@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/dist/cjs/nodes/payment/payment-charge-user.js

@@ -5,50 +5,44 @@ const types_1 = require("../types");
 // Contract for the `amount` config field:
 //   A floating-point number in the MAJOR currency unit (e.g. 99.99 USD,
 //   9999 JPY). Individual line items use the same `unitAmount` semantics.
-// Both Stripe and PayPal handlers convert to the correct provider-specific
-// representation internally — callers must NOT pre-convert to minor units.
-// Resolves a secret / provider credential from `process.env` with a fallback
-// chain. Some deploys populate the canonical names (`STRIPE_SECRET_KEY`,
-// `PAYPAL_CLIENT_ID`, …) while others keep the value behind a
-// `CONFIGURATION_*` prefix (sometimes numbered: `CONFIGURATION_PAYPAL_CLIENT_ID2`).
-// Iterate the list in order, returning the first non-empty match. If no
-// primary or numbered fallback is filled, scan every `process.env` key
-// beginning with the prefix so new variants don't require a code change.
-function resolveProviderSecret(candidates, prefixScan) {
-    // Access `process` via `globalThis` rather than as a bare identifier. When
-    // the GUI generates this project it bundles the code generators through
-    // webpack, and `fn.toString()` captures whatever webpack rewrote a bare
-    // `process` into (e.g. `payment_charge_user_process`, which is undefined on
-    // the Vercel Node runtime). `globalThis.process` is a member access webpack
-    // leaves untouched, so the serialized handler stays valid on the server.
-    const env = globalThis.process.env;
-    for (const key of candidates) {
-        const value = env[key];
-        if (value && String(value).length > 0) {
-            return String(value);
-        }
-    }
-    if (prefixScan) {
-        const envKeys = Object.keys(env);
-        for (const key of envKeys) {
-            if (key.indexOf(prefixScan) === 0) {
-                const value = env[key];
-                if (value && String(value).length > 0) {
-                    return String(value);
-                }
-            }
-        }
-    }
-    return '';
-}
-// Stripe and PayPal both reject relative paths for success_url / cancel_url
-// with a terse "Not a valid URL" error. The workflow-level
-// `Build Payment Redirect URLs And Metadata` script emits root-relative paths
-// (e.g. `/order-details/ORD-42`) because at build time it has no way to know
-// the live host. Absolutize them here using the request's base URL, which
-// the api-route generator already stores on `context.__baseUrl`
-// ("http://localhost:3001", "https://example.com", …). Leave fully-qualified
-// URLs untouched so callers can override with an external URL when needed.
+// Each provider's driver converts to its own representation — callers must
+// NOT pre-convert to minor units.
+//
+// The provider work itself lives in the store's payment drivers
+// (`utils/payments/drivers/<id>.js`, see `src/payments`), reached through the
+// `__paymentDrivers` binding every route running this node declares. The
+// handler owns what every provider shares: the redirect URLs, the metadata,
+// the answer shape and the refusal of a provider the store has no driver for.
+// An order may already have a checkout open with the provider (the buyer
+// left it, then came back through "Continue payment"). With
+// \`previousAttempt\` — the reference the store recorded for that checkout —
+// the node asks the provider about it before opening another: one the buyer
+// can still pay is reopened instead (\`attemptOutcome: 'reused'\`), one already
+// paid or being paid opens nothing (\`'in-progress'\`, and the buyer is sent
+// to where a finished payment lands), and only one that can take no more
+// money gives way to a new checkout (\`'created'\`). Two open checkouts are
+// how one order gets paid twice.
+//
+// An order that recorded no checkout names itself instead (\`lookupOrderId\`,
+// \`lookupPlacedAt\`): the provider is searched for the pages its placing
+// opened, and they are closed before another opens (see
+// \`core.closeOrderCheckouts\`). One the provider cannot close is reopened and
+// answered as \`'adopted'\`, to be recorded like a new one.
+//
+// \`deferRedirect\` answers with the page instead of sending the buyer there,
+// so the steps after this node can record the checkout first; a navigation
+// step then opens \`redirectUrl\`.
+//
+// \`reportRefusal\` answers a provider that refused to open the checkout as
+// the node's result (\`refused: 'true'\`, the provider's own words in
+// \`refusal\`) instead of ending the run with a 400, so the steps after it can
+// give back what the order held and tell the buyer why. Every answer then
+// names the provider and says whether it refused.
+// Stripe, PayPal and every other provider reject relative paths for the
+// return URLs. The place-order script emits root-relative paths (e.g.
+// `/order-details/ORD-42`) because at build time it cannot know the live host,
+// so they are absolutized against the request's base URL
+// (`context.__baseUrl`). Fully-qualified URLs pass through untouched.
 function toAbsoluteUrl(url, baseUrl) {
     if (!url) {
         return url;
@@ -63,372 +57,245 @@ function toAbsoluteUrl(url, baseUrl) {
     const base = String(baseUrl).replace(/\/+$/, '');
     return str.startsWith('/') ? base + str : base + '/' + str;
 }
+// The provider sends the buyer to these pages after paying, so they must stay
+// on this store: a URL on another origin (or one that does not parse) becomes
+// the store's home page. Without a base URL nothing can be compared, and the
+// URL is left as it is.
+function toStoreUrl(url, baseUrl) {
+    if (!url || !baseUrl) {
+        return url;
+    }
+    try {
+        const origin = new URL(baseUrl).origin;
+        return new URL(url, origin + '/').origin === origin ? url : origin + '/';
+    }
+    catch (_e) {
+        return String(baseUrl).replace(/\/+$/, '') + '/';
+    }
+}
 async function payment_charge_user(config, _context) {
-    const providerType = config.providerType || config.provider || config.providerId || 'stripe';
-    const amount = config.amount;
+    // A workflow that names no provider has always meant Stripe.
+    const providerType = String(config.providerType || config.provider || config.providerId || 'stripe')
+        .trim()
+        .toLowerCase();
     const currency = config.currency || 'usd';
+    // 'payment' (the default) opens a one-time checkout; 'subscription' opens
+    // the provider's recurring checkout for ONE plan — `amount` is then what
+    // every cycle bills, `recurringInterval` / `recurringIntervalCount` the
+    // cycle, `trialDays` the free days before the first charge, and `planId`
+    // the plan `payment-ensure-subscription-plan` returned.
+    const mode = String(config.mode || 'payment').toLowerCase() === 'subscription' ? 'subscription' : 'payment';
     const baseUrl = String((_context && _context.__baseUrl) || '');
     // The buyer comes back from the provider's hosted page to the language they
     // checked out in: a site-relative return path gets the run's locale prefix
     // (the segment route reads it off the client context) before it is
-    // absolutized; an external override passes through untouched.
+    // absolutized. A page on another site is never a return page (see
+    // `toStoreUrl`).
     const runLocale = _context && _context.__locale;
-    const successUrl = toAbsoluteUrl(__workflowUtils.localizeHref(config.successUrl || '', runLocale), baseUrl);
-    const cancelUrl = toAbsoluteUrl(__workflowUtils.localizeHref(config.cancelUrl || '', runLocale), baseUrl);
-    const description = config.description || 'Payment';
-    const lineItems = config.lineItems;
-    let parsedMetadata;
+    const successUrl = toStoreUrl(toAbsoluteUrl(__workflowUtils.localizeHref(config.successUrl || '', runLocale), baseUrl), baseUrl);
+    const cancelUrl = toStoreUrl(toAbsoluteUrl(__workflowUtils.localizeHref(config.cancelUrl || '', runLocale), baseUrl), baseUrl);
+    let metadata;
     if (config.metadata) {
         try {
-            parsedMetadata =
-                typeof config.metadata === 'string' ? JSON.parse(config.metadata) : config.metadata;
+            metadata = typeof config.metadata === 'string' ? JSON.parse(config.metadata) : config.metadata;
         }
         catch (_e) {
-            parsedMetadata = undefined;
+            metadata = undefined;
         }
     }
+    const driver = typeof __paymentDrivers !== 'undefined' && __paymentDrivers
+        ? __paymentDrivers.get(providerType)
+        : null;
+    const previousAttempt = String(config.previousAttempt || '').trim();
+    const lookupOrderId = String(config.lookupOrderId || '').trim();
+    const deferRedirect = config.deferRedirect === true || config.deferRedirect === 'true';
+    const reportRefusal = config.reportRefusal === true || config.reportRefusal === 'true';
+    let attemptOutcome = 'created';
+    let adoptedAttempt = '';
     let result;
-    if (providerType === 'paypal') {
-        result = await chargeWithPaypal(config, currency, amount, successUrl, cancelUrl, description, parsedMetadata);
-    }
-    else {
-        // Everything that isn't PayPal charges through Stripe. Apple Pay / Google
-        // Pay are surfaced automatically by Stripe's hosted checkout (Dynamic
-        // Payment Methods) — they aren't separate providers here.
-        result = await chargeWithStripe(config, currency, amount, successUrl, cancelUrl, description, lineItems, parsedMetadata);
-    }
-    // Provider-side errors (bad keys, invalid request, wrong currency, etc.)
-    // are user-actionable configuration problems, not 500s. Surfacing them as
-    // 400 with the provider's own message (`invalid_client`, etc.) lets the
-    // checkout page render an actionable toast instead of a generic
-    // "Workflow segment error" 500. The segment runtime forwards
-    // `__earlyResponse.status` / `body` straight to the HTTP response.
-    if (result && typeof result.error === 'string' && result.error) {
-        return {
-            __earlyResponse: {
-                status: 400,
-                headers: { 'Content-Type': 'application/json' },
-                body: { success: false, error: result.error, provider: providerType },
-            },
-        };
-    }
-    return result;
-}
-// Converts a major-unit amount (e.g. 99.99 USD) into Stripe's expected
-// smallest-unit integer. Zero-decimal currencies pass through rounded;
-// three-decimal currencies multiply by 1000; everything else multiplies by
-// 100. Always returns a safe non-negative integer.
-//
-// The currency lists are declared LOCAL to this function rather than as
-// shared top-level consts. `generateHandler()` below assembles the final
-// handler by calling `.toString()` on several functions independently and
-// concatenating the source; a top-level const is fine in an unminified
-// build, but when this package itself is bundled + minified by a consumer
-// (e.g. teleport-gui's browser packer, built with webpack/Terser), the
-// minifier is free to rename the top-level const's declaration — nothing
-// in the bundle calls it by name, only this runtime `.toString()` read
-// does, which is invisible to the minifier. `toStripeMinorUnits.toString()`
-// would then embed a reference to a name (e.g. a mangled `Oo`) that is
-// never declared anywhere in the generated workflow segment file, throwing
-// "<mangled name> is not defined" the first time a Stripe charge runs.
-// Declaring the lists inside the function keeps the declaration and every
-// reference to it in the SAME `.toString()` snapshot, so a consistent
-// rename by the minifier can never separate them. See `resolveProviderSecret`
-// above for the same class of bug with the `process` global.
-function toStripeMinorUnits(major, currency) {
-    const zeroDecimalCurrencies = [
-        'BIF',
-        'CLP',
-        'DJF',
-        'GNF',
-        'JPY',
-        'KMF',
-        'KRW',
-        'MGA',
-        'PYG',
-        'RWF',
-        'UGX',
-        'VND',
-        'VUV',
-        'XAF',
-        'XOF',
-        'XPF',
-    ];
-    // Currencies where the smallest unit is 1/1000 of the major unit. Stripe
-    // expects amounts in the smallest unit (e.g. 1.500 JOD -> 1500).
-    const threeDecimalCurrencies = ['BHD', 'IQD', 'JOD', 'KWD', 'LYD', 'OMR', 'TND'];
-    const amt = Number(major);
-    if (!isFinite(amt) || amt <= 0) {
-        return 0;
-    }
-    const upper = String(currency || '').toUpperCase();
-    if (zeroDecimalCurrencies.indexOf(upper) >= 0) {
-        return Math.round(amt);
-    }
-    if (threeDecimalCurrencies.indexOf(upper) >= 0) {
-        return Math.round(amt * 1000);
-    }
-    return Math.round(amt * 100);
-}
-async function chargeWithStripe(_config, currency, amount, successUrl, cancelUrl, description, lineItems, metadata) {
-    const secretKey = resolveProviderSecret(['STRIPE_SECRET_KEY', 'CONFIGURATION_STRIPE_SECRET_KEY', 'STRIPE_TEST_KEY'], 'CONFIGURATION_STRIPE_SECRET_KEY');
-    if (!secretKey) {
-        return { checkoutUrl: '', sessionId: '', error: 'STRIPE_SECRET_KEY is not configured' };
-    }
-    try {
-        // Use webpack's `__non_webpack_require__` when present (the GUI bundles this
-        // handler through webpack, which rewrites a bare `require` into the
-        // browser-only `__webpack_require__`). Falls back to the real `require` in
-        // the plain tsc/dist build. See webpack-runtime-globals.d.ts.
-        const nodeRequire = typeof __non_webpack_require__ !== 'undefined' ? __non_webpack_require__ : require;
-        const Stripe = nodeRequire('stripe');
-        const stripe = new Stripe(secretKey);
-        // `payment_method_types` is intentionally omitted so Stripe uses Dynamic
-        // Payment Methods — the checkout surfaces every method the merchant enabled
-        // in their Stripe Dashboard (card, Apple Pay, Google Pay, Link, …) based on
-        // the shopper's device/eligibility. Pinning `['card']` would suppress that.
-        // (Stripe Checkout Sessions don't accept `automatic_payment_methods`; the
-        // documented way to opt into Dynamic Payment Methods is to omit the list.)
-        const sessionParams = {
-            mode: 'payment',
-            success_url: successUrl || undefined,
-            cancel_url: cancelUrl || undefined,
-        };
-        if (lineItems && Array.isArray(lineItems) && lineItems.length > 0) {
-            sessionParams.line_items = lineItems.map(function (item) {
-                return {
-                    price_data: {
-                        currency,
-                        product_data: { name: item.name || 'Item' },
-                        unit_amount: toStripeMinorUnits(item.unitAmount, currency),
-                    },
-                    quantity: Number(item.quantity) || 1,
-                };
+    if (driver &&
+        !previousAttempt &&
+        lookupOrderId &&
+        __paymentDrivers.core &&
+        typeof __paymentDrivers.core.closeOrderCheckouts === 'function') {
+        // An order that recorded no checkout (placed before the store recorded
+        // them, or one whose record failed): the pages the provider finds for it
+        // are closed first. One that took the money, or is taking it, opens
+        // nothing; one the provider cannot close is reopened and recorded
+        // ('adopted'); one that cannot even be found (PayPal is not searchable)
+        // is waited out.
+        let earlier;
+        try {
+            earlier = await __paymentDrivers.core.closeOrderCheckouts(driver, {
+                orderId: lookupOrderId,
+                placedAt: String(config.lookupPlacedAt || '').trim(),
             });
         }
-        else {
-            sessionParams.line_items = [
-                {
-                    price_data: {
-                        currency,
-                        product_data: { name: description },
-                        unit_amount: toStripeMinorUnits(amount, currency),
-                    },
-                    quantity: 1,
-                },
-            ];
+        catch (err) {
+            earlier = { outcome: '', error: err.message };
         }
-        if (metadata) {
-            sessionParams.metadata = metadata;
+        const found = String((earlier && earlier.outcome) || '');
+        if (!found) {
+            result = {
+                checkoutUrl: '',
+                sessionId: '',
+                error: String((earlier && earlier.error) || 'The earlier payment could not be checked.'),
+            };
+        }
+        else if (found === 'paid' || found === 'confirming') {
+            attemptOutcome = 'in-progress';
+            result = { checkoutUrl: '', sessionId: '' };
+        }
+        else if (found === 'open' && earlier.checkoutUrl && earlier.reference) {
+            attemptOutcome = 'adopted';
+            adoptedAttempt = String(earlier.reference);
+            result = { checkoutUrl: String(earlier.checkoutUrl), sessionId: adoptedAttempt };
+        }
+        else if (found === 'open') {
+            const until = new Date(String(earlier.openUntil || ''));
+            result = {
+                checkoutUrl: '',
+                sessionId: '',
+                error: 'The payment page this order opened earlier may still take a payment' +
+                    (isFinite(until.getTime())
+                        ? ' until ' + until.toISOString().slice(0, 16).replace('T', ' ') + ' UTC'
+                        : '') +
+                    '. Finish paying there, or try again after that.',
+            };
         }
-        const session = await stripe.checkout.sessions.create(sessionParams);
-        // __redirectUrl signals the client-side workflow runtime to
-        // navigate the browser to Stripe's hosted checkout page.
-        // Without it, payment-charge-user returns __terminal but the
-        // user is left stuck on the originating page (e.g. /checkout)
-        // with the loading button never resetting — Stripe's
-        // payment.created webhook never fires because the buyer never
-        // sees the payment form. See runtime.js for the redirect step.
-        const checkoutUrl = session.url || '';
-        return {
-            checkoutUrl,
-            sessionId: session.id || '',
-            __terminal: true,
-            __redirectUrl: checkoutUrl,
-        };
-    }
-    catch (err) {
-        return { checkoutUrl: '', sessionId: '', error: err.message };
     }
-}
-// Authenticates with PayPal and discovers which environment (sandbox/live)
-// the credentials belong to in the same call. Both PayPal environments issue
-// client IDs starting with `A...` so the prefix tells us nothing — but the
-// OAuth token endpoint replies with `invalid_client` when the keys belong to
-// the other environment, which we use as a precise signal to fail over.
-//
-// The detected base URL is cached at module scope (`__paypalBaseUrlCache`)
-// so the next charge in the same server instance skips the failover round
-// trip. Cache is invalidated automatically if a cached URL ever returns
-// `invalid_client` — covers credential rotation between envs.
-async function paypalAuthenticate(clientId, clientSecret) {
-    const SANDBOX = 'https://api-m.sandbox.paypal.com';
-    const LIVE = 'https://api-m.paypal.com';
-    const basicAuth = 'Basic ' + globalThis.Buffer.from(clientId + ':' + clientSecret).toString('base64');
-    async function tryAuth(baseUrl) {
+    if (driver && previousAttempt && typeof driver.inspectCheckout === 'function') {
+        let earlier;
         try {
-            const res = await fetch(baseUrl + '/v1/oauth2/token', {
-                method: 'POST',
-                headers: { Authorization: basicAuth, 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: 'grant_type=client_credentials',
-            });
-            const data = await res.json();
-            if (data && data.access_token) {
-                return { accessToken: data.access_token };
-            }
-            // PayPal's documented error code for "credentials don't match this env".
-            const isInvalidClient = data && data.error === 'invalid_client';
-            return {
-                invalidClient: isInvalidClient,
-                errorMessage: (data && (data.error_description || data.error)) || 'HTTP ' + res.status,
-            };
+            earlier = await driver.inspectCheckout({ reference: previousAttempt });
         }
-        catch (e) {
-            return { errorMessage: 'network error: ' + e.message };
+        catch (err) {
+            earlier = { error: err.message };
         }
-    }
-    // Cache hit — try it first. If credentials rotated to the other env the
-    // cached URL replies invalid_client and we re-detect.
-    const cached = globalThis.__paypalBaseUrlCache;
-    if (cached === SANDBOX || cached === LIVE) {
-        const r = await tryAuth(cached);
-        if (r.accessToken) {
-            return { baseUrl: cached, accessToken: r.accessToken };
+        const state = String((earlier && earlier.state) || '');
+        if (earlier && typeof earlier.error === 'string' && earlier.error) {
+            // Opening another checkout while the provider cannot say what became of
+            // this one could take the money twice: the buyer tries again instead.
+            result = { checkoutUrl: '', sessionId: '', error: earlier.error };
         }
-        if (!r.invalidClient) {
-            return { error: 'PayPal authentication failed: ' + r.errorMessage };
-            // invalid_client on cached env → bust cache, fall through to detection.
+        else if (state === 'open' && earlier.checkoutUrl) {
+            attemptOutcome = 'reused';
+            result = { checkoutUrl: String(earlier.checkoutUrl), sessionId: previousAttempt };
+        }
+        else if (state === 'paid' || state === 'confirming') {
+            attemptOutcome = 'in-progress';
+            result = { checkoutUrl: '', sessionId: previousAttempt };
         }
-        ;
-        globalThis.__paypalBaseUrlCache = undefined;
-    }
-    // Detection: sandbox first (safer default — most dev setups). On
-    // invalid_client try live. Anything else (network/server error) is real
-    // and worth surfacing immediately so it doesn't get masked by a successful
-    // live call against keys that belong to a different sandbox account.
-    const sandboxResult = await tryAuth(SANDBOX);
-    if (sandboxResult.accessToken) {
-        ;
-        globalThis.__paypalBaseUrlCache = SANDBOX;
-        return { baseUrl: SANDBOX, accessToken: sandboxResult.accessToken };
-    }
-    if (!sandboxResult.invalidClient) {
-        return { error: 'PayPal authentication failed: ' + sandboxResult.errorMessage };
-    }
-    const liveResult = await tryAuth(LIVE);
-    if (liveResult.accessToken) {
-        ;
-        globalThis.__paypalBaseUrlCache = LIVE;
-        return { baseUrl: LIVE, accessToken: liveResult.accessToken };
-    }
-    // Both environments rejected the credentials.
-    return {
-        error: 'PayPal authentication failed: credentials are not valid for either sandbox or live (' +
-            (liveResult.errorMessage || 'invalid_client') +
-            '). Verify CONFIGURATION_PAYPAL_CLIENT_ID and CONFIGURATION_PAYPAL_CLIENT_SECRET in .env match a single PayPal app.',
-    };
-}
-async function chargeWithPaypal(_config, currency, amount, successUrl, cancelUrl, description, metadata) {
-    const clientId = resolveProviderSecret(['PAYPAL_CLIENT_ID', 'CONFIGURATION_PAYPAL_CLIENT_ID'], 'CONFIGURATION_PAYPAL_CLIENT_ID');
-    const clientSecret = resolveProviderSecret(['PAYPAL_CLIENT_SECRET', 'CONFIGURATION_PAYPAL_CLIENT_SECRET'], 'CONFIGURATION_PAYPAL_CLIENT_SECRET');
-    if (!clientId || !clientSecret) {
-        return { checkoutUrl: '', sessionId: '', error: 'PayPal credentials are not configured' };
     }
-    // Common .env mistake: copy-pasted CLIENT_ID into both fields. Catch it
-    // before round-tripping to PayPal so the user sees an actionable message
-    // instead of a generic "Failed to authenticate" 401.
-    if (clientId === clientSecret) {
-        return {
+    if (!result && !driver) {
+        // A provider the store carries no driver for: refusing is the only honest
+        // answer — charging through another provider would take the money with
+        // keys the merchant never meant for this checkout.
+        result = {
             checkoutUrl: '',
             sessionId: '',
-            error: 'PayPal credentials are misconfigured: CLIENT_ID and CLIENT_SECRET are identical. Update CONFIGURATION_PAYPAL_CLIENT_SECRET in .env.',
+            error: 'Payment provider "' + providerType + '" is not supported by this store.',
         };
     }
-    try {
-        const auth = await paypalAuthenticate(clientId, clientSecret);
-        if ('error' in auth) {
-            return { checkoutUrl: '', sessionId: '', error: auth.error };
-        }
-        const { baseUrl, accessToken } = auth;
-        // PayPal expects amounts in the MAJOR currency unit as a string:
-        //   - Non-zero-decimal currencies: two decimals ("99.99")
-        //   - Zero-decimal currencies (HUF/JPY/TWD): whole-number string ("9999")
-        // The `amount` input is already in major units per the handler contract.
-        const PAYPAL_ZERO_DECIMAL = ['HUF', 'JPY', 'TWD'];
-        function fmtPaypalMajor(majorAmount, cur) {
-            const amt = Number(majorAmount);
-            const safe = isFinite(amt) && amt > 0 ? amt : 0;
-            if (PAYPAL_ZERO_DECIMAL.indexOf(String(cur || '').toUpperCase()) >= 0) {
-                return String(Math.round(safe));
-            }
-            return safe.toFixed(2);
-        }
-        const orderPayload = {
-            intent: 'CAPTURE',
-            purchase_units: [
-                {
-                    amount: {
-                        currency_code: currency.toUpperCase(),
-                        value: fmtPaypalMajor(Number(amount), currency),
-                    },
-                    description: description || undefined,
-                },
-            ],
-            application_context: {
-                return_url: successUrl || undefined,
-                cancel_url: cancelUrl || undefined,
-            },
+    else if (!result) {
+        const input = {
+            amount: config.amount,
+            currency,
+            description: config.description || 'Payment',
+            lineItems: config.lineItems,
+            successUrl,
+            cancelUrl,
+            metadata,
+            customerEmail: config.customerEmail,
+            baseUrl,
+            recurringInterval: config.recurringInterval,
+            recurringIntervalCount: config.recurringIntervalCount,
+            trialDays: config.trialDays,
+            amountDue: config.amountDue,
+            planId: config.planId,
+            previousAttempt,
         };
-        if (metadata) {
-            orderPayload.purchase_units[0].custom_id = JSON.stringify(metadata);
+        try {
+            result =
+                mode === 'subscription'
+                    ? await driver.createSubscriptionCheckout(input)
+                    : await driver.createCheckout(input);
         }
-        const orderResponse = await fetch(baseUrl + '/v2/checkout/orders', {
-            method: 'POST',
-            headers: {
-                Authorization: 'Bearer ' + accessToken,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(orderPayload),
-        });
-        const orderData = await orderResponse.json();
-        if (!orderResponse.ok) {
+        catch (err) {
+            result = { checkoutUrl: '', sessionId: '', error: err.message };
+        }
+    }
+    // Provider-side errors (bad keys, invalid request, wrong currency, etc.)
+    // are user-actionable configuration problems, not 500s. Surfacing them as
+    // 400 with the provider's own message lets the checkout page render an
+    // actionable toast instead of a generic "Workflow segment error" 500. The
+    // segment runtime forwards `__earlyResponse.status` / `body` straight to the
+    // HTTP response.
+    if (result && typeof result.error === 'string' && result.error) {
+        if (reportRefusal) {
+            // Never under \`error\`: the runtime ends a run on a node that answers one.
             return {
+                refused: 'true',
+                refusal: result.error,
+                provider: providerType,
                 checkoutUrl: '',
                 sessionId: '',
-                error: orderData.message ||
-                    (orderData.details && orderData.details[0] && orderData.details[0].description) ||
-                    'Order creation failed',
+                attemptRef: '',
+                attemptOutcome: '',
+                redirectUrl: '',
             };
         }
-        const approveLink = orderData.links &&
-            orderData.links.find(function (l) {
-                return l.rel === 'approve';
-            });
-        const approveUrl = approveLink ? approveLink.href : '';
         return {
-            checkoutUrl: approveUrl,
-            sessionId: orderData.id || '',
-            __terminal: true,
-            // Mirror the Stripe path — the client runtime needs the
-            // approval URL to send the buyer to PayPal's hosted page.
-            __redirectUrl: approveUrl,
+            __earlyResponse: {
+                status: 400,
+                headers: { 'Content-Type': 'application/json' },
+                body: { success: false, error: result.error, provider: providerType },
+            },
         };
     }
-    catch (err) {
-        return { checkoutUrl: '', sessionId: '', error: err.message };
+    const checkoutUrl = String((result && result.checkoutUrl) || '');
+    const sessionId = String((result && result.sessionId) || '');
+    const answer = {
+        checkoutUrl,
+        sessionId,
+        // What the store records for this checkout: the provider's reference, or
+        // more where a driver needs it to reopen the page (Square: order and link).
+        attemptRef: attemptOutcome === 'created'
+            ? String((result && result.attemptRef) || sessionId)
+            : adoptedAttempt || previousAttempt,
+        attemptOutcome,
+        redirectUrl: attemptOutcome === 'in-progress' ? successUrl : checkoutUrl,
+    };
+    if (reportRefusal) {
+        answer.refused = 'false';
+        answer.refusal = '';
+        answer.provider = providerType;
+    }
+    if (mode === 'subscription') {
+        // Known at once for a provider that creates the subscription before the
+        // buyer approves it (PayPal, Razorpay); '' where the webhook reports it.
+        answer.providerSubscriptionId = String((result && result.providerSubscriptionId) || '');
+    }
+    if (deferRedirect) {
+        return answer;
     }
+    // __redirectUrl signals the client-side workflow runtime to navigate the
+    // browser to the provider's hosted page; without it the buyer is left on the
+    // checkout page with the button spinning (see runtime.js).
+    answer.__terminal = true;
+    answer.__redirectUrl = answer.redirectUrl;
+    return answer;
 }
 exports.paymentChargeUser = {
     nodeType: 'payment-charge-user',
     executionEnv: 'server',
     isTerminal: true,
-    dependencies: {
-        stripe: '^14.0.0',
-    },
     generateHandler() {
         return ((0, types_1.handlerToString)(payment_charge_user) +
-            '\n' +
-            resolveProviderSecret.toString() +
             '\n' +
             toAbsoluteUrl.toString() +
             '\n' +
-            toStripeMinorUnits.toString() +
-            '\n' +
-            chargeWithStripe.toString() +
-            '\n' +
-            paypalAuthenticate.toString() +
-            '\n' +
-            chargeWithPaypal.toString());
+            toStoreUrl.toString());
     },
 };
 //# sourceMappingURL=payment-charge-user.js.map