vona-module-pay-paypal 5.0.2 → 5.0.4

package/dist/bean/payProvider.paypal.d.ts

@@ -1,5 +1,6 @@
 import type { IDecoratorPayProviderOptions, IPayProviderClientOptions, IPayProviderClientRecord, IPayProviderExecute, IPayProviderPaymentInput, IPayProviderPaymentSnapshot, IPayProviderRefundInput, IPayProviderRefundSnapshot, IPayProviderVerifiedWebhook, IPayProviderWebhookInput } from 'vona-module-a-pay';
 import { BeanBase } from 'vona';
+import type { IPaypalGateway } from '../lib/paypalGateway.ts';
 export interface IPayProviderPaypalClientRecord extends IPayProviderClientRecord {
 }
 export interface IPayProviderPaypalClientOptions extends IPayProviderClientOptions {
@@ -8,14 +9,26 @@ export interface IPayProviderPaypalClientOptions extends IPayProviderClientOptio
         clientSecret: string | undefined;
     };
     webhookId: string | undefined;
+    gateway?: IPaypalGateway;
 }
 export interface IPayProviderOptionsPaypal extends IDecoratorPayProviderOptions<IPayProviderPaypalClientRecord, IPayProviderPaypalClientOptions> {
 }
 export declare class PayProviderPaypal extends BeanBase implements IPayProviderExecute<IPayProviderPaypalClientOptions> {
-    startPayment(_input: IPayProviderPaymentInput, _clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderPaymentSnapshot>;
-    queryPayment(_input: IPayProviderPaymentInput, _clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderPaymentSnapshot>;
-    createRefund(_input: IPayProviderRefundInput, _clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderRefundSnapshot>;
-    verifyWebhook(_input: IPayProviderWebhookInput, _clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderVerifiedWebhook>;
+    startPayment(input: IPayProviderPaymentInput, clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderPaymentSnapshot>;
+    confirmPayment(input: IPayProviderPaymentInput, clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderPaymentSnapshot>;
+    queryPayment(input: IPayProviderPaymentInput, clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderPaymentSnapshot>;
+    createRefund(input: IPayProviderRefundInput, clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderRefundSnapshot>;
+    queryRefund(input: IPayProviderRefundInput, clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderRefundSnapshot>;
+    verifyWebhook(input: IPayProviderWebhookInput, clientOptions: IPayProviderPaypalClientOptions): Promise<IPayProviderVerifiedWebhook>;
+    private _mapWebhook;
+    private _inputFromOrder;
+    private _mapOrder;
+    private _mapRefund;
+    private _gateway;
+    private _gatewayOptions;
+    private _throwGatewayError;
+    private _assertReady;
+    private _assertMerchant;
 }
 declare module 'vona-module-a-pay' {
     interface IPayProviderRecord {

package/dist/bean/payProvider.paypal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payProvider.paypal.d.ts","sourceRoot":"","sources":["../../src/bean/payProvider.paypal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,QAAQ,EAAU,MAAM,MAAM,CAAC;AAGxC,MAAM,WAAW,8BAA+B,SAAQ,wBAAwB;CAAG;AAEnF,MAAM,WAAW,+BAAgC,SAAQ,yBAAyB;IAChF,gBAAgB,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACrF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAID,MAAM,WAAW,yBAA0B,SAAQ,4BAA4B,CAC7E,8BAA8B,EAC9B,+BAA+B,CAChC;CAAG;AAEJ,qBAuBa,iBACX,SAAQ,QACR,YAAW,mBAAmB,CAAC,+BAA+B,CAAC;IAEzD,YAAY,CAChB,MAAM,EAAE,wBAAwB,EAChC,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,2BAA2B,CAAC;IAIjC,YAAY,CAChB,MAAM,EAAE,wBAAwB,EAChC,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,2BAA2B,CAAC;IAIjC,YAAY,CAChB,MAAM,EAAE,uBAAuB,EAC/B,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,0BAA0B,CAAC;IAIhC,aAAa,CACjB,MAAM,EAAE,wBAAwB,EAChC,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,2BAA2B,CAAC;CAGxC;AAED,OAAO,QAAQ,mBAAmB,CAAC;IACjC,UAAiB,kBAAkB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC;KAChD;CACF"}
+{"version":3,"file":"payProvider.paypal.d.ts","sourceRoot":"","sources":["../../src/bean/payProvider.paypal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,QAAQ,EAAU,MAAM,MAAM,CAAC;AAIxC,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,yBAAyB,CAAC;AAIrF,MAAM,WAAW,8BAA+B,SAAQ,wBAAwB;CAAG;AAEnF,MAAM,WAAW,+BAAgC,SAAQ,yBAAyB;IAChF,gBAAgB,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACrF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AASD,MAAM,WAAW,yBAA0B,SAAQ,4BAA4B,CAC7E,8BAA8B,EAC9B,+BAA+B,CAChC;CAAG;AAEJ,qBAwBa,iBACX,SAAQ,QACR,YAAW,mBAAmB,CAAC,+BAA+B,CAAC;IAEzD,YAAY,CAChB,KAAK,EAAE,wBAAwB,EAC/B,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,2BAA2B,CAAC;IA0CjC,cAAc,CAClB,KAAK,EAAE,wBAAwB,EAC/B,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,2BAA2B,CAAC;IAajC,YAAY,CAChB,KAAK,EAAE,wBAAwB,EAC/B,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,2BAA2B,CAAC;IASjC,YAAY,CAChB,KAAK,EAAE,uBAAuB,EAC9B,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,0BAA0B,CAAC;IAoBhC,WAAW,CACf,KAAK,EAAE,uBAAuB,EAC9B,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,0BAA0B,CAAC;IAahC,aAAa,CACjB,KAAK,EAAE,wBAAwB,EAC/B,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,2BAA2B,CAAC;YAezB,WAAW;IA+EzB,OAAO,CAAC,eAAe;IAqBvB,OAAO,CAAC,SAAS;IAkEjB,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,eAAe;CAaxB;AAuED,OAAO,QAAQ,mBAAmB,CAAC;IACjC,UAAiB,kBAAkB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC;KAChD;CACF"}

package/dist/index.js

@@ -1,21 +1,393 @@
+import { PaymentsController, OrdersController, Client, Environment, CheckoutPaymentIntent, OrderStatus } from '@cabloy/paypal-server-sdk';
 import { useApp, BeanInfo, BeanBase, BeanScopeBase } from 'vona';
 import { __decorate } from 'tslib';
 import { PayProvider } from 'vona-module-a-pay';
+import { z } from 'zod';
 import { Scope } from 'vona-module-a-bean';
 
+class PaypalGatewayError extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = void 0;
+    this.status = status;
+  }
+}
+function createPaypalGateway(fetcher) {
+  return {
+    async createOrder(options, input) {
+      return (await new OrdersController(createClient(options)).createOrder(input)).result;
+    },
+    async captureOrder(options, input) {
+      return (await new OrdersController(createClient(options)).captureOrder(input)).result;
+    },
+    async getOrder(options, input) {
+      return (await new OrdersController(createClient(options)).getOrder(input)).result;
+    },
+    async refundCapturedPayment(options, input) {
+      return (await new PaymentsController(createClient(options)).refundCapturedPayment(input)).result;
+    },
+    async getRefund(options, input) {
+      return (await new PaymentsController(createClient(options)).getRefund(input)).result;
+    },
+    async verifyWebhookSignature(options, input) {
+      const transmissionId = getHeader(input.headers, 'paypal-transmission-id');
+      const transmissionTime = getHeader(input.headers, 'paypal-transmission-time');
+      const certUrl = getHeader(input.headers, 'paypal-cert-url');
+      const authAlgo = getHeader(input.headers, 'paypal-auth-algo');
+      const transmissionSig = getHeader(input.headers, 'paypal-transmission-sig');
+      if (!transmissionId || !transmissionTime || !certUrl || !authAlgo || !transmissionSig) {
+        throw new PaypalGatewayError(401, 'PayPal webhook transmission headers are invalid');
+      }
+      const apiBaseUrl = options.environment === 'sandbox' ? 'https://api-m.sandbox.paypal.com' : 'https://api-m.paypal.com';
+      const tokenResponse = await fetcher(`${apiBaseUrl}/v1/oauth2/token`, {
+        method: 'POST',
+        headers: {
+          'authorization': `Basic ${Buffer.from(`${options.clientId}:${options.clientSecret}`).toString('base64')}`,
+          'content-type': 'application/x-www-form-urlencoded'
+        },
+        body: 'grant_type=client_credentials'
+      });
+      const token = asRecord$1(tokenResponse.ok ? await tokenResponse.json() : undefined);
+      const accessToken = readString$1(token.access_token);
+      if (!accessToken) {
+        throw new PaypalGatewayError(401, 'PayPal webhook verification authentication failed');
+      }
+      const response = await fetcher(`${apiBaseUrl}/v1/notifications/verify-webhook-signature`, {
+        method: 'POST',
+        headers: {
+          'authorization': `Bearer ${accessToken}`,
+          'content-type': 'application/json'
+        },
+        body: JSON.stringify({
+          auth_algo: authAlgo,
+          cert_url: certUrl,
+          transmission_id: transmissionId,
+          transmission_sig: transmissionSig,
+          transmission_time: transmissionTime,
+          webhook_id: options.webhookId,
+          webhook_event: input.body
+        })
+      });
+      if (!response.ok) throw new PaypalGatewayError(401, 'PayPal webhook verification failed');
+      const result = asRecord$1(await response.json());
+      if (readString$1(result.verification_status) !== 'SUCCESS') {
+        throw new PaypalGatewayError(401, 'PayPal webhook signature is invalid');
+      }
+    }
+  };
+}
+function createClient(options) {
+  return new Client({
+    clientCredentialsAuthCredentials: {
+      oAuthClientId: options.clientId,
+      oAuthClientSecret: options.clientSecret
+    },
+    timeout: 0,
+    environment: options.environment === 'live' ? Environment.Production : Environment.Sandbox
+  });
+}
+function asRecord$1(value) {
+  return value && typeof value === 'object' ? value : {};
+}
+function readString$1(value) {
+  return typeof value === 'string' && value ? value : undefined;
+}
+function getHeader(headers, key) {
+  const value = headers[key];
+  return Array.isArray(value) ? value[0] : value;
+}
+
 const app = useApp();
+const PaypalWebhookSchema = z.object({
+  id: z.string().min(1).max(255),
+  event_type: z.string().min(1).max(255),
+  resource: z.record(z.string(), z.unknown())
+});
 let PayProviderPaypal = class PayProviderPaypal extends BeanBase {
-  async startPayment(_input, _clientOptions) {
-    this.app.throw(501, 'PayPal provider is not configured');
+  async startPayment(input, clientOptions) {
+    if (input.providerOrderId) return await this.queryPayment(input, clientOptions);
+    if (!input.returnUrl || !input.cancelUrl) {
+      this.app.throw(422, 'PayPal payment requires return and cancel URLs');
+    }
+    this._assertReady(clientOptions);
+    const order = await this._gateway(clientOptions).createOrder(this._gatewayOptions(clientOptions), {
+      paypalRequestId: input.idempotencyKey,
+      body: {
+        intent: CheckoutPaymentIntent.Capture,
+        applicationContext: {
+          returnUrl: input.returnUrl,
+          cancelUrl: input.cancelUrl
+        },
+        purchaseUnits: [{
+          customId: String(input.paymentSessionId),
+          invoiceId: input.businessReference,
+          amount: {
+            currencyCode: input.currency,
+            value: formatMinorAmount(input.amountMinor, input.currency)
+          }
+        }]
+      }
+    });
+    const orderRecord = asRecord(order);
+    const approvalUrl = readString(asArray(orderRecord.links).map(asRecord).find(item => item.rel === 'approve')?.href);
+    const orderId = readString(orderRecord.id);
+    if (!orderId || !approvalUrl) this.app.throw(502, 'PayPal did not return an approval order');
+    return {
+      state: 'requires_action',
+      providerPaymentId: orderId,
+      providerOrderId: orderId,
+      nextAction: {
+        kind: 'redirect',
+        url: approvalUrl
+      }
+    };
+  }
+  async confirmPayment(input, clientOptions) {
+    this._assertReady(clientOptions);
+    if (!input.providerOrderId) this.app.throw(409, 'PayPal payment has no provider order');
+    const order = await this._gateway(clientOptions).captureOrder(this._gatewayOptions(clientOptions), {
+      id: input.providerOrderId,
+      paypalRequestId: input.idempotencyKey
+    });
+    return this._mapOrder(order, input, clientOptions);
+  }
+  async queryPayment(input, clientOptions) {
+    this._assertReady(clientOptions);
+    if (!input.providerOrderId) this.app.throw(409, 'PayPal payment has no provider order');
+    const order = await this._gateway(clientOptions).getOrder(this._gatewayOptions(clientOptions), {
+      id: input.providerOrderId
+    });
+    return this._mapOrder(order, input, clientOptions);
+  }
+  async createRefund(input, clientOptions) {
+    this._assertReady(clientOptions);
+    const refund = await this._gateway(clientOptions).refundCapturedPayment(this._gatewayOptions(clientOptions), {
+      captureId: input.providerCaptureId,
+      paypalRequestId: input.idempotencyKey,
+      body: {
+        amount: {
+          currencyCode: input.currency,
+          value: formatMinorAmount(input.amountMinor, input.currency)
+        },
+        customId: String(input.refundOperationId),
+        invoiceId: input.businessReference
+      }
+    });
+    return this._mapRefund(refund, input, clientOptions);
+  }
+  async queryRefund(input, clientOptions) {
+    this._assertReady(clientOptions);
+    if (!input.providerRefundId) this.app.throw(409, 'PayPal refund has no provider refund identifier');
+    const refund = await this._gateway(clientOptions).getRefund(this._gatewayOptions(clientOptions), {
+      refundId: input.providerRefundId
+    });
+    return this._mapRefund(refund, input, clientOptions);
+  }
+  async verifyWebhook(input, clientOptions) {
+    this._assertReady(clientOptions);
+    const webhook = PaypalWebhookSchema.safeParse(input.body);
+    if (!webhook.success) this.app.throw(400, 'PayPal webhook is invalid');
+    try {
+      await this._gateway(clientOptions).verifyWebhookSignature(this._gatewayOptions(clientOptions), input);
+    } catch (error) {
+      this._throwGatewayError(error);
+    }
+    return await this._mapWebhook(webhook.data, clientOptions);
+  }
+  async _mapWebhook(event, clientOptions) {
+    const resource = event.resource;
+    const amount = parsePaypalAmount(resource.amount);
+    const currency = parsePaypalCurrency(resource.amount);
+    const resourceId = readString(resource.id);
+    if (!resourceId || !amount || !currency) this.app.throw(400, 'PayPal webhook has invalid resource');
+    if (isRefundEvent(event.event_type)) {
+      const refundOperationId = readString(readField(resource, 'customId', 'custom_id'));
+      const captureId = readNestedString(resource, ['supplementary_data', 'related_ids', 'capture_id']);
+      if (!refundOperationId || !captureId) this.app.throw(400, 'PayPal refund webhook is not correlated');
+      const refund = await this.$scope.pay.model.refundOperation.getById(refundOperationId);
+      if (!refund) this.app.throw(404, 'PayPal refund operation not found');
+      const session = await this.$scope.pay.model.paymentSession.getById(refund.paymentSessionId);
+      if (!session || session.providerCaptureId !== captureId) {
+        this.app.throw(409, 'PayPal refund webhook capture conflicts');
+      }
+      const snapshot = this._mapRefund(resource, {
+        paymentSessionId: session.id,
+        refundOperationId: refund.id,
+        businessReference: refund.businessReference,
+        idempotencyKey: '',
+        amountMinor: refund.amountMinor,
+        currency: refund.currency,
+        providerCaptureId: captureId,
+        providerRefundId: resourceId
+      }, clientOptions);
+      return {
+        eventId: event.id,
+        eventType: event.event_type,
+        refundOperationId: refund.id,
+        refund: snapshot,
+        summary: {
+          amountMinor: amount,
+          currency
+        }
+      };
+    }
+    if (event.event_type.startsWith('PAYMENT.CAPTURE.')) {
+      const orderId = readNestedString(resource, ['supplementaryData', 'relatedIds', 'orderId']);
+      if (!orderId) this.app.throw(400, 'PayPal capture webhook has no order identifier');
+      const order = await this._gateway(clientOptions).getOrder(this._gatewayOptions(clientOptions), {
+        id: orderId
+      });
+      const input = this._inputFromOrder(order, orderId);
+      const payment = this._mapOrder(order, input, clientOptions);
+      if (!['succeeded', 'failed', 'cancelled'].includes(payment.state)) {
+        this.app.throw(400, 'PayPal capture webhook is not terminal');
+      }
+      if (payment.providerCaptureId && payment.providerCaptureId !== resourceId) {
+        this.app.throw(409, 'PayPal capture webhook conflicts with order capture');
+      }
+      return {
+        eventId: event.id,
+        eventType: event.event_type,
+        paymentSessionId: input.paymentSessionId,
+        payment,
+        summary: {
+          amountMinor: amount,
+          currency
+        }
+      };
+    }
+    this.app.throw(400, 'PayPal webhook event type is unsupported');
+  }
+  _inputFromOrder(order, providerOrderId) {
+    const orderRecord = asRecord(order);
+    const unit = asArray(readField(orderRecord, 'purchaseUnits', 'purchase_units'))[0];
+    const unitRecord = asRecord(unit);
+    const customId = readString(readField(unitRecord, 'customId', 'custom_id'));
+    const businessReference = readString(readField(unitRecord, 'invoiceId', 'invoice_id'));
+    const amountMinor = parsePaypalAmount(readField(unitRecord, 'amount'));
+    const currency = parsePaypalCurrency(readField(unitRecord, 'amount'));
+    if (!customId || !businessReference || amountMinor === undefined || !currency) {
+      this.app.throw(400, 'PayPal order is not correlated');
+    }
+    return {
+      paymentSessionId: customId,
+      businessReference,
+      idempotencyKey: '',
+      amountMinor,
+      currency,
+      providerOrderId
+    };
   }
-  async queryPayment(_input, _clientOptions) {
-    this.app.throw(501, 'PayPal provider is not configured');
+  _mapOrder(order, input, clientOptions) {
+    const orderRecord = asRecord(order);
+    const orderId = readString(orderRecord.id);
+    if (!orderId || orderId !== input.providerOrderId) {
+      this.app.throw(409, 'PayPal order identifier conflicts');
+    }
+    const units = asArray(readField(orderRecord, 'purchaseUnits', 'purchase_units'));
+    if (units.length !== 1) this.app.throw(409, 'PayPal order has an invalid purchase-unit count');
+    const unit = asRecord(units[0]);
+    if (readString(readField(unit, 'customId', 'custom_id')) !== String(input.paymentSessionId) || readString(readField(unit, 'invoiceId', 'invoice_id')) !== input.businessReference || parsePaypalAmount(readField(unit, 'amount')) !== input.amountMinor || parsePaypalCurrency(readField(unit, 'amount')) !== input.currency) {
+      this.app.throw(409, 'PayPal order facts conflict with the payment session');
+    }
+    this._assertMerchant(unit, clientOptions);
+    const captures = asArray(readField(asRecord(readField(unit, 'payments')), 'captures'));
+    if (captures.length > 1) this.app.throw(409, 'PayPal order has multiple captures');
+    const capture = asRecord(captures[0]);
+    const captureId = readString(capture.id);
+    const captureStatus = readString(capture.status);
+    if (captureId) {
+      if (parsePaypalAmount(capture.amount) !== input.amountMinor || parsePaypalCurrency(capture.amount) !== input.currency) {
+        this.app.throw(409, 'PayPal capture facts conflict with the payment session');
+      }
+      if (captureStatus === 'COMPLETED') {
+        return {
+          state: 'succeeded',
+          providerPaymentId: orderId,
+          providerOrderId: orderId,
+          providerCaptureId: captureId,
+          nextAction: {
+            kind: 'completed'
+          }
+        };
+      }
+      if (captureStatus === 'FAILED' || captureStatus === 'DECLINED') {
+        return {
+          state: 'failed',
+          providerPaymentId: orderId,
+          providerOrderId: orderId,
+          providerCaptureId: captureId
+        };
+      }
+      if (captureStatus === 'PENDING') {
+        return {
+          state: 'processing',
+          providerPaymentId: orderId,
+          providerOrderId: orderId,
+          providerCaptureId: captureId
+        };
+      }
+    }
+    if (orderRecord.status === OrderStatus.Voided) {
+      return {
+        state: 'cancelled',
+        providerPaymentId: orderId,
+        providerOrderId: orderId
+      };
+    }
+    return {
+      state: 'requires_action',
+      providerPaymentId: orderId,
+      providerOrderId: orderId
+    };
   }
-  async createRefund(_input, _clientOptions) {
-    this.app.throw(501, 'PayPal provider is not configured');
+  _mapRefund(refund, input, clientOptions) {
+    const record = asRecord(refund);
+    const providerRefundId = readString(record.id);
+    if (!providerRefundId) this.app.throw(502, 'PayPal refund returned no identifier');
+    if (input.providerRefundId && input.providerRefundId !== providerRefundId || readString(readField(record, 'customId', 'custom_id')) !== String(input.refundOperationId) || readString(readField(record, 'invoiceId', 'invoice_id')) !== input.businessReference || parsePaypalAmount(record.amount) !== input.amountMinor || parsePaypalCurrency(record.amount) !== input.currency) {
+      this.app.throw(409, 'PayPal refund facts conflict with the refund operation');
+    }
+    this._assertMerchant(record, clientOptions);
+    return mapRefund(readString(record.status), providerRefundId);
+  }
+  _gateway(clientOptions) {
+    return clientOptions.gateway ?? createPaypalGateway(this.bean.core.fetch);
+  }
+  _gatewayOptions(clientOptions) {
+    const {
+      clientId,
+      clientSecret
+    } = clientOptions.secretCredential;
+    const webhookId = clientOptions.webhookId;
+    if (!clientId || !clientSecret || !webhookId) {
+      this.app.throw(503, 'PayPal is not fully configured');
+    }
+    return {
+      environment: clientOptions.environment,
+      clientId,
+      clientSecret,
+      webhookId
+    };
   }
-  async verifyWebhook(_input, _clientOptions) {
-    this.app.throw(501, 'PayPal webhook verification is not configured');
+  _throwGatewayError(error) {
+    if (error instanceof PaypalGatewayError) this.app.throw(error.status, error.message);
+    throw error;
+  }
+  _assertReady(clientOptions) {
+    const {
+      clientId,
+      clientSecret
+    } = clientOptions.secretCredential;
+    if (!clientId || !clientSecret || !clientOptions.webhookId || !clientOptions.merchantReference) {
+      this.app.throw(503, 'PayPal is not fully configured');
+    }
+  }
+  _assertMerchant(value, clientOptions) {
+    const merchantId = readNestedString(value, ['payee', 'merchantId']) ?? readNestedString(value, ['payee', 'merchant_id']) ?? readNestedString(value, ['sellerReceivableBreakdown', 'payee', 'merchantId']) ?? readNestedString(value, ['seller_receivable_breakdown', 'payee', 'merchant_id']);
+    if (!merchantId || merchantId !== clientOptions.merchantReference) {
+      this.app.throw(409, 'PayPal merchant reference conflicts');
+    }
   }
 };
 PayProviderPaypal = __decorate([PayProvider({
@@ -32,17 +404,85 @@ PayProviderPaypal = __decorate([PayProvider({
   },
   clients: {
     default: {
-      environment: 'sandbox',
+      environment: app.meta.env.PAYPAL_ENVIRONMENT,
       secretCredential: {
         clientId: app.meta.env.PAYPAL_CLIENT_ID,
         clientSecret: app.meta.env.PAYPAL_CLIENT_SECRET
       },
-      webhookId: app.meta.env.PAYPAL_WEBHOOK_ID
+      webhookId: app.meta.env.PAYPAL_WEBHOOK_ID,
+      merchantReference: app.meta.env.PAYPAL_MERCHANT_REFERENCE
     }
   }
 }), BeanInfo({
   module: "pay-paypal"
 })], PayProviderPaypal);
+function formatMinorAmount(amountMinor, currency) {
+  if (!Number.isSafeInteger(amountMinor) || amountMinor < 0 || currency !== 'USD') {
+    throw new Error('PayPal supports only nonnegative USD minor-unit amounts');
+  }
+  return `${Math.floor(amountMinor / 100)}.${String(amountMinor % 100).padStart(2, '0')}`;
+}
+function mapRefund(status, providerRefundId) {
+  if (status === 'COMPLETED') return {
+    state: 'succeeded',
+    providerRefundId
+  };
+  if (status === 'FAILED') return {
+    state: 'failed',
+    providerRefundId
+  };
+  if (status === 'CANCELLED') return {
+    state: 'cancelled',
+    providerRefundId
+  };
+  return {
+    state: 'pending',
+    providerRefundId
+  };
+}
+function asRecord(value) {
+  return value && typeof value === 'object' ? value : {};
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function readString(value) {
+  return typeof value === 'string' && value ? value : undefined;
+}
+function readField(record, ...keys) {
+  for (const key of keys) {
+    if (record[key] !== undefined) return record[key];
+  }
+  return undefined;
+}
+function readNestedString(value, path) {
+  let current = value;
+  for (const key of path) {
+    const record = asRecord(current);
+    current = record[key] ?? record[camelToSnake(key)];
+  }
+  return readString(current);
+}
+function camelToSnake(value) {
+  return value.replace(/[A-Z]/g, character => `_${character.toLowerCase()}`);
+}
+function parsePaypalAmount(value) {
+  const amount = asRecord(value);
+  if (readString(readField(amount, 'currencyCode', 'currency_code')) !== 'USD') return undefined;
+  const decimal = readString(amount.value);
+  if (!decimal || !/^\d+\.\d{2}$/.test(decimal)) return undefined;
+  const [whole, fractional] = decimal.split('.');
+  const result = Number(whole) * 100 + Number(fractional);
+  return Number.isSafeInteger(result) ? result : undefined;
+}
+function parsePaypalCurrency(value) {
+  const amount = asRecord(value);
+  const currency = readString(readField(amount, 'currencyCode', 'currency_code'));
+  return currency === 'USD' ? currency : undefined;
+}
+function isRefundEvent(eventType) {
+  return eventType === 'PAYMENT.CAPTURE.REFUNDED' || eventType.startsWith('PAYMENT.REFUND.');
+}
 
 let ScopeModulePayPaypal = class ScopeModulePayPaypal extends BeanScopeBase {};
 ScopeModulePayPaypal = __decorate([Scope(), BeanInfo({
@@ -50,5 +490,5 @@ ScopeModulePayPaypal = __decorate([Scope(), BeanInfo({
 })], ScopeModulePayPaypal);
 /** scope: end */
 
-export { PayProviderPaypal, ScopeModulePayPaypal };
+export { PayProviderPaypal, PaypalGatewayError, ScopeModulePayPaypal, createPaypalGateway };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../src/bean/payProvider.paypal.ts","../src/.metadata/index.ts"],"sourcesContent":[null,null],"names":["app","useApp","PayProviderPaypal","BeanBase","startPayment","_input","_clientOptions","throw","queryPayment","createRefund","verifyWebhook","__decorate","PayProvider","base","capabilities","redirectCheckout","embeddedCheckout","automaticCapture","manualCapture","refunds","partialRefunds","webhooks","clients","default","environment","secretCredential","clientId","meta","env","PAYPAL_CLIENT_ID","clientSecret","PAYPAL_CLIENT_SECRET","webhookId","PAYPAL_WEBHOOK_ID","__z_BeanInfo","module","ScopeModulePayPaypal","BeanScopeBase","Scope"],"mappings":";;;;;AAuBA,MAAMA,GAAG,GAAGC,MAAM,EAAE;AA8Bb,IAAMC,iBAAiB,GAAvB,MAAMA,iBACX,SAAQC,QAAQ,CAAA;AAGhB,EAAA,MAAMC,YAAYA,CAChBC,MAAgC,EAChCC,cAA+C,EAAA;IAE/C,IAAI,CAACN,GAAG,CAACO,KAAK,CAAC,GAAG,EAAE,mCAAmC,CAAC;AAC1D,EAAA;AAEA,EAAA,MAAMC,YAAYA,CAChBH,MAAgC,EAChCC,cAA+C,EAAA;IAE/C,IAAI,CAACN,GAAG,CAACO,KAAK,CAAC,GAAG,EAAE,mCAAmC,CAAC;AAC1D,EAAA;AAEA,EAAA,MAAME,YAAYA,CAChBJ,MAA+B,EAC/BC,cAA+C,EAAA;IAE/C,IAAI,CAACN,GAAG,CAACO,KAAK,CAAC,GAAG,EAAE,mCAAmC,CAAC;AAC1D,EAAA;AAEA,EAAA,MAAMG,aAAaA,CACjBL,MAAgC,EAChCC,cAA+C,EAAA;IAE/C,IAAI,CAACN,GAAG,CAACO,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC;AACtE,EAAA;;AA9BWL,iBAAiB,GAAAS,UAAA,CAAA,CAvB7BC,WAAW,CAA4B;AACtCC,EAAAA,IAAI,EAAE;AACJC,IAAAA,YAAY,EAAE;AACZC,MAAAA,gBAAgB,EAAE,IAAI;AACtBC,MAAAA,gBAAgB,EAAE,KAAK;AACvBC,MAAAA,gBAAgB,EAAE,IAAI;AACtBC,MAAAA,aAAa,EAAE,KAAK;AACpBC,MAAAA,OAAO,EAAE,IAAI;AACbC,MAAAA,cAAc,EAAE,IAAI;AACpBC,MAAAA,QAAQ,EAAE;AACX;GACF;AACDC,EAAAA,OAAO,EAAE;AACPC,IAAAA,OAAO,EAAE;AACPC,MAAAA,WAAW,EAAE,SAAS;AACtBC,MAAAA,gBAAgB,EAAE;AAChBC,QAAAA,QAAQ,EAAE1B,GAAG,CAAC2B,IAAI,CAACC,GAAG,CAACC,gBAAgB;AACvCC,QAAAA,YAAY,EAAE9B,GAAG,CAAC2B,IAAI,CAACC,GAAG,CAACG;OAC5B;AACDC,MAAAA,SAAS,EAAEhC,GAAG,CAAC2B,IAAI,CAACC,GAAG,CAACK;AACzB;AACF;CACF,CAAC,EAAAC,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACW,EAAAjC,iBAAiB,CA+B7B;;AC9CM,IAAMkC,oBAAoB,GAA1B,MAAMA,oBAAqB,SAAQC,aAAa,CAAA;AAA1CD,oBAAoB,GAAAzB,UAAA,CAAA,CADhC2B,KAAK,EAAE,EAAAJ,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACK,EAAAC,oBAAoB,CAAyB;AAuB1D;;;;"}
+{"version":3,"file":"index.js","sources":["../src/lib/paypalGateway.ts","../src/bean/payProvider.paypal.ts","../src/.metadata/index.ts"],"sourcesContent":[null,null,null],"names":["PaypalGatewayError","Error","constructor","status","message","createPaypalGateway","fetcher","createOrder","options","input","OrdersController","createClient","result","captureOrder","getOrder","refundCapturedPayment","PaymentsController","getRefund","verifyWebhookSignature","transmissionId","getHeader","headers","transmissionTime","certUrl","authAlgo","transmissionSig","apiBaseUrl","environment","tokenResponse","method","Buffer","from","clientId","clientSecret","toString","body","token","asRecord","ok","json","undefined","accessToken","readString","access_token","response","JSON","stringify","auth_algo","cert_url","transmission_id","transmission_sig","transmission_time","webhook_id","webhookId","webhook_event","verification_status","Client","clientCredentialsAuthCredentials","oAuthClientId","oAuthClientSecret","timeout","Environment","Production","Sandbox","value","key","Array","isArray","app","useApp","PaypalWebhookSchema","z","object","id","string","min","max","event_type","resource","record","unknown","PayProviderPaypal","BeanBase","startPayment","clientOptions","providerOrderId","queryPayment","returnUrl","cancelUrl","throw","_assertReady","order","_gateway","_gatewayOptions","paypalRequestId","idempotencyKey","intent","CheckoutPaymentIntent","Capture","applicationContext","purchaseUnits","customId","String","paymentSessionId","invoiceId","businessReference","amount","currencyCode","currency","formatMinorAmount","amountMinor","orderRecord","approvalUrl","asArray","links","map","find","item","rel","href","orderId","state","providerPaymentId","nextAction","kind","url","confirmPayment","_mapOrder","createRefund","refund","captureId","providerCaptureId","refundOperationId","_mapRefund","queryRefund","providerRefundId","refundId","verifyWebhook","webhook","safeParse","success","error","_throwGatewayError","_mapWebhook","data","event","parsePaypalAmount","parsePaypalCurrency","resourceId","isRefundEvent","readField","readNestedString","$scope","pay","model","refundOperation","getById","session","paymentSession","snapshot","eventId","eventType","summary","startsWith","_inputFromOrder","payment","includes","unit","unitRecord","units","length","_assertMerchant","captures","capture","captureStatus","OrderStatus","Voided","mapRefund","gateway","bean","core","fetch","secretCredential","merchantReference","merchantId","__decorate","PayProvider","base","capabilities","redirectCheckout","embeddedCheckout","automaticCapture","manualCapture","refunds","partialRefunds","webhooks","clients","default","meta","env","PAYPAL_ENVIRONMENT","PAYPAL_CLIENT_ID","PAYPAL_CLIENT_SECRET","PAYPAL_WEBHOOK_ID","PAYPAL_MERCHANT_REFERENCE","__z_BeanInfo","module","Number","isSafeInteger","Math","floor","padStart","keys","path","current","camelToSnake","replace","character","toLowerCase","decimal","test","whole","fractional","split","ScopeModulePayPaypal","BeanScopeBase","Scope"],"mappings":";;;;;;;AA0BM,MAAOA,kBAAmB,SAAQC,KAAK,CAAA;AAC3CC,EAAAA,WAAAA,CACWC,MAAc,EACvBC,OAAe,EAAA;IAEf,KAAK,CAACA,OAAO,CAAC;AAAC,IAAA,IAAA,CAHND,MAAA,GAAA,MAAA;IAAA,IAAA,CAAAA,MAAM,GAANA,MAAM;AAIjB,EAAA;AACD;AAEK,SAAUE,mBAAmBA,CAACC,OAAqB,EAAA;EACvD,OAAO;AACL,IAAA,MAAMC,WAAWA,CAACC,OAAO,EAAEC,KAAK,EAAA;AAC9B,MAAA,OAAO,CAAC,MAAM,IAAIC,gBAAgB,CAACC,YAAY,CAACH,OAAO,CAAC,CAAC,CAACD,WAAW,CAACE,KAAc,CAAC,EAAEG,MAAM;IAC/F,CAAC;AACD,IAAA,MAAMC,YAAYA,CAACL,OAAO,EAAEC,KAAK,EAAA;AAC/B,MAAA,OAAO,CAAC,MAAM,IAAIC,gBAAgB,CAACC,YAAY,CAACH,OAAO,CAAC,CAAC,CAACK,YAAY,CAACJ,KAAc,CAAC,EACnFG,MAAM;IACX,CAAC;AACD,IAAA,MAAME,QAAQA,CAACN,OAAO,EAAEC,KAAK,EAAA;AAC3B,MAAA,OAAO,CAAC,MAAM,IAAIC,gBAAgB,CAACC,YAAY,CAACH,OAAO,CAAC,CAAC,CAACM,QAAQ,CAACL,KAAc,CAAC,EAAEG,MAAM;IAC5F,CAAC;AACD,IAAA,MAAMG,qBAAqBA,CAACP,OAAO,EAAEC,KAAK,EAAA;AACxC,MAAA,OAAO,CACL,MAAM,IAAIO,kBAAkB,CAACL,YAAY,CAACH,OAAO,CAAC,CAAC,CAACO,qBAAqB,CAACN,KAAc,CAAC,EACzFG,MAAM;IACV,CAAC;AACD,IAAA,MAAMK,SAASA,CAACT,OAAO,EAAEC,KAAK,EAAA;AAC5B,MAAA,OAAO,CAAC,MAAM,IAAIO,kBAAkB,CAACL,YAAY,CAACH,OAAO,CAAC,CAAC,CAACS,SAAS,CAACR,KAAc,CAAC,EAAEG,MAAM;IAC/F,CAAC;AACD,IAAA,MAAMM,sBAAsBA,CAACV,OAAO,EAAEC,KAAK,EAAA;MACzC,MAAMU,cAAc,GAAGC,SAAS,CAACX,KAAK,CAACY,OAAO,EAAE,wBAAwB,CAAC;MACzE,MAAMC,gBAAgB,GAAGF,SAAS,CAACX,KAAK,CAACY,OAAO,EAAE,0BAA0B,CAAC;MAC7E,MAAME,OAAO,GAAGH,SAAS,CAACX,KAAK,CAACY,OAAO,EAAE,iBAAiB,CAAC;MAC3D,MAAMG,QAAQ,GAAGJ,SAAS,CAACX,KAAK,CAACY,OAAO,EAAE,kBAAkB,CAAC;MAC7D,MAAMI,eAAe,GAAGL,SAAS,CAACX,KAAK,CAACY,OAAO,EAAE,yBAAyB,CAAC;AAC3E,MAAA,IAAI,CAACF,cAAc,IAAI,CAACG,gBAAgB,IAAI,CAACC,OAAO,IAAI,CAACC,QAAQ,IAAI,CAACC,eAAe,EAAE;AACrF,QAAA,MAAM,IAAIzB,kBAAkB,CAAC,GAAG,EAAE,iDAAiD,CAAC;AACtF,MAAA;MACA,MAAM0B,UAAU,GACdlB,OAAO,CAACmB,WAAW,KAAK,SAAS,GAC7B,kCAAkC,GAClC,0BAA0B;MAChC,MAAMC,aAAa,GAAG,MAAMtB,OAAO,CAAC,CAAA,EAAGoB,UAAU,kBAAkB,EAAE;AACnEG,QAAAA,MAAM,EAAE,MAAM;AACdR,QAAAA,OAAO,EAAE;UACP,eAAe,EAAE,SAASS,MAAM,CAACC,IAAI,CAAC,CAAA,EAAGvB,OAAO,CAACwB,QAAQ,IAAIxB,OAAO,CAACyB,YAAY,CAAA,CAAE,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAE;AACzG,UAAA,cAAc,EAAE;SACjB;AACDC,QAAAA,IAAI,EAAE;AACP,OAAA,CAAC;AACF,MAAA,MAAMC,KAAK,GAAGC,UAAQ,CAACT,aAAa,CAACU,EAAE,GAAG,MAAMV,aAAa,CAACW,IAAI,EAAE,GAAGC,SAAS,CAAC;AACjF,MAAA,MAAMC,WAAW,GAAGC,YAAU,CAACN,KAAK,CAACO,YAAY,CAAC;MAClD,IAAI,CAACF,WAAW,EAAE;AAChB,QAAA,MAAM,IAAIzC,kBAAkB,CAAC,GAAG,EAAE,mDAAmD,CAAC;AACxF,MAAA;MACA,MAAM4C,QAAQ,GAAG,MAAMtC,OAAO,CAAC,CAAA,EAAGoB,UAAU,4CAA4C,EAAE;AACxFG,QAAAA,MAAM,EAAE,MAAM;AACdR,QAAAA,OAAO,EAAE;UACP,eAAe,EAAE,CAAA,OAAA,EAAUoB,WAAW,CAAA,CAAE;AACxC,UAAA,cAAc,EAAE;SACjB;AACDN,QAAAA,IAAI,EAAEU,IAAI,CAACC,SAAS,CAAC;AACnBC,UAAAA,SAAS,EAAEvB,QAAQ;AACnBwB,UAAAA,QAAQ,EAAEzB,OAAO;AACjB0B,UAAAA,eAAe,EAAE9B,cAAc;AAC/B+B,UAAAA,gBAAgB,EAAEzB,eAAe;AACjC0B,UAAAA,iBAAiB,EAAE7B,gBAAgB;UACnC8B,UAAU,EAAE5C,OAAO,CAAC6C,SAAS;UAC7BC,aAAa,EAAE7C,KAAK,CAAC0B;SACtB;AACF,OAAA,CAAC;AACF,MAAA,IAAI,CAACS,QAAQ,CAACN,EAAE,EAAE,MAAM,IAAItC,kBAAkB,CAAC,GAAG,EAAE,oCAAoC,CAAC;MACzF,MAAMY,MAAM,GAAGyB,UAAQ,CAAC,MAAMO,QAAQ,CAACL,IAAI,EAAE,CAAC;MAC9C,IAAIG,YAAU,CAAC9B,MAAM,CAAC2C,mBAAmB,CAAC,KAAK,SAAS,EAAE;AACxD,QAAA,MAAM,IAAIvD,kBAAkB,CAAC,GAAG,EAAE,qCAAqC,CAAC;AAC1E,MAAA;AACF,IAAA;GACD;AACH;AAEA,SAASW,YAAYA,CAACH,OAA8B,EAAA;EAClD,OAAO,IAAIgD,MAAM,CAAC;AAChBC,IAAAA,gCAAgC,EAAE;MAChCC,aAAa,EAAElD,OAAO,CAACwB,QAAQ;MAC/B2B,iBAAiB,EAAEnD,OAAO,CAACyB;KAC5B;AACD2B,IAAAA,OAAO,EAAE,CAAC;AACVjC,IAAAA,WAAW,EAAEnB,OAAO,CAACmB,WAAW,KAAK,MAAM,GAAGkC,WAAW,CAACC,UAAU,GAAGD,WAAW,CAACE;AACpF,GAAA,CAAC;AACJ;AAEA,SAAS1B,UAAQA,CAAC2B,KAAc,EAAA;EAC9B,OAAOA,KAAK,IAAI,OAAOA,KAAK,KAAK,QAAQ,GAAIA,KAAiC,GAAG,EAAE;AACrF;AAEA,SAAStB,YAAUA,CAACsB,KAAc,EAAA;EAChC,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,GAAGA,KAAK,GAAGxB,SAAS;AAC/D;AAEA,SAASpB,SAASA,CAACC,OAAsD,EAAE4C,GAAW,EAAA;AACpF,EAAA,MAAMD,KAAK,GAAG3C,OAAO,CAAC4C,GAAG,CAAC;AAC1B,EAAA,OAAOC,KAAK,CAACC,OAAO,CAACH,KAAK,CAAC,GAAGA,KAAK,CAAC,CAAC,CAAC,GAAGA,KAAK;AAChD;;AClGA,MAAMI,GAAG,GAAGC,MAAM,EAAE;AACpB,MAAMC,mBAAmB,GAAGC,CAAC,CAACC,MAAM,CAAC;AACnCC,EAAAA,EAAE,EAAEF,CAAC,CAACG,MAAM,EAAE,CAACC,GAAG,CAAC,CAAC,CAAC,CAACC,GAAG,CAAC,GAAG,CAAC;AAC9BC,EAAAA,UAAU,EAAEN,CAAC,CAACG,MAAM,EAAE,CAACC,GAAG,CAAC,CAAC,CAAC,CAACC,GAAG,CAAC,GAAG,CAAC;AACtCE,EAAAA,QAAQ,EAAEP,CAAC,CAACQ,MAAM,CAACR,CAAC,CAACG,MAAM,EAAE,EAAEH,CAAC,CAACS,OAAO,EAAE;AAC3C,CAAA,CAAC;AA+BK,IAAMC,iBAAiB,GAAvB,MAAMA,iBACX,SAAQC,QAAQ,CAAA;AAGhB,EAAA,MAAMC,YAAYA,CAChB1E,KAA+B,EAC/B2E,aAA8C,EAAA;AAE9C,IAAA,IAAI3E,KAAK,CAAC4E,eAAe,EAAE,OAAO,MAAM,IAAI,CAACC,YAAY,CAAC7E,KAAK,EAAE2E,aAAa,CAAC;IAC/E,IAAI,CAAC3E,KAAK,CAAC8E,SAAS,IAAI,CAAC9E,KAAK,CAAC+E,SAAS,EAAE;MACxC,IAAI,CAACpB,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,gDAAgD,CAAC;AACvE,IAAA;AACA,IAAA,IAAI,CAACC,YAAY,CAACN,aAAa,CAAC;AAChC,IAAA,MAAMO,KAAK,GAAG,MAAM,IAAI,CAACC,QAAQ,CAACR,aAAa,CAAC,CAAC7E,WAAW,CAC1D,IAAI,CAACsF,eAAe,CAACT,aAAa,CAAC,EACnC;MACEU,eAAe,EAAErF,KAAK,CAACsF,cAAc;AACrC5D,MAAAA,IAAI,EAAE;QACJ6D,MAAM,EAAEC,qBAAqB,CAACC,OAAO;AACrCC,QAAAA,kBAAkB,EAAE;UAAEZ,SAAS,EAAE9E,KAAK,CAAC8E,SAAS;UAAEC,SAAS,EAAE/E,KAAK,CAAC+E;SAAW;AAC9EY,QAAAA,aAAa,EAAE,CACb;AACEC,UAAAA,QAAQ,EAAEC,MAAM,CAAC7F,KAAK,CAAC8F,gBAAgB,CAAC;UACxCC,SAAS,EAAE/F,KAAK,CAACgG,iBAAiB;AAClCC,UAAAA,MAAM,EAAE;YACNC,YAAY,EAAElG,KAAK,CAACmG,QAAQ;YAC5B5C,KAAK,EAAE6C,iBAAiB,CAACpG,KAAK,CAACqG,WAAW,EAAErG,KAAK,CAACmG,QAAQ;AAC3D;SACF;AAEJ;AACF,KAAA,CACF;AACD,IAAA,MAAMG,WAAW,GAAG1E,QAAQ,CAACsD,KAAK,CAAC;AACnC,IAAA,MAAMqB,WAAW,GAAGtE,UAAU,CAC5BuE,OAAO,CAACF,WAAW,CAACG,KAAK,CAAC,CACvBC,GAAG,CAAC9E,QAAQ,CAAC,CACb+E,IAAI,CAACC,IAAI,IAAIA,IAAI,CAACC,GAAG,KAAK,SAAS,CAAC,EAAEC,IAAI,CAC9C;AACD,IAAA,MAAMC,OAAO,GAAG9E,UAAU,CAACqE,WAAW,CAACtC,EAAE,CAAC;AAC1C,IAAA,IAAI,CAAC+C,OAAO,IAAI,CAACR,WAAW,EAAE,IAAI,CAAC5C,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;IAC5F,OAAO;AACLgC,MAAAA,KAAK,EAAE,iBAAiB;AACxBC,MAAAA,iBAAiB,EAAEF,OAAO;AAC1BnC,MAAAA,eAAe,EAAEmC,OAAO;AACxBG,MAAAA,UAAU,EAAE;AAAEC,QAAAA,IAAI,EAAE,UAAU;AAAEC,QAAAA,GAAG,EAAEb;AAAW;KACjD;AACH,EAAA;AAEA,EAAA,MAAMc,cAAcA,CAClBrH,KAA+B,EAC/B2E,aAA8C,EAAA;AAE9C,IAAA,IAAI,CAACM,YAAY,CAACN,aAAa,CAAC;AAChC,IAAA,IAAI,CAAC3E,KAAK,CAAC4E,eAAe,EAAE,IAAI,CAACjB,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvF,IAAA,MAAME,KAAK,GAAG,MAAM,IAAI,CAACC,QAAQ,CAACR,aAAa,CAAC,CAACvE,YAAY,CAC3D,IAAI,CAACgF,eAAe,CAACT,aAAa,CAAC,EACnC;MACEX,EAAE,EAAEhE,KAAK,CAAC4E,eAAe;MACzBS,eAAe,EAAErF,KAAK,CAACsF;AACxB,KAAA,CACF;IACD,OAAO,IAAI,CAACgC,SAAS,CAACpC,KAAK,EAAElF,KAAK,EAAE2E,aAAa,CAAC;AACpD,EAAA;AAEA,EAAA,MAAME,YAAYA,CAChB7E,KAA+B,EAC/B2E,aAA8C,EAAA;AAE9C,IAAA,IAAI,CAACM,YAAY,CAACN,aAAa,CAAC;AAChC,IAAA,IAAI,CAAC3E,KAAK,CAAC4E,eAAe,EAAE,IAAI,CAACjB,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvF,IAAA,MAAME,KAAK,GAAG,MAAM,IAAI,CAACC,QAAQ,CAACR,aAAa,CAAC,CAACtE,QAAQ,CAAC,IAAI,CAAC+E,eAAe,CAACT,aAAa,CAAC,EAAE;MAC7FX,EAAE,EAAEhE,KAAK,CAAC4E;AACX,KAAA,CAAC;IACF,OAAO,IAAI,CAAC0C,SAAS,CAACpC,KAAK,EAAElF,KAAK,EAAE2E,aAAa,CAAC;AACpD,EAAA;AAEA,EAAA,MAAM4C,YAAYA,CAChBvH,KAA8B,EAC9B2E,aAA8C,EAAA;AAE9C,IAAA,IAAI,CAACM,YAAY,CAACN,aAAa,CAAC;AAChC,IAAA,MAAM6C,MAAM,GAAG,MAAM,IAAI,CAACrC,QAAQ,CAACR,aAAa,CAAC,CAACrE,qBAAqB,CACrE,IAAI,CAAC8E,eAAe,CAACT,aAAa,CAAC,EACnC;MACE8C,SAAS,EAAEzH,KAAK,CAAC0H,iBAAiB;MAClCrC,eAAe,EAAErF,KAAK,CAACsF,cAAc;AACrC5D,MAAAA,IAAI,EAAE;AACJuE,QAAAA,MAAM,EAAE;UACNC,YAAY,EAAElG,KAAK,CAACmG,QAAQ;UAC5B5C,KAAK,EAAE6C,iBAAiB,CAACpG,KAAK,CAACqG,WAAW,EAAErG,KAAK,CAACmG,QAAQ;SAC3D;AACDP,QAAAA,QAAQ,EAAEC,MAAM,CAAC7F,KAAK,CAAC2H,iBAAiB,CAAC;QACzC5B,SAAS,EAAE/F,KAAK,CAACgG;AAClB;AACF,KAAA,CACF;IACD,OAAO,IAAI,CAAC4B,UAAU,CAACJ,MAAM,EAAExH,KAAK,EAAE2E,aAAa,CAAC;AACtD,EAAA;AAEA,EAAA,MAAMkD,WAAWA,CACf7H,KAA8B,EAC9B2E,aAA8C,EAAA;AAE9C,IAAA,IAAI,CAACM,YAAY,CAACN,aAAa,CAAC;AAChC,IAAA,IAAI,CAAC3E,KAAK,CAAC8H,gBAAgB,EACzB,IAAI,CAACnE,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,iDAAiD,CAAC;AACxE,IAAA,MAAMwC,MAAM,GAAG,MAAM,IAAI,CAACrC,QAAQ,CAACR,aAAa,CAAC,CAACnE,SAAS,CACzD,IAAI,CAAC4E,eAAe,CAACT,aAAa,CAAC,EACnC;MACEoD,QAAQ,EAAE/H,KAAK,CAAC8H;AACjB,KAAA,CACF;IACD,OAAO,IAAI,CAACF,UAAU,CAACJ,MAAM,EAAExH,KAAK,EAAE2E,aAAa,CAAC;AACtD,EAAA;AAEA,EAAA,MAAMqD,aAAaA,CACjBhI,KAA+B,EAC/B2E,aAA8C,EAAA;AAE9C,IAAA,IAAI,CAACM,YAAY,CAACN,aAAa,CAAC;IAChC,MAAMsD,OAAO,GAAGpE,mBAAmB,CAACqE,SAAS,CAAClI,KAAK,CAAC0B,IAAI,CAAC;AACzD,IAAA,IAAI,CAACuG,OAAO,CAACE,OAAO,EAAE,IAAI,CAACxE,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC;IACtE,IAAI;AACF,MAAA,MAAM,IAAI,CAACG,QAAQ,CAACR,aAAa,CAAC,CAAClE,sBAAsB,CACvD,IAAI,CAAC2E,eAAe,CAACT,aAAa,CAAC,EACnC3E,KAAK,CACN;IACH,CAAC,CAAC,OAAOoI,KAAK,EAAE;AACd,MAAA,IAAI,CAACC,kBAAkB,CAACD,KAAK,CAAC;AAChC,IAAA;IACA,OAAO,MAAM,IAAI,CAACE,WAAW,CAACL,OAAO,CAACM,IAAI,EAAE5D,aAAa,CAAC;AAC5D,EAAA;AAEQ,EAAA,MAAM2D,WAAWA,CACvBE,KAA0C,EAC1C7D,aAA8C,EAAA;AAE9C,IAAA,MAAMN,QAAQ,GAAGmE,KAAK,CAACnE,QAAQ;AAC/B,IAAA,MAAM4B,MAAM,GAAGwC,iBAAiB,CAACpE,QAAQ,CAAC4B,MAAM,CAAC;AACjD,IAAA,MAAME,QAAQ,GAAGuC,mBAAmB,CAACrE,QAAQ,CAAC4B,MAAM,CAAC;AACrD,IAAA,MAAM0C,UAAU,GAAG1G,UAAU,CAACoC,QAAQ,CAACL,EAAE,CAAC;AAC1C,IAAA,IAAI,CAAC2E,UAAU,IAAI,CAAC1C,MAAM,IAAI,CAACE,QAAQ,EACrC,IAAI,CAACxC,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,qCAAqC,CAAC;AAE5D,IAAA,IAAI4D,aAAa,CAACJ,KAAK,CAACpE,UAAU,CAAC,EAAE;AACnC,MAAA,MAAMuD,iBAAiB,GAAG1F,UAAU,CAAC4G,SAAS,CAACxE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAClF,MAAA,MAAMoD,SAAS,GAAGqB,gBAAgB,CAACzE,QAAQ,EAAE,CAC3C,oBAAoB,EACpB,aAAa,EACb,YAAY,CACb,CAAC;AACF,MAAA,IAAI,CAACsD,iBAAiB,IAAI,CAACF,SAAS,EAClC,IAAI,CAAC9D,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAChE,MAAA,MAAMwC,MAAM,GAAG,MAAM,IAAI,CAACuB,MAAM,CAACC,GAAG,CAACC,KAAK,CAACC,eAAe,CAACC,OAAO,CAChExB,iBAA0B,CAC3B;AACD,MAAA,IAAI,CAACH,MAAM,EAAE,IAAI,CAAC7D,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,mCAAmC,CAAC;AACrE,MAAA,MAAMoE,OAAO,GAAG,MAAM,IAAI,CAACL,MAAM,CAACC,GAAG,CAACC,KAAK,CAACI,cAAc,CAACF,OAAO,CAAC3B,MAAM,CAAC1B,gBAAgB,CAAC;MAC3F,IAAI,CAACsD,OAAO,IAAIA,OAAO,CAAC1B,iBAAiB,KAAKD,SAAS,EAAE;QACvD,IAAI,CAAC9D,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAChE,MAAA;AACA,MAAA,MAAMsE,QAAQ,GAAG,IAAI,CAAC1B,UAAU,CAC9BvD,QAAQ,EACR;QACEyB,gBAAgB,EAAEsD,OAAO,CAACpF,EAAE;QAC5B2D,iBAAiB,EAAEH,MAAM,CAACxD,EAAE;QAC5BgC,iBAAiB,EAAEwB,MAAM,CAACxB,iBAAiB;AAC3CV,QAAAA,cAAc,EAAE,EAAE;QAClBe,WAAW,EAAEmB,MAAM,CAACnB,WAAW;QAC/BF,QAAQ,EAAEqB,MAAM,CAACrB,QAAQ;AACzBuB,QAAAA,iBAAiB,EAAED,SAAS;AAC5BK,QAAAA,gBAAgB,EAAEa;OACnB,EACDhE,aAAa,CACd;MACD,OAAO;QACL4E,OAAO,EAAEf,KAAK,CAACxE,EAAE;QACjBwF,SAAS,EAAEhB,KAAK,CAACpE,UAAU;QAC3BuD,iBAAiB,EAAEH,MAAM,CAACxD,EAAE;AAC5BwD,QAAAA,MAAM,EAAE8B,QAAQ;AAChBG,QAAAA,OAAO,EAAE;AAAEpD,UAAAA,WAAW,EAAEJ,MAAM;AAAEE,UAAAA;AAAQ;OACzC;AACH,IAAA;IAEA,IAAIqC,KAAK,CAACpE,UAAU,CAACsF,UAAU,CAAC,kBAAkB,CAAC,EAAE;AACnD,MAAA,MAAM3C,OAAO,GAAG+B,gBAAgB,CAACzE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAC1F,MAAA,IAAI,CAAC0C,OAAO,EAAE,IAAI,CAACpD,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,gDAAgD,CAAC;AACnF,MAAA,MAAME,KAAK,GAAG,MAAM,IAAI,CAACC,QAAQ,CAACR,aAAa,CAAC,CAACtE,QAAQ,CACvD,IAAI,CAAC+E,eAAe,CAACT,aAAa,CAAC,EACnC;AACEX,QAAAA,EAAE,EAAE+C;AACL,OAAA,CACF;MACD,MAAM/G,KAAK,GAAG,IAAI,CAAC2J,eAAe,CAACzE,KAAK,EAAE6B,OAAO,CAAC;MAClD,MAAM6C,OAAO,GAAG,IAAI,CAACtC,SAAS,CAACpC,KAAK,EAAElF,KAAK,EAAE2E,aAAa,CAAC;AAC3D,MAAA,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAACkF,QAAQ,CAACD,OAAO,CAAC5C,KAAK,CAAC,EAAE;QACjE,IAAI,CAACrD,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,wCAAwC,CAAC;AAC/D,MAAA;MACA,IAAI4E,OAAO,CAAClC,iBAAiB,IAAIkC,OAAO,CAAClC,iBAAiB,KAAKiB,UAAU,EAAE;QACzE,IAAI,CAAChF,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AAC5E,MAAA;MACA,OAAO;QACLuE,OAAO,EAAEf,KAAK,CAACxE,EAAE;QACjBwF,SAAS,EAAEhB,KAAK,CAACpE,UAAU;QAC3B0B,gBAAgB,EAAE9F,KAAK,CAAC8F,gBAAgB;QACxC8D,OAAO;AACPH,QAAAA,OAAO,EAAE;AAAEpD,UAAAA,WAAW,EAAEJ,MAAM;AAAEE,UAAAA;AAAQ;OACzC;AACH,IAAA;IACA,IAAI,CAACxC,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,0CAA0C,CAAC;AACjE,EAAA;AAEQ2E,EAAAA,eAAeA,CAACzE,KAAc,EAAEN,eAAuB,EAAA;AAC7D,IAAA,MAAM0B,WAAW,GAAG1E,QAAQ,CAACsD,KAAK,CAAC;AACnC,IAAA,MAAM4E,IAAI,GAAGtD,OAAO,CAACqC,SAAS,CAACvC,WAAW,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,IAAA,MAAMyD,UAAU,GAAGnI,QAAQ,CAACkI,IAAI,CAAC;AACjC,IAAA,MAAMlE,QAAQ,GAAG3D,UAAU,CAAC4G,SAAS,CAACkB,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAC3E,IAAA,MAAM/D,iBAAiB,GAAG/D,UAAU,CAAC4G,SAAS,CAACkB,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACtF,MAAM1D,WAAW,GAAGoC,iBAAiB,CAACI,SAAS,CAACkB,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM5D,QAAQ,GAAGuC,mBAAmB,CAACG,SAAS,CAACkB,UAAU,EAAE,QAAQ,CAAC,CAAC;AACrE,IAAA,IAAI,CAACnE,QAAQ,IAAI,CAACI,iBAAiB,IAAIK,WAAW,KAAKtE,SAAS,IAAI,CAACoE,QAAQ,EAAE;MAC7E,IAAI,CAACxC,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,gCAAgC,CAAC;AACvD,IAAA;IACA,OAAO;AACLc,MAAAA,gBAAgB,EAAEF,QAAiB;MACnCI,iBAAiB;AACjBV,MAAAA,cAAc,EAAE,EAAE;MAClBe,WAAW;MACXF,QAAQ;AACRvB,MAAAA;KACD;AACH,EAAA;AAEQ0C,EAAAA,SAASA,CACfpC,KAAc,EACdlF,KAA+B,EAC/B2E,aAA8C,EAAA;AAE9C,IAAA,MAAM2B,WAAW,GAAG1E,QAAQ,CAACsD,KAAK,CAAC;AACnC,IAAA,MAAM6B,OAAO,GAAG9E,UAAU,CAACqE,WAAW,CAACtC,EAAE,CAAC;IAC1C,IAAI,CAAC+C,OAAO,IAAIA,OAAO,KAAK/G,KAAK,CAAC4E,eAAe,EAAE;MACjD,IAAI,CAACjB,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,mCAAmC,CAAC;AAC1D,IAAA;AACA,IAAA,MAAMgF,KAAK,GAAGxD,OAAO,CAACqC,SAAS,CAACvC,WAAW,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAChF,IAAA,IAAI0D,KAAK,CAACC,MAAM,KAAK,CAAC,EAAE,IAAI,CAACtG,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,iDAAiD,CAAC;IAC9F,MAAM8E,IAAI,GAAGlI,QAAQ,CAACoI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/B,IAAA,IACE/H,UAAU,CAAC4G,SAAS,CAACiB,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,KAAKjE,MAAM,CAAC7F,KAAK,CAAC8F,gBAAgB,CAAC,IACvF7D,UAAU,CAAC4G,SAAS,CAACiB,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK9J,KAAK,CAACgG,iBAAiB,IAClFyC,iBAAiB,CAACI,SAAS,CAACiB,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK9J,KAAK,CAACqG,WAAW,IAClEqC,mBAAmB,CAACG,SAAS,CAACiB,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK9J,KAAK,CAACmG,QAAQ,EACjE;MACA,IAAI,CAACxC,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,sDAAsD,CAAC;AAC7E,IAAA;AACA,IAAA,IAAI,CAACkF,eAAe,CAACJ,IAAI,EAAEnF,aAAa,CAAC;AACzC,IAAA,MAAMwF,QAAQ,GAAG3D,OAAO,CAACqC,SAAS,CAACjH,QAAQ,CAACiH,SAAS,CAACiB,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACtF,IAAA,IAAIK,QAAQ,CAACF,MAAM,GAAG,CAAC,EAAE,IAAI,CAACtG,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,oCAAoC,CAAC;IAClF,MAAMoF,OAAO,GAAGxI,QAAQ,CAACuI,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrC,IAAA,MAAM1C,SAAS,GAAGxF,UAAU,CAACmI,OAAO,CAACpG,EAAE,CAAC;AACxC,IAAA,MAAMqG,aAAa,GAAGpI,UAAU,CAACmI,OAAO,CAAC1K,MAAM,CAAC;AAChD,IAAA,IAAI+H,SAAS,EAAE;MACb,IACEgB,iBAAiB,CAAC2B,OAAO,CAACnE,MAAM,CAAC,KAAKjG,KAAK,CAACqG,WAAW,IACvDqC,mBAAmB,CAAC0B,OAAO,CAACnE,MAAM,CAAC,KAAKjG,KAAK,CAACmG,QAAQ,EACtD;QACA,IAAI,CAACxC,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,wDAAwD,CAAC;AAC/E,MAAA;MACA,IAAIqF,aAAa,KAAK,WAAW,EAAE;QACjC,OAAO;AACLrD,UAAAA,KAAK,EAAE,WAAW;AAClBC,UAAAA,iBAAiB,EAAEF,OAAO;AAC1BnC,UAAAA,eAAe,EAAEmC,OAAO;AACxBW,UAAAA,iBAAiB,EAAED,SAAS;AAC5BP,UAAAA,UAAU,EAAE;AAAEC,YAAAA,IAAI,EAAE;AAAW;SAChC;AACH,MAAA;AACA,MAAA,IAAIkD,aAAa,KAAK,QAAQ,IAAIA,aAAa,KAAK,UAAU,EAAE;QAC9D,OAAO;AACLrD,UAAAA,KAAK,EAAE,QAAQ;AACfC,UAAAA,iBAAiB,EAAEF,OAAO;AAC1BnC,UAAAA,eAAe,EAAEmC,OAAO;AACxBW,UAAAA,iBAAiB,EAAED;SACpB;AACH,MAAA;MACA,IAAI4C,aAAa,KAAK,SAAS,EAAE;QAC/B,OAAO;AACLrD,UAAAA,KAAK,EAAE,YAAY;AACnBC,UAAAA,iBAAiB,EAAEF,OAAO;AAC1BnC,UAAAA,eAAe,EAAEmC,OAAO;AACxBW,UAAAA,iBAAiB,EAAED;SACpB;AACH,MAAA;AACF,IAAA;AACA,IAAA,IAAInB,WAAW,CAAC5G,MAAM,KAAK4K,WAAW,CAACC,MAAM,EAAE;MAC7C,OAAO;AAAEvD,QAAAA,KAAK,EAAE,WAAW;AAAEC,QAAAA,iBAAiB,EAAEF,OAAO;AAAEnC,QAAAA,eAAe,EAAEmC;OAAS;AACrF,IAAA;IACA,OAAO;AAAEC,MAAAA,KAAK,EAAE,iBAAiB;AAAEC,MAAAA,iBAAiB,EAAEF,OAAO;AAAEnC,MAAAA,eAAe,EAAEmC;KAAS;AAC3F,EAAA;AAEQa,EAAAA,UAAUA,CAChBJ,MAAe,EACfxH,KAA8B,EAC9B2E,aAA8C,EAAA;AAE9C,IAAA,MAAML,MAAM,GAAG1C,QAAQ,CAAC4F,MAAM,CAAC;AAC/B,IAAA,MAAMM,gBAAgB,GAAG7F,UAAU,CAACqC,MAAM,CAACN,EAAE,CAAC;AAC9C,IAAA,IAAI,CAAC8D,gBAAgB,EAAE,IAAI,CAACnE,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AAClF,IAAA,IACGhF,KAAK,CAAC8H,gBAAgB,IAAI9H,KAAK,CAAC8H,gBAAgB,KAAKA,gBAAgB,IACtE7F,UAAU,CAAC4G,SAAS,CAACvE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,KAAKuB,MAAM,CAAC7F,KAAK,CAAC2H,iBAAiB,CAAC,IAC1F1F,UAAU,CAAC4G,SAAS,CAACvE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,KAAKtE,KAAK,CAACgG,iBAAiB,IACpFyC,iBAAiB,CAACnE,MAAM,CAAC2B,MAAM,CAAC,KAAKjG,KAAK,CAACqG,WAAW,IACtDqC,mBAAmB,CAACpE,MAAM,CAAC2B,MAAM,CAAC,KAAKjG,KAAK,CAACmG,QAAQ,EACrD;MACA,IAAI,CAACxC,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,wDAAwD,CAAC;AAC/E,IAAA;AACA,IAAA,IAAI,CAACkF,eAAe,CAAC5F,MAAM,EAAEK,aAAa,CAAC;IAC3C,OAAO6F,SAAS,CAACvI,UAAU,CAACqC,MAAM,CAAC5E,MAAM,CAAC,EAAEoI,gBAAgB,CAAC;AAC/D,EAAA;EAEQ3C,QAAQA,CAACR,aAA8C,EAAA;AAC7D,IAAA,OAAOA,aAAa,CAAC8F,OAAO,IAAI7K,mBAAmB,CAAC,IAAI,CAAC8K,IAAI,CAACC,IAAI,CAACC,KAAK,CAAC;AAC3E,EAAA;EAEQxF,eAAeA,CAACT,aAA8C,EAAA;IACpE,MAAM;MAAEpD,QAAQ;AAAEC,MAAAA;KAAc,GAAGmD,aAAa,CAACkG,gBAAgB;AACjE,IAAA,MAAMjI,SAAS,GAAG+B,aAAa,CAAC/B,SAAS;IACzC,IAAI,CAACrB,QAAQ,IAAI,CAACC,YAAY,IAAI,CAACoB,SAAS,EAAE;MAC5C,IAAI,CAACe,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,gCAAgC,CAAC;AACvD,IAAA;IACA,OAAO;MACL9D,WAAW,EAAEyD,aAAa,CAACzD,WAAW;MACtCK,QAAQ;MACRC,YAAY;AACZoB,MAAAA;KACD;AACH,EAAA;EAEQyF,kBAAkBA,CAACD,KAAc,EAAA;AACvC,IAAA,IAAIA,KAAK,YAAY7I,kBAAkB,EAAE,IAAI,CAACoE,GAAG,CAACqB,KAAK,CAACoD,KAAK,CAAC1I,MAAM,EAAE0I,KAAK,CAACzI,OAAO,CAAC;AACpF,IAAA,MAAMyI,KAAK;AACb,EAAA;EAEQnD,YAAYA,CAACN,aAA8C,EAAA;IACjE,MAAM;MAAEpD,QAAQ;AAAEC,MAAAA;KAAc,GAAGmD,aAAa,CAACkG,gBAAgB;AACjE,IAAA,IACE,CAACtJ,QAAQ,IACT,CAACC,YAAY,IACb,CAACmD,aAAa,CAAC/B,SAAS,IACxB,CAAC+B,aAAa,CAACmG,iBAAiB,EAChC;MACA,IAAI,CAACnH,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,gCAAgC,CAAC;AACvD,IAAA;AACF,EAAA;AAEQkF,EAAAA,eAAeA,CACrB3G,KAA8B,EAC9BoB,aAA8C,EAAA;IAE9C,MAAMoG,UAAU,GACdjC,gBAAgB,CAACvF,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,IAChDuF,gBAAgB,CAACvF,KAAK,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IACjDuF,gBAAgB,CAACvF,KAAK,EAAE,CAAC,2BAA2B,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,IAC7EuF,gBAAgB,CAACvF,KAAK,EAAE,CAAC,6BAA6B,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAClF,IAAI,CAACwH,UAAU,IAAIA,UAAU,KAAKpG,aAAa,CAACmG,iBAAiB,EAAE;MACjE,IAAI,CAACnH,GAAG,CAACqB,KAAK,CAAC,GAAG,EAAE,qCAAqC,CAAC;AAC5D,IAAA;AACF,EAAA;;AAhXWR,iBAAiB,GAAAwG,UAAA,CAAA,CAxB7BC,WAAW,CAA4B;AACtCC,EAAAA,IAAI,EAAE;AACJC,IAAAA,YAAY,EAAE;AACZC,MAAAA,gBAAgB,EAAE,IAAI;AACtBC,MAAAA,gBAAgB,EAAE,KAAK;AACvBC,MAAAA,gBAAgB,EAAE,IAAI;AACtBC,MAAAA,aAAa,EAAE,KAAK;AACpBC,MAAAA,OAAO,EAAE,IAAI;AACbC,MAAAA,cAAc,EAAE,IAAI;AACpBC,MAAAA,QAAQ,EAAE;AACX;GACF;AACDC,EAAAA,OAAO,EAAE;AACPC,IAAAA,OAAO,EAAE;AACP1K,MAAAA,WAAW,EAAEyC,GAAG,CAACkI,IAAI,CAACC,GAAG,CAACC,kBAAwC;AAClElB,MAAAA,gBAAgB,EAAE;AAChBtJ,QAAAA,QAAQ,EAAEoC,GAAG,CAACkI,IAAI,CAACC,GAAG,CAACE,gBAAgB;AACvCxK,QAAAA,YAAY,EAAEmC,GAAG,CAACkI,IAAI,CAACC,GAAG,CAACG;OAC5B;AACDrJ,MAAAA,SAAS,EAAEe,GAAG,CAACkI,IAAI,CAACC,GAAG,CAACI,iBAAiB;AACzCpB,MAAAA,iBAAiB,EAAEnH,GAAG,CAACkI,IAAI,CAACC,GAAG,CAACK;AACjC;AACF;CACF,CAAC,EAAAC,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACW,EAAA7H,iBAAiB,CAiX7B;AAED,SAAS4B,iBAAiBA,CAACC,WAAmB,EAAEF,QAAgB,EAAA;AAC9D,EAAA,IAAI,CAACmG,MAAM,CAACC,aAAa,CAAClG,WAAW,CAAC,IAAIA,WAAW,GAAG,CAAC,IAAIF,QAAQ,KAAK,KAAK,EAAE;AAC/E,IAAA,MAAM,IAAI3G,KAAK,CAAC,yDAAyD,CAAC;AAC5E,EAAA;EACA,OAAO,CAAA,EAAGgN,IAAI,CAACC,KAAK,CAACpG,WAAW,GAAG,GAAG,CAAC,CAAA,CAAA,EAAIR,MAAM,CAACQ,WAAW,GAAG,GAAG,CAAC,CAACqG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA,CAAE;AACzF;AAEA,SAASlC,SAASA,CAChB9K,MAA0B,EAC1BoI,gBAAwB,EAAA;AAExB,EAAA,IAAIpI,MAAM,KAAK,WAAW,EAAE,OAAO;AAAEsH,IAAAA,KAAK,EAAE,WAAW;AAAEc,IAAAA;GAAkB;AAC3E,EAAA,IAAIpI,MAAM,KAAK,QAAQ,EAAE,OAAO;AAAEsH,IAAAA,KAAK,EAAE,QAAQ;AAAEc,IAAAA;GAAkB;AACrE,EAAA,IAAIpI,MAAM,KAAK,WAAW,EAAE,OAAO;AAAEsH,IAAAA,KAAK,EAAE,WAAW;AAAEc,IAAAA;GAAkB;EAC3E,OAAO;AAAEd,IAAAA,KAAK,EAAE,SAAS;AAAEc,IAAAA;GAAkB;AAC/C;AAEA,SAASlG,QAAQA,CAAC2B,KAAc,EAAA;EAC9B,OAAOA,KAAK,IAAI,OAAOA,KAAK,KAAK,QAAQ,GAAIA,KAAiC,GAAG,EAAE;AACrF;AAEA,SAASiD,OAAOA,CAACjD,KAAc,EAAA;EAC7B,OAAOE,KAAK,CAACC,OAAO,CAACH,KAAK,CAAC,GAAGA,KAAK,GAAG,EAAE;AAC1C;AAEA,SAAStB,UAAUA,CAACsB,KAAc,EAAA;EAChC,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,GAAGA,KAAK,GAAGxB,SAAS;AAC/D;AAEA,SAAS8G,SAASA,CAACvE,MAA+B,EAAE,GAAGqI,IAAc,EAAA;AACnE,EAAA,KAAK,MAAMnJ,GAAG,IAAImJ,IAAI,EAAE;IACtB,IAAIrI,MAAM,CAACd,GAAG,CAAC,KAAKzB,SAAS,EAAE,OAAOuC,MAAM,CAACd,GAAG,CAAC;AACnD,EAAA;AACA,EAAA,OAAOzB,SAAS;AAClB;AAEA,SAAS+G,gBAAgBA,CAACvF,KAAc,EAAEqJ,IAAc,EAAA;EACtD,IAAIC,OAAO,GAAYtJ,KAAK;AAC5B,EAAA,KAAK,MAAMC,GAAG,IAAIoJ,IAAI,EAAE;AACtB,IAAA,MAAMtI,MAAM,GAAG1C,QAAQ,CAACiL,OAAO,CAAC;AAChCA,IAAAA,OAAO,GAAGvI,MAAM,CAACd,GAAG,CAAC,IAAIc,MAAM,CAACwI,YAAY,CAACtJ,GAAG,CAAC,CAAC;AACpD,EAAA;EACA,OAAOvB,UAAU,CAAC4K,OAAO,CAAC;AAC5B;AAEA,SAASC,YAAYA,CAACvJ,KAAa,EAAA;AACjC,EAAA,OAAOA,KAAK,CAACwJ,OAAO,CAAC,QAAQ,EAAEC,SAAS,IAAI,CAAA,CAAA,EAAIA,SAAS,CAACC,WAAW,EAAE,EAAE,CAAC;AAC5E;AAEA,SAASxE,iBAAiBA,CAAClF,KAAc,EAAA;AACvC,EAAA,MAAM0C,MAAM,GAAGrE,QAAQ,CAAC2B,KAAK,CAAC;AAC9B,EAAA,IAAItB,UAAU,CAAC4G,SAAS,CAAC5C,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,KAAK,KAAK,EAAE,OAAOlE,SAAS;AAC9F,EAAA,MAAMmL,OAAO,GAAGjL,UAAU,CAACgE,MAAM,CAAC1C,KAAK,CAAC;AACxC,EAAA,IAAI,CAAC2J,OAAO,IAAI,CAAC,cAAc,CAACC,IAAI,CAACD,OAAO,CAAC,EAAE,OAAOnL,SAAS;EAC/D,MAAM,CAACqL,KAAK,EAAEC,UAAU,CAAC,GAAGH,OAAO,CAACI,KAAK,CAAC,GAAG,CAAC;AAC9C,EAAA,MAAMnN,MAAM,GAAGmM,MAAM,CAACc,KAAK,CAAC,GAAG,GAAG,GAAGd,MAAM,CAACe,UAAU,CAAC;EACvD,OAAOf,MAAM,CAACC,aAAa,CAACpM,MAAM,CAAC,GAAGA,MAAM,GAAG4B,SAAS;AAC1D;AAEA,SAAS2G,mBAAmBA,CAACnF,KAAc,EAAA;AACzC,EAAA,MAAM0C,MAAM,GAAGrE,QAAQ,CAAC2B,KAAK,CAAC;AAC9B,EAAA,MAAM4C,QAAQ,GAAGlE,UAAU,CAAC4G,SAAS,CAAC5C,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAC/E,EAAA,OAAOE,QAAQ,KAAK,KAAK,GAAGA,QAAQ,GAAGpE,SAAS;AAClD;AAEA,SAAS6G,aAAaA,CAACY,SAAiB,EAAA;EACtC,OAAOA,SAAS,KAAK,0BAA0B,IAAIA,SAAS,CAACE,UAAU,CAAC,iBAAiB,CAAC;AAC5F;;ACldO,IAAM6D,oBAAoB,GAA1B,MAAMA,oBAAqB,SAAQC,aAAa,CAAA;AAA1CD,oBAAoB,GAAAvC,UAAA,CAAA,CADhCyC,KAAK,EAAE,EAAArB,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACK,EAAAkB,oBAAoB,CAAyB;AAuB1D;;;;"}

package/dist/lib/index.d.ts

@@ -1,2 +1,2 @@
-export {};
+export * from './paypalGateway.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC"}

package/dist/lib/paypalGateway.d.ts

@@ -0,0 +1,23 @@
+export interface IPaypalGatewayOptions {
+    environment: 'sandbox' | 'live';
+    clientId: string;
+    clientSecret: string;
+    webhookId: string;
+}
+export interface IPaypalGateway {
+    createOrder(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+    captureOrder(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+    getOrder(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+    refundCapturedPayment(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+    getRefund(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+    verifyWebhookSignature(options: IPaypalGatewayOptions, input: {
+        headers: Record<string, string | string[] | undefined>;
+        body: unknown;
+    }): Promise<void>;
+}
+export declare class PaypalGatewayError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare function createPaypalGateway(fetcher: typeof fetch): IPaypalGateway;
+//# sourceMappingURL=paypalGateway.d.ts.map

package/dist/lib/paypalGateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paypalGateway.d.ts","sourceRoot":"","sources":["../../src/lib/paypalGateway.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,SAAS,GAAG,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,YAAY,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,QAAQ,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,SAAS,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,sBAAsB,CACpB,OAAO,EAAE,qBAAqB,EAC9B,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAC/E,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIlB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,KAAK,GAAG,cAAc,CAqEzE"}

package/dist/types/index.d.ts

@@ -3,6 +3,8 @@ declare module 'vona' {
         PAYPAL_CLIENT_ID: string | undefined;
         PAYPAL_CLIENT_SECRET: string | undefined;
         PAYPAL_WEBHOOK_ID: string | undefined;
+        PAYPAL_MERCHANT_REFERENCE: string | undefined;
+        PAYPAL_ENVIRONMENT: 'sandbox' | 'live';
     }
 }
 export {};

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAiB,aAAa;QAC5B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;QACzC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;KACvC;CACF;AAED,OAAO,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAiB,aAAa;QAC5B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;QACzC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,yBAAyB,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9C,kBAAkB,EAAE,SAAS,GAAG,MAAM,CAAC;KACxC;CACF;AAED,OAAO,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-paypal",
-  "version": "5.0.2",
+  "version": "5.0.4",
   "description": "",
   "keywords": [
     "Vona Module"
@@ -30,7 +30,8 @@
     "postpack": "clean-package restore"
   },
   "dependencies": {
-    "vona-module-a-pay": "5.0.2"
+    "@cabloy/paypal-server-sdk": "2.2.0",
+    "vona-module-a-pay": "5.0.4"
   },
   "title": "pay-paypal",
   "vonaModule": {
@@ -39,5 +40,5 @@
       "a-vona": "5.0.0"
     }
   },
-  "gitHead": "95488ea0a7779f34f6ebddeca7719d8545bc55b3"
+  "gitHead": "c408492ce774644ac8a2530702db916986f52151"
 }

package/src/bean/payProvider.paypal.ts

@@ -11,17 +11,29 @@ import type {
   IPayProviderWebhookInput,
 } from 'vona-module-a-pay';
 
+import { CheckoutPaymentIntent, OrderStatus } from '@cabloy/paypal-server-sdk';
 import { BeanBase, useApp } from 'vona';
 import { PayProvider } from 'vona-module-a-pay';
+import { z } from 'zod';
+
+import type { IPaypalGateway, IPaypalGatewayOptions } from '../lib/paypalGateway.ts';
+
+import { createPaypalGateway, PaypalGatewayError } from '../lib/paypalGateway.ts';
 
 export interface IPayProviderPaypalClientRecord extends IPayProviderClientRecord {}
 
 export interface IPayProviderPaypalClientOptions extends IPayProviderClientOptions {
   secretCredential: { clientId: string | undefined; clientSecret: string | undefined };
   webhookId: string | undefined;
+  gateway?: IPaypalGateway;
 }
 
 const app = useApp();
+const PaypalWebhookSchema = z.object({
+  id: z.string().min(1).max(255),
+  event_type: z.string().min(1).max(255),
+  resource: z.record(z.string(), z.unknown()),
+});
 
 export interface IPayProviderOptionsPaypal extends IDecoratorPayProviderOptions<
   IPayProviderPaypalClientRecord,
@@ -42,12 +54,13 @@ export interface IPayProviderOptionsPaypal extends IDecoratorPayProviderOptions<
   },
   clients: {
     default: {
-      environment: 'sandbox',
+      environment: app.meta.env.PAYPAL_ENVIRONMENT as 'sandbox' | 'live',
       secretCredential: {
         clientId: app.meta.env.PAYPAL_CLIENT_ID,
         clientSecret: app.meta.env.PAYPAL_CLIENT_SECRET,
       },
       webhookId: app.meta.env.PAYPAL_WEBHOOK_ID,
+      merchantReference: app.meta.env.PAYPAL_MERCHANT_REFERENCE,
     },
   },
 })
@@ -56,32 +69,439 @@ export class PayProviderPaypal
   implements IPayProviderExecute<IPayProviderPaypalClientOptions>
 {
   async startPayment(
-    _input: IPayProviderPaymentInput,
-    _clientOptions: IPayProviderPaypalClientOptions,
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderPaypalClientOptions,
+  ): Promise<IPayProviderPaymentSnapshot> {
+    if (input.providerOrderId) return await this.queryPayment(input, clientOptions);
+    if (!input.returnUrl || !input.cancelUrl) {
+      this.app.throw(422, 'PayPal payment requires return and cancel URLs');
+    }
+    this._assertReady(clientOptions);
+    const order = await this._gateway(clientOptions).createOrder(
+      this._gatewayOptions(clientOptions),
+      {
+        paypalRequestId: input.idempotencyKey,
+        body: {
+          intent: CheckoutPaymentIntent.Capture,
+          applicationContext: { returnUrl: input.returnUrl, cancelUrl: input.cancelUrl },
+          purchaseUnits: [
+            {
+              customId: String(input.paymentSessionId),
+              invoiceId: input.businessReference,
+              amount: {
+                currencyCode: input.currency,
+                value: formatMinorAmount(input.amountMinor, input.currency),
+              },
+            },
+          ],
+        },
+      },
+    );
+    const orderRecord = asRecord(order);
+    const approvalUrl = readString(
+      asArray(orderRecord.links)
+        .map(asRecord)
+        .find(item => item.rel === 'approve')?.href,
+    );
+    const orderId = readString(orderRecord.id);
+    if (!orderId || !approvalUrl) this.app.throw(502, 'PayPal did not return an approval order');
+    return {
+      state: 'requires_action',
+      providerPaymentId: orderId,
+      providerOrderId: orderId,
+      nextAction: { kind: 'redirect', url: approvalUrl },
+    };
+  }
+
+  async confirmPayment(
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderPaypalClientOptions,
   ): Promise<IPayProviderPaymentSnapshot> {
-    this.app.throw(501, 'PayPal provider is not configured');
+    this._assertReady(clientOptions);
+    if (!input.providerOrderId) this.app.throw(409, 'PayPal payment has no provider order');
+    const order = await this._gateway(clientOptions).captureOrder(
+      this._gatewayOptions(clientOptions),
+      {
+        id: input.providerOrderId,
+        paypalRequestId: input.idempotencyKey,
+      },
+    );
+    return this._mapOrder(order, input, clientOptions);
   }
 
   async queryPayment(
-    _input: IPayProviderPaymentInput,
-    _clientOptions: IPayProviderPaypalClientOptions,
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderPaypalClientOptions,
   ): Promise<IPayProviderPaymentSnapshot> {
-    this.app.throw(501, 'PayPal provider is not configured');
+    this._assertReady(clientOptions);
+    if (!input.providerOrderId) this.app.throw(409, 'PayPal payment has no provider order');
+    const order = await this._gateway(clientOptions).getOrder(this._gatewayOptions(clientOptions), {
+      id: input.providerOrderId,
+    });
+    return this._mapOrder(order, input, clientOptions);
   }
 
   async createRefund(
-    _input: IPayProviderRefundInput,
-    _clientOptions: IPayProviderPaypalClientOptions,
+    input: IPayProviderRefundInput,
+    clientOptions: IPayProviderPaypalClientOptions,
   ): Promise<IPayProviderRefundSnapshot> {
-    this.app.throw(501, 'PayPal provider is not configured');
+    this._assertReady(clientOptions);
+    const refund = await this._gateway(clientOptions).refundCapturedPayment(
+      this._gatewayOptions(clientOptions),
+      {
+        captureId: input.providerCaptureId,
+        paypalRequestId: input.idempotencyKey,
+        body: {
+          amount: {
+            currencyCode: input.currency,
+            value: formatMinorAmount(input.amountMinor, input.currency),
+          },
+          customId: String(input.refundOperationId),
+          invoiceId: input.businessReference,
+        },
+      },
+    );
+    return this._mapRefund(refund, input, clientOptions);
+  }
+
+  async queryRefund(
+    input: IPayProviderRefundInput,
+    clientOptions: IPayProviderPaypalClientOptions,
+  ): Promise<IPayProviderRefundSnapshot> {
+    this._assertReady(clientOptions);
+    if (!input.providerRefundId)
+      this.app.throw(409, 'PayPal refund has no provider refund identifier');
+    const refund = await this._gateway(clientOptions).getRefund(
+      this._gatewayOptions(clientOptions),
+      {
+        refundId: input.providerRefundId,
+      },
+    );
+    return this._mapRefund(refund, input, clientOptions);
   }
 
   async verifyWebhook(
-    _input: IPayProviderWebhookInput,
-    _clientOptions: IPayProviderPaypalClientOptions,
+    input: IPayProviderWebhookInput,
+    clientOptions: IPayProviderPaypalClientOptions,
+  ): Promise<IPayProviderVerifiedWebhook> {
+    this._assertReady(clientOptions);
+    const webhook = PaypalWebhookSchema.safeParse(input.body);
+    if (!webhook.success) this.app.throw(400, 'PayPal webhook is invalid');
+    try {
+      await this._gateway(clientOptions).verifyWebhookSignature(
+        this._gatewayOptions(clientOptions),
+        input,
+      );
+    } catch (error) {
+      this._throwGatewayError(error);
+    }
+    return await this._mapWebhook(webhook.data, clientOptions);
+  }
+
+  private async _mapWebhook(
+    event: z.infer<typeof PaypalWebhookSchema>,
+    clientOptions: IPayProviderPaypalClientOptions,
   ): Promise<IPayProviderVerifiedWebhook> {
-    this.app.throw(501, 'PayPal webhook verification is not configured');
+    const resource = event.resource;
+    const amount = parsePaypalAmount(resource.amount);
+    const currency = parsePaypalCurrency(resource.amount);
+    const resourceId = readString(resource.id);
+    if (!resourceId || !amount || !currency)
+      this.app.throw(400, 'PayPal webhook has invalid resource');
+
+    if (isRefundEvent(event.event_type)) {
+      const refundOperationId = readString(readField(resource, 'customId', 'custom_id'));
+      const captureId = readNestedString(resource, [
+        'supplementary_data',
+        'related_ids',
+        'capture_id',
+      ]);
+      if (!refundOperationId || !captureId)
+        this.app.throw(400, 'PayPal refund webhook is not correlated');
+      const refund = await this.$scope.pay.model.refundOperation.getById(
+        refundOperationId as never,
+      );
+      if (!refund) this.app.throw(404, 'PayPal refund operation not found');
+      const session = await this.$scope.pay.model.paymentSession.getById(refund.paymentSessionId);
+      if (!session || session.providerCaptureId !== captureId) {
+        this.app.throw(409, 'PayPal refund webhook capture conflicts');
+      }
+      const snapshot = this._mapRefund(
+        resource,
+        {
+          paymentSessionId: session.id,
+          refundOperationId: refund.id,
+          businessReference: refund.businessReference,
+          idempotencyKey: '',
+          amountMinor: refund.amountMinor,
+          currency: refund.currency,
+          providerCaptureId: captureId,
+          providerRefundId: resourceId,
+        },
+        clientOptions,
+      );
+      return {
+        eventId: event.id,
+        eventType: event.event_type,
+        refundOperationId: refund.id,
+        refund: snapshot,
+        summary: { amountMinor: amount, currency },
+      };
+    }
+
+    if (event.event_type.startsWith('PAYMENT.CAPTURE.')) {
+      const orderId = readNestedString(resource, ['supplementaryData', 'relatedIds', 'orderId']);
+      if (!orderId) this.app.throw(400, 'PayPal capture webhook has no order identifier');
+      const order = await this._gateway(clientOptions).getOrder(
+        this._gatewayOptions(clientOptions),
+        {
+          id: orderId,
+        },
+      );
+      const input = this._inputFromOrder(order, orderId);
+      const payment = this._mapOrder(order, input, clientOptions);
+      if (!['succeeded', 'failed', 'cancelled'].includes(payment.state)) {
+        this.app.throw(400, 'PayPal capture webhook is not terminal');
+      }
+      if (payment.providerCaptureId && payment.providerCaptureId !== resourceId) {
+        this.app.throw(409, 'PayPal capture webhook conflicts with order capture');
+      }
+      return {
+        eventId: event.id,
+        eventType: event.event_type,
+        paymentSessionId: input.paymentSessionId,
+        payment,
+        summary: { amountMinor: amount, currency },
+      };
+    }
+    this.app.throw(400, 'PayPal webhook event type is unsupported');
+  }
+
+  private _inputFromOrder(order: unknown, providerOrderId: string): IPayProviderPaymentInput {
+    const orderRecord = asRecord(order);
+    const unit = asArray(readField(orderRecord, 'purchaseUnits', 'purchase_units'))[0];
+    const unitRecord = asRecord(unit);
+    const customId = readString(readField(unitRecord, 'customId', 'custom_id'));
+    const businessReference = readString(readField(unitRecord, 'invoiceId', 'invoice_id'));
+    const amountMinor = parsePaypalAmount(readField(unitRecord, 'amount'));
+    const currency = parsePaypalCurrency(readField(unitRecord, 'amount'));
+    if (!customId || !businessReference || amountMinor === undefined || !currency) {
+      this.app.throw(400, 'PayPal order is not correlated');
+    }
+    return {
+      paymentSessionId: customId as never,
+      businessReference,
+      idempotencyKey: '',
+      amountMinor,
+      currency,
+      providerOrderId,
+    };
+  }
+
+  private _mapOrder(
+    order: unknown,
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderPaypalClientOptions,
+  ): IPayProviderPaymentSnapshot {
+    const orderRecord = asRecord(order);
+    const orderId = readString(orderRecord.id);
+    if (!orderId || orderId !== input.providerOrderId) {
+      this.app.throw(409, 'PayPal order identifier conflicts');
+    }
+    const units = asArray(readField(orderRecord, 'purchaseUnits', 'purchase_units'));
+    if (units.length !== 1) this.app.throw(409, 'PayPal order has an invalid purchase-unit count');
+    const unit = asRecord(units[0]);
+    if (
+      readString(readField(unit, 'customId', 'custom_id')) !== String(input.paymentSessionId) ||
+      readString(readField(unit, 'invoiceId', 'invoice_id')) !== input.businessReference ||
+      parsePaypalAmount(readField(unit, 'amount')) !== input.amountMinor ||
+      parsePaypalCurrency(readField(unit, 'amount')) !== input.currency
+    ) {
+      this.app.throw(409, 'PayPal order facts conflict with the payment session');
+    }
+    this._assertMerchant(unit, clientOptions);
+    const captures = asArray(readField(asRecord(readField(unit, 'payments')), 'captures'));
+    if (captures.length > 1) this.app.throw(409, 'PayPal order has multiple captures');
+    const capture = asRecord(captures[0]);
+    const captureId = readString(capture.id);
+    const captureStatus = readString(capture.status);
+    if (captureId) {
+      if (
+        parsePaypalAmount(capture.amount) !== input.amountMinor ||
+        parsePaypalCurrency(capture.amount) !== input.currency
+      ) {
+        this.app.throw(409, 'PayPal capture facts conflict with the payment session');
+      }
+      if (captureStatus === 'COMPLETED') {
+        return {
+          state: 'succeeded',
+          providerPaymentId: orderId,
+          providerOrderId: orderId,
+          providerCaptureId: captureId,
+          nextAction: { kind: 'completed' },
+        };
+      }
+      if (captureStatus === 'FAILED' || captureStatus === 'DECLINED') {
+        return {
+          state: 'failed',
+          providerPaymentId: orderId,
+          providerOrderId: orderId,
+          providerCaptureId: captureId,
+        };
+      }
+      if (captureStatus === 'PENDING') {
+        return {
+          state: 'processing',
+          providerPaymentId: orderId,
+          providerOrderId: orderId,
+          providerCaptureId: captureId,
+        };
+      }
+    }
+    if (orderRecord.status === OrderStatus.Voided) {
+      return { state: 'cancelled', providerPaymentId: orderId, providerOrderId: orderId };
+    }
+    return { state: 'requires_action', providerPaymentId: orderId, providerOrderId: orderId };
+  }
+
+  private _mapRefund(
+    refund: unknown,
+    input: IPayProviderRefundInput,
+    clientOptions: IPayProviderPaypalClientOptions,
+  ): IPayProviderRefundSnapshot {
+    const record = asRecord(refund);
+    const providerRefundId = readString(record.id);
+    if (!providerRefundId) this.app.throw(502, 'PayPal refund returned no identifier');
+    if (
+      (input.providerRefundId && input.providerRefundId !== providerRefundId) ||
+      readString(readField(record, 'customId', 'custom_id')) !== String(input.refundOperationId) ||
+      readString(readField(record, 'invoiceId', 'invoice_id')) !== input.businessReference ||
+      parsePaypalAmount(record.amount) !== input.amountMinor ||
+      parsePaypalCurrency(record.amount) !== input.currency
+    ) {
+      this.app.throw(409, 'PayPal refund facts conflict with the refund operation');
+    }
+    this._assertMerchant(record, clientOptions);
+    return mapRefund(readString(record.status), providerRefundId);
+  }
+
+  private _gateway(clientOptions: IPayProviderPaypalClientOptions) {
+    return clientOptions.gateway ?? createPaypalGateway(this.bean.core.fetch);
+  }
+
+  private _gatewayOptions(clientOptions: IPayProviderPaypalClientOptions): IPaypalGatewayOptions {
+    const { clientId, clientSecret } = clientOptions.secretCredential;
+    const webhookId = clientOptions.webhookId;
+    if (!clientId || !clientSecret || !webhookId) {
+      this.app.throw(503, 'PayPal is not fully configured');
+    }
+    return {
+      environment: clientOptions.environment,
+      clientId,
+      clientSecret,
+      webhookId,
+    };
+  }
+
+  private _throwGatewayError(error: unknown): never {
+    if (error instanceof PaypalGatewayError) this.app.throw(error.status, error.message);
+    throw error;
   }
+
+  private _assertReady(clientOptions: IPayProviderPaypalClientOptions) {
+    const { clientId, clientSecret } = clientOptions.secretCredential;
+    if (
+      !clientId ||
+      !clientSecret ||
+      !clientOptions.webhookId ||
+      !clientOptions.merchantReference
+    ) {
+      this.app.throw(503, 'PayPal is not fully configured');
+    }
+  }
+
+  private _assertMerchant(
+    value: Record<string, unknown>,
+    clientOptions: IPayProviderPaypalClientOptions,
+  ) {
+    const merchantId =
+      readNestedString(value, ['payee', 'merchantId']) ??
+      readNestedString(value, ['payee', 'merchant_id']) ??
+      readNestedString(value, ['sellerReceivableBreakdown', 'payee', 'merchantId']) ??
+      readNestedString(value, ['seller_receivable_breakdown', 'payee', 'merchant_id']);
+    if (!merchantId || merchantId !== clientOptions.merchantReference) {
+      this.app.throw(409, 'PayPal merchant reference conflicts');
+    }
+  }
+}
+
+function formatMinorAmount(amountMinor: number, currency: string) {
+  if (!Number.isSafeInteger(amountMinor) || amountMinor < 0 || currency !== 'USD') {
+    throw new Error('PayPal supports only nonnegative USD minor-unit amounts');
+  }
+  return `${Math.floor(amountMinor / 100)}.${String(amountMinor % 100).padStart(2, '0')}`;
+}
+
+function mapRefund(
+  status: string | undefined,
+  providerRefundId: string,
+): IPayProviderRefundSnapshot {
+  if (status === 'COMPLETED') return { state: 'succeeded', providerRefundId };
+  if (status === 'FAILED') return { state: 'failed', providerRefundId };
+  if (status === 'CANCELLED') return { state: 'cancelled', providerRefundId };
+  return { state: 'pending', providerRefundId };
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' ? (value as Record<string, unknown>) : {};
+}
+
+function asArray(value: unknown): unknown[] {
+  return Array.isArray(value) ? value : [];
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === 'string' && value ? value : undefined;
+}
+
+function readField(record: Record<string, unknown>, ...keys: string[]) {
+  for (const key of keys) {
+    if (record[key] !== undefined) return record[key];
+  }
+  return undefined;
+}
+
+function readNestedString(value: unknown, path: string[]) {
+  let current: unknown = value;
+  for (const key of path) {
+    const record = asRecord(current);
+    current = record[key] ?? record[camelToSnake(key)];
+  }
+  return readString(current);
+}
+
+function camelToSnake(value: string) {
+  return value.replace(/[A-Z]/g, character => `_${character.toLowerCase()}`);
+}
+
+function parsePaypalAmount(value: unknown): number | undefined {
+  const amount = asRecord(value);
+  if (readString(readField(amount, 'currencyCode', 'currency_code')) !== 'USD') return undefined;
+  const decimal = readString(amount.value);
+  if (!decimal || !/^\d+\.\d{2}$/.test(decimal)) return undefined;
+  const [whole, fractional] = decimal.split('.');
+  const result = Number(whole) * 100 + Number(fractional);
+  return Number.isSafeInteger(result) ? result : undefined;
+}
+
+function parsePaypalCurrency(value: unknown) {
+  const amount = asRecord(value);
+  const currency = readString(readField(amount, 'currencyCode', 'currency_code'));
+  return currency === 'USD' ? currency : undefined;
+}
+
+function isRefundEvent(eventType: string) {
+  return eventType === 'PAYMENT.CAPTURE.REFUNDED' || eventType.startsWith('PAYMENT.REFUND.');
 }
 
 declare module 'vona-module-a-pay' {

package/src/lib/index.ts

@@ -1 +1 @@
-export {};
+export * from './paypalGateway.ts';

package/src/lib/paypalGateway.ts

@@ -0,0 +1,129 @@
+import {
+  Client,
+  Environment,
+  OrdersController,
+  PaymentsController,
+} from '@cabloy/paypal-server-sdk';
+
+export interface IPaypalGatewayOptions {
+  environment: 'sandbox' | 'live';
+  clientId: string;
+  clientSecret: string;
+  webhookId: string;
+}
+
+export interface IPaypalGateway {
+  createOrder(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+  captureOrder(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+  getOrder(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+  refundCapturedPayment(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+  getRefund(options: IPaypalGatewayOptions, input: unknown): Promise<unknown>;
+  verifyWebhookSignature(
+    options: IPaypalGatewayOptions,
+    input: { headers: Record<string, string | string[] | undefined>; body: unknown },
+  ): Promise<void>;
+}
+
+export class PaypalGatewayError extends Error {
+  constructor(
+    readonly status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export function createPaypalGateway(fetcher: typeof fetch): IPaypalGateway {
+  return {
+    async createOrder(options, input) {
+      return (await new OrdersController(createClient(options)).createOrder(input as never)).result;
+    },
+    async captureOrder(options, input) {
+      return (await new OrdersController(createClient(options)).captureOrder(input as never))
+        .result;
+    },
+    async getOrder(options, input) {
+      return (await new OrdersController(createClient(options)).getOrder(input as never)).result;
+    },
+    async refundCapturedPayment(options, input) {
+      return (
+        await new PaymentsController(createClient(options)).refundCapturedPayment(input as never)
+      ).result;
+    },
+    async getRefund(options, input) {
+      return (await new PaymentsController(createClient(options)).getRefund(input as never)).result;
+    },
+    async verifyWebhookSignature(options, input) {
+      const transmissionId = getHeader(input.headers, 'paypal-transmission-id');
+      const transmissionTime = getHeader(input.headers, 'paypal-transmission-time');
+      const certUrl = getHeader(input.headers, 'paypal-cert-url');
+      const authAlgo = getHeader(input.headers, 'paypal-auth-algo');
+      const transmissionSig = getHeader(input.headers, 'paypal-transmission-sig');
+      if (!transmissionId || !transmissionTime || !certUrl || !authAlgo || !transmissionSig) {
+        throw new PaypalGatewayError(401, 'PayPal webhook transmission headers are invalid');
+      }
+      const apiBaseUrl =
+        options.environment === 'sandbox'
+          ? 'https://api-m.sandbox.paypal.com'
+          : 'https://api-m.paypal.com';
+      const tokenResponse = await fetcher(`${apiBaseUrl}/v1/oauth2/token`, {
+        method: 'POST',
+        headers: {
+          'authorization': `Basic ${Buffer.from(`${options.clientId}:${options.clientSecret}`).toString('base64')}`,
+          'content-type': 'application/x-www-form-urlencoded',
+        },
+        body: 'grant_type=client_credentials',
+      });
+      const token = asRecord(tokenResponse.ok ? await tokenResponse.json() : undefined);
+      const accessToken = readString(token.access_token);
+      if (!accessToken) {
+        throw new PaypalGatewayError(401, 'PayPal webhook verification authentication failed');
+      }
+      const response = await fetcher(`${apiBaseUrl}/v1/notifications/verify-webhook-signature`, {
+        method: 'POST',
+        headers: {
+          'authorization': `Bearer ${accessToken}`,
+          'content-type': 'application/json',
+        },
+        body: JSON.stringify({
+          auth_algo: authAlgo,
+          cert_url: certUrl,
+          transmission_id: transmissionId,
+          transmission_sig: transmissionSig,
+          transmission_time: transmissionTime,
+          webhook_id: options.webhookId,
+          webhook_event: input.body,
+        }),
+      });
+      if (!response.ok) throw new PaypalGatewayError(401, 'PayPal webhook verification failed');
+      const result = asRecord(await response.json());
+      if (readString(result.verification_status) !== 'SUCCESS') {
+        throw new PaypalGatewayError(401, 'PayPal webhook signature is invalid');
+      }
+    },
+  };
+}
+
+function createClient(options: IPaypalGatewayOptions) {
+  return new Client({
+    clientCredentialsAuthCredentials: {
+      oAuthClientId: options.clientId,
+      oAuthClientSecret: options.clientSecret,
+    },
+    timeout: 0,
+    environment: options.environment === 'live' ? Environment.Production : Environment.Sandbox,
+  });
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' ? (value as Record<string, unknown>) : {};
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === 'string' && value ? value : undefined;
+}
+
+function getHeader(headers: Record<string, string | string[] | undefined>, key: string) {
+  const value = headers[key];
+  return Array.isArray(value) ? value[0] : value;
+}

package/src/types/index.ts

@@ -3,6 +3,8 @@ declare module 'vona' {
     PAYPAL_CLIENT_ID: string | undefined;
     PAYPAL_CLIENT_SECRET: string | undefined;
     PAYPAL_WEBHOOK_ID: string | undefined;
+    PAYPAL_MERCHANT_REFERENCE: string | undefined;
+    PAYPAL_ENVIRONMENT: 'sandbox' | 'live';
   }
 }