@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/dist/cjs/payments/drivers/square-driver-code.js

@@ -0,0 +1,931 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSquareDriverCode = void 0;
+/**
+ * Emits `utils/payments/drivers/square.js`: Square Checkout payment links (an
+ * itemised order for a one-time purchase, a quick-pay link on a subscription
+ * plan variation for a recurring one), refunds, subscription management and
+ * the `x-square-hmacsha256-signature` webhook check the store REQUIRES.
+ *
+ * Square charges in its location's currency, and neither a payment link nor
+ * the subscription it creates carries the store's ids back — the store puts
+ * them in the payment note (`teleport:<order>:<subscription>:<variation>`),
+ * which Square copies onto the payment, and the webhook for the first charge
+ * finds the subscription Square created for that buyer and plan.
+ */
+const generateSquareDriverCode = () => `'use strict';
+/**
+ * Square driver. Generated by TeleportHQ — changes are overwritten on the next export.
+ */
+module.exports = function createSquareDriver(core) {
+  var PRODUCTION = 'https://connect.squareup.com';
+  var SANDBOX = 'https://connect.squareupsandbox.com';
+  var API_VERSION = '2026-09-16';
+  var MISSING_TOKEN = 'SQUARE_ACCESS_TOKEN is not configured';
+  var ZERO_DECIMAL = ['JPY'];
+  var NOTE_PREFIX = 'teleport:';
+  var CANCEL_NOW_UNSUPPORTED =
+    'Square cannot end a subscription immediately: it always cancels at the end of the paid period. Cancel at the period end instead.';
+  var PAUSE_SCHEDULED =
+    'Square pauses a subscription from the start of its next billing cycle, so it stays active until the current period ends.';
+  // How much earlier than its first payment Square may record a subscription.
+  var SUBSCRIPTION_CREATED_ALLOWANCE_MS = 5 * 60 * 1000;
+  // The cadences Square bills, by store interval and count.
+  var CADENCES = {
+    'day:1': 'DAILY',
+    'day:30': 'THIRTY_DAYS',
+    'day:60': 'SIXTY_DAYS',
+    'day:90': 'NINETY_DAYS',
+    'week:1': 'WEEKLY',
+    'week:2': 'EVERY_TWO_WEEKS',
+    'month:1': 'MONTHLY',
+    'month:2': 'EVERY_TWO_MONTHS',
+    'month:3': 'QUARTERLY',
+    'month:4': 'EVERY_FOUR_MONTHS',
+    'month:6': 'EVERY_SIX_MONTHS',
+    'year:1': 'ANNUAL',
+    'year:2': 'EVERY_TWO_YEARS',
+  };
+
+  function accessToken() {
+    return core.credential('square', 'accessToken');
+  }
+
+  function minor(major, currency) {
+    var value = Number(major);
+    if (!isFinite(value) || value <= 0) {
+      return 0;
+    }
+    return Math.round(ZERO_DECIMAL.indexOf(String(currency || '').toUpperCase()) >= 0 ? value : value * 100);
+  }
+
+  function major(minorValue, currency) {
+    var value = Number(minorValue);
+    if (!isFinite(value)) {
+      return 0;
+    }
+    return ZERO_DECIMAL.indexOf(String(currency || '').toUpperCase()) >= 0 ? value : value / 100;
+  }
+
+  function money(major, currency) {
+    return { amount: minor(major, currency), currency: String(currency || '').toUpperCase() };
+  }
+
+  function problem(data, fallback) {
+    var errors = data && Array.isArray(data.errors) ? data.errors : [];
+    return errors.length > 0 ? errors.map(function (e) { return e.detail || e.code; }).join('; ') : fallback;
+  }
+
+  // Idempotency keys are capped (45 characters for refunds): a long key is
+  // replaced by its hash, which is just as stable.
+  function idempotencyKey(value, max) {
+    var key = String(value || '');
+    return key.length <= max ? key : 'k-' + core.hmac('sha256', 'square-idempotency', key, 'hex').slice(0, max - 2);
+  }
+
+  // A token belongs to production or the sandbox and says nothing about which:
+  // the one that accepts it is remembered for this process.
+  async function baseUrl() {
+    var cached = globalThis.__squareBaseUrlCache;
+    if (cached === PRODUCTION || cached === SANDBOX) {
+      return { url: cached };
+    }
+    var candidates = [PRODUCTION, SANDBOX];
+    for (var i = 0; i < candidates.length; i++) {
+      var answer = await core.request(candidates[i] + '/v2/locations', {
+        headers: { Authorization: 'Bearer ' + accessToken(), 'Square-Version': API_VERSION },
+      });
+      if (answer.ok) {
+        globalThis.__squareBaseUrlCache = candidates[i];
+        return { url: candidates[i] };
+      }
+      if (answer.status !== 401) {
+        return { error: problem(answer.data, 'Square could not be reached (HTTP ' + answer.status + ')') };
+      }
+    }
+    return { error: 'Square does not accept the access token in either production or the sandbox.' };
+  }
+
+  async function call(method, path, body) {
+    var base = await baseUrl();
+    if (base.error) {
+      return { ok: false, status: 0, data: { errors: [{ detail: base.error }] } };
+    }
+    return core.request(base.url + path, {
+      method: method,
+      headers: {
+        Authorization: 'Bearer ' + accessToken(),
+        'Content-Type': 'application/json',
+        'Square-Version': API_VERSION,
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+  }
+
+  // The configured location, else the account's main one; its currency is the
+  // only one Square charges in.
+  async function location() {
+    var configured = core.credential('square', 'locationId');
+    var answer = await call('GET', '/v2/locations/' + encodeURIComponent(configured || 'main'));
+    // A configured id the token cannot use (another account's, a country
+    // typed in its place): Square says only that access is forbidden.
+    if (configured && (answer.status === 403 || answer.status === 404)) {
+      return { error: 'Square has no location "' + configured + '" these keys can charge through: the store needs a Square location ID, or none for the main location.' };
+    }
+    if (!answer.ok || !answer.data || !answer.data.location) {
+      return { error: problem(answer.data, 'Square could not find the location to charge through.') };
+    }
+    var found = answer.data.location;
+    return {
+      id: found.id,
+      currency: String(found.currency || '').toUpperCase(),
+      country: String(found.country || '').toUpperCase(),
+      // Square lists what it enabled for the location; card payments only
+      // once the seller's account can take them (a supported country, an
+      // activated account). No list: nothing to go by, nothing refused.
+      takesCards: !Array.isArray(found.capabilities) || found.capabilities.indexOf('CREDIT_CARD_PROCESSING') !== -1,
+    };
+  }
+
+  function currencyMismatch(place, currency) {
+    return place.currency && place.currency !== String(currency || '').toUpperCase()
+      ? 'Square charges in the location currency (' + place.currency + '), but these products are priced in ' + String(currency || '').toUpperCase() + '.'
+      : '';
+  }
+
+  // Why this location cannot take the payment, or '' when it can: Square's
+  // own page would otherwise tell the buyer only that the business is "not
+  // accepting payments".
+  function cannotCharge(place, currency) {
+    if (!place.takesCards) {
+      return 'This Square account cannot take card payments yet: Square has not enabled card processing for its location' + (place.country ? ' (' + place.country + ')' : '') + '.';
+    }
+    return currencyMismatch(place, currency);
+  }
+
+  function paymentNote(metadata, variationId) {
+    return (NOTE_PREFIX + [metadata.orderId || '', metadata.subscriptionId || '', variationId || ''].join(':')).slice(0, 500);
+  }
+
+  function readNote(note) {
+    var text = String(note || '');
+    if (text.indexOf(NOTE_PREFIX) !== 0) {
+      return null;
+    }
+    var parts = text.slice(NOTE_PREFIX.length).split(':');
+    return { orderId: parts[0] || '', subscriptionId: parts[1] || '', variationId: parts[2] || '' };
+  }
+
+  function linkResult(answer, extra) {
+    var link = answer.ok && answer.data ? answer.data.payment_link : null;
+    if (!link || !link.url) {
+      return { checkoutUrl: '', sessionId: '', error: problem(answer.data, 'Square refused the payment link (HTTP ' + answer.status + ')') };
+    }
+    var result = { checkoutUrl: String(link.url), sessionId: String(link.order_id || link.id || '') };
+    // The attempt as the store records it: the order the payment events name,
+    // then the link that reopens its page.
+    if (link.order_id && link.id) {
+      result.attemptRef = String(link.order_id) + ':' + String(link.id);
+    }
+    Object.keys(extra || {}).forEach(function (key) {
+      result[key] = extra[key];
+    });
+    return result;
+  }
+
+  async function createCheckout(input) {
+    if (!accessToken()) {
+      return { checkoutUrl: '', sessionId: '', error: MISSING_TOKEN };
+    }
+    try {
+      var place = await location();
+      if (place.error) {
+        return { checkoutUrl: '', sessionId: '', error: place.error };
+      }
+      var mismatch = cannotCharge(place, input.currency);
+      if (mismatch) {
+        return { checkoutUrl: '', sessionId: '', error: mismatch };
+      }
+      var metadata = input.metadata || {};
+      var lines = Array.isArray(input.lineItems) && input.lineItems.length > 0 ? input.lineItems : [{ name: input.description, unitAmount: input.amount, quantity: 1 }];
+      var body = {
+        // A retried checkout gets the link it already created; a checkout opened
+        // after an earlier one closed is a new link.
+        idempotency_key: idempotencyKey(
+          'link:' + (metadata.orderId || Date.now()) + (input.previousAttempt ? ':' + input.previousAttempt : ''),
+          192
+        ),
+        order: {
+          location_id: place.id,
+          reference_id: String(metadata.orderId || '').slice(0, 40) || undefined,
+          line_items: lines.map(function (line) {
+            return {
+              name: String(line.name || 'Item').slice(0, 512),
+              quantity: String(Math.max(1, Math.floor(Number(line.quantity) || 1))),
+              base_price_money: money(line.unitAmount, input.currency),
+            };
+          }),
+        },
+        checkout_options: { redirect_url: input.successUrl || undefined },
+        payment_note: paymentNote(metadata, ''),
+      };
+      if (input.customerEmail) {
+        body.pre_populated_data = { buyer_email: String(input.customerEmail).slice(0, 256) };
+      }
+      return linkResult(await call('POST', '/v2/online-checkout/payment-links', body));
+    } catch (err) {
+      return { checkoutUrl: '', sessionId: '', error: core.describeError(err) };
+    }
+  }
+
+  // What the payments on an order took: an order a payment link opened stays
+  // OPEN after it is paid, so its tenders' payments decide. \`paid\` once it
+  // owes nothing or a payment completed, \`confirming\` while one is approved
+  // or pending, '' when none took money (failed or cancelled ones included);
+  // \`{ error }\` when a payment could not be read.
+  async function tenderState(order) {
+    var tenders = Array.isArray(order && order.tenders) ? order.tenders : [];
+    if (tenders.length === 0) {
+      return { state: '' };
+    }
+    var due = order.net_amount_due_money ? Number(order.net_amount_due_money.amount) : NaN;
+    if (due === 0) {
+      return { state: 'paid' };
+    }
+    var state = '';
+    for (var i = 0; i < tenders.length; i++) {
+      var paymentId = String((tenders[i] && (tenders[i].payment_id || tenders[i].id)) || '');
+      if (!paymentId) {
+        continue;
+      }
+      var answer = await call('GET', '/v2/payments/' + encodeURIComponent(paymentId));
+      var payment = answer.ok && answer.data ? answer.data.payment : null;
+      if (!payment) {
+        return { error: problem(answer.data, 'Square could not be asked about payment ' + paymentId) };
+      }
+      var status = String(payment.status || '').toUpperCase();
+      if (status === 'COMPLETED') {
+        return { state: 'paid' };
+      }
+      if (status === 'APPROVED' || status === 'PENDING') {
+        state = 'confirming';
+      }
+    }
+    return { state: state };
+  }
+
+  // A Square order as a checkout state: a cancelled one takes no more, a
+  // completed one is paid, and an open one is what its payments took —
+  // \`open\` when they took nothing.
+  async function orderState(order) {
+    var state = String((order && order.state) || '').toUpperCase();
+    if (state === 'CANCELED') {
+      return { state: 'closed' };
+    }
+    if (state === 'COMPLETED') {
+      return { state: 'paid' };
+    }
+    var taken = await tenderState(order);
+    return taken.error ? taken : { state: taken.state || 'open' };
+  }
+
+  // What became of a checkout the store opened earlier (its order, then its
+  // payment link). An open order nobody paid is paid on its link's page,
+  // which is read back for its address.
+  async function inspectCheckout(input) {
+    var parts = String((input && input.reference) || '').trim().split(':');
+    var orderId = parts[0] || '';
+    var linkId = parts[1] || '';
+    if (!orderId) {
+      return { state: 'closed', checkoutUrl: '' };
+    }
+    if (!accessToken()) {
+      return { state: '', checkoutUrl: '', error: MISSING_TOKEN };
+    }
+    try {
+      var answer = await call('GET', '/v2/orders/' + encodeURIComponent(orderId));
+      if (answer.status === 404) {
+        return { state: 'closed', checkoutUrl: '' };
+      }
+      if (!answer.ok || !answer.data || !answer.data.order) {
+        return { state: '', checkoutUrl: '', error: problem(answer.data, 'Square could not be asked about order ' + orderId) };
+      }
+      var found = await orderState(answer.data.order);
+      if (found.error) {
+        return { state: '', checkoutUrl: '', error: found.error };
+      }
+      if (found.state !== 'open') {
+        return { state: found.state, checkoutUrl: '' };
+      }
+      if (!linkId) {
+        return { state: 'closed', checkoutUrl: '' };
+      }
+      var link = await call('GET', '/v2/online-checkout/payment-links/' + encodeURIComponent(linkId));
+      if (link.status === 404) {
+        return { state: 'closed', checkoutUrl: '' };
+      }
+      if (!link.ok) {
+        return { state: '', checkoutUrl: '', error: problem(link.data, 'Square could not be asked about payment link ' + linkId) };
+      }
+      var page = link.data && link.data.payment_link ? String(link.data.payment_link.url || '') : '';
+      return page ? { state: 'open', checkoutUrl: page } : { state: 'closed', checkoutUrl: '' };
+    } catch (err) {
+      return { state: '', checkoutUrl: '', error: core.describeError(err) };
+    }
+  }
+
+  // Closes a checkout the order no longer needs: its payment link is deleted,
+  // so its page is gone, which cancels its Square order with it; the order is
+  // cancelled on its own only when there is no link to delete, or deleting it
+  // failed. An order whose payments took money is answered as what they took.
+  async function closeCheckout(input) {
+    var parts = String((input && input.reference) || '').trim().split(':');
+    var orderId = parts[0] || '';
+    var linkId = parts[1] || '';
+    if (!orderId) {
+      return { state: 'closed', checkoutUrl: '', openUntil: '' };
+    }
+    if (!accessToken()) {
+      return { state: '', error: MISSING_TOKEN };
+    }
+    try {
+      var path = '/v2/orders/' + encodeURIComponent(orderId);
+      var answer = await call('GET', path);
+      if (answer.status === 404) {
+        return { state: 'closed', checkoutUrl: '', openUntil: '' };
+      }
+      if (!answer.ok || !answer.data || !answer.data.order) {
+        return { state: '', error: problem(answer.data, 'Square could not be asked about order ' + orderId) };
+      }
+      var order = answer.data.order;
+      var found = await orderState(order);
+      if (found.error) {
+        return { state: '', error: found.error };
+      }
+      if (found.state !== 'open') {
+        return { state: found.state, checkoutUrl: '', openUntil: '' };
+      }
+      var linkGone = false;
+      if (linkId) {
+        var deleted = await call('DELETE', '/v2/online-checkout/payment-links/' + encodeURIComponent(linkId));
+        if (deleted.ok) {
+          return { state: 'closed', checkoutUrl: '', openUntil: '' };
+        }
+        linkGone = deleted.status === 404;
+      }
+      var cancelled = await call('PUT', path, {
+        idempotency_key: idempotencyKey('close:' + orderId + ':' + String(order.version || ''), 192),
+        order: { location_id: order.location_id, version: order.version, state: 'CANCELED' },
+      });
+      if (cancelled.ok || linkGone) {
+        return { state: 'closed', checkoutUrl: '', openUntil: '' };
+      }
+      // Paid between the read and the cancellation: answer what it became.
+      var again = await call('GET', path);
+      var after = again.ok && again.data && again.data.order ? await orderState(again.data.order) : {};
+      return after.state && after.state !== 'open'
+        ? { state: after.state, checkoutUrl: '', openUntil: '' }
+        : { state: '', error: after.error || problem(cancelled.data, 'Square did not cancel order ' + orderId) };
+    } catch (err) {
+      return { state: '', error: core.describeError(err) };
+    }
+  }
+
+  // The Square orders opened for an order around the moment it was placed:
+  // they carry the order as their reference. A search filtered on a time
+  // must sort on that same time, or Square refuses it.
+  async function searchOrders(locationId, reference, span) {
+    var references = [];
+    var cursor = '';
+    for (var page = 0; page < core.SEARCH_PAGE_LIMIT; page++) {
+      var body = {
+        location_ids: [locationId],
+        query: {
+          filter: { date_time_filter: { created_at: { start_at: core.isoTime(span.from), end_at: core.isoTime(span.to) } } },
+          sort: { sort_field: 'CREATED_AT' },
+        },
+        limit: 500,
+      };
+      if (cursor) {
+        body.cursor = cursor;
+      }
+      var answer = await call('POST', '/v2/orders/search', body);
+      if (!answer.ok || !answer.data) {
+        return { error: problem(answer.data, 'Square could not search its orders') };
+      }
+      (Array.isArray(answer.data.orders) ? answer.data.orders : []).forEach(function (order) {
+        if (order && order.id && String(order.reference_id || '') === reference) {
+          references.push(String(order.id));
+        }
+      });
+      cursor = String(answer.data.cursor || '');
+      if (!cursor) {
+        return { references: references };
+      }
+    }
+    return { error: 'Square has more orders around the time this order was placed than the store can search.' };
+  }
+
+  // The payment links opened for the order around the moment it was placed,
+  // as \`<order id>:<link id>\`: the link's note names the order. The order of
+  // a link nobody opened yet may be a draft an order search does not return.
+  async function searchLinks(orderId, span) {
+    var prefix = NOTE_PREFIX + orderId + ':';
+    var references = [];
+    var cursor = '';
+    for (var page = 0; page < core.SEARCH_PAGE_LIMIT; page++) {
+      var answer = await call('GET', '/v2/online-checkout/payment-links?limit=1000' + (cursor ? '&cursor=' + encodeURIComponent(cursor) : ''));
+      if (!answer.ok || !answer.data) {
+        return { error: problem(answer.data, 'Square could not list its payment links') };
+      }
+      (Array.isArray(answer.data.payment_links) ? answer.data.payment_links : []).forEach(function (link) {
+        var created = Date.parse(String((link && link.created_at) || ''));
+        if (link && link.id && link.order_id && String(link.payment_note || '').indexOf(prefix) === 0 && created >= span.from && created <= span.to) {
+          references.push(String(link.order_id) + ':' + String(link.id));
+        }
+      });
+      cursor = String(answer.data.cursor || '');
+      if (!cursor) {
+        return { references: references };
+      }
+    }
+    return { error: 'Square has more payment links than the store can search.' };
+  }
+
+  async function findCheckouts(input) {
+    var orderId = String((input && input.orderId) || '').trim();
+    var span = core.searchWindow(input && input.placedAt);
+    if (!orderId || !span) {
+      return { error: 'The order to look up names no id or no time it was placed.' };
+    }
+    if (!accessToken()) {
+      return { error: MISSING_TOKEN };
+    }
+    try {
+      var place = await location();
+      if (place.error) {
+        return { error: place.error };
+      }
+      var orders = await searchOrders(place.id, orderId.slice(0, 40), span);
+      if (orders.error || orders.references.length > 0) {
+        return orders;
+      }
+      return await searchLinks(orderId, span);
+    } catch (err) {
+      return { error: core.describeError(err) };
+    }
+  }
+
+  function planFailure(message) {
+    return { ok: 'false', planId: '', providerProductId: '', created: 'false', error: message };
+  }
+
+  // A subscription plan and one variation (one STATIC paid phase) per product
+  // and price, cached by the workflow: Square's phases are immutable, so a new
+  // price is a new variation. The sandbox and production keep separate
+  // catalogs: a cached variation the current token's catalog does not have
+  // (the store moved between them) is created again there. One that cannot
+  // be checked right now is used as it is.
+  async function ensurePlan(input) {
+    if (!accessToken()) {
+      return planFailure(MISSING_TOKEN);
+    }
+    var cached = String(input.planId || '').trim();
+    if (cached) {
+      try {
+        var known = await call('GET', '/v2/catalog/object/' + encodeURIComponent(cached));
+        if (known.status !== 404) {
+          return { ok: 'true', planId: cached, providerProductId: String(input.providerProductId || ''), created: 'false' };
+        }
+      } catch (_err) {
+        return { ok: 'true', planId: cached, providerProductId: String(input.providerProductId || ''), created: 'false' };
+      }
+    }
+    var cadence = CADENCES[String(input.interval || 'month').toLowerCase() + ':' + Math.max(1, Math.floor(Number(input.intervalCount) || 1))];
+    if (!cadence) {
+      return planFailure('Square cannot bill every ' + (input.intervalCount || 1) + ' ' + input.interval + '(s).');
+    }
+    if (Math.max(0, Math.floor(Number(input.trialDays) || 0)) > 0) {
+      return planFailure('Square subscriptions charge at checkout, so they cannot start with a free trial.');
+    }
+    try {
+      // A plan priced in another currency than the location's is refused by
+      // Square's catalog with an opaque error: say what is wrong instead.
+      var place = await location();
+      if (place.error) {
+        return planFailure(place.error);
+      }
+      var mismatch = cannotCharge(place, input.currency);
+      if (mismatch) {
+        return planFailure(mismatch);
+      }
+      var name = String(input.productName || 'Subscription').slice(0, 255);
+      var plan = await call('POST', '/v2/catalog/object', {
+        idempotency_key: idempotencyKey('plan:' + input.productId + ':' + input.amount + ':' + cadence, 128),
+        object: { type: 'SUBSCRIPTION_PLAN', id: '#plan', present_at_all_locations: true, subscription_plan_data: { name: name } },
+      });
+      var planId = plan.ok && plan.data && plan.data.catalog_object ? String(plan.data.catalog_object.id) : '';
+      if (!planId) {
+        return planFailure(problem(plan.data, 'Square refused the subscription plan (HTTP ' + plan.status + ')'));
+      }
+      var variation = await call('POST', '/v2/catalog/object', {
+        idempotency_key: idempotencyKey('variation:' + planId + ':' + input.amount + ':' + cadence, 128),
+        object: {
+          type: 'SUBSCRIPTION_PLAN_VARIATION',
+          id: '#variation',
+          subscription_plan_variation_data: {
+            name: name,
+            subscription_plan_id: planId,
+            phases: [{ cadence: cadence, pricing: { type: 'STATIC', price_money: money(input.amount, input.currency) } }],
+          },
+        },
+      });
+      var variationId = variation.ok && variation.data && variation.data.catalog_object ? String(variation.data.catalog_object.id) : '';
+      if (!variationId) {
+        return planFailure(problem(variation.data, 'Square refused the plan variation (HTTP ' + variation.status + ')'));
+      }
+      return { ok: 'true', planId: variationId, providerProductId: planId, created: 'true' };
+    } catch (err) {
+      return planFailure(core.describeError(err));
+    }
+  }
+
+  // A quick-pay link on the plan VARIATION: Square saves the card, creates the
+  // subscription and charges its first cycle. Its one paid phase leaves no
+  // room for a gift card on that charge.
+  async function createSubscriptionCheckout(input) {
+    if (!accessToken()) {
+      return { checkoutUrl: '', sessionId: '', error: MISSING_TOKEN };
+    }
+    var variationId = String(input.planId || '').trim();
+    if (!variationId) {
+      return { checkoutUrl: '', sessionId: '', error: 'No Square plan variation was supplied for the subscription' };
+    }
+    var regular = Number(input.amount);
+    var due = Number(input.amountDue);
+    if (isFinite(due) && due < regular) {
+      return { checkoutUrl: '', sessionId: '', error: 'Square cannot take a gift card toward a subscription payment.' };
+    }
+    try {
+      var place = await location();
+      if (place.error) {
+        return { checkoutUrl: '', sessionId: '', error: place.error };
+      }
+      var mismatch = cannotCharge(place, input.currency);
+      if (mismatch) {
+        return { checkoutUrl: '', sessionId: '', error: mismatch };
+      }
+      var metadata = input.metadata || {};
+      var body = {
+        idempotency_key: idempotencyKey('subscription:' + (metadata.subscriptionId || Date.now()), 192),
+        quick_pay: { name: String(input.description || 'Subscription').slice(0, 255), price_money: money(regular, input.currency), location_id: place.id },
+        checkout_options: { subscription_plan_id: variationId, redirect_url: input.successUrl || undefined },
+        payment_note: paymentNote(metadata, variationId),
+      };
+      if (input.customerEmail) {
+        body.pre_populated_data = { buyer_email: String(input.customerEmail).slice(0, 256) };
+      }
+      return linkResult(await call('POST', '/v2/online-checkout/payment-links', body), { providerSubscriptionId: '' });
+    } catch (err) {
+      return { checkoutUrl: '', sessionId: '', error: core.describeError(err) };
+    }
+  }
+
+  function subscriptionStatus(status) {
+    var map = { PENDING: 'pending', ACTIVE: 'active', CANCELED: 'cancelled', DEACTIVATED: 'past_due', PAUSED: 'paused', COMPLETED: 'expired' };
+    return map[String(status || '').toUpperCase()] || '';
+  }
+
+  function dayToIso(value) {
+    return value ? new Date(String(value) + 'T00:00:00Z').toISOString() : '';
+  }
+
+  function manageFailure(message) {
+    return { ok: 'false', status: '', cancelAtPeriodEnd: 'false', currentPeriodStart: '', currentPeriodEnd: '', error: message };
+  }
+
+  // The pause Square scheduled for the next billing cycle, on a subscription
+  // read with its actions; null when none waits.
+  function pendingPause(subscription) {
+    var actions = Array.isArray(subscription.actions) ? subscription.actions : [];
+    for (var i = 0; i < actions.length; i++) {
+      if (actions[i] && actions[i].id && String(actions[i].type || '').toUpperCase() === 'PAUSE') {
+        return actions[i];
+      }
+    }
+    return null;
+  }
+
+  // Square only ever cancels at the end of the paid period, so "cancel now"
+  // is refused. A pause starts with the next billing cycle: until then the
+  // subscription stays active, and the answer says so. A resume withdraws a
+  // scheduled cancellation, resumes a paused subscription at once, or deletes
+  // a pause still waiting for its cycle.
+  async function manageSubscription(input) {
+    if (!accessToken()) {
+      return manageFailure(MISSING_TOKEN);
+    }
+    if (input.action === 'cancel') {
+      return manageFailure(CANCEL_NOW_UNSUPPORTED);
+    }
+    var path = '/v2/subscriptions/' + encodeURIComponent(input.subscriptionId);
+    try {
+      var answer;
+      if (input.action === 'refresh') {
+        answer = await call('GET', path + '?include=actions');
+      } else if (input.action === 'cancel_at_period_end') {
+        answer = await call('POST', path + '/cancel');
+      } else if (input.action === 'pause') {
+        answer = await call('POST', path + '/pause', {});
+      } else {
+        var current = await call('GET', path + '?include=actions');
+        var existing = current.ok && current.data ? current.data.subscription : null;
+        if (!existing) {
+          return manageFailure(problem(current.data, 'Square could not read the subscription (HTTP ' + current.status + ')'));
+        }
+        var pause = String(existing.status || '').toUpperCase() === 'PAUSED' ? null : pendingPause(existing);
+        answer = existing.canceled_date
+          ? await call('PUT', path, { subscription: { canceled_date: null } })
+          : pause
+          ? await call('DELETE', path + '/actions/' + encodeURIComponent(pause.id))
+          : await call('POST', path + '/resume', { resume_change_timing: 'IMMEDIATE' });
+      }
+      var subscription = answer.ok && answer.data ? answer.data.subscription : null;
+      if (!subscription) {
+        return manageFailure(problem(answer.data, 'Square refused the change (HTTP ' + answer.status + ')'));
+      }
+      var scheduledCancel = !!subscription.canceled_date && String(subscription.status).toUpperCase() !== 'CANCELED';
+      var result = {
+        ok: 'true',
+        status: subscriptionStatus(subscription.status),
+        cancelAtPeriodEnd: scheduledCancel ? 'true' : 'false',
+        currentPeriodStart: '',
+        currentPeriodEnd: dayToIso(subscription.charged_through_date || subscription.canceled_date),
+      };
+      if (input.action === 'pause' && result.status !== 'paused') {
+        result.message = PAUSE_SCHEDULED;
+      }
+      return result;
+    } catch (err) {
+      return manageFailure(core.describeError(err));
+    }
+  }
+
+  async function billingPortal() {
+    return { ok: 'false', url: '', error: 'Square has no billing page for subscribers.' };
+  }
+
+  function refundFailure(currency, message, extra) {
+    var result = { success: false, refundId: '', amount: 0, currency: currency, status: '', error: message };
+    if (extra) {
+      Object.keys(extra).forEach(function (key) {
+        result[key] = extra[key];
+      });
+    }
+    return result;
+  }
+
+  // Square needs the amount even for a full refund: what is left of the
+  // payment, read from the payment itself.
+  async function refund(input) {
+    var currency = String(input.currency || '').toUpperCase();
+    if (!accessToken()) {
+      return refundFailure(currency, MISSING_TOKEN);
+    }
+    var paymentId = String(input.paymentReference || '').trim();
+    if (!paymentId) {
+      return refundFailure(currency, 'This order has no Square payment to refund.');
+    }
+    try {
+      var found = await call('GET', '/v2/payments/' + encodeURIComponent(paymentId));
+      var payment = found.ok && found.data ? found.data.payment : null;
+      if (!payment) {
+        return refundFailure(currency, problem(found.data, 'Square could not find the payment ' + paymentId + '.'));
+      }
+      var paymentCurrency = String((payment.total_money && payment.total_money.currency) || currency).toUpperCase();
+      var remaining = Number((payment.total_money && payment.total_money.amount) || 0) - Number((payment.refunded_money && payment.refunded_money.amount) || 0);
+      var amountMinor = input.amount > 0 ? minor(input.amount, paymentCurrency) : remaining;
+      if (!(amountMinor > 0)) {
+        return refundFailure(paymentCurrency, input.amount > 0 ? 'The amount is smaller than the smallest unit of ' + paymentCurrency + '.' : 'Nothing is left to refund on this Square payment.');
+      }
+      var answer = await call('POST', '/v2/refunds', {
+        idempotency_key: idempotencyKey(input.idempotencyKey, 45),
+        payment_id: paymentId,
+        amount_money: { amount: amountMinor, currency: paymentCurrency },
+        reason: String(input.reason || '').trim().slice(0, 192) || undefined,
+      });
+      var created = answer.ok && answer.data ? answer.data.refund : null;
+      if (!created) {
+        return refundFailure(paymentCurrency, problem(answer.data, 'Square refused the refund (HTTP ' + answer.status + ')'));
+      }
+      var status = String(created.status || '');
+      if (status === 'REJECTED' || status === 'FAILED') {
+        return refundFailure(paymentCurrency, 'Square reported the refund as ' + status.toLowerCase() + '.', { refundId: created.id || '', status: status });
+      }
+      return {
+        success: true,
+        refundId: created.id || '',
+        amount: major(created.amount_money && created.amount_money.amount, paymentCurrency),
+        currency: paymentCurrency,
+        status: status,
+        error: '',
+      };
+    } catch (err) {
+      return refundFailure(currency, core.describeError(err));
+    }
+  }
+
+  // The URL Square posted to, which it signs with the body. Behind a proxy
+  // that does not pass the public host on, the request's own URL is not the
+  // registered one: the store's canonical origin (NEXTAUTH_URL) with the same
+  // path is tried too. A candidate URL cannot weaken the check — without the
+  // signature key no URL matches.
+  function signedUrlCandidates(input) {
+    var candidates = [];
+    var requested = String(input.url || '');
+    if (requested) {
+      candidates.push(requested);
+    }
+    var canonical = String(process.env.NEXTAUTH_URL || '').trim();
+    if (requested && canonical) {
+      try {
+        var own = new URL(requested);
+        var alternative = new URL(canonical).origin + own.pathname + own.search;
+        if (candidates.indexOf(alternative) === -1) {
+          candidates.push(alternative);
+        }
+      } catch (_err) {}
+    }
+    return candidates;
+  }
+
+  function signatureMatches(input, secret) {
+    var signature = core.header(input.headers, 'x-square-hmacsha256-signature');
+    if (!signature) {
+      return false;
+    }
+    return signedUrlCandidates(input).some(function (url) {
+      return core.safeEqual(core.hmac('sha256', secret, url + input.rawBody.toString('utf8'), 'base64'), signature);
+    });
+  }
+
+  // The first charge of a subscription names the store's rows in its note;
+  // the subscription Square created for that buyer and variation is looked up
+  // and handed to the store with it. Square may create it a moment after the
+  // payment, so a miss asks Square to deliver the event again. A returning
+  // subscriber's ended subscription, or an older one on the same plan, is
+  // not this payment's: only a live one no older than the payment (less a
+  // moment, as Square may record it just before the charge) is.
+  async function attachSubscription(payment, marker) {
+    var customerId = String(payment.customer_id || '');
+    if (!customerId) {
+      return { retry: 'Square has not attached a customer to the payment ' + payment.id + ' yet.' };
+    }
+    var found = await call('POST', '/v2/subscriptions/search', { query: { filter: { customer_ids: [customerId] } } });
+    var list = found.ok && found.data && Array.isArray(found.data.subscriptions) ? found.data.subscriptions : [];
+    var paidAt = Date.parse(String(payment.created_at || ''));
+    var matches = list
+      .filter(function (subscription) {
+        var status = String(subscription.status || '').toUpperCase();
+        if (status === 'CANCELED' || status === 'DEACTIVATED') {
+          return false;
+        }
+        if (marker.variationId && subscription.plan_variation_id !== marker.variationId) {
+          return false;
+        }
+        return isNaN(paidAt) || Date.parse(String(subscription.created_at || '')) >= paidAt - SUBSCRIPTION_CREATED_ALLOWANCE_MS;
+      })
+      .sort(function (a, b) {
+        return String(b.created_at || '').localeCompare(String(a.created_at || ''));
+      });
+    if (matches.length === 0) {
+      return { retry: 'Square has not created the subscription for payment ' + payment.id + ' yet.' };
+    }
+    return { subscription: matches[0] };
+  }
+
+  // The payment behind an order: its first tender's; '' for an order nobody paid.
+  function tenderPaymentId(order) {
+    var tenders = order && Array.isArray(order.tenders) ? order.tenders : [];
+    return tenders.length > 0 ? String(tenders[0].payment_id || tenders[0].id || '') : '';
+  }
+
+  // A renewal is an invoice: its payment is the tender of the invoice's order.
+  async function attachInvoicePayment(invoice) {
+    if (!invoice.order_id) {
+      return {};
+    }
+    var answer = await call('GET', '/v2/orders/' + encodeURIComponent(invoice.order_id));
+    return { paymentId: answer.ok && answer.data ? tenderPaymentId(answer.data.order) : '' };
+  }
+
+  async function verifyWebhook(input) {
+    var secret = input.secret || core.credential('square', 'webhookSignatureKey');
+    if (!secret) {
+      return { ok: false, reason: 'The Square webhook signature key (SQUARE_WEBHOOK_SIGNATURE_KEY) is not configured.' };
+    }
+    if (!signatureMatches(input, secret)) {
+      return { ok: false, reason: 'The Square signature does not match: the signature key belongs to another webhook subscription, or Square posts to another URL than ' + (input.url || 'this route') + '.' };
+    }
+    return enrichEvent(input.body || {});
+  }
+
+  // What the store reads off an event past its signature, or one built from
+  // Square (see reconcile): the store rows a payment note names, with the
+  // subscription a first charge opened, and the payment behind a renewal.
+  async function enrichEvent(body) {
+    var object = (body.data && body.data.object) || {};
+    try {
+      if (object.payment) {
+        var marker = readNote(object.payment.note);
+        if (marker) {
+          object.payment.teleport = marker;
+          if (marker.subscriptionId && String(object.payment.status).toUpperCase() === 'COMPLETED') {
+            var attached = await attachSubscription(object.payment, marker);
+            if (attached.retry) {
+              return { ok: false, retry: true, reason: attached.retry };
+            }
+            object.payment.teleportSubscription = attached.subscription;
+          }
+        }
+      } else if (object.invoice && object.invoice.subscription_id) {
+        object.invoice.teleportPaymentId = (await attachInvoicePayment(object.invoice)).paymentId || '';
+      }
+      return { ok: true, body: body };
+    } catch (err) {
+      return { ok: false, retry: true, reason: core.describeError(err) };
+    }
+  }
+
+  // A checkout whose webhook never came (no webhook subscription for this
+  // store's address, a key of another one) is settled from Square itself:
+  // its order's payment is READ with the store's token and answered as the
+  // \`payment.updated\` Square sends for it. Nothing but the checkout's
+  // reference (\`<order id>:<link id>\`, or the order id alone) comes from the
+  // request.
+  var CHECKOUT_REFERENCE_PATTERN = /^([A-Za-z0-9]{8,64})(:[A-Za-z0-9]{8,64})?$/;
+
+  // Square could not be asked (its environment could not be found, an
+  // outage, a rate limit): worth asking again.
+  function unanswered(answer, fallback) {
+    return { ok: false, retry: answer.status === 0 || answer.status >= 500 || answer.status === 429, reason: problem(answer.data, fallback) };
+  }
+
+  async function reconcile(request) {
+    var kind = String((request && request.kind) || '');
+    var reference = CHECKOUT_REFERENCE_PATTERN.exec(String((request && request.id) || '').trim());
+    if (kind !== 'checkout' || !reference) {
+      return { ok: false, reason: 'The request names no Square checkout to settle.' };
+    }
+    if (!accessToken()) {
+      return { ok: false, retry: true, reason: MISSING_TOKEN };
+    }
+    var orderId = reference[1];
+    try {
+      var answer = await call('GET', '/v2/orders/' + encodeURIComponent(orderId));
+      if (!answer.ok || !answer.data || !answer.data.order) {
+        return unanswered(answer, 'Square could not be asked about order ' + orderId);
+      }
+      var paymentId = tenderPaymentId(answer.data.order);
+      if (!paymentId) {
+        return { ok: false, reason: 'Nobody has paid Square order ' + orderId + ' yet.' };
+      }
+      var found = await call('GET', '/v2/payments/' + encodeURIComponent(paymentId));
+      var payment = found.ok && found.data ? found.data.payment : null;
+      if (!payment) {
+        return unanswered(found, 'Square could not be asked about payment ' + paymentId);
+      }
+      return await enrichEvent({
+        type: 'payment.updated',
+        event_id: 'teleport-settle:' + String(payment.id || paymentId),
+        created_at: new Date().toISOString(),
+        data: { type: 'payment', id: String(payment.id || paymentId), object: { payment: payment } },
+      });
+    } catch (err) {
+      return { ok: false, retry: true, reason: core.describeError(err) };
+    }
+  }
+
+  function reconcileKinds(reference) {
+    return CHECKOUT_REFERENCE_PATTERN.test(String(reference || '').trim()) ? ['checkout'] : [];
+  }
+
+  return {
+    id: 'square',
+    createCheckout: createCheckout,
+    createSubscriptionCheckout: createSubscriptionCheckout,
+    inspectCheckout: inspectCheckout,
+    closeCheckout: closeCheckout,
+    findCheckouts: findCheckouts,
+    ensurePlan: ensurePlan,
+    refund: refund,
+    manageSubscription: manageSubscription,
+    billingPortal: billingPortal,
+    reconcile: reconcile,
+    reconcileKinds: reconcileKinds,
+    verifyWebhook: verifyWebhook,
+  };
+};
+`;
+exports.generateSquareDriverCode = generateSquareDriverCode;
+//# sourceMappingURL=square-driver-code.js.map