@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.68

package/dist/cjs/payments/drivers/paypal-driver-code.js

@@ -0,0 +1,1261 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePaypalDriverCode = void 0;
+/**
+ * Emits `utils/payments/drivers/paypal.js`: Orders v2 checkout (captured when
+ * the buyer returns), Billing Plans + Subscriptions, refunds of captures and
+ * subscription sales, subscription management and webhook verification, all
+ * over fetch.
+ *
+ * Sandbox and live keys look alike (both client ids start with "A"), so the
+ * environment is found by asking: sandbox first, live on `invalid_client`,
+ * the answer cached per process (a generated app serves one merchant).
+ */
+const generatePaypalDriverCode = () => `'use strict';
+/**
+ * PayPal driver. Generated by TeleportHQ — changes are overwritten on the next export.
+ */
+module.exports = function createPaypalDriver(core) {
+  var SANDBOX = 'https://api-m.sandbox.paypal.com';
+  var LIVE = 'https://api-m.paypal.com';
+  var MISSING_CREDENTIALS = 'PayPal credentials are not configured';
+  // Currencies PayPal takes as whole numbers.
+  var ZERO_DECIMAL = ['HUF', 'JPY', 'TWD'];
+  var INTERVALS = ['DAY', 'WEEK', 'MONTH', 'YEAR'];
+  // The longest billing cycle PayPal accepts in each unit: a year at most.
+  var INTERVAL_COUNT_MAX = { DAY: 365, WEEK: 52, MONTH: 12, YEAR: 1 };
+
+  function credentials() {
+    return {
+      clientId: core.credential('paypal', 'clientId'),
+      clientSecret: core.credential('paypal', 'clientSecret'),
+    };
+  }
+
+  // PayPal's "secret" is the id of the webhook the merchant registered.
+  function webhookId(configured) {
+    return configured || core.credential('paypal', 'webhookId');
+  }
+
+  function formatAmount(major, currency) {
+    var amount = Number(major);
+    var safe = isFinite(amount) && amount > 0 ? amount : 0;
+    return ZERO_DECIMAL.indexOf(String(currency || '').toUpperCase()) >= 0 ? String(Math.round(safe)) : safe.toFixed(2);
+  }
+
+  // The provider's own message for a failed call, which is the actionable half.
+  function errorMessage(data, fallback) {
+    var detail = data && data.details && data.details[0] ? data.details[0] : null;
+    return (detail && (detail.description || detail.issue)) || (data && data.message) || fallback;
+  }
+
+  async function tryAuth(baseUrl, basicAuth) {
+    try {
+      var response = await fetch(baseUrl + '/v1/oauth2/token', {
+        method: 'POST',
+        headers: { Authorization: basicAuth, 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: 'grant_type=client_credentials',
+      });
+      var data = await core.readJson(response);
+      if (data && data.access_token) {
+        return { accessToken: data.access_token };
+      }
+      return {
+        invalidClient: !!(data && data.error === 'invalid_client'),
+        errorMessage: (data && (data.error_description || data.error)) || 'HTTP ' + response.status,
+      };
+    } catch (err) {
+      return { errorMessage: 'network error: ' + core.describeError(err) };
+    }
+  }
+
+  // \`{ baseUrl, accessToken }\` or \`{ error }\`. A cached environment that now
+  // answers \`invalid_client\` (keys rotated to the other one) is re-detected.
+  async function authenticate() {
+    var keys = credentials();
+    if (!keys.clientId || !keys.clientSecret) {
+      return { error: MISSING_CREDENTIALS };
+    }
+    var basicAuth = 'Basic ' + Buffer.from(keys.clientId + ':' + keys.clientSecret).toString('base64');
+    var cached = globalThis.__paypalBaseUrlCache;
+    if (cached === SANDBOX || cached === LIVE) {
+      var cachedResult = await tryAuth(cached, basicAuth);
+      if (cachedResult.accessToken) {
+        return { baseUrl: cached, accessToken: cachedResult.accessToken };
+      }
+      if (!cachedResult.invalidClient) {
+        return { error: 'PayPal authentication failed: ' + cachedResult.errorMessage };
+      }
+      globalThis.__paypalBaseUrlCache = undefined;
+    }
+    var sandbox = await tryAuth(SANDBOX, basicAuth);
+    if (sandbox.accessToken) {
+      globalThis.__paypalBaseUrlCache = SANDBOX;
+      return { baseUrl: SANDBOX, accessToken: sandbox.accessToken };
+    }
+    if (!sandbox.invalidClient) {
+      return { error: 'PayPal authentication failed: ' + sandbox.errorMessage };
+    }
+    var live = await tryAuth(LIVE, basicAuth);
+    if (live.accessToken) {
+      globalThis.__paypalBaseUrlCache = LIVE;
+      return { baseUrl: LIVE, accessToken: live.accessToken };
+    }
+    return {
+      error:
+        'PayPal authentication failed: credentials are not valid for either sandbox or live (' +
+        (live.errorMessage || 'invalid_client') +
+        '). Check that the Client ID and the Secret saved for PayPal belong to the same PayPal app.',
+    };
+  }
+
+  function bearer(auth) {
+    return { Authorization: 'Bearer ' + auth.accessToken, 'Content-Type': 'application/json' };
+  }
+
+  async function createCheckout(input) {
+    var keys = credentials();
+    if (!keys.clientId || !keys.clientSecret) {
+      return { checkoutUrl: '', sessionId: '', error: MISSING_CREDENTIALS };
+    }
+    // A common .env mistake, caught before a round trip that would only say 401.
+    if (keys.clientId === keys.clientSecret) {
+      return {
+        checkoutUrl: '',
+        sessionId: '',
+        error:
+          'PayPal credentials are misconfigured: the Client ID and the Secret saved for PayPal are identical. Save the app\\'s Secret instead.',
+      };
+    }
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return { checkoutUrl: '', sessionId: '', error: auth.error };
+      }
+      var currency = String(input.currency || '').toUpperCase();
+      var paypal = {
+        experience_context: {
+          return_url: input.successUrl || undefined,
+          cancel_url: input.cancelUrl || undefined,
+          // The store captures the order as soon as the buyer is back, with no
+          // review page of its own: PayPal's button says "Pay Now".
+          user_action: 'PAY_NOW',
+        },
+      };
+      if (input.customerEmail) {
+        paypal.email_address = String(input.customerEmail);
+      }
+      var payload = {
+        intent: 'CAPTURE',
+        purchase_units: [
+          {
+            amount: { currency_code: currency, value: formatAmount(input.amount, currency) },
+            description: input.description || undefined,
+          },
+        ],
+        payment_source: { paypal: paypal },
+      };
+      if (input.metadata) {
+        payload.purchase_units[0].custom_id = JSON.stringify(input.metadata);
+      }
+      var response = await fetch(auth.baseUrl + '/v2/checkout/orders', {
+        method: 'POST',
+        headers: bearer(auth),
+        body: JSON.stringify(payload),
+      });
+      var data = await response.json();
+      if (!response.ok) {
+        return { checkoutUrl: '', sessionId: '', error: errorMessage(data, 'Order creation failed') };
+      }
+      return { checkoutUrl: orderPage(data), sessionId: data.id || '' };
+    } catch (err) {
+      return { checkoutUrl: '', sessionId: '', error: err && err.message ? err.message : String(err) };
+    }
+  }
+
+  // A subscription against the Billing Plan \`ensurePlan\` returned; its id
+  // (\`I-…\`) is known at once, the ACTIVATED webhook confirms the mandate.
+  async function createSubscriptionCheckout(input) {
+    var keys = credentials();
+    if (!keys.clientId || !keys.clientSecret) {
+      return { checkoutUrl: '', sessionId: '', error: MISSING_CREDENTIALS };
+    }
+    var planId = String(input.planId || '').trim();
+    if (!planId) {
+      return { checkoutUrl: '', sessionId: '', error: 'No PayPal billing plan was supplied for the subscription' };
+    }
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return { checkoutUrl: '', sessionId: '', error: auth.error };
+      }
+      var payload = {
+        plan_id: planId,
+        application_context: {
+          user_action: 'SUBSCRIBE_NOW',
+          return_url: input.successUrl || undefined,
+          cancel_url: input.cancelUrl || undefined,
+        },
+      };
+      if (input.metadata) {
+        payload.custom_id = JSON.stringify(input.metadata);
+      }
+      if (input.customerEmail) {
+        payload.subscriber = { email_address: String(input.customerEmail) };
+      }
+      var response = await fetch(auth.baseUrl + '/v1/billing/subscriptions', {
+        method: 'POST',
+        headers: bearer(auth),
+        body: JSON.stringify(payload),
+      });
+      var data = await response.json();
+      if (!response.ok) {
+        return { checkoutUrl: '', sessionId: '', error: errorMessage(data, 'Subscription creation failed') };
+      }
+      return { checkoutUrl: orderPage(data), sessionId: data.id || '', providerSubscriptionId: data.id || '' };
+    } catch (err) {
+      return { checkoutUrl: '', sessionId: '', error: err && err.message ? err.message : String(err) };
+    }
+  }
+
+  function planFailure(message) {
+    return { ok: 'false', planId: '', providerProductId: '', created: 'false', error: message };
+  }
+
+  // Whether the environment the credentials belong to (sandbox or live) knows
+  // a cached plan: one created under the other environment's credentials is
+  // unknown here. A plan that cannot be checked right now counts as known.
+  async function planKnown(planId) {
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return true;
+      }
+      var response = await fetch(auth.baseUrl + '/v1/billing/plans/' + encodeURIComponent(planId), {
+        method: 'GET',
+        headers: bearer(auth),
+      });
+      return response.status !== 404;
+    } catch (_err) {
+      return true;
+    }
+  }
+
+  // A catalog product and a Billing Plan for one product at one price. A gift
+  // card that paid part of the first cycle makes that cycle a paid TRIAL at the
+  // reduced price, then the regular price. A cached plan the current
+  // credentials' environment does not know (the store moved between sandbox
+  // and live) is created again there.
+  async function ensurePlan(input) {
+    var cachedPlanId = String(input.planId || '').trim();
+    var keys = credentials();
+    var cached = { ok: 'true', planId: cachedPlanId, providerProductId: String(input.providerProductId || ''), created: 'false' };
+    if (cachedPlanId && (!keys.clientId || !keys.clientSecret || (await planKnown(cachedPlanId)))) {
+      return cached;
+    }
+    if (!keys.clientId || !keys.clientSecret) {
+      return planFailure(MISSING_CREDENTIALS);
+    }
+    var currency = String(input.currency || 'USD').toUpperCase();
+    var amount = Number(input.amount);
+    if (!isFinite(amount) || amount <= 0) {
+      return planFailure('A subscription needs a positive amount to bill.');
+    }
+    var interval = String(input.interval || 'month').toUpperCase();
+    if (INTERVALS.indexOf(interval) === -1) {
+      return planFailure('Unknown billing interval "' + interval + '".');
+    }
+    var intervalCount = Math.max(1, Math.floor(Number(input.intervalCount) || 1));
+    var trialDays = Math.max(0, Math.floor(Number(input.trialDays) || 0));
+    // PayPal refuses the whole plan over these, with a message that names no field.
+    var longest = INTERVAL_COUNT_MAX[interval];
+    if (intervalCount > longest) {
+      var unit = interval.toLowerCase();
+      return planFailure(
+        'PayPal cannot bill every ' + intervalCount + ' ' + unit + 's: its longest billing cycle is ' +
+          (longest === 1 ? 'one ' + unit : longest + ' ' + unit + 's') + '.'
+      );
+    }
+    if (trialDays > INTERVAL_COUNT_MAX.DAY) {
+      return planFailure('PayPal cannot run a free trial of ' + trialDays + ' days: its longest is ' + INTERVAL_COUNT_MAX.DAY + ' days.');
+    }
+    var productName = String(input.productName || 'Subscription').slice(0, 127);
+    var firstCycleRaw = Number(input.firstCycleAmount);
+    var firstCycleAmount = isFinite(firstCycleRaw) && firstCycleRaw > 0 && firstCycleRaw < amount ? firstCycleRaw : null;
+    if (firstCycleAmount !== null && trialDays > 0) {
+      return planFailure('A subscription with a free trial cannot open with a reduced first payment.');
+    }
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return planFailure(auth.error);
+      }
+      var readError = async function (response, fallback) {
+        return errorMessage(await core.readJson(response), fallback);
+      };
+      var productResponse = await fetch(auth.baseUrl + '/v1/catalogs/products', {
+        method: 'POST',
+        headers: bearer(auth),
+        body: JSON.stringify({
+          name: productName,
+          description: input.productId ? 'Store product ' + String(input.productId) : undefined,
+          type: 'SERVICE',
+        }),
+      });
+      if (!productResponse.ok) {
+        return planFailure('PayPal refused to create the product: ' + (await readError(productResponse, 'HTTP ' + productResponse.status)));
+      }
+      var product = await productResponse.json();
+      var providerProductId = String((product && product.id) || '');
+      if (!providerProductId) {
+        return planFailure('PayPal returned no product id.');
+      }
+      var billingCycles = [];
+      if (trialDays > 0) {
+        billingCycles.push({
+          frequency: { interval_unit: 'DAY', interval_count: trialDays },
+          tenure_type: 'TRIAL',
+          sequence: 1,
+          total_cycles: 1,
+          pricing_scheme: { fixed_price: { value: '0', currency_code: currency } },
+        });
+      } else if (firstCycleAmount !== null) {
+        billingCycles.push({
+          frequency: { interval_unit: interval, interval_count: intervalCount },
+          tenure_type: 'TRIAL',
+          sequence: 1,
+          total_cycles: 1,
+          pricing_scheme: { fixed_price: { value: formatAmount(firstCycleAmount, currency), currency_code: currency } },
+        });
+      }
+      billingCycles.push({
+        frequency: { interval_unit: interval, interval_count: intervalCount },
+        tenure_type: 'REGULAR',
+        sequence: billingCycles.length + 1,
+        // 0 = until cancelled.
+        total_cycles: 0,
+        pricing_scheme: { fixed_price: { value: formatAmount(amount, currency), currency_code: currency } },
+      });
+      var planResponse = await fetch(auth.baseUrl + '/v1/billing/plans', {
+        method: 'POST',
+        headers: bearer(auth),
+        body: JSON.stringify({
+          product_id: providerProductId,
+          name: productName,
+          status: 'ACTIVE',
+          billing_cycles: billingCycles,
+          payment_preferences: { auto_bill_outstanding: true, setup_fee_failure_action: 'CONTINUE', payment_failure_threshold: 3 },
+        }),
+      });
+      if (!planResponse.ok) {
+        return planFailure('PayPal refused to create the plan: ' + (await readError(planResponse, 'HTTP ' + planResponse.status)));
+      }
+      var plan = await planResponse.json();
+      var planId = String((plan && plan.id) || '');
+      if (!planId) {
+        return planFailure('PayPal returned no plan id.');
+      }
+      return { ok: 'true', planId: planId, providerProductId: providerProductId, created: 'true' };
+    } catch (err) {
+      return planFailure(err && err.message ? err.message : String(err));
+    }
+  }
+
+  function refundFailure(currency, message, extra) {
+    var result = { success: false, refundId: '', amount: 0, currency: currency, status: '', error: message };
+    if (extra) {
+      Object.keys(extra).forEach(function (key) {
+        result[key] = extra[key];
+      });
+    }
+    return result;
+  }
+
+  // One lookup of the reference as one resource type. Only "no such resource"
+  // lets the caller try the next type; an outage is reported as itself.
+  async function probe(auth, path, step) {
+    var response = await fetch(auth.baseUrl + path, { headers: { Authorization: 'Bearer ' + auth.accessToken } });
+    var data = await core.readJson(response);
+    if (response.ok) {
+      return { found: true, data: data, error: '' };
+    }
+    if (response.status === 404 || (data && data.name === 'RESOURCE_NOT_FOUND')) {
+      return { found: false, data: null, error: '' };
+    }
+    return {
+      found: false,
+      data: null,
+      error: 'PayPal could not look up the payment reference as ' + step + ': ' + errorMessage(data, 'HTTP ' + response.status),
+    };
+  }
+
+  // PayPal refunds a money movement: a v2 CAPTURE (or an order, exchanged for
+  // its completed capture) for a checkout, a v1 SALE for a subscription cycle.
+  async function resolveRefundTarget(auth, reference) {
+    var encoded = encodeURIComponent(reference);
+    var capture = await probe(auth, '/v2/payments/captures/' + encoded, 'a capture');
+    if (capture.error) {
+      return { captureId: '', saleId: '', error: capture.error };
+    }
+    if (capture.found) {
+      return { captureId: reference, saleId: '', error: '' };
+    }
+    var sale = await probe(auth, '/v1/payments/sale/' + encoded, 'a sale');
+    if (sale.error) {
+      return { captureId: '', saleId: '', error: sale.error };
+    }
+    if (sale.found) {
+      return { captureId: '', saleId: reference, error: '' };
+    }
+    var order = await probe(auth, '/v2/checkout/orders/' + encoded, 'an order');
+    if (order.error) {
+      return { captureId: '', saleId: '', error: order.error };
+    }
+    if (!order.found) {
+      return { captureId: '', saleId: '', error: 'PayPal does not recognise this order payment reference.' };
+    }
+    var units = (order.data && order.data.purchase_units) || [];
+    var captures = units.length > 0 && units[0].payments ? units[0].payments.captures || [] : [];
+    var captureId = '';
+    for (var i = 0; i < captures.length; i++) {
+      if (captures[i] && captures[i].status === 'COMPLETED') {
+        captureId = captures[i].id;
+        break;
+      }
+    }
+    if (!captureId && captures.length > 0) {
+      captureId = captures[0].id;
+    }
+    if (!captureId) {
+      return { captureId: '', saleId: '', error: 'This PayPal order was never captured, so there is nothing to refund.' };
+    }
+    return { captureId: captureId, saleId: '', error: '' };
+  }
+
+  async function refund(input) {
+    var currencyCode = String(input.currency || '').toUpperCase();
+    var keys = credentials();
+    if (!keys.clientId || !keys.clientSecret) {
+      return refundFailure(currencyCode, MISSING_CREDENTIALS);
+    }
+    var auth = await authenticate();
+    if (auth.error) {
+      return refundFailure(currencyCode, auth.error);
+    }
+    try {
+      var target = await resolveRefundTarget(auth, input.paymentReference);
+      if (target.error) {
+        return refundFailure(currencyCode, target.error);
+      }
+      // A sale refunds through v1, whose fields differ from v2's for the same things.
+      var isSale = target.saleId !== '';
+      var resourceId = isSale ? target.saleId : target.captureId;
+      var body = {};
+      if (input.amount > 0) {
+        var value = formatAmount(input.amount, currencyCode);
+        if (Number(value) <= 0) {
+          return refundFailure(currencyCode, 'The amount is smaller than the smallest unit of ' + currencyCode + '.');
+        }
+        body.amount = isSale ? { total: value, currency: currencyCode } : { value: value, currency_code: currencyCode };
+      }
+      var note = String(input.reason || '').trim();
+      if (note) {
+        // PayPal rejects the whole call over 255 characters.
+        body[isSale ? 'description' : 'note_to_payer'] = note.slice(0, 255);
+      }
+      if (!isSale && input.orderId) {
+        // Read back by the webhook to match the refund to its order. Capped at
+        // 127 characters, and a cut JSON document parses as nothing.
+        var customId = JSON.stringify({ orderId: input.orderId });
+        if (customId.length <= 127) {
+          body.custom_id = customId;
+        }
+      }
+      var headers = {
+        Authorization: 'Bearer ' + auth.accessToken,
+        'Content-Type': 'application/json',
+        'PayPal-Request-Id': input.idempotencyKey,
+      };
+      if (!isSale) {
+        // v2 answers with the refund's id and status alone unless asked for
+        // all of it, and its amount is what the store records as refunded.
+        headers.Prefer = 'return=representation';
+      }
+      var response = await fetch(
+        auth.baseUrl + (isSale ? '/v1/payments/sale/' : '/v2/payments/captures/') + encodeURIComponent(resourceId) + '/refund',
+        { method: 'POST', headers: headers, body: JSON.stringify(body) }
+      );
+      var data = await core.readJson(response);
+      if (!response.ok) {
+        return refundFailure(currencyCode, errorMessage(data, 'PayPal refund failed (HTTP ' + response.status + ')'));
+      }
+      var status = String((data && (data.status || data.state)) || '');
+      var refunded = data && data.amount ? data.amount : null;
+      var refundedValue = refunded ? Number(refunded.value !== undefined ? refunded.value : refunded.total) : NaN;
+      var refundedCurrency = String((refunded && (refunded.currency_code || refunded.currency)) || currencyCode).toUpperCase();
+      var upper = status.toUpperCase();
+      if (upper === 'FAILED' || upper === 'CANCELLED' || upper === 'CANCELED') {
+        return refundFailure(refundedCurrency, 'PayPal reported the refund as ' + status + '.', {
+          refundId: (data && data.id) || '',
+          status: status,
+        });
+      }
+      return {
+        success: true,
+        refundId: (data && data.id) || '',
+        amount: isFinite(refundedValue) ? refundedValue : input.amount,
+        currency: refundedCurrency,
+        status: status,
+        error: '',
+      };
+    } catch (err) {
+      return refundFailure(currencyCode, err && err.message ? err.message : String(err));
+    }
+  }
+
+  function subscriptionStatus(status) {
+    var map = {
+      ACTIVE: 'active',
+      SUSPENDED: 'paused',
+      CANCELLED: 'cancelled',
+      EXPIRED: 'expired',
+      APPROVAL_PENDING: 'pending',
+      APPROVED: 'pending',
+    };
+    return map[String(status || '').toUpperCase()] || '';
+  }
+
+  function manageFailure(message) {
+    return { ok: 'false', status: '', cancelAtPeriodEnd: 'false', currentPeriodStart: '', currentPeriodEnd: '', error: message };
+  }
+
+  // PayPal has no "cancel at the end of the period": a cancellation is
+  // immediate, and never refunds the running cycle.
+  async function manageSubscription(input) {
+    var keys = credentials();
+    if (!keys.clientId || !keys.clientSecret) {
+      return manageFailure(MISSING_CREDENTIALS);
+    }
+    var subscriptionId = input.subscriptionId;
+    var action = input.action;
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return manageFailure(auth.error);
+      }
+      var headers = bearer(auth);
+      var verb = action === 'pause' ? 'suspend' : action === 'resume' ? 'activate' : 'cancel';
+      var reason = verb === 'cancel' ? 'Cancelled by the store' : verb === 'suspend' ? 'Paused by the store' : 'Resumed by the store';
+      if (action !== 'refresh') {
+        var actionResponse = await fetch(
+          auth.baseUrl + '/v1/billing/subscriptions/' + encodeURIComponent(subscriptionId) + '/' + verb,
+          { method: 'POST', headers: headers, body: JSON.stringify({ reason: reason }) }
+        );
+        if (!actionResponse.ok) {
+          // The 204 success and some errors carry no body.
+          var refusal = await core.readJson(actionResponse);
+          return manageFailure('PayPal refused the ' + verb + ': ' + errorMessage(refusal, 'HTTP ' + actionResponse.status));
+        }
+      }
+      var detailResponse = await fetch(auth.baseUrl + '/v1/billing/subscriptions/' + encodeURIComponent(subscriptionId), {
+        headers: headers,
+      });
+      if (action === 'refresh' && !detailResponse.ok) {
+        return manageFailure('PayPal could not read the subscription: HTTP ' + detailResponse.status);
+      }
+      var detail = detailResponse.ok ? await detailResponse.json() : {};
+      var billingInfo = (detail && detail.billing_info) || {};
+      var lastPayment = billingInfo.last_payment || {};
+      return {
+        ok: 'true',
+        status: subscriptionStatus(detail && detail.status),
+        cancelAtPeriodEnd: 'false',
+        currentPeriodStart: lastPayment.time ? String(lastPayment.time) : detail && detail.start_time ? String(detail.start_time) : '',
+        currentPeriodEnd: billingInfo.next_billing_time ? String(billingInfo.next_billing_time) : '',
+      };
+    } catch (err) {
+      return manageFailure(err && err.message ? err.message : String(err));
+    }
+  }
+
+  // PayPal has no merchant-created portal: the buyer changes a subscription's
+  // funding source from their own "automatic payments" page, on the
+  // environment the store's credentials belong to.
+  async function billingPortal() {
+    var keys = credentials();
+    if (!keys.clientId || !keys.clientSecret) {
+      return { ok: 'false', url: '', error: MISSING_CREDENTIALS };
+    }
+    var auth = await authenticate();
+    if (auth.error) {
+      return { ok: 'false', url: '', error: auth.error };
+    }
+    return { ok: 'true', url: siteOf(auth) + '/myaccount/autopay/' };
+  }
+
+  // The environment's own site, where buyers approve orders and manage their
+  // automatic payments.
+  function siteOf(auth) {
+    return auth.baseUrl.indexOf('sandbox') !== -1 ? 'https://www.sandbox.paypal.com' : 'https://www.paypal.com';
+  }
+
+  // What became of a PayPal order the store opened earlier. One the buyer has
+  // not approved yet is paid on its own approval page. An APPROVED one moved no
+  // money until it is captured, so it is captured now — what the buyer's return
+  // and the approval webhook would have done — and its capture event pays the
+  // store's order. A capture PayPal refuses in a way the buyer can fix (another
+  // card, a step at PayPal) leaves the same order payable on its approval page;
+  // any other refusal is only answered closed once the order is closed, since
+  // an APPROVED order can still be captured later. A COMPLETED order is paid
+  // only when its capture says so. PayPal forgets an order nobody approved once
+  // it runs out.
+  async function inspectCheckout(input) {
+    var reference = String((input && input.reference) || '').trim();
+    if (!reference) {
+      return { state: 'closed', checkoutUrl: '' };
+    }
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return { state: '', checkoutUrl: '', error: auth.error };
+      }
+      var answer = await core.request(auth.baseUrl + '/v2/checkout/orders/' + encodeURIComponent(reference), {
+        headers: bearer(auth),
+      });
+      if (answer.status === 404) {
+        return { state: 'closed', checkoutUrl: '' };
+      }
+      if (!answer.ok || !answer.data) {
+        return { state: '', checkoutUrl: '', error: errorMessage(answer.data, 'PayPal could not be asked about order ' + reference) };
+      }
+      var status = String(answer.data.status || '').toUpperCase();
+      // An order the store closed is never captured, so it takes no money.
+      if (isClosedOrder(answer.data) && status !== 'COMPLETED') {
+        return { state: 'closed', checkoutUrl: '' };
+      }
+      if (status === 'CREATED' || status === 'PAYER_ACTION_REQUIRED') {
+        var page = orderPage(answer.data);
+        return page ? { state: 'open', checkoutUrl: page } : { state: 'closed', checkoutUrl: '' };
+      }
+      if (status === 'APPROVED') {
+        var capture = await confirmReturn({ query: { token: reference } });
+        if (capture.ok) {
+          return { state: 'confirming', checkoutUrl: '' };
+        }
+        if (capture.retryable) {
+          return { state: '', checkoutUrl: '', error: capture.error };
+        }
+        if (capture.payerActionUrl) {
+          return { state: 'open', checkoutUrl: capture.payerActionUrl };
+        }
+        if (capture.closed || capture.declined) {
+          return { state: 'closed', checkoutUrl: '' };
+        }
+        return await closeRefusedOrder(auth, reference, answer.data, capture.error);
+      }
+      if (status === 'COMPLETED') {
+        return { state: completedOrderState(answer.data), checkoutUrl: '' };
+      }
+      if (status === 'SAVED') {
+        return { state: 'confirming', checkoutUrl: '' };
+      }
+      return { state: 'closed', checkoutUrl: '' };
+    } catch (err) {
+      return { state: '', checkoutUrl: '', error: 'PayPal could not be reached: ' + core.describeError(err) };
+    }
+  }
+
+  // An APPROVED order whose capture PayPal refused for good can still be
+  // captured later (the approval webhook's retry, the buyer's return page), so
+  // it is marked closed, which every capture reads first, before the store is
+  // told it takes no money.
+  async function closeRefusedOrder(auth, reference, order, reason) {
+    var path = '/v2/checkout/orders/' + encodeURIComponent(reference);
+    var marked = await markClosed(auth, path, order);
+    if (marked.ok) {
+      return { state: 'closed', checkoutUrl: '' };
+    }
+    var again = await core.request(auth.baseUrl + path, { headers: bearer(auth) });
+    if (again.status === 404) {
+      return { state: 'closed', checkoutUrl: '' };
+    }
+    var after = again.ok && again.data ? String(again.data.status || '').toUpperCase() : '';
+    if (after === 'PAYER_ACTION_REQUIRED') {
+      return { state: 'open', checkoutUrl: payerActionUrl(auth, again.data, reference) };
+    }
+    if (after && after !== 'APPROVED' && after !== 'CREATED') {
+      return { state: orderState(again.data).state, checkoutUrl: '' };
+    }
+    return {
+      state: '',
+      checkoutUrl: '',
+      error: 'PayPal refused to capture order ' + reference + ' (' + reason + ') and did not let the store close it: ' + errorMessage(marked.data, 'HTTP ' + marked.status),
+    };
+  }
+
+  // The mark a closed order carries in its \`custom_id\` (the checkout's metadata
+  // as JSON): the order stays readable to the webhook, which finds the store's
+  // order in the same field.
+  var CLOSED_MARK = 'closed';
+  // PayPal's limit on \`custom_id\`.
+  var CUSTOM_ID_MAX = 127;
+  // How long a PayPal order can still be paid: the store has 6 hours from
+  // creating it to send the buyer there (PayPal can extend that to 24, 48 or
+  // 72 hours for an account), and once sent the buyer has 6 hours to approve
+  // it and the store to capture it. The store assumes the longest, 72 + 6.
+  var ORDER_LIFETIME_MS = 78 * 60 * 60 * 1000;
+  // A capture that moved the money, including one refunded since.
+  var PAID_CAPTURES = ['COMPLETED', 'PARTIALLY_REFUNDED', 'REFUNDED'];
+  // Refusals after which the buyer can still pay the SAME order on its
+  // approval page: another card or funding source, or a step PayPal asks of them.
+  var PAYER_FIXABLE_ISSUES = ['INSTRUMENT_DECLINED', 'PAYER_ACTION_REQUIRED', 'REDIRECT_PAYER_FOR_ALTERNATE_FUNDING'];
+
+  function purchaseUnit(order) {
+    return order && Array.isArray(order.purchase_units) && order.purchase_units[0] ? order.purchase_units[0] : {};
+  }
+
+  function isClosedOrder(order) {
+    return core.readMetadata(purchaseUnit(order).custom_id)[CLOSED_MARK] === true;
+  }
+
+  function closedCustomId(order) {
+    var metadata = core.readMetadata(purchaseUnit(order).custom_id);
+    var marked = {};
+    Object.keys(metadata).forEach(function (key) {
+      marked[key] = metadata[key];
+    });
+    marked[CLOSED_MARK] = true;
+    var value = JSON.stringify(marked);
+    return value.length <= CUSTOM_ID_MAX ? value : JSON.stringify({ orderId: String(metadata.orderId || '').slice(0, 80), closed: true });
+  }
+
+  // Marks the order closed in its custom_id. PayPal lets an order be changed
+  // while it is CREATED or APPROVED.
+  function markClosed(auth, path, order) {
+    var unit = purchaseUnit(order);
+    return core.request(auth.baseUrl + path, {
+      method: 'PATCH',
+      headers: bearer(auth),
+      body: JSON.stringify([
+        {
+          op: unit.custom_id ? 'replace' : 'add',
+          path: "/purchase_units/@reference_id=='" + String(unit.reference_id || 'default').replace(/'/g, '') + "'/custom_id",
+          value: closedCustomId(order),
+        },
+      ]),
+    });
+  }
+
+  // What an order's capture did with the money: paid, on its way (PENDING, held
+  // for review) or refused (DECLINED, FAILED); '' when the order lists no
+  // capture. PayPal completes an order whose capture it declined too, so the
+  // order's own COMPLETED says nothing about the money.
+  function captureState(order) {
+    var payments = purchaseUnit(order).payments;
+    var captures = payments && Array.isArray(payments.captures) ? payments.captures : [];
+    var state = '';
+    for (var i = 0; i < captures.length; i++) {
+      var captureStatus = String((captures[i] && captures[i].status) || '').toUpperCase();
+      if (PAID_CAPTURES.indexOf(captureStatus) !== -1) {
+        return 'paid';
+      }
+      if (captureStatus === 'PENDING') {
+        state = 'confirming';
+      } else if ((captureStatus === 'DECLINED' || captureStatus === 'FAILED') && !state) {
+        state = 'closed';
+      }
+    }
+    return state;
+  }
+
+  // A completed order that lists no capture cannot be told paid: the store
+  // then neither pays the order nor opens a second checkout beside it.
+  function completedOrderState(order) {
+    return captureState(order) || 'confirming';
+  }
+
+  // The page where the buyer approves the order, or finishes a step PayPal asks of them.
+  function orderPage(order) {
+    var links = order && Array.isArray(order.links) ? order.links : [];
+    var page = links.find(function (entry) {
+      return entry && (entry.rel === 'approve' || entry.rel === 'payer-action') && entry.href;
+    });
+    return page ? String(page.href) : '';
+  }
+
+  // An order waiting on the buyer, which the store cannot change: payable on
+  // its page until it runs out.
+  function openOrder(order) {
+    var created = new Date(String((order && order.create_time) || '')).getTime();
+    return {
+      state: 'open',
+      checkoutUrl: orderPage(order),
+      openUntil: isFinite(created) ? core.isoTime(created + ORDER_LIFETIME_MS) : '',
+    };
+  }
+
+  function orderState(order) {
+    var status = String((order && order.status) || '').toUpperCase();
+    if (status === 'COMPLETED') {
+      return { state: completedOrderState(order), checkoutUrl: '', openUntil: '' };
+    }
+    if (status === 'APPROVED' || status === 'SAVED') {
+      return { state: 'confirming', checkoutUrl: '', openUntil: '' };
+    }
+    return { state: 'closed', checkoutUrl: '', openUntil: '' };
+  }
+
+  // Closes a PayPal order the store no longer wants paid. PayPal cannot void an
+  // order, but it moves no money until the store captures it: the order is
+  // marked closed (PayPal lets an order be changed while it is CREATED or
+  // APPROVED), and every capture reads that mark first. One the buyer approved
+  // but the store never captured is marked too, so a capture that runs late
+  // (the approval webhook's retry, the buyer's return page) cannot take the
+  // money of an order the merchant settled or cancelled.
+  async function closeCheckout(input) {
+    var reference = String((input && input.reference) || '').trim();
+    if (!reference) {
+      return { state: 'closed', checkoutUrl: '', openUntil: '' };
+    }
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return { state: '', error: auth.error };
+      }
+      if (reference.indexOf('I-') === 0) {
+        return await closeSubscriptionApproval(auth, reference);
+      }
+      var path = '/v2/checkout/orders/' + encodeURIComponent(reference);
+      var answer = await core.request(auth.baseUrl + path, { headers: bearer(auth) });
+      if (answer.status === 404) {
+        return { state: 'closed', checkoutUrl: '', openUntil: '' };
+      }
+      if (!answer.ok || !answer.data) {
+        return { state: '', error: errorMessage(answer.data, 'PayPal could not be asked about order ' + reference) };
+      }
+      var status = String(answer.data.status || '').toUpperCase();
+      if (status !== 'CREATED' && status !== 'APPROVED' && status !== 'PAYER_ACTION_REQUIRED') {
+        return isClosedOrder(answer.data) && status !== 'COMPLETED' ? { state: 'closed', checkoutUrl: '', openUntil: '' } : orderState(answer.data);
+      }
+      if (isClosedOrder(answer.data)) {
+        return { state: 'closed', checkoutUrl: '', openUntil: '' };
+      }
+      var patched = await markClosed(auth, path, answer.data);
+      if (patched.ok) {
+        return { state: 'closed', checkoutUrl: '', openUntil: '' };
+      }
+      // The store captured it between the read and the mark, or it waits on a
+      // step the buyer takes at PayPal: read what they left.
+      var again = await core.request(auth.baseUrl + path, { headers: bearer(auth) });
+      var after = again.ok && again.data ? String(again.data.status || '').toUpperCase() : '';
+      if (after === 'PAYER_ACTION_REQUIRED') {
+        // Unmarked, it is captured once the buyer finishes that step.
+        return openOrder(again.data);
+      }
+      // Still CREATED or APPROVED and unmarked, it can still be captured: the
+      // merchant's change must wait rather than read it as closed.
+      if (after && after !== 'CREATED' && after !== 'APPROVED') {
+        return orderState(again.data);
+      }
+      return { state: '', error: errorMessage(patched.data, 'PayPal did not let the store close order ' + reference) };
+    } catch (err) {
+      return { state: '', error: 'PayPal could not be reached: ' + core.describeError(err) };
+    }
+  }
+
+  // A subscription the buyer has not approved yet cannot be cancelled (PayPal
+  // cancels only an ACTIVE or SUSPENDED one): its approval page stays open
+  // until PayPal lets it run out, which the store bounds by the longest an
+  // order lives.
+  async function closeSubscriptionApproval(auth, reference) {
+    var path = '/v1/billing/subscriptions/' + encodeURIComponent(reference);
+    var answer = await core.request(auth.baseUrl + path, { headers: bearer(auth) });
+    if (answer.status === 404) {
+      return { state: 'closed', checkoutUrl: '', openUntil: '' };
+    }
+    if (!answer.ok || !answer.data) {
+      return { state: '', error: errorMessage(answer.data, 'PayPal could not be asked about subscription ' + reference) };
+    }
+    var status = String(answer.data.status || '').toUpperCase();
+    if (status === 'ACTIVE' || status === 'SUSPENDED') {
+      return { state: 'paid', checkoutUrl: '', openUntil: '' };
+    }
+    if (status === 'APPROVED') {
+      return { state: 'confirming', checkoutUrl: '', openUntil: '' };
+    }
+    if (status !== 'APPROVAL_PENDING') {
+      return { state: 'closed', checkoutUrl: '', openUntil: '' };
+    }
+    var created = new Date(String(answer.data.create_time || '')).getTime();
+    return { state: 'open', checkoutUrl: '', openUntil: isFinite(created) ? core.isoTime(created + ORDER_LIFETIME_MS) : '' };
+  }
+
+  // PayPal cannot be searched for an order's checkouts. The one the order's
+  // placing opened can be captured until it runs out.
+  async function findCheckouts(input) {
+    var placed = new Date(String((input && input.placedAt) || '')).getTime();
+    if (!isFinite(placed) || placed <= 0) {
+      return { error: 'The order to look up names no time it was placed.' };
+    }
+    return { searchable: false, openUntil: core.isoTime(placed + ORDER_LIFETIME_MS) };
+  }
+
+  function issuesOf(data) {
+    return data && Array.isArray(data.details)
+      ? data.details.map(function (detail) {
+          return String((detail && detail.issue) || '');
+        })
+      : [];
+  }
+
+  // Where a buyer PayPal sent back finishes paying: the link the refusal
+  // names, else the order's approval page, at the address its approve link has.
+  function payerActionUrl(auth, data, orderId) {
+    var page = orderPage(data);
+    return page || siteOf(auth) + '/checkoutnow?token=' + encodeURIComponent(orderId);
+  }
+
+  // Captures the order the buyer just approved (\`?token=<order id>\` on the
+  // return URL). A subscription approval returns a \`token\` that is no order
+  // (\`subscription_id\` / \`ba_token\` beside it): the ACTIVATED webhook covers it.
+  // Answers ok only for a capture PayPal took (\`pending\` while it holds the
+  // money for review); a declined capture is refused for good, and one the
+  // buyer can fix names the page to fix it on (\`payerActionUrl\`).
+  async function confirmReturn(input) {
+    var query = input.query || {};
+    var orderId = String(query.token || '').trim();
+    if (!orderId || query.subscription_id || query.ba_token) {
+      return { handled: false };
+    }
+    var auth = await authenticate();
+    if (auth.error) {
+      return { handled: true, ok: false, error: auth.error };
+    }
+    try {
+      var orderUrl = auth.baseUrl + '/v2/checkout/orders/' + encodeURIComponent(orderId);
+      // An order the store closed (paid another way, or cancelled) is never
+      // captured: its approval moves no money, which is how a PayPal page the
+      // store cannot void stops being able to take the order's money.
+      var current = await core.request(orderUrl, { headers: bearer(auth) });
+      if (!current.ok && current.status !== 404) {
+        return { handled: true, ok: false, retryable: true, error: errorMessage(current.data, 'PayPal could not be asked about order ' + orderId) };
+      }
+      if (current.ok && isClosedOrder(current.data) && String(current.data.status || '').toUpperCase() !== 'COMPLETED') {
+        return { handled: true, ok: false, retryable: false, closed: true, error: 'The store closed PayPal order ' + orderId + ', so it was not captured.' };
+      }
+      var headers = bearer(auth);
+      // The whole order back, whose capture says whether the money moved.
+      headers.Prefer = 'return=representation';
+      var response = await fetch(orderUrl + '/capture', {
+        method: 'POST',
+        headers: headers,
+        // Some hardened proxies strip a POST without a body.
+        body: '{}',
+      });
+      var data = await core.readJson(response);
+      var issues = issuesOf(data);
+      var alreadyCaptured = response.status === 422 && issues.indexOf('ORDER_ALREADY_CAPTURED') !== -1;
+      if (!response.ok && !alreadyCaptured) {
+        var fixable = issues.some(function (issue) {
+          return PAYER_FIXABLE_ISSUES.indexOf(issue) !== -1;
+        });
+        return {
+          handled: true,
+          ok: false,
+          // An outage, a request still in progress or a rate limit is worth
+          // trying again; a refusal stands.
+          retryable: response.status >= 500 || response.status === 409 || response.status === 429,
+          payerActionUrl: fixable ? payerActionUrl(auth, data, orderId) : '',
+          error: errorMessage(data, 'PayPal capture failed'),
+        };
+      }
+      var captured = data;
+      if (alreadyCaptured) {
+        // Captured before (the buyer's return, the approval webhook): the
+        // order's capture says what that did.
+        var again = await core.request(orderUrl, { headers: bearer(auth) });
+        captured = again.ok ? again.data : null;
+      }
+      var state = captureState(captured);
+      if (state === 'closed') {
+        return { handled: true, ok: false, retryable: false, declined: true, error: 'PayPal declined the payment for order ' + orderId + '.' };
+      }
+      return {
+        handled: true,
+        ok: true,
+        alreadyCaptured: alreadyCaptured,
+        pending: state === 'confirming',
+        status: state === 'confirming' ? 'PENDING' : state === 'paid' ? 'COMPLETED' : String((captured && captured.status) || 'COMPLETED'),
+      };
+    } catch (err) {
+      return { handled: true, ok: false, retryable: true, error: 'PayPal capture failed: ' + core.describeError(err) };
+    }
+  }
+
+  // An APPROVED order has not moved any money: the capture the buyer's return
+  // makes does. A buyer who closes the tab before returning never makes it,
+  // so the approval captures the order too (a second capture is answered
+  // "already captured"). The capture's own event is what pays the order.
+  async function captureApprovedOrder(event) {
+    var resource = (event && event.resource) || {};
+    if (!event || event.event_type !== 'CHECKOUT.ORDER.APPROVED' || !resource.id || String(resource.intent || 'CAPTURE').toUpperCase() !== 'CAPTURE') {
+      return { ok: true, body: event };
+    }
+    var capture = await confirmReturn({ query: { token: String(resource.id) } });
+    if (!capture.ok && capture.retryable) {
+      return { ok: false, retry: true, reason: capture.error };
+    }
+    return { ok: true, body: event };
+  }
+
+  // A payment the store confirmed itself — the buyer's return — is settled
+  // without waiting for its webhook, which may never come (a store PayPal
+  // cannot reach, a Webhook ID of another app). The store's own server asks
+  // its webhook route (see the PayPal capture route): the payment is READ from
+  // PayPal with the store's credentials and answered as the event PayPal sends
+  // for it. Nothing but the PayPal id comes from the request.
+  var ORDER_ID_PATTERN = /^[A-Z0-9]{10,36}$/;
+  var SUBSCRIPTION_ID_PATTERN = /^I-[A-Z0-9]{6,40}$/;
+  var CAPTURE_EVENTS = {
+    COMPLETED: 'PAYMENT.CAPTURE.COMPLETED',
+    PENDING: 'PAYMENT.CAPTURE.PENDING',
+    DECLINED: 'PAYMENT.CAPTURE.DECLINED',
+    FAILED: 'PAYMENT.CAPTURE.DECLINED',
+  };
+  // A subscription's first payment is dated from a day before it was created.
+  var FIRST_PAYMENT_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+  function settledEvent(eventType, resource) {
+    return { ok: true, body: { id: 'teleport-settle:' + String(resource.id || ''), event_type: eventType, resource: resource } };
+  }
+
+  function unanswered(answer, fallback) {
+    return { ok: false, retry: answer.status >= 500 || answer.status === 429, reason: errorMessage(answer.data, fallback) };
+  }
+
+  // The capture that decides the order: a completed one, else one PayPal
+  // holds for review, else the latest.
+  function decidingCapture(order) {
+    var payments = purchaseUnit(order).payments;
+    var captures = payments && Array.isArray(payments.captures) ? payments.captures : [];
+    var byStatus = function (status) {
+      return captures.filter(function (capture) {
+        return String((capture && capture.status) || '').toUpperCase() === status;
+      })[0];
+    };
+    return byStatus('COMPLETED') || byStatus('PENDING') || captures[captures.length - 1] || null;
+  }
+
+  async function settleOrder(auth, orderId) {
+    var answer = await core.request(auth.baseUrl + '/v2/checkout/orders/' + encodeURIComponent(orderId), { headers: bearer(auth) });
+    if (!answer.ok || !answer.data) {
+      return unanswered(answer, 'PayPal could not be asked about order ' + orderId);
+    }
+    var capture = decidingCapture(answer.data);
+    var eventType = capture ? CAPTURE_EVENTS[String(capture.status || '').toUpperCase()] : '';
+    if (!eventType) {
+      return { ok: false, reason: 'PayPal order ' + orderId + ' has no capture to settle.' };
+    }
+    var related = (capture.supplementary_data && capture.supplementary_data.related_ids) || {};
+    return settledEvent(eventType, {
+      id: String(capture.id || ''),
+      status: capture.status,
+      amount: capture.amount,
+      custom_id: capture.custom_id || purchaseUnit(answer.data).custom_id || '',
+      supplementary_data: { related_ids: Object.assign({}, related, { order_id: String(answer.data.id || orderId) }) },
+      create_time: capture.create_time,
+    });
+  }
+
+  async function readSubscription(auth, subscriptionId) {
+    var answer = await core.request(auth.baseUrl + '/v1/billing/subscriptions/' + encodeURIComponent(subscriptionId), { headers: bearer(auth) });
+    if (!answer.ok || !answer.data || answer.data.id !== subscriptionId) {
+      return { failure: unanswered(answer, 'PayPal does not know subscription ' + subscriptionId) };
+    }
+    return { subscription: answer.data };
+  }
+
+  // The mandate: PayPal's own ACTIVATED event, from the subscription as it is.
+  async function settleSubscription(auth, subscriptionId) {
+    var read = await readSubscription(auth, subscriptionId);
+    if (read.failure) {
+      return read.failure;
+    }
+    var status = String(read.subscription.status || '').toUpperCase();
+    if (status !== 'ACTIVE') {
+      return { ok: false, reason: 'PayPal subscription ' + subscriptionId + ' is ' + (status || 'not active') + ', not ACTIVE.' };
+    }
+    return settledEvent('BILLING.SUBSCRIPTION.ACTIVATED', read.subscription);
+  }
+
+  // The first cycle's payment: the earliest completed transaction, as the
+  // v1 sale PayPal's PAYMENT.SALE.COMPLETED carries (its id is the sale id).
+  async function settleSubscriptionPayment(auth, subscriptionId) {
+    var read = await readSubscription(auth, subscriptionId);
+    if (read.failure) {
+      return read.failure;
+    }
+    var subscription = read.subscription;
+    var created = Date.parse(String(subscription.create_time || subscription.start_time || ''));
+    var since = (isFinite(created) ? created : Date.now()) - FIRST_PAYMENT_WINDOW_MS;
+    var answer = await core.request(
+      auth.baseUrl + '/v1/billing/subscriptions/' + encodeURIComponent(subscriptionId) + '/transactions' +
+        '?start_time=' + encodeURIComponent(core.isoTime(since)) + '&end_time=' + encodeURIComponent(core.isoTime(Date.now())),
+      { headers: bearer(auth) }
+    );
+    if (!answer.ok || !answer.data) {
+      return unanswered(answer, 'PayPal could not list the payments of subscription ' + subscriptionId);
+    }
+    var completed = (Array.isArray(answer.data.transactions) ? answer.data.transactions : [])
+      .filter(function (transaction) {
+        return transaction && transaction.id && String(transaction.status || '').toUpperCase() === 'COMPLETED';
+      })
+      .sort(function (a, b) {
+        return String(a.time || '').localeCompare(String(b.time || ''));
+      });
+    if (completed.length === 0) {
+      return { ok: false, reason: 'PayPal has not taken the first payment of subscription ' + subscriptionId + ' yet.' };
+    }
+    var gross = (completed[0].amount_with_breakdown && completed[0].amount_with_breakdown.gross_amount) || {};
+    return settledEvent('PAYMENT.SALE.COMPLETED', {
+      id: String(completed[0].id),
+      state: 'completed',
+      amount: { total: String(gross.value == null ? '' : gross.value), currency: String(gross.currency_code || '') },
+      billing_agreement_id: subscriptionId,
+      custom: subscription.custom_id || '',
+      create_time: completed[0].time,
+    });
+  }
+
+  async function reconcile(request) {
+    var kind = String((request && request.kind) || '');
+    var id = String((request && request.id) || '').trim();
+    var known = kind === 'order' ? ORDER_ID_PATTERN.test(id) : (kind === 'subscription' || kind === 'subscription-payment') && SUBSCRIPTION_ID_PATTERN.test(id);
+    if (!known) {
+      return { ok: false, reason: 'The request names no PayPal payment to settle.' };
+    }
+    try {
+      var auth = await authenticate();
+      if (auth.error) {
+        return { ok: false, retry: true, reason: auth.error };
+      }
+      if (kind === 'order') {
+        return await settleOrder(auth, id);
+      }
+      return kind === 'subscription' ? await settleSubscription(auth, id) : await settleSubscriptionPayment(auth, id);
+    } catch (err) {
+      return { ok: false, retry: true, reason: core.describeError(err) };
+    }
+  }
+
+  // What \`reconcile\` settles a checkout the store recorded by, in order: a
+  // subscription's mandate before its first payment.
+  function reconcileKinds(reference) {
+    var id = String(reference || '').trim();
+    if (SUBSCRIPTION_ID_PATTERN.test(id)) {
+      return ['subscription', 'subscription-payment'];
+    }
+    return ORDER_ID_PATTERN.test(id) ? ['order'] : [];
+  }
+
+  // PayPal's verify endpoint must see the event EXACTLY as delivered, so the
+  // raw text is spliced into the request rather than parsed and re-serialised.
+  async function verifySignature(input, id) {
+    var keys = credentials();
+    if (!keys.clientId || !keys.clientSecret) {
+      return { ok: false, reason: MISSING_CREDENTIALS };
+    }
+    var certUrl = core.header(input.headers, 'paypal-cert-url');
+    var baseUrl = certUrl.indexOf('sandbox.paypal.com') !== -1 ? SANDBOX : LIVE;
+    var basicAuth = 'Basic ' + Buffer.from(keys.clientId + ':' + keys.clientSecret).toString('base64');
+    var token = await tryAuth(baseUrl, basicAuth);
+    if (!token.accessToken) {
+      return { ok: false, reason: 'PayPal authentication against ' + baseUrl + ' failed: ' + token.errorMessage };
+    }
+    var fields = {
+      auth_algo: core.header(input.headers, 'paypal-auth-algo'),
+      cert_url: certUrl,
+      transmission_id: core.header(input.headers, 'paypal-transmission-id'),
+      transmission_sig: core.header(input.headers, 'paypal-transmission-sig'),
+      transmission_time: core.header(input.headers, 'paypal-transmission-time'),
+      webhook_id: id,
+    };
+    var fieldsJson = JSON.stringify(fields);
+    // Spliced in by position: a replace() would read "$&" or "$$" in the
+    // event's own text as its tokens and change what PayPal is asked to check.
+    var requestBody = fieldsJson.slice(0, -1) + ',"webhook_event":' + input.rawBody.toString('utf8') + '}';
+    var response = await fetch(baseUrl + '/v1/notifications/verify-webhook-signature', {
+      method: 'POST',
+      headers: { Authorization: 'Bearer ' + token.accessToken, 'Content-Type': 'application/json' },
+      body: requestBody,
+    });
+    var data = await core.readJson(response);
+    if (data && data.verification_status === 'SUCCESS') {
+      return { ok: true, body: input.body };
+    }
+    return {
+      ok: false,
+      reason: 'PayPal rejected the signature: verification_status=' + ((data && data.verification_status) || '(missing)'),
+    };
+  }
+
+  // The event read back from PayPal with the store's own app credentials:
+  // THAT copy is what the store acts on — a forged body names no event PayPal has.
+  async function readBackEvent(input) {
+    var eventId = input.body && typeof input.body.id === 'string' ? input.body.id : '';
+    if (!eventId) {
+      return { ok: false, reason: 'The request names no PayPal event.' };
+    }
+    var auth = await authenticate();
+    if (auth.error) {
+      return { ok: false, reason: auth.error };
+    }
+    var answer = await core.request(auth.baseUrl + '/v1/notifications/webhooks-events/' + encodeURIComponent(eventId), {
+      headers: { Authorization: 'Bearer ' + auth.accessToken },
+    });
+    if (!answer.ok || !answer.data || answer.data.id !== eventId) {
+      return { ok: false, reason: 'PayPal does not know the event ' + eventId + '.' };
+    }
+    return await captureApprovedOrder(answer.data);
+  }
+
+  // With a webhook id the signature is checked by PayPal. A Webhook ID of
+  // another app or environment fails EVERY signature, so a refused one is not
+  // the end: the event is read back from PayPal instead, and the mismatch is
+  // logged for the merchant to fix. Without an id the event is read back.
+  async function verifyWebhook(input) {
+    try {
+      var id = webhookId(input.secret);
+      if (id) {
+        var signed = await verifySignature(input, id);
+        if (signed.ok) {
+          return await captureApprovedOrder(signed.body);
+        }
+        console.warn('PayPal webhook: ' + signed.reason + '. Is the saved Webhook ID the one of the webhook that posts to this store? Reading the event back from PayPal instead.');
+      }
+      return await readBackEvent(input);
+    } catch (err) {
+      return { ok: false, reason: core.describeError(err) };
+    }
+  }
+
+  return {
+    id: 'paypal',
+    createCheckout: createCheckout,
+    createSubscriptionCheckout: createSubscriptionCheckout,
+    inspectCheckout: inspectCheckout,
+    closeCheckout: closeCheckout,
+    findCheckouts: findCheckouts,
+    ensurePlan: ensurePlan,
+    refund: refund,
+    manageSubscription: manageSubscription,
+    billingPortal: billingPortal,
+    confirmReturn: confirmReturn,
+    reconcile: reconcile,
+    reconcileKinds: reconcileKinds,
+    verifyWebhook: verifyWebhook,
+  };
+};
+`;
+exports.generatePaypalDriverCode = generatePaypalDriverCode;
+//# sourceMappingURL=paypal-driver-code.js.map