@sazito/checkout 0.4.19 → 0.4.21

package/dist/server/index.cjs

@@ -0,0 +1,205 @@
+'use strict';
+
+var clientSdk = require('@sazito/client-sdk');
+var next_paymentReturn = require('../next/payment-return.cjs');
+
+/**
+ * @sazito/checkout/server — server-only payment callback handlers.
+ *
+ * The implementation uses only the standard Web Request/Response APIs so the
+ * same handlers work in Next.js Route Handlers and other compatible runtimes.
+ */
+const DEFAULT_CHECKOUT_PATH = '/checkout';
+const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+const BROWSER_FINALIZED_RESULT_MARKERS = new Set(['paymentinplaceresult']);
+/**
+ * Create GET and POST route handlers for payment callbacks.
+ * A fresh SDK client is created for each request so server-side guest
+ * credentials can never leak between concurrent callbacks.
+ */
+function SazitoCheckout(config) {
+    const { checkoutPath = DEFAULT_CHECKOUT_PATH, maxCallbackBodyBytes = DEFAULT_MAX_BODY_BYTES, gatewayResultMarkers, ...sdkConfig } = config;
+    validateConfig(sdkConfig, checkoutPath, maxCallbackBodyBytes);
+    const parserOptions = { gatewayResultMarkers };
+    const createHandler = (method) => async (request) => {
+        if (request.method.toUpperCase() !== method) {
+            return errorResponse(405, 'method_not_allowed', { Allow: method });
+        }
+        try {
+            const callback = next_paymentReturn.parsePaymentReturnUrl(request.url, parserOptions);
+            if (!callback || callback.resolution === 'status') {
+                return errorResponse(400, 'invalid_payment_callback');
+            }
+            const requestUrl = new URL(request.url);
+            const body = method === 'POST'
+                ? await readCallbackBody(request, maxCallbackBodyBytes)
+                : undefined;
+            const query = fieldsFromSearchParams(requestUrl.searchParams);
+            // Payment-in-place uses an empty POST only to return control to the
+            // storefront. Processing it on the server and then performing a status
+            // read in the browser calls process_payment_step twice; some deployments
+            // report the second call as failed even though the first one created the
+            // order. Redirect the empty first-party callback to the browser so the
+            // order is finalized exactly once and the returned order can be rendered.
+            if (shouldFinalizeInBrowser(requestUrl, body, query)) {
+                return redirectResponse(createPaymentReturnRedirectUrl(requestUrl, checkoutPath, callback.payment, 'callback'));
+            }
+            const client = clientSdk.createSazitoClient(sdkConfig);
+            const verification = await client.payments.verifyPaymentCallback({
+                paymentId: callback.payment.id,
+                paymentIdentifier: callback.payment.identifier,
+                body,
+                query
+            });
+            if (verification.error || !verification.data) {
+                if (sdkConfig.debug) {
+                    console.error('[Sazito Checkout] Payment callback verification failed:', {
+                        paymentId: callback.payment.id,
+                        error: verification.error
+                    });
+                }
+                return errorResponse(502, 'payment_verification_failed');
+            }
+            const redirectUrl = createPaymentReturnRedirectUrl(requestUrl, checkoutPath, callback.payment, 'status');
+            return redirectResponse(redirectUrl);
+        }
+        catch (error) {
+            if (config.debug) {
+                console.error('[Sazito Checkout] Invalid payment callback request:', error);
+            }
+            const status = error instanceof CallbackRequestError ? error.status : 500;
+            const code = error instanceof CallbackRequestError
+                ? error.code
+                : 'payment_callback_failed';
+            return errorResponse(status, code);
+        }
+    };
+    return {
+        handlers: {
+            GET: createHandler('GET'),
+            POST: createHandler('POST')
+        }
+    };
+}
+function validateConfig(config, checkoutPath, maxCallbackBodyBytes) {
+    if (!config.domain?.trim()) {
+        throw new Error('[@sazito/checkout] `domain` is required by the payment callback handler.');
+    }
+    if (!checkoutPath.trim()) {
+        throw new Error('[@sazito/checkout] `checkoutPath` cannot be empty.');
+    }
+    if (!Number.isSafeInteger(maxCallbackBodyBytes) || maxCallbackBodyBytes <= 0) {
+        throw new Error('[@sazito/checkout] `maxCallbackBodyBytes` must be a positive integer.');
+    }
+}
+async function readCallbackBody(request, maxBodyBytes) {
+    const declaredLength = Number(request.headers.get('content-length') ?? 0);
+    if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+        throw new CallbackRequestError(413, 'payment_callback_too_large');
+    }
+    const bytes = await request.arrayBuffer();
+    if (bytes.byteLength > maxBodyBytes) {
+        throw new CallbackRequestError(413, 'payment_callback_too_large');
+    }
+    if (bytes.byteLength === 0)
+        return {};
+    const contentType = request.headers.get('content-type')?.toLowerCase() ?? '';
+    if (contentType.includes('application/json')) {
+        return fieldsFromJson(new TextDecoder().decode(bytes));
+    }
+    if (contentType.includes('multipart/form-data')) {
+        const form = await new Response(bytes, {
+            headers: { 'Content-Type': request.headers.get('content-type') ?? '' }
+        }).formData();
+        return fieldsFromFormData(form);
+    }
+    // Gateways commonly omit Content-Type or label URL-encoded data as text.
+    return fieldsFromSearchParams(new URLSearchParams(new TextDecoder().decode(bytes)));
+}
+function fieldsFromJson(source) {
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new CallbackRequestError(400, 'invalid_payment_callback_body');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new CallbackRequestError(400, 'invalid_payment_callback_body');
+    }
+    return value;
+}
+function fieldsFromSearchParams(params) {
+    const fields = {};
+    for (const [name, value] of params)
+        appendField(fields, name, value);
+    return fields;
+}
+function fieldsFromFormData(form) {
+    const fields = {};
+    for (const [name, value] of form) {
+        if (typeof value !== 'string') {
+            throw new CallbackRequestError(400, 'unsupported_payment_callback_file');
+        }
+        appendField(fields, name, value);
+    }
+    return fields;
+}
+function appendField(fields, name, value) {
+    const current = fields[name];
+    if (current === undefined) {
+        fields[name] = value;
+    }
+    else if (Array.isArray(current)) {
+        fields[name] = [...current, value ?? null];
+    }
+    else {
+        fields[name] = [current, value ?? null];
+    }
+}
+function shouldFinalizeInBrowser(requestUrl, body, query) {
+    const pathSegments = requestUrl.pathname
+        .split('/')
+        .filter(Boolean);
+    const resultMarker = pathSegments[pathSegments.length - 5]?.toLowerCase();
+    return Boolean(resultMarker &&
+        BROWSER_FINALIZED_RESULT_MARKERS.has(resultMarker) &&
+        Object.keys(body ?? {}).length === 0 &&
+        Object.keys(query).length === 0);
+}
+function createPaymentReturnRedirectUrl(requestUrl, checkoutPath, payment, resolution) {
+    const redirectUrl = new URL(checkoutPath, requestUrl.origin);
+    redirectUrl.searchParams.set(next_paymentReturn.SAZITO_PAYMENT_STATUS_QUERY.resolution, resolution);
+    redirectUrl.searchParams.set(next_paymentReturn.SAZITO_PAYMENT_STATUS_QUERY.paymentId, String(payment.id));
+    redirectUrl.searchParams.set(next_paymentReturn.SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier, payment.identifier);
+    return redirectUrl;
+}
+function redirectResponse(url) {
+    return new Response(null, {
+        status: 303,
+        headers: {
+            Location: url.toString(),
+            'Cache-Control': 'no-store',
+            'Referrer-Policy': 'no-referrer'
+        }
+    });
+}
+function errorResponse(status, code, extraHeaders = {}) {
+    return Response.json({ error: code }, {
+        status,
+        headers: {
+            'Cache-Control': 'no-store',
+            ...extraHeaders
+        }
+    });
+}
+class CallbackRequestError extends Error {
+    constructor(status, code) {
+        super(code);
+        this.status = status;
+        this.code = code;
+    }
+}
+
+exports.SazitoCheckout = SazitoCheckout;
+//# sourceMappingURL=index.cjs.map

package/dist/server/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../../src/server/index.ts"],"sourcesContent":["/**\n * @sazito/checkout/server — server-only payment callback handlers.\n *\n * The implementation uses only the standard Web Request/Response APIs so the\n * same handlers work in Next.js Route Handlers and other compatible runtimes.\n */\nimport {\n  createSazitoClient,\n  type PaymentCallbackFieldValue,\n  type PaymentCallbackFields,\n  type SazitoConfig\n} from '@sazito/client-sdk';\nimport {\n  parsePaymentReturnUrl,\n  SAZITO_PAYMENT_STATUS_QUERY\n} from '../core/payment-return';\nimport type { PaymentReturnParserOptions } from '../core/types';\n\nconst DEFAULT_CHECKOUT_PATH = '/checkout';\nconst DEFAULT_MAX_BODY_BYTES = 64 * 1024;\nconst BROWSER_FINALIZED_RESULT_MARKERS = new Set(['paymentinplaceresult']);\n\nexport type SazitoPaymentRouteHandler = (request: Request) => Promise<Response>;\n\nexport interface SazitoCheckoutServerConfig extends SazitoConfig {\n  /** Page that renders `SazitoCheckoutPage` after server verification. */\n  checkoutPath?: string;\n  /** Maximum accepted gateway callback body size. Defaults to 64 KiB. */\n  maxCallbackBodyBytes?: number;\n  /** Replace the built-in gateway-result marker allowlist. */\n  gatewayResultMarkers?: readonly string[];\n}\n\nexport interface SazitoCheckoutServer {\n  handlers: {\n    GET: SazitoPaymentRouteHandler;\n    POST: SazitoPaymentRouteHandler;\n  };\n}\n\n/**\n * Create GET and POST route handlers for payment callbacks.\n * A fresh SDK client is created for each request so server-side guest\n * credentials can never leak between concurrent callbacks.\n */\nexport function SazitoCheckout(config: SazitoCheckoutServerConfig): SazitoCheckoutServer {\n  const {\n    checkoutPath = DEFAULT_CHECKOUT_PATH,\n    maxCallbackBodyBytes = DEFAULT_MAX_BODY_BYTES,\n    gatewayResultMarkers,\n    ...sdkConfig\n  } = config;\n\n  validateConfig(sdkConfig, checkoutPath, maxCallbackBodyBytes);\n  const parserOptions: PaymentReturnParserOptions = { gatewayResultMarkers };\n\n  const createHandler = (method: 'GET' | 'POST'): SazitoPaymentRouteHandler =>\n    async (request) => {\n      if (request.method.toUpperCase() !== method) {\n        return errorResponse(405, 'method_not_allowed', { Allow: method });\n      }\n\n      try {\n        const callback = parsePaymentReturnUrl(request.url, parserOptions);\n        if (!callback || callback.resolution === 'status') {\n          return errorResponse(400, 'invalid_payment_callback');\n        }\n\n        const requestUrl = new URL(request.url);\n        const body = method === 'POST'\n          ? await readCallbackBody(request, maxCallbackBodyBytes)\n          : undefined;\n        const query = fieldsFromSearchParams(requestUrl.searchParams);\n\n        // Payment-in-place uses an empty POST only to return control to the\n        // storefront. Processing it on the server and then performing a status\n        // read in the browser calls process_payment_step twice; some deployments\n        // report the second call as failed even though the first one created the\n        // order. Redirect the empty first-party callback to the browser so the\n        // order is finalized exactly once and the returned order can be rendered.\n        if (shouldFinalizeInBrowser(requestUrl, body, query)) {\n          return redirectResponse(createPaymentReturnRedirectUrl(\n            requestUrl,\n            checkoutPath,\n            callback.payment,\n            'callback'\n          ));\n        }\n\n        const client = createSazitoClient(sdkConfig);\n        const verification = await client.payments.verifyPaymentCallback({\n          paymentId: callback.payment.id,\n          paymentIdentifier: callback.payment.identifier,\n          body,\n          query\n        });\n\n        if (verification.error || !verification.data) {\n          if (sdkConfig.debug) {\n            console.error('[Sazito Checkout] Payment callback verification failed:', {\n              paymentId: callback.payment.id,\n              error: verification.error\n            });\n          }\n          return errorResponse(502, 'payment_verification_failed');\n        }\n\n        const redirectUrl = createPaymentReturnRedirectUrl(\n          requestUrl,\n          checkoutPath,\n          callback.payment,\n          'status'\n        );\n        return redirectResponse(redirectUrl);\n      } catch (error) {\n        if (config.debug) {\n          console.error('[Sazito Checkout] Invalid payment callback request:', error);\n        }\n        const status = error instanceof CallbackRequestError ? error.status : 500;\n        const code = error instanceof CallbackRequestError\n          ? error.code\n          : 'payment_callback_failed';\n        return errorResponse(status, code);\n      }\n    };\n\n  return {\n    handlers: {\n      GET: createHandler('GET'),\n      POST: createHandler('POST')\n    }\n  };\n}\n\nfunction validateConfig(\n  config: SazitoConfig,\n  checkoutPath: string,\n  maxCallbackBodyBytes: number\n): void {\n  if (!config.domain?.trim()) {\n    throw new Error('[@sazito/checkout] `domain` is required by the payment callback handler.');\n  }\n  if (!checkoutPath.trim()) {\n    throw new Error('[@sazito/checkout] `checkoutPath` cannot be empty.');\n  }\n  if (!Number.isSafeInteger(maxCallbackBodyBytes) || maxCallbackBodyBytes <= 0) {\n    throw new Error('[@sazito/checkout] `maxCallbackBodyBytes` must be a positive integer.');\n  }\n}\n\nasync function readCallbackBody(\n  request: Request,\n  maxBodyBytes: number\n): Promise<PaymentCallbackFields> {\n  const declaredLength = Number(request.headers.get('content-length') ?? 0);\n  if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {\n    throw new CallbackRequestError(413, 'payment_callback_too_large');\n  }\n\n  const bytes = await request.arrayBuffer();\n  if (bytes.byteLength > maxBodyBytes) {\n    throw new CallbackRequestError(413, 'payment_callback_too_large');\n  }\n  if (bytes.byteLength === 0) return {};\n\n  const contentType = request.headers.get('content-type')?.toLowerCase() ?? '';\n  if (contentType.includes('application/json')) {\n    return fieldsFromJson(new TextDecoder().decode(bytes));\n  }\n  if (contentType.includes('multipart/form-data')) {\n    const form = await new Response(bytes, {\n      headers: { 'Content-Type': request.headers.get('content-type') ?? '' }\n    }).formData();\n    return fieldsFromFormData(form);\n  }\n\n  // Gateways commonly omit Content-Type or label URL-encoded data as text.\n  return fieldsFromSearchParams(new URLSearchParams(new TextDecoder().decode(bytes)));\n}\n\nfunction fieldsFromJson(source: string): PaymentCallbackFields {\n  let value: unknown;\n  try {\n    value = JSON.parse(source);\n  } catch {\n    throw new CallbackRequestError(400, 'invalid_payment_callback_body');\n  }\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new CallbackRequestError(400, 'invalid_payment_callback_body');\n  }\n  return value as PaymentCallbackFields;\n}\n\nfunction fieldsFromSearchParams(params: URLSearchParams): PaymentCallbackFields {\n  const fields: PaymentCallbackFields = {};\n  for (const [name, value] of params) appendField(fields, name, value);\n  return fields;\n}\n\nfunction fieldsFromFormData(form: FormData): PaymentCallbackFields {\n  const fields: PaymentCallbackFields = {};\n  for (const [name, value] of form) {\n    if (typeof value !== 'string') {\n      throw new CallbackRequestError(400, 'unsupported_payment_callback_file');\n    }\n    appendField(fields, name, value);\n  }\n  return fields;\n}\n\nfunction appendField(\n  fields: PaymentCallbackFields,\n  name: string,\n  value: PaymentCallbackFieldValue\n): void {\n  const current = fields[name];\n  if (current === undefined) {\n    fields[name] = value;\n  } else if (Array.isArray(current)) {\n    fields[name] = [...current, value ?? null];\n  } else {\n    fields[name] = [current, value ?? null];\n  }\n}\n\nfunction shouldFinalizeInBrowser(\n  requestUrl: URL,\n  body: PaymentCallbackFields | undefined,\n  query: PaymentCallbackFields\n): boolean {\n  const pathSegments = requestUrl.pathname\n    .split('/')\n    .filter(Boolean);\n  const resultMarker = pathSegments[pathSegments.length - 5]?.toLowerCase();\n\n  return Boolean(\n    resultMarker &&\n    BROWSER_FINALIZED_RESULT_MARKERS.has(resultMarker) &&\n    Object.keys(body ?? {}).length === 0 &&\n    Object.keys(query).length === 0\n  );\n}\n\nfunction createPaymentReturnRedirectUrl(\n  requestUrl: URL,\n  checkoutPath: string,\n  payment: { id: number; identifier: string },\n  resolution: 'callback' | 'status'\n): URL {\n  const redirectUrl = new URL(checkoutPath, requestUrl.origin);\n  redirectUrl.searchParams.set(SAZITO_PAYMENT_STATUS_QUERY.resolution, resolution);\n  redirectUrl.searchParams.set(SAZITO_PAYMENT_STATUS_QUERY.paymentId, String(payment.id));\n  redirectUrl.searchParams.set(\n    SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier,\n    payment.identifier\n  );\n  return redirectUrl;\n}\n\nfunction redirectResponse(url: URL): Response {\n  return new Response(null, {\n    status: 303,\n    headers: {\n      Location: url.toString(),\n      'Cache-Control': 'no-store',\n      'Referrer-Policy': 'no-referrer'\n    }\n  });\n}\n\nfunction errorResponse(\n  status: number,\n  code: string,\n  extraHeaders: Record<string, string> = {}\n): Response {\n  return Response.json(\n    { error: code },\n    {\n      status,\n      headers: {\n        'Cache-Control': 'no-store',\n        ...extraHeaders\n      }\n    }\n  );\n}\n\nclass CallbackRequestError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string\n  ) {\n    super(code);\n  }\n}\n"],"names":["parsePaymentReturnUrl","createSazitoClient","SAZITO_PAYMENT_STATUS_QUERY"],"mappings":";;;;;AAAA;;;;;AAKG;AAaH,MAAM,qBAAqB,GAAG,WAAW;AACzC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI;AACxC,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC;AAoB1E;;;;AAIG;AACG,SAAU,cAAc,CAAC,MAAkC,EAAA;AAC/D,IAAA,MAAM,EACJ,YAAY,GAAG,qBAAqB,EACpC,oBAAoB,GAAG,sBAAsB,EAC7C,oBAAoB,EACpB,GAAG,SAAS,EACb,GAAG,MAAM;AAEV,IAAA,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,oBAAoB,CAAC;AAC7D,IAAA,MAAM,aAAa,GAA+B,EAAE,oBAAoB,EAAE;IAE1E,MAAM,aAAa,GAAG,CAAC,MAAsB,KAC3C,OAAO,OAAO,KAAI;QAChB,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE;AAC3C,YAAA,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpE;AAEA,QAAA,IAAI;YACF,MAAM,QAAQ,GAAGA,wCAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC;YAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;AACjD,gBAAA,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,CAAC;YACvD;YAEA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;AACvC,YAAA,MAAM,IAAI,GAAG,MAAM,KAAK;AACtB,kBAAE,MAAM,gBAAgB,CAAC,OAAO,EAAE,oBAAoB;kBACpD,SAAS;YACb,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,YAAY,CAAC;;;;;;;YAQ7D,IAAI,uBAAuB,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;AACpD,gBAAA,OAAO,gBAAgB,CAAC,8BAA8B,CACpD,UAAU,EACV,YAAY,EACZ,QAAQ,CAAC,OAAO,EAChB,UAAU,CACX,CAAC;YACJ;AAEA,YAAA,MAAM,MAAM,GAAGC,4BAAkB,CAAC,SAAS,CAAC;YAC5C,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;AAC/D,gBAAA,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE;AAC9B,gBAAA,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;gBAC9C,IAAI;gBACJ;AACD,aAAA,CAAC;YAEF,IAAI,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;AAC5C,gBAAA,IAAI,SAAS,CAAC,KAAK,EAAE;AACnB,oBAAA,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE;AACvE,wBAAA,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE;wBAC9B,KAAK,EAAE,YAAY,CAAC;AACrB,qBAAA,CAAC;gBACJ;AACA,gBAAA,OAAO,aAAa,CAAC,GAAG,EAAE,6BAA6B,CAAC;YAC1D;AAEA,YAAA,MAAM,WAAW,GAAG,8BAA8B,CAChD,UAAU,EACV,YAAY,EACZ,QAAQ,CAAC,OAAO,EAChB,QAAQ,CACT;AACD,YAAA,OAAO,gBAAgB,CAAC,WAAW,CAAC;QACtC;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,IAAI,MAAM,CAAC,KAAK,EAAE;AAChB,gBAAA,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC;YAC7E;AACA,YAAA,MAAM,MAAM,GAAG,KAAK,YAAY,oBAAoB,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG;AACzE,YAAA,MAAM,IAAI,GAAG,KAAK,YAAY;kBAC1B,KAAK,CAAC;kBACN,yBAAyB;AAC7B,YAAA,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QACpC;AACF,IAAA,CAAC;IAEH,OAAO;AACL,QAAA,QAAQ,EAAE;AACR,YAAA,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC;AACzB,YAAA,IAAI,EAAE,aAAa,CAAC,MAAM;AAC3B;KACF;AACH;AAEA,SAAS,cAAc,CACrB,MAAoB,EACpB,YAAoB,EACpB,oBAA4B,EAAA;IAE5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;AAC1B,QAAA,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC;IAC7F;AACA,IAAA,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;AACxB,QAAA,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC;IACvE;AACA,IAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,IAAI,CAAC,EAAE;AAC5E,QAAA,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC;IAC1F;AACF;AAEA,eAAe,gBAAgB,CAC7B,OAAgB,EAChB,YAAoB,EAAA;AAEpB,IAAA,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,YAAY,EAAE;AACpE,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,4BAA4B,CAAC;IACnE;AAEA,IAAA,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE;AACzC,IAAA,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY,EAAE;AACnC,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,4BAA4B,CAAC;IACnE;AACA,IAAA,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;AAAE,QAAA,OAAO,EAAE;AAErC,IAAA,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;AAC5E,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE;QAC5C,OAAO,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD;AACA,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE;AAC/C,QAAA,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE;AACrC,YAAA,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;SACrE,CAAC,CAAC,QAAQ,EAAE;AACb,QAAA,OAAO,kBAAkB,CAAC,IAAI,CAAC;IACjC;;AAGA,IAAA,OAAO,sBAAsB,CAAC,IAAI,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrF;AAEA,SAAS,cAAc,CAAC,MAAc,EAAA;AACpC,IAAA,IAAI,KAAc;AAClB,IAAA,IAAI;AACF,QAAA,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5B;AAAE,IAAA,MAAM;AACN,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,+BAA+B,CAAC;IACtE;AACA,IAAA,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AAC/D,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,+BAA+B,CAAC;IACtE;AACA,IAAA,OAAO,KAA8B;AACvC;AAEA,SAAS,sBAAsB,CAAC,MAAuB,EAAA;IACrD,MAAM,MAAM,GAA0B,EAAE;AACxC,IAAA,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM;AAAE,QAAA,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;AACpE,IAAA,OAAO,MAAM;AACf;AAEA,SAAS,kBAAkB,CAAC,IAAc,EAAA;IACxC,MAAM,MAAM,GAA0B,EAAE;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;AAChC,QAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,YAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,mCAAmC,CAAC;QAC1E;AACA,QAAA,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;IAClC;AACA,IAAA,OAAO,MAAM;AACf;AAEA,SAAS,WAAW,CAClB,MAA6B,EAC7B,IAAY,EACZ,KAAgC,EAAA;AAEhC,IAAA,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,IAAA,IAAI,OAAO,KAAK,SAAS,EAAE;AACzB,QAAA,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK;IACtB;AAAO,SAAA,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;AACjC,QAAA,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5C;SAAO;QACL,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACzC;AACF;AAEA,SAAS,uBAAuB,CAC9B,UAAe,EACf,IAAuC,EACvC,KAA4B,EAAA;AAE5B,IAAA,MAAM,YAAY,GAAG,UAAU,CAAC;SAC7B,KAAK,CAAC,GAAG;SACT,MAAM,CAAC,OAAO,CAAC;AAClB,IAAA,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE;IAEzE,OAAO,OAAO,CACZ,YAAY;AACZ,QAAA,gCAAgC,CAAC,GAAG,CAAC,YAAY,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAChC;AACH;AAEA,SAAS,8BAA8B,CACrC,UAAe,EACf,YAAoB,EACpB,OAA2C,EAC3C,UAAiC,EAAA;IAEjC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC;IAC5D,WAAW,CAAC,YAAY,CAAC,GAAG,CAACC,8CAA2B,CAAC,UAAU,EAAE,UAAU,CAAC;AAChF,IAAA,WAAW,CAAC,YAAY,CAAC,GAAG,CAACA,8CAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACvF,IAAA,WAAW,CAAC,YAAY,CAAC,GAAG,CAC1BA,8CAA2B,CAAC,iBAAiB,EAC7C,OAAO,CAAC,UAAU,CACnB;AACD,IAAA,OAAO,WAAW;AACpB;AAEA,SAAS,gBAAgB,CAAC,GAAQ,EAAA;AAChC,IAAA,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;AACxB,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,OAAO,EAAE;AACP,YAAA,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;AACxB,YAAA,eAAe,EAAE,UAAU;AAC3B,YAAA,iBAAiB,EAAE;AACpB;AACF,KAAA,CAAC;AACJ;AAEA,SAAS,aAAa,CACpB,MAAc,EACd,IAAY,EACZ,eAAuC,EAAE,EAAA;IAEzC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,IAAI,EAAE,EACf;QACE,MAAM;AACN,QAAA,OAAO,EAAE;AACP,YAAA,eAAe,EAAE,UAAU;AAC3B,YAAA,GAAG;AACJ;AACF,KAAA,CACF;AACH;AAEA,MAAM,oBAAqB,SAAQ,KAAK,CAAA;IACtC,WAAA,CACW,MAAc,EACd,IAAY,EAAA;QAErB,KAAK,CAAC,IAAI,CAAC;QAHF,IAAA,CAAA,MAAM,GAAN,MAAM;QACN,IAAA,CAAA,IAAI,GAAJ,IAAI;IAGf;AACD;;;;"}

package/dist/server/index.d.cts

@@ -0,0 +1,33 @@
+import { SazitoConfig } from '@sazito/client-sdk';
+
+/**
+ * @sazito/checkout/server — server-only payment callback handlers.
+ *
+ * The implementation uses only the standard Web Request/Response APIs so the
+ * same handlers work in Next.js Route Handlers and other compatible runtimes.
+ */
+
+type SazitoPaymentRouteHandler = (request: Request) => Promise<Response>;
+interface SazitoCheckoutServerConfig extends SazitoConfig {
+    /** Page that renders `SazitoCheckoutPage` after server verification. */
+    checkoutPath?: string;
+    /** Maximum accepted gateway callback body size. Defaults to 64 KiB. */
+    maxCallbackBodyBytes?: number;
+    /** Replace the built-in gateway-result marker allowlist. */
+    gatewayResultMarkers?: readonly string[];
+}
+interface SazitoCheckoutServer {
+    handlers: {
+        GET: SazitoPaymentRouteHandler;
+        POST: SazitoPaymentRouteHandler;
+    };
+}
+/**
+ * Create GET and POST route handlers for payment callbacks.
+ * A fresh SDK client is created for each request so server-side guest
+ * credentials can never leak between concurrent callbacks.
+ */
+declare function SazitoCheckout(config: SazitoCheckoutServerConfig): SazitoCheckoutServer;
+
+export { SazitoCheckout };
+export type { SazitoCheckoutServer, SazitoCheckoutServerConfig, SazitoPaymentRouteHandler };

package/dist/server/index.d.ts

@@ -0,0 +1,33 @@
+import { SazitoConfig } from '@sazito/client-sdk';
+
+/**
+ * @sazito/checkout/server — server-only payment callback handlers.
+ *
+ * The implementation uses only the standard Web Request/Response APIs so the
+ * same handlers work in Next.js Route Handlers and other compatible runtimes.
+ */
+
+type SazitoPaymentRouteHandler = (request: Request) => Promise<Response>;
+interface SazitoCheckoutServerConfig extends SazitoConfig {
+    /** Page that renders `SazitoCheckoutPage` after server verification. */
+    checkoutPath?: string;
+    /** Maximum accepted gateway callback body size. Defaults to 64 KiB. */
+    maxCallbackBodyBytes?: number;
+    /** Replace the built-in gateway-result marker allowlist. */
+    gatewayResultMarkers?: readonly string[];
+}
+interface SazitoCheckoutServer {
+    handlers: {
+        GET: SazitoPaymentRouteHandler;
+        POST: SazitoPaymentRouteHandler;
+    };
+}
+/**
+ * Create GET and POST route handlers for payment callbacks.
+ * A fresh SDK client is created for each request so server-side guest
+ * credentials can never leak between concurrent callbacks.
+ */
+declare function SazitoCheckout(config: SazitoCheckoutServerConfig): SazitoCheckoutServer;
+
+export { SazitoCheckout };
+export type { SazitoCheckoutServer, SazitoCheckoutServerConfig, SazitoPaymentRouteHandler };

package/dist/server/index.js

@@ -0,0 +1,203 @@
+import { createSazitoClient } from '@sazito/client-sdk';
+import { parsePaymentReturnUrl, SAZITO_PAYMENT_STATUS_QUERY } from '../next/payment-return.js';
+
+/**
+ * @sazito/checkout/server — server-only payment callback handlers.
+ *
+ * The implementation uses only the standard Web Request/Response APIs so the
+ * same handlers work in Next.js Route Handlers and other compatible runtimes.
+ */
+const DEFAULT_CHECKOUT_PATH = '/checkout';
+const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+const BROWSER_FINALIZED_RESULT_MARKERS = new Set(['paymentinplaceresult']);
+/**
+ * Create GET and POST route handlers for payment callbacks.
+ * A fresh SDK client is created for each request so server-side guest
+ * credentials can never leak between concurrent callbacks.
+ */
+function SazitoCheckout(config) {
+    const { checkoutPath = DEFAULT_CHECKOUT_PATH, maxCallbackBodyBytes = DEFAULT_MAX_BODY_BYTES, gatewayResultMarkers, ...sdkConfig } = config;
+    validateConfig(sdkConfig, checkoutPath, maxCallbackBodyBytes);
+    const parserOptions = { gatewayResultMarkers };
+    const createHandler = (method) => async (request) => {
+        if (request.method.toUpperCase() !== method) {
+            return errorResponse(405, 'method_not_allowed', { Allow: method });
+        }
+        try {
+            const callback = parsePaymentReturnUrl(request.url, parserOptions);
+            if (!callback || callback.resolution === 'status') {
+                return errorResponse(400, 'invalid_payment_callback');
+            }
+            const requestUrl = new URL(request.url);
+            const body = method === 'POST'
+                ? await readCallbackBody(request, maxCallbackBodyBytes)
+                : undefined;
+            const query = fieldsFromSearchParams(requestUrl.searchParams);
+            // Payment-in-place uses an empty POST only to return control to the
+            // storefront. Processing it on the server and then performing a status
+            // read in the browser calls process_payment_step twice; some deployments
+            // report the second call as failed even though the first one created the
+            // order. Redirect the empty first-party callback to the browser so the
+            // order is finalized exactly once and the returned order can be rendered.
+            if (shouldFinalizeInBrowser(requestUrl, body, query)) {
+                return redirectResponse(createPaymentReturnRedirectUrl(requestUrl, checkoutPath, callback.payment, 'callback'));
+            }
+            const client = createSazitoClient(sdkConfig);
+            const verification = await client.payments.verifyPaymentCallback({
+                paymentId: callback.payment.id,
+                paymentIdentifier: callback.payment.identifier,
+                body,
+                query
+            });
+            if (verification.error || !verification.data) {
+                if (sdkConfig.debug) {
+                    console.error('[Sazito Checkout] Payment callback verification failed:', {
+                        paymentId: callback.payment.id,
+                        error: verification.error
+                    });
+                }
+                return errorResponse(502, 'payment_verification_failed');
+            }
+            const redirectUrl = createPaymentReturnRedirectUrl(requestUrl, checkoutPath, callback.payment, 'status');
+            return redirectResponse(redirectUrl);
+        }
+        catch (error) {
+            if (config.debug) {
+                console.error('[Sazito Checkout] Invalid payment callback request:', error);
+            }
+            const status = error instanceof CallbackRequestError ? error.status : 500;
+            const code = error instanceof CallbackRequestError
+                ? error.code
+                : 'payment_callback_failed';
+            return errorResponse(status, code);
+        }
+    };
+    return {
+        handlers: {
+            GET: createHandler('GET'),
+            POST: createHandler('POST')
+        }
+    };
+}
+function validateConfig(config, checkoutPath, maxCallbackBodyBytes) {
+    if (!config.domain?.trim()) {
+        throw new Error('[@sazito/checkout] `domain` is required by the payment callback handler.');
+    }
+    if (!checkoutPath.trim()) {
+        throw new Error('[@sazito/checkout] `checkoutPath` cannot be empty.');
+    }
+    if (!Number.isSafeInteger(maxCallbackBodyBytes) || maxCallbackBodyBytes <= 0) {
+        throw new Error('[@sazito/checkout] `maxCallbackBodyBytes` must be a positive integer.');
+    }
+}
+async function readCallbackBody(request, maxBodyBytes) {
+    const declaredLength = Number(request.headers.get('content-length') ?? 0);
+    if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+        throw new CallbackRequestError(413, 'payment_callback_too_large');
+    }
+    const bytes = await request.arrayBuffer();
+    if (bytes.byteLength > maxBodyBytes) {
+        throw new CallbackRequestError(413, 'payment_callback_too_large');
+    }
+    if (bytes.byteLength === 0)
+        return {};
+    const contentType = request.headers.get('content-type')?.toLowerCase() ?? '';
+    if (contentType.includes('application/json')) {
+        return fieldsFromJson(new TextDecoder().decode(bytes));
+    }
+    if (contentType.includes('multipart/form-data')) {
+        const form = await new Response(bytes, {
+            headers: { 'Content-Type': request.headers.get('content-type') ?? '' }
+        }).formData();
+        return fieldsFromFormData(form);
+    }
+    // Gateways commonly omit Content-Type or label URL-encoded data as text.
+    return fieldsFromSearchParams(new URLSearchParams(new TextDecoder().decode(bytes)));
+}
+function fieldsFromJson(source) {
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new CallbackRequestError(400, 'invalid_payment_callback_body');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new CallbackRequestError(400, 'invalid_payment_callback_body');
+    }
+    return value;
+}
+function fieldsFromSearchParams(params) {
+    const fields = {};
+    for (const [name, value] of params)
+        appendField(fields, name, value);
+    return fields;
+}
+function fieldsFromFormData(form) {
+    const fields = {};
+    for (const [name, value] of form) {
+        if (typeof value !== 'string') {
+            throw new CallbackRequestError(400, 'unsupported_payment_callback_file');
+        }
+        appendField(fields, name, value);
+    }
+    return fields;
+}
+function appendField(fields, name, value) {
+    const current = fields[name];
+    if (current === undefined) {
+        fields[name] = value;
+    }
+    else if (Array.isArray(current)) {
+        fields[name] = [...current, value ?? null];
+    }
+    else {
+        fields[name] = [current, value ?? null];
+    }
+}
+function shouldFinalizeInBrowser(requestUrl, body, query) {
+    const pathSegments = requestUrl.pathname
+        .split('/')
+        .filter(Boolean);
+    const resultMarker = pathSegments[pathSegments.length - 5]?.toLowerCase();
+    return Boolean(resultMarker &&
+        BROWSER_FINALIZED_RESULT_MARKERS.has(resultMarker) &&
+        Object.keys(body ?? {}).length === 0 &&
+        Object.keys(query).length === 0);
+}
+function createPaymentReturnRedirectUrl(requestUrl, checkoutPath, payment, resolution) {
+    const redirectUrl = new URL(checkoutPath, requestUrl.origin);
+    redirectUrl.searchParams.set(SAZITO_PAYMENT_STATUS_QUERY.resolution, resolution);
+    redirectUrl.searchParams.set(SAZITO_PAYMENT_STATUS_QUERY.paymentId, String(payment.id));
+    redirectUrl.searchParams.set(SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier, payment.identifier);
+    return redirectUrl;
+}
+function redirectResponse(url) {
+    return new Response(null, {
+        status: 303,
+        headers: {
+            Location: url.toString(),
+            'Cache-Control': 'no-store',
+            'Referrer-Policy': 'no-referrer'
+        }
+    });
+}
+function errorResponse(status, code, extraHeaders = {}) {
+    return Response.json({ error: code }, {
+        status,
+        headers: {
+            'Cache-Control': 'no-store',
+            ...extraHeaders
+        }
+    });
+}
+class CallbackRequestError extends Error {
+    constructor(status, code) {
+        super(code);
+        this.status = status;
+        this.code = code;
+    }
+}
+
+export { SazitoCheckout };
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../src/server/index.ts"],"sourcesContent":["/**\n * @sazito/checkout/server — server-only payment callback handlers.\n *\n * The implementation uses only the standard Web Request/Response APIs so the\n * same handlers work in Next.js Route Handlers and other compatible runtimes.\n */\nimport {\n  createSazitoClient,\n  type PaymentCallbackFieldValue,\n  type PaymentCallbackFields,\n  type SazitoConfig\n} from '@sazito/client-sdk';\nimport {\n  parsePaymentReturnUrl,\n  SAZITO_PAYMENT_STATUS_QUERY\n} from '../core/payment-return';\nimport type { PaymentReturnParserOptions } from '../core/types';\n\nconst DEFAULT_CHECKOUT_PATH = '/checkout';\nconst DEFAULT_MAX_BODY_BYTES = 64 * 1024;\nconst BROWSER_FINALIZED_RESULT_MARKERS = new Set(['paymentinplaceresult']);\n\nexport type SazitoPaymentRouteHandler = (request: Request) => Promise<Response>;\n\nexport interface SazitoCheckoutServerConfig extends SazitoConfig {\n  /** Page that renders `SazitoCheckoutPage` after server verification. */\n  checkoutPath?: string;\n  /** Maximum accepted gateway callback body size. Defaults to 64 KiB. */\n  maxCallbackBodyBytes?: number;\n  /** Replace the built-in gateway-result marker allowlist. */\n  gatewayResultMarkers?: readonly string[];\n}\n\nexport interface SazitoCheckoutServer {\n  handlers: {\n    GET: SazitoPaymentRouteHandler;\n    POST: SazitoPaymentRouteHandler;\n  };\n}\n\n/**\n * Create GET and POST route handlers for payment callbacks.\n * A fresh SDK client is created for each request so server-side guest\n * credentials can never leak between concurrent callbacks.\n */\nexport function SazitoCheckout(config: SazitoCheckoutServerConfig): SazitoCheckoutServer {\n  const {\n    checkoutPath = DEFAULT_CHECKOUT_PATH,\n    maxCallbackBodyBytes = DEFAULT_MAX_BODY_BYTES,\n    gatewayResultMarkers,\n    ...sdkConfig\n  } = config;\n\n  validateConfig(sdkConfig, checkoutPath, maxCallbackBodyBytes);\n  const parserOptions: PaymentReturnParserOptions = { gatewayResultMarkers };\n\n  const createHandler = (method: 'GET' | 'POST'): SazitoPaymentRouteHandler =>\n    async (request) => {\n      if (request.method.toUpperCase() !== method) {\n        return errorResponse(405, 'method_not_allowed', { Allow: method });\n      }\n\n      try {\n        const callback = parsePaymentReturnUrl(request.url, parserOptions);\n        if (!callback || callback.resolution === 'status') {\n          return errorResponse(400, 'invalid_payment_callback');\n        }\n\n        const requestUrl = new URL(request.url);\n        const body = method === 'POST'\n          ? await readCallbackBody(request, maxCallbackBodyBytes)\n          : undefined;\n        const query = fieldsFromSearchParams(requestUrl.searchParams);\n\n        // Payment-in-place uses an empty POST only to return control to the\n        // storefront. Processing it on the server and then performing a status\n        // read in the browser calls process_payment_step twice; some deployments\n        // report the second call as failed even though the first one created the\n        // order. Redirect the empty first-party callback to the browser so the\n        // order is finalized exactly once and the returned order can be rendered.\n        if (shouldFinalizeInBrowser(requestUrl, body, query)) {\n          return redirectResponse(createPaymentReturnRedirectUrl(\n            requestUrl,\n            checkoutPath,\n            callback.payment,\n            'callback'\n          ));\n        }\n\n        const client = createSazitoClient(sdkConfig);\n        const verification = await client.payments.verifyPaymentCallback({\n          paymentId: callback.payment.id,\n          paymentIdentifier: callback.payment.identifier,\n          body,\n          query\n        });\n\n        if (verification.error || !verification.data) {\n          if (sdkConfig.debug) {\n            console.error('[Sazito Checkout] Payment callback verification failed:', {\n              paymentId: callback.payment.id,\n              error: verification.error\n            });\n          }\n          return errorResponse(502, 'payment_verification_failed');\n        }\n\n        const redirectUrl = createPaymentReturnRedirectUrl(\n          requestUrl,\n          checkoutPath,\n          callback.payment,\n          'status'\n        );\n        return redirectResponse(redirectUrl);\n      } catch (error) {\n        if (config.debug) {\n          console.error('[Sazito Checkout] Invalid payment callback request:', error);\n        }\n        const status = error instanceof CallbackRequestError ? error.status : 500;\n        const code = error instanceof CallbackRequestError\n          ? error.code\n          : 'payment_callback_failed';\n        return errorResponse(status, code);\n      }\n    };\n\n  return {\n    handlers: {\n      GET: createHandler('GET'),\n      POST: createHandler('POST')\n    }\n  };\n}\n\nfunction validateConfig(\n  config: SazitoConfig,\n  checkoutPath: string,\n  maxCallbackBodyBytes: number\n): void {\n  if (!config.domain?.trim()) {\n    throw new Error('[@sazito/checkout] `domain` is required by the payment callback handler.');\n  }\n  if (!checkoutPath.trim()) {\n    throw new Error('[@sazito/checkout] `checkoutPath` cannot be empty.');\n  }\n  if (!Number.isSafeInteger(maxCallbackBodyBytes) || maxCallbackBodyBytes <= 0) {\n    throw new Error('[@sazito/checkout] `maxCallbackBodyBytes` must be a positive integer.');\n  }\n}\n\nasync function readCallbackBody(\n  request: Request,\n  maxBodyBytes: number\n): Promise<PaymentCallbackFields> {\n  const declaredLength = Number(request.headers.get('content-length') ?? 0);\n  if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {\n    throw new CallbackRequestError(413, 'payment_callback_too_large');\n  }\n\n  const bytes = await request.arrayBuffer();\n  if (bytes.byteLength > maxBodyBytes) {\n    throw new CallbackRequestError(413, 'payment_callback_too_large');\n  }\n  if (bytes.byteLength === 0) return {};\n\n  const contentType = request.headers.get('content-type')?.toLowerCase() ?? '';\n  if (contentType.includes('application/json')) {\n    return fieldsFromJson(new TextDecoder().decode(bytes));\n  }\n  if (contentType.includes('multipart/form-data')) {\n    const form = await new Response(bytes, {\n      headers: { 'Content-Type': request.headers.get('content-type') ?? '' }\n    }).formData();\n    return fieldsFromFormData(form);\n  }\n\n  // Gateways commonly omit Content-Type or label URL-encoded data as text.\n  return fieldsFromSearchParams(new URLSearchParams(new TextDecoder().decode(bytes)));\n}\n\nfunction fieldsFromJson(source: string): PaymentCallbackFields {\n  let value: unknown;\n  try {\n    value = JSON.parse(source);\n  } catch {\n    throw new CallbackRequestError(400, 'invalid_payment_callback_body');\n  }\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new CallbackRequestError(400, 'invalid_payment_callback_body');\n  }\n  return value as PaymentCallbackFields;\n}\n\nfunction fieldsFromSearchParams(params: URLSearchParams): PaymentCallbackFields {\n  const fields: PaymentCallbackFields = {};\n  for (const [name, value] of params) appendField(fields, name, value);\n  return fields;\n}\n\nfunction fieldsFromFormData(form: FormData): PaymentCallbackFields {\n  const fields: PaymentCallbackFields = {};\n  for (const [name, value] of form) {\n    if (typeof value !== 'string') {\n      throw new CallbackRequestError(400, 'unsupported_payment_callback_file');\n    }\n    appendField(fields, name, value);\n  }\n  return fields;\n}\n\nfunction appendField(\n  fields: PaymentCallbackFields,\n  name: string,\n  value: PaymentCallbackFieldValue\n): void {\n  const current = fields[name];\n  if (current === undefined) {\n    fields[name] = value;\n  } else if (Array.isArray(current)) {\n    fields[name] = [...current, value ?? null];\n  } else {\n    fields[name] = [current, value ?? null];\n  }\n}\n\nfunction shouldFinalizeInBrowser(\n  requestUrl: URL,\n  body: PaymentCallbackFields | undefined,\n  query: PaymentCallbackFields\n): boolean {\n  const pathSegments = requestUrl.pathname\n    .split('/')\n    .filter(Boolean);\n  const resultMarker = pathSegments[pathSegments.length - 5]?.toLowerCase();\n\n  return Boolean(\n    resultMarker &&\n    BROWSER_FINALIZED_RESULT_MARKERS.has(resultMarker) &&\n    Object.keys(body ?? {}).length === 0 &&\n    Object.keys(query).length === 0\n  );\n}\n\nfunction createPaymentReturnRedirectUrl(\n  requestUrl: URL,\n  checkoutPath: string,\n  payment: { id: number; identifier: string },\n  resolution: 'callback' | 'status'\n): URL {\n  const redirectUrl = new URL(checkoutPath, requestUrl.origin);\n  redirectUrl.searchParams.set(SAZITO_PAYMENT_STATUS_QUERY.resolution, resolution);\n  redirectUrl.searchParams.set(SAZITO_PAYMENT_STATUS_QUERY.paymentId, String(payment.id));\n  redirectUrl.searchParams.set(\n    SAZITO_PAYMENT_STATUS_QUERY.paymentIdentifier,\n    payment.identifier\n  );\n  return redirectUrl;\n}\n\nfunction redirectResponse(url: URL): Response {\n  return new Response(null, {\n    status: 303,\n    headers: {\n      Location: url.toString(),\n      'Cache-Control': 'no-store',\n      'Referrer-Policy': 'no-referrer'\n    }\n  });\n}\n\nfunction errorResponse(\n  status: number,\n  code: string,\n  extraHeaders: Record<string, string> = {}\n): Response {\n  return Response.json(\n    { error: code },\n    {\n      status,\n      headers: {\n        'Cache-Control': 'no-store',\n        ...extraHeaders\n      }\n    }\n  );\n}\n\nclass CallbackRequestError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string\n  ) {\n    super(code);\n  }\n}\n"],"names":[],"mappings":";;;AAAA;;;;;AAKG;AAaH,MAAM,qBAAqB,GAAG,WAAW;AACzC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI;AACxC,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC;AAoB1E;;;;AAIG;AACG,SAAU,cAAc,CAAC,MAAkC,EAAA;AAC/D,IAAA,MAAM,EACJ,YAAY,GAAG,qBAAqB,EACpC,oBAAoB,GAAG,sBAAsB,EAC7C,oBAAoB,EACpB,GAAG,SAAS,EACb,GAAG,MAAM;AAEV,IAAA,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,oBAAoB,CAAC;AAC7D,IAAA,MAAM,aAAa,GAA+B,EAAE,oBAAoB,EAAE;IAE1E,MAAM,aAAa,GAAG,CAAC,MAAsB,KAC3C,OAAO,OAAO,KAAI;QAChB,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE;AAC3C,YAAA,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpE;AAEA,QAAA,IAAI;YACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC;YAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;AACjD,gBAAA,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,CAAC;YACvD;YAEA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;AACvC,YAAA,MAAM,IAAI,GAAG,MAAM,KAAK;AACtB,kBAAE,MAAM,gBAAgB,CAAC,OAAO,EAAE,oBAAoB;kBACpD,SAAS;YACb,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,YAAY,CAAC;;;;;;;YAQ7D,IAAI,uBAAuB,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;AACpD,gBAAA,OAAO,gBAAgB,CAAC,8BAA8B,CACpD,UAAU,EACV,YAAY,EACZ,QAAQ,CAAC,OAAO,EAChB,UAAU,CACX,CAAC;YACJ;AAEA,YAAA,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC;YAC5C,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;AAC/D,gBAAA,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE;AAC9B,gBAAA,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;gBAC9C,IAAI;gBACJ;AACD,aAAA,CAAC;YAEF,IAAI,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;AAC5C,gBAAA,IAAI,SAAS,CAAC,KAAK,EAAE;AACnB,oBAAA,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE;AACvE,wBAAA,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE;wBAC9B,KAAK,EAAE,YAAY,CAAC;AACrB,qBAAA,CAAC;gBACJ;AACA,gBAAA,OAAO,aAAa,CAAC,GAAG,EAAE,6BAA6B,CAAC;YAC1D;AAEA,YAAA,MAAM,WAAW,GAAG,8BAA8B,CAChD,UAAU,EACV,YAAY,EACZ,QAAQ,CAAC,OAAO,EAChB,QAAQ,CACT;AACD,YAAA,OAAO,gBAAgB,CAAC,WAAW,CAAC;QACtC;QAAE,OAAO,KAAK,EAAE;AACd,YAAA,IAAI,MAAM,CAAC,KAAK,EAAE;AAChB,gBAAA,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC;YAC7E;AACA,YAAA,MAAM,MAAM,GAAG,KAAK,YAAY,oBAAoB,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG;AACzE,YAAA,MAAM,IAAI,GAAG,KAAK,YAAY;kBAC1B,KAAK,CAAC;kBACN,yBAAyB;AAC7B,YAAA,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QACpC;AACF,IAAA,CAAC;IAEH,OAAO;AACL,QAAA,QAAQ,EAAE;AACR,YAAA,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC;AACzB,YAAA,IAAI,EAAE,aAAa,CAAC,MAAM;AAC3B;KACF;AACH;AAEA,SAAS,cAAc,CACrB,MAAoB,EACpB,YAAoB,EACpB,oBAA4B,EAAA;IAE5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;AAC1B,QAAA,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC;IAC7F;AACA,IAAA,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;AACxB,QAAA,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC;IACvE;AACA,IAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,IAAI,CAAC,EAAE;AAC5E,QAAA,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC;IAC1F;AACF;AAEA,eAAe,gBAAgB,CAC7B,OAAgB,EAChB,YAAoB,EAAA;AAEpB,IAAA,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,YAAY,EAAE;AACpE,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,4BAA4B,CAAC;IACnE;AAEA,IAAA,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE;AACzC,IAAA,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY,EAAE;AACnC,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,4BAA4B,CAAC;IACnE;AACA,IAAA,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;AAAE,QAAA,OAAO,EAAE;AAErC,IAAA,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;AAC5E,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE;QAC5C,OAAO,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD;AACA,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE;AAC/C,QAAA,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE;AACrC,YAAA,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;SACrE,CAAC,CAAC,QAAQ,EAAE;AACb,QAAA,OAAO,kBAAkB,CAAC,IAAI,CAAC;IACjC;;AAGA,IAAA,OAAO,sBAAsB,CAAC,IAAI,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrF;AAEA,SAAS,cAAc,CAAC,MAAc,EAAA;AACpC,IAAA,IAAI,KAAc;AAClB,IAAA,IAAI;AACF,QAAA,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5B;AAAE,IAAA,MAAM;AACN,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,+BAA+B,CAAC;IACtE;AACA,IAAA,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AAC/D,QAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,+BAA+B,CAAC;IACtE;AACA,IAAA,OAAO,KAA8B;AACvC;AAEA,SAAS,sBAAsB,CAAC,MAAuB,EAAA;IACrD,MAAM,MAAM,GAA0B,EAAE;AACxC,IAAA,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM;AAAE,QAAA,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;AACpE,IAAA,OAAO,MAAM;AACf;AAEA,SAAS,kBAAkB,CAAC,IAAc,EAAA;IACxC,MAAM,MAAM,GAA0B,EAAE;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;AAChC,QAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC7B,YAAA,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,mCAAmC,CAAC;QAC1E;AACA,QAAA,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;IAClC;AACA,IAAA,OAAO,MAAM;AACf;AAEA,SAAS,WAAW,CAClB,MAA6B,EAC7B,IAAY,EACZ,KAAgC,EAAA;AAEhC,IAAA,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,IAAA,IAAI,OAAO,KAAK,SAAS,EAAE;AACzB,QAAA,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK;IACtB;AAAO,SAAA,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;AACjC,QAAA,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5C;SAAO;QACL,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACzC;AACF;AAEA,SAAS,uBAAuB,CAC9B,UAAe,EACf,IAAuC,EACvC,KAA4B,EAAA;AAE5B,IAAA,MAAM,YAAY,GAAG,UAAU,CAAC;SAC7B,KAAK,CAAC,GAAG;SACT,MAAM,CAAC,OAAO,CAAC;AAClB,IAAA,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE;IAEzE,OAAO,OAAO,CACZ,YAAY;AACZ,QAAA,gCAAgC,CAAC,GAAG,CAAC,YAAY,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAChC;AACH;AAEA,SAAS,8BAA8B,CACrC,UAAe,EACf,YAAoB,EACpB,OAA2C,EAC3C,UAAiC,EAAA;IAEjC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC;IAC5D,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,UAAU,EAAE,UAAU,CAAC;AAChF,IAAA,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,2BAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACvF,IAAA,WAAW,CAAC,YAAY,CAAC,GAAG,CAC1B,2BAA2B,CAAC,iBAAiB,EAC7C,OAAO,CAAC,UAAU,CACnB;AACD,IAAA,OAAO,WAAW;AACpB;AAEA,SAAS,gBAAgB,CAAC,GAAQ,EAAA;AAChC,IAAA,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;AACxB,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,OAAO,EAAE;AACP,YAAA,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;AACxB,YAAA,eAAe,EAAE,UAAU;AAC3B,YAAA,iBAAiB,EAAE;AACpB;AACF,KAAA,CAAC;AACJ;AAEA,SAAS,aAAa,CACpB,MAAc,EACd,IAAY,EACZ,eAAuC,EAAE,EAAA;IAEzC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,IAAI,EAAE,EACf;QACE,MAAM;AACN,QAAA,OAAO,EAAE;AACP,YAAA,eAAe,EAAE,UAAU;AAC3B,YAAA,GAAG;AACJ;AACF,KAAA,CACF;AACH;AAEA,MAAM,oBAAqB,SAAQ,KAAK,CAAA;IACtC,WAAA,CACW,MAAc,EACd,IAAY,EAAA;QAErB,KAAK,CAAC,IAAI,CAAC;QAHF,IAAA,CAAA,MAAM,GAAN,MAAM;QACN,IAAA,CAAA,IAAI,GAAJ,IAAI;IAGf;AACD;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sazito/checkout",
-  "version": "0.4.19",
+  "version": "0.4.21",
   "description": "Headless checkout engine + React UI for the Sazito platform, powered by @sazito/client-sdk",
   "license": "MIT",
   "repository": {
@@ -67,6 +67,28 @@
       },
       "default": "./dist/next/payment-return.js"
     },
+    "./next/server": {
+      "import": {
+        "types": "./dist/next/server.d.ts",
+        "default": "./dist/next/server.js"
+      },
+      "require": {
+        "types": "./dist/next/server.d.cts",
+        "default": "./dist/next/server.cjs"
+      },
+      "default": "./dist/next/server.js"
+    },
+    "./server": {
+      "import": {
+        "types": "./dist/server/index.d.ts",
+        "default": "./dist/server/index.js"
+      },
+      "require": {
+        "types": "./dist/server/index.d.cts",
+        "default": "./dist/server/index.cjs"
+      },
+      "default": "./dist/server/index.js"
+    },
     "./styles.css": "./dist/styles.css"
   },
   "typesVersions": {
@@ -82,6 +104,12 @@
       ],
       "next/payment-return": [
         "dist/next/payment-return.d.ts"
+      ],
+      "next/server": [
+        "dist/next/server.d.ts"
+      ],
+      "server": [
+        "dist/server/index.d.ts"
       ]
     }
   },
@@ -99,7 +127,7 @@
     "prepublishOnly": "pnpm run release:check"
   },
   "peerDependencies": {
-    "@sazito/client-sdk": "^1.2.3",
+    "@sazito/client-sdk": "^1.2.28",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0"
   },