@adonis-agora/payments 0.2.0

package/dist/src/testing/mutable_clock.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A clock whose time can be advanced manually — for deterministic time-based tests
+ * (retries, trial windows) without real waits. Mirrors durable's testing `MutableClock`.
+ */
+export declare class MutableClock {
+    #private;
+    constructor(start?: Date);
+    now(): Date;
+    advance(ms: number): void;
+    set(date: Date): void;
+}
+//# sourceMappingURL=mutable_clock.d.ts.map

package/dist/src/testing/mutable_clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutable_clock.d.ts","sourceRoot":"","sources":["../../../src/testing/mutable_clock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,YAAY;;gBAGX,KAAK,OAAuC;IAIxD,GAAG,IAAI,IAAI;IAIX,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIzB,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;CAGtB"}

package/dist/src/testing/mutable_clock.js

@@ -0,0 +1,20 @@
+/**
+ * A clock whose time can be advanced manually — for deterministic time-based tests
+ * (retries, trial windows) without real waits. Mirrors durable's testing `MutableClock`.
+ */
+export class MutableClock {
+    #now;
+    constructor(start = new Date('2026-01-01T00:00:00.000Z')) {
+        this.#now = start;
+    }
+    now() {
+        return this.#now;
+    }
+    advance(ms) {
+        this.#now = new Date(this.#now.getTime() + ms);
+    }
+    set(date) {
+        this.#now = date;
+    }
+}
+//# sourceMappingURL=mutable_clock.js.map

package/dist/src/testing/mutable_clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutable_clock.js","sourceRoot":"","sources":["../../../src/testing/mutable_clock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,YAAY;IACvB,IAAI,CAAO;IAEX,YAAY,KAAK,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,IAAU;QACZ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/src/types.d.ts

@@ -0,0 +1,178 @@
+/**
+ * Shared domain types for the billing layer.
+ *
+ * These are the provider-agnostic shapes the drivers normalize into. Every gateway driver
+ * (Stripe, AbacatePay, Asaas, Woovi) maps its own API response onto these types, so the
+ * billing layer and application code never touch gateway-specific payloads.
+ */
+/** A monetary amount in the currency's smallest unit (e.g. cents for BRL/USD). */
+export type Money = number;
+/** ISO 4217 currency code, lowercase (e.g. `'brl'`, `'usd'`). */
+export type Currency = string;
+export type BillingStatus = 'pending' | 'paid' | 'failed' | 'refunded' | 'canceled' | 'disputed';
+export type SubscriptionStatus = 'trialing' | 'active' | 'past_due' | 'incomplete' | 'canceled' | 'ended';
+export type PaymentMethodType = 'card' | 'pix' | 'boleto' | 'debit_card' | 'unknown';
+/**
+ * Canonical payment method names used to route charges to a provider (`config.methods`).
+ * `undefined` means "let the customer choose at checkout" (gateway's `UNDEFINED`).
+ */
+export type PaymentMethodName = 'pix' | 'credit_card' | 'debit_card' | 'boleto' | 'undefined';
+export interface MoneyAmount {
+    amount: Money;
+    currency: Currency;
+}
+/** A customer as seen by the gateway. */
+export interface Customer {
+    id: string;
+    email?: string;
+    name?: string;
+    /** CPF/CNPJ (BR gateways) or tax id. */
+    taxId?: string;
+    /** Provider-specific extra data. */
+    metadata?: Record<string, unknown>;
+}
+export interface Payment {
+    id: string;
+    /** External gateway id. */
+    gatewayId: string;
+    provider: string;
+    amount: MoneyAmount;
+    status: BillingStatus;
+    /** The customer the payment belongs to, when the gateway has one. */
+    customerId?: string;
+    /** Payment method type (pix, card, boleto...). */
+    method?: PaymentMethodType;
+    /** Provider-specific raw payload. */
+    payload: Record<string, unknown>;
+    createdAt: string;
+    paidAt?: string;
+    /** Pix QR code / copy-paste code when the gateway provides one. */
+    pixQrCode?: string;
+    pixCopiaECola?: string;
+    /** URL to a hosted checkout/charge page when the gateway provides one. */
+    hostedUrl?: string;
+    /** The subscription this payment belongs to, when recurring. */
+    subscriptionId?: string;
+    /** Invoice emitted for this payment, when `invoice` was requested. */
+    invoice?: Invoice;
+}
+export interface Refund {
+    id: string;
+    gatewayId: string;
+    provider: string;
+    amount: MoneyAmount;
+    status: 'succeeded' | 'pending' | 'failed';
+    createdAt: string;
+}
+export interface CheckoutSession {
+    id: string;
+    gatewayId: string;
+    provider: string;
+    /** URL to redirect the customer to (hosted checkout). */
+    url: string;
+    status: 'open' | 'complete' | 'expired';
+    amount?: MoneyAmount;
+    /** The subscription created by this checkout, when it was a subscription checkout. */
+    subscriptionId?: string;
+    customerId?: string;
+}
+export interface Subscription {
+    id: string;
+    gatewayId: string;
+    provider: string;
+    customerId: string;
+    status: SubscriptionStatus;
+    /** Price id/plan id at the gateway. */
+    planId: string;
+    amount?: MoneyAmount;
+    /** ISO date the trial ends (when on trial). */
+    trialEndsAt?: string;
+    /** ISO date the subscription ends (canceled/ended). */
+    endsAt?: string;
+    /** Current billing period start (ISO). */
+    currentPeriodStart?: string;
+    /** Current billing period end (ISO). */
+    currentPeriodEnd?: string;
+    /** Provider-specific raw payload. */
+    payload: Record<string, unknown>;
+    createdAt: string;
+}
+export interface Invoice {
+    id: string;
+    gatewayId: string;
+    provider: string;
+    customerId?: string;
+    subscriptionId?: string;
+    status: 'draft' | 'open' | 'paid' | 'void' | 'uncollectible' | 'issued' | 'pending' | 'failed' | 'canceled';
+    amount: MoneyAmount;
+    /** ISO date the invoice was created. */
+    createdAt: string;
+    /** URL to download the invoice PDF, when the provider gives one. */
+    hostedPdfUrl?: string;
+    /** Invoice number, when issued. */
+    number?: string;
+    /** Access key (chave de acesso), when available. */
+    key?: string;
+    /** ISO date the invoice was issued. */
+    issuedAt?: string;
+    /** Provider-specific raw payload. */
+    payload: Record<string, unknown>;
+}
+/** A normalized webhook event from a gateway. */
+export interface WebhookEvent<T = unknown> {
+    /** Stable event id — used for idempotency. */
+    id: string;
+    provider: string;
+    /** Gateway event type, e.g. `checkout.completed`, `invoice.payment_succeeded`. */
+    type: string;
+    /** ISO timestamp of when the event happened at the gateway. */
+    createdAt?: string;
+    /** The normalized event payload. */
+    data: T;
+    /** The raw, unmodified gateway payload. */
+    raw: Record<string, unknown>;
+}
+/**
+ * Invoice emission options, passed to a charge/subscription call. The presence of the
+ * option means "emit an invoice for this charge":
+ *
+ * - `true` — use the default invoice provider from `config/payments.ts` (`invoice.default`).
+ * - `'focus'` — use the named invoice provider (a key of `invoice.providers`).
+ * - `{ provider?, ... }` — use the named provider (or the default) with these overrides.
+ *
+ * ```ts
+ * await payments.bill({
+ *   customerId: 'cus_x',
+ *   amount: 1990,
+ *   invoice: {
+ *     provider: 'focus',
+ *     service: { description: 'Software license', code: '1.01' },
+ *     tax: { iss: 5 },
+ *   },
+ * })
+ * ```
+ */
+export interface InvoiceOptions {
+    /** Named invoice provider (a key of `invoice.providers`). Defaults to `invoice.default`. */
+    provider?: string;
+    /** Service details for service invoices. Falls back to `invoice.defaults.service`. */
+    service?: {
+        description?: string;
+        /** Service code (código de serviço). */
+        code?: string;
+        /** Municipal service code (código de serviço municipal). */
+        cityServiceCode?: string;
+    };
+    /** Tax configuration. Falls back to `invoice.defaults.tax`. */
+    tax?: Record<string, unknown>;
+    /** Invoice recipient. Defaults to the billing customer's data. */
+    customer?: {
+        name?: string;
+        taxId?: string;
+        email?: string;
+        address?: Record<string, unknown>;
+    };
+    /** Extra provider-specific fields. */
+    metadata?: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kFAAkF;AAClF,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC;AAE3B,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjG,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAErF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE9F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;IACtB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EACF,OAAO,GACP,MAAM,GACN,MAAM,GACN,MAAM,GACN,eAAe,GACf,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,UAAU,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC;IACR,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,cAAc;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,wCAAwC;QACxC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,4DAA4D;QAC5D,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,CAAC;IACF,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}

package/dist/src/types.js

@@ -0,0 +1,9 @@
+/**
+ * Shared domain types for the billing layer.
+ *
+ * These are the provider-agnostic shapes the drivers normalize into. Every gateway driver
+ * (Stripe, AbacatePay, Asaas, Woovi) maps its own API response onto these types, so the
+ * billing layer and application code never touch gateway-specific payloads.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/webhook_handlers.d.ts

@@ -0,0 +1,76 @@
+import type { WebhookHandler } from './billing/webhook_processor.js';
+import type { WebhookEvent } from './types.js';
+/**
+ * A webhook-handler service constructor: the lib resolves it from the Adonis container
+ * (DI works) and calls `handle(event)` for each event of the registered type. A class
+ * with no dependencies is unaffected — the container simply does `new Ctor()`.
+ */
+export interface WebhookHandlerService {
+    new (...args: never[]): {
+        handle(event: WebhookEvent): void | Promise<void>;
+    };
+}
+/** The container surface handler resolution needs. */
+export interface HandlerContainer {
+    make<T>(token: unknown): Promise<T>;
+}
+/**
+ * Detect a {@link WebhookHandlerService} (a class with a `handle` method) vs a plain
+ * handler function. Arrow functions have no prototype; named functions have one without
+ * a `handle` member — only a class declaring `handle` matches, so plain handlers are
+ * never misrouted.
+ */
+export declare function isWebhookHandlerService(entry: unknown): entry is WebhookHandlerService;
+/**
+ * Resolve one `billing.handlers` entry (or a folder-discovered handler) into a concrete
+ * {@link WebhookHandler}: plain functions pass through; service classes are instantiated
+ * through the container and bound to their `handle` method.
+ */
+export declare function resolveWebhookHandler(entry: WebhookHandler | WebhookHandlerService, container: HandlerContainer): Promise<WebhookHandler>;
+/**
+ * A folder-discovered handler: the normalized event type plus the raw entry (function or
+ * service class) to resolve through the container at wiring time.
+ */
+export interface DiscoveredWebhookHandler {
+    type: string;
+    entry: WebhookHandler | WebhookHandlerService;
+}
+/** Shape each file in the conventions folder must default-export. */
+export interface WebhookHandlerModule {
+    /**
+     * Normalized event type this handler listens to (e.g. `'payment.succeeded'`). A service
+     * class declares it as `static eventType` instead.
+     */
+    type?: string;
+    /** Event-type static on a service class form. */
+    eventType?: string;
+    /** The handler function (object form). */
+    handle?: WebhookHandler;
+}
+/** Normalize a module's default export into a {@link DiscoveredWebhookHandler}, or null. */
+export declare function normalizeWebhookHandlerModule(mod: unknown): DiscoveredWebhookHandler | null;
+/** The build-time barrel the Assembler `init` hook generates — a map of key → lazy import. */
+export type WebhookHandlersBarrel = Record<string, () => Promise<Record<string, unknown>>>;
+/**
+ * Load the generated barrel (`.adonisjs/payments/webhook_handlers.js`) — the build-time
+ * equivalent of a directory scan, with no runtime `readdir`. Each module's default export
+ * is normalized via {@link normalizeWebhookHandlerModule}.
+ */
+export declare function loadWebhookHandlersFromBarrel(barrel: WebhookHandlersBarrel): Promise<DiscoveredWebhookHandler[]>;
+/**
+ * Pick the module extension a directory scan should import, from the `readdir` entries
+ * already in hand — NOT from this library's own compiled file. A consuming app resolves
+ * this library as built `.js`, but its own `app/payment_handlers` are `.ts` in dev;
+ * deriving the extension from `import.meta.url` would always pick `.js` and discover
+ * nothing. `.d.ts` entries are never importable. `.ts` wins over `.js` when both exist
+ * (same module never registered twice). Mirrors durable's `pickModuleExt`.
+ */
+export declare function pickModuleExt(entries: readonly string[]): '.ts' | '.js' | null;
+/**
+ * Scan the conventions folder RECURSIVELY for handler modules (default export is a
+ * `{ type, handle }` object or a service class with `static eventType`). Missing
+ * directory → empty list (the convention is opt-in: no `app/payment_handlers`, nothing
+ * to register). Mirrors durable's `discoverWorkflows`.
+ */
+export declare function discoverWebhookHandlers(dir: string): Promise<DiscoveredWebhookHandler[]>;
+//# sourceMappingURL=webhook_handlers.d.ts.map

package/dist/src/webhook_handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook_handlers.d.ts","sourceRoot":"","sources":["../../src/webhook_handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG;QAAE,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CAC/E;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAKtF;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,cAAc,GAAG,qBAAqB,EAC7C,SAAS,EAAE,gBAAgB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAAC;CAC/C;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,GAAG,IAAI,CAa3F;AAED,8FAA8F;AAC9F,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAE3F;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAcrC;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAY9E;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAyB9F"}

package/dist/src/webhook_handlers.js

@@ -0,0 +1,128 @@
+import { readdir } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+/**
+ * Detect a {@link WebhookHandlerService} (a class with a `handle` method) vs a plain
+ * handler function. Arrow functions have no prototype; named functions have one without
+ * a `handle` member — only a class declaring `handle` matches, so plain handlers are
+ * never misrouted.
+ */
+export function isWebhookHandlerService(entry) {
+    return (typeof entry === 'function' &&
+        Object.getOwnPropertyNames(entry.prototype ?? {}).includes('handle'));
+}
+/**
+ * Resolve one `billing.handlers` entry (or a folder-discovered handler) into a concrete
+ * {@link WebhookHandler}: plain functions pass through; service classes are instantiated
+ * through the container and bound to their `handle` method.
+ */
+export async function resolveWebhookHandler(entry, container) {
+    if (isWebhookHandlerService(entry)) {
+        const service = await container.make(entry);
+        return (event) => service.handle(event);
+    }
+    return entry;
+}
+/** Normalize a module's default export into a {@link DiscoveredWebhookHandler}, or null. */
+export function normalizeWebhookHandlerModule(mod) {
+    if (typeof mod !== 'function' && (typeof mod !== 'object' || mod === null))
+        return null;
+    const candidate = mod;
+    const type = candidate.type ?? candidate.eventType;
+    if (typeof type !== 'string')
+        return null;
+    if (typeof mod === 'function') {
+        // Service class form: `static eventType` + instance `handle`.
+        if (isWebhookHandlerService(mod))
+            return { type, entry: mod };
+        return null;
+    }
+    // Object form: `{ type, handle }`.
+    if (typeof candidate.handle !== 'function')
+        return null;
+    return { type, entry: candidate.handle };
+}
+/**
+ * Load the generated barrel (`.adonisjs/payments/webhook_handlers.js`) — the build-time
+ * equivalent of a directory scan, with no runtime `readdir`. Each module's default export
+ * is normalized via {@link normalizeWebhookHandlerModule}.
+ */
+export async function loadWebhookHandlersFromBarrel(barrel) {
+    const found = [];
+    const seen = new Set();
+    for (const load of Object.values(barrel)) {
+        const mod = await load();
+        for (const exported of Object.values(mod)) {
+            if (seen.has(exported))
+                continue;
+            const normalized = normalizeWebhookHandlerModule(exported);
+            if (!normalized)
+                continue;
+            seen.add(exported);
+            found.push(normalized);
+        }
+    }
+    return found;
+}
+/**
+ * Pick the module extension a directory scan should import, from the `readdir` entries
+ * already in hand — NOT from this library's own compiled file. A consuming app resolves
+ * this library as built `.js`, but its own `app/payment_handlers` are `.ts` in dev;
+ * deriving the extension from `import.meta.url` would always pick `.js` and discover
+ * nothing. `.d.ts` entries are never importable. `.ts` wins over `.js` when both exist
+ * (same module never registered twice). Mirrors durable's `pickModuleExt`.
+ */
+export function pickModuleExt(entries) {
+    let hasTs = false;
+    let hasJs = false;
+    for (const entry of entries) {
+        if (entry.endsWith('.d.ts'))
+            continue;
+        const ext = extname(entry);
+        if (ext === '.ts')
+            hasTs = true;
+        else if (ext === '.js')
+            hasJs = true;
+    }
+    if (hasTs)
+        return '.ts';
+    if (hasJs)
+        return '.js';
+    return null;
+}
+/**
+ * Scan the conventions folder RECURSIVELY for handler modules (default export is a
+ * `{ type, handle }` object or a service class with `static eventType`). Missing
+ * directory → empty list (the convention is opt-in: no `app/payment_handlers`, nothing
+ * to register). Mirrors durable's `discoverWorkflows`.
+ */
+export async function discoverWebhookHandlers(dir) {
+    let entries;
+    try {
+        entries = await readdir(dir, { recursive: true });
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    const moduleExt = pickModuleExt(entries);
+    const found = [];
+    if (moduleExt === null)
+        return found;
+    const seen = new Set();
+    for (const entry of entries.sort()) {
+        if (extname(entry) !== moduleExt || entry.endsWith(`.d${moduleExt}`))
+            continue;
+        const mod = (await import(pathToFileURL(join(dir, entry)).href));
+        const normalized = normalizeWebhookHandlerModule(mod.default);
+        if (!normalized)
+            continue;
+        if (seen.has(normalized.entry))
+            continue;
+        seen.add(normalized.entry);
+        found.push(normalized);
+    }
+    return found;
+}
+//# sourceMappingURL=webhook_handlers.js.map

package/dist/src/webhook_handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook_handlers.js","sourceRoot":"","sources":["../../src/webhook_handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAkBzC;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,CACL,OAAO,KAAK,KAAK,UAAU;QAC3B,MAAM,CAAC,mBAAmB,CAAE,KAAgC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACjG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA6C,EAC7C,SAA2B;IAE3B,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAsC,KAAK,CAAC,CAAC;QACjF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD,4FAA4F;AAC5F,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,IAAI,OAAO,GAAG,KAAK,UAAU,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,SAAS,GAAG,GAA2B,CAAC;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;QAC9B,8DAA8D;QAC9D,IAAI,uBAAuB,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mCAAmC;IACnC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAKD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAA6B;IAE7B,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAA0B;IACtD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC;aAC3B,IAAI,GAAG,KAAK,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC;IACvC,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAW;IACvD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YAAE,SAAS;QAC/E,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAE9D,CAAC;QACF,MAAM,UAAU,GAAG,6BAA6B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/webhook_security.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared webhook-auth primitives for the drivers. Every gateway signs webhooks
+ * differently (Stripe: SDK HMAC; AbacatePay: HMAC-SHA256; Woovi: HMAC-SHA1 or
+ * RSA-SHA256; Asaas: shared token), but the comparison and digest mechanics are the
+ * same — they live here so every driver verifies with the same, timing-safe code.
+ */
+/** Length-independent, timing-safe string comparison. */
+export declare function safeCompare(received: string, expected: string): boolean;
+/**
+ * Compute an HMAC over the raw webhook body and compare it to the signature header,
+ * timing-safe. `digest` matches the gateway's encoding (`base64` for AbacatePay and
+ * Woovi's HMAC mode).
+ */
+export declare function verifyHmacSignature(rawBody: string, signature: string | undefined, secret: string, algorithm: 'sha256' | 'sha1'): boolean;
+/**
+ * Verify Woovi's recommended `x-webhook-signature`: an RSA-SHA256 signature made with
+ * Woovi's private key, verified here against the public key published at
+ * `GET /api/v1/webhook/public-keys`. The key may be pasted as PEM or as the base64 of a
+ * PEM document (the dashboard shows it base64-encoded).
+ */
+export declare function verifyRsaSha256Signature(rawBody: string, signature: string | undefined, publicKey: string): boolean;
+/**
+ * Enforce a configured webhook credential against the request headers. Returns the
+ * header value when valid; throws when the driver has a secret configured but the
+ * request doesn't carry it or carries a wrong one — fail-closed whenever a secret IS
+ * set. Drivers only reach this when their credential is configured.
+ */
+export declare function requireMatchingCredential(received: string | undefined, expected: string, provider: string, what: string): void;
+//# sourceMappingURL=webhook_security.d.ts.map

package/dist/src/webhook_security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook_security.d.ts","sourceRoot":"","sources":["../../src/webhook_security.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,QAAQ,GAAG,MAAM,GAC3B,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAWT;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,IAAI,CAON"}

package/dist/src/webhook_security.js

@@ -0,0 +1,53 @@
+import { createHmac, verify as cryptoVerify, timingSafeEqual } from 'node:crypto';
+/**
+ * Shared webhook-auth primitives for the drivers. Every gateway signs webhooks
+ * differently (Stripe: SDK HMAC; AbacatePay: HMAC-SHA256; Woovi: HMAC-SHA1 or
+ * RSA-SHA256; Asaas: shared token), but the comparison and digest mechanics are the
+ * same — they live here so every driver verifies with the same, timing-safe code.
+ */
+/** Length-independent, timing-safe string comparison. */
+export function safeCompare(received, expected) {
+    const a = Buffer.from(received, 'utf8');
+    const b = Buffer.from(expected, 'utf8');
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/**
+ * Compute an HMAC over the raw webhook body and compare it to the signature header,
+ * timing-safe. `digest` matches the gateway's encoding (`base64` for AbacatePay and
+ * Woovi's HMAC mode).
+ */
+export function verifyHmacSignature(rawBody, signature, secret, algorithm) {
+    if (signature === undefined || signature === '')
+        return false;
+    const expected = createHmac(algorithm, secret).update(rawBody, 'utf8').digest('base64');
+    return safeCompare(signature, expected);
+}
+/**
+ * Verify Woovi's recommended `x-webhook-signature`: an RSA-SHA256 signature made with
+ * Woovi's private key, verified here against the public key published at
+ * `GET /api/v1/webhook/public-keys`. The key may be pasted as PEM or as the base64 of a
+ * PEM document (the dashboard shows it base64-encoded).
+ */
+export function verifyRsaSha256Signature(rawBody, signature, publicKey) {
+    if (signature === undefined || signature === '')
+        return false;
+    const pem = publicKey.includes('-----BEGIN')
+        ? publicKey
+        : Buffer.from(publicKey, 'base64').toString('utf8');
+    return cryptoVerify('RSA-SHA256', Buffer.from(rawBody, 'utf8'), pem, Buffer.from(signature, 'base64'));
+}
+/**
+ * Enforce a configured webhook credential against the request headers. Returns the
+ * header value when valid; throws when the driver has a secret configured but the
+ * request doesn't carry it or carries a wrong one — fail-closed whenever a secret IS
+ * set. Drivers only reach this when their credential is configured.
+ */
+export function requireMatchingCredential(received, expected, provider, what) {
+    if (received === undefined || received === '') {
+        throw new Error(`[payments] Missing webhook ${what} on ${provider} request.`);
+    }
+    if (!safeCompare(received, expected)) {
+        throw new Error(`[payments] Invalid ${provider} webhook ${what}.`);
+    }
+}
+//# sourceMappingURL=webhook_security.js.map

package/dist/src/webhook_security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook_security.js","sourceRoot":"","sources":["../../src/webhook_security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAElF;;;;;GAKG;AAEH,yDAAyD;AACzD,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,SAA6B,EAC7B,MAAc,EACd,SAA4B;IAE5B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxF,OAAO,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,SAA6B,EAC7B,SAAiB;IAEjB,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,YAAY,CACjB,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAC5B,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA4B,EAC5B,QAAgB,EAChB,QAAgB,EAChB,IAAY;IAEZ,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,OAAO,QAAQ,WAAW,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,YAAY,IAAI,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/stubs/config/payments.stub

@@ -0,0 +1,101 @@
+{{{
+  exports({ to: app.configPath('payments.ts') })
+}}}
+import env from '#start/env'
+import { defineConfig, payments, invoice } from '@adonis-agora/payments'
+
+export default defineConfig({
+  /**
+   * Default payment provider — a key of `providers`.
+   */
+  default: 'stripe',
+
+  /**
+   * Named payment providers. Each factory lazily imports its gateway SDK, so only the
+   * providers you actually use are loaded.
+   */
+  providers: {
+    stripe: payments.stripe({
+      apiKey: env.get('STRIPE_KEY'),
+      currency: 'brl',
+      // Required to verify webhook signatures (whsec_...):
+      webhookSecret: env.get('STRIPE_WEBHOOK_SECRET'),
+    }),
+    // abacate: payments.abacate({
+    //   apiKey: env.get('ABACATE_API_KEY'),
+    //   // HMAC secret that signs webhooks — reject unsigned requests in production:
+    //   webhookSecret: env.get('ABACATE_PUBLIC_KEY'),
+    // }),
+    // asaas: payments.asaas({
+    //   apiKey: env.get('ASAAS_API_KEY'),
+    //   sandbox: env.get('NODE_ENV') !== 'production',
+    //   // Shared token set in the Asaas dashboard — reject requests without it:
+    //   webhookToken: env.get('ASAAS_WEBHOOK_TOKEN'),
+    // }),
+    // woovi: payments.woovi({
+    //   appId: env.get('WOOVI_APP_ID'),
+    //   // Recommended RSA signature (x-webhook-signature):
+    //   webhookPublicKey: env.get('WOOVI_PUBLIC_KEY'),
+    // }),
+  },
+
+  /**
+   * Route a payment method to a provider (a key of `providers`). The charge call then
+   * resolves the driver per method: `payments.driver('pix').charge(...)`.
+   */
+  methods: {
+    pix: 'stripe',
+    credit_card: 'stripe',
+    // boleto: 'asaas',
+    // debit_card: 'asaas',
+    // undefined: 'asaas',
+  },
+
+  /**
+   * Invoice (NFe/NFSe) emission. Optional — only needed when you want to emit invoices
+   * for charges (e.g. `charge({ ..., invoice: true })`).
+   */
+  invoice: {
+    default: 'focus',
+    providers: {
+      focus: invoice.focus({
+        token: env.get('FOCUS_NFE_TOKEN'),
+      }),
+      // enotas: invoice.enotas({ apiKey: env.get('ENOTAS_API_KEY') }),
+      // plugnotas: invoice.plugnotas({ apiKey: env.get('PLUGNOTAS_API_KEY') }),
+      // Asaas NFS-e nativo — invoice: true numa charge Asaas emite pelo próprio Asaas:
+      // asaas: invoice.asaas({ apiKey: env.get('ASAAS_API_KEY') }),
+    },
+    defaults: {
+      service: {
+        description: 'Software license',
+      },
+    },
+  },
+
+  /**
+   * Billing (subscription) layer.
+   */
+  billing: {
+    enabled: true,
+    /**
+     * 'auto' uses @adonis-agora/durable to process webhooks when it is installed in the
+     * app, falling back to an in-process dispatcher otherwise. Set `false` to always use
+     * the in-process dispatcher, or `true` to require durable.
+     */
+    durable: 'auto',
+    /**
+     * Business webhook handlers run inside the lib-mounted route (errors mark the event
+     * failed + retry). Accepts a DI service class (the lib calls its `.handle`) or a
+     * plain function. Alternative: drop files in `app/payment_handlers/` (durable-style
+     * discovery, see `@adonis-agora/payments/hooks/webhook_handlers`). Recommended: the
+     * handler only dispatches to a durable workflow / queue — never heavy work inline.
+     *
+     * handlers: {
+     *   'payment.succeeded': PaymentSucceededHandler, // DI service → .handle(event)
+     *   'payment.refunded': (event) => { ... },
+     * },
+     */
+    handlers: {},
+  },
+})