awesome-node-checkout 1.0.2 → 1.2.0

package/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.2.0] - 2026-09-27
+
+### Security
+- **Nexi**: Fail-closed outcome MAC verification on redirect and webhook. Missing or invalid `mac` parameter rejects payment with status `FAILED` and error `'MAC missing'`. Verifies 7-field formula (`codTrans`, `esito`, `importo`, `divisa`, `data`, `orario`, `codAut`, `macKey`) using constant-time comparison `crypto.timingSafeEqual`. Resolves #6.
+- **Express Adapter**: `publicPaths` now uses segment-based path matching rather than substring matching, preventing subpath bypasses such as `/webhook/execute` or `/redirect/execute` when `/webhook` or `/redirect` is marked public. Resolves #13.
+
+### Fixed
+- **Nexi**: Updated `getPaymentDetails` to query the official BackOffice endpoint `POST /ecomm/api/bo/situazioneOrdine` with JSON payload and response MAC verification instead of the non-existent IGFS endpoint. Resolves #7.
+- **Satispay**: Fixed webhook handling for GET callbacks containing `payment_id` query parameter, ensuring callbacks routed to `handleWebhook` correctly extract payment details and verify signatures. Added configurable `callbackPath` (defaulting to `/checkout/satispay/webhook`). Resolves #10.
+- **Satispay**: Fixed HTTP signature verification to support `(request-target)` pseudo-header via request context, signature header without `(request-target)`, flexible header key order, and body digest verification. Resolves #11.
+
+### Added
+- **Nexi**: Added server-to-server outcome notification support (`urlpost`) configured via `PaymentRequest.notifyUrl` in `createPayment`, and handled via `NexiProvider.handleWebhook`. Resolves #8.
+- **Core**: Exposed `amount` and `currency` in `PaymentResult` and `WebhookResult` across all providers (Nexi, PayPal, Satispay) to enable post-payment amount verification. Resolves #9.
+- **Core**: Propagated `orderId` and `raw` provider response data through `CheckoutConfigurator` event bus payloads (`payment.created`, `payment.completed`, `payment.failed`, `payment.refunded`, `webhook.received`). Resolves #12.
+- **Express Adapter**: Added `options.redirect` for automatic 302 HTTP redirects to `onSuccess(result, req)` or `onFailure(result, req)` on browser return. Resolves #12.
+- **Express Adapter**: Added `options.details` configuration to gate or disable `GET /:provider/:id` (`enabled: false` returns 404, or custom `middleware`). Resolves #12.
+- **Express Adapter**: Added context argument `{ provider, res }` to `buildPaymentRequest(req, ctx)` and strict validation of returned `PaymentRequest`. Resolves #12.
+- **Express Adapter**: Mounted both `GET` and `POST` routes for `/:provider/webhook`. Resolves #10.
+- **Packaging**: Added `"types"` condition to `exports` in `package.json` for TypeScript package resolution under `node16`/`nodenext`. Resolves #12.
+
+### Changed
+- **Nexi**: Breaking change in outcome verification: previously `handleRedirect` accepted outcomes without a `mac` field. It is now strictly required (fail-closed). Any integration testing Nexi callbacks must supply a valid `mac`.
+
+## [1.1.0] - 2026-09-27
+
+### Added
+- **Security**: Added `buildPaymentRequest` hook in `createCheckoutRouter` options to build payment requests securely server-side (preventing clients from tampering with amounts and order parameters). Resolves #3.
+- **Security**: Added mount-time warning when `createCheckoutRouter` is used without `buildPaymentRequest`.
+- **Validation**: Added input validation on `POST /:provider` when `buildPaymentRequest` is not configured (requires finite positive number `amount` and non-empty `currency`).
+- **Gating**: Gated `POST /:provider/refund` behind `options.refund` (returns 404 unless explicitly configured with optional middleware).
+- **Hooks**: Added `onBeforeExecute` and dedicated `middleware` support in `options.execute` for `POST /:provider/execute`.
+- **Examples**: Added reference Express implementation under `examples/express` demonstrating SQLite store, Handlebars UI, and full checkout flow.
+
+## [1.0.2] - 2026-04-23
+
+### Changed
+- Removed compiled `dist/` artifacts from git tracking.
+- Added GitHub Actions publish workflow.
+- Updated dependencies.
+
+## [1.0.1] - 2026-04-13
+
+### Fixed
+- Satispay provider warning at construction time when `webhookPublicKey` is not configured.
+- PayPal refund implementation and security improvements.
+
+## [1.0.0] - 2026-03-30
+
+### Added
+- Initial release of `awesome-node-checkout`.
+- Framework-agnostic `CheckoutConfigurator`.
+- PayPal, Nexi, and Satispay providers.
+- Express adapter with `createCheckoutRouter`.

package/README.md

@@ -67,13 +67,58 @@ import { createCheckoutRouter } from 'awesome-node-checkout/express';
 
 const app = express();
 app.use(express.json());
-
-// Mounts all checkout routes under /checkout
-app.use('/checkout', createCheckoutRouter(checkout));
+// If using Nexi server notifications (urlpost), urlencoded parser is required:
+app.use(express.urlencoded({ extended: false }));
+
+// Mount checkout routes with secure server-side request builder and browser redirects
+app.use(
+  '/checkout',
+  createCheckoutRouter(checkout, {
+    // Recommended: verify order and compute amount on the server
+    buildPaymentRequest: async (req, { provider }) => {
+      const order = await myOrderService.getOrder(req.body.orderId);
+      return {
+        amount: order.totalAmount,
+        currency: order.currency, // e.g. 'EUR'
+        orderId: order.id,
+        returnUrl: 'https://myapp.com/checkout/' + provider + '/redirect',
+        cancelUrl: 'https://myapp.com/payment/cancel',
+        notifyUrl: 'https://myapp.com/checkout/' + provider + '/webhook',
+        description: `Order #${order.id}`,
+      };
+    },
+    // Optional: automatic 302 redirects for browser-based flows
+    redirect: {
+      onSuccess: (result, req) => `/orders/${result.orderId}?status=success`,
+      onFailure: (result, req) => `/orders/${result.orderId}?status=failed&error=${encodeURIComponent(result.error || '')}`,
+    },
+    // Optional: gate or disable public access to GET /:provider/:id
+    details: {
+      enabled: false, // or provide middleware: [requireAuth]
+    },
+    // Opt-in: mount POST /:provider/refund protected by admin middleware
+    refund: {
+      middleware: [requireAdminAuth],
+    },
+    // Optional: guard execution before capturing payment
+    execute: {
+      onBeforeExecute: async (req, paymentId) => {
+        // Verify payment belongs to current session or user
+      },
+    },
+    // Public paths matching segments safely without substring bypasses
+    publicPaths: [
+      [':provider', 'webhook'],
+      [':provider', 'redirect'],
+    ],
+  }),
+);
 
 app.listen(3000);
 ```
 
+> **Security Note**: Never trust client-sent amounts directly. Always define `buildPaymentRequest` so the payment amount and order parameters are derived server-side. If `buildPaymentRequest` is omitted, the router will issue a warning at mount time and validate that client bodies contain positive finite amounts and valid currencies.
+
 ### With Fastify (or any other framework)
 
 Use the `CheckoutConfigurator` methods directly in your own routes:
@@ -85,23 +130,56 @@ fastify.post('/checkout/:provider', async (req, reply) => {
 });
 
 fastify.post('/checkout/:provider/webhook', async (req, reply) => {
-  const result = await checkout.handleWebhook(req.params.provider, req.body, req.headers);
+  const result = await checkout.handleWebhook(req.params.provider, req.body, req.headers, req.query, {
+    method: req.method,
+    path: req.url,
+  });
   reply.send(result);
 });
 ```
 
 ---
 
+## Example Application
+
+A full-featured reference implementation using Express 5, SQLite (`ITransactionStore`), and Handlebars is available in [examples/express](./examples/express).
+
+---
+
 ## Routes (Express adapter)
 
-| Method | Path                        | Description                      |
-|--------|-----------------------------|----------------------------------|
-| POST   | `/:provider`                | Create a payment                 |
-| POST   | `/:provider/execute`        | Execute/capture a payment        |
-| GET    | `/:provider/redirect`       | Handle provider redirect callback|
-| GET    | `/:provider/:id`            | Get payment details              |
-| POST   | `/:provider/refund`         | Refund a payment                 |
-| POST   | `/:provider/webhook`        | Handle provider webhook          |
+| Method      | Path                        | Description                                                    |
+|-------------|-----------------------------|----------------------------------------------------------------|
+| POST        | `/:provider`                | Create a payment (server-built or validated)                  |
+| POST        | `/:provider/execute`        | Execute/capture a payment (supports `onBeforeExecute`)         |
+| GET         | `/:provider/redirect`       | Handle provider redirect callback (supports 302 via `redirect`)|
+| GET         | `/:provider/:id`            | Get payment details (*configurable*: can disable or protect via `details`)|
+| POST        | `/:provider/refund`         | Refund a payment (*opt-in*: mounted only when `refund` option is set)|
+| GET / POST  | `/:provider/webhook`        | Handle provider webhook (POST for Nexi/Satispay, GET for Satispay)|
+
+---
+
+## Security: A Redirect Is Not Proof of Payment
+
+Relying solely on front-end browser redirects (`GET /:provider/redirect`) to fulfill orders introduces significant risk:
+- **Drop-off**: Shoppers may close the tab, lose connectivity, or navigate away before reaching your redirect URL.
+- **Tampering**: Unless protected by cryptographic signatures (such as Nexi's mandatory outcome MAC), client-controlled URL parameters can be manipulated.
+- **Amount Mismatch**: Always verify that the captured payment amount matches your order ledger before fulfilling goods or services.
+
+To ensure safe fulfillment:
+1. **Verify Amount & Currency**: `PaymentResult` and `WebhookResult` return `amount` and `currency` extracted directly from the provider.
+   ```typescript
+   const result = await checkout.handleRedirect(provider, req.query);
+   if (result.success && result.status === 'COMPLETED') {
+     if (result.amount !== order.totalAmount || result.currency !== order.currency) {
+       throw new Error('Authorized amount does not match order total');
+     }
+   }
+   ```
+2. **Use Server Notifications / Webhooks**:
+   - For **Nexi**: Pass `notifyUrl` in `PaymentRequest` (e.g. `https://myapp.com/checkout/nexi/webhook`). Nexi sends a server-to-server POST notification (`urlpost`) with the 7-field outcome MAC. Ensure your app includes `app.use(express.urlencoded({ extended: false }))`.
+   - For **Satispay**: Use `callbackPath` or webhook callbacks; signatures are verified against Satispay's RSA public key with `(request-target)` HTTP signature support.
+3. **Idempotency**: Because both the redirect callback and the webhook notification may arrive for the same order, ensure your fulfillment handler is idempotent.
 
 ---
 
@@ -110,7 +188,7 @@ fastify.post('/checkout/:provider/webhook', async (req, reply) => {
 | Flow       | Providers        | Description                                              |
 |------------|------------------|----------------------------------------------------------|
 | `redirect` | PayPal, Nexi     | User is redirected to provider, returns with query params|
-| `webhook`  | Satispay         | Provider calls a webhook URL after async confirmation    |
+| `webhook`  | Satispay, Nexi   | Provider calls a webhook URL for async confirmation      |
 | `direct`   | *(future)*       | Synchronous processing (card tokenization, etc.)         |
 
 ---
@@ -119,11 +197,11 @@ fastify.post('/checkout/:provider/webhook', async (req, reply) => {
 
 ```typescript
 checkout.events
-  .on('payment.created',   ({ provider, paymentId }) => { /* ... */ })
-  .on('payment.completed', ({ provider, paymentId }) => { /* ... */ })
-  .on('payment.failed',    ({ provider, error })     => { /* ... */ })
-  .on('payment.refunded',  ({ provider, paymentId }) => { /* ... */ })
-  .on('webhook.received',  ({ provider, data })      => { /* ... */ });
+  .on('payment.created',   ({ provider, paymentId, orderId, raw }) => { /* ... */ })
+  .on('payment.completed', ({ provider, paymentId, orderId, raw }) => { /* ... */ })
+  .on('payment.failed',    ({ provider, error, orderId, raw })     => { /* ... */ })
+  .on('payment.refunded',  ({ provider, paymentId, orderId, raw }) => { /* ... */ })
+  .on('webhook.received',  ({ provider, data, orderId, raw })      => { /* ... */ });
 ```
 
 ---
@@ -179,11 +257,11 @@ checkout.registerProvider(new StripeProvider({ secretKey: '...' }));
 
 ## Built-in Providers
 
-| Provider  | Flow      | Notes                                      |
-|-----------|-----------|--------------------------------------------|
-| PayPal    | redirect  | Orders API v2                              |
-| Nexi      | redirect  | eCommerce DispatcherServlet + MAC SHA-1    |
-| Satispay  | webhook   | Business API v1, RSA-SHA256 signature      |
+| Provider  | Flow                | Notes                                                                                       |
+|-----------|---------------------|---------------------------------------------------------------------------------------------|
+| PayPal    | redirect            | Orders API v2 (`return=representation`, captures expose `amount` and `currency`)            |
+| Nexi      | redirect + webhook  | eCommerce DispatcherServlet + MAC SHA-1 (mandatory 7-field outcome MAC, `urlpost`, BackOffice `situazioneOrdine` API) |
+| Satispay  | webhook             | Business API v1, RSA-SHA256 HTTP signature, GET and POST callbacks, configurable `callbackPath` |
 
 ---
 

package/dist/adapters/express/index.d.ts

@@ -1,17 +1,62 @@
-import { Router, RequestHandler } from 'express';
+import { Router, Request, Response, RequestHandler } from 'express';
 import { CheckoutConfigurator } from '../../checkout-configurator';
+import { PaymentRequest } from '../../models/payment-request.model';
+import { PaymentResult } from '../../models/payment-result.model';
+export interface PaymentRequestContext {
+    provider: string;
+    res: Response;
+}
 export interface ExpressCheckoutOptions {
     /**
      * Middleware applied to ALL checkout routes (e.g. API key auth).
-     * Webhooks are typically public — use `publicPaths` to exclude them.
+     * Webhooks and redirects are typically public — use `publicPaths` to exclude them.
      */
     middleware?: RequestHandler[];
     /**
-     * Route suffixes that bypass `middleware` (e.g. [':provider/webhook']).
-     * Matched against the path suffix after the mount point.
+     * Route patterns that bypass `middleware` (e.g. [':provider/webhook', ':provider/redirect']).
+     * Matched by path segments after the mount point (:provider matches any single segment).
      */
     publicPaths?: string[];
+    /**
+     * Builds the PaymentRequest on the server (amount from your own order), ignoring the client body.
+     */
+    buildPaymentRequest?: (req: Request, ctx: PaymentRequestContext) => PaymentRequest | Promise<PaymentRequest>;
+    /**
+     * When configured, GET /:provider/redirect responds with a 302 redirect
+     * to the URL returned by onSuccess or onFailure instead of JSON.
+     */
+    redirect?: {
+        onSuccess: (result: PaymentResult, req: Request) => string;
+        onFailure: (result: PaymentResult, req: Request) => string;
+    };
+    /**
+     * Configuration for GET /:provider/:id (getPaymentDetails).
+     * Default: enabled: true. Set enabled: false to return 404.
+     */
+    details?: {
+        enabled?: boolean;
+        middleware?: RequestHandler[];
+    };
+    /**
+     * Configuration for POST /:provider/refund.
+     * If omitted, the refund route is NOT mounted (returns 404).
+     */
+    refund?: {
+        middleware?: RequestHandler[];
+    };
+    /**
+     * Configuration for POST /:provider/execute.
+     */
+    execute?: {
+        middleware?: RequestHandler[];
+        onBeforeExecute?: (req: Request, paymentId: string) => void | Promise<void>;
+    };
 }
+/**
+ * Matches a request path against public path patterns by segments.
+ * ':provider' matches any single non-empty segment.
+ */
+export declare function isPathPublic(reqPath: string, publicPaths: string[]): boolean;
 /**
  * Creates an Express Router with all checkout endpoints pre-wired.
  *
@@ -19,16 +64,28 @@ export interface ExpressCheckoutOptions {
  * ```
  * POST   /:provider              → createPayment
  * POST   /:provider/execute      → executePayment
+ * POST   /:provider/refund       → refundPayment (only if options.refund is configured)
+ * GET    /:provider/webhook      → handleWebhook
+ * POST   /:provider/webhook      → handleWebhook
  * GET    /:provider/redirect     → handleRedirect  (must come before /:provider/:id)
  * GET    /:provider/:id          → getPaymentDetails
- * POST   /:provider/refund       → refundPayment
- * POST   /:provider/webhook      → handleWebhook
  * ```
  *
  * Usage:
  * ```typescript
  * import { createCheckoutRouter } from 'awesome-node-checkout/express';
- * app.use('/checkout', createCheckoutRouter(checkout));
+ * app.use('/checkout', createCheckoutRouter(checkout, {
+ *   buildPaymentRequest: async (req, ctx) => {
+ *     const order = await getOrder(req.body.orderId);
+ *     return {
+ *       amount: order.total,
+ *       currency: 'EUR',
+ *       orderId: order.id,
+ *       returnUrl: 'https://example.com/success',
+ *       cancelUrl: 'https://example.com/cancel',
+ *     };
+ *   },
+ * }));
  * ```
  */
 export declare function createCheckoutRouter(checkout: CheckoutConfigurator, options?: ExpressCheckoutOptions): Router;

package/dist/adapters/express/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,cAAc,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAE9B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,GAAE,sBAA2B,GACnC,MAAM,CA8FR"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAE9B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,mBAAmB,CAAC,EAAE,CACpB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,qBAAqB,KACvB,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;QAC3D,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;KAC5D,CAAC;IAEF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;KAC/B,CAAC;IAEF;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;KAC/B,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;QAC9B,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7E,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAc5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,GAAE,sBAA2B,GACnC,MAAM,CA6KR"}

package/dist/adapters/express/index.js

@@ -1,8 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPathPublic = isPathPublic;
 exports.createCheckoutRouter = createCheckoutRouter;
 const express_1 = require("express");
 const errors_1 = require("../../models/errors");
+/**
+ * Matches a request path against public path patterns by segments.
+ * ':provider' matches any single non-empty segment.
+ */
+function isPathPublic(reqPath, publicPaths) {
+    const reqSegments = reqPath.split('/').filter(Boolean);
+    return publicPaths.some((pattern) => {
+        const patternSegments = pattern.split('/').filter(Boolean);
+        if (reqSegments.length !== patternSegments.length) {
+            return false;
+        }
+        return patternSegments.every((patSeg, i) => {
+            if (patSeg === ':provider') {
+                return reqSegments[i].length > 0;
+            }
+            return patSeg === reqSegments[i];
+        });
+    });
+}
 /**
  * Creates an Express Router with all checkout endpoints pre-wired.
  *
@@ -10,27 +30,40 @@ const errors_1 = require("../../models/errors");
  * ```
  * POST   /:provider              → createPayment
  * POST   /:provider/execute      → executePayment
+ * POST   /:provider/refund       → refundPayment (only if options.refund is configured)
+ * GET    /:provider/webhook      → handleWebhook
+ * POST   /:provider/webhook      → handleWebhook
  * GET    /:provider/redirect     → handleRedirect  (must come before /:provider/:id)
  * GET    /:provider/:id          → getPaymentDetails
- * POST   /:provider/refund       → refundPayment
- * POST   /:provider/webhook      → handleWebhook
  * ```
  *
  * Usage:
  * ```typescript
  * import { createCheckoutRouter } from 'awesome-node-checkout/express';
- * app.use('/checkout', createCheckoutRouter(checkout));
+ * app.use('/checkout', createCheckoutRouter(checkout, {
+ *   buildPaymentRequest: async (req, ctx) => {
+ *     const order = await getOrder(req.body.orderId);
+ *     return {
+ *       amount: order.total,
+ *       currency: 'EUR',
+ *       orderId: order.id,
+ *       returnUrl: 'https://example.com/success',
+ *       cancelUrl: 'https://example.com/cancel',
+ *     };
+ *   },
+ * }));
  * ```
  */
 function createCheckoutRouter(checkout, options = {}) {
     const router = (0, express_1.Router)();
-    // Apply shared middleware (skipping public paths)
+    if (!options.buildPaymentRequest) {
+        console.warn('[awesome-node-checkout] createCheckoutRouter: the client body decides the amount; set buildPaymentRequest');
+    }
+    // Apply shared middleware (skipping public paths by segment match)
     if (options.middleware?.length) {
         const publicPaths = options.publicPaths ?? [];
         router.use((req, res, next) => {
-            const providerParam = String(req.params?.provider ?? '');
-            const isPublic = publicPaths.some((p) => req.path.endsWith(p) || req.path.includes(p.replace(':provider', providerParam)));
-            if (isPublic)
+            if (isPathPublic(req.path, publicPaths))
                 return next();
             // Chain all middleware in sequence
             const handlers = options.middleware;
@@ -45,7 +78,48 @@ function createCheckoutRouter(checkout, options = {}) {
     // ---- POST /:provider — create payment ------------------------------------
     router.post('/:provider', async (req, res) => {
         try {
-            const result = await checkout.createPayment(String(req.params.provider), req.body);
+            const provider = String(req.params.provider);
+            let paymentRequest;
+            if (options.buildPaymentRequest) {
+                paymentRequest = await options.buildPaymentRequest(req, {
+                    provider,
+                    res,
+                });
+                if (!paymentRequest ||
+                    typeof paymentRequest !== 'object' ||
+                    typeof paymentRequest.amount !== 'number' ||
+                    !Number.isFinite(paymentRequest.amount) ||
+                    paymentRequest.amount <= 0 ||
+                    typeof paymentRequest.currency !== 'string' ||
+                    paymentRequest.currency.trim() === '' ||
+                    typeof paymentRequest.returnUrl !== 'string' ||
+                    paymentRequest.returnUrl.trim() === '' ||
+                    typeof paymentRequest.cancelUrl !== 'string' ||
+                    paymentRequest.cancelUrl.trim() === '') {
+                    return res.status(400).json({
+                        success: false,
+                        code: 'INVALID_PAYMENT_REQUEST',
+                        error: 'Invalid payment request returned by buildPaymentRequest: amount must be a positive number, currency, returnUrl, and cancelUrl are required strings',
+                    });
+                }
+            }
+            else {
+                const body = req.body;
+                const amount = body?.amount;
+                const currency = body?.currency;
+                if (typeof amount !== 'number' ||
+                    !Number.isFinite(amount) ||
+                    amount <= 0 ||
+                    typeof currency !== 'string' ||
+                    currency.trim() === '') {
+                    return res.status(400).json({
+                        success: false,
+                        error: 'Invalid payment request: amount must be a positive number and currency is required',
+                    });
+                }
+                paymentRequest = body;
+            }
+            const result = await checkout.createPayment(provider, paymentRequest);
             res.status(result.success ? 201 : 400).json(result);
         }
         catch (err) {
@@ -53,9 +127,16 @@ function createCheckoutRouter(checkout, options = {}) {
         }
     });
     // ---- POST /:provider/execute — execute payment ---------------------------
-    router.post('/:provider/execute', async (req, res) => {
+    const executeHandlers = [];
+    if (options.execute?.middleware?.length) {
+        executeHandlers.push(...options.execute.middleware);
+    }
+    router.post('/:provider/execute', ...executeHandlers, async (req, res) => {
         try {
             const { paymentId, data } = req.body;
+            if (options.execute?.onBeforeExecute) {
+                await options.execute.onBeforeExecute(req, paymentId);
+            }
             const result = await checkout.executePayment(String(req.params.provider), paymentId, data);
             res.status(result.success ? 200 : 400).json(result);
         }
@@ -63,33 +144,47 @@ function createCheckoutRouter(checkout, options = {}) {
             sendError(res, err);
         }
     });
-    // ---- POST /:provider/refund — refund payment -----------------------------
-    router.post('/:provider/refund', async (req, res) => {
-        try {
-            const { paymentId, amount } = req.body;
-            const result = await checkout.refundPayment(String(req.params.provider), paymentId, amount);
-            res.status(result.success ? 200 : 400).json(result);
+    // ---- POST /:provider/refund — refund payment (opt-in) --------------------
+    if (options.refund) {
+        const refundHandlers = [];
+        if (options.refund.middleware?.length) {
+            refundHandlers.push(...options.refund.middleware);
         }
-        catch (err) {
-            sendError(res, err);
-        }
-    });
-    // ---- POST /:provider/webhook — handle webhook ----------------------------
-    router.post('/:provider/webhook', async (req, res) => {
+        router.post('/:provider/refund', ...refundHandlers, async (req, res) => {
+            try {
+                const { paymentId, amount } = req.body;
+                const result = await checkout.refundPayment(String(req.params.provider), paymentId, amount);
+                res.status(result.success ? 200 : 400).json(result);
+            }
+            catch (err) {
+                sendError(res, err);
+            }
+        });
+    }
+    // ---- GET & POST /:provider/webhook — handle webhook ----------------------
+    const webhookHandler = async (req, res) => {
         try {
-            const result = await checkout.handleWebhook(String(req.params.provider), req.body, req.headers);
+            const result = await checkout.handleWebhook(String(req.params.provider), req.body, req.headers, req.query, { method: req.method, path: req.originalUrl || req.url });
             res.status(result.success ? 200 : 400).json(result);
         }
         catch (err) {
             sendError(res, err);
         }
-    });
+    };
+    router.get('/:provider/webhook', webhookHandler);
+    router.post('/:provider/webhook', webhookHandler);
     // ---- GET /:provider/redirect — handle redirect callback ------------------
     // NOTE: must be defined BEFORE /:provider/:id to avoid "redirect" being
     // treated as a paymentId.
     router.get('/:provider/redirect', async (req, res) => {
         try {
             const result = await checkout.handleRedirect(String(req.params.provider), req.query);
+            if (options.redirect) {
+                const targetUrl = result.success
+                    ? options.redirect.onSuccess(result, req)
+                    : options.redirect.onFailure(result, req);
+                return res.redirect(302, targetUrl);
+            }
             res.status(result.success ? 200 : 400).json(result);
         }
         catch (err) {
@@ -97,7 +192,14 @@ function createCheckoutRouter(checkout, options = {}) {
         }
     });
     // ---- GET /:provider/:id — get payment details ----------------------------
-    router.get('/:provider/:id', async (req, res) => {
+    const detailsHandlers = [];
+    if (options.details?.middleware?.length) {
+        detailsHandlers.push(...options.details.middleware);
+    }
+    router.get('/:provider/:id', ...detailsHandlers, async (req, res) => {
+        if (options.details?.enabled === false) {
+            return res.status(404).json({ success: false, error: 'Payment details route is disabled' });
+        }
         try {
             const result = await checkout.getPaymentDetails(String(req.params.provider), String(req.params.id));
             res.status(result.success ? 200 : 404).json(result);
@@ -118,7 +220,7 @@ function sendError(res, err) {
             WEBHOOK_NOT_SUPPORTED: 422,
             REDIRECT_NOT_SUPPORTED: 422,
         };
-        const status = statusMap[err.code] ?? 500;
+        const status = statusMap[err.code] ?? 400;
         res.status(status).json({ success: false, error: err.message, code: err.code });
     }
     else {

package/dist/adapters/express/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":";;AAqCA,oDAiGC;AAtID,qCAAoE;AAEpE,gDAAoD;AAgBpD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,oBAAoB,CAClC,QAA8B,EAC9B,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,kDAAkD;IAClD,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CACjF,CAAC;YACF,IAAI,QAAQ;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC5B,mCAAmC;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAW,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE;gBAC9B,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM;oBAAE,OAAO,IAAI,EAAE,CAAC;gBACxC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC;YACF,GAAG,CAAC,CAAC,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAyC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA8C,CAAC;YACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAiC,CACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,KAA+B,CACpC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC5C,IAAI,GAAG,YAAY,sBAAa,EAAE,CAAC;QACjC,MAAM,SAAS,GAA2B;YACxC,kBAAkB,EAAE,GAAG;YACvB,qBAAqB,EAAE,GAAG;YAC1B,sBAAsB,EAAE,GAAG;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":";;AAuEA,oCAcC;AAiCD,oDAgLC;AAtSD,qCAAoE;AAEpE,gDAAoD;AAiEpD;;;GAGG;AACH,SAAgB,YAAY,CAAC,OAAe,EAAE,WAAqB;IACjE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACzC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,oBAAoB,CAClC,QAA8B,EAC9B,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CACV,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACvD,mCAAmC;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAW,CAAC;YACrC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE;gBAC9B,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM;oBAAE,OAAO,IAAI,EAAE,CAAC;gBACxC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC;YACF,GAAG,CAAC,CAAC,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,cAA8B,CAAC;YACnC,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,cAAc,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,GAAG,EAAE;oBACtD,QAAQ;oBACR,GAAG;iBACJ,CAAC,CAAC;gBAEH,IACE,CAAC,cAAc;oBACf,OAAO,cAAc,KAAK,QAAQ;oBAClC,OAAO,cAAc,CAAC,MAAM,KAAK,QAAQ;oBACzC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC;oBACvC,cAAc,CAAC,MAAM,IAAI,CAAC;oBAC1B,OAAO,cAAc,CAAC,QAAQ,KAAK,QAAQ;oBAC3C,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;oBACrC,OAAO,cAAc,CAAC,SAAS,KAAK,QAAQ;oBAC5C,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;oBACtC,OAAO,cAAc,CAAC,SAAS,KAAK,QAAQ;oBAC5C,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EACtC,CAAC;oBACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EACH,oJAAoJ;qBACvJ,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;gBAChC,IACE,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,MAAM,IAAI,CAAC;oBACX,OAAO,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EACtB,CAAC;oBACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oFAAoF;qBAC5F,CAAC,CAAC;gBACL,CAAC;gBACD,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAyC,CAAC;YAC1E,IAAI,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;gBACrC,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,cAAc,GAAqB,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACtC,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YACxF,IAAI,CAAC;gBACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA8C,CAAC;gBACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC5F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAiC,EACrC,GAAG,CAAC,KAA+B,EACnC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE,CACzD,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAElD,6EAA6E;IAC7E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3B,GAAG,CAAC,KAA+B,CACpC,CAAC;YACF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO;oBAC9B,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC;oBACzC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACtC,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACrF,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC5C,IAAI,GAAG,YAAY,sBAAa,EAAE,CAAC;QACjC,MAAM,SAAS,GAA2B;YACxC,kBAAkB,EAAE,GAAG;YACvB,qBAAqB,EAAE,GAAG;YAC1B,sBAAsB,EAAE,GAAG;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/checkout-configurator.d.ts

@@ -27,6 +27,7 @@ import { CheckoutEventBus } from './events/checkout-event-bus';
 export declare class CheckoutConfigurator {
     private readonly config;
     private readonly providers;
+    private readonly paymentOrders;
     /** Event bus — subscribe to payment lifecycle events */
     readonly events: CheckoutEventBus;
     constructor(config?: CheckoutConfig);
@@ -56,7 +57,10 @@ export declare class CheckoutConfigurator {
      * Handle an incoming webhook from the provider.
      * @throws CheckoutError if the provider does not support webhooks.
      */
-    handleWebhook(providerName: string, body: Record<string, unknown>, headers: Record<string, string>): Promise<WebhookResult>;
+    handleWebhook(providerName: string, body?: Record<string, unknown>, headers?: Record<string, string>, query?: Record<string, string>, context?: {
+        method?: string;
+        path?: string;
+    }): Promise<WebhookResult>;
     /**
      * Handle the redirect callback from the provider (query params).
      * @throws CheckoutError if the provider does not support redirect handling.

package/dist/checkout-configurator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkout-configurator.d.ts","sourceRoot":"","sources":["../src/checkout-configurator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAA2C,MAAM,6BAA6B,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,oBAAoB;IAMnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4C;IAEtE,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAA0B;gBAE9B,MAAM,GAAE,cAAmB;IAExD,8EAA8E;YAChE,IAAI;IASlB;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAalD;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB;IAY3C,oDAAoD;IACpD,sBAAsB,IAAI,MAAM,EAAE;IAIlC,sDAAsD;IAChD,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAa1F,mDAAmD;IAC7C,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,aAAa,CAAC;IAYzB,2DAA2D;IACrD,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAKxF,qCAAqC;IAC/B,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC;IAYzB;;;OAGG;IACG,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,aAAa,CAAC;IAoBzB;;;OAGG;IACG,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,aAAa,CAAC;CAkB1B"}
+{"version":3,"file":"checkout-configurator.d.ts","sourceRoot":"","sources":["../src/checkout-configurator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAA2C,MAAM,6BAA6B,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,oBAAoB;IAOnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4C;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAEhE,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAA0B;gBAE9B,MAAM,GAAE,cAAmB;IAExD,8EAA8E;YAChE,IAAI;IASlB;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAalD;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB;IAY3C,oDAAoD;IACpD,sBAAsB,IAAI,MAAM,EAAE;IAIlC,sDAAsD;IAChD,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAiB1F,mDAAmD;IAC7C,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,aAAa,CAAC;IAezB,2DAA2D;IACrD,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAKxF,qCAAqC;IAC/B,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC;IAezB;;;OAGG;IACG,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACpC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,aAAa,CAAC;IA+BzB;;;OAGG;IACG,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,aAAa,CAAC;CAyB1B"}