@sazito/checkout 0.4.19 → 0.4.20

package/dist/next/payment-return.cjs

@@ -1,5 +1,29 @@
 'use strict';
 
+const SAZITO_PAYMENT_STATUS_QUERY = {
+    resolution: 'sazito_payment_return',
+    paymentId: 'sazito_payment_id',
+    paymentIdentifier: 'sazito_payment_identifier'
+};
+/** Remove server-return credentials from the visible URL after they are read. */
+function stripPaymentStatusReturn(url) {
+    let parsedUrl;
+    try {
+        parsedUrl = typeof url === 'string'
+            ? new URL(url, 'https://checkout.sazito.invalid')
+            : new URL(url.toString());
+    }
+    catch {
+        return undefined;
+    }
+    if (parsedUrl.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {
+        return undefined;
+    }
+    parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.resolution);
+    parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentId);
+    parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier);
+    return `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;
+}
 const SAZITO_PAYMENT_RESULT_MARKERS = [
     'mellatpaymentresult', 'pecpaymentresult', 'uppaymentresult',
     'seppaymentresult', 'vandarpaymentresult', 'yourgatepaymentresult',
@@ -57,6 +81,9 @@ function parsePaymentReturnUrl(url, options = {}) {
     catch {
         return undefined;
     }
+    const statusReturn = parsePaymentStatusReturn(parsedUrl);
+    if (statusReturn)
+        return statusReturn;
     const segments = parsedUrl.pathname
         .split('/')
         .filter(Boolean)
@@ -73,6 +100,27 @@ function parsePaymentReturnUrl(url, options = {}) {
     }
     return parsePaymentReturn(segments.slice(-5), searchParams, options);
 }
+function parsePaymentStatusReturn(url) {
+    if (url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {
+        return undefined;
+    }
+    const rawPaymentId = url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.paymentId);
+    const identifier = url.searchParams
+        .get(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier)
+        ?.trim();
+    const paymentId = Number(rawPaymentId);
+    if (!Number.isSafeInteger(paymentId) || paymentId <= 0 || !identifier) {
+        return undefined;
+    }
+    return {
+        payment: { id: paymentId, identifier },
+        params: {
+            id: String(paymentId),
+            paymentIdentifier: identifier
+        },
+        resolution: 'status'
+    };
+}
 function decodePathSegment(segment) {
     try {
         return decodeURIComponent(segment);
@@ -93,6 +141,8 @@ function normalizeSearchParams(searchParams) {
 }
 
 exports.SAZITO_PAYMENT_RESULT_MARKERS = SAZITO_PAYMENT_RESULT_MARKERS;
+exports.SAZITO_PAYMENT_STATUS_QUERY = SAZITO_PAYMENT_STATUS_QUERY;
 exports.parsePaymentReturn = parsePaymentReturn;
 exports.parsePaymentReturnUrl = parsePaymentReturnUrl;
+exports.stripPaymentStatusReturn = stripPaymentStatusReturn;
 //# sourceMappingURL=payment-return.cjs.map

package/dist/next/payment-return.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"payment-return.cjs","sources":["../../src/core/payment-return.ts"],"sourcesContent":["import type {\n  CheckoutPaymentReturn,\n  PaymentReturnParserOptions,\n  PaymentReturnSearchParams\n} from './types';\n\nexport const SAZITO_PAYMENT_RESULT_MARKERS = [\n  'mellatpaymentresult', 'pecpaymentresult', 'uppaymentresult',\n  'seppaymentresult', 'vandarpaymentresult', 'yourgatepaymentresult',\n  'bazarpaymentresult', 'zifypaymentresult', 'zibalpaymentresult',\n  'snapppaypaymentresult', 'torobpaypaymentresult', 'ghestapaypaymentresult',\n  'azkipaymentresult', 'digipaypaymentresult', 'greenpaypaymentresult',\n  'novapaypaymentresult', 'zarinpluspaymentresult', 'tomanpaymentresult',\n  'tarapaymentresult', 'ozonpaymentresult', 'millipaypaymentresult',\n  'ayriapaymentresult', 'sadadpaymentresult', 'freepaymentresult',\n  'paymentinplaceresult', 'cardtocardpaymentresult', 'zarinpalpaymentresult',\n  'directpayresult', 'paypingpaymentresult', 'podpaymentresult',\n  'sabinpaymentresult', 'firoozepaymentresult', 'technopaypaymentresult',\n  'buywithdigikalaresult'\n] as const;\n\n/**\n * Parse Sazito's nested payment callback path into checkout-ready data.\n * Returns undefined for ordinary checkout URLs and malformed callbacks.\n */\nexport function parsePaymentReturn(\n  segments: readonly string[] | undefined,\n  searchParams: PaymentReturnSearchParams = {},\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  const [resultRoute, paymentSegment, rawPaymentId, identifierSegment, rawIdentifier] =\n    segments ?? [];\n  const paymentId = Number(rawPaymentId);\n  const identifier = rawIdentifier?.trim();\n  const allowedMarkers = new Set(\n    (options.gatewayResultMarkers ?? SAZITO_PAYMENT_RESULT_MARKERS)\n      .map((marker) => marker.toLowerCase())\n  );\n\n  if (\n    segments?.length !== 5 ||\n    !resultRoute ||\n    !allowedMarkers.has(resultRoute.toLowerCase()) ||\n    paymentSegment?.toLowerCase() !== 'payment' ||\n    identifierSegment?.toLowerCase() !== 'identifier' ||\n    !Number.isSafeInteger(paymentId) ||\n    paymentId <= 0 ||\n    !identifier\n  ) {\n    return undefined;\n  }\n\n  const params = normalizeSearchParams(searchParams);\n  params.id = String(paymentId);\n  params.paymentIdentifier = identifier;\n\n  return {\n    payment: { id: paymentId, identifier },\n    params\n  };\n}\n\n/**\n * Parse a complete checkout URL containing Sazito's nested payment callback.\n * The callback may be mounted below any checkout base path; only its final\n * five path segments are significant.\n */\nexport function parsePaymentReturnUrl(\n  url: string | URL,\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  let parsedUrl: URL;\n\n  try {\n    parsedUrl = typeof url === 'string'\n      ? new URL(url, 'https://checkout.sazito.invalid')\n      : url;\n  } catch {\n    return undefined;\n  }\n\n  const segments = parsedUrl.pathname\n    .split('/')\n    .filter(Boolean)\n    .map(decodePathSegment);\n\n  if (segments.length < 5) {\n    return undefined;\n  }\n\n  const searchParams: Record<string, string> = {};\n  for (const [key, value] of parsedUrl.searchParams) {\n    // Match Next.js search-param normalization: preserve the first value.\n    if (searchParams[key] === undefined) {\n      searchParams[key] = value;\n    }\n  }\n\n  return parsePaymentReturn(segments.slice(-5), searchParams, options);\n}\n\nfunction decodePathSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\nfunction normalizeSearchParams(\n  searchParams: PaymentReturnSearchParams\n): Record<string, string> {\n  const normalized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(searchParams)) {\n    const firstValue = Array.isArray(value) ? value[0] : value;\n    if (firstValue !== undefined) {\n      normalized[key] = firstValue;\n    }\n  }\n\n  return normalized;\n}\n"],"names":[],"mappings":";;AAMO,MAAM,6BAA6B,GAAG;IAC3C,qBAAqB,EAAE,kBAAkB,EAAE,iBAAiB;IAC5D,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB;IAClE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB;IAC/D,uBAAuB,EAAE,uBAAuB,EAAE,wBAAwB;IAC1E,mBAAmB,EAAE,sBAAsB,EAAE,uBAAuB;IACpE,sBAAsB,EAAE,wBAAwB,EAAE,oBAAoB;IACtE,mBAAmB,EAAE,mBAAmB,EAAE,uBAAuB;IACjE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB;IAC/D,sBAAsB,EAAE,yBAAyB,EAAE,uBAAuB;IAC1E,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB;IAC7D,oBAAoB,EAAE,sBAAsB,EAAE,wBAAwB;IACtE;;AAGF;;;AAGG;AACG,SAAU,kBAAkB,CAChC,QAAuC,EACvC,YAAA,GAA0C,EAAE,EAC5C,OAAA,GAAsC,EAAE,EAAA;AAExC,IAAA,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,CAAC,GACjF,QAAQ,IAAI,EAAE;AAChB,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;AACtC,IAAA,MAAM,UAAU,GAAG,aAAa,EAAE,IAAI,EAAE;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,OAAO,CAAC,oBAAoB,IAAI,6BAA6B;AAC3D,SAAA,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CACzC;AAED,IAAA,IACE,QAAQ,EAAE,MAAM,KAAK,CAAC;AACtB,QAAA,CAAC,WAAW;QACZ,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;AAC9C,QAAA,cAAc,EAAE,WAAW,EAAE,KAAK,SAAS;AAC3C,QAAA,iBAAiB,EAAE,WAAW,EAAE,KAAK,YAAY;AACjD,QAAA,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;AAChC,QAAA,SAAS,IAAI,CAAC;QACd,CAAC,UAAU,EACX;AACA,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC;AAClD,IAAA,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;AAC7B,IAAA,MAAM,CAAC,iBAAiB,GAAG,UAAU;IAErC,OAAO;AACL,QAAA,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QACtC;KACD;AACH;AAEA;;;;AAIG;SACa,qBAAqB,CACnC,GAAiB,EACjB,UAAsC,EAAE,EAAA;AAExC,IAAA,IAAI,SAAc;AAElB,IAAA,IAAI;AACF,QAAA,SAAS,GAAG,OAAO,GAAG,KAAK;AACzB,cAAE,IAAI,GAAG,CAAC,GAAG,EAAE,iCAAiC;cAC9C,GAAG;IACT;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;SACxB,KAAK,CAAC,GAAG;SACT,MAAM,CAAC,OAAO;SACd,GAAG,CAAC,iBAAiB,CAAC;AAEzB,IAAA,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AACvB,QAAA,OAAO,SAAS;IAClB;IAEA,MAAM,YAAY,GAA2B,EAAE;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,YAAY,EAAE;;AAEjD,QAAA,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE;AACnC,YAAA,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK;QAC3B;IACF;AAEA,IAAA,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC;AACtE;AAEA,SAAS,iBAAiB,CAAC,OAAe,EAAA;AACxC,IAAA,IAAI;AACF,QAAA,OAAO,kBAAkB,CAAC,OAAO,CAAC;IACpC;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,OAAO;IAChB;AACF;AAEA,SAAS,qBAAqB,CAC5B,YAAuC,EAAA;IAEvC,MAAM,UAAU,GAA2B,EAAE;AAE7C,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;AACvD,QAAA,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK;AAC1D,QAAA,IAAI,UAAU,KAAK,SAAS,EAAE;AAC5B,YAAA,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU;QAC9B;IACF;AAEA,IAAA,OAAO,UAAU;AACnB;;;;;;"}
+{"version":3,"file":"payment-return.cjs","sources":["../../src/core/payment-return.ts"],"sourcesContent":["import type {\n  CheckoutPaymentReturn,\n  PaymentReturnParserOptions,\n  PaymentReturnSearchParams\n} from './types';\n\nexport const SAZITO_PAYMENT_STATUS_QUERY = {\n  resolution: 'sazito_payment_return',\n  paymentId: 'sazito_payment_id',\n  paymentIdentifier: 'sazito_payment_identifier'\n} as const;\n\n/** Remove server-return credentials from the visible URL after they are read. */\nexport function stripPaymentStatusReturn(url: string | URL): string | undefined {\n  let parsedUrl: URL;\n  try {\n    parsedUrl = typeof url === 'string'\n      ? new URL(url, 'https://checkout.sazito.invalid')\n      : new URL(url.toString());\n  } catch {\n    return undefined;\n  }\n\n  if (parsedUrl.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {\n    return undefined;\n  }\n\n  parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.resolution);\n  parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentId);\n  parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier);\n  return `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;\n}\n\nexport const SAZITO_PAYMENT_RESULT_MARKERS = [\n  'mellatpaymentresult', 'pecpaymentresult', 'uppaymentresult',\n  'seppaymentresult', 'vandarpaymentresult', 'yourgatepaymentresult',\n  'bazarpaymentresult', 'zifypaymentresult', 'zibalpaymentresult',\n  'snapppaypaymentresult', 'torobpaypaymentresult', 'ghestapaypaymentresult',\n  'azkipaymentresult', 'digipaypaymentresult', 'greenpaypaymentresult',\n  'novapaypaymentresult', 'zarinpluspaymentresult', 'tomanpaymentresult',\n  'tarapaymentresult', 'ozonpaymentresult', 'millipaypaymentresult',\n  'ayriapaymentresult', 'sadadpaymentresult', 'freepaymentresult',\n  'paymentinplaceresult', 'cardtocardpaymentresult', 'zarinpalpaymentresult',\n  'directpayresult', 'paypingpaymentresult', 'podpaymentresult',\n  'sabinpaymentresult', 'firoozepaymentresult', 'technopaypaymentresult',\n  'buywithdigikalaresult'\n] as const;\n\n/**\n * Parse Sazito's nested payment callback path into checkout-ready data.\n * Returns undefined for ordinary checkout URLs and malformed callbacks.\n */\nexport function parsePaymentReturn(\n  segments: readonly string[] | undefined,\n  searchParams: PaymentReturnSearchParams = {},\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  const [resultRoute, paymentSegment, rawPaymentId, identifierSegment, rawIdentifier] =\n    segments ?? [];\n  const paymentId = Number(rawPaymentId);\n  const identifier = rawIdentifier?.trim();\n  const allowedMarkers = new Set(\n    (options.gatewayResultMarkers ?? SAZITO_PAYMENT_RESULT_MARKERS)\n      .map((marker) => marker.toLowerCase())\n  );\n\n  if (\n    segments?.length !== 5 ||\n    !resultRoute ||\n    !allowedMarkers.has(resultRoute.toLowerCase()) ||\n    paymentSegment?.toLowerCase() !== 'payment' ||\n    identifierSegment?.toLowerCase() !== 'identifier' ||\n    !Number.isSafeInteger(paymentId) ||\n    paymentId <= 0 ||\n    !identifier\n  ) {\n    return undefined;\n  }\n\n  const params = normalizeSearchParams(searchParams);\n  params.id = String(paymentId);\n  params.paymentIdentifier = identifier;\n\n  return {\n    payment: { id: paymentId, identifier },\n    params\n  };\n}\n\n/**\n * Parse a complete checkout URL containing Sazito's nested payment callback.\n * The callback may be mounted below any checkout base path; only its final\n * five path segments are significant.\n */\nexport function parsePaymentReturnUrl(\n  url: string | URL,\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  let parsedUrl: URL;\n\n  try {\n    parsedUrl = typeof url === 'string'\n      ? new URL(url, 'https://checkout.sazito.invalid')\n      : url;\n  } catch {\n    return undefined;\n  }\n\n  const statusReturn = parsePaymentStatusReturn(parsedUrl);\n  if (statusReturn) return statusReturn;\n\n  const segments = parsedUrl.pathname\n    .split('/')\n    .filter(Boolean)\n    .map(decodePathSegment);\n\n  if (segments.length < 5) {\n    return undefined;\n  }\n\n  const searchParams: Record<string, string> = {};\n  for (const [key, value] of parsedUrl.searchParams) {\n    // Match Next.js search-param normalization: preserve the first value.\n    if (searchParams[key] === undefined) {\n      searchParams[key] = value;\n    }\n  }\n\n  return parsePaymentReturn(segments.slice(-5), searchParams, options);\n}\n\nfunction parsePaymentStatusReturn(url: URL): CheckoutPaymentReturn | undefined {\n  if (url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {\n    return undefined;\n  }\n\n  const rawPaymentId = url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.paymentId);\n  const identifier = url.searchParams\n    .get(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier)\n    ?.trim();\n  const paymentId = Number(rawPaymentId);\n\n  if (!Number.isSafeInteger(paymentId) || paymentId <= 0 || !identifier) {\n    return undefined;\n  }\n\n  return {\n    payment: { id: paymentId, identifier },\n    params: {\n      id: String(paymentId),\n      paymentIdentifier: identifier\n    },\n    resolution: 'status'\n  };\n}\n\nfunction decodePathSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\nfunction normalizeSearchParams(\n  searchParams: PaymentReturnSearchParams\n): Record<string, string> {\n  const normalized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(searchParams)) {\n    const firstValue = Array.isArray(value) ? value[0] : value;\n    if (firstValue !== undefined) {\n      normalized[key] = firstValue;\n    }\n  }\n\n  return normalized;\n}\n"],"names":[],"mappings":";;AAMO,MAAM,2BAA2B,GAAG;AACzC,IAAA,UAAU,EAAE,uBAAuB;AACnC,IAAA,SAAS,EAAE,mBAAmB;AAC9B,IAAA,iBAAiB,EAAE;;AAGrB;AACM,SAAU,wBAAwB,CAAC,GAAiB,EAAA;AACxD,IAAA,IAAI,SAAc;AAClB,IAAA,IAAI;AACF,QAAA,SAAS,GAAG,OAAO,GAAG,KAAK;AACzB,cAAE,IAAI,GAAG,CAAC,GAAG,EAAE,iCAAiC;cAC9C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,IAAI,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE;AACnF,QAAA,OAAO,SAAS;IAClB;IAEA,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,2BAA2B,CAAC,UAAU,CAAC;IACrE,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC;IACpE,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,2BAA2B,CAAC,iBAAiB,CAAC;AAC5E,IAAA,OAAO,CAAA,EAAG,SAAS,CAAC,QAAQ,CAAA,EAAG,SAAS,CAAC,MAAM,CAAA,EAAG,SAAS,CAAC,IAAI,EAAE;AACpE;AAEO,MAAM,6BAA6B,GAAG;IAC3C,qBAAqB,EAAE,kBAAkB,EAAE,iBAAiB;IAC5D,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB;IAClE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB;IAC/D,uBAAuB,EAAE,uBAAuB,EAAE,wBAAwB;IAC1E,mBAAmB,EAAE,sBAAsB,EAAE,uBAAuB;IACpE,sBAAsB,EAAE,wBAAwB,EAAE,oBAAoB;IACtE,mBAAmB,EAAE,mBAAmB,EAAE,uBAAuB;IACjE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB;IAC/D,sBAAsB,EAAE,yBAAyB,EAAE,uBAAuB;IAC1E,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB;IAC7D,oBAAoB,EAAE,sBAAsB,EAAE,wBAAwB;IACtE;;AAGF;;;AAGG;AACG,SAAU,kBAAkB,CAChC,QAAuC,EACvC,YAAA,GAA0C,EAAE,EAC5C,OAAA,GAAsC,EAAE,EAAA;AAExC,IAAA,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,CAAC,GACjF,QAAQ,IAAI,EAAE;AAChB,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;AACtC,IAAA,MAAM,UAAU,GAAG,aAAa,EAAE,IAAI,EAAE;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,OAAO,CAAC,oBAAoB,IAAI,6BAA6B;AAC3D,SAAA,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CACzC;AAED,IAAA,IACE,QAAQ,EAAE,MAAM,KAAK,CAAC;AACtB,QAAA,CAAC,WAAW;QACZ,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;AAC9C,QAAA,cAAc,EAAE,WAAW,EAAE,KAAK,SAAS;AAC3C,QAAA,iBAAiB,EAAE,WAAW,EAAE,KAAK,YAAY;AACjD,QAAA,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;AAChC,QAAA,SAAS,IAAI,CAAC;QACd,CAAC,UAAU,EACX;AACA,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC;AAClD,IAAA,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;AAC7B,IAAA,MAAM,CAAC,iBAAiB,GAAG,UAAU;IAErC,OAAO;AACL,QAAA,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QACtC;KACD;AACH;AAEA;;;;AAIG;SACa,qBAAqB,CACnC,GAAiB,EACjB,UAAsC,EAAE,EAAA;AAExC,IAAA,IAAI,SAAc;AAElB,IAAA,IAAI;AACF,QAAA,SAAS,GAAG,OAAO,GAAG,KAAK;AACzB,cAAE,IAAI,GAAG,CAAC,GAAG,EAAE,iCAAiC;cAC9C,GAAG;IACT;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,CAAC;AACxD,IAAA,IAAI,YAAY;AAAE,QAAA,OAAO,YAAY;AAErC,IAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;SACxB,KAAK,CAAC,GAAG;SACT,MAAM,CAAC,OAAO;SACd,GAAG,CAAC,iBAAiB,CAAC;AAEzB,IAAA,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AACvB,QAAA,OAAO,SAAS;IAClB;IAEA,MAAM,YAAY,GAA2B,EAAE;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,YAAY,EAAE;;AAEjD,QAAA,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE;AACnC,YAAA,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK;QAC3B;IACF;AAEA,IAAA,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC;AACtE;AAEA,SAAS,wBAAwB,CAAC,GAAQ,EAAA;AACxC,IAAA,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE;AAC7E,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,SAAS,CAAC;AAChF,IAAA,MAAM,UAAU,GAAG,GAAG,CAAC;AACpB,SAAA,GAAG,CAAC,2BAA2B,CAAC,iBAAiB;UAChD,IAAI,EAAE;AACV,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;AAEtC,IAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AACrE,QAAA,OAAO,SAAS;IAClB;IAEA,OAAO;AACL,QAAA,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;AACtC,QAAA,MAAM,EAAE;AACN,YAAA,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC;AACrB,YAAA,iBAAiB,EAAE;AACpB,SAAA;AACD,QAAA,UAAU,EAAE;KACb;AACH;AAEA,SAAS,iBAAiB,CAAC,OAAe,EAAA;AACxC,IAAA,IAAI;AACF,QAAA,OAAO,kBAAkB,CAAC,OAAO,CAAC;IACpC;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,OAAO;IAChB;AACF;AAEA,SAAS,qBAAqB,CAC5B,YAAuC,EAAA;IAEvC,MAAM,UAAU,GAA2B,EAAE;AAE7C,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;AACvD,QAAA,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK;AAC1D,QAAA,IAAI,UAAU,KAAK,SAAS,EAAE;AAC5B,YAAA,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU;QAC9B;IACF;AAEA,IAAA,OAAO,UAAU;AACnB;;;;;;;;"}

package/dist/next/payment-return.d.cts

@@ -12,7 +12,14 @@ interface CheckoutPaymentReturn {
         identifier: string;
     };
     params: Record<string, string>;
+    /**
+     * `callback` forwards gateway fields for verification. `status` is emitted
+     * by the SDK server handler after it has already verified the gateway POST,
+     * so the browser performs only an authoritative status read.
+     */
+    resolution?: PaymentReturnResolution;
 }
+type PaymentReturnResolution = 'callback' | 'status';
 /** Search-param shape exposed by current Next.js App Router pages. */
 type PaymentReturnSearchParams = Record<string, string | string[] | undefined>;
 interface PaymentReturnParserOptions {
@@ -20,6 +27,13 @@ interface PaymentReturnParserOptions {
     gatewayResultMarkers?: readonly string[];
 }
 
+declare const SAZITO_PAYMENT_STATUS_QUERY: {
+    readonly resolution: "sazito_payment_return";
+    readonly paymentId: "sazito_payment_id";
+    readonly paymentIdentifier: "sazito_payment_identifier";
+};
+/** Remove server-return credentials from the visible URL after they are read. */
+declare function stripPaymentStatusReturn(url: string | URL): string | undefined;
 declare const SAZITO_PAYMENT_RESULT_MARKERS: readonly ["mellatpaymentresult", "pecpaymentresult", "uppaymentresult", "seppaymentresult", "vandarpaymentresult", "yourgatepaymentresult", "bazarpaymentresult", "zifypaymentresult", "zibalpaymentresult", "snapppaypaymentresult", "torobpaypaymentresult", "ghestapaypaymentresult", "azkipaymentresult", "digipaypaymentresult", "greenpaypaymentresult", "novapaypaymentresult", "zarinpluspaymentresult", "tomanpaymentresult", "tarapaymentresult", "ozonpaymentresult", "millipaypaymentresult", "ayriapaymentresult", "sadadpaymentresult", "freepaymentresult", "paymentinplaceresult", "cardtocardpaymentresult", "zarinpalpaymentresult", "directpayresult", "paypingpaymentresult", "podpaymentresult", "sabinpaymentresult", "firoozepaymentresult", "technopaypaymentresult", "buywithdigikalaresult"];
 /**
  * Parse Sazito's nested payment callback path into checkout-ready data.
@@ -33,5 +47,5 @@ declare function parsePaymentReturn(segments: readonly string[] | undefined, sea
  */
 declare function parsePaymentReturnUrl(url: string | URL, options?: PaymentReturnParserOptions): CheckoutPaymentReturn | undefined;
 
-export { SAZITO_PAYMENT_RESULT_MARKERS, parsePaymentReturn, parsePaymentReturnUrl };
-export type { CheckoutPaymentReturn, PaymentReturnParserOptions, PaymentReturnSearchParams };
+export { SAZITO_PAYMENT_RESULT_MARKERS, SAZITO_PAYMENT_STATUS_QUERY, parsePaymentReturn, parsePaymentReturnUrl, stripPaymentStatusReturn };
+export type { CheckoutPaymentReturn, PaymentReturnParserOptions, PaymentReturnResolution, PaymentReturnSearchParams };

package/dist/next/payment-return.d.ts

@@ -12,7 +12,14 @@ interface CheckoutPaymentReturn {
         identifier: string;
     };
     params: Record<string, string>;
+    /**
+     * `callback` forwards gateway fields for verification. `status` is emitted
+     * by the SDK server handler after it has already verified the gateway POST,
+     * so the browser performs only an authoritative status read.
+     */
+    resolution?: PaymentReturnResolution;
 }
+type PaymentReturnResolution = 'callback' | 'status';
 /** Search-param shape exposed by current Next.js App Router pages. */
 type PaymentReturnSearchParams = Record<string, string | string[] | undefined>;
 interface PaymentReturnParserOptions {
@@ -20,6 +27,13 @@ interface PaymentReturnParserOptions {
     gatewayResultMarkers?: readonly string[];
 }
 
+declare const SAZITO_PAYMENT_STATUS_QUERY: {
+    readonly resolution: "sazito_payment_return";
+    readonly paymentId: "sazito_payment_id";
+    readonly paymentIdentifier: "sazito_payment_identifier";
+};
+/** Remove server-return credentials from the visible URL after they are read. */
+declare function stripPaymentStatusReturn(url: string | URL): string | undefined;
 declare const SAZITO_PAYMENT_RESULT_MARKERS: readonly ["mellatpaymentresult", "pecpaymentresult", "uppaymentresult", "seppaymentresult", "vandarpaymentresult", "yourgatepaymentresult", "bazarpaymentresult", "zifypaymentresult", "zibalpaymentresult", "snapppaypaymentresult", "torobpaypaymentresult", "ghestapaypaymentresult", "azkipaymentresult", "digipaypaymentresult", "greenpaypaymentresult", "novapaypaymentresult", "zarinpluspaymentresult", "tomanpaymentresult", "tarapaymentresult", "ozonpaymentresult", "millipaypaymentresult", "ayriapaymentresult", "sadadpaymentresult", "freepaymentresult", "paymentinplaceresult", "cardtocardpaymentresult", "zarinpalpaymentresult", "directpayresult", "paypingpaymentresult", "podpaymentresult", "sabinpaymentresult", "firoozepaymentresult", "technopaypaymentresult", "buywithdigikalaresult"];
 /**
  * Parse Sazito's nested payment callback path into checkout-ready data.
@@ -33,5 +47,5 @@ declare function parsePaymentReturn(segments: readonly string[] | undefined, sea
  */
 declare function parsePaymentReturnUrl(url: string | URL, options?: PaymentReturnParserOptions): CheckoutPaymentReturn | undefined;
 
-export { SAZITO_PAYMENT_RESULT_MARKERS, parsePaymentReturn, parsePaymentReturnUrl };
-export type { CheckoutPaymentReturn, PaymentReturnParserOptions, PaymentReturnSearchParams };
+export { SAZITO_PAYMENT_RESULT_MARKERS, SAZITO_PAYMENT_STATUS_QUERY, parsePaymentReturn, parsePaymentReturnUrl, stripPaymentStatusReturn };
+export type { CheckoutPaymentReturn, PaymentReturnParserOptions, PaymentReturnResolution, PaymentReturnSearchParams };

package/dist/next/payment-return.js

@@ -1,3 +1,27 @@
+const SAZITO_PAYMENT_STATUS_QUERY = {
+    resolution: 'sazito_payment_return',
+    paymentId: 'sazito_payment_id',
+    paymentIdentifier: 'sazito_payment_identifier'
+};
+/** Remove server-return credentials from the visible URL after they are read. */
+function stripPaymentStatusReturn(url) {
+    let parsedUrl;
+    try {
+        parsedUrl = typeof url === 'string'
+            ? new URL(url, 'https://checkout.sazito.invalid')
+            : new URL(url.toString());
+    }
+    catch {
+        return undefined;
+    }
+    if (parsedUrl.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {
+        return undefined;
+    }
+    parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.resolution);
+    parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentId);
+    parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier);
+    return `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;
+}
 const SAZITO_PAYMENT_RESULT_MARKERS = [
     'mellatpaymentresult', 'pecpaymentresult', 'uppaymentresult',
     'seppaymentresult', 'vandarpaymentresult', 'yourgatepaymentresult',
@@ -55,6 +79,9 @@ function parsePaymentReturnUrl(url, options = {}) {
     catch {
         return undefined;
     }
+    const statusReturn = parsePaymentStatusReturn(parsedUrl);
+    if (statusReturn)
+        return statusReturn;
     const segments = parsedUrl.pathname
         .split('/')
         .filter(Boolean)
@@ -71,6 +98,27 @@ function parsePaymentReturnUrl(url, options = {}) {
     }
     return parsePaymentReturn(segments.slice(-5), searchParams, options);
 }
+function parsePaymentStatusReturn(url) {
+    if (url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {
+        return undefined;
+    }
+    const rawPaymentId = url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.paymentId);
+    const identifier = url.searchParams
+        .get(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier)
+        ?.trim();
+    const paymentId = Number(rawPaymentId);
+    if (!Number.isSafeInteger(paymentId) || paymentId <= 0 || !identifier) {
+        return undefined;
+    }
+    return {
+        payment: { id: paymentId, identifier },
+        params: {
+            id: String(paymentId),
+            paymentIdentifier: identifier
+        },
+        resolution: 'status'
+    };
+}
 function decodePathSegment(segment) {
     try {
         return decodeURIComponent(segment);
@@ -90,5 +138,5 @@ function normalizeSearchParams(searchParams) {
     return normalized;
 }
 
-export { SAZITO_PAYMENT_RESULT_MARKERS, parsePaymentReturn, parsePaymentReturnUrl };
+export { SAZITO_PAYMENT_RESULT_MARKERS, SAZITO_PAYMENT_STATUS_QUERY, parsePaymentReturn, parsePaymentReturnUrl, stripPaymentStatusReturn };
 //# sourceMappingURL=payment-return.js.map

package/dist/next/payment-return.js.map

@@ -1 +1 @@
-{"version":3,"file":"payment-return.js","sources":["../../src/core/payment-return.ts"],"sourcesContent":["import type {\n  CheckoutPaymentReturn,\n  PaymentReturnParserOptions,\n  PaymentReturnSearchParams\n} from './types';\n\nexport const SAZITO_PAYMENT_RESULT_MARKERS = [\n  'mellatpaymentresult', 'pecpaymentresult', 'uppaymentresult',\n  'seppaymentresult', 'vandarpaymentresult', 'yourgatepaymentresult',\n  'bazarpaymentresult', 'zifypaymentresult', 'zibalpaymentresult',\n  'snapppaypaymentresult', 'torobpaypaymentresult', 'ghestapaypaymentresult',\n  'azkipaymentresult', 'digipaypaymentresult', 'greenpaypaymentresult',\n  'novapaypaymentresult', 'zarinpluspaymentresult', 'tomanpaymentresult',\n  'tarapaymentresult', 'ozonpaymentresult', 'millipaypaymentresult',\n  'ayriapaymentresult', 'sadadpaymentresult', 'freepaymentresult',\n  'paymentinplaceresult', 'cardtocardpaymentresult', 'zarinpalpaymentresult',\n  'directpayresult', 'paypingpaymentresult', 'podpaymentresult',\n  'sabinpaymentresult', 'firoozepaymentresult', 'technopaypaymentresult',\n  'buywithdigikalaresult'\n] as const;\n\n/**\n * Parse Sazito's nested payment callback path into checkout-ready data.\n * Returns undefined for ordinary checkout URLs and malformed callbacks.\n */\nexport function parsePaymentReturn(\n  segments: readonly string[] | undefined,\n  searchParams: PaymentReturnSearchParams = {},\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  const [resultRoute, paymentSegment, rawPaymentId, identifierSegment, rawIdentifier] =\n    segments ?? [];\n  const paymentId = Number(rawPaymentId);\n  const identifier = rawIdentifier?.trim();\n  const allowedMarkers = new Set(\n    (options.gatewayResultMarkers ?? SAZITO_PAYMENT_RESULT_MARKERS)\n      .map((marker) => marker.toLowerCase())\n  );\n\n  if (\n    segments?.length !== 5 ||\n    !resultRoute ||\n    !allowedMarkers.has(resultRoute.toLowerCase()) ||\n    paymentSegment?.toLowerCase() !== 'payment' ||\n    identifierSegment?.toLowerCase() !== 'identifier' ||\n    !Number.isSafeInteger(paymentId) ||\n    paymentId <= 0 ||\n    !identifier\n  ) {\n    return undefined;\n  }\n\n  const params = normalizeSearchParams(searchParams);\n  params.id = String(paymentId);\n  params.paymentIdentifier = identifier;\n\n  return {\n    payment: { id: paymentId, identifier },\n    params\n  };\n}\n\n/**\n * Parse a complete checkout URL containing Sazito's nested payment callback.\n * The callback may be mounted below any checkout base path; only its final\n * five path segments are significant.\n */\nexport function parsePaymentReturnUrl(\n  url: string | URL,\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  let parsedUrl: URL;\n\n  try {\n    parsedUrl = typeof url === 'string'\n      ? new URL(url, 'https://checkout.sazito.invalid')\n      : url;\n  } catch {\n    return undefined;\n  }\n\n  const segments = parsedUrl.pathname\n    .split('/')\n    .filter(Boolean)\n    .map(decodePathSegment);\n\n  if (segments.length < 5) {\n    return undefined;\n  }\n\n  const searchParams: Record<string, string> = {};\n  for (const [key, value] of parsedUrl.searchParams) {\n    // Match Next.js search-param normalization: preserve the first value.\n    if (searchParams[key] === undefined) {\n      searchParams[key] = value;\n    }\n  }\n\n  return parsePaymentReturn(segments.slice(-5), searchParams, options);\n}\n\nfunction decodePathSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\nfunction normalizeSearchParams(\n  searchParams: PaymentReturnSearchParams\n): Record<string, string> {\n  const normalized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(searchParams)) {\n    const firstValue = Array.isArray(value) ? value[0] : value;\n    if (firstValue !== undefined) {\n      normalized[key] = firstValue;\n    }\n  }\n\n  return normalized;\n}\n"],"names":[],"mappings":"AAMO,MAAM,6BAA6B,GAAG;IAC3C,qBAAqB,EAAE,kBAAkB,EAAE,iBAAiB;IAC5D,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB;IAClE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB;IAC/D,uBAAuB,EAAE,uBAAuB,EAAE,wBAAwB;IAC1E,mBAAmB,EAAE,sBAAsB,EAAE,uBAAuB;IACpE,sBAAsB,EAAE,wBAAwB,EAAE,oBAAoB;IACtE,mBAAmB,EAAE,mBAAmB,EAAE,uBAAuB;IACjE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB;IAC/D,sBAAsB,EAAE,yBAAyB,EAAE,uBAAuB;IAC1E,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB;IAC7D,oBAAoB,EAAE,sBAAsB,EAAE,wBAAwB;IACtE;;AAGF;;;AAGG;AACG,SAAU,kBAAkB,CAChC,QAAuC,EACvC,YAAA,GAA0C,EAAE,EAC5C,OAAA,GAAsC,EAAE,EAAA;AAExC,IAAA,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,CAAC,GACjF,QAAQ,IAAI,EAAE;AAChB,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;AACtC,IAAA,MAAM,UAAU,GAAG,aAAa,EAAE,IAAI,EAAE;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,OAAO,CAAC,oBAAoB,IAAI,6BAA6B;AAC3D,SAAA,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CACzC;AAED,IAAA,IACE,QAAQ,EAAE,MAAM,KAAK,CAAC;AACtB,QAAA,CAAC,WAAW;QACZ,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;AAC9C,QAAA,cAAc,EAAE,WAAW,EAAE,KAAK,SAAS;AAC3C,QAAA,iBAAiB,EAAE,WAAW,EAAE,KAAK,YAAY;AACjD,QAAA,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;AAChC,QAAA,SAAS,IAAI,CAAC;QACd,CAAC,UAAU,EACX;AACA,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC;AAClD,IAAA,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;AAC7B,IAAA,MAAM,CAAC,iBAAiB,GAAG,UAAU;IAErC,OAAO;AACL,QAAA,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QACtC;KACD;AACH;AAEA;;;;AAIG;SACa,qBAAqB,CACnC,GAAiB,EACjB,UAAsC,EAAE,EAAA;AAExC,IAAA,IAAI,SAAc;AAElB,IAAA,IAAI;AACF,QAAA,SAAS,GAAG,OAAO,GAAG,KAAK;AACzB,cAAE,IAAI,GAAG,CAAC,GAAG,EAAE,iCAAiC;cAC9C,GAAG;IACT;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;SACxB,KAAK,CAAC,GAAG;SACT,MAAM,CAAC,OAAO;SACd,GAAG,CAAC,iBAAiB,CAAC;AAEzB,IAAA,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AACvB,QAAA,OAAO,SAAS;IAClB;IAEA,MAAM,YAAY,GAA2B,EAAE;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,YAAY,EAAE;;AAEjD,QAAA,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE;AACnC,YAAA,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK;QAC3B;IACF;AAEA,IAAA,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC;AACtE;AAEA,SAAS,iBAAiB,CAAC,OAAe,EAAA;AACxC,IAAA,IAAI;AACF,QAAA,OAAO,kBAAkB,CAAC,OAAO,CAAC;IACpC;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,OAAO;IAChB;AACF;AAEA,SAAS,qBAAqB,CAC5B,YAAuC,EAAA;IAEvC,MAAM,UAAU,GAA2B,EAAE;AAE7C,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;AACvD,QAAA,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK;AAC1D,QAAA,IAAI,UAAU,KAAK,SAAS,EAAE;AAC5B,YAAA,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU;QAC9B;IACF;AAEA,IAAA,OAAO,UAAU;AACnB;;;;"}
+{"version":3,"file":"payment-return.js","sources":["../../src/core/payment-return.ts"],"sourcesContent":["import type {\n  CheckoutPaymentReturn,\n  PaymentReturnParserOptions,\n  PaymentReturnSearchParams\n} from './types';\n\nexport const SAZITO_PAYMENT_STATUS_QUERY = {\n  resolution: 'sazito_payment_return',\n  paymentId: 'sazito_payment_id',\n  paymentIdentifier: 'sazito_payment_identifier'\n} as const;\n\n/** Remove server-return credentials from the visible URL after they are read. */\nexport function stripPaymentStatusReturn(url: string | URL): string | undefined {\n  let parsedUrl: URL;\n  try {\n    parsedUrl = typeof url === 'string'\n      ? new URL(url, 'https://checkout.sazito.invalid')\n      : new URL(url.toString());\n  } catch {\n    return undefined;\n  }\n\n  if (parsedUrl.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {\n    return undefined;\n  }\n\n  parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.resolution);\n  parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentId);\n  parsedUrl.searchParams.delete(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier);\n  return `${parsedUrl.pathname}${parsedUrl.search}${parsedUrl.hash}`;\n}\n\nexport const SAZITO_PAYMENT_RESULT_MARKERS = [\n  'mellatpaymentresult', 'pecpaymentresult', 'uppaymentresult',\n  'seppaymentresult', 'vandarpaymentresult', 'yourgatepaymentresult',\n  'bazarpaymentresult', 'zifypaymentresult', 'zibalpaymentresult',\n  'snapppaypaymentresult', 'torobpaypaymentresult', 'ghestapaypaymentresult',\n  'azkipaymentresult', 'digipaypaymentresult', 'greenpaypaymentresult',\n  'novapaypaymentresult', 'zarinpluspaymentresult', 'tomanpaymentresult',\n  'tarapaymentresult', 'ozonpaymentresult', 'millipaypaymentresult',\n  'ayriapaymentresult', 'sadadpaymentresult', 'freepaymentresult',\n  'paymentinplaceresult', 'cardtocardpaymentresult', 'zarinpalpaymentresult',\n  'directpayresult', 'paypingpaymentresult', 'podpaymentresult',\n  'sabinpaymentresult', 'firoozepaymentresult', 'technopaypaymentresult',\n  'buywithdigikalaresult'\n] as const;\n\n/**\n * Parse Sazito's nested payment callback path into checkout-ready data.\n * Returns undefined for ordinary checkout URLs and malformed callbacks.\n */\nexport function parsePaymentReturn(\n  segments: readonly string[] | undefined,\n  searchParams: PaymentReturnSearchParams = {},\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  const [resultRoute, paymentSegment, rawPaymentId, identifierSegment, rawIdentifier] =\n    segments ?? [];\n  const paymentId = Number(rawPaymentId);\n  const identifier = rawIdentifier?.trim();\n  const allowedMarkers = new Set(\n    (options.gatewayResultMarkers ?? SAZITO_PAYMENT_RESULT_MARKERS)\n      .map((marker) => marker.toLowerCase())\n  );\n\n  if (\n    segments?.length !== 5 ||\n    !resultRoute ||\n    !allowedMarkers.has(resultRoute.toLowerCase()) ||\n    paymentSegment?.toLowerCase() !== 'payment' ||\n    identifierSegment?.toLowerCase() !== 'identifier' ||\n    !Number.isSafeInteger(paymentId) ||\n    paymentId <= 0 ||\n    !identifier\n  ) {\n    return undefined;\n  }\n\n  const params = normalizeSearchParams(searchParams);\n  params.id = String(paymentId);\n  params.paymentIdentifier = identifier;\n\n  return {\n    payment: { id: paymentId, identifier },\n    params\n  };\n}\n\n/**\n * Parse a complete checkout URL containing Sazito's nested payment callback.\n * The callback may be mounted below any checkout base path; only its final\n * five path segments are significant.\n */\nexport function parsePaymentReturnUrl(\n  url: string | URL,\n  options: PaymentReturnParserOptions = {}\n): CheckoutPaymentReturn | undefined {\n  let parsedUrl: URL;\n\n  try {\n    parsedUrl = typeof url === 'string'\n      ? new URL(url, 'https://checkout.sazito.invalid')\n      : url;\n  } catch {\n    return undefined;\n  }\n\n  const statusReturn = parsePaymentStatusReturn(parsedUrl);\n  if (statusReturn) return statusReturn;\n\n  const segments = parsedUrl.pathname\n    .split('/')\n    .filter(Boolean)\n    .map(decodePathSegment);\n\n  if (segments.length < 5) {\n    return undefined;\n  }\n\n  const searchParams: Record<string, string> = {};\n  for (const [key, value] of parsedUrl.searchParams) {\n    // Match Next.js search-param normalization: preserve the first value.\n    if (searchParams[key] === undefined) {\n      searchParams[key] = value;\n    }\n  }\n\n  return parsePaymentReturn(segments.slice(-5), searchParams, options);\n}\n\nfunction parsePaymentStatusReturn(url: URL): CheckoutPaymentReturn | undefined {\n  if (url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.resolution) !== 'status') {\n    return undefined;\n  }\n\n  const rawPaymentId = url.searchParams.get(SAZITO_PAYMENT_STATUS_QUERY.paymentId);\n  const identifier = url.searchParams\n    .get(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier)\n    ?.trim();\n  const paymentId = Number(rawPaymentId);\n\n  if (!Number.isSafeInteger(paymentId) || paymentId <= 0 || !identifier) {\n    return undefined;\n  }\n\n  return {\n    payment: { id: paymentId, identifier },\n    params: {\n      id: String(paymentId),\n      paymentIdentifier: identifier\n    },\n    resolution: 'status'\n  };\n}\n\nfunction decodePathSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\nfunction normalizeSearchParams(\n  searchParams: PaymentReturnSearchParams\n): Record<string, string> {\n  const normalized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(searchParams)) {\n    const firstValue = Array.isArray(value) ? value[0] : value;\n    if (firstValue !== undefined) {\n      normalized[key] = firstValue;\n    }\n  }\n\n  return normalized;\n}\n"],"names":[],"mappings":"AAMO,MAAM,2BAA2B,GAAG;AACzC,IAAA,UAAU,EAAE,uBAAuB;AACnC,IAAA,SAAS,EAAE,mBAAmB;AAC9B,IAAA,iBAAiB,EAAE;;AAGrB;AACM,SAAU,wBAAwB,CAAC,GAAiB,EAAA;AACxD,IAAA,IAAI,SAAc;AAClB,IAAA,IAAI;AACF,QAAA,SAAS,GAAG,OAAO,GAAG,KAAK;AACzB,cAAE,IAAI,GAAG,CAAC,GAAG,EAAE,iCAAiC;cAC9C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,IAAI,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE;AACnF,QAAA,OAAO,SAAS;IAClB;IAEA,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,2BAA2B,CAAC,UAAU,CAAC;IACrE,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC;IACpE,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,2BAA2B,CAAC,iBAAiB,CAAC;AAC5E,IAAA,OAAO,CAAA,EAAG,SAAS,CAAC,QAAQ,CAAA,EAAG,SAAS,CAAC,MAAM,CAAA,EAAG,SAAS,CAAC,IAAI,EAAE;AACpE;AAEO,MAAM,6BAA6B,GAAG;IAC3C,qBAAqB,EAAE,kBAAkB,EAAE,iBAAiB;IAC5D,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB;IAClE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB;IAC/D,uBAAuB,EAAE,uBAAuB,EAAE,wBAAwB;IAC1E,mBAAmB,EAAE,sBAAsB,EAAE,uBAAuB;IACpE,sBAAsB,EAAE,wBAAwB,EAAE,oBAAoB;IACtE,mBAAmB,EAAE,mBAAmB,EAAE,uBAAuB;IACjE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB;IAC/D,sBAAsB,EAAE,yBAAyB,EAAE,uBAAuB;IAC1E,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB;IAC7D,oBAAoB,EAAE,sBAAsB,EAAE,wBAAwB;IACtE;;AAGF;;;AAGG;AACG,SAAU,kBAAkB,CAChC,QAAuC,EACvC,YAAA,GAA0C,EAAE,EAC5C,OAAA,GAAsC,EAAE,EAAA;AAExC,IAAA,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,CAAC,GACjF,QAAQ,IAAI,EAAE;AAChB,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;AACtC,IAAA,MAAM,UAAU,GAAG,aAAa,EAAE,IAAI,EAAE;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,OAAO,CAAC,oBAAoB,IAAI,6BAA6B;AAC3D,SAAA,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CACzC;AAED,IAAA,IACE,QAAQ,EAAE,MAAM,KAAK,CAAC;AACtB,QAAA,CAAC,WAAW;QACZ,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;AAC9C,QAAA,cAAc,EAAE,WAAW,EAAE,KAAK,SAAS;AAC3C,QAAA,iBAAiB,EAAE,WAAW,EAAE,KAAK,YAAY;AACjD,QAAA,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;AAChC,QAAA,SAAS,IAAI,CAAC;QACd,CAAC,UAAU,EACX;AACA,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC;AAClD,IAAA,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;AAC7B,IAAA,MAAM,CAAC,iBAAiB,GAAG,UAAU;IAErC,OAAO;AACL,QAAA,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QACtC;KACD;AACH;AAEA;;;;AAIG;SACa,qBAAqB,CACnC,GAAiB,EACjB,UAAsC,EAAE,EAAA;AAExC,IAAA,IAAI,SAAc;AAElB,IAAA,IAAI;AACF,QAAA,SAAS,GAAG,OAAO,GAAG,KAAK;AACzB,cAAE,IAAI,GAAG,CAAC,GAAG,EAAE,iCAAiC;cAC9C,GAAG;IACT;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,CAAC;AACxD,IAAA,IAAI,YAAY;AAAE,QAAA,OAAO,YAAY;AAErC,IAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;SACxB,KAAK,CAAC,GAAG;SACT,MAAM,CAAC,OAAO;SACd,GAAG,CAAC,iBAAiB,CAAC;AAEzB,IAAA,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AACvB,QAAA,OAAO,SAAS;IAClB;IAEA,MAAM,YAAY,GAA2B,EAAE;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,YAAY,EAAE;;AAEjD,QAAA,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE;AACnC,YAAA,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK;QAC3B;IACF;AAEA,IAAA,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC;AACtE;AAEA,SAAS,wBAAwB,CAAC,GAAQ,EAAA;AACxC,IAAA,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE;AAC7E,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,SAAS,CAAC;AAChF,IAAA,MAAM,UAAU,GAAG,GAAG,CAAC;AACpB,SAAA,GAAG,CAAC,2BAA2B,CAAC,iBAAiB;UAChD,IAAI,EAAE;AACV,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;AAEtC,IAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;AACrE,QAAA,OAAO,SAAS;IAClB;IAEA,OAAO;AACL,QAAA,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;AACtC,QAAA,MAAM,EAAE;AACN,YAAA,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC;AACrB,YAAA,iBAAiB,EAAE;AACpB,SAAA;AACD,QAAA,UAAU,EAAE;KACb;AACH;AAEA,SAAS,iBAAiB,CAAC,OAAe,EAAA;AACxC,IAAA,IAAI;AACF,QAAA,OAAO,kBAAkB,CAAC,OAAO,CAAC;IACpC;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,OAAO;IAChB;AACF;AAEA,SAAS,qBAAqB,CAC5B,YAAuC,EAAA;IAEvC,MAAM,UAAU,GAA2B,EAAE;AAE7C,IAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;AACvD,QAAA,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK;AAC1D,QAAA,IAAI,UAAU,KAAK,SAAS,EAAE;AAC5B,YAAA,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU;QAC9B;IACF;AAEA,IAAA,OAAO,UAAU;AACnB;;;;"}

package/dist/next/server.cjs

@@ -0,0 +1,10 @@
+'use strict';
+
+var server_index = require('../server/index.cjs');
+require('@sazito/client-sdk');
+require('./payment-return.cjs');
+
+
+
+exports.SazitoCheckout = server_index.SazitoCheckout;
+//# sourceMappingURL=server.cjs.map

package/dist/next/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;"}

package/dist/next/server.d.cts

@@ -0,0 +1,33 @@
+import { SazitoConfig } from '@sazito/client-sdk';
+
+/**
+ * @sazito/checkout/server — server-only payment callback handlers.
+ *
+ * The implementation uses only the standard Web Request/Response APIs so the
+ * same handlers work in Next.js Route Handlers and other compatible runtimes.
+ */
+
+type SazitoPaymentRouteHandler = (request: Request) => Promise<Response>;
+interface SazitoCheckoutServerConfig extends SazitoConfig {
+    /** Page that renders `SazitoCheckoutPage` after server verification. */
+    checkoutPath?: string;
+    /** Maximum accepted gateway callback body size. Defaults to 64 KiB. */
+    maxCallbackBodyBytes?: number;
+    /** Replace the built-in gateway-result marker allowlist. */
+    gatewayResultMarkers?: readonly string[];
+}
+interface SazitoCheckoutServer {
+    handlers: {
+        GET: SazitoPaymentRouteHandler;
+        POST: SazitoPaymentRouteHandler;
+    };
+}
+/**
+ * Create GET and POST route handlers for payment callbacks.
+ * A fresh SDK client is created for each request so server-side guest
+ * credentials can never leak between concurrent callbacks.
+ */
+declare function SazitoCheckout(config: SazitoCheckoutServerConfig): SazitoCheckoutServer;
+
+export { SazitoCheckout };
+export type { SazitoCheckoutServer, SazitoCheckoutServerConfig, SazitoPaymentRouteHandler };

package/dist/next/server.d.ts

@@ -0,0 +1,33 @@
+import { SazitoConfig } from '@sazito/client-sdk';
+
+/**
+ * @sazito/checkout/server — server-only payment callback handlers.
+ *
+ * The implementation uses only the standard Web Request/Response APIs so the
+ * same handlers work in Next.js Route Handlers and other compatible runtimes.
+ */
+
+type SazitoPaymentRouteHandler = (request: Request) => Promise<Response>;
+interface SazitoCheckoutServerConfig extends SazitoConfig {
+    /** Page that renders `SazitoCheckoutPage` after server verification. */
+    checkoutPath?: string;
+    /** Maximum accepted gateway callback body size. Defaults to 64 KiB. */
+    maxCallbackBodyBytes?: number;
+    /** Replace the built-in gateway-result marker allowlist. */
+    gatewayResultMarkers?: readonly string[];
+}
+interface SazitoCheckoutServer {
+    handlers: {
+        GET: SazitoPaymentRouteHandler;
+        POST: SazitoPaymentRouteHandler;
+    };
+}
+/**
+ * Create GET and POST route handlers for payment callbacks.
+ * A fresh SDK client is created for each request so server-side guest
+ * credentials can never leak between concurrent callbacks.
+ */
+declare function SazitoCheckout(config: SazitoCheckoutServerConfig): SazitoCheckoutServer;
+
+export { SazitoCheckout };
+export type { SazitoCheckoutServer, SazitoCheckoutServerConfig, SazitoPaymentRouteHandler };

package/dist/next/server.js

@@ -0,0 +1,4 @@
+export { SazitoCheckout } from '../server/index.js';
+import '@sazito/client-sdk';
+import './payment-return.js';
+//# sourceMappingURL=server.js.map

package/dist/next/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}

package/dist/react/index.cjs

@@ -1,11 +1,11 @@
 'use client';
 'use strict';
 
-var useCheckout = require('../chunks/use-checkout-wHkKNkbK.cjs');
+var useCheckout = require('../chunks/use-checkout-DsTtOAMs.cjs');
 require('react/jsx-runtime');
 require('react');
 require('../next/payment-return.cjs');
-require('../chunks/labels-Cy05dLJx.cjs');
+require('../chunks/labels-FNi3eq4p.cjs');
 require('@sazito/client-sdk');
 
 

package/dist/react/index.d.cts

@@ -99,6 +99,7 @@ interface CheckoutCredentials {
         identifier: string;
     };
 }
+type PaymentReturnResolution = 'callback' | 'status';
 interface CheckoutConfig {
     locale?: CheckoutLocale;
     direction?: CheckoutDirection;
@@ -240,8 +241,8 @@ interface CheckoutActions {
     placeOrder(): Promise<void>;
     /** Rehydrate a failed gateway return and reopen a usable payment step. */
     retryPayment(): Promise<void>;
-    /** Resolve a return from the payment gateway (query params from the URL). */
-    resolvePaymentReturn(params: Record<string, string>): Promise<void>;
+    /** Resolve a gateway callback or a server-verified payment status return. */
+    resolvePaymentReturn(params: Record<string, string>, resolution?: PaymentReturnResolution): Promise<void>;
     reset(): void;
 }
 

package/dist/react/index.d.ts

@@ -99,6 +99,7 @@ interface CheckoutCredentials {
         identifier: string;
     };
 }
+type PaymentReturnResolution = 'callback' | 'status';
 interface CheckoutConfig {
     locale?: CheckoutLocale;
     direction?: CheckoutDirection;
@@ -240,8 +241,8 @@ interface CheckoutActions {
     placeOrder(): Promise<void>;
     /** Rehydrate a failed gateway return and reopen a usable payment step. */
     retryPayment(): Promise<void>;
-    /** Resolve a return from the payment gateway (query params from the URL). */
-    resolvePaymentReturn(params: Record<string, string>): Promise<void>;
+    /** Resolve a gateway callback or a server-verified payment status return. */
+    resolvePaymentReturn(params: Record<string, string>, resolution?: PaymentReturnResolution): Promise<void>;
     reset(): void;
 }
 

package/dist/react/index.js

@@ -1,8 +1,8 @@
 'use client';
-export { C as CheckoutProvider, S as SazitoProvider, u as useCheckout, a as useCheckoutEngine, b as useSazitoClient } from '../chunks/use-checkout-uWEi8iqK.js';
+export { C as CheckoutProvider, S as SazitoProvider, u as useCheckout, a as useCheckoutEngine, b as useSazitoClient } from '../chunks/use-checkout-OyHfWeAh.js';
 import 'react/jsx-runtime';
 import 'react';
 import '../next/payment-return.js';
-import '../chunks/labels-Cysz2BgA.js';
+import '../chunks/labels-CwHBYso8.js';
 import '@sazito/client-sdk';
 //# sourceMappingURL=index.js.map

package/dist/server/index.cjs

@@ -0,0 +1,182 @@
+'use strict';
+
+var clientSdk = require('@sazito/client-sdk');
+var next_paymentReturn = require('../next/payment-return.cjs');
+
+/**
+ * @sazito/checkout/server — server-only payment callback handlers.
+ *
+ * The implementation uses only the standard Web Request/Response APIs so the
+ * same handlers work in Next.js Route Handlers and other compatible runtimes.
+ */
+const DEFAULT_CHECKOUT_PATH = '/checkout';
+const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+/**
+ * Create GET and POST route handlers for payment callbacks.
+ * A fresh SDK client is created for each request so server-side guest
+ * credentials can never leak between concurrent callbacks.
+ */
+function SazitoCheckout(config) {
+    const { checkoutPath = DEFAULT_CHECKOUT_PATH, maxCallbackBodyBytes = DEFAULT_MAX_BODY_BYTES, gatewayResultMarkers, ...sdkConfig } = config;
+    validateConfig(sdkConfig, checkoutPath, maxCallbackBodyBytes);
+    const parserOptions = { gatewayResultMarkers };
+    const createHandler = (method) => async (request) => {
+        if (request.method.toUpperCase() !== method) {
+            return errorResponse(405, 'method_not_allowed', { Allow: method });
+        }
+        try {
+            const callback = next_paymentReturn.parsePaymentReturnUrl(request.url, parserOptions);
+            if (!callback || callback.resolution === 'status') {
+                return errorResponse(400, 'invalid_payment_callback');
+            }
+            const requestUrl = new URL(request.url);
+            const body = method === 'POST'
+                ? await readCallbackBody(request, maxCallbackBodyBytes)
+                : undefined;
+            const query = fieldsFromSearchParams(requestUrl.searchParams);
+            const client = clientSdk.createSazitoClient(sdkConfig);
+            const verification = await client.payments.verifyPaymentCallback({
+                paymentId: callback.payment.id,
+                paymentIdentifier: callback.payment.identifier,
+                body,
+                query
+            });
+            if (verification.error || !verification.data) {
+                if (sdkConfig.debug) {
+                    console.error('[Sazito Checkout] Payment callback verification failed:', {
+                        paymentId: callback.payment.id,
+                        error: verification.error
+                    });
+                }
+                return errorResponse(502, 'payment_verification_failed');
+            }
+            const redirectUrl = createStatusRedirectUrl(requestUrl, checkoutPath, callback.payment);
+            return new Response(null, {
+                status: 303,
+                headers: {
+                    Location: redirectUrl.toString(),
+                    'Cache-Control': 'no-store',
+                    'Referrer-Policy': 'no-referrer'
+                }
+            });
+        }
+        catch (error) {
+            if (config.debug) {
+                console.error('[Sazito Checkout] Invalid payment callback request:', error);
+            }
+            const status = error instanceof CallbackRequestError ? error.status : 500;
+            const code = error instanceof CallbackRequestError
+                ? error.code
+                : 'payment_callback_failed';
+            return errorResponse(status, code);
+        }
+    };
+    return {
+        handlers: {
+            GET: createHandler('GET'),
+            POST: createHandler('POST')
+        }
+    };
+}
+function validateConfig(config, checkoutPath, maxCallbackBodyBytes) {
+    if (!config.domain?.trim()) {
+        throw new Error('[@sazito/checkout] `domain` is required by the payment callback handler.');
+    }
+    if (!checkoutPath.trim()) {
+        throw new Error('[@sazito/checkout] `checkoutPath` cannot be empty.');
+    }
+    if (!Number.isSafeInteger(maxCallbackBodyBytes) || maxCallbackBodyBytes <= 0) {
+        throw new Error('[@sazito/checkout] `maxCallbackBodyBytes` must be a positive integer.');
+    }
+}
+async function readCallbackBody(request, maxBodyBytes) {
+    const declaredLength = Number(request.headers.get('content-length') ?? 0);
+    if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+        throw new CallbackRequestError(413, 'payment_callback_too_large');
+    }
+    const bytes = await request.arrayBuffer();
+    if (bytes.byteLength > maxBodyBytes) {
+        throw new CallbackRequestError(413, 'payment_callback_too_large');
+    }
+    if (bytes.byteLength === 0)
+        return {};
+    const contentType = request.headers.get('content-type')?.toLowerCase() ?? '';
+    if (contentType.includes('application/json')) {
+        return fieldsFromJson(new TextDecoder().decode(bytes));
+    }
+    if (contentType.includes('multipart/form-data')) {
+        const form = await new Response(bytes, {
+            headers: { 'Content-Type': request.headers.get('content-type') ?? '' }
+        }).formData();
+        return fieldsFromFormData(form);
+    }
+    // Gateways commonly omit Content-Type or label URL-encoded data as text.
+    return fieldsFromSearchParams(new URLSearchParams(new TextDecoder().decode(bytes)));
+}
+function fieldsFromJson(source) {
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new CallbackRequestError(400, 'invalid_payment_callback_body');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new CallbackRequestError(400, 'invalid_payment_callback_body');
+    }
+    return value;
+}
+function fieldsFromSearchParams(params) {
+    const fields = {};
+    for (const [name, value] of params)
+        appendField(fields, name, value);
+    return fields;
+}
+function fieldsFromFormData(form) {
+    const fields = {};
+    for (const [name, value] of form) {
+        if (typeof value !== 'string') {
+            throw new CallbackRequestError(400, 'unsupported_payment_callback_file');
+        }
+        appendField(fields, name, value);
+    }
+    return fields;
+}
+function appendField(fields, name, value) {
+    const current = fields[name];
+    if (current === undefined) {
+        fields[name] = value;
+    }
+    else if (Array.isArray(current)) {
+        fields[name] = [...current, value ?? null];
+    }
+    else {
+        fields[name] = [current, value ?? null];
+    }
+}
+function createStatusRedirectUrl(requestUrl, checkoutPath, payment) {
+    const redirectUrl = new URL(checkoutPath, requestUrl.origin);
+    redirectUrl.searchParams.set(next_paymentReturn.SAZITO_PAYMENT_STATUS_QUERY.resolution, 'status');
+    redirectUrl.searchParams.set(next_paymentReturn.SAZITO_PAYMENT_STATUS_QUERY.paymentId, String(payment.id));
+    redirectUrl.searchParams.set(next_paymentReturn.SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier, payment.identifier);
+    return redirectUrl;
+}
+function errorResponse(status, code, extraHeaders = {}) {
+    return Response.json({ error: code }, {
+        status,
+        headers: {
+            'Cache-Control': 'no-store',
+            ...extraHeaders
+        }
+    });
+}
+class CallbackRequestError extends Error {
+    constructor(status, code) {
+        super(code);
+        this.status = status;
+        this.code = code;
+    }
+}
+
+exports.SazitoCheckout = SazitoCheckout;
+//# sourceMappingURL=index.cjs.map