elpaypg 2.0.6 → 2.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "elpaypg",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "ELPAY PG - single-backend payment gateway module",
   "type": "module",
   "main": "./src/index.js",

package/public/views/checkout.html

@@ -970,19 +970,17 @@
     let currentSelectedMethod = 'UPI';
 
     function hideAllContent() {
-      document.getElementById('viewUpiContent').hidden = true;
-      const vCod = document.getElementById('viewCodContent');
-      if (vCod) vCod.hidden = true;
-      const vCash = document.getElementById('viewCashContent');
-      if (vCash) vCash.hidden = true;
-      const vCard = document.getElementById('viewCardContent');
-      if (vCard) vCard.hidden = true;
-      document.getElementById('viewProcessingContent').hidden = true;
-      document.getElementById('viewSuccessContent').hidden = true;
-      document.getElementById('viewFailedContent').hidden = true;
-      document.getElementById('viewQueuedContent').hidden = true;
-      const vBlocked = document.getElementById('viewBlockedContent');
-      if (vBlocked) vBlocked.hidden = true;
+      const u = document.getElementById('viewUpiContent'); if (u) u.hidden = true;
+      const vCod = document.getElementById('viewCodContent'); if (vCod) vCod.hidden = true;
+      const vCash = document.getElementById('viewCashContent'); if (vCash) vCash.hidden = true;
+      const vCard = document.getElementById('viewCardContent'); if (vCard) vCard.hidden = true;
+      const p = document.getElementById('viewProcessingContent'); if (p) p.hidden = true;
+      const s = document.getElementById('viewSuccessContent'); if (s) s.hidden = true;
+      const f = document.getElementById('viewFailedContent'); if (f) f.hidden = true;
+      const q = document.getElementById('viewQueuedContent'); if (q) q.hidden = true;
+      const vBlocked = document.getElementById('viewBlockedContent'); if (vBlocked) vBlocked.hidden = true;
+      const vDup = document.getElementById('viewDuplicateSessionContent'); if (vDup) vDup.hidden = true;
+    }
       const vDup = document.getElementById('viewDuplicateSessionContent');
       if (vDup) vDup.hidden = true;
     }
@@ -1432,6 +1430,21 @@
         }
 
         return { deviceId: null, deviceToken: null };
+      },
+
+      async reset() {
+        this.currentDeviceId = null;
+        this.currentDeviceToken = null;
+        try { localStorage.removeItem('ypg_device_id'); localStorage.removeItem('ypg_device_token'); } catch {}
+        try {
+          const db = await this.openDb();
+          if (db) {
+            const tx = db.transaction(this.storeName, 'readwrite');
+            const store = tx.objectStore(this.storeName);
+            store.delete('primary_device');
+            await new Promise((resolve) => { tx.oncomplete = () => resolve(); tx.onerror = () => resolve(); });
+          }
+        } catch {}
       }
     };
 
@@ -1459,6 +1472,14 @@
         const res = await fetch(`${API_BASE}/api/v1/checkout/${PAYMENT_ID}/state`, { headers });
         const data = await res.json().catch(() => ({}));
 
+        if (data.code === 'DEVICE_REVOKED' || data.code === 'DEVICE_TOKEN_INVALID' || data.code === 'DEVICE_ID_REQUIRED' || data.code === 'DEVICE_CREDENTIALS_REQUIRED') {
+          if (!window._deviceResetAttempted) {
+            window._deviceResetAttempted = true;
+            await DeviceIdentity.reset();
+            return loadState();
+          }
+        }
+
         if (res.status === 409 || data.error === 'DUPLICATE_SESSION_DETECTED') {
           renderDuplicateSession(data);
           dismissSplashScreen();

package/src/index.js

@@ -1,137 +1,138 @@
-import { EventEmitter } from 'node:events';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { PaymentStatus } from './vendor/common/index.js';
-import {
-  getDatabase,
-  ensureDatabaseInitialized,
-  runMigrations,
-  MerchantRepository,
-  ReceivingAccountRepository,
-  CustomerRepository,
-  CustomerSessionRepository,
-  PaymentSessionRepository,
-  ObservationRepository,
-  SupportTicketRepository,
-  AuditLogRepository,
-  DeviceRepository
-} from './vendor/db/index.js';
-import {
-  QueueEngine,
-  TimingEngine,
-  AttributionEngine,
-  RecoveryEngine,
-  WebhookEngine,
-  PaymentVerificationPipeline
-} from './vendor/core/index.js';
-import { createRouter } from './router.js';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-export async function elpay(options = {}) {
-  const db = options.db || getDatabase(options.databaseUrl);
-  ensureDatabaseInitialized(db);
-  const { defaultMerchant } = runMigrations(db);
-
-  const merchantRepo = new MerchantRepository(db);
-  const accountRepo = new ReceivingAccountRepository(db);
-  const customerRepo = new CustomerRepository(db);
-  const customerSessionRepo = new CustomerSessionRepository(db, customerRepo);
-  const sessionRepo = new PaymentSessionRepository(db);
-  const obsRepo = new ObservationRepository(db);
-  const ticketRepo = new SupportTicketRepository(db);
-  const auditRepo = new AuditLogRepository(db);
-  const deviceRepo = new DeviceRepository(db);
-
-  const eventEmitter = new EventEmitter();
-
-  const parseWindowMs = (raw, fallback) => {
-    if (raw === undefined || raw === null || String(raw).trim() === '') return fallback;
-    const value = Number(raw);
-    if (!Number.isFinite(value) || value <= 0 || value > 24 * 60 * 60 * 1000) return fallback;
-    return Math.floor(value);
-  };
-  const activeDurationMs = parseWindowMs(process.env.PAYMENT_ACTIVE_WINDOW_MS, 300000);
-  const processingDurationMs = parseWindowMs(process.env.PAYMENT_PROCESSING_WINDOW_MS, 30000);
-
-  const queueEngine = new QueueEngine({ sessionRepo, accountRepo, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
-  const timingEngine = new TimingEngine({ sessionRepo, queueEngine, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
-  const attributionEngine = new AttributionEngine({ sessionRepo, obsRepo, ticketRepo, auditRepo, eventEmitter });
-  const recoveryEngine = new RecoveryEngine({ db, sessionRepo, accountRepo, queueEngine, timingEngine, auditRepo, eventEmitter });
-  const webhookEngine = new WebhookEngine({ db, merchantRepo, maxRetries: Number(process.env.WEBHOOK_MAX_RETRIES || 5) });
-
-  const checkoutBaseUrl = options.baseUrl || process.env.BASE_CHECKOUT_URL || 'http://localhost:3000';
-
-  const handleSlotFreedAndPromote = (receivingAccountId) => {
-    if (!receivingAccountId) return null;
-    const promoted = queueEngine.promoteNext(receivingAccountId);
-    if (promoted) {
-      if (promoted.expiresAt) timingEngine.startActiveTimer(promoted.id, promoted.expiresAt);
-    }
-    return promoted;
-  };
-
-  eventEmitter.on('PAYMENT.SUCCESS', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('SUCCESS', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-    if (options.onSuccess) options.onSuccess(data);
-  });
-  eventEmitter.on('PAYMENT.FAILED', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('FAILED', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-    if (options.onFailed) options.onFailed(data);
-  });
-  eventEmitter.on('PAYMENT.EXPIRED', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('EXPIRED', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-  });
-  eventEmitter.on('PAYMENT.CANCELLED', (data) => {
-    const session = sessionRepo.findById(data.paymentId);
-    if (session) {
-      webhookEngine.dispatch('CANCELLED', session).catch(() => {});
-      handleSlotFreedAndPromote(session.receivingAccountId);
-    }
-  });
-
-  recoveryEngine.recover();
-
-  const pipeline = new PaymentVerificationPipeline({
-    db, sessionRepo, obsRepo, customerRepo, attributionEngine, auditRepo, merchantRepo,
-    server: null, eventEmitter
-  });
-
-  const ctx = {
-    db, merchantRepo, accountRepo, customerRepo, customerSessionRepo, sessionRepo, deviceRepo,
-    obsRepo, ticketRepo, auditRepo, queueEngine, timingEngine, attributionEngine, pipeline,
-    recoveryEngine, eventEmitter, defaultMerchant, checkoutBaseUrl, webhookEngine,
-    otpCooldownMs: options.otpCooldownMs,
-    theme: options.theme || {}
-  };
-
-  const router = createRouter(ctx);
-
-  const destroy = () => {
-    timingEngine.destroy?.();
-    attributionEngine.destroy?.();
-  };
-
-  return {
-    router,
-    on: (event, cb) => eventEmitter.on(event, cb),
-    init: async () => {},
-    destroy,
-  };
-}
-
-export { createRouter };
-export default { elpay };
+import { EventEmitter } from 'node:events';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PaymentStatus } from './vendor/common/index.js';
+import {
+  getDatabase,
+  ensureDatabaseInitialized,
+  runMigrations,
+  MerchantRepository,
+  ReceivingAccountRepository,
+  CustomerRepository,
+  CustomerSessionRepository,
+  PaymentSessionRepository,
+  ObservationRepository,
+  SupportTicketRepository,
+  AuditLogRepository,
+  DeviceRepository
+} from './vendor/db/index.js';
+import {
+  QueueEngine,
+  TimingEngine,
+  AttributionEngine,
+  RecoveryEngine,
+  WebhookEngine,
+  PaymentVerificationPipeline
+} from './vendor/core/index.js';
+import { createRouter } from './router.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+export async function elpay(options = {}) {
+  const db = options.db || getDatabase(options.databaseUrl);
+  ensureDatabaseInitialized(db);
+  const { defaultMerchant } = runMigrations(db);
+
+  const merchantRepo = new MerchantRepository(db);
+  const accountRepo = new ReceivingAccountRepository(db);
+  const customerRepo = new CustomerRepository(db);
+  const customerSessionRepo = new CustomerSessionRepository(db, customerRepo);
+  const sessionRepo = new PaymentSessionRepository(db);
+  const obsRepo = new ObservationRepository(db);
+  const ticketRepo = new SupportTicketRepository(db);
+  const auditRepo = new AuditLogRepository(db);
+  const deviceRepo = new DeviceRepository(db);
+
+  const eventEmitter = new EventEmitter();
+
+  const parseWindowMs = (raw, fallback) => {
+    if (raw === undefined || raw === null || String(raw).trim() === '') return fallback;
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value <= 0 || value > 24 * 60 * 60 * 1000) return fallback;
+    return Math.floor(value);
+  };
+  const activeDurationMs = parseWindowMs(process.env.PAYMENT_ACTIVE_WINDOW_MS, 300000);
+  const processingDurationMs = parseWindowMs(process.env.PAYMENT_PROCESSING_WINDOW_MS, 30000);
+
+  const queueEngine = new QueueEngine({ sessionRepo, accountRepo, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
+  const timingEngine = new TimingEngine({ sessionRepo, queueEngine, eventEmitter, auditRepo, activeDurationMs, processingDurationMs });
+  const attributionEngine = new AttributionEngine({ sessionRepo, obsRepo, ticketRepo, auditRepo, eventEmitter });
+  const recoveryEngine = new RecoveryEngine({ db, sessionRepo, accountRepo, queueEngine, timingEngine, auditRepo, eventEmitter });
+  const webhookEngine = new WebhookEngine({ db, merchantRepo, maxRetries: Number(process.env.WEBHOOK_MAX_RETRIES || 5) });
+
+  const checkoutBaseUrl = options.baseUrl || process.env.BASE_CHECKOUT_URL || 'http://localhost:3000';
+
+  const handleSlotFreedAndPromote = (receivingAccountId) => {
+    if (!receivingAccountId) return null;
+    const promoted = queueEngine.promoteNext(receivingAccountId);
+    if (promoted) {
+      if (promoted.expiresAt) timingEngine.startActiveTimer(promoted.id, promoted.expiresAt);
+    }
+    return promoted;
+  };
+
+  eventEmitter.on('PAYMENT.SUCCESS', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('SUCCESS', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+    if (options.onSuccess) options.onSuccess(data);
+  });
+  eventEmitter.on('PAYMENT.FAILED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('FAILED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+    if (options.onFailed) options.onFailed(data);
+  });
+  eventEmitter.on('PAYMENT.EXPIRED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('EXPIRED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+  });
+  eventEmitter.on('PAYMENT.CANCELLED', (data) => {
+    const session = sessionRepo.findById(data.paymentId);
+    if (session) {
+      webhookEngine.dispatch('CANCELLED', session).catch(() => {});
+      handleSlotFreedAndPromote(session.receivingAccountId);
+    }
+  });
+
+  recoveryEngine.recover();
+
+  const pipeline = new PaymentVerificationPipeline({
+    db, sessionRepo, obsRepo, customerRepo, attributionEngine, auditRepo, merchantRepo,
+    server: null, eventEmitter
+  });
+
+  const ctx = {
+    db, merchantRepo, accountRepo, customerRepo, customerSessionRepo, sessionRepo, deviceRepo,
+    obsRepo, ticketRepo, auditRepo, queueEngine, timingEngine, attributionEngine, pipeline,
+    recoveryEngine, eventEmitter, defaultMerchant, checkoutBaseUrl, webhookEngine,
+    baseUrl: options.baseUrl || process.env.BASE_URL || 'http://localhost:5000',
+    otpCooldownMs: options.otpCooldownMs,
+    theme: options.theme || {}
+  };
+
+  const router = createRouter(ctx);
+
+  const destroy = () => {
+    timingEngine.destroy?.();
+    attributionEngine.destroy?.();
+  };
+
+  return {
+    router,
+    on: (event, cb) => eventEmitter.on(event, cb),
+    init: async () => {},
+    destroy,
+  };
+}
+
+export { createRouter };
+export default { elpay };

package/src/router.js

@@ -1,8 +1,10 @@
 import { Router } from 'express';
+import { server } from './sse.js';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import fs from 'node:fs';
 import express from 'express';
+import { getInternalServiceToken } from './vendor/common/index.js';
 import { registerPaymentRoutes } from './routes/payments.routes.js';
 import { registerCheckoutRoutes } from './routes/checkout.routes.js';
 import { registerPollerRoutes } from './routes/pollers.routes.js';
@@ -12,15 +14,60 @@ import { registerDeviceRoutes } from './routes/device.routes.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+function loadTemplateWithPartials() {
+  const viewsDir = path.resolve(__dirname, '..', 'public', 'views');
+  const partialsDir = path.resolve(viewsDir, 'partials');
+  let content = fs.readFileSync(path.join(viewsDir, 'checkout.html'), 'utf8');
+  content = content.replace(/<!--\s*include:partials\/([a-zA-Z0-9_\-.]+)\s*-->/g, (match, filename) => {
+    const partialPath = path.resolve(partialsDir, filename);
+    const relative = path.relative(partialsDir, partialPath);
+    const isSecure = relative && !relative.startsWith('..') && !path.isAbsolute(relative);
+    if (isSecure && fs.existsSync(partialPath)) {
+      return fs.readFileSync(partialPath, 'utf8');
+    }
+    return match;
+  });
+  return content;
+}
+
+function renderTemplate(template, values) {
+  const escapeHtml = (v) => (v === null || v === undefined) ? '' : String(v).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[ch]);
+  const escapeJs = (v) => (v === null || v === undefined) ? '' : String(v).replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r').replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
+  const scriptKeys = new Set(['PAYMENT_ID', 'API_BASE_URL', 'AMOUNT']);
+  return template.replace(/\{\{([A-Z0-9_]+)\}\}/g, (match, key) => {
+    if (!Object.prototype.hasOwnProperty.call(values, key)) return match;
+    const value = values[key];
+    return scriptKeys.has(key) ? escapeJs(value) : escapeHtml(value);
+  });
+}
+
+function serializeForScript(value) {
+  return JSON.stringify(value === undefined ? null : value)
+    .replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026')
+    .replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+}
+
+async function fetchCheckoutState(ctx, paymentId) {
+  try {
+    const base = (ctx.baseUrl || ctx.checkoutBaseUrl || 'http://127.0.0.1:5000').replace(/\/$/, '');
+    const token = getInternalServiceToken();
+    const res = await fetch(`${base}/api/v1/checkout/${encodeURIComponent(paymentId)}/state`, {
+      headers: { Authorization: `Bearer ${token}`, 'X-Internal-Render': 'true' },
+      signal: AbortSignal.timeout(4000)
+    });
+    if (res.ok) return await res.json();
+  } catch {}
+  return null;
+}
+
 export function createRouter(ctx = {}) {
   const router = Router();
   router.use(express.static(path.join(__dirname, '..', 'public')));
 
-  router.get('/checkout/:id', (req, res) => {
-    const htmlPath = path.join(__dirname, '..', 'public', 'views', 'checkout.html');
-    const html = fs.readFileSync(htmlPath, 'utf8')
-      .replace(/\{\{API_BASE_URL\}\}/g, ctx.baseUrl || 'http://localhost:5000')
-      .replace(/\{\{PAYMENT_ID\}\}/g, req.params.id);
+  router.get('/checkout/:id', async (req, res) => {
+    const paymentId = req.params.id;
+    const state = await fetchCheckoutState(ctx, paymentId);
+    const html = renderCheckoutPage(ctx, paymentId, state);
     res.type('html').send(html);
   });
 
@@ -50,4 +97,17 @@ export function createRouter(ctx = {}) {
   return router;
 }
 
+function renderCheckoutPage(ctx, paymentId, state) {
+  const template = loadTemplateWithPartials();
+  const values = {
+    PAYMENT_ID: paymentId,
+    API_BASE_URL: '',
+    APP_NAME: state?.branding?.appName || 'ELPAY PG',
+    MERCHANT_NAME: state?.merchantName || 'Merchant Checkout',
+    AMOUNT: state?.amount || '0.00',
+    INITIAL_STATE_JSON: serializeForScript(state || {})
+  };
+  return renderTemplate(template, values);
+}
+
 export default createRouter;

package/src/routes/admin.routes.js

@@ -1,4 +1,5 @@
-import crypto from 'node:crypto';
+import crypto from 'node:crypto';
+import { server } from '../sse.js';
 import { Router } from 'express';
 import { PaymentStatus, PaymentMethod, SellingMode, AuditActorType, isValidVpa, toRupeesString, deriveCloudflareRoutes, resolveRuntimeUrls, resolveGmailRedirectUri, createOAuthState, validateOutboundWebhookUrl } from '../vendor/common/index.js';
 import { PaymentVerificationPipeline } from '../vendor/core/index.js';
@@ -1120,10 +1121,7 @@ export function registerAdminRoutes(router, ctx) {
 
   // GET /api/v1/admin/stream (SSE for Live Admin Counter & Queue Events)
   router.get('/api/v1/admin/stream', async (req, res) => {
-    res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': '*' });
-    res.write('event: connected\ndata: {"status":"connected"}\n\n');
-    const _iv = setInterval(() => { try { res.write(': keepalive\n\n'); } catch {} }, 15000);
-    req.on('close', () => clearInterval(_iv));
+    server.initSse('admin_counter_events', res);
   });
 
   // --- WHATSAPP BERRY PROTOCOL MERCHANT SESSION CONFIGURATION ---

package/src/routes/checkout.routes.js

@@ -1,4 +1,5 @@
-import { Router } from 'express';
+import { Router } from 'express';
+import { server } from '../sse.js';
 import { toRupeesString, buildUpiUri, PaymentStatus, PaymentMethod, UPI_PROVIDERS, isInternalServiceRequest, isValidTransition } from '../vendor/common/index.js';
 import { validateSessionDeviceAccess, verifyRegisteredDeviceCredentials } from '../vendor/core/index.js';
 import { isPaymentOwner } from '../auth-guard.js';
@@ -1961,15 +1962,7 @@ export function registerCheckoutRoutes(router, ctx) {
       res.status(deviceAccess.statusCode || 409).json(deviceAccess.body);
       return;
     }
-    res.writeHead(200, {
-      'Content-Type': 'text/event-stream',
-      'Cache-Control': 'no-cache',
-      'Connection': 'keep-alive',
-      'Access-Control-Allow-Origin': '*'
-    });
-    res.write('event: connected\ndata: {"status":"connected"}\n\n');
-    const interval = setInterval(() => { try { res.write(': keepalive\n\n'); } catch {} }, 15000);
-    req.on('close', () => clearInterval(interval));
+    server.initSse(req.params.id, res);
   });
 
   router.get('/api/v1/checkout/:id/events', async (req, res) => {
@@ -1983,15 +1976,7 @@ export function registerCheckoutRoutes(router, ctx) {
       res.status(deviceAccess.statusCode || 409).json(deviceAccess.body);
       return;
     }
-    res.writeHead(200, {
-      'Content-Type': 'text/event-stream',
-      'Cache-Control': 'no-cache',
-      'Connection': 'keep-alive',
-      'Access-Control-Allow-Origin': '*'
-    });
-    res.write('event: connected\ndata: {"status":"connected"}\n\n');
-    const interval = setInterval(() => { try { res.write(': keepalive\n\n'); } catch {} }, 15000);
-    req.on('close', () => clearInterval(interval));
+    server.initSse(req.params.id, res);
   });
 }
 

package/src/sse.js

@@ -0,0 +1,44 @@
+const channels = new Map();
+
+export const server = {
+  initSse(topic, res) {
+    const headers = {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      'Connection': 'keep-alive',
+      'Access-Control-Allow-Origin': '*'
+    };
+    res.writeHead(200, headers);
+    res.write('event: connected\ndata: {"status":"connected"}\n\n');
+
+    if (!channels.has(topic)) channels.set(topic, new Set());
+    const set = channels.get(topic);
+    set.add(res);
+
+    const ping = setInterval(() => {
+      try { res.write(': keepalive\n\n'); } catch { clearInterval(ping); }
+    }, 15000);
+    if (ping.unref) ping.unref();
+
+    res.on('close', () => {
+      clearInterval(ping);
+      set.delete(res);
+      if (set.size === 0) channels.delete(topic);
+    });
+  },
+
+  broadcastSse(topic, event, data) {
+    const set = channels.get(topic);
+    if (!set || set.size === 0) return;
+    let safeJson;
+    try { safeJson = JSON.stringify(data, (k, v) => typeof v === 'bigint' ? v.toString() : v); } catch { safeJson = '{}'; }
+    const named = `event: ${event}\ndata: ${safeJson}\n\n`;
+    const def = `data: ${JSON.stringify({ type: event, ...data, event })}\n\n`;
+    const payload = named + def;
+    for (const r of set) {
+      try { r.write(payload); } catch { set.delete(r); }
+    }
+  }
+};
+
+export default server;