OAAO,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAA;QAChE,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}