includio-cms 0.26.0 → 0.27.0

package/dist/db-postgres/schema/shop/payment.d.ts

@@ -1,4 +1,7 @@
 export type ShopPaymentStatus = 'pending' | 'paid' | 'failed' | 'refunded' | 'cancelled';
+/** `kind` distinguishes full / deposit / balance payment rows under paymentPolicy A-lite. */
+export declare const shopPaymentKindEnum: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgEnum<["full", "deposit", "balance"]>;
+export type ShopPaymentKind = 'full' | 'deposit' | 'balance';
 export declare const shopPaymentsTable: import("drizzle-orm/pg-core/table", { with: { "resolution-mode": "require" } }).PgTableWithColumns<{
     name: "shop_payments";
     schema: undefined;
@@ -90,6 +93,23 @@ export declare const shopPaymentsTable: import("drizzle-orm/pg-core/table", { wi
         }, {}, {
             $type: ShopPaymentStatus;
         }>;
+        kind: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "kind";
+            tableName: "shop_payments";
+            dataType: "string";
+            columnType: "PgEnumColumn";
+            data: "full" | "deposit" | "balance";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["full", "deposit", "balance"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         amount: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
             name: "amount";
             tableName: "shop_payments";

package/dist/db-postgres/schema/shop/payment.js

@@ -1,5 +1,7 @@
-import { integer, jsonb, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { integer, jsonb, pgEnum, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
 import { shopOrdersTable } from './order.js';
+/** `kind` distinguishes full / deposit / balance payment rows under paymentPolicy A-lite. */
+export const shopPaymentKindEnum = pgEnum('shop_payment_kind', ['full', 'deposit', 'balance']);
 export const shopPaymentsTable = pgTable('shop_payments', {
     id: uuid('id').primaryKey().defaultRandom(),
     orderId: uuid('order_id')
@@ -8,6 +10,7 @@ export const shopPaymentsTable = pgTable('shop_payments', {
     provider: text('provider').notNull(),
     providerRef: text('provider_ref'),
     status: text('status').$type().notNull().default('pending'),
+    kind: shopPaymentKindEnum('kind').notNull().default('full'),
     amount: integer('amount').notNull(),
     currency: text('currency').notNull(),
     raw: jsonb('raw'),

package/dist/db-postgres/schema/shop/product.d.ts

@@ -1,3 +1,4 @@
+import type { PaymentPolicy } from '../../../shop/types.js';
 export declare const shopProductsTable: import("drizzle-orm/pg-core/table", { with: { "resolution-mode": "require" } }).PgTableWithColumns<{
     name: "shop_products";
     schema: undefined;
@@ -121,6 +122,25 @@ export declare const shopProductsTable: import("drizzle-orm/pg-core/table", { wi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        paymentPolicy: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "payment_policy";
+            tableName: "shop_products";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: PaymentPolicy | null;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: PaymentPolicy | null;
+        }>;
         createdAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
             name: "created_at";
             tableName: "shop_products";

package/dist/db-postgres/schema/shop/product.js

@@ -1,4 +1,4 @@
-import { boolean, integer, numeric, pgTable, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { boolean, integer, jsonb, numeric, pgTable, timestamp, uuid } from 'drizzle-orm/pg-core';
 import { entriesTable } from '../entry.js';
 export const shopProductsTable = pgTable('shop_products', {
     id: uuid('id').primaryKey().defaultRandom(),
@@ -13,6 +13,8 @@ export const shopProductsTable = pgTable('shop_products', {
     sortOrder: integer('sort_order'),
     // Null = alert disabled. When stock decrement crosses threshold, fire-and-forget admin email.
     lowStockThreshold: integer('low_stock_threshold'),
+    // Per-product payment policy. Null = full payment (legacy).
+    paymentPolicy: jsonb('payment_policy').$type(),
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
     updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull()
 });

package/dist/db-postgres/schema/shop/productVariant.d.ts

@@ -1,3 +1,4 @@
+import type { VariantAttribute } from '../../../shop/types.js';
 export declare const shopProductVariantsTable: import("drizzle-orm/pg-core/table", { with: { "resolution-mode": "require" } }).PgTableWithColumns<{
     name: "shop_product_variants";
     schema: undefined;
@@ -111,7 +112,7 @@ export declare const shopProductVariantsTable: import("drizzle-orm/pg-core/table
             tableName: "shop_product_variants";
             dataType: "json";
             columnType: "PgJsonb";
-            data: Record<string, string>;
+            data: Record<string, unknown>;
             driverParam: unknown;
             notNull: false;
             hasDefault: false;
@@ -123,7 +124,7 @@ export declare const shopProductVariantsTable: import("drizzle-orm/pg-core/table
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: Record<string, string>;
+            $type: Record<string, unknown>;
         }>;
         sortOrder: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
             name: "sort_order";
@@ -162,3 +163,12 @@ export declare const shopProductVariantsTable: import("drizzle-orm/pg-core/table
     };
     dialect: "pg";
 }>;
+/**
+ * Build `CREATE INDEX IF NOT EXISTS … USING gin ((attributes->'<key>'))` DDL
+ * statements — one per attribute marked `indexable: true`. Drizzle's static
+ * schema can't capture user-defined variantAttributes, so apply these at shop
+ * bootstrap (or via the migration in `src/lib/updates/0.27.0`).
+ * Index name pattern: `shop_variant_attr_<key>_gin_idx`.
+ * @internal
+ */
+export declare function createVariantAttributeIndexes(attrs: Record<string, VariantAttribute>): string[];

package/dist/db-postgres/schema/shop/productVariant.js

@@ -14,3 +14,25 @@ export const shopProductVariantsTable = pgTable('shop_product_variants', {
     sortOrder: integer('sort_order'),
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull()
 });
+const SAFE_KEY = /^[a-zA-Z][a-zA-Z0-9_]*$/;
+/**
+ * Build `CREATE INDEX IF NOT EXISTS … USING gin ((attributes->'<key>'))` DDL
+ * statements — one per attribute marked `indexable: true`. Drizzle's static
+ * schema can't capture user-defined variantAttributes, so apply these at shop
+ * bootstrap (or via the migration in `src/lib/updates/0.27.0`).
+ * Index name pattern: `shop_variant_attr_<key>_gin_idx`.
+ * @internal
+ */
+export function createVariantAttributeIndexes(attrs) {
+    const stmts = [];
+    for (const [key, attr] of Object.entries(attrs)) {
+        if (!attr.indexable)
+            continue;
+        if (!SAFE_KEY.test(key)) {
+            throw new Error(`variantAttribute key "${key}" is not a safe SQL identifier (allowed: [A-Za-z][A-Za-z0-9_]*).`);
+        }
+        stmts.push(`CREATE INDEX IF NOT EXISTS shop_variant_attr_${key}_gin_idx ` +
+            `ON shop_product_variants USING gin ((attributes->'${key}'))`);
+    }
+    return stmts;
+}

package/dist/paraglide/messages/_index.d.ts

@@ -1,3 +1,36 @@
-export * from "./hello_world.js";
-export * from "./login_hello.js";
-export * from "./login_please_login.js";
+export function hello_world(inputs: {
+    name: NonNullable<unknown>;
+}, options?: {
+    locale?: "en" | "pl";
+}): string;
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+*
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+declare function login_hello(inputs?: {}, options?: {
+    locale?: "en" | "pl";
+}): string;
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+*
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+declare function login_please_login(inputs?: {}, options?: {
+    locale?: "en" | "pl";
+}): string;
+export { login_hello as login.hello, login_please_login as login.please_login };

package/dist/paraglide/messages/_index.js

@@ -1,4 +1,72 @@
 /* eslint-disable */
-export * from './hello_world.js'
-export * from './login_hello.js'
-export * from './login_please_login.js'
+import { getLocale, trackMessageCall, experimentalMiddlewareLocaleSplitting, isServer } from "../runtime.js"
+import * as en from "./en.js"
+import * as pl from "./pl.js"
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{ name: NonNullable<unknown> }} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+export const hello_world = (inputs, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.hello_world(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("hello_world", locale)
+	if (locale === "en") return en.hello_world(inputs)
+	return pl.hello_world(inputs)
+};
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+const login_hello = (inputs = {}, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.login_hello(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("login_hello", locale)
+	if (locale === "en") return en.login_hello(inputs)
+	return pl.login_hello(inputs)
+};
+export { login_hello as "login.hello" }
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+const login_please_login = (inputs = {}, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.login_please_login(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("login_please_login", locale)
+	if (locale === "en") return en.login_please_login(inputs)
+	return pl.login_please_login(inputs)
+};
+export { login_please_login as "login.please_login" }

package/dist/paraglide/messages/en.d.ts

@@ -0,0 +1,5 @@
+export const hello_world: (inputs: {
+    name: NonNullable<unknown>;
+}) => string;
+export const login_hello: (inputs: {}) => string;
+export const login_please_login: (inputs: {}) => string;

package/dist/paraglide/messages/en.js

@@ -0,0 +1,14 @@
+/* eslint-disable */
+
+
+export const hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
+	return `Hello, ${i.name} from en!`
+};
+
+export const login_hello = /** @type {(inputs: {}) => string} */ () => {
+	return `Welcome back`
+};
+
+export const login_please_login = /** @type {(inputs: {}) => string} */ () => {
+	return `Login to your account`
+};

package/dist/paraglide/messages/pl.d.ts

@@ -0,0 +1,5 @@
+export const hello_world: (inputs: {
+    name: NonNullable<unknown>;
+}) => string;
+export const login_hello: (inputs: {}) => string;
+export const login_please_login: (inputs: {}) => string;

package/dist/paraglide/messages/pl.js

@@ -0,0 +1,14 @@
+/* eslint-disable */
+
+
+export const hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
+	return `Hello, ${i.name} from pl!`
+};
+
+export const login_hello = /** @type {(inputs: {}) => string} */ () => {
+	return `Witaj ponownie`
+};
+
+export const login_please_login = /** @type {(inputs: {}) => string} */ () => {
+	return `Zaloguj się na swoje konto`
+};

package/dist/shop/cart/types.d.ts

@@ -5,6 +5,7 @@ export interface CartItemRef {
 }
 export interface CartLine extends CartItemRef {
     entryId: string;
+    productId: string;
     variantName: Record<string, string> | null;
     variantSku: string | null;
     productTitle: string | null;

package/dist/shop/client/index.d.ts

@@ -114,6 +114,34 @@ export interface RetryPaymentResult {
     requiresPaymentRedirect: boolean;
     redirectUrl: string | null;
 }
+/**
+ * Result of `orders.payBalance` — initiates a payment session for the
+ * outstanding balance on a deposit order.
+ * @public
+ */
+export interface PayBalanceResult {
+    status: 'redirect' | 'manual' | 'error';
+    requiresPaymentRedirect: boolean;
+    redirectUrl: string | null;
+}
+/**
+ * Public-facing variant row returned by `client.products.listUpcoming`.
+ * Mirrors the `shop_product_variants` schema with `priceDelta` decoded as
+ * the raw numeric(20,6) string and `attributes` as the typed map declared
+ * in `defineShop({ variantAttributes })`.
+ * @public
+ */
+export interface VariantPublic {
+    id: string;
+    productId: string;
+    sku: string | null;
+    name: Record<string, string> | null;
+    priceDelta: string;
+    stock: number | null;
+    attributes: Record<string, unknown> | null;
+    sortOrder: number | null;
+    createdAt: string;
+}
 /**
  * Headless shop SDK surface returned by `createShopClient()`.
  *
@@ -124,6 +152,21 @@ export interface RetryPaymentResult {
  * @public
  */
 export interface ShopClient {
+    /** Product / variant discovery. */
+    products: {
+        /**
+         * List upcoming (non-expired) variants for a product. When
+         * `defineShop({ variantExpiry })` is not configured this returns
+         * every variant; otherwise variants whose datetime attribute has
+         * already passed (per `offsetDays`) are filtered out and the
+         * remainder are sorted ascending by that attribute.
+         *
+         * @param productId - The shop product id (UUID).
+         */
+        listUpcoming(productId: string): Promise<{
+            items: VariantPublic[];
+        }>;
+    };
     /** Cart operations — read state and mutate items / coupon. */
     cart: {
         /**
@@ -201,6 +244,17 @@ export interface ShopClient {
          * re-fill the checkout form.
          */
         retryPayment(orderNumber: string, token?: string): Promise<RetryPaymentResult>;
+        /**
+         * Pay the outstanding balance on a deposit-policy order. `token` is
+         * the signed balance token from the admin-generated balance link;
+         * the server returns a redirect URL when the payment provider needs
+         * to take over, or `paymentStatus: 'manual'` for manual methods.
+         *
+         * @param orderNumber - The order number from the balance link.
+         * @param token - Signed balance token (query parameter on the link).
+         * @experimental
+         */
+        payBalance(orderNumber: string, token: string): Promise<PayBalanceResult>;
     };
 }
 /**

package/dist/shop/client/index.js

@@ -59,6 +59,9 @@ export function createShopClient(options = {}) {
         return (await res.json());
     }
     return {
+        products: {
+            listUpcoming: (productId) => call('GET', `/api/shop/products/${encodeURIComponent(productId)}/variants/upcoming`)
+        },
         cart: {
             get: () => call('GET', '/api/shop/cart'),
             add: (variantId, qty = 1) => call('POST', '/api/shop/cart', { variantId, qty }),
@@ -77,7 +80,8 @@ export function createShopClient(options = {}) {
         orders: {
             get: (orderNumber, token) => call('GET', `/api/shop/orders/${encodeURIComponent(orderNumber)}${tokenQuery(token)}`),
             refreshPayment: (orderNumber, token) => call('POST', `/api/shop/orders/${encodeURIComponent(orderNumber)}/refresh-payment${tokenQuery(token)}`),
-            retryPayment: (orderNumber, token) => call('POST', `/api/shop/orders/${encodeURIComponent(orderNumber)}/retry-payment${tokenQuery(token)}`)
+            retryPayment: (orderNumber, token) => call('POST', `/api/shop/orders/${encodeURIComponent(orderNumber)}/retry-payment${tokenQuery(token)}`),
+            payBalance: (orderNumber, token) => call('POST', `/api/shop/orders/${encodeURIComponent(orderNumber)}/balance?token=${encodeURIComponent(token)}`, {})
         }
     };
 }

package/dist/shop/expiry.d.ts

@@ -0,0 +1,35 @@
+import type { VariantExpiryConfig } from './types.js';
+/**
+ * Thrown by `createOrderFromCart` / cart-add HTTP guard when a referenced
+ * variant has already expired under the configured `variantExpiry`. The
+ * `code` is `VARIANT_EXPIRED` and `variantId` identifies the offending row.
+ * @public
+ */
+export declare class VariantExpiredError extends Error {
+    readonly code = "VARIANT_EXPIRED";
+    readonly variantId: string;
+    constructor(variantId: string);
+}
+interface VariantLike {
+    attributes: Record<string, unknown> | null;
+}
+/**
+ * Check whether a variant has expired under the given config. Fail-open by
+ * design: `null` config, missing source attribute, non-string value, or
+ * malformed datetime all return `false` — only a parseable past datetime
+ * counts as expired. Malformed datetimes emit `console.warn` so authoring
+ * issues surface in dev without blocking checkout.
+ *
+ * @param variant - Object with an `attributes` map (e.g. `shop_product_variants.attributes`).
+ * @param config - Result of `defineShop({ variantExpiry })`, or `null` when not configured.
+ * @param now - Override the current time (test seam). Defaults to `Date.now()`.
+ * @public
+ */
+export declare function isVariantExpired(variant: VariantLike, config: VariantExpiryConfig | null, now?: Date): boolean;
+/**
+ * Return the subset of `variants` that have not yet expired. Order is
+ * preserved. `null` config = passthrough.
+ * @public
+ */
+export declare function filterUpcoming<T extends VariantLike>(variants: T[], config: VariantExpiryConfig | null, now?: Date): T[];
+export {};

package/dist/shop/expiry.js

@@ -0,0 +1,68 @@
+/**
+ * Thrown by `createOrderFromCart` / cart-add HTTP guard when a referenced
+ * variant has already expired under the configured `variantExpiry`. The
+ * `code` is `VARIANT_EXPIRED` and `variantId` identifies the offending row.
+ * @public
+ */
+export class VariantExpiredError extends Error {
+    code = 'VARIANT_EXPIRED';
+    variantId;
+    constructor(variantId) {
+        super(`Variant ${variantId} has expired`);
+        this.name = 'VariantExpiredError';
+        this.variantId = variantId;
+    }
+}
+/**
+ * Add `offsetDays` to an ISO-8601 datetime and return the resulting `Date`.
+ * Returns `null` on malformed input (caller decides fail-open vs throw).
+ * @internal
+ */
+function addDaysIso(iso, offsetDays) {
+    const ts = Date.parse(iso);
+    if (Number.isNaN(ts))
+        return null;
+    return new Date(ts + offsetDays * 86_400_000);
+}
+/**
+ * Check whether a variant has expired under the given config. Fail-open by
+ * design: `null` config, missing source attribute, non-string value, or
+ * malformed datetime all return `false` — only a parseable past datetime
+ * counts as expired. Malformed datetimes emit `console.warn` so authoring
+ * issues surface in dev without blocking checkout.
+ *
+ * @param variant - Object with an `attributes` map (e.g. `shop_product_variants.attributes`).
+ * @param config - Result of `defineShop({ variantExpiry })`, or `null` when not configured.
+ * @param now - Override the current time (test seam). Defaults to `Date.now()`.
+ * @public
+ */
+export function isVariantExpired(variant, config, now = new Date(Date.now())) {
+    if (!config)
+        return false;
+    const attrs = variant.attributes;
+    if (!attrs)
+        return false;
+    const raw = attrs[config.source];
+    if (raw === undefined || raw === null)
+        return false;
+    if (typeof raw !== 'string') {
+        console.warn(`[variantExpiry] attribute "${config.source}" is not a string (got ${typeof raw}); treating variant as upcoming`);
+        return false;
+    }
+    const cutoff = addDaysIso(raw, config.offsetDays);
+    if (!cutoff) {
+        console.warn(`[variantExpiry] attribute "${config.source}" is not a parseable datetime ("${raw}"); treating variant as upcoming`);
+        return false;
+    }
+    return cutoff.getTime() < now.getTime();
+}
+/**
+ * Return the subset of `variants` that have not yet expired. Order is
+ * preserved. `null` config = passthrough.
+ * @public
+ */
+export function filterUpcoming(variants, config, now) {
+    if (!config)
+        return variants;
+    return variants.filter((v) => !isVariantExpired(v, config, now));
+}

package/dist/shop/http/balance-handler.d.ts

@@ -0,0 +1,20 @@
+import { type RequestHandler } from '@sveltejs/kit';
+/**
+ * @experimental
+ * HTTP handlers for the balance-payment flow. Mount at
+ * `/api/shop/orders/[number]/balance` (or any URL containing `number` +
+ * `?token=...`).
+ *
+ * - `GET` returns the minimal public order view (amount due, currency)
+ *   when the token + balanceOwed check passes.
+ * - `POST` initiates a payment session for the outstanding balance using
+ *   the order's original payment adapter and returns `{ redirectUrl,
+ *   status }`.
+ *
+ * Both verbs return 403 when the token is invalid OR `balanceOwed` is
+ * false (no oracle distinction — we don't tell the caller which gate failed).
+ */
+export declare function createBalanceHandler(): {
+    GET: RequestHandler;
+    POST: RequestHandler;
+};

package/dist/shop/http/balance-handler.js

@@ -0,0 +1,91 @@
+import { json } from '@sveltejs/kit';
+import { getCMS } from '../../core/cms.js';
+import { createBalanceSession, requireBalanceTokenSecret, verifyBalanceToken } from '../server/balance-payment.js';
+import { getOrderByNumber } from '../server/orders.js';
+function shopEnabled() {
+    try {
+        return getCMS().shopConfig !== null;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * @experimental
+ * HTTP handlers for the balance-payment flow. Mount at
+ * `/api/shop/orders/[number]/balance` (or any URL containing `number` +
+ * `?token=...`).
+ *
+ * - `GET` returns the minimal public order view (amount due, currency)
+ *   when the token + balanceOwed check passes.
+ * - `POST` initiates a payment session for the outstanding balance using
+ *   the order's original payment adapter and returns `{ redirectUrl,
+ *   status }`.
+ *
+ * Both verbs return 403 when the token is invalid OR `balanceOwed` is
+ * false (no oracle distinction — we don't tell the caller which gate failed).
+ */
+export function createBalanceHandler() {
+    return {
+        GET: async ({ params, url }) => {
+            if (!shopEnabled())
+                return json({ error: 'Shop not enabled' }, { status: 404 });
+            const orderNumber = params.number;
+            if (!orderNumber)
+                return json({ error: 'Order number required' }, { status: 400 });
+            const token = url.searchParams.get('token') ?? '';
+            const order = await getOrderByNumber(orderNumber);
+            if (!order)
+                return json({ error: 'Order not found' }, { status: 404 });
+            if (!order.balanceOwed || !order.partialPayment) {
+                return json({ error: 'No outstanding balance' }, { status: 403 });
+            }
+            const secret = requireBalanceTokenSecret();
+            if (!verifyBalanceToken(token, order.id, secret)) {
+                return json({ error: 'Invalid token' }, { status: 403 });
+            }
+            const pp = order.partialPayment;
+            return json({
+                orderNumber: order.number,
+                currency: order.currency,
+                totalGross: order.totalGross,
+                amountToPay: pp.balanceAmount,
+                paidAmount: pp.paidAmount,
+                paymentMethod: order.paymentMethod,
+                language: order.language
+            });
+        },
+        POST: async ({ params, url, request, getClientAddress }) => {
+            if (!shopEnabled())
+                return json({ error: 'Shop not enabled' }, { status: 404 });
+            const orderNumber = params.number;
+            if (!orderNumber)
+                return json({ error: 'Order number required' }, { status: 400 });
+            const token = url.searchParams.get('token') ?? '';
+            let customerIp;
+            try {
+                customerIp = getClientAddress();
+            }
+            catch {
+                customerIp = undefined;
+            }
+            const body = (await request.json().catch(() => ({})));
+            const language = typeof body.language === 'string' ? body.language : undefined;
+            try {
+                const result = await createBalanceSession(orderNumber, token, { customerIp, language });
+                return json({
+                    status: result.status,
+                    redirectUrl: result.redirectUrl ?? null,
+                    requiresPaymentRedirect: result.status === 'redirect'
+                });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : 'Balance payment failed';
+                const code = message === 'Invalid balance token' || message === 'Order has no outstanding balance'
+                    ? 403
+                    : 400;
+                return json({ error: message }, { status: code });
+            }
+        }
+    };
+}