elpaypg 2.0.5 → 2.0.7

package/public/icons/visa.svg

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Generator: Adobe Illustrator 12.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 51448)  -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   version="1.1"
+   id="Layer_1"
+   viewBox="0 0 1000 324.68351"
+   overflow="visible"
+   enable-background="new 0 0 659.055 202.068"
+   xml:space="preserve"
+   inkscape:version="0.48.2 r9819"
+   sodipodi:docname="Visa_Logo.svg"
+   style="overflow:visible"><metadata
+   id="metadata3739"><rdf:RDF><cc:Work
+       rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type
+         rdf:resource="http://purl.org/dc/dcmitype/StillImage" /><dc:title></dc:title></cc:Work></rdf:RDF></metadata><defs
+   id="defs3737"><linearGradient
+     id="linearGradient3801"><stop
+       style="stop-color:#20225f;stop-opacity:1"
+       offset="0"
+       id="stop3803" /><stop
+       id="stop3815"
+       offset="0.2"
+       style="stop-color:#1a1f61;stop-opacity:1" /><stop
+       id="stop3813"
+       offset="0.41023257"
+       style="stop-color:#172272;stop-opacity:1" /><stop
+       id="stop3811"
+       offset="0.59519672"
+       style="stop-color:#152682;stop-opacity:1" /><stop
+       id="stop3809"
+       offset="0.80208331"
+       style="stop-color:#12288e;stop-opacity:1" /><stop
+       style="stop-color:#0e2c9a;stop-opacity:1"
+       offset="1"
+       id="stop3805" /></linearGradient><linearGradient
+     inkscape:collect="always"
+     xlink:href="#linearGradient3801"
+     id="linearGradient3807"
+     x1="-60.048428"
+     y1="431.60797"
+     x2="740.05066"
+     y2="431.60797"
+     gradientUnits="userSpaceOnUse"
+     gradientTransform="matrix(1.2491404,0,0,1.2491404,75.136131,-428.03322)" /></defs><sodipodi:namedview
+   pagecolor="#ffffff"
+   bordercolor="#666666"
+   borderopacity="1"
+   objecttolerance="10"
+   gridtolerance="10"
+   guidetolerance="10"
+   inkscape:pageopacity="0"
+   inkscape:pageshadow="2"
+   inkscape:window-width="1920"
+   inkscape:window-height="1028"
+   id="namedview3735"
+   showgrid="false"
+   fit-margin-left="0.5"
+   fit-margin-bottom="0.5"
+   fit-margin-top="0.5"
+   fit-margin-right="0.5"
+   inkscape:zoom="0.51625"
+   inkscape:cx="838.0749"
+   inkscape:cy="-26.853447"
+   inkscape:window-x="-8"
+   inkscape:window-y="-8"
+   inkscape:window-maximized="1"
+   inkscape:current-layer="Layer_1"><inkscape:grid
+     type="xygrid"
+     id="grid3787"
+     empspacing="5"
+     visible="true"
+     enabled="true"
+     snapvisiblegridlinesonly="true" /></sodipodi:namedview>
+
+<path
+   style="fill:url(#linearGradient3807);fill-opacity:1;stroke:none"
+   d="m 651.18503,0.50000002 c -70.93272,0 -134.32163,36.76584998 -134.32163,104.69357998 0,77.90028 112.42264,83.28082 112.42264,122.41576 0,16.47806 -18.88384,31.22851 -51.13668,31.22851 -45.77308,0 -79.98403,-20.61081 -79.98403,-20.61081 l -14.63836,68.54658 c 0,0 39.41037,17.40989 91.73375,17.40989 77.55217,0 138.57651,-38.57104 138.57651,-107.66029 0,-82.3157 -112.89106,-87.53633 -112.89106,-123.86008 0,-12.9082 15.50201,-27.05169 47.66251,-27.05169 36.28682,0 65.89216,14.98968 65.89216,14.98968 l 14.32608,-66.20444 c 0,0 -32.21317,-13.89668998 -77.64189,-13.89668998 z M 2.2175605,5.49657 0.49999253,15.48969 c 0,0 29.84159547,5.46149 56.71878047,16.35593 34.606624,12.4927 37.071853,19.7653 42.900167,42.35367 l 63.51098,244.83152 85.13673,0 131.15974,-313.53424 -84.94155,0 L 210.7069,218.67018 176.3165,37.97422 C 173.1626,17.29371 157.18709,5.49657 137.63219,5.49657 l -135.4146295,0 z m 411.8650095,0 -66.63383,313.53424 80.99895,0 66.39962,-313.53424 -80.76474,0 z m 451.75943,0 c -19.53181,0 -29.88045,10.45695 -37.47421,28.73022 l -118.66834,284.80402 84.94155,0 16.434,-47.46734 103.48348,0 9.99312,47.46734 74.94843,0 -65.3847,-313.53424 -68.27333,0 z m 11.04709,84.70733 25.17799,117.65341 -67.45359,0 42.2756,-117.65341 z"
+   id="path3789"
+   inkscape:connector-curvature="0" /></svg>

package/public/views/checkout.html

@@ -970,19 +970,17 @@
     let currentSelectedMethod = 'UPI';
 
     function hideAllContent() {
-      document.getElementById('viewUpiContent').hidden = true;
-      const vCod = document.getElementById('viewCodContent');
-      if (vCod) vCod.hidden = true;
-      const vCash = document.getElementById('viewCashContent');
-      if (vCash) vCash.hidden = true;
-      const vCard = document.getElementById('viewCardContent');
-      if (vCard) vCard.hidden = true;
-      document.getElementById('viewProcessingContent').hidden = true;
-      document.getElementById('viewSuccessContent').hidden = true;
-      document.getElementById('viewFailedContent').hidden = true;
-      document.getElementById('viewQueuedContent').hidden = true;
-      const vBlocked = document.getElementById('viewBlockedContent');
-      if (vBlocked) vBlocked.hidden = true;
+      const u = document.getElementById('viewUpiContent'); if (u) u.hidden = true;
+      const vCod = document.getElementById('viewCodContent'); if (vCod) vCod.hidden = true;
+      const vCash = document.getElementById('viewCashContent'); if (vCash) vCash.hidden = true;
+      const vCard = document.getElementById('viewCardContent'); if (vCard) vCard.hidden = true;
+      const p = document.getElementById('viewProcessingContent'); if (p) p.hidden = true;
+      const s = document.getElementById('viewSuccessContent'); if (s) s.hidden = true;
+      const f = document.getElementById('viewFailedContent'); if (f) f.hidden = true;
+      const q = document.getElementById('viewQueuedContent'); if (q) q.hidden = true;
+      const vBlocked = document.getElementById('viewBlockedContent'); if (vBlocked) vBlocked.hidden = true;
+      const vDup = document.getElementById('viewDuplicateSessionContent'); if (vDup) vDup.hidden = true;
+    }
       const vDup = document.getElementById('viewDuplicateSessionContent');
       if (vDup) vDup.hidden = true;
     }
@@ -1432,6 +1430,21 @@
         }
 
         return { deviceId: null, deviceToken: null };
+      },
+
+      async reset() {
+        this.currentDeviceId = null;
+        this.currentDeviceToken = null;
+        try { localStorage.removeItem('ypg_device_id'); localStorage.removeItem('ypg_device_token'); } catch {}
+        try {
+          const db = await this.openDb();
+          if (db) {
+            const tx = db.transaction(this.storeName, 'readwrite');
+            const store = tx.objectStore(this.storeName);
+            store.delete('primary_device');
+            await new Promise((resolve) => { tx.oncomplete = () => resolve(); tx.onerror = () => resolve(); });
+          }
+        } catch {}
       }
     };
 
@@ -1459,6 +1472,14 @@
         const res = await fetch(`${API_BASE}/api/v1/checkout/${PAYMENT_ID}/state`, { headers });
         const data = await res.json().catch(() => ({}));
 
+        if (data.code === 'DEVICE_REVOKED' || data.code === 'DEVICE_TOKEN_INVALID' || data.code === 'DEVICE_ID_REQUIRED' || data.code === 'DEVICE_CREDENTIALS_REQUIRED') {
+          if (!window._deviceResetAttempted) {
+            window._deviceResetAttempted = true;
+            await DeviceIdentity.reset();
+            return loadState();
+          }
+        }
+
         if (res.status === 409 || data.error === 'DUPLICATE_SESSION_DETECTED') {
           renderDuplicateSession(data);
           dismissSplashScreen();

package/src/index.js

@@ -1,137 +1,138 @@
-import { EventEmitter } from 'node:events';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { PaymentStatus } from './vendor/common/index.js';
-import {
-  getDatabase,
-  ensureDatabaseInitialized,
-  runMigrations,
-  MerchantRepository,
-  ReceivingAccountRepository,
-  CustomerRepository,
-  CustomerSessionRepository,
-  PaymentSessionRepository,
-  ObservationRepository,
-  SupportTicketRepository,
-  AuditLogRepository,
-  DeviceRepository
-} from './vendor/db/index.js';
-import {
-  QueueEngine,
-  TimingEngine,
-  AttributionEngine,
-  RecoveryEngine,
-  WebhookEngine,
-  PaymentVerificationPipeline
-} from './vendor/core/index.js';
-import { createRouter } from './router.js';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-export async function elpay(options = {}) {
-  const db = options.db || getDatabase(options.databaseUrl);
-  ensureDatabaseInitialized(db);
-  const { defaultMerchant } = runMigrations(db);
-
-  const merchantRepo = new MerchantRepository(db);
-  const accountRepo = new ReceivingAccountRepository(db);
-  const customerRepo = new CustomerRepository(db);
-  const customerSessionRepo = new CustomerSessionRepository(db, customerRepo);
-  const sessionRepo = new PaymentSessionRepository(db);
-  const obsRepo = new ObservationRepository(db);
-  const ticketRepo = new SupportTicketRepository(db);
-  const auditRepo = new AuditLogRepository(db);
-  const deviceRepo = new DeviceRepository(db);
-
-  const eventEmitter = new EventEmitter();
-
-  const parseWindowMs = (raw, fallback) => {
-    if (raw === undefined || raw === null || String(raw).trim() === '') return fallback;
-    const value = Number(raw);
-    if (!Number.isFinite(value) || value <= 0 || value > 24 * 60 * 60 * 1000) return fallback;
-    return Math.floor(value);
-  };
-  const activeDurationMs = parseWindowMs(process.env.PAYMENT_ACTIVE_WINDOW_MS, 300000);
-  const processingDurationMs = parseWindowMs(process.env.PAYMENT_PROCESSING_WINDOW_MS, 30000);
-
-  const queueEngine = new QueueEngine({ sessionRepo, accountRepo, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
-  const timingEngine = new TimingEngine({ sessionRepo, queueEngine, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
-  const attributionEngine = new AttributionEngine({ sessionRepo, obsRepo, ticketRepo, auditRepo, eventEmitter });
-  const recoveryEngine = new RecoveryEngine({ db, sessionRepo, accountRepo, queueEngine, timingEngine, auditRepo, eventEmitter });
-  const webhookEngine = new WebhookEngine({ db, merchantRepo, maxRetries: Number(process.env.WEBHOOK_MAX_RETRIES || 5) });
-
-  const checkoutBaseUrl = options.baseUrl || process.env.BASE_CHECKOUT_URL || 'http://localhost:3000';
-
-  const handleSlotFreedAndPromote = (receivingAccountId) => {
-    if (!receivingAccountId) return null;
-    const promoted = queueEngine.promoteNext(receivingAccountId);
-    if (promoted) {
-      if (promoted.expiresAt) timingEngine.startActiveTimer(promoted.id, promoted.expiresAt);
-    }
-    return promoted;
-  };
-
-  eventEmitter.on('PAYMENT.SUCCESS', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('SUCCESS', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-    if (options.onSuccess) options.onSuccess(data);
-  });
-  eventEmitter.on('PAYMENT.FAILED', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('FAILED', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-    if (options.onFailed) options.onFailed(data);
-  });
-  eventEmitter.on('PAYMENT.EXPIRED', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('EXPIRED', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-  });
-  eventEmitter.on('PAYMENT.CANCELLED', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('CANCELLED', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-  });
-
-  recoveryEngine.recover();
-
-  const pipeline = new PaymentVerificationPipeline({
-    db, sessionRepo, obsRepo, customerRepo, attributionEngine, auditRepo, merchantRepo,
-    server: null, eventEmitter
-  });
-
-  const ctx = {
-    db, merchantRepo, accountRepo, customerRepo, customerSessionRepo, sessionRepo, deviceRepo,
-    obsRepo, ticketRepo, auditRepo, queueEngine, timingEngine, attributionEngine, pipeline,
-    recoveryEngine, eventEmitter, defaultMerchant, checkoutBaseUrl, webhookEngine,
-    otpCooldownMs: options.otpCooldownMs,
-    theme: options.theme || {}
-  };
-
-  const router = createRouter(ctx);
-
-  const destroy = () => {
-    timingEngine.destroy?.();
-    attributionEngine.destroy?.();
-  };
-
-  return {
-    router,
-    on: (event, cb) => eventEmitter.on(event, cb),
-    init: async () => {},
-    destroy,
-  };
-}
-
-export { createRouter };
-export default { elpay };
+import { EventEmitter } from 'node:events';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PaymentStatus } from './vendor/common/index.js';
+import {
+  getDatabase,
+  ensureDatabaseInitialized,
+  runMigrations,
+  MerchantRepository,
+  ReceivingAccountRepository,
+  CustomerRepository,
+  CustomerSessionRepository,
+  PaymentSessionRepository,
+  ObservationRepository,
+  SupportTicketRepository,
+  AuditLogRepository,
+  DeviceRepository
+} from './vendor/db/index.js';
+import {
+  QueueEngine,
+  TimingEngine,
+  AttributionEngine,
+  RecoveryEngine,
+  WebhookEngine,
+  PaymentVerificationPipeline
+} from './vendor/core/index.js';
+import { createRouter } from './router.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+export async function elpay(options = {}) {
+  const db = options.db || getDatabase(options.databaseUrl);
+  ensureDatabaseInitialized(db);
+  const { defaultMerchant } = runMigrations(db);
+
+  const merchantRepo = new MerchantRepository(db);
+  const accountRepo = new ReceivingAccountRepository(db);
+  const customerRepo = new CustomerRepository(db);
+  const customerSessionRepo = new CustomerSessionRepository(db, customerRepo);
+  const sessionRepo = new PaymentSessionRepository(db);
+  const obsRepo = new ObservationRepository(db);
+  const ticketRepo = new SupportTicketRepository(db);
+  const auditRepo = new AuditLogRepository(db);
+  const deviceRepo = new DeviceRepository(db);
+
+  const eventEmitter = new EventEmitter();
+
+  const parseWindowMs = (raw, fallback) => {
+    if (raw === undefined || raw === null || String(raw).trim() === '') return fallback;
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value <= 0 || value > 24 * 60 * 60 * 1000) return fallback;
+    return Math.floor(value);
+  };
+  const activeDurationMs = parseWindowMs(process.env.PAYMENT_ACTIVE_WINDOW_MS, 300000);
+  const processingDurationMs = parseWindowMs(process.env.PAYMENT_PROCESSING_WINDOW_MS, 30000);
+
+  const queueEngine = new QueueEngine({ sessionRepo, accountRepo, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
+  const timingEngine = new TimingEngine({ sessionRepo, queueEngine, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
+  const attributionEngine = new AttributionEngine({ sessionRepo, obsRepo, ticketRepo, auditRepo, eventEmitter });
+  const recoveryEngine = new RecoveryEngine({ db, sessionRepo, accountRepo, queueEngine, timingEngine, auditRepo, eventEmitter });
+  const webhookEngine = new WebhookEngine({ db, merchantRepo, maxRetries: Number(process.env.WEBHOOK_MAX_RETRIES || 5) });
+
+  const checkoutBaseUrl = options.baseUrl || process.env.BASE_CHECKOUT_URL || 'http://localhost:3000';
+
+  const handleSlotFreedAndPromote = (receivingAccountId) => {
+    if (!receivingAccountId) return null;
+    const promoted = queueEngine.promoteNext(receivingAccountId);
+    if (promoted) {
+      if (promoted.expiresAt) timingEngine.startActiveTimer(promoted.id, promoted.expiresAt);
+    }
+    return promoted;
+  };
+
+  eventEmitter.on('PAYMENT.SUCCESS', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('SUCCESS', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+    if (options.onSuccess) options.onSuccess(data);
+  });
+  eventEmitter.on('PAYMENT.FAILED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('FAILED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+    if (options.onFailed) options.onFailed(data);
+  });
+  eventEmitter.on('PAYMENT.EXPIRED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('EXPIRED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+  });
+  eventEmitter.on('PAYMENT.CANCELLED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('CANCELLED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+  });
+
+  recoveryEngine.recover();
+
+  const pipeline = new PaymentVerificationPipeline({
+    db, sessionRepo, obsRepo, customerRepo, attributionEngine, auditRepo, merchantRepo,
+    server: null, eventEmitter
+  });
+
+  const ctx = {
+    db, merchantRepo, accountRepo, customerRepo, customerSessionRepo, sessionRepo, deviceRepo,
+    obsRepo, ticketRepo, auditRepo, queueEngine, timingEngine, attributionEngine, pipeline,
+    recoveryEngine, eventEmitter, defaultMerchant, checkoutBaseUrl, webhookEngine,
+    baseUrl: options.baseUrl || process.env.BASE_URL || 'http://localhost:5000',
+    otpCooldownMs: options.otpCooldownMs,
+    theme: options.theme || {}
+  };
+
+  const router = createRouter(ctx);
+
+  const destroy = () => {
+    timingEngine.destroy?.();
+    attributionEngine.destroy?.();
+  };
+
+  return {
+    router,
+    on: (event, cb) => eventEmitter.on(event, cb),
+    init: async () => {},
+    destroy,
+  };
+}
+
+export { createRouter };
+export default { elpay };

package/src/router.js

@@ -1,8 +1,10 @@
 import { Router } from 'express';
+import { server } from './sse.js';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import fs from 'node:fs';
 import express from 'express';
+import { getInternalServiceToken } from './vendor/common/index.js';
 import { registerPaymentRoutes } from './routes/payments.routes.js';
 import { registerCheckoutRoutes } from './routes/checkout.routes.js';
 import { registerPollerRoutes } from './routes/pollers.routes.js';
@@ -12,15 +14,60 @@ import { registerDeviceRoutes } from './routes/device.routes.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+function loadTemplateWithPartials() {
+  const viewsDir = path.resolve(__dirname, '..', 'public', 'views');
+  const partialsDir = path.resolve(viewsDir, 'partials');
+  let content = fs.readFileSync(path.join(viewsDir, 'checkout.html'), 'utf8');
+  content = content.replace(/<!--\s*include:partials\/([a-zA-Z0-9_\-.]+)\s*-->/g, (match, filename) => {
+    const partialPath = path.resolve(partialsDir, filename);
+    const relative = path.relative(partialsDir, partialPath);
+    const isSecure = relative && !relative.startsWith('..') && !path.isAbsolute(relative);
+    if (isSecure && fs.existsSync(partialPath)) {
+      return fs.readFileSync(partialPath, 'utf8');
+    }
+    return match;
+  });
+  return content;
+}
+
+function renderTemplate(template, values) {
+  const escapeHtml = (v) => (v === null || v === undefined) ? '' : String(v).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[ch]);
+  const escapeJs = (v) => (v === null || v === undefined) ? '' : String(v).replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r').replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
+  const scriptKeys = new Set(['PAYMENT_ID', 'API_BASE_URL', 'AMOUNT']);
+  return template.replace(/\{\{([A-Z0-9_]+)\}\}/g, (match, key) => {
+    if (!Object.prototype.hasOwnProperty.call(values, key)) return match;
+    const value = values[key];
+    return scriptKeys.has(key) ? escapeJs(value) : escapeHtml(value);
+  });
+}
+
+function serializeForScript(value) {
+  return JSON.stringify(value === undefined ? null : value)
+    .replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026')
+    .replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+}
+
+async function fetchCheckoutState(ctx, paymentId) {
+  try {
+    const base = (ctx.baseUrl || ctx.checkoutBaseUrl || 'http://127.0.0.1:5000').replace(/\/$/, '');
+    const token = getInternalServiceToken();
+    const res = await fetch(`${base}/api/v1/checkout/${encodeURIComponent(paymentId)}/state`, {
+      headers: { Authorization: `Bearer ${token}`, 'X-Internal-Render': 'true' },
+      signal: AbortSignal.timeout(4000)
+    });
+    if (res.ok) return await res.json();
+  } catch {}
+  return null;
+}
+
 export function createRouter(ctx = {}) {
   const router = Router();
   router.use(express.static(path.join(__dirname, '..', 'public')));
 
-  router.get('/checkout/:id', (req, res) => {
-    const htmlPath = path.join(__dirname, '..', 'public', 'views', 'checkout.html');
-    const html = fs.readFileSync(htmlPath, 'utf8')
-      .replace(/\{\{API_BASE_URL\}\}/g, ctx.baseUrl || 'http://localhost:5000')
-      .replace(/\{\{PAYMENT_ID\}\}/g, req.params.id);
+  router.get('/checkout/:id', async (req, res) => {
+    const paymentId = req.params.id;
+    const state = await fetchCheckoutState(ctx, paymentId);
+    const html = renderCheckoutPage(ctx, paymentId, state);
     res.type('html').send(html);
   });
 
@@ -50,4 +97,17 @@ export function createRouter(ctx = {}) {
   return router;
 }
 
+function renderCheckoutPage(ctx, paymentId, state) {
+  const template = loadTemplateWithPartials();
+  const values = {
+    PAYMENT_ID: paymentId,
+    API_BASE_URL: '',
+    APP_NAME: state?.branding?.appName || 'ELPAY PG',
+    MERCHANT_NAME: state?.merchantName || 'Merchant Checkout',
+    AMOUNT: state?.amount || '0.00',
+    INITIAL_STATE_JSON: serializeForScript(state || {})
+  };
+  return renderTemplate(template, values);
+}
+
 export default createRouter;

package/src/routes/admin.routes.js

@@ -1,4 +1,5 @@
-import crypto from 'node:crypto';
+import crypto from 'node:crypto';
+import { server } from '../sse.js';
 import { Router } from 'express';
 import { PaymentStatus, PaymentMethod, SellingMode, AuditActorType, isValidVpa, toRupeesString, deriveCloudflareRoutes, resolveRuntimeUrls, resolveGmailRedirectUri, createOAuthState, validateOutboundWebhookUrl } from '../vendor/common/index.js';
 import { PaymentVerificationPipeline } from '../vendor/core/index.js';
@@ -1120,10 +1121,7 @@ export function registerAdminRoutes(router, ctx) {
 
   // GET /api/v1/admin/stream (SSE for Live Admin Counter & Queue Events)
   router.get('/api/v1/admin/stream', async (req, res) => {
-    res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': '*' });
-    res.write('event: connected\ndata: {"status":"connected"}\n\n');
-    const _iv = setInterval(() => { try { res.write(': keepalive\n\n'); } catch {} }, 15000);
-    req.on('close', () => clearInterval(_iv));
+    server.initSse('admin_counter_events', res);
   });
 
   // --- WHATSAPP BERRY PROTOCOL MERCHANT SESSION CONFIGURATION ---

package/src/routes/checkout.routes.js

@@ -1,4 +1,5 @@
-import { Router } from 'express';
+import { Router } from 'express';
+import { server } from '../sse.js';
 import { toRupeesString, buildUpiUri, PaymentStatus, PaymentMethod, UPI_PROVIDERS, isInternalServiceRequest, isValidTransition } from '../vendor/common/index.js';
 import { validateSessionDeviceAccess, verifyRegisteredDeviceCredentials } from '../vendor/core/index.js';
 import { isPaymentOwner } from '../auth-guard.js';
@@ -1961,15 +1962,7 @@ export function registerCheckoutRoutes(router, ctx) {
       res.status(deviceAccess.statusCode || 409).json(deviceAccess.body);
       return;
     }
-    res.writeHead(200, {
-      'Content-Type': 'text/event-stream',
-      'Cache-Control': 'no-cache',
-      'Connection': 'keep-alive',
-      'Access-Control-Allow-Origin': '*'
-    });
-    res.write('event: connected\ndata: {"status":"connected"}\n\n');
-    const interval = setInterval(() => { try { res.write(': keepalive\n\n'); } catch {} }, 15000);
-    req.on('close', () => clearInterval(interval));
+    server.initSse(req.params.id, res);
   });
 
   router.get('/api/v1/checkout/:id/events', async (req, res) => {
@@ -1983,15 +1976,7 @@ export function registerCheckoutRoutes(router, ctx) {
       res.status(deviceAccess.statusCode || 409).json(deviceAccess.body);
       return;
     }
-    res.writeHead(200, {
-      'Content-Type': 'text/event-stream',
-      'Cache-Control': 'no-cache',
-      'Connection': 'keep-alive',
-      'Access-Control-Allow-Origin': '*'
-    });
-    res.write('event: connected\ndata: {"status":"connected"}\n\n');
-    const interval = setInterval(() => { try { res.write(': keepalive\n\n'); } catch {} }, 15000);
-    req.on('close', () => clearInterval(interval));
+    server.initSse(req.params.id, res);
   });
 }
 

package/src/sse.js

@@ -0,0 +1,44 @@
+const channels = new Map();
+
+export const server = {
+  initSse(topic, res) {
+    const headers = {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      'Connection': 'keep-alive',
+      'Access-Control-Allow-Origin': '*'
+    };
+    res.writeHead(200, headers);
+    res.write('event: connected\ndata: {"status":"connected"}\n\n');
+
+    if (!channels.has(topic)) channels.set(topic, new Set());
+    const set = channels.get(topic);
+    set.add(res);
+
+    const ping = setInterval(() => {
+      try { res.write(': keepalive\n\n'); } catch { clearInterval(ping); }
+    }, 15000);
+    if (ping.unref) ping.unref();
+
+    res.on('close', () => {
+      clearInterval(ping);
+      set.delete(res);
+      if (set.size === 0) channels.delete(topic);
+    });
+  },
+
+  broadcastSse(topic, event, data) {
+    const set = channels.get(topic);
+    if (!set || set.size === 0) return;
+    let safeJson;
+    try { safeJson = JSON.stringify(data, (k, v) => typeof v === 'bigint' ? v.toString() : v); } catch { safeJson = '{}'; }
+    const named = `event: ${event}\ndata: ${safeJson}\n\n`;
+    const def = `data: ${JSON.stringify({ type: event, ...data, event })}\n\n`;
+    const payload = named + def;
+    for (const r of set) {
+      try { r.write(payload); } catch { set.delete(r); }
+    }
+  }
+};
+
+export default server;