@vtex/faststore 0.0.8 → 0.0.11

package/dist/sdk/navigation/binding-switch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-switch.js","names":[],"sources":["../../../src/sdk/navigation/binding-switch.ts"],"sourcesContent":["import type { ApolloClient } from '@apollo/client';\nimport {\n  type AlternateBinding,\n  CATALOG_ROUTE_ALTERNATES_QUERY,\n  catalogClusterPaths,\n  encodePath,\n} from '../seo/page-alternates.js';\nimport { decodeRouteParams } from './decode-route-params.js';\nimport { resolveStorefrontHref } from './resolve-storefront-href.js';\nimport type { RouteMap, RouteMapEntry, StandardName } from './types.js';\n\n/** Bounds the `catalogRoute` lookup: a slow API takes the no-equivalent fallback instead of stalling the switch. */\nconst BINDING_SWITCH_LOOKUP_TIMEOUT_MS = 3_000;\n\nconst CATALOG_STANDARDS: ReadonlySet<StandardName> = new Set(['product', 'category', 'brand', 'collection']);\n\nconst NO_EQUIVALENT_QUERY = '?fs_notice=no-equivalent';\n\nexport type BindingSwitchRequest = {\n  /** Destination binding id. */\n  bindingId: string;\n  /** The binding the shopper is on. */\n  currentBindingId: string;\n  params: Record<string, string | string[]>;\n  /** Decoded logical path of the current page. */\n  path: string;\n  /** `location.search`: `''` or `'?…'`. */\n  search: string;\n  /** `location.hash`: `''` or `'#…'`. */\n  hash: string;\n};\n\nexport type BindingSwitchResult = { url: string | null };\n\nexport type ResolveBindingSwitchOptions = {\n  request: BindingSwitchRequest;\n  knownBindingId: (candidate: string | null | undefined) => string | null;\n  bindings: readonly AlternateBinding[];\n  routeMap: RouteMap;\n  buildUrl: (bindingId: string, logicalPath: string) => string;\n  clientFor: (bindingId: string) => ApolloClient;\n};\n\n/**\n * The equivalent URL of the current page in the destination binding, or the destination's home with\n * `fs_notice=no-equivalent` when none exists or the lookup fails. The page is the one route-map\n * entry whose href in the current binding equals the logical path; none or several take the\n * fallback. Every URL is built by `buildUrl` from an id `knownBindingId` accepted; an undeclared\n * destination resolves `{ url: null }`. The request comes off the wire, so each field is read as\n * unchecked. Never throws for an expected outcome, writes no cookie, and reads no request header.\n */\nexport async function resolveBindingSwitch({\n  request,\n  knownBindingId,\n  bindings,\n  routeMap,\n  buildUrl,\n  clientFor,\n}: ResolveBindingSwitchOptions): Promise<BindingSwitchResult> {\n  const destination = knownBindingId(stringOr(request.bindingId, null));\n  if (destination === null) {\n    console.error('[locale.set] unknown binding');\n    return { url: null };\n  }\n\n  const fallback = { url: `${buildUrl(destination, '/')}${NO_EQUIVALENT_QUERY}` };\n  const path = stringOr(request.path, '');\n  // `useParams()` hands the segments over percent-encoded; the route map fills patterns with decoded values.\n  const params = decodeRouteParams(paramsOf(request.params));\n  const page = pageMatchingPath(routeMap, stringOr(request.currentBindingId, ''), path, params);\n  const entry = page === undefined ? undefined : ownEntry(routeMap, page);\n  if (page === undefined || entry === undefined) return fallback;\n  if (entry.bindings !== undefined && !entry.bindings.includes(destination)) return fallback;\n\n  const tail = `${searchOf(request.search)}${hashOf(request.hash)}`;\n\n  if (entry.standard !== undefined && CATALOG_STANDARDS.has(entry.standard)) {\n    const current = knownBindingId(stringOr(request.currentBindingId, null));\n    if (current === null || path === '' || path === '/') return fallback;\n\n    const paths = await catalogClusterPaths(bindings, async () => {\n      const { data, error } = await clientFor(current).query({\n        query: CATALOG_ROUTE_ALTERNATES_QUERY,\n        variables: { path },\n        errorPolicy: 'all',\n        fetchPolicy: 'no-cache',\n        context: { fetchOptions: { signal: AbortSignal.timeout(BINDING_SWITCH_LOOKUP_TIMEOUT_MS) } },\n      });\n      return { data, error };\n    });\n    const variantPath = paths && Object.hasOwn(paths, destination) ? paths[destination] : undefined;\n    if (variantPath === undefined) return fallback;\n    return { url: `${buildUrl(destination, encodePath(variantPath))}${tail}` };\n  }\n\n  const { href } = resolveStorefrontHref({ bindingId: destination, basePath: '/' }, routeMap, { page, params });\n  if (href === null) return fallback;\n  return { url: `${buildUrl(destination, href)}${tail}` };\n}\n\nfunction stringOr<T extends string | null>(value: unknown, empty: T): string | T {\n  return typeof value === 'string' ? value : empty;\n}\n\nfunction paramsOf(value: unknown): BindingSwitchRequest['params'] {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n    ? (value as BindingSwitchRequest['params'])\n    : {};\n}\n\n/**\n * The single page whose href in the current binding is this logical path. A miss and a tie are both\n * no page: the switch falls back instead of guessing. An entry that cannot be resolved (a missing\n * param, a binding it does not serve) is skipped.\n */\nfunction pageMatchingPath(\n  routeMap: RouteMap,\n  bindingId: string,\n  path: string,\n  params: BindingSwitchRequest['params'],\n): string | undefined {\n  const matches: string[] = [];\n  for (const name of Object.keys(routeMap)) {\n    const { href } = resolveStorefrontHref({ bindingId, basePath: '/' }, routeMap, { page: name, params });\n    if (href === null || !sameDecodedPath(href, path)) continue;\n    matches.push(name);\n  }\n  return matches.length === 1 ? matches[0] : undefined;\n}\n\n/**\n * `resolveStorefrontHref` percent-encodes params, so the href is decoded once. The request path is\n * compared as it arrived first, so a decoded slug like `100%-off` or `%41` is not decoded again; an\n * encoded path still matches through its decoded form.\n */\nfunction sameDecodedPath(href: string, path: string): boolean {\n  const decodedHref = decodeOrNull(href);\n  if (decodedHref === null) return false;\n  return decodedHref === path || decodedHref === decodeOrNull(path);\n}\n\nfunction decodeOrNull(text: string): string | null {\n  try {\n    return decodeURIComponent(text);\n  } catch {\n    return null;\n  }\n}\n\nfunction ownEntry(routeMap: RouteMap, page: string): RouteMapEntry | undefined {\n  return Object.hasOwn(routeMap, page) ? routeMap[page] : undefined;\n}\n\n/** Kept verbatim when it is only a query: a leading `?`, no `#`, and no control character. */\nfunction searchOf(search: unknown): string {\n  const text = stringOr(search, '');\n  if (text.length < 2 || !text.startsWith('?')) return '';\n  for (const char of text) {\n    const code = char.codePointAt(0) ?? 0;\n    if (char === '#' || code < 0x20 || code === 0x7f) return '';\n  }\n  return text;\n}\n\nfunction hashOf(hash: unknown): string {\n  const text = stringOr(hash, '');\n  return text.startsWith('#') && text.length > 1 ? text : '';\n}\n"],"mappings":";;;;;AAYA,MAAM,mCAAmC;AAEzC,MAAM,oCAA+C,IAAI,IAAI;CAAC;CAAW;CAAY;CAAS;AAAY,CAAC;AAE3G,MAAM,sBAAsB;;;;;;;;;AAmC5B,eAAsB,qBAAqB,EACzC,SACA,gBACA,UACA,UACA,UACA,aAC4D;CAC5D,MAAM,cAAc,eAAe,SAAS,QAAQ,WAAW,IAAI,CAAC;CACpE,IAAI,gBAAgB,MAAM;EACxB,QAAQ,MAAM,8BAA8B;EAC5C,OAAO,EAAE,KAAK,KAAK;CACrB;CAEA,MAAM,WAAW,EAAE,KAAK,GAAG,SAAS,aAAa,GAAG,IAAI,sBAAsB;CAC9E,MAAM,OAAO,SAAS,QAAQ,MAAM,EAAE;CAEtC,MAAM,SAAS,kBAAkB,SAAS,QAAQ,MAAM,CAAC;CACzD,MAAM,OAAO,iBAAiB,UAAU,SAAS,QAAQ,kBAAkB,EAAE,GAAG,MAAM,MAAM;CAC5F,MAAM,QAAQ,SAAS,KAAA,IAAY,KAAA,IAAY,SAAS,UAAU,IAAI;CACtE,IAAI,SAAS,KAAA,KAAa,UAAU,KAAA,GAAW,OAAO;CACtD,IAAI,MAAM,aAAa,KAAA,KAAa,CAAC,MAAM,SAAS,SAAS,WAAW,GAAG,OAAO;CAElF,MAAM,OAAO,GAAG,SAAS,QAAQ,MAAM,IAAI,OAAO,QAAQ,IAAI;CAE9D,IAAI,MAAM,aAAa,KAAA,KAAa,kBAAkB,IAAI,MAAM,QAAQ,GAAG;EACzE,MAAM,UAAU,eAAe,SAAS,QAAQ,kBAAkB,IAAI,CAAC;EACvE,IAAI,YAAY,QAAQ,SAAS,MAAM,SAAS,KAAK,OAAO;EAE5D,MAAM,QAAQ,MAAM,oBAAoB,UAAU,YAAY;GAC5D,MAAM,EAAE,MAAM,UAAU,MAAM,UAAU,OAAO,CAAC,CAAC,MAAM;IACrD,OAAO;IACP,WAAW,EAAE,KAAK;IAClB,aAAa;IACb,aAAa;IACb,SAAS,EAAE,cAAc,EAAE,QAAQ,YAAY,QAAQ,gCAAgC,EAAE,EAAE;GAC7F,CAAC;GACD,OAAO;IAAE;IAAM;GAAM;EACvB,CAAC;EACD,MAAM,cAAc,SAAS,OAAO,OAAO,OAAO,WAAW,IAAI,MAAM,eAAe,KAAA;EACtF,IAAI,gBAAgB,KAAA,GAAW,OAAO;EACtC,OAAO,EAAE,KAAK,GAAG,SAAS,aAAa,WAAW,WAAW,CAAC,IAAI,OAAO;CAC3E;CAEA,MAAM,EAAE,SAAS,sBAAsB;EAAE,WAAW;EAAa,UAAU;CAAI,GAAG,UAAU;EAAE;EAAM;CAAO,CAAC;CAC5G,IAAI,SAAS,MAAM,OAAO;CAC1B,OAAO,EAAE,KAAK,GAAG,SAAS,aAAa,IAAI,IAAI,OAAO;AACxD;AAEA,SAAS,SAAkC,OAAgB,OAAsB;CAC/E,OAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,SAAS,OAAgD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD,CAAC;AACP;;;;;;AAOA,SAAS,iBACP,UACA,WACA,MACA,QACoB;CACpB,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,GAAG;EACxC,MAAM,EAAE,SAAS,sBAAsB;GAAE;GAAW,UAAU;EAAI,GAAG,UAAU;GAAE,MAAM;GAAM;EAAO,CAAC;EACrG,IAAI,SAAS,QAAQ,CAAC,gBAAgB,MAAM,IAAI,GAAG;EACnD,QAAQ,KAAK,IAAI;CACnB;CACA,OAAO,QAAQ,WAAW,IAAI,QAAQ,KAAK,KAAA;AAC7C;;;;;;AAOA,SAAS,gBAAgB,MAAc,MAAuB;CAC5D,MAAM,cAAc,aAAa,IAAI;CACrC,IAAI,gBAAgB,MAAM,OAAO;CACjC,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI;AAClE;AAEA,SAAS,aAAa,MAA6B;CACjD,IAAI;EACF,OAAO,mBAAmB,IAAI;CAChC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,SAAS,UAAoB,MAAyC;CAC7E,OAAO,OAAO,OAAO,UAAU,IAAI,IAAI,SAAS,QAAQ,KAAA;AAC1D;;AAGA,SAAS,SAAS,QAAyB;CACzC,MAAM,OAAO,SAAS,QAAQ,EAAE;CAChC,IAAI,KAAK,SAAS,KAAK,CAAC,KAAK,WAAW,GAAG,GAAG,OAAO;CACrD,KAAK,MAAM,QAAQ,MAAM;EACvB,MAAM,OAAO,KAAK,YAAY,CAAC,KAAK;EACpC,IAAI,SAAS,OAAO,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3D;CACA,OAAO;AACT;AAEA,SAAS,OAAO,MAAuB;CACrC,MAAM,OAAO,SAAS,MAAM,EAAE;CAC9B,OAAO,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,OAAO;AAC1D"}

package/dist/sdk/navigation/decode-route-params.d.ts

@@ -0,0 +1,11 @@
+//#region src/sdk/navigation/decode-route-params.d.ts
+type RouteParamValue = string | string[] | undefined;
+/**
+ * The route params a generated page receives, decoded: Next hands over a dynamic segment
+ * percent-encoded, so an id ending in `=` arrives as `%3D`. A value with a malformed sequence is kept
+ * as received, so a request can never turn into an exception. A list (catch-all) is decoded segment
+ * by segment, and the keys are unchanged.
+ */
+export declare function decodeRouteParams<T extends Record<string, RouteParamValue>>(params: T): T;
+//#endregion
+//# sourceMappingURL=decode-route-params.d.ts.map

package/dist/sdk/navigation/decode-route-params.js

@@ -0,0 +1,32 @@
+//#region src/sdk/navigation/decode-route-params.ts
+function decodeSegment(segment) {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return segment;
+	}
+}
+function decodeValue(value) {
+	if (value === void 0) return void 0;
+	return Array.isArray(value) ? value.map(decodeSegment) : decodeSegment(value);
+}
+/**
+* The route params a generated page receives, decoded: Next hands over a dynamic segment
+* percent-encoded, so an id ending in `=` arrives as `%3D`. A value with a malformed sequence is kept
+* as received, so a request can never turn into an exception. A list (catch-all) is decoded segment
+* by segment, and the keys are unchanged.
+*/
+function decodeRouteParams(params) {
+	const decoded = {};
+	for (const [key, value] of Object.entries(params)) Object.defineProperty(decoded, key, {
+		value: decodeValue(value),
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	return decoded;
+}
+//#endregion
+export { decodeRouteParams };
+
+//# sourceMappingURL=decode-route-params.js.map

package/dist/sdk/navigation/decode-route-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode-route-params.js","names":[],"sources":["../../../src/sdk/navigation/decode-route-params.ts"],"sourcesContent":["type RouteParamValue = string | string[] | undefined;\n\nfunction decodeSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\nfunction decodeValue(value: RouteParamValue): RouteParamValue {\n  if (value === undefined) return undefined;\n  return Array.isArray(value) ? value.map(decodeSegment) : decodeSegment(value);\n}\n\n/**\n * The route params a generated page receives, decoded: Next hands over a dynamic segment\n * percent-encoded, so an id ending in `=` arrives as `%3D`. A value with a malformed sequence is kept\n * as received, so a request can never turn into an exception. A list (catch-all) is decoded segment\n * by segment, and the keys are unchanged.\n */\nexport function decodeRouteParams<T extends Record<string, RouteParamValue>>(params: T): T {\n  const decoded: Record<string, RouteParamValue> = {};\n  for (const [key, value] of Object.entries(params)) {\n    // defineProperty, not assignment: a param named `__proto__` must stay an own key.\n    Object.defineProperty(decoded, key, {\n      value: decodeValue(value),\n      enumerable: true,\n      writable: true,\n      configurable: true,\n    });\n  }\n  return decoded as T;\n}\n"],"mappings":";AAEA,SAAS,cAAc,SAAyB;CAC9C,IAAI;EACF,OAAO,mBAAmB,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,OAAyC;CAC5D,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,aAAa,IAAI,cAAc,KAAK;AAC9E;;;;;;;AAQA,SAAgB,kBAA6D,QAAc;CACzF,MAAM,UAA2C,CAAC;CAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAE9C,OAAO,eAAe,SAAS,KAAK;EAClC,OAAO,YAAY,KAAK;EACxB,YAAY;EACZ,UAAU;EACV,cAAc;CAChB,CAAC;CAEH,OAAO;AACT"}

package/dist/sdk/navigation/redirect.d.ts

@@ -7,5 +7,7 @@ type BindingContext = Pick<StorefrontContext, 'bindingId' | 'basePath'>;
 export declare function redirectToStorefrontPage(context: BindingContext, routeMap: RouteMap, target: PageRef | string): never;
 /** Next's `permanentRedirect` to a page reference or a logical path, resolved for the binding. */
 export declare function permanentRedirectToStorefrontPage(context: BindingContext, routeMap: RouteMap, target: PageRef | string): never;
+/** Next's `redirect` to `resolveSignInHref`: the session gate's answer to an anonymous request. */
+export declare function redirectToSignIn(context: BindingContext, routeMap: RouteMap, returnPath: string): never;
 //#endregion
 //# sourceMappingURL=redirect.d.ts.map

package/dist/sdk/navigation/redirect.js

@@ -1,5 +1,7 @@
+import { RETURN_URL_PARAM, resolveSiteRelativeHref, signInTarget } from "../../utils/safe-href.js";
 import { resolveStorefrontHref } from "./resolve-storefront-href.js";
 import { reportUnresolved } from "./report.js";
+import { MOCK_SESSION_ROUTE, mockSessionToken } from "../session/mock-session.js";
 import { permanentRedirect, redirect } from "next/navigation";
 //#region src/sdk/navigation/redirect.ts
 function resolveOrThrow(context, routeMap, target) {
@@ -16,7 +18,23 @@ function redirectToStorefrontPage(context, routeMap, target) {
 function permanentRedirectToStorefrontPage(context, routeMap, target) {
 	return permanentRedirect(resolveOrThrow(context, routeMap, target));
 }
+/**
+* Where the session gate sends an anonymous request: the binding's sign-in page carrying `returnPath`, a
+* logical path. With `FS_MOCK_SESSION` set it is the mock session handler instead, which lives outside
+* every binding, so the return it carries is already the public path.
+*/
+function resolveSignInHref(context, routeMap, returnPath) {
+	if (mockSessionToken() === null) return resolveOrThrow(context, routeMap, signInTarget(returnPath));
+	const back = resolveStorefrontHref(context, routeMap, returnPath).href;
+	const destination = back === null ? null : resolveSiteRelativeHref(back);
+	if (!destination?.safe) return MOCK_SESSION_ROUTE;
+	return `${MOCK_SESSION_ROUTE}?${new URLSearchParams({ [RETURN_URL_PARAM]: destination.href })}`;
+}
+/** Next's `redirect` to `resolveSignInHref`: the session gate's answer to an anonymous request. */
+function redirectToSignIn(context, routeMap, returnPath) {
+	return redirect(resolveSignInHref(context, routeMap, returnPath));
+}
 //#endregion
-export { permanentRedirectToStorefrontPage, redirectToStorefrontPage };
+export { permanentRedirectToStorefrontPage, redirectToSignIn, redirectToStorefrontPage, resolveSignInHref };
 
 //# sourceMappingURL=redirect.js.map

package/dist/sdk/navigation/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","names":[],"sources":["../../../src/sdk/navigation/redirect.ts"],"sourcesContent":["import type { StorefrontContext } from '@vtex/fs-core';\nimport { permanentRedirect, redirect } from 'next/navigation';\nimport { reportUnresolved } from './report.js';\nimport { resolveStorefrontHref } from './resolve-storefront-href.js';\nimport type { PageRef, RouteMap } from './types.js';\n\ntype BindingContext = Pick<StorefrontContext, 'bindingId' | 'basePath'>;\n\nfunction resolveOrThrow(context: BindingContext, routeMap: RouteMap, target: PageRef | string): string {\n  const result = resolveStorefrontHref(context, routeMap, target);\n  if (result.href !== null) return result.href;\n  reportUnresolved(result.reason, target);\n  throw new Error(\n    `Cannot redirect: ${JSON.stringify(target)} resolved to no href (${result.reason}) on ` +\n      `binding ${JSON.stringify(context.bindingId)}.`,\n  );\n}\n\n/** Next's `redirect` to a page reference or a logical path, resolved for the binding. */\nexport function redirectToStorefrontPage(context: BindingContext, routeMap: RouteMap, target: PageRef | string): never {\n  return redirect(resolveOrThrow(context, routeMap, target));\n}\n\n/** Next's `permanentRedirect` to a page reference or a logical path, resolved for the binding. */\nexport function permanentRedirectToStorefrontPage(\n  context: BindingContext,\n  routeMap: RouteMap,\n  target: PageRef | string,\n): never {\n  return permanentRedirect(resolveOrThrow(context, routeMap, target));\n}\n"],"mappings":";;;;AAQA,SAAS,eAAe,SAAyB,UAAoB,QAAkC;CACrG,MAAM,SAAS,sBAAsB,SAAS,UAAU,MAAM;CAC9D,IAAI,OAAO,SAAS,MAAM,OAAO,OAAO;CACxC,iBAAiB,OAAO,QAAQ,MAAM;CACtC,MAAM,IAAI,MACR,oBAAoB,KAAK,UAAU,MAAM,EAAE,wBAAwB,OAAO,OAAO,eACpE,KAAK,UAAU,QAAQ,SAAS,EAAE,EACjD;AACF;;AAGA,SAAgB,yBAAyB,SAAyB,UAAoB,QAAiC;CACrH,OAAO,SAAS,eAAe,SAAS,UAAU,MAAM,CAAC;AAC3D;;AAGA,SAAgB,kCACd,SACA,UACA,QACO;CACP,OAAO,kBAAkB,eAAe,SAAS,UAAU,MAAM,CAAC;AACpE"}
+{"version":3,"file":"redirect.js","names":[],"sources":["../../../src/sdk/navigation/redirect.ts"],"sourcesContent":["import type { StorefrontContext } from '@vtex/fs-core';\nimport { permanentRedirect, redirect } from 'next/navigation';\nimport { RETURN_URL_PARAM, resolveSiteRelativeHref, signInTarget } from '../../utils/safe-href.js';\nimport { MOCK_SESSION_ROUTE, mockSessionToken } from '../session/mock-session.js';\nimport { reportUnresolved } from './report.js';\nimport { resolveStorefrontHref } from './resolve-storefront-href.js';\nimport type { PageRef, RouteMap } from './types.js';\n\ntype BindingContext = Pick<StorefrontContext, 'bindingId' | 'basePath'>;\n\nfunction resolveOrThrow(context: BindingContext, routeMap: RouteMap, target: PageRef | string): string {\n  const result = resolveStorefrontHref(context, routeMap, target);\n  if (result.href !== null) return result.href;\n  reportUnresolved(result.reason, target);\n  throw new Error(\n    `Cannot redirect: ${JSON.stringify(target)} resolved to no href (${result.reason}) on ` +\n      `binding ${JSON.stringify(context.bindingId)}.`,\n  );\n}\n\n/** Next's `redirect` to a page reference or a logical path, resolved for the binding. */\nexport function redirectToStorefrontPage(context: BindingContext, routeMap: RouteMap, target: PageRef | string): never {\n  return redirect(resolveOrThrow(context, routeMap, target));\n}\n\n/** Next's `permanentRedirect` to a page reference or a logical path, resolved for the binding. */\nexport function permanentRedirectToStorefrontPage(\n  context: BindingContext,\n  routeMap: RouteMap,\n  target: PageRef | string,\n): never {\n  return permanentRedirect(resolveOrThrow(context, routeMap, target));\n}\n\n/**\n * Where the session gate sends an anonymous request: the binding's sign-in page carrying `returnPath`, a\n * logical path. With `FS_MOCK_SESSION` set it is the mock session handler instead, which lives outside\n * every binding, so the return it carries is already the public path.\n */\nexport function resolveSignInHref(context: BindingContext, routeMap: RouteMap, returnPath: string): string {\n  if (mockSessionToken() === null) {\n    return resolveOrThrow(context, routeMap, signInTarget(returnPath));\n  }\n  const back = resolveStorefrontHref(context, routeMap, returnPath).href;\n  const destination = back === null ? null : resolveSiteRelativeHref(back);\n  if (!destination?.safe) return MOCK_SESSION_ROUTE;\n  return `${MOCK_SESSION_ROUTE}?${new URLSearchParams({ [RETURN_URL_PARAM]: destination.href })}`;\n}\n\n/** Next's `redirect` to `resolveSignInHref`: the session gate's answer to an anonymous request. */\nexport function redirectToSignIn(context: BindingContext, routeMap: RouteMap, returnPath: string): never {\n  return redirect(resolveSignInHref(context, routeMap, returnPath));\n}\n"],"mappings":";;;;;;AAUA,SAAS,eAAe,SAAyB,UAAoB,QAAkC;CACrG,MAAM,SAAS,sBAAsB,SAAS,UAAU,MAAM;CAC9D,IAAI,OAAO,SAAS,MAAM,OAAO,OAAO;CACxC,iBAAiB,OAAO,QAAQ,MAAM;CACtC,MAAM,IAAI,MACR,oBAAoB,KAAK,UAAU,MAAM,EAAE,wBAAwB,OAAO,OAAO,eACpE,KAAK,UAAU,QAAQ,SAAS,EAAE,EACjD;AACF;;AAGA,SAAgB,yBAAyB,SAAyB,UAAoB,QAAiC;CACrH,OAAO,SAAS,eAAe,SAAS,UAAU,MAAM,CAAC;AAC3D;;AAGA,SAAgB,kCACd,SACA,UACA,QACO;CACP,OAAO,kBAAkB,eAAe,SAAS,UAAU,MAAM,CAAC;AACpE;;;;;;AAOA,SAAgB,kBAAkB,SAAyB,UAAoB,YAA4B;CACzG,IAAI,iBAAiB,MAAM,MACzB,OAAO,eAAe,SAAS,UAAU,aAAa,UAAU,CAAC;CAEnE,MAAM,OAAO,sBAAsB,SAAS,UAAU,UAAU,CAAC,CAAC;CAClE,MAAM,cAAc,SAAS,OAAO,OAAO,wBAAwB,IAAI;CACvE,IAAI,CAAC,aAAa,MAAM,OAAO;CAC/B,OAAO,GAAG,mBAAmB,GAAG,IAAI,gBAAgB,GAAG,mBAAmB,YAAY,KAAK,CAAC;AAC9F;;AAGA,SAAgB,iBAAiB,SAAyB,UAAoB,YAA2B;CACvG,OAAO,SAAS,kBAAkB,SAAS,UAAU,UAAU,CAAC;AAClE"}

package/dist/sdk/navigation/types.d.ts

@@ -26,6 +26,19 @@ export type RouteMapEntry = {
   params?: string[];
   aliases?: Record<string, string>;
   bindings?: string[];
+  /**
+   * Set on a Search Landing Page: the term a singleton pins, as authored, or the content type and route
+   * parameter of the page over CMS term entries, whose item slug is the normalized term.
+   */
+  searchTerm?: string | {
+    contentType: string;
+    param: string;
+  };
+  /**
+   * Set on an Entity Landing Page: the Relay node ID of the collection, category, or brand whose standard
+   * listing points its canonical here, the ID `catalogRoute` returns for that listing.
+   */
+  canonicalFor?: string;
 };
 /** Keyed by page name. */
 export type RouteMap = Record<string, RouteMapEntry>;

package/dist/sdk/payment/bin-format.js

@@ -0,0 +1,20 @@
+import { isAcceptedCardBin } from "@vtex/fs-domain-logic/checkout/rules";
+//#region src/sdk/payment/bin-format.ts
+/**
+* The browser-side use of the rule `paymentMethodSelect` applies to `bin`, so a malformed value never leaves
+* through `payment.setMethod`. The rule itself lives in `@vtex/fs-domain-logic/checkout/rules`, shared with the
+* server, so the two can no longer drift; the fixed refusal text lives there too. A new card (no `accountId`,
+* or an empty one) carries nothing or exactly eight digits; a saved card carries nothing or one to eight,
+* because the server compares it to the card's own stored BIN. `null` counts as nothing, like the server; any
+* other value that is not a string is refused. Reads the value and returns a boolean: it never stores, logs or
+* interpolates it.
+*/
+function isAcceptedBin({ bin, accountId }) {
+	if (bin === void 0 || bin === null || bin === "") return true;
+	if (typeof bin !== "string") return false;
+	return isAcceptedCardBin(bin, Boolean(accountId));
+}
+//#endregion
+export { isAcceptedBin };
+
+//# sourceMappingURL=bin-format.js.map

package/dist/sdk/payment/bin-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin-format.js","names":[],"sources":["../../../src/sdk/payment/bin-format.ts"],"sourcesContent":["import { isAcceptedCardBin } from '@vtex/fs-domain-logic/checkout/rules';\n\n/**\n * The browser-side use of the rule `paymentMethodSelect` applies to `bin`, so a malformed value never leaves\n * through `payment.setMethod`. The rule itself lives in `@vtex/fs-domain-logic/checkout/rules`, shared with the\n * server, so the two can no longer drift; the fixed refusal text lives there too. A new card (no `accountId`,\n * or an empty one) carries nothing or exactly eight digits; a saved card carries nothing or one to eight,\n * because the server compares it to the card's own stored BIN. `null` counts as nothing, like the server; any\n * other value that is not a string is refused. Reads the value and returns a boolean: it never stores, logs or\n * interpolates it.\n */\nexport function isAcceptedBin({ bin, accountId }: Readonly<{ bin?: string | null; accountId?: string }>): boolean {\n  if (bin === undefined || bin === null || bin === '') return true;\n  if (typeof bin !== 'string') return false;\n  return isAcceptedCardBin(bin, Boolean(accountId));\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,cAAc,EAAE,KAAK,aAA6E;CAChH,IAAI,QAAQ,KAAA,KAAa,QAAQ,QAAQ,QAAQ,IAAI,OAAO;CAC5D,IAAI,OAAO,QAAQ,UAAU,OAAO;CACpC,OAAO,kBAAkB,KAAK,QAAQ,SAAS,CAAC;AAClD"}

package/dist/sdk/payment/challenge-return.js

@@ -0,0 +1,37 @@
+//#region src/sdk/payment/challenge-return.ts
+/**
+* The contract between the two ends of the 3D Secure round trip (T208, Decision 2): `usePlaceOrder` builds
+* the return URL's query before the card is posted, and the `ChallengeReturn` page reads it back when the
+* bank sends the shopper home. Both ends live here so they cannot drift apart.
+*
+* The query is the order group and a literal flag, nothing else. The group is the only key the gateway
+* callback needs and it exists before the card is posted. The reader is strict because the page it feeds
+* issues a write: exactly one `orderGroup` that fits `ORDER_GROUP_PATTERN` (which excludes `.`, so a dot
+* segment cannot arrive) and `redirect` equal to the string `true`. Anything else the gateway or the bank
+* appends is ignored, and never returned.
+*/
+const ORDER_GROUP_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+const GROUP_PARAM = "orderGroup";
+const FLAG_PARAM = "redirect";
+const FLAG_VALUE = "true";
+/** The query for a group's return URL, or `null` when the group is not one a return page would accept. */
+function buildChallengeReturnQuery(orderGroup) {
+	if (!ORDER_GROUP_PATTERN.test(orderGroup)) return null;
+	return {
+		[GROUP_PARAM]: orderGroup,
+		[FLAG_PARAM]: FLAG_VALUE
+	};
+}
+/** The order group a return URL's query names, or `null` for anything that is not exactly a return query. */
+function readChallengeReturn(search) {
+	const params = new URLSearchParams(search);
+	const groups = params.getAll(GROUP_PARAM);
+	const [orderGroup] = groups;
+	if (groups.length !== 1 || orderGroup === void 0 || !ORDER_GROUP_PATTERN.test(orderGroup)) return null;
+	if (params.get(FLAG_PARAM) !== FLAG_VALUE) return null;
+	return { orderGroup };
+}
+//#endregion
+export { buildChallengeReturnQuery, readChallengeReturn };
+
+//# sourceMappingURL=challenge-return.js.map

package/dist/sdk/payment/challenge-return.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-return.js","names":[],"sources":["../../../src/sdk/payment/challenge-return.ts"],"sourcesContent":["/**\n * The contract between the two ends of the 3D Secure round trip (T208, Decision 2): `usePlaceOrder` builds\n * the return URL's query before the card is posted, and the `ChallengeReturn` page reads it back when the\n * bank sends the shopper home. Both ends live here so they cannot drift apart.\n *\n * The query is the order group and a literal flag, nothing else. The group is the only key the gateway\n * callback needs and it exists before the card is posted. The reader is strict because the page it feeds\n * issues a write: exactly one `orderGroup` that fits `ORDER_GROUP_PATTERN` (which excludes `.`, so a dot\n * segment cannot arrive) and `redirect` equal to the string `true`. Anything else the gateway or the bank\n * appends is ignored, and never returned.\n */\n\nconst ORDER_GROUP_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;\n\nconst GROUP_PARAM = 'orderGroup';\nconst FLAG_PARAM = 'redirect';\nconst FLAG_VALUE = 'true';\n\n/** The query for a group's return URL, or `null` when the group is not one a return page would accept. */\nexport function buildChallengeReturnQuery(orderGroup: string): Record<string, string> | null {\n  if (!ORDER_GROUP_PATTERN.test(orderGroup)) return null;\n  return { [GROUP_PARAM]: orderGroup, [FLAG_PARAM]: FLAG_VALUE };\n}\n\n/** The order group a return URL's query names, or `null` for anything that is not exactly a return query. */\nexport function readChallengeReturn(search: string): { orderGroup: string } | null {\n  const params = new URLSearchParams(search);\n  const groups = params.getAll(GROUP_PARAM);\n  const [orderGroup] = groups;\n  if (groups.length !== 1 || orderGroup === undefined || !ORDER_GROUP_PATTERN.test(orderGroup)) return null;\n  if (params.get(FLAG_PARAM) !== FLAG_VALUE) return null;\n  return { orderGroup };\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,sBAAsB;AAE5B,MAAM,cAAc;AACpB,MAAM,aAAa;AACnB,MAAM,aAAa;;AAGnB,SAAgB,0BAA0B,YAAmD;CAC3F,IAAI,CAAC,oBAAoB,KAAK,UAAU,GAAG,OAAO;CAClD,OAAO;GAAG,cAAc;GAAa,aAAa;CAAW;AAC/D;;AAGA,SAAgB,oBAAoB,QAA+C;CACjF,MAAM,SAAS,IAAI,gBAAgB,MAAM;CACzC,MAAM,SAAS,OAAO,OAAO,WAAW;CACxC,MAAM,CAAC,cAAc;CACrB,IAAI,OAAO,WAAW,KAAK,eAAe,KAAA,KAAa,CAAC,oBAAoB,KAAK,UAAU,GAAG,OAAO;CACrG,IAAI,OAAO,IAAI,UAAU,MAAM,YAAY,OAAO;CAClD,OAAO,EAAE,WAAW;AACtB"}

package/dist/sdk/payment/confirmation-last-four.js

@@ -0,0 +1,39 @@
+import { useSyncExternalStore } from "react";
+//#region src/sdk/payment/confirmation-last-four.ts
+const FOUR_ASCII_DIGITS = /^\d{4}$/;
+const NOT_AN_ASCII_DIGIT = /\D/g;
+const SHORTEST_NUMBER_LENGTH = 8;
+let record = null;
+const listeners = /* @__PURE__ */ new Set();
+function notify() {
+	for (const listener of listeners) listener();
+}
+function subscribe(listener) {
+	listeners.add(listener);
+	return () => {
+		listeners.delete(listener);
+	};
+}
+/** The last four ASCII digits of `rawDigits` once every non-digit is removed; null below 8 digits. */
+function lastFourOf(rawDigits) {
+	const digits = rawDigits.replaceAll(NOT_AN_ASCII_DIGIT, "");
+	return digits.length >= SHORTEST_NUMBER_LENGTH ? digits.slice(-4) : null;
+}
+/** Stores one record. Refuses (no-op) unless `lastFour` is exactly four ASCII digits and `orderGroup` is non-empty. */
+function rememberConfirmationLastFour(orderGroup, lastFour) {
+	if (typeof orderGroup !== "string" || orderGroup === "") return;
+	if (typeof lastFour !== "string" || !FOUR_ASCII_DIGITS.test(lastFour)) return;
+	record = {
+		orderGroup,
+		lastFour
+	};
+	notify();
+}
+/** The four digits for this order group, or null. The server snapshot is always null. */
+function useConfirmationLastFour(orderGroup) {
+	return useSyncExternalStore(subscribe, () => record !== null && orderGroup != null && record.orderGroup === orderGroup ? record.lastFour : null, () => null);
+}
+//#endregion
+export { lastFourOf, rememberConfirmationLastFour, useConfirmationLastFour };
+
+//# sourceMappingURL=confirmation-last-four.js.map

package/dist/sdk/payment/confirmation-last-four.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmation-last-four.js","names":[],"sources":["../../../src/sdk/payment/confirmation-last-four.ts"],"sourcesContent":["import { useSyncExternalStore } from 'react';\n\n/**\n * The masked last four of a newly typed payment instrument, carried in module memory from the place-order\n * step to the confirmation recap (T82, US-8). It holds one record: four ASCII digits and the order group\n * they belong to. It is never written to a storage API, a cookie, a URL, a header, a log, an analytics\n * event, a GraphQL variable or an error, and it is empty on the server and on first load.\n */\ntype ConfirmationLastFour = Readonly<{ orderGroup: string; lastFour: string }>;\n\nconst FOUR_ASCII_DIGITS = /^\\d{4}$/;\nconst NOT_AN_ASCII_DIGIT = /\\D/g;\nconst SHORTEST_NUMBER_LENGTH = 8;\n\nlet record: ConfirmationLastFour | null = null;\nconst listeners = new Set<() => void>();\n\nfunction notify(): void {\n  for (const listener of listeners) listener();\n}\n\nfunction subscribe(listener: () => void): () => void {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\n/** The last four ASCII digits of `rawDigits` once every non-digit is removed; null below 8 digits. */\nexport function lastFourOf(rawDigits: string): string | null {\n  const digits = rawDigits.replaceAll(NOT_AN_ASCII_DIGIT, '');\n  return digits.length >= SHORTEST_NUMBER_LENGTH ? digits.slice(-4) : null;\n}\n\n/** Stores one record. Refuses (no-op) unless `lastFour` is exactly four ASCII digits and `orderGroup` is non-empty. */\nexport function rememberConfirmationLastFour(orderGroup: string, lastFour: string): void {\n  if (typeof orderGroup !== 'string' || orderGroup === '') return;\n  if (typeof lastFour !== 'string' || !FOUR_ASCII_DIGITS.test(lastFour)) return;\n  record = { orderGroup, lastFour };\n  notify();\n}\n\n/** The current record, or null. */\nexport function readConfirmationLastFour(): ConfirmationLastFour | null {\n  return record;\n}\n\n/** The four digits for this order group, or null. The server snapshot is always null. */\nexport function useConfirmationLastFour(orderGroup: string | null | undefined): string | null {\n  return useSyncExternalStore(\n    subscribe,\n    () => (record !== null && orderGroup != null && record.orderGroup === orderGroup ? record.lastFour : null),\n    () => null,\n  );\n}\n\n/** Test seam: empties the record. */\nexport function clearConfirmationLastFour(): void {\n  record = null;\n  notify();\n}\n"],"mappings":";;AAUA,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAE/B,IAAI,SAAsC;AAC1C,MAAM,4BAAY,IAAI,IAAgB;AAEtC,SAAS,SAAe;CACtB,KAAK,MAAM,YAAY,WAAW,SAAS;AAC7C;AAEA,SAAS,UAAU,UAAkC;CACnD,UAAU,IAAI,QAAQ;CACtB,aAAa;EACX,UAAU,OAAO,QAAQ;CAC3B;AACF;;AAGA,SAAgB,WAAW,WAAkC;CAC3D,MAAM,SAAS,UAAU,WAAW,oBAAoB,EAAE;CAC1D,OAAO,OAAO,UAAU,yBAAyB,OAAO,MAAM,EAAE,IAAI;AACtE;;AAGA,SAAgB,6BAA6B,YAAoB,UAAwB;CACvF,IAAI,OAAO,eAAe,YAAY,eAAe,IAAI;CACzD,IAAI,OAAO,aAAa,YAAY,CAAC,kBAAkB,KAAK,QAAQ,GAAG;CACvE,SAAS;EAAE;EAAY;CAAS;CAChC,OAAO;AACT;;AAQA,SAAgB,wBAAwB,YAAsD;CAC5F,OAAO,qBACL,iBACO,WAAW,QAAQ,cAAc,QAAQ,OAAO,eAAe,aAAa,OAAO,WAAW,YAC/F,IACR;AACF"}

package/dist/sdk/payment/gateway.d.ts

@@ -38,7 +38,7 @@ export type PaymentGatewayTransaction = Readonly<{
   installmentsValueInCents: number;
   /** `PaymentInstallment.interestRate`; 0 for the interest-free 1x default. */
   interestRate: number;
-  /** Absolute return URL. Phase-2 redirect mode only; omitted in v1's direct mode. */
+  /** Absolute return URL for the 3D Secure challenge. Omitted when the store authored no return page. */
   callbackUrl?: string;
   /**
    * Billing differs from the delivery address. Defaults to `false`, because `setBillingAddress` persists

package/dist/sdk/payment/gateway.js

@@ -23,7 +23,10 @@ import { isTrustedGatewayOrigin } from "./gateway-origin.js";
 */
 /** Client-synthesized code for a failed gateway leg — distinct from the BFF's `NETWORK_ERROR`. */
 const PAYMENT_GATEWAY_ERROR_CODE = "GATEWAY_ERROR";
-/** The single userError a rejected request, a non-2xx response and a request the builder refused all resolve to. */
+/**
+* The single userError a rejected request, a non-2xx response and a request the builder refused all resolve to.
+* Its `message` is diagnostic; `PlaceOrder` words the code.
+*/
 const PAYMENT_GATEWAY_USER_ERROR = {
 	code: PAYMENT_GATEWAY_ERROR_CODE,
 	message: "Unable to complete the payment. Please try again."
@@ -85,7 +88,10 @@ function buildGatewayPaymentsRequest({ transaction, card }) {
 	if (!isTrustedGatewayOrigin(transaction.gatewayUrl)) throw new Error("Refusing to post card data: the transaction carries no trusted https gateway origin.");
 	const params = new URLSearchParams({ orderId: transaction.orderGroup });
 	if (transaction.userProfileId !== null) params.append("userProfileId", transaction.userProfileId);
-	if (transaction.callbackUrl !== void 0) params.append("callbackUrl", transaction.callbackUrl);
+	if (transaction.callbackUrl !== void 0) {
+		params.append("callbackUrl", transaction.callbackUrl);
+		params.append("redirect", "false");
+	}
 	const transactionId = encodeURIComponent(transaction.transactionId);
 	const url = `${transaction.gatewayUrl}/api/payments/transactions/${transactionId}/payments?${params}`;
 	const { bin, fields } = toCardBody(card);

package/dist/sdk/payment/gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.js","names":[],"sources":["../../../src/sdk/payment/gateway.ts"],"sourcesContent":["/**\n * The direct-to-gateway card POST (specs/payment-action-namespace.md, US-6) — the PCI boundary of the\n * credit-card feature. A new card's number and CVV, or a saved card's CVV, go from the browser straight\n * to the VTEX payment gateway and never transit our GraphQL layer or the normalized Apollo cache\n * (RFC D13; ADR-0010's sanctioned façade flavor).\n *\n * This module imports no Apollo and no GraphQL symbol on purpose: the code that holds card data has no\n * route to the cache, and that property is checkable by reading the imports above. Card data arrives as\n * a runtime argument from the card-entry component's local state (T7) — it is never a declared action\n * payload, a fragment field, or a schema-bindable prop, so the AI Store Builder and the visual editor\n * have no name to map a value onto.\n *\n * Nothing on this path is ever logged, serialized, or stored anywhere but the request body: the caller\n * in `use-payment-actions.ts` logs a static message plus the error's `name` only.\n *\n * The request shape is behavior evidence from the legacy checkout\n * (`fastcheckout@cd09bec3`, `packages/apps/client/src/screens/Payment/components/CardForm/services/gateway.service.ts`)\n * — never a port. Where the legacy hardcoded a value under a `TODO` (installment count, interest rate,\n * reference value) this builder reads it off the transaction descriptor instead.\n */\n\nimport { loggableErrorName } from '../../utils/loggable-error-name.js';\nimport { isTrustedGatewayOrigin } from './gateway-origin.js';\nimport type { PaymentUserError } from './operations.js';\n\n/** Client-synthesized code for a failed gateway leg — distinct from the BFF's `NETWORK_ERROR`. */\nexport const PAYMENT_GATEWAY_ERROR_CODE = 'GATEWAY_ERROR';\n\n/** The single userError a rejected request, a non-2xx response and a request the builder refused all resolve to. */\nexport const PAYMENT_GATEWAY_USER_ERROR: PaymentUserError = {\n  code: PAYMENT_GATEWAY_ERROR_CODE,\n  message: 'Unable to complete the payment. Please try again.',\n};\n\n/**\n * Non-sensitive descriptor of the open transaction. Every field maps to a value the caller already\n * holds — `paymentStartTransaction`'s payload (T3) or the `Payment` read model (T1) — except\n * `gatewayUrl` and `merchantName`, which that payload does not carry today (Gaps 1 and 2 in the spec).\n * Amounts are in the currency's **minor units**; `PaymentStartTransactionPayload.value.amount` is a\n * decimal, so the caller converts once, visibly, rather than having this module assume an exponent.\n */\nexport type PaymentGatewayTransaction = Readonly<{\n  /**\n   * Gateway origin, e.g. `https://acme.vtexvault.com`. Server-resolved by T18 and read off\n   * `paymentStartTransaction`'s payload; never derived here. It is nullable there and required here,\n   * so the builder re-checks it (`isTrustedGatewayOrigin`) rather than trusting the type.\n   */\n  gatewayUrl: string;\n  /** `PaymentStartTransactionPayload.transactionId`. */\n  transactionId: string;\n  /** VTEX merchant name for this transaction. Resolved server-side by T3 but not exposed on its payload. */\n  merchantName: string;\n  /** `PaymentStartTransactionPayload.orderGroup` — the gateway's `orderId` query parameter. */\n  orderGroup: string;\n  /** `PaymentStartTransactionPayload.userProfileId`; null for a guest order, so the query parameter is left out. */\n  userProfileId: string | null;\n  /** `Payment.selectedMethodId` — the VTEX payment-system id. */\n  paymentSystem: string;\n  /** `PaymentMethod.groupName`, e.g. `creditCardPaymentGroup`. */\n  groupName: string;\n  /** `PaymentStartTransactionPayload.value.currencyCode`. */\n  currencyCode: string;\n  /** Transaction total, in minor units. */\n  valueInCents: number;\n  /** Pre-interest base (`PaymentInstallmentOption.baseValue`), in minor units. */\n  referenceValueInCents: number;\n  /** `Payment.selectedInstallment.count`; 1 when the shopper never picked a plan. */\n  installments: number;\n  /** Per-installment amount (`PaymentInstallment.value`), in minor units. */\n  installmentsValueInCents: number;\n  /** `PaymentInstallment.interestRate`; 0 for the interest-free 1x default. */\n  interestRate: number;\n  /** Absolute return URL. Phase-2 redirect mode only; omitted in v1's direct mode. */\n  callbackUrl?: string;\n  /**\n   * Billing differs from the delivery address. Defaults to `false`, because `setBillingAddress` persists\n   * billing on the order form's `invoiceData` (T3) and the gateway reads it from there rather than from\n   * this body. The call site that would override it is T13's `usePlaceOrder`, the one place the\n   * descriptor is assembled; T11 owns the live verification of the assumption and publishes the flag to\n   * T5's `draft` for T13 to read. Confirming it never reopens this module.\n   */\n  billingAddressDifferent?: boolean;\n}>;\n\n/** A newly entered card. Runtime argument only — never declared, never logged, never cached. */\nexport type PaymentGatewayNewCard = Readonly<{\n  kind: 'new';\n  /** Full card number. The builder strips whatever separators the method's `numberMask` inserted. */\n  number: string;\n  /** Security code (CVV). */\n  securityCode: string;\n  /** Expiry. Normalized to `MM/YY`, so a `MM/YYYY` mask is accepted. */\n  expirationDate: string;\n  holderName: string;\n  /** Shopper document (a CPF). The builder strips its punctuation. */\n  document?: string;\n  /** Shopper-assigned label, when the save-card control collected one. */\n  cardLabel?: string;\n  /** The card-save flag itself — the other half of `payment.saveCard`'s consent write (RFC D5). */\n  saveCard?: boolean;\n}>;\n\n/** A previously saved card: its account reference plus the CVV the shopper re-enters. */\nexport type PaymentGatewaySavedCard = Readonly<{\n  kind: 'saved';\n  /** `SavedCard.accountId`. */\n  accountId: string;\n  /** `SavedCard.bin` — not sensitive; the read model exposes it for installment lookup. */\n  bin: string;\n  /** Security code (CVV). */\n  securityCode: string;\n}>;\n\nexport type PaymentGatewayCard = PaymentGatewayNewCard | PaymentGatewaySavedCard;\n\nexport type SendPaymentsRequest = Readonly<{\n  transaction: PaymentGatewayTransaction;\n  card: PaymentGatewayCard;\n}>;\n\n/** The assembled request. Exported so the body shape is unit-testable without issuing a POST. */\nexport type GatewayPaymentsRequest = Readonly<{ url: string; body: readonly unknown[] }>;\n\n/** VTEX bins the leading eight digits, not six — the legacy's own `sanitizedBin` slice. */\nconst BIN_LENGTH = 8;\n\n/**\n * Strips the separators a mask inserted. `PaymentMethodValidator.numberMask` is server-driven (T1) and the\n * card-entry component (T7) renders the input through it, so its local state holds `4111 1111 1111 1111`\n * rather than the digits. The legacy normalized here, in the builder, before its own BIN slice\n * (`card.cardNumber = card.cardNumber.replace(/ /g, '')`) — the boundary is the one place the obligation\n * cannot be forgotten, and a spaced BIN is a lookup the gateway fails with no diagnosable error.\n */\nfunction toDigits(value: string): string {\n  return value.replace(/\\D/g, '');\n}\n\n/** `MM/YY` whatever the mask produced (`MM/YYYY`, `MMYY`) — the legacy's own two-slice normalization. */\nfunction toDueDate(expirationDate: string): string {\n  const digits = toDigits(expirationDate);\n  return `${digits.slice(0, 2)}/${digits.slice(-2)}`;\n}\n\n/** The card half of the body — the BIN and the `fields` map, both derived from one normalization pass. */\nfunction toCardBody(card: PaymentGatewayCard): { bin: string; fields: Record<string, unknown> } {\n  if (card.kind === 'saved') {\n    return { bin: card.bin, fields: { bin: card.bin, validationCode: card.securityCode } };\n  }\n\n  const number = toDigits(card.number);\n  const bin = number.slice(0, BIN_LENGTH);\n\n  return {\n    bin,\n    fields: {\n      bin,\n      cardNumber: number,\n      // The legacy's own `\\W` strip, so a CPF typed `123.456.789-00` reaches the gateway unpunctuated.\n      document: card.document === undefined ? null : card.document.replace(/\\W/g, ''),\n      dueDate: toDueDate(card.expirationDate),\n      holderName: card.holderName,\n      validationCode: card.securityCode,\n      cardLabel: card.cardLabel,\n      savePaymentData: card.saveCard ?? false,\n    },\n  };\n}\n\n/**\n * Builds the gateway URL and body. Billing is deliberately absent from the body: `setBillingAddress`\n * already persisted it on the order form's `invoiceData` (T3), so the gateway reads it from there — hence\n * the `billingAddressDifferent: false` default the two billing flags derive from. `originalPaymentIndex`\n * is the legacy's own constant for a single-payment order.\n *\n * The origin check is the last line of defence, not the first: `usePlaceOrder` already refuses an\n * untrusted origin *before* asking a holder for the card (T13, Decision 4). A builder has no userError\n * channel, so it throws — `sendPayments` catches, collapses it to `GATEWAY_ERROR`, and logs the error's\n * name only, so nothing about the card reaches a log. The throw happens before the body is assembled.\n */\nexport function buildGatewayPaymentsRequest({ transaction, card }: SendPaymentsRequest): GatewayPaymentsRequest {\n  if (!isTrustedGatewayOrigin(transaction.gatewayUrl)) {\n    throw new Error('Refusing to post card data: the transaction carries no trusted https gateway origin.');\n  }\n\n  const params = new URLSearchParams({ orderId: transaction.orderGroup });\n  if (transaction.userProfileId !== null) params.append('userProfileId', transaction.userProfileId);\n  if (transaction.callbackUrl !== undefined) params.append('callbackUrl', transaction.callbackUrl);\n\n  const transactionId = encodeURIComponent(transaction.transactionId);\n  const url = `${transaction.gatewayUrl}/api/payments/transactions/${transactionId}/payments?${params}`;\n\n  const { bin, fields } = toCardBody(card);\n  const billingAddressDifferent = transaction.billingAddressDifferent ?? false;\n\n  const payment = {\n    accountId: card.kind === 'saved' ? card.accountId : null,\n    bin,\n    chooseToUseNewCard: card.kind === 'new',\n    currencyCode: transaction.currencyCode,\n    fields,\n    groupName: transaction.groupName,\n    hasDefaultBillingAddress: !billingAddressDifferent,\n    id: transaction.merchantName,\n    installmentValue: transaction.installmentsValueInCents,\n    installments: transaction.installments,\n    installmentsInterestRate: transaction.interestRate,\n    installmentsValue: transaction.installmentsValueInCents,\n    interestRate: transaction.interestRate,\n    isBillingAddressDifferent: billingAddressDifferent,\n    originalPaymentIndex: 1,\n    paymentSystem: transaction.paymentSystem,\n    referenceValue: transaction.referenceValueInCents,\n    tokenId: null,\n    transaction: { id: transaction.transactionId, merchantName: transaction.merchantName },\n    value: transaction.valueInCents,\n  };\n\n  return { url, body: [payment] };\n}\n\n/**\n * T29 (FR-6, OQ-7): this leg's own abort budget. Before this task the direct-to-gateway POST carried no\n * `AbortSignal` and no timeout at all, so a gateway that never answered left `placing` true and the CTA\n * dead for the life of the mount (Route C, `place-order.md`'s Known limitations). The BFF's own default\n * is 10s (`apps/storefront-api-core/.../api-timeout.ts:9`), but a card authorization can legitimately\n * run longer than a GraphQL round trip, and this exact number is not confirmed with payments (spec\n * OQ-7) — a placeholder pending that answer, not a tuned production value.\n *\n * Exported so `gateway.test.ts`'s own abort-budget test can assert the abort fires at exactly this\n * duration, rather than against `vi.runAllTimersAsync()`, which fires any pending timer regardless of\n * duration and would stay green even if this were edited to `300_000`. That mechanism test alone is\n * still self-referential about this constant's own *value* — it advances the fake clock by whatever\n * `GATEWAY_REQUEST_TIMEOUT_MS` currently holds, so on its own it cannot catch an edit to the constant\n * either (fix round 2, verification finding V2). `gateway.test.ts` also asserts this constant against\n * the literal `30_000` directly, in its own dedicated test — that is what actually fails if this\n * constant's value ever changes.\n */\nexport const GATEWAY_REQUEST_TIMEOUT_MS = 30_000;\n\n/**\n * What a card POST resolves (T112). `reachedGateway` is `false` only when this module can show no request\n * was issued — the request builder refused before any `fetch`. Anything it cannot classify (a rejection, a\n * timeout, an abort, a malformed result) is `true`: a browser cannot tell whether a request that never\n * answered was processed, and a `false` frees the shopper to post the card again. Beside it, `userErrors`\n * keeps the `{ ..., userErrors }` payload shape (ADR-00005); it carries no card value.\n */\nexport type PaymentGatewayResult = Readonly<{\n  /** false only when no request was issued to the gateway. Anything unclassified is true. */\n  reachedGateway: boolean;\n  userErrors: readonly PaymentUserError[];\n}>;\n\n/**\n * Posts the card straight to the gateway and resolves a `PaymentGatewayResult`. A non-2xx response\n * resolves `{ reachedGateway: true, userErrors: [GATEWAY_ERROR] }`; a request the builder refuses\n * (an untrusted origin, a malformed card) resolves `{ reachedGateway: false, userErrors: [GATEWAY_ERROR] }`\n * without issuing a `fetch` or arming a timer, logging only the error's name. A rejected request —\n * including this leg's own timeout firing, or `options.signal` aborting — propagates, and the handler in\n * `use-payment-actions.ts` collapses it to a `reachedGateway: true` result: nothing here can prove it\n * never left. Neither outcome reads the response body: it may echo the request, and it tells the shopper\n * nothing more actionable than \"try again\".\n *\n * `options.signal`, when given, aborts this request in *addition to* — never instead of — this module's\n * own timeout: a caller opts into an earlier or externally triggered abort, but cannot opt out of the\n * budget that keeps this leg from hanging forever (FR-6, US-3). Composed with a plain `AbortController`\n * rather than `AbortSignal.any`/`AbortSignal.timeout` so the timeout is driven by an ordinary\n * `setTimeout`, the one implementation a test can advance deterministically with fake timers.\n *\n * No caller in this package passes `options.signal` today — it exists to satisfy the spec's own\n * Technical Contract (`specs/make-an-order-attempt-survive-a.md`) ahead of a future integration. Fix\n * pass, Low finding: the listener this composes onto `externalSignal` is now removed in the `finally`\n * below on every exit path, not only when it fires — previously, a caller that supplied a long-lived\n * signal (as opposed to a fresh one per call) would accumulate one listener, and this function's own\n * dead `AbortController`, per call that resolved normally.\n */\nexport async function postPaymentsToGateway(\n  request: SendPaymentsRequest,\n  options?: { signal?: AbortSignal },\n): Promise<PaymentGatewayResult> {\n  let built: GatewayPaymentsRequest;\n  try {\n    built = buildGatewayPaymentsRequest(request);\n  } catch (error) {\n    // Name only: the builder's message and the request it rejected can carry the card.\n    console.error(\n      '[payment.sendPayments] the gateway request was refused before it was sent',\n      loggableErrorName(error),\n    );\n    return { reachedGateway: false, userErrors: [PAYMENT_GATEWAY_USER_ERROR] };\n  }\n  const { url, body } = built;\n\n  const controller = new AbortController();\n  const timeoutId = setTimeout(\n    () => controller.abort(new DOMException('The gateway request timed out.', 'TimeoutError')),\n    GATEWAY_REQUEST_TIMEOUT_MS,\n  );\n  const externalSignal = options?.signal;\n  const onExternalAbort = () => controller.abort(externalSignal?.reason);\n  if (externalSignal) {\n    if (externalSignal.aborted) {\n      controller.abort(externalSignal.reason);\n    } else {\n      externalSignal.addEventListener('abort', onExternalAbort, { once: true });\n    }\n  }\n\n  try {\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(body),\n      signal: controller.signal,\n    });\n\n    return { reachedGateway: true, userErrors: response.ok ? [] : [PAYMENT_GATEWAY_USER_ERROR] };\n  } finally {\n    clearTimeout(timeoutId);\n    externalSignal?.removeEventListener('abort', onExternalAbort);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,6BAA6B;;AAG1C,MAAa,6BAA+C;CAC1D,MAAM;CACN,SAAS;AACX;;AA4FA,MAAM,aAAa;;;;;;;;AASnB,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,QAAQ,OAAO,EAAE;AAChC;;AAGA,SAAS,UAAU,gBAAgC;CACjD,MAAM,SAAS,SAAS,cAAc;CACtC,OAAO,GAAG,OAAO,MAAM,GAAG,CAAC,EAAE,GAAG,OAAO,MAAM,EAAE;AACjD;;AAGA,SAAS,WAAW,MAA4E;CAC9F,IAAI,KAAK,SAAS,SAChB,OAAO;EAAE,KAAK,KAAK;EAAK,QAAQ;GAAE,KAAK,KAAK;GAAK,gBAAgB,KAAK;EAAa;CAAE;CAGvF,MAAM,SAAS,SAAS,KAAK,MAAM;CACnC,MAAM,MAAM,OAAO,MAAM,GAAG,UAAU;CAEtC,OAAO;EACL;EACA,QAAQ;GACN;GACA,YAAY;GAEZ,UAAU,KAAK,aAAa,KAAA,IAAY,OAAO,KAAK,SAAS,QAAQ,OAAO,EAAE;GAC9E,SAAS,UAAU,KAAK,cAAc;GACtC,YAAY,KAAK;GACjB,gBAAgB,KAAK;GACrB,WAAW,KAAK;GAChB,iBAAiB,KAAK,YAAY;EACpC;CACF;AACF;;;;;;;;;;;;AAaA,SAAgB,4BAA4B,EAAE,aAAa,QAAqD;CAC9G,IAAI,CAAC,uBAAuB,YAAY,UAAU,GAChD,MAAM,IAAI,MAAM,sFAAsF;CAGxG,MAAM,SAAS,IAAI,gBAAgB,EAAE,SAAS,YAAY,WAAW,CAAC;CACtE,IAAI,YAAY,kBAAkB,MAAM,OAAO,OAAO,iBAAiB,YAAY,aAAa;CAChG,IAAI,YAAY,gBAAgB,KAAA,GAAW,OAAO,OAAO,eAAe,YAAY,WAAW;CAE/F,MAAM,gBAAgB,mBAAmB,YAAY,aAAa;CAClE,MAAM,MAAM,GAAG,YAAY,WAAW,6BAA6B,cAAc,YAAY;CAE7F,MAAM,EAAE,KAAK,WAAW,WAAW,IAAI;CACvC,MAAM,0BAA0B,YAAY,2BAA2B;CAyBvE,OAAO;EAAE;EAAK,MAAM,CAAC;GAtBnB,WAAW,KAAK,SAAS,UAAU,KAAK,YAAY;GACpD;GACA,oBAAoB,KAAK,SAAS;GAClC,cAAc,YAAY;GAC1B;GACA,WAAW,YAAY;GACvB,0BAA0B,CAAC;GAC3B,IAAI,YAAY;GAChB,kBAAkB,YAAY;GAC9B,cAAc,YAAY;GAC1B,0BAA0B,YAAY;GACtC,mBAAmB,YAAY;GAC/B,cAAc,YAAY;GAC1B,2BAA2B;GAC3B,sBAAsB;GACtB,eAAe,YAAY;GAC3B,gBAAgB,YAAY;GAC5B,SAAS;GACT,aAAa;IAAE,IAAI,YAAY;IAAe,cAAc,YAAY;GAAa;GACrF,OAAO,YAAY;EAGM,CAAC;CAAE;AAChC;;;;;;;;;;;;;;;;;;AAmBA,MAAa,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;AAsC1C,eAAsB,sBACpB,SACA,SAC+B;CAC/B,IAAI;CACJ,IAAI;EACF,QAAQ,4BAA4B,OAAO;CAC7C,SAAS,OAAO;EAEd,QAAQ,MACN,6EACA,kBAAkB,KAAK,CACzB;EACA,OAAO;GAAE,gBAAgB;GAAO,YAAY,CAAC,0BAA0B;EAAE;CAC3E;CACA,MAAM,EAAE,KAAK,SAAS;CAEtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,YAAY,iBACV,WAAW,MAAM,IAAI,aAAa,kCAAkC,cAAc,CAAC,GACzF,0BACF;CACA,MAAM,iBAAiB,SAAS;CAChC,MAAM,wBAAwB,WAAW,MAAM,gBAAgB,MAAM;CACrE,IAAI,gBAAgB;EAClB,IAAI,eAAe,SACjB,WAAW,MAAM,eAAe,MAAM;OAEtC,eAAe,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAE5E;CAEA,IAAI;EAQF,OAAO;GAAE,gBAAgB;GAAM,aAAY,MAPpB,MAAM,KAAK;IAChC,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM,KAAK,UAAU,IAAI;IACzB,QAAQ,WAAW;GACrB,CAAC,EAAA,CAEmD,KAAK,CAAC,IAAI,CAAC,0BAA0B;EAAE;CAC7F,UAAU;EACR,aAAa,SAAS;EACtB,gBAAgB,oBAAoB,SAAS,eAAe;CAC9D;AACF"}
+{"version":3,"file":"gateway.js","names":[],"sources":["../../../src/sdk/payment/gateway.ts"],"sourcesContent":["/**\n * The direct-to-gateway card POST (specs/payment-action-namespace.md, US-6) — the PCI boundary of the\n * credit-card feature. A new card's number and CVV, or a saved card's CVV, go from the browser straight\n * to the VTEX payment gateway and never transit our GraphQL layer or the normalized Apollo cache\n * (RFC D13; ADR-0010's sanctioned façade flavor).\n *\n * This module imports no Apollo and no GraphQL symbol on purpose: the code that holds card data has no\n * route to the cache, and that property is checkable by reading the imports above. Card data arrives as\n * a runtime argument from the card-entry component's local state (T7) — it is never a declared action\n * payload, a fragment field, or a schema-bindable prop, so the AI Store Builder and the visual editor\n * have no name to map a value onto.\n *\n * Nothing on this path is ever logged, serialized, or stored anywhere but the request body: the caller\n * in `use-payment-actions.ts` logs a static message plus the error's `name` only.\n *\n * The request shape is behavior evidence from the legacy checkout\n * (`fastcheckout@cd09bec3`, `packages/apps/client/src/screens/Payment/components/CardForm/services/gateway.service.ts`)\n * — never a port. Where the legacy hardcoded a value under a `TODO` (installment count, interest rate,\n * reference value) this builder reads it off the transaction descriptor instead.\n */\n\nimport { loggableErrorName } from '../../utils/loggable-error-name.js';\nimport { isTrustedGatewayOrigin } from './gateway-origin.js';\nimport type { PaymentUserError } from './operations.js';\n\n/** Client-synthesized code for a failed gateway leg — distinct from the BFF's `NETWORK_ERROR`. */\nexport const PAYMENT_GATEWAY_ERROR_CODE = 'GATEWAY_ERROR';\n\n/**\n * The single userError a rejected request, a non-2xx response and a request the builder refused all resolve to.\n * Its `message` is diagnostic; `PlaceOrder` words the code.\n */\nexport const PAYMENT_GATEWAY_USER_ERROR: PaymentUserError = {\n  code: PAYMENT_GATEWAY_ERROR_CODE,\n  message: 'Unable to complete the payment. Please try again.',\n};\n\n/**\n * Non-sensitive descriptor of the open transaction. Every field maps to a value the caller already\n * holds — `paymentStartTransaction`'s payload (T3) or the `Payment` read model (T1) — except\n * `gatewayUrl` and `merchantName`, which that payload does not carry today (Gaps 1 and 2 in the spec).\n * Amounts are in the currency's **minor units**; `PaymentStartTransactionPayload.value.amount` is a\n * decimal, so the caller converts once, visibly, rather than having this module assume an exponent.\n */\nexport type PaymentGatewayTransaction = Readonly<{\n  /**\n   * Gateway origin, e.g. `https://acme.vtexvault.com`. Server-resolved by T18 and read off\n   * `paymentStartTransaction`'s payload; never derived here. It is nullable there and required here,\n   * so the builder re-checks it (`isTrustedGatewayOrigin`) rather than trusting the type.\n   */\n  gatewayUrl: string;\n  /** `PaymentStartTransactionPayload.transactionId`. */\n  transactionId: string;\n  /** VTEX merchant name for this transaction. Resolved server-side by T3 but not exposed on its payload. */\n  merchantName: string;\n  /** `PaymentStartTransactionPayload.orderGroup` — the gateway's `orderId` query parameter. */\n  orderGroup: string;\n  /** `PaymentStartTransactionPayload.userProfileId`; null for a guest order, so the query parameter is left out. */\n  userProfileId: string | null;\n  /** `Payment.selectedMethodId` — the VTEX payment-system id. */\n  paymentSystem: string;\n  /** `PaymentMethod.groupName`, e.g. `creditCardPaymentGroup`. */\n  groupName: string;\n  /** `PaymentStartTransactionPayload.value.currencyCode`. */\n  currencyCode: string;\n  /** Transaction total, in minor units. */\n  valueInCents: number;\n  /** Pre-interest base (`PaymentInstallmentOption.baseValue`), in minor units. */\n  referenceValueInCents: number;\n  /** `Payment.selectedInstallment.count`; 1 when the shopper never picked a plan. */\n  installments: number;\n  /** Per-installment amount (`PaymentInstallment.value`), in minor units. */\n  installmentsValueInCents: number;\n  /** `PaymentInstallment.interestRate`; 0 for the interest-free 1x default. */\n  interestRate: number;\n  /** Absolute return URL for the 3D Secure challenge. Omitted when the store authored no return page. */\n  callbackUrl?: string;\n  /**\n   * Billing differs from the delivery address. Defaults to `false`, because `setBillingAddress` persists\n   * billing on the order form's `invoiceData` (T3) and the gateway reads it from there rather than from\n   * this body. The call site that would override it is T13's `usePlaceOrder`, the one place the\n   * descriptor is assembled; T11 owns the live verification of the assumption and publishes the flag to\n   * T5's `draft` for T13 to read. Confirming it never reopens this module.\n   */\n  billingAddressDifferent?: boolean;\n}>;\n\n/** A newly entered card. Runtime argument only — never declared, never logged, never cached. */\nexport type PaymentGatewayNewCard = Readonly<{\n  kind: 'new';\n  /** Full card number. The builder strips whatever separators the method's `numberMask` inserted. */\n  number: string;\n  /** Security code (CVV). */\n  securityCode: string;\n  /** Expiry. Normalized to `MM/YY`, so a `MM/YYYY` mask is accepted. */\n  expirationDate: string;\n  holderName: string;\n  /** Shopper document (a CPF). The builder strips its punctuation. */\n  document?: string;\n  /** Shopper-assigned label, when the save-card control collected one. */\n  cardLabel?: string;\n  /** The card-save flag itself — the other half of `payment.saveCard`'s consent write (RFC D5). */\n  saveCard?: boolean;\n}>;\n\n/** A previously saved card: its account reference plus the CVV the shopper re-enters. */\nexport type PaymentGatewaySavedCard = Readonly<{\n  kind: 'saved';\n  /** `SavedCard.accountId`. */\n  accountId: string;\n  /** `SavedCard.bin` — not sensitive; the read model exposes it for installment lookup. */\n  bin: string;\n  /** Security code (CVV). */\n  securityCode: string;\n}>;\n\nexport type PaymentGatewayCard = PaymentGatewayNewCard | PaymentGatewaySavedCard;\n\nexport type SendPaymentsRequest = Readonly<{\n  transaction: PaymentGatewayTransaction;\n  card: PaymentGatewayCard;\n}>;\n\n/** The assembled request. Exported so the body shape is unit-testable without issuing a POST. */\nexport type GatewayPaymentsRequest = Readonly<{ url: string; body: readonly unknown[] }>;\n\n/** VTEX bins the leading eight digits, not six — the legacy's own `sanitizedBin` slice. */\nconst BIN_LENGTH = 8;\n\n/**\n * Strips the separators a mask inserted. `PaymentMethodValidator.numberMask` is server-driven (T1) and the\n * card-entry component (T7) renders the input through it, so its local state holds `4111 1111 1111 1111`\n * rather than the digits. The legacy normalized here, in the builder, before its own BIN slice\n * (`card.cardNumber = card.cardNumber.replace(/ /g, '')`) — the boundary is the one place the obligation\n * cannot be forgotten, and a spaced BIN is a lookup the gateway fails with no diagnosable error.\n */\nfunction toDigits(value: string): string {\n  return value.replace(/\\D/g, '');\n}\n\n/** `MM/YY` whatever the mask produced (`MM/YYYY`, `MMYY`) — the legacy's own two-slice normalization. */\nfunction toDueDate(expirationDate: string): string {\n  const digits = toDigits(expirationDate);\n  return `${digits.slice(0, 2)}/${digits.slice(-2)}`;\n}\n\n/** The card half of the body — the BIN and the `fields` map, both derived from one normalization pass. */\nfunction toCardBody(card: PaymentGatewayCard): { bin: string; fields: Record<string, unknown> } {\n  if (card.kind === 'saved') {\n    return { bin: card.bin, fields: { bin: card.bin, validationCode: card.securityCode } };\n  }\n\n  const number = toDigits(card.number);\n  const bin = number.slice(0, BIN_LENGTH);\n\n  return {\n    bin,\n    fields: {\n      bin,\n      cardNumber: number,\n      // The legacy's own `\\W` strip, so a CPF typed `123.456.789-00` reaches the gateway unpunctuated.\n      document: card.document === undefined ? null : card.document.replace(/\\W/g, ''),\n      dueDate: toDueDate(card.expirationDate),\n      holderName: card.holderName,\n      validationCode: card.securityCode,\n      cardLabel: card.cardLabel,\n      savePaymentData: card.saveCard ?? false,\n    },\n  };\n}\n\n/**\n * Builds the gateway URL and body. Billing is deliberately absent from the body: `setBillingAddress`\n * already persisted it on the order form's `invoiceData` (T3), so the gateway reads it from there — hence\n * the `billingAddressDifferent: false` default the two billing flags derive from. `originalPaymentIndex`\n * is the legacy's own constant for a single-payment order.\n *\n * The origin check is the last line of defence, not the first: `usePlaceOrder` already refuses an\n * untrusted origin *before* asking a holder for the card (T13, Decision 4). A builder has no userError\n * channel, so it throws — `sendPayments` catches, collapses it to `GATEWAY_ERROR`, and logs the error's\n * name only, so nothing about the card reaches a log. The throw happens before the body is assembled.\n */\nexport function buildGatewayPaymentsRequest({ transaction, card }: SendPaymentsRequest): GatewayPaymentsRequest {\n  if (!isTrustedGatewayOrigin(transaction.gatewayUrl)) {\n    throw new Error('Refusing to post card data: the transaction carries no trusted https gateway origin.');\n  }\n\n  const params = new URLSearchParams({ orderId: transaction.orderGroup });\n  if (transaction.userProfileId !== null) params.append('userProfileId', transaction.userProfileId);\n  if (transaction.callbackUrl !== undefined) {\n    params.append('callbackUrl', transaction.callbackUrl);\n    params.append('redirect', 'false');\n  }\n\n  const transactionId = encodeURIComponent(transaction.transactionId);\n  const url = `${transaction.gatewayUrl}/api/payments/transactions/${transactionId}/payments?${params}`;\n\n  const { bin, fields } = toCardBody(card);\n  const billingAddressDifferent = transaction.billingAddressDifferent ?? false;\n\n  const payment = {\n    accountId: card.kind === 'saved' ? card.accountId : null,\n    bin,\n    chooseToUseNewCard: card.kind === 'new',\n    currencyCode: transaction.currencyCode,\n    fields,\n    groupName: transaction.groupName,\n    hasDefaultBillingAddress: !billingAddressDifferent,\n    id: transaction.merchantName,\n    installmentValue: transaction.installmentsValueInCents,\n    installments: transaction.installments,\n    installmentsInterestRate: transaction.interestRate,\n    installmentsValue: transaction.installmentsValueInCents,\n    interestRate: transaction.interestRate,\n    isBillingAddressDifferent: billingAddressDifferent,\n    originalPaymentIndex: 1,\n    paymentSystem: transaction.paymentSystem,\n    referenceValue: transaction.referenceValueInCents,\n    tokenId: null,\n    transaction: { id: transaction.transactionId, merchantName: transaction.merchantName },\n    value: transaction.valueInCents,\n  };\n\n  return { url, body: [payment] };\n}\n\n/**\n * T29 (FR-6, OQ-7): this leg's own abort budget. Before this task the direct-to-gateway POST carried no\n * `AbortSignal` and no timeout at all, so a gateway that never answered left `placing` true and the CTA\n * dead for the life of the mount (Route C, `place-order.md`'s Known limitations). The BFF's own default\n * is 10s (`apps/storefront-api-core/.../api-timeout.ts:9`), but a card authorization can legitimately\n * run longer than a GraphQL round trip, and this exact number is not confirmed with payments (spec\n * OQ-7) — a placeholder pending that answer, not a tuned production value.\n *\n * Exported so `gateway.test.ts`'s own abort-budget test can assert the abort fires at exactly this\n * duration, rather than against `vi.runAllTimersAsync()`, which fires any pending timer regardless of\n * duration and would stay green even if this were edited to `300_000`. That mechanism test alone is\n * still self-referential about this constant's own *value* — it advances the fake clock by whatever\n * `GATEWAY_REQUEST_TIMEOUT_MS` currently holds, so on its own it cannot catch an edit to the constant\n * either (fix round 2, verification finding V2). `gateway.test.ts` also asserts this constant against\n * the literal `30_000` directly, in its own dedicated test — that is what actually fails if this\n * constant's value ever changes.\n */\nexport const GATEWAY_REQUEST_TIMEOUT_MS = 30_000;\n\n/**\n * What a card POST resolves (T112). `reachedGateway` is `false` only when this module can show no request\n * was issued — the request builder refused before any `fetch`. Anything it cannot classify (a rejection, a\n * timeout, an abort, a malformed result) is `true`: a browser cannot tell whether a request that never\n * answered was processed, and a `false` frees the shopper to post the card again. Beside it, `userErrors`\n * keeps the `{ ..., userErrors }` payload shape (ADR-00005); it carries no card value.\n */\nexport type PaymentGatewayResult = Readonly<{\n  /** false only when no request was issued to the gateway. Anything unclassified is true. */\n  reachedGateway: boolean;\n  userErrors: readonly PaymentUserError[];\n}>;\n\n/**\n * Posts the card straight to the gateway and resolves a `PaymentGatewayResult`. A non-2xx response\n * resolves `{ reachedGateway: true, userErrors: [GATEWAY_ERROR] }`; a request the builder refuses\n * (an untrusted origin, a malformed card) resolves `{ reachedGateway: false, userErrors: [GATEWAY_ERROR] }`\n * without issuing a `fetch` or arming a timer, logging only the error's name. A rejected request —\n * including this leg's own timeout firing, or `options.signal` aborting — propagates, and the handler in\n * `use-payment-actions.ts` collapses it to a `reachedGateway: true` result: nothing here can prove it\n * never left. Neither outcome reads the response body: it may echo the request, and it tells the shopper\n * nothing more actionable than \"try again\".\n *\n * `options.signal`, when given, aborts this request in *addition to* — never instead of — this module's\n * own timeout: a caller opts into an earlier or externally triggered abort, but cannot opt out of the\n * budget that keeps this leg from hanging forever (FR-6, US-3). Composed with a plain `AbortController`\n * rather than `AbortSignal.any`/`AbortSignal.timeout` so the timeout is driven by an ordinary\n * `setTimeout`, the one implementation a test can advance deterministically with fake timers.\n *\n * No caller in this package passes `options.signal` today — it exists to satisfy the spec's own\n * Technical Contract (`specs/make-an-order-attempt-survive-a.md`) ahead of a future integration. Fix\n * pass, Low finding: the listener this composes onto `externalSignal` is now removed in the `finally`\n * below on every exit path, not only when it fires — previously, a caller that supplied a long-lived\n * signal (as opposed to a fresh one per call) would accumulate one listener, and this function's own\n * dead `AbortController`, per call that resolved normally.\n */\nexport async function postPaymentsToGateway(\n  request: SendPaymentsRequest,\n  options?: { signal?: AbortSignal },\n): Promise<PaymentGatewayResult> {\n  let built: GatewayPaymentsRequest;\n  try {\n    built = buildGatewayPaymentsRequest(request);\n  } catch (error) {\n    // Name only: the builder's message and the request it rejected can carry the card.\n    console.error(\n      '[payment.sendPayments] the gateway request was refused before it was sent',\n      loggableErrorName(error),\n    );\n    return { reachedGateway: false, userErrors: [PAYMENT_GATEWAY_USER_ERROR] };\n  }\n  const { url, body } = built;\n\n  const controller = new AbortController();\n  const timeoutId = setTimeout(\n    () => controller.abort(new DOMException('The gateway request timed out.', 'TimeoutError')),\n    GATEWAY_REQUEST_TIMEOUT_MS,\n  );\n  const externalSignal = options?.signal;\n  const onExternalAbort = () => controller.abort(externalSignal?.reason);\n  if (externalSignal) {\n    if (externalSignal.aborted) {\n      controller.abort(externalSignal.reason);\n    } else {\n      externalSignal.addEventListener('abort', onExternalAbort, { once: true });\n    }\n  }\n\n  try {\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(body),\n      signal: controller.signal,\n    });\n\n    return { reachedGateway: true, userErrors: response.ok ? [] : [PAYMENT_GATEWAY_USER_ERROR] };\n  } finally {\n    clearTimeout(timeoutId);\n    externalSignal?.removeEventListener('abort', onExternalAbort);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,6BAA6B;;;;;AAM1C,MAAa,6BAA+C;CAC1D,MAAM;CACN,SAAS;AACX;;AA4FA,MAAM,aAAa;;;;;;;;AASnB,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,QAAQ,OAAO,EAAE;AAChC;;AAGA,SAAS,UAAU,gBAAgC;CACjD,MAAM,SAAS,SAAS,cAAc;CACtC,OAAO,GAAG,OAAO,MAAM,GAAG,CAAC,EAAE,GAAG,OAAO,MAAM,EAAE;AACjD;;AAGA,SAAS,WAAW,MAA4E;CAC9F,IAAI,KAAK,SAAS,SAChB,OAAO;EAAE,KAAK,KAAK;EAAK,QAAQ;GAAE,KAAK,KAAK;GAAK,gBAAgB,KAAK;EAAa;CAAE;CAGvF,MAAM,SAAS,SAAS,KAAK,MAAM;CACnC,MAAM,MAAM,OAAO,MAAM,GAAG,UAAU;CAEtC,OAAO;EACL;EACA,QAAQ;GACN;GACA,YAAY;GAEZ,UAAU,KAAK,aAAa,KAAA,IAAY,OAAO,KAAK,SAAS,QAAQ,OAAO,EAAE;GAC9E,SAAS,UAAU,KAAK,cAAc;GACtC,YAAY,KAAK;GACjB,gBAAgB,KAAK;GACrB,WAAW,KAAK;GAChB,iBAAiB,KAAK,YAAY;EACpC;CACF;AACF;;;;;;;;;;;;AAaA,SAAgB,4BAA4B,EAAE,aAAa,QAAqD;CAC9G,IAAI,CAAC,uBAAuB,YAAY,UAAU,GAChD,MAAM,IAAI,MAAM,sFAAsF;CAGxG,MAAM,SAAS,IAAI,gBAAgB,EAAE,SAAS,YAAY,WAAW,CAAC;CACtE,IAAI,YAAY,kBAAkB,MAAM,OAAO,OAAO,iBAAiB,YAAY,aAAa;CAChG,IAAI,YAAY,gBAAgB,KAAA,GAAW;EACzC,OAAO,OAAO,eAAe,YAAY,WAAW;EACpD,OAAO,OAAO,YAAY,OAAO;CACnC;CAEA,MAAM,gBAAgB,mBAAmB,YAAY,aAAa;CAClE,MAAM,MAAM,GAAG,YAAY,WAAW,6BAA6B,cAAc,YAAY;CAE7F,MAAM,EAAE,KAAK,WAAW,WAAW,IAAI;CACvC,MAAM,0BAA0B,YAAY,2BAA2B;CAyBvE,OAAO;EAAE;EAAK,MAAM,CAAC;GAtBnB,WAAW,KAAK,SAAS,UAAU,KAAK,YAAY;GACpD;GACA,oBAAoB,KAAK,SAAS;GAClC,cAAc,YAAY;GAC1B;GACA,WAAW,YAAY;GACvB,0BAA0B,CAAC;GAC3B,IAAI,YAAY;GAChB,kBAAkB,YAAY;GAC9B,cAAc,YAAY;GAC1B,0BAA0B,YAAY;GACtC,mBAAmB,YAAY;GAC/B,cAAc,YAAY;GAC1B,2BAA2B;GAC3B,sBAAsB;GACtB,eAAe,YAAY;GAC3B,gBAAgB,YAAY;GAC5B,SAAS;GACT,aAAa;IAAE,IAAI,YAAY;IAAe,cAAc,YAAY;GAAa;GACrF,OAAO,YAAY;EAGM,CAAC;CAAE;AAChC;;;;;;;;;;;;;;;;;;AAmBA,MAAa,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;AAsC1C,eAAsB,sBACpB,SACA,SAC+B;CAC/B,IAAI;CACJ,IAAI;EACF,QAAQ,4BAA4B,OAAO;CAC7C,SAAS,OAAO;EAEd,QAAQ,MACN,6EACA,kBAAkB,KAAK,CACzB;EACA,OAAO;GAAE,gBAAgB;GAAO,YAAY,CAAC,0BAA0B;EAAE;CAC3E;CACA,MAAM,EAAE,KAAK,SAAS;CAEtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,YAAY,iBACV,WAAW,MAAM,IAAI,aAAa,kCAAkC,cAAc,CAAC,GACzF,0BACF;CACA,MAAM,iBAAiB,SAAS;CAChC,MAAM,wBAAwB,WAAW,MAAM,gBAAgB,MAAM;CACrE,IAAI,gBAAgB;EAClB,IAAI,eAAe,SACjB,WAAW,MAAM,eAAe,MAAM;OAEtC,eAAe,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAE5E;CAEA,IAAI;EAQF,OAAO;GAAE,gBAAgB;GAAM,aAAY,MAPpB,MAAM,KAAK;IAChC,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM,KAAK,UAAU,IAAI;IACzB,QAAQ,WAAW;GACrB,CAAC,EAAA,CAEmD,KAAK,CAAC,IAAI,CAAC,0BAA0B;EAAE;CAC7F,UAAU;EACR,aAAa,SAAS;EACtB,gBAAgB,oBAAoB,SAAS,eAAe;CAC9D;AACF"}

package/dist/sdk/payment/operations.d.ts

@@ -1,3 +1,4 @@
+import "../generated/graphql.js";
 import "../cart/operations.js";
 import { TypedDocumentNode } from "@apollo/client";
 //#region src/sdk/payment/operations.d.ts

package/dist/sdk/payment/operations.js

@@ -40,11 +40,12 @@ const PaymentFragment = gql`
         amount
         currencyCode
       }
-      total {
+      totalAmount {
         amount
         currencyCode
       }
       interestRate
+      interestFree
     }
     installmentOptions {
       __typename
@@ -61,17 +62,19 @@ const PaymentFragment = gql`
           amount
           currencyCode
         }
-        total {
+        totalAmount {
           amount
           currencyCode
         }
         interestRate
+        interestFree
       }
     }
     methods {
       __typename
       id
       name
+      type
       groupName
       validator {
         __typename
@@ -137,9 +140,11 @@ const PAYMENT_METHOD_SELECT = gql`
   ${PaymentBillingAddressFragment}
 `;
 /**
-* Selects `cart { ...CartFragment }` alongside `payment` so the interest-inclusive order total lands
-* in the normalized cache in the same round trip (REQ-03) — the same reason `shippingOptionSelect`
-* selects the cart.
+* Selects `cart { ...CartFragment }` alongside `payment` so the cart total the server returns lands in
+* the normalized cache in the same round trip (REQ-03) — the same reason `shippingOptionSelect`
+* selects the cart. That total is the server's: the greater of the order form's value and the selected
+* payment's value (`mapOrderFormToGqlCart`), so it carries the picked tier's interest. Dropping `total`
+* from the selection leaves the total on screen at its previous value.
 */
 const PAYMENT_INSTALLMENT_SELECT = gql`
   mutation PaymentInstallmentSelect($input: PaymentInstallmentSelectInput!) {
@@ -202,6 +207,7 @@ const PAYMENT_START_TRANSACTION = gql`
       merchantName
       gatewayUrl
       orderGroup
+      orderNodeId
       userProfileId
       value {
         amount
@@ -221,6 +227,8 @@ const PAYMENT_GATEWAY_CALLBACK = gql`
     paymentGatewayCallback(input: $input) {
       __typename
       orderId
+      orderNodeId
+      redirectUrl
       userErrors {
         code
         message
@@ -228,7 +236,21 @@ const PAYMENT_GATEWAY_CALLBACK = gql`
     }
   }
 `;
+/** Only what `emitPurchaseForOrder` needs: the order's reference, its status, and what it costs. */
+const SETTLED_ORDER_FACTS = gql`
+  query SettledOrderFacts($id: ID!) {
+    order(id: $id) {
+      id
+      reference
+      status
+      total {
+        amount
+        currencyCode
+      }
+    }
+  }
+`;
 //#endregion
-export { PAYMENT_BILLING_ADDRESS_UPDATE, PAYMENT_GATEWAY_CALLBACK, PAYMENT_INSTALLMENT_SELECT, PAYMENT_METHOD_SELECT, PAYMENT_NETWORK_ERROR_CODE, PAYMENT_START_TRANSACTION, PaymentBillingAddressFragment, PaymentFragment };
+export { PAYMENT_BILLING_ADDRESS_UPDATE, PAYMENT_GATEWAY_CALLBACK, PAYMENT_INSTALLMENT_SELECT, PAYMENT_METHOD_SELECT, PAYMENT_NETWORK_ERROR_CODE, PAYMENT_START_TRANSACTION, PaymentBillingAddressFragment, PaymentFragment, SETTLED_ORDER_FACTS };
 
 //# sourceMappingURL=operations.js.map

package/dist/sdk/payment/operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations.js","names":[],"sources":["../../../src/sdk/payment/operations.ts"],"sourcesContent":["import type { TypedDocumentNode } from '@apollo/client';\nimport { type CartEntity, CartFragment } from '../cart/operations.js';\nimport { gql } from '../graphql-tag.js';\n\n/**\n * Payment write-model GraphQL operations (specs/payment-action-namespace.md, T4) — the five mutations\n * `api-module:PaymentWriteModel` shipped (T3, `checkout/schema.graphql` § 11). Nothing here is\n * invented: every mutation, input field, and payload field is pinned to that schema.\n *\n * Authored with the hand `gql` tag — the codegen `graphql()` factory is reserved for the reactive read\n * path — and excluded from the codegen `documents` glob (see `codegen.ts`): the `gql` tag alone is\n * still plucked by `graphql-codegen`, which would duplicate these hand-written types in\n * `sdk/generated/`. Mirrors `shipping/option-select-operations.ts` and `identity/operations.ts`.\n *\n * No field at any nesting depth carries a card number or CVV — the read model guarantees it (RFC D13),\n * and the one call that does carry them never touches GraphQL at all (see `gateway.ts`).\n *\n * Failures follow ADR-00007's two-path contract: domain outcomes arrive as payload `userErrors`;\n * transport and top-level GraphQL failures are infrastructure, collapsed by the handlers in\n * `use-payment-actions.ts` to the one client-synthesized code, `PAYMENT_NETWORK_ERROR_CODE`.\n */\n\n// ---------------------------------------------------------------------------\n// Domain types — mirror the shipped checkout schema\n// ---------------------------------------------------------------------------\n\n/** A payment domain error. Every mutation's error type is `{ code, message }`; codes stay strings. */\nexport type PaymentUserError = Readonly<{ code: string; message: string }>;\n\n/**\n * The one client-synthesized error code, carried by the userError every mutation-backed method\n * *resolves* (never throws) when its mutation fails at the transport or top-level-GraphQL layer.\n * `gateway.ts` owns the separate code for a failed gateway leg (Decision 7).\n */\nexport const PAYMENT_NETWORK_ERROR_CODE = 'NETWORK_ERROR';\n\nexport type PaymentMoney = Readonly<{ __typename?: 'Money'; amount: number; currencyCode: string }>;\n\ntype PaymentInstallmentEntity = Readonly<{\n  __typename?: 'PaymentInstallment';\n  count: number;\n  value: PaymentMoney;\n  total: PaymentMoney;\n  interestRate: number;\n}>;\n\ntype PaymentMethodValidatorEntity = Readonly<{\n  __typename?: 'PaymentMethodValidator';\n  numberMask: string | null;\n  numberRegex: string | null;\n  cvvMask: string | null;\n  cvvRegex: string | null;\n  cvvRequired: boolean;\n  expirationRequired: boolean;\n  holderNameRequired: boolean;\n  billingAddressRequired: boolean;\n  documentDisplayable: boolean;\n  documentRequired: boolean;\n}>;\n\ntype PaymentCountryDocumentEntity = Readonly<{\n  __typename?: 'PaymentCountryDocument';\n  type: string;\n  displayable: boolean;\n  required: boolean;\n}>;\n\ntype PaymentCountryEntity = Readonly<{\n  __typename?: 'PaymentCountry';\n  countryCode: string;\n  documents: readonly PaymentCountryDocumentEntity[];\n}>;\n\ntype PaymentMethodEntity = Readonly<{\n  __typename?: 'PaymentMethod';\n  id: string;\n  name: string;\n  groupName: string;\n  validator: PaymentMethodValidatorEntity;\n}>;\n\ntype PaymentInstallmentOptionEntity = Readonly<{\n  __typename?: 'PaymentInstallmentOption';\n  methodId: string;\n  bin: string | null;\n  baseValue: PaymentMoney;\n  installments: readonly PaymentInstallmentEntity[];\n}>;\n\ntype SavedCardEntity = Readonly<{\n  __typename?: 'SavedCard';\n  id: string;\n  accountId: string;\n  methodId: string;\n  network: string;\n  lastFourDigits: string;\n  bin: string;\n  label: string | null;\n  expired: boolean;\n  cvvRequired: boolean;\n}>;\n\n/** The full `Payment` entity every selection mutation echoes back. Never carries a PAN or CVV. */\nexport type PaymentEntity = Readonly<{\n  __typename?: 'Payment';\n  id: string;\n  methods: readonly PaymentMethodEntity[];\n  selectedMethodId: string | null;\n  selectedAccountId: string | null;\n  selectedBin: string | null;\n  storeCountryCode: string | null;\n  countries: readonly PaymentCountryEntity[];\n  selectedInstallment: PaymentInstallmentEntity | null;\n  installmentOptions: readonly PaymentInstallmentOptionEntity[];\n  savedCards: readonly SavedCardEntity[];\n}>;\n\n/** The billing-address echo on the selection payloads — the schema's shared `Address` type. */\nexport type PaymentBillingAddressEntity = Readonly<{\n  __typename?: 'Address';\n  id: string | null;\n  recipientName: string | null;\n  postalCode: string | null;\n  country: string;\n  street: string | null;\n  number: string | null;\n  complement: string | null;\n  neighborhood: string | null;\n  city: string | null;\n  state: string | null;\n}>;\n\n// ---------------------------------------------------------------------------\n// Mutation inputs — mirror the schema's input types verbatim\n// ---------------------------------------------------------------------------\n\n/** A `bin` with an `accountId` is validated against the saved card's own BIN (MISMATCHED_BIN_FOR_SAVED_CARD). */\nexport type PaymentMethodSelectInput = Readonly<{ methodId: string; bin?: string; accountId?: string }>;\n\nexport type PaymentInstallmentSelectInput = Readonly<{ count: number }>;\n\n/** With `sameAsDelivery: true` every other field is ignored and the server performs no upstream write. */\nexport type PaymentBillingAddressUpdateInput = Readonly<{\n  sameAsDelivery: boolean;\n  addressType?: string;\n  postalCode?: string;\n  country?: string;\n  street?: string;\n  number?: string;\n  complement?: string;\n  neighborhood?: string;\n  city?: string;\n  state?: string;\n  reference?: string;\n}>;\n\nexport type PaymentGatewayCallbackInput = Readonly<{ orderGroup: string }>;\n\n// ---------------------------------------------------------------------------\n// Shared fragment\n// ---------------------------------------------------------------------------\n\n/**\n * The canonical `Payment` selection set, spread by every selection mutation so one response\n * re-normalizes the whole entity and every reactive subscriber re-renders with no refetch — the\n * payload-completeness invariant writes must honor (ADR-0010). Selecting the entire entity mirrors\n * `CartFragment` and `SHIPPING_ADDRESS_UPDATE`'s full-`Shipping` selection: the method list (T5), the\n * validator config (T7), `installmentOptions` (T9), and the summary's selection fields (T6) are all\n * subscribed independently, and a partial selection would leave one of them incomplete.\n */\nexport const PaymentFragment = gql`\n  fragment PaymentFragment on Payment {\n    __typename\n    id\n    selectedMethodId\n    selectedAccountId\n    selectedBin\n    storeCountryCode\n    countries {\n      __typename\n      countryCode\n      documents {\n        __typename\n        type\n        displayable\n        required\n      }\n    }\n    selectedInstallment {\n      __typename\n      count\n      value {\n        amount\n        currencyCode\n      }\n      total {\n        amount\n        currencyCode\n      }\n      interestRate\n    }\n    installmentOptions {\n      __typename\n      methodId\n      bin\n      baseValue {\n        amount\n        currencyCode\n      }\n      installments {\n        __typename\n        count\n        value {\n          amount\n          currencyCode\n        }\n        total {\n          amount\n          currencyCode\n        }\n        interestRate\n      }\n    }\n    methods {\n      __typename\n      id\n      name\n      groupName\n      validator {\n        __typename\n        numberMask\n        numberRegex\n        cvvMask\n        cvvRegex\n        cvvRequired\n        expirationRequired\n        holderNameRequired\n        billingAddressRequired\n        documentDisplayable\n        documentRequired\n      }\n    }\n    savedCards {\n      __typename\n      id\n      accountId\n      methodId\n      network\n      lastFourDigits\n      bin\n      label\n      expired\n      cvvRequired\n    }\n  }\n`;\n\n/** The billing-address echo, spread by the three selection mutations that return one. */\nexport const PaymentBillingAddressFragment = gql`\n  fragment PaymentBillingAddressFragment on Address {\n    __typename\n    id\n    recipientName\n    postalCode\n    country\n    street\n    number\n    complement\n    neighborhood\n    city\n    state\n  }\n`;\n\n// ---------------------------------------------------------------------------\n// Mutation operations\n// ---------------------------------------------------------------------------\n\ntype PaymentMethodSelectMutation = Readonly<{\n  paymentMethodSelect: Readonly<{\n    __typename?: 'PaymentMethodSelectPayload';\n    payment: PaymentEntity | null;\n    billingAddress: PaymentBillingAddressEntity | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\nexport const PAYMENT_METHOD_SELECT: TypedDocumentNode<\n  PaymentMethodSelectMutation,\n  Readonly<{ input: PaymentMethodSelectInput }>\n> = gql`\n  mutation PaymentMethodSelect($input: PaymentMethodSelectInput!) {\n    paymentMethodSelect(input: $input) {\n      __typename\n      payment {\n        ...PaymentFragment\n      }\n      billingAddress {\n        ...PaymentBillingAddressFragment\n      }\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n  ${PaymentFragment}\n  ${PaymentBillingAddressFragment}\n`;\n\ntype PaymentInstallmentSelectMutation = Readonly<{\n  paymentInstallmentSelect: Readonly<{\n    __typename?: 'PaymentInstallmentSelectPayload';\n    payment: PaymentEntity | null;\n    cart: CartEntity | null;\n    billingAddress: PaymentBillingAddressEntity | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\n/**\n * Selects `cart { ...CartFragment }` alongside `payment` so the interest-inclusive order total lands\n * in the normalized cache in the same round trip (REQ-03) — the same reason `shippingOptionSelect`\n * selects the cart.\n */\nexport const PAYMENT_INSTALLMENT_SELECT: TypedDocumentNode<\n  PaymentInstallmentSelectMutation,\n  Readonly<{ input: PaymentInstallmentSelectInput }>\n> = gql`\n  mutation PaymentInstallmentSelect($input: PaymentInstallmentSelectInput!) {\n    paymentInstallmentSelect(input: $input) {\n      __typename\n      payment {\n        ...PaymentFragment\n      }\n      cart {\n        ...CartFragment\n      }\n      billingAddress {\n        ...PaymentBillingAddressFragment\n      }\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n  ${PaymentFragment}\n  ${PaymentBillingAddressFragment}\n  ${CartFragment}\n`;\n\ntype PaymentBillingAddressUpdateMutation = Readonly<{\n  paymentBillingAddressUpdate: Readonly<{\n    __typename?: 'PaymentBillingAddressUpdatePayload';\n    billingAddress: PaymentBillingAddressEntity | null;\n    payment: PaymentEntity | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\nexport const PAYMENT_BILLING_ADDRESS_UPDATE: TypedDocumentNode<\n  PaymentBillingAddressUpdateMutation,\n  Readonly<{ input: PaymentBillingAddressUpdateInput }>\n> = gql`\n  mutation PaymentBillingAddressUpdate($input: PaymentBillingAddressUpdateInput!) {\n    paymentBillingAddressUpdate(input: $input) {\n      __typename\n      billingAddress {\n        ...PaymentBillingAddressFragment\n      }\n      payment {\n        ...PaymentFragment\n      }\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n  ${PaymentFragment}\n  ${PaymentBillingAddressFragment}\n`;\n\ntype PaymentStartTransactionMutation = Readonly<{\n  paymentStartTransaction: Readonly<{\n    __typename?: 'PaymentStartTransactionPayload';\n    transactionId: string | null;\n    merchantName: string | null;\n    gatewayUrl: string | null;\n    orderGroup: string | null;\n    userProfileId: string | null;\n    value: PaymentMoney | null;\n    valueInCents: number | null;\n    referenceValueInCents: number | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\n/**\n * Takes no input: every field VTEX's transaction endpoint needs is derived server-side from the\n * already-persisted selection (T3 Decision 9). The transaction cookies it mints ride on the HTTP\n * response, not on the payload.\n *\n * `merchantName`, `gatewayUrl`, `valueInCents`, and `referenceValueInCents` are T18's additions\n * (specs/payment-transaction-payload-gaps.md), selected here by T13: `PaymentGatewayTransaction`\n * requires all four, so the descriptor cannot be assembled without them. `value` stays selected\n * beside the minor-unit pair — it is the display decimal, and the `purchase` analytics event reports\n * it rather than a client-side division.\n */\nexport const PAYMENT_START_TRANSACTION: TypedDocumentNode<PaymentStartTransactionMutation, Record<string, never>> = gql`\n  mutation PaymentStartTransaction {\n    paymentStartTransaction {\n      __typename\n      transactionId\n      merchantName\n      gatewayUrl\n      orderGroup\n      userProfileId\n      value {\n        amount\n        currencyCode\n      }\n      valueInCents\n      referenceValueInCents\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n`;\n\ntype PaymentGatewayCallbackMutation = Readonly<{\n  paymentGatewayCallback: Readonly<{\n    __typename?: 'PaymentGatewayCallbackPayload';\n    orderId: string | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\nexport const PAYMENT_GATEWAY_CALLBACK: TypedDocumentNode<\n  PaymentGatewayCallbackMutation,\n  Readonly<{ input: PaymentGatewayCallbackInput }>\n> = gql`\n  mutation PaymentGatewayCallback($input: PaymentGatewayCallbackInput!) {\n    paymentGatewayCallback(input: $input) {\n      __typename\n      orderId\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n`;\n"],"mappings":";;;;;;;;AAkCA,MAAa,6BAA6B;;;;;;;;;AAwI1C,MAAa,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwFlC,MAAa,gCAAgC,GAAG;;;;;;;;;;;;;;;AA6BhD,MAAa,wBAGT,GAAG;;;;;;;;;;;;;;;;IAgBH,gBAAgB;IAChB,8BAA8B;;;;;;;AAkBlC,MAAa,6BAGT,GAAG;;;;;;;;;;;;;;;;;;;IAmBH,gBAAgB;IAChB,8BAA8B;IAC9B,aAAa;;AAYjB,MAAa,iCAGT,GAAG;;;;;;;;;;;;;;;;IAgBH,gBAAgB;IAChB,8BAA8B;;;;;;;;;;;;;AA6BlC,MAAa,4BAAuG,GAAG;;;;;;;;;;;;;;;;;;;;;;AA+BvH,MAAa,2BAGT,GAAG"}
+{"version":3,"file":"operations.js","names":[],"sources":["../../../src/sdk/payment/operations.ts"],"sourcesContent":["import type { TypedDocumentNode } from '@apollo/client';\nimport { type CartEntity, CartFragment } from '../cart/operations.js';\nimport type { PaymentType } from '../generated/graphql.js';\nimport { gql } from '../graphql-tag.js';\n\n/**\n * Payment write-model GraphQL operations (specs/payment-action-namespace.md, T4) — the five mutations\n * `api-module:PaymentWriteModel` shipped (T3, `checkout/schema.graphql` § 11). Nothing here is\n * invented: every mutation, input field, and payload field is pinned to that schema.\n *\n * Authored with the hand `gql` tag — the codegen `graphql()` factory is reserved for the reactive read\n * path — and excluded from the codegen `documents` glob (see `codegen.ts`): the `gql` tag alone is\n * still plucked by `graphql-codegen`, which would duplicate these hand-written types in\n * `sdk/generated/`. Mirrors `shipping/option-select-operations.ts` and `identity/operations.ts`.\n *\n * No field at any nesting depth carries a card number or CVV — the read model guarantees it (RFC D13),\n * and the one call that does carry them never touches GraphQL at all (see `gateway.ts`).\n *\n * Failures follow ADR-00007's two-path contract: domain outcomes arrive as payload `userErrors`;\n * transport and top-level GraphQL failures are infrastructure, collapsed by the handlers in\n * `use-payment-actions.ts` to the one client-synthesized code, `PAYMENT_NETWORK_ERROR_CODE`.\n */\n\n// ---------------------------------------------------------------------------\n// Domain types — mirror the shipped checkout schema\n// ---------------------------------------------------------------------------\n\n/** A payment domain error. Every mutation's error type is `{ code, message }`; codes stay strings. */\nexport type PaymentUserError = Readonly<{ code: string; message: string }>;\n\n/**\n * The one client-synthesized error code, carried by the userError every mutation-backed method\n * *resolves* (never throws) when its mutation fails at the transport or top-level-GraphQL layer.\n * `gateway.ts` owns the separate code for a failed gateway leg (Decision 7).\n */\nexport const PAYMENT_NETWORK_ERROR_CODE = 'NETWORK_ERROR';\n\nexport type PaymentMoney = Readonly<{ __typename?: 'Money'; amount: number; currencyCode: string }>;\n\ntype PaymentInstallmentEntity = Readonly<{\n  __typename?: 'PaymentInstallment';\n  count: number;\n  value: PaymentMoney;\n  /** The whole-plan amount, interest included. */\n  totalAmount: PaymentMoney;\n  /** Hundredths of a percent. `null` when the order form did not say what the rate is. */\n  interestRate: number | null;\n  /** `null` exactly when `interestRate` is `null`. */\n  interestFree: boolean | null;\n}>;\n\ntype PaymentMethodValidatorEntity = Readonly<{\n  __typename?: 'PaymentMethodValidator';\n  numberMask: string | null;\n  numberRegex: string | null;\n  cvvMask: string | null;\n  cvvRegex: string | null;\n  cvvRequired: boolean;\n  expirationRequired: boolean;\n  holderNameRequired: boolean;\n  billingAddressRequired: boolean;\n  documentDisplayable: boolean;\n  documentRequired: boolean;\n}>;\n\ntype PaymentCountryDocumentEntity = Readonly<{\n  __typename?: 'PaymentCountryDocument';\n  type: string;\n  displayable: boolean;\n  required: boolean;\n}>;\n\ntype PaymentCountryEntity = Readonly<{\n  __typename?: 'PaymentCountry';\n  countryCode: string;\n  documents: readonly PaymentCountryDocumentEntity[];\n}>;\n\ntype PaymentMethodEntity = Readonly<{\n  __typename?: 'PaymentMethod';\n  id: string;\n  name: string;\n  /** The vendor-neutral kind. Classify a method with this; `groupName` is the gateway transport value. */\n  type: PaymentType;\n  groupName: string;\n  validator: PaymentMethodValidatorEntity;\n}>;\n\ntype PaymentInstallmentOptionEntity = Readonly<{\n  __typename?: 'PaymentInstallmentOption';\n  methodId: string;\n  bin: string | null;\n  baseValue: PaymentMoney;\n  installments: readonly PaymentInstallmentEntity[];\n}>;\n\ntype SavedCardEntity = Readonly<{\n  __typename?: 'SavedCard';\n  id: string;\n  accountId: string;\n  methodId: string;\n  network: string;\n  lastFourDigits: string;\n  bin: string;\n  label: string | null;\n  expired: boolean;\n  cvvRequired: boolean;\n}>;\n\n/** The full `Payment` entity every selection mutation echoes back. Never carries a PAN or CVV. */\nexport type PaymentEntity = Readonly<{\n  __typename?: 'Payment';\n  id: string;\n  methods: readonly PaymentMethodEntity[];\n  selectedMethodId: string | null;\n  selectedAccountId: string | null;\n  selectedBin: string | null;\n  storeCountryCode: string | null;\n  countries: readonly PaymentCountryEntity[];\n  selectedInstallment: PaymentInstallmentEntity | null;\n  installmentOptions: readonly PaymentInstallmentOptionEntity[];\n  savedCards: readonly SavedCardEntity[];\n}>;\n\n/** The billing-address echo on the selection payloads — the schema's shared `Address` type. */\nexport type PaymentBillingAddressEntity = Readonly<{\n  __typename?: 'Address';\n  id: string | null;\n  recipientName: string | null;\n  postalCode: string | null;\n  country: string;\n  street: string | null;\n  number: string | null;\n  complement: string | null;\n  neighborhood: string | null;\n  city: string | null;\n  state: string | null;\n}>;\n\n// ---------------------------------------------------------------------------\n// Mutation inputs — mirror the schema's input types verbatim\n// ---------------------------------------------------------------------------\n\n/** A `bin` with an `accountId` is validated against the saved card's own BIN (MISMATCHED_BIN_FOR_SAVED_CARD). */\nexport type PaymentMethodSelectInput = Readonly<{ methodId: string; bin?: string; accountId?: string }>;\n\nexport type PaymentInstallmentSelectInput = Readonly<{ count: number }>;\n\n/** With `sameAsDelivery: true` every other field is ignored and the server performs no upstream write. */\nexport type PaymentBillingAddressUpdateInput = Readonly<{\n  sameAsDelivery: boolean;\n  addressType?: string;\n  postalCode?: string;\n  country?: string;\n  street?: string;\n  number?: string;\n  complement?: string;\n  neighborhood?: string;\n  city?: string;\n  state?: string;\n  reference?: string;\n}>;\n\nexport type PaymentGatewayCallbackInput = Readonly<{ orderGroup: string; acceptChallenges?: boolean }>;\n\n// ---------------------------------------------------------------------------\n// Shared fragment\n// ---------------------------------------------------------------------------\n\n/**\n * The canonical `Payment` selection set, spread by every selection mutation so one response\n * re-normalizes the whole entity and every reactive subscriber re-renders with no refetch — the\n * payload-completeness invariant writes must honor (ADR-0010). Selecting the entire entity mirrors\n * `CartFragment` and `SHIPPING_ADDRESS_UPDATE`'s full-`Shipping` selection: the method list (T5), the\n * validator config (T7), `installmentOptions` (T9), and the summary's selection fields (T6) are all\n * subscribed independently, and a partial selection would leave one of them incomplete.\n */\nexport const PaymentFragment = gql`\n  fragment PaymentFragment on Payment {\n    __typename\n    id\n    selectedMethodId\n    selectedAccountId\n    selectedBin\n    storeCountryCode\n    countries {\n      __typename\n      countryCode\n      documents {\n        __typename\n        type\n        displayable\n        required\n      }\n    }\n    selectedInstallment {\n      __typename\n      count\n      value {\n        amount\n        currencyCode\n      }\n      totalAmount {\n        amount\n        currencyCode\n      }\n      interestRate\n      interestFree\n    }\n    installmentOptions {\n      __typename\n      methodId\n      bin\n      baseValue {\n        amount\n        currencyCode\n      }\n      installments {\n        __typename\n        count\n        value {\n          amount\n          currencyCode\n        }\n        totalAmount {\n          amount\n          currencyCode\n        }\n        interestRate\n        interestFree\n      }\n    }\n    methods {\n      __typename\n      id\n      name\n      type\n      groupName\n      validator {\n        __typename\n        numberMask\n        numberRegex\n        cvvMask\n        cvvRegex\n        cvvRequired\n        expirationRequired\n        holderNameRequired\n        billingAddressRequired\n        documentDisplayable\n        documentRequired\n      }\n    }\n    savedCards {\n      __typename\n      id\n      accountId\n      methodId\n      network\n      lastFourDigits\n      bin\n      label\n      expired\n      cvvRequired\n    }\n  }\n`;\n\n/** The billing-address echo, spread by the three selection mutations that return one. */\nexport const PaymentBillingAddressFragment = gql`\n  fragment PaymentBillingAddressFragment on Address {\n    __typename\n    id\n    recipientName\n    postalCode\n    country\n    street\n    number\n    complement\n    neighborhood\n    city\n    state\n  }\n`;\n\n// ---------------------------------------------------------------------------\n// Mutation operations\n// ---------------------------------------------------------------------------\n\ntype PaymentMethodSelectMutation = Readonly<{\n  paymentMethodSelect: Readonly<{\n    __typename?: 'PaymentMethodSelectPayload';\n    payment: PaymentEntity | null;\n    billingAddress: PaymentBillingAddressEntity | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\nexport const PAYMENT_METHOD_SELECT: TypedDocumentNode<\n  PaymentMethodSelectMutation,\n  Readonly<{ input: PaymentMethodSelectInput }>\n> = gql`\n  mutation PaymentMethodSelect($input: PaymentMethodSelectInput!) {\n    paymentMethodSelect(input: $input) {\n      __typename\n      payment {\n        ...PaymentFragment\n      }\n      billingAddress {\n        ...PaymentBillingAddressFragment\n      }\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n  ${PaymentFragment}\n  ${PaymentBillingAddressFragment}\n`;\n\ntype PaymentInstallmentSelectMutation = Readonly<{\n  paymentInstallmentSelect: Readonly<{\n    __typename?: 'PaymentInstallmentSelectPayload';\n    payment: PaymentEntity | null;\n    cart: CartEntity | null;\n    billingAddress: PaymentBillingAddressEntity | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\n/**\n * Selects `cart { ...CartFragment }` alongside `payment` so the cart total the server returns lands in\n * the normalized cache in the same round trip (REQ-03) — the same reason `shippingOptionSelect`\n * selects the cart. That total is the server's: the greater of the order form's value and the selected\n * payment's value (`mapOrderFormToGqlCart`), so it carries the picked tier's interest. Dropping `total`\n * from the selection leaves the total on screen at its previous value.\n */\nexport const PAYMENT_INSTALLMENT_SELECT: TypedDocumentNode<\n  PaymentInstallmentSelectMutation,\n  Readonly<{ input: PaymentInstallmentSelectInput }>\n> = gql`\n  mutation PaymentInstallmentSelect($input: PaymentInstallmentSelectInput!) {\n    paymentInstallmentSelect(input: $input) {\n      __typename\n      payment {\n        ...PaymentFragment\n      }\n      cart {\n        ...CartFragment\n      }\n      billingAddress {\n        ...PaymentBillingAddressFragment\n      }\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n  ${PaymentFragment}\n  ${PaymentBillingAddressFragment}\n  ${CartFragment}\n`;\n\ntype PaymentBillingAddressUpdateMutation = Readonly<{\n  paymentBillingAddressUpdate: Readonly<{\n    __typename?: 'PaymentBillingAddressUpdatePayload';\n    billingAddress: PaymentBillingAddressEntity | null;\n    payment: PaymentEntity | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\nexport const PAYMENT_BILLING_ADDRESS_UPDATE: TypedDocumentNode<\n  PaymentBillingAddressUpdateMutation,\n  Readonly<{ input: PaymentBillingAddressUpdateInput }>\n> = gql`\n  mutation PaymentBillingAddressUpdate($input: PaymentBillingAddressUpdateInput!) {\n    paymentBillingAddressUpdate(input: $input) {\n      __typename\n      billingAddress {\n        ...PaymentBillingAddressFragment\n      }\n      payment {\n        ...PaymentFragment\n      }\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n  ${PaymentFragment}\n  ${PaymentBillingAddressFragment}\n`;\n\ntype PaymentStartTransactionMutation = Readonly<{\n  paymentStartTransaction: Readonly<{\n    __typename?: 'PaymentStartTransactionPayload';\n    transactionId: string | null;\n    merchantName: string | null;\n    gatewayUrl: string | null;\n    orderGroup: string | null;\n    orderNodeId: string | null;\n    userProfileId: string | null;\n    value: PaymentMoney | null;\n    valueInCents: number | null;\n    referenceValueInCents: number | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\n/**\n * Takes no input: every field VTEX's transaction endpoint needs is derived server-side from the\n * already-persisted selection (T3 Decision 9). The transaction cookies it mints ride on the HTTP\n * response, not on the payload.\n *\n * `merchantName`, `gatewayUrl`, `valueInCents`, and `referenceValueInCents` are T18's additions\n * (specs/payment-transaction-payload-gaps.md), selected here by T13: `PaymentGatewayTransaction`\n * requires all four, so the descriptor cannot be assembled without them. `value` stays selected\n * beside the minor-unit pair — it is the display decimal, and the `purchase` analytics event reports\n * it rather than a client-side division.\n */\nexport const PAYMENT_START_TRANSACTION: TypedDocumentNode<PaymentStartTransactionMutation, Record<string, never>> = gql`\n  mutation PaymentStartTransaction {\n    paymentStartTransaction {\n      __typename\n      transactionId\n      merchantName\n      gatewayUrl\n      orderGroup\n      orderNodeId\n      userProfileId\n      value {\n        amount\n        currencyCode\n      }\n      valueInCents\n      referenceValueInCents\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n`;\n\ntype PaymentGatewayCallbackMutation = Readonly<{\n  paymentGatewayCallback: Readonly<{\n    __typename?: 'PaymentGatewayCallbackPayload';\n    orderId: string | null;\n    orderNodeId: string | null;\n    redirectUrl: string | null;\n    userErrors: readonly PaymentUserError[];\n  }>;\n}>;\n\nexport const PAYMENT_GATEWAY_CALLBACK: TypedDocumentNode<\n  PaymentGatewayCallbackMutation,\n  Readonly<{ input: PaymentGatewayCallbackInput }>\n> = gql`\n  mutation PaymentGatewayCallback($input: PaymentGatewayCallbackInput!) {\n    paymentGatewayCallback(input: $input) {\n      __typename\n      orderId\n      orderNodeId\n      redirectUrl\n      userErrors {\n        code\n        message\n      }\n    }\n  }\n`;\n\n// ---------------------------------------------------------------------------\n// The settled-order read the resume paths report a purchase from (T208)\n// ---------------------------------------------------------------------------\n\ntype SettledOrderQuery = Readonly<{\n  order: Readonly<{\n    __typename?: 'Order';\n    id: string;\n    reference: string;\n    status: 'APPROVED' | 'PENDING' | 'DENIED' | 'UNKNOWN';\n    total: Readonly<{ __typename?: 'Money'; amount: string; currencyCode: string }> | null;\n  }> | null;\n}>;\n\n/** Only what `emitPurchaseForOrder` needs: the order's reference, its status, and what it costs. */\nexport const SETTLED_ORDER_FACTS: TypedDocumentNode<SettledOrderQuery, Readonly<{ id: string }>> = gql`\n  query SettledOrderFacts($id: ID!) {\n    order(id: $id) {\n      id\n      reference\n      status\n      total {\n        amount\n        currencyCode\n      }\n    }\n  }\n`;\n"],"mappings":";;;;;;;;AAmCA,MAAa,6BAA6B;;;;;;;;;AA8I1C,MAAa,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FlC,MAAa,gCAAgC,GAAG;;;;;;;;;;;;;;;AA6BhD,MAAa,wBAGT,GAAG;;;;;;;;;;;;;;;;IAgBH,gBAAgB;IAChB,8BAA8B;;;;;;;;;AAoBlC,MAAa,6BAGT,GAAG;;;;;;;;;;;;;;;;;;;IAmBH,gBAAgB;IAChB,8BAA8B;IAC9B,aAAa;;AAYjB,MAAa,iCAGT,GAAG;;;;;;;;;;;;;;;;IAgBH,gBAAgB;IAChB,8BAA8B;;;;;;;;;;;;;AA8BlC,MAAa,4BAAuG,GAAG;;;;;;;;;;;;;;;;;;;;;;;AAkCvH,MAAa,2BAGT,GAAG;;;;;;;;;;;;;;;AA8BP,MAAa,sBAAsF,GAAG"}

package/dist/sdk/payment/resumed-purchase.d.ts

@@ -0,0 +1 @@
+import "../analytics/use-analytics-actions.js";