@actuate-media/plugin-commerce 0.0.13 → 0.1.0

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @actuate-media/plugin-commerce
 
+## 0.1.0
+
+### Minor Changes
+
+- d278add: Verify Stripe webhook signatures and lock in the checkout money-mapping.
+
+  The webhook handler previously "verified" a payload by only checking that the
+  signature and secret strings were non-empty before parsing it — so a forged POST
+  with any non-empty `Stripe-Signature` would be processed as a real event (a fake
+  `payment_intent.succeeded` is a direct fraud risk). `handleStripeWebhook` now
+  performs real HMAC-SHA256 verification via a new exported `verifyStripeSignature`
+  (a dependency-free equivalent of `stripe.webhooks.constructEvent`: signed-payload
+  HMAC, constant-time compare, multi-`v1` key rotation, and timestamp replay
+  tolerance).
+
+  The money-critical checkout mapping (dollar→integer-cents rounding for line items
+  and shipping, discounts, metadata) is extracted into a pure, exported
+  `buildCheckoutSessionParams` so it is unit-tested independently of the
+  (still-stubbed) Stripe API call. Adds 15 behavioral tests covering signature
+  accept/reject/replay/rotation, event routing, and cents/shipping/discount mapping.
+
+## 0.0.14
+
+### Patch Changes
+
+- c231dd0: Add `definePlugin` and migrate all 10 plugins onto the canonical `PluginDefinition` contract.
+
+  cms-core already exported `PluginDefinition`, but every plugin hand-rolled a
+  local `ActuatePlugin` interface — a lossy subset that dropped `version`/`init`
+  and, in blocks/email/ai, widened hook payloads to `unknown[]`/`event: string`.
+  That's copy-paste drift with no shared source of truth.
+
+  `cms-core` now exports `definePlugin(plugin: PluginDefinition)` (an identity
+  helper like `defineConfig`), and each plugin imports the canonical type instead
+  of its own: the local `ActuatePlugin` interfaces are deleted, factory return
+  types are `PluginDefinition`, and the widened `hooks.ts` types are retyped as
+  `PluginHook[]`. Type-only change — no runtime behavior, plugin `name`, or config
+  options changed. Net −69 lines.
+
+- 325694f: Import `definePlugin` from the lightweight `@actuate-media/cms-core/config`
+  entry instead of the barrel.
+
+  The plugin-definition migration imported the `definePlugin` **value** from
+  `@actuate-media/cms-core`, which pulls the entire cms-core barrel (graphql,
+  sharp, sentry, codegen) into every plugin's runtime — bundle bloat for
+  consumers and, under parallel test load, a timeout. The `/config` subpath exists
+  precisely to avoid the barrel. Types stay as erased `import type`, so nothing
+  heavy is loaded. No API or behavior change.
+
 ## 0.0.13
 
 ### Patch Changes

package/dist/__tests__/checkout.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=checkout.test.d.ts.map

package/dist/__tests__/checkout.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/checkout.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/checkout.test.js

@@ -0,0 +1,68 @@
+import { describe, expect, it } from 'vitest';
+import { buildCheckoutSessionParams } from '../stripe/checkout.js';
+const base = { successUrl: '/success', cancelUrl: '/cancel' };
+const lineItem = (over = {}) => ({
+    productId: 'p1',
+    name: 'Widget',
+    quantity: 1,
+    unitPrice: 5,
+    ...over,
+});
+describe('buildCheckoutSessionParams', () => {
+    it('converts dollar unit prices to integer cents (float-safe)', () => {
+        const params = buildCheckoutSessionParams({
+            ...base,
+            lineItems: [lineItem({ unitPrice: 19.99, quantity: 2 })],
+        });
+        const li = params.line_items[0];
+        expect(li.price_data.unit_amount).toBe(1999); // 19.99*100 = 1998.999… → round
+        expect(li.quantity).toBe(2);
+        expect(params.mode).toBe('payment');
+        expect(params.success_url).toBe('/success');
+    });
+    it('rounds a value that floats below the integer (10.1 → 1010c)', () => {
+        const params = buildCheckoutSessionParams({
+            ...base,
+            lineItems: [lineItem({ unitPrice: 10.1 })],
+        });
+        expect(params.line_items[0].price_data.unit_amount).toBe(1010);
+    });
+    it('includes variant metadata + image only when present', () => {
+        const withVariant = buildCheckoutSessionParams({
+            ...base,
+            lineItems: [lineItem({ variantId: 'v1', image: 'https://img/x.png' })],
+        });
+        const pd = withVariant.line_items[0].price_data.product_data;
+        expect(pd.metadata).toEqual({ productId: 'p1', variantId: 'v1' });
+        expect(pd.images).toEqual(['https://img/x.png']);
+        const bare = buildCheckoutSessionParams({ ...base, lineItems: [lineItem()] });
+        const pd2 = bare.line_items[0].price_data.product_data;
+        expect(pd2.metadata).toEqual({ productId: 'p1' });
+        expect(pd2.images).toEqual([]);
+    });
+    it('maps shipping options to fixed_amount cents', () => {
+        const params = buildCheckoutSessionParams({
+            ...base,
+            lineItems: [lineItem()],
+            shippingOptions: [{ id: 's1', label: 'Express', amount: 12.5 }],
+        });
+        const so = params.shipping_options[0];
+        expect(so.shipping_rate_data.fixed_amount).toEqual({ amount: 1250, currency: 'usd' });
+        expect(so.shipping_rate_data.display_name).toBe('Express');
+    });
+    it('adds discounts + customer_email only when provided', () => {
+        const full = buildCheckoutSessionParams({
+            ...base,
+            lineItems: [lineItem()],
+            discountCode: 'SAVE10',
+            customerEmail: 'a@b.com',
+        });
+        expect(full.discounts).toEqual([{ coupon: 'SAVE10' }]);
+        expect(full.customer_email).toBe('a@b.com');
+        const bare = buildCheckoutSessionParams({ ...base, lineItems: [lineItem()] });
+        expect(bare.discounts).toBeUndefined();
+        expect(bare.customer_email).toBeUndefined();
+        expect(bare.shipping_options).toBeUndefined();
+    });
+});
+//# sourceMappingURL=checkout.test.js.map

package/dist/__tests__/checkout.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.test.js","sourceRoot":"","sources":["../../src/__tests__/checkout.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAElE,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AAC7D,MAAM,QAAQ,GAAG,CAAC,OAAgC,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC;IACX,SAAS,EAAE,CAAC;IACZ,GAAG,IAAI;CACR,CAAC,CAAA;AAEF,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,0BAA0B,CAAC;YACxC,GAAG,IAAI;YACP,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;SACzD,CAAC,CAAA;QACF,MAAM,EAAE,GAAI,MAAM,CAAC,UAAoB,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,gCAAgC;QAC7E,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,0BAA0B,CAAC;YACxC,GAAG,IAAI;YACP,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;SAC3C,CAAC,CAAA;QACF,MAAM,CAAE,MAAM,CAAC,UAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,WAAW,GAAG,0BAA0B,CAAC;YAC7C,GAAG,IAAI;YACP,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;SACvE,CAAC,CAAA;QACF,MAAM,EAAE,GAAI,WAAW,CAAC,UAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAA;QACvE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACjE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAEhD,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7E,MAAM,GAAG,GAAI,IAAI,CAAC,UAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAA;QACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,0BAA0B,CAAC;YACxC,GAAG,IAAI;YACP,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC;YACvB,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,EAAE,GAAI,MAAM,CAAC,gBAA0B,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,IAAI,GAAG,0BAA0B,CAAC;YACtC,GAAG,IAAI;YACP,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC;YACvB,YAAY,EAAE,QAAQ;YACtB,aAAa,EAAE,SAAS;SACzB,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAE3C,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7E,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,aAAa,EAAE,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,aAAa,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/webhooks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhooks.test.d.ts.map

package/dist/__tests__/webhooks.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhooks.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/webhooks.test.js

@@ -0,0 +1,71 @@
+import { createHmac } from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { handleStripeWebhook, verifyStripeSignature } from '../stripe/webhooks.js';
+const SECRET = 'whsec_test';
+const NOW = 1_700_000_000_000; // fixed ms for deterministic replay checks
+const NOW_SEC = Math.floor(NOW / 1000);
+function sign(payload, ts = NOW_SEC, secret = SECRET) {
+    const sig = createHmac('sha256', secret).update(`${ts}.${payload}`).digest('hex');
+    return `t=${ts},v1=${sig}`;
+}
+describe('verifyStripeSignature', () => {
+    it('accepts a valid signature within the tolerance window', () => {
+        const payload = JSON.stringify({ type: 'x' });
+        expect(() => verifyStripeSignature(payload, sign(payload), SECRET, { now: NOW })).not.toThrow();
+    });
+    it('rejects a tampered payload', () => {
+        const header = sign('{"amount":100}');
+        expect(() => verifyStripeSignature('{"amount":999}', header, SECRET, { now: NOW })).toThrow(/mismatch/);
+    });
+    it('rejects a signature made with a different secret', () => {
+        const payload = '{}';
+        expect(() => verifyStripeSignature(payload, sign(payload, NOW_SEC, 'whsec_other'), SECRET, { now: NOW })).toThrow(/mismatch/);
+    });
+    it('rejects an out-of-tolerance timestamp (replay protection)', () => {
+        const payload = '{}';
+        expect(() => verifyStripeSignature(payload, sign(payload, NOW_SEC - 10_000), SECRET, { now: NOW })).toThrow(/tolerance/);
+    });
+    it('rejects a missing signature or missing secret', () => {
+        expect(() => verifyStripeSignature('{}', '', SECRET, { now: NOW })).toThrow(/Missing webhook signature/);
+        expect(() => verifyStripeSignature('{}', sign('{}'), '', { now: NOW })).toThrow(/Missing webhook signing secret/);
+    });
+    it('rejects a malformed signature header', () => {
+        expect(() => verifyStripeSignature('{}', 'garbage', SECRET, { now: NOW })).toThrow(/Malformed/);
+    });
+    it('accepts when any of multiple v1 signatures matches (key rotation)', () => {
+        const payload = '{}';
+        const good = createHmac('sha256', SECRET).update(`${NOW_SEC}.${payload}`).digest('hex');
+        const header = `t=${NOW_SEC},v1=deadbeef,v1=${good}`;
+        expect(() => verifyStripeSignature(payload, header, SECRET, { now: NOW })).not.toThrow();
+    });
+});
+describe('handleStripeWebhook', () => {
+    function evt(type, object = {}) {
+        const payload = JSON.stringify({ type, data: { object } });
+        return { payload, header: sign(payload) };
+    }
+    it('routes each known event type to handled=true', async () => {
+        for (const type of [
+            'checkout.session.completed',
+            'payment_intent.succeeded',
+            'charge.refunded',
+        ]) {
+            const { payload, header } = evt(type);
+            const res = await handleStripeWebhook(payload, header, SECRET, { now: NOW });
+            expect(res).toMatchObject({ handled: true, event: type });
+        }
+    });
+    it('returns handled=false for an unknown but authentic event', async () => {
+        const { payload, header } = evt('customer.created');
+        const res = await handleStripeWebhook(payload, header, SECRET, { now: NOW });
+        expect(res).toEqual({ handled: false, event: 'customer.created' });
+    });
+    it('does NOT process a forged event (invalid signature)', async () => {
+        // A fake "payment succeeded" — this must be rejected, not handled.
+        const payload = JSON.stringify({ type: 'payment_intent.succeeded', data: { object: {} } });
+        const res = await handleStripeWebhook(payload, `t=${NOW_SEC},v1=forged`, SECRET, { now: NOW });
+        expect(res.handled).toBe(false);
+        expect(res.error).toMatch(/verification failed/i);
+    });
+});
+//# sourceMappingURL=webhooks.test.js.map

package/dist/__tests__/webhooks.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.js","sourceRoot":"","sources":["../../src/__tests__/webhooks.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAElF,MAAM,MAAM,GAAG,YAAY,CAAA;AAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAA,CAAC,2CAA2C;AACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;AAEtC,SAAS,IAAI,CAAC,OAAe,EAAE,KAAa,OAAO,EAAE,MAAM,GAAG,MAAM;IAClE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,KAAK,EAAE,OAAO,GAAG,EAAE,CAAA;AAC5B,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACjG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CACzF,UAAU,CACX,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAA;QACpB,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAC5F,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAA;QACpB,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACtF,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CACzE,2BAA2B,CAC5B,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAC7E,gCAAgC,CACjC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAA;QACpB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACvF,MAAM,MAAM,GAAG,KAAK,OAAO,mBAAmB,IAAI,EAAE,CAAA;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAC1F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,SAAS,GAAG,CAAC,IAAY,EAAE,SAAkC,EAAE;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAA;IAC3C,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,KAAK,MAAM,IAAI,IAAI;YACjB,4BAA4B;YAC5B,0BAA0B;YAC1B,iBAAiB;SAClB,EAAE,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;YACrC,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAC1F,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,OAAO,YAAY,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { FieldDefinition, CollectionDefinition, PluginHook } from '@actuate-media/cms-core';
+import { type PluginDefinition } from '@actuate-media/cms-core/config';
 export interface CommercePluginConfig {
     stripe?: {
         secretKey: string;
@@ -12,19 +12,8 @@ export interface CommercePluginConfig {
         enabled?: boolean;
     };
 }
-interface ActuatePlugin {
-    name: string;
-    fields?: Record<string, FieldDefinition>;
-    collections?: Record<string, CollectionDefinition>;
-    adminNavItems?: Array<{
-        label: string;
-        icon: string;
-        path: string;
-    }>;
-    hooks?: PluginHook[];
-}
 /** Creates the Actuate Commerce plugin with optional Stripe, tax, and shipping configuration. */
-export declare function commercePlugin(config?: CommercePluginConfig): ActuatePlugin;
+export declare function commercePlugin(config?: CommercePluginConfig): PluginDefinition;
 export type { CommercePluginConfig as CommerceConfig };
 export { commerceFields } from './fields.js';
 export { commerceCollections } from './collections.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAKhG,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,aAAa,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,aAAa,CAAC,EAAE,OAAO,CAAA;KACxB,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAClD,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;CACrB;AAED,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,MAAM,GAAE,oBAAyB,GAAG,aAAa,CAiB/E;AAED,YAAY,EAAE,oBAAoB,IAAI,cAAc,EAAE,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAKpF,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,aAAa,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,aAAa,CAAC,EAAE,OAAO,CAAA;KACxB,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,MAAM,GAAE,oBAAyB,GAAG,gBAAgB,CAiBlF;AAED,YAAY,EAAE,oBAAoB,IAAI,cAAc,EAAE,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -1,9 +1,10 @@
+import { definePlugin } from '@actuate-media/cms-core/config';
 import { commerceFields } from './fields.js';
 import { commerceCollections } from './collections.js';
 import { commerceHooks } from './hooks.js';
 /** Creates the Actuate Commerce plugin with optional Stripe, tax, and shipping configuration. */
 export function commercePlugin(config = {}) {
-    return {
+    return definePlugin({
         name: 'commerce',
         fields: commerceFields,
         collections: commerceCollections,
@@ -18,7 +19,7 @@ export function commercePlugin(config = {}) {
             },
         ],
         hooks: commerceHooks,
-    };
+    });
 }
 export { commerceFields } from './fields.js';
 export { commerceCollections } from './collections.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAwB1C,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,SAA+B,EAAE;IAC9D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;QAChC,aAAa,EAAE;YACb,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE;YAClE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE;YACpE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE;YACpE;gBACE,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,qBAAqB;aAC5B;SACF;QACD,KAAK,EAAE,aAAa;KACrB,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAyB,MAAM,gCAAgC,CAAA;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAgB1C,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,SAA+B,EAAE;IAC9D,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;QAChC,aAAa,EAAE;YACb,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE;YAClE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE;YACpE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE;YACpE;gBACE,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,qBAAqB;aAC5B;SACF;QACD,KAAK,EAAE,aAAa;KACrB,CAAC,CAAA;AACJ,CAAC;AAGD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA"}

package/dist/stripe/checkout.d.ts

@@ -24,6 +24,16 @@ export interface CheckoutSession {
     url: string;
     expiresAt: Date;
 }
+/**
+ * Build the Stripe Checkout Session params from cart line items and options.
+ *
+ * Pure and money-critical: it converts dollar amounts to integer cents
+ * (`Math.round(x * 100)`) for every line item and shipping rate. Extracted from
+ * `createCheckoutSession` so this mapping is unit-testable independently of the
+ * (still-stubbed) Stripe API call — a cents-rounding or field-shape bug here is
+ * a real overcharge/undercharge once the SDK is wired.
+ */
+export declare function buildCheckoutSessionParams(options: CheckoutSessionOptions): Record<string, unknown>;
 /** Creates a Stripe Checkout session from cart line items and configuration. */
 export declare function createCheckoutSession(options: CheckoutSessionOptions): Promise<CheckoutSession>;
 //# sourceMappingURL=checkout.d.ts.map

package/dist/stripe/checkout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkout.d.ts","sourceRoot":"","sources":["../../src/stripe/checkout.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,gBAAgB,EAAE,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,gFAAgF;AAChF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAgD1B"}
+{"version":3,"file":"checkout.d.ts","sourceRoot":"","sources":["../../src/stripe/checkout.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,gBAAgB,EAAE,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,IAAI,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,sBAAsB,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwCzB;AAED,gFAAgF;AAChF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAa1B"}

package/dist/stripe/checkout.js

@@ -1,5 +1,13 @@
-/** Creates a Stripe Checkout session from cart line items and configuration. */
-export async function createCheckoutSession(options) {
+/**
+ * Build the Stripe Checkout Session params from cart line items and options.
+ *
+ * Pure and money-critical: it converts dollar amounts to integer cents
+ * (`Math.round(x * 100)`) for every line item and shipping rate. Extracted from
+ * `createCheckoutSession` so this mapping is unit-testable independently of the
+ * (still-stubbed) Stripe API call — a cents-rounding or field-shape bug here is
+ * a real overcharge/undercharge once the SDK is wired.
+ */
+export function buildCheckoutSessionParams(options) {
     const stripeLineItems = options.lineItems.map((item) => ({
         price_data: {
             currency: 'usd',
@@ -34,7 +42,13 @@ export async function createCheckoutSession(options) {
     if (options.discountCode) {
         sessionParams['discounts'] = [{ coupon: options.discountCode }];
     }
+    return sessionParams;
+}
+/** Creates a Stripe Checkout session from cart line items and configuration. */
+export async function createCheckoutSession(options) {
+    const sessionParams = buildCheckoutSessionParams(options);
     // TODO: Call Stripe SDK — stripe.checkout.sessions.create(sessionParams)
+    void sessionParams;
     const expiresAt = new Date();
     expiresAt.setMinutes(expiresAt.getMinutes() + 30);
     return {

package/dist/stripe/checkout.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkout.js","sourceRoot":"","sources":["../../src/stripe/checkout.ts"],"names":[],"mappings":"AA8BA,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA+B;IAE/B,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,UAAU,EAAE;YACV,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;gBACtC,QAAQ,EAAE;oBACR,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD;aACF;YACD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;SAC9C;QACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC,CAAA;IAEH,MAAM,aAAa,GAA4B;QAC7C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,OAAO,CAAC,UAAU;QAC/B,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAA;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;QACpC,aAAa,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,kBAAkB,EAAE;gBAClB,YAAY,EAAE,GAAG,CAAC,KAAK;gBACvB,IAAI,EAAE,cAAc;gBACpB,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;aACxE;SACF,CAAC,CAAC,CAAA;IACL,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,yEAAyE;IACzE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;IAC5B,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAEjD,OAAO;QACL,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;QAC3B,GAAG,EAAE,2CAA2C,IAAI,CAAC,GAAG,EAAE,EAAE;QAC5D,SAAS;KACV,CAAA;AACH,CAAC"}
+{"version":3,"file":"checkout.js","sourceRoot":"","sources":["../../src/stripe/checkout.ts"],"names":[],"mappings":"AA8BA;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA+B;IAE/B,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,UAAU,EAAE;YACV,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;gBACtC,QAAQ,EAAE;oBACR,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD;aACF;YACD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;SAC9C;QACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC,CAAA;IAEH,MAAM,aAAa,GAA4B;QAC7C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,OAAO,CAAC,UAAU;QAC/B,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAA;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;QACpC,aAAa,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,kBAAkB,EAAE;gBAClB,YAAY,EAAE,GAAG,CAAC,KAAK;gBACvB,IAAI,EAAE,cAAc;gBACpB,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;aACxE;SACF,CAAC,CAAC,CAAA;IACL,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA+B;IAE/B,MAAM,aAAa,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;IAEzD,yEAAyE;IACzE,KAAK,aAAa,CAAA;IAClB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;IAC5B,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAEjD,OAAO;QACL,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;QAC3B,GAAG,EAAE,2CAA2C,IAAI,CAAC,GAAG,EAAE,EAAE;QAC5D,SAAS;KACV,CAAA;AACH,CAAC"}

package/dist/stripe/webhooks.d.ts

@@ -3,6 +3,26 @@ export interface WebhookResult {
     event: string;
     error?: string;
 }
+export interface VerifyOptions {
+    /** Reject events whose timestamp is further than this from now. Default 300s. */
+    toleranceSeconds?: number;
+    /** Current time in ms — injectable for deterministic tests. Default Date.now(). */
+    now?: number;
+}
+/**
+ * Verify a Stripe webhook signature (the `Stripe-Signature` header) against the
+ * raw request body using the endpoint's signing secret. This is a
+ * dependency-free equivalent of `stripe.webhooks.constructEvent`:
+ *
+ *   signed_payload = `${t}.${rawBody}`
+ *   expected       = HMAC-SHA256(signed_payload, secret)   // hex
+ *   valid          = any provided v1 == expected (constant-time) AND |now - t| ≤ tolerance
+ *
+ * Throws on any failure. Multiple `v1` signatures (key rotation) are supported.
+ * Without this, a forged POST with any non-empty signature would be processed —
+ * a fake "payment succeeded" is a direct money/fraud risk.
+ */
+export declare function verifyStripeSignature(payload: string, signatureHeader: string, secret: string, options?: VerifyOptions): void;
 /** Verifies and processes a Stripe webhook event payload. */
-export declare function handleStripeWebhook(payload: string, signature: string, secret: string): Promise<WebhookResult>;
+export declare function handleStripeWebhook(payload: string, signature: string, secret: string, options?: VerifyOptions): Promise<WebhookResult>;
 //# sourceMappingURL=webhooks.d.ts.map

package/dist/stripe/webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/stripe/webhooks.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAqCD,6DAA6D;AAC7D,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,CAAC,CAiCxB"}
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/stripe/webhooks.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAUD,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,aAAkB,GAC1B,IAAI,CAkCN;AAgCD,6DAA6D;AAC7D,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,aAAa,CAAC,CA8BxB"}

package/dist/stripe/webhooks.js

@@ -1,3 +1,57 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/** Default replay-protection window, matching Stripe's SDK (5 minutes). */
+const DEFAULT_TOLERANCE_SECONDS = 300;
+/**
+ * Verify a Stripe webhook signature (the `Stripe-Signature` header) against the
+ * raw request body using the endpoint's signing secret. This is a
+ * dependency-free equivalent of `stripe.webhooks.constructEvent`:
+ *
+ *   signed_payload = `${t}.${rawBody}`
+ *   expected       = HMAC-SHA256(signed_payload, secret)   // hex
+ *   valid          = any provided v1 == expected (constant-time) AND |now - t| ≤ tolerance
+ *
+ * Throws on any failure. Multiple `v1` signatures (key rotation) are supported.
+ * Without this, a forged POST with any non-empty signature would be processed —
+ * a fake "payment succeeded" is a direct money/fraud risk.
+ */
+export function verifyStripeSignature(payload, signatureHeader, secret, options = {}) {
+    if (!secret)
+        throw new Error('Missing webhook signing secret');
+    if (!signatureHeader)
+        throw new Error('Missing webhook signature');
+    let timestamp;
+    const signatures = [];
+    for (const part of signatureHeader.split(',')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = part.slice(0, eq).trim();
+        const value = part.slice(eq + 1).trim();
+        if (key === 't')
+            timestamp = value;
+        else if (key === 'v1')
+            signatures.push(value);
+    }
+    if (!timestamp || signatures.length === 0) {
+        throw new Error('Malformed webhook signature header');
+    }
+    const timestampSec = Number(timestamp);
+    if (!Number.isFinite(timestampSec))
+        throw new Error('Invalid webhook timestamp');
+    const nowSec = Math.floor((options.now ?? Date.now()) / 1000);
+    const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+    if (Math.abs(nowSec - timestampSec) > tolerance) {
+        throw new Error('Webhook timestamp outside tolerance (possible replay)');
+    }
+    const expected = createHmac('sha256', secret).update(`${timestamp}.${payload}`).digest('hex');
+    const expectedBuf = Buffer.from(expected);
+    const matches = signatures.some((sig) => {
+        const sigBuf = Buffer.from(sig);
+        return sigBuf.length === expectedBuf.length && timingSafeEqual(sigBuf, expectedBuf);
+    });
+    if (!matches)
+        throw new Error('Webhook signature mismatch');
+}
 async function handleCheckoutCompleted(session) {
     const customerEmail = session['customer_email'];
     const paymentIntentId = session['payment_intent'];
@@ -19,13 +73,10 @@ async function handleChargeRefunded(charge) {
     console.info(`[commerce:webhook] Charge refunded — charge=${chargeId} intent=${paymentIntentId} refunded=${amountRefunded}`);
 }
 /** Verifies and processes a Stripe webhook event payload. */
-export async function handleStripeWebhook(payload, signature, secret) {
+export async function handleStripeWebhook(payload, signature, secret, options = {}) {
     let event;
     try {
-        // TODO: Replace with stripe.webhooks.constructEvent(payload, signature, secret)
-        if (!signature || !secret) {
-            throw new Error('Missing webhook signature or secret');
-        }
+        verifyStripeSignature(payload, signature, secret, options);
         event = JSON.parse(payload);
     }
     catch (err) {

package/dist/stripe/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/stripe/webhooks.ts"],"names":[],"mappings":"AAWA,KAAK,UAAU,uBAAuB,CAAC,OAAgC;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAuB,CAAA;IACrE,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAuB,CAAA;IACvE,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAuB,CAAA;IAEjE,8CAA8C;IAC9C,OAAO,CAAC,IAAI,CACV,iDAAiD,aAAa,YAAY,eAAe,UAAU,WAAW,EAAE,CACjH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,aAAsC;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAuB,CAAA;IAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAuB,CAAA;IAE5D,oDAAoD;IACpD,OAAO,CAAC,IAAI,CAAC,iDAAiD,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAA;AAC5F,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA+B;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAuB,CAAA;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAuB,CAAA;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAuB,CAAA;IAEtE,wEAAwE;IACxE,OAAO,CAAC,IAAI,CACV,+CAA+C,QAAQ,WAAW,eAAe,aAAa,cAAc,EAAE,CAC/G,CAAA;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,IAAI,KAAkB,CAAA;IAEtB,IAAI,CAAC;QACH,gFAAgF;QAChF,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC1F,CAAA;IACH,CAAC;IAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,4BAA4B;YAC/B,MAAM,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;QAE7C,KAAK,0BAA0B;YAC7B,MAAM,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;QAE7C,KAAK,iBAAiB;YACpB,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;QAE7C;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IAChD,CAAC;AACH,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/stripe/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAazD,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,GAAG,CAAA;AASrC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,eAAuB,EACvB,MAAc,EACd,UAAyB,EAAE;IAE3B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAC9D,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAElE,IAAI,SAA6B,CAAA;IACjC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACvC,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS,GAAG,KAAK,CAAA;aAC7B,IAAI,GAAG,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAEhF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAA;IACvE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7F,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;AAC7D,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,OAAgC;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAuB,CAAA;IACrE,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAuB,CAAA;IACvE,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAuB,CAAA;IAEjE,8CAA8C;IAC9C,OAAO,CAAC,IAAI,CACV,iDAAiD,aAAa,YAAY,eAAe,UAAU,WAAW,EAAE,CACjH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,aAAsC;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAuB,CAAA;IAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAuB,CAAA;IAE5D,oDAAoD;IACpD,OAAO,CAAC,IAAI,CAAC,iDAAiD,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAA;AAC5F,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA+B;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAuB,CAAA;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAuB,CAAA;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAuB,CAAA;IAEtE,wEAAwE;IACxE,OAAO,CAAC,IAAI,CACV,+CAA+C,QAAQ,WAAW,eAAe,aAAa,cAAc,EAAE,CAC/G,CAAA;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,UAAyB,EAAE;IAE3B,IAAI,KAAkB,CAAA;IAEtB,IAAI,CAAC;QACH,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QAC1D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC1F,CAAA;IACH,CAAC;IAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,4BAA4B;YAC/B,MAAM,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;QAE7C,KAAK,0BAA0B;YAC7B,MAAM,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;QAE7C,KAAK,iBAAiB;YACpB,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;QAE7C;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IAChD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/plugin-commerce",
-  "version": "0.0.13",
+  "version": "0.1.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -28,7 +28,7 @@
     "@types/react": "^19.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.91.0"
+    "@actuate-media/cms-core": "0.93.0"
   },
   "peerDependencies": {
     "@actuate-media/cms-core": ">=0.1.0",