@alphawebai/hs-prism 0.1.0-rc.30 → 0.1.0-rc.32

package/dist/src/alphaweb/manifest.d.ts

@@ -1,7 +1,7 @@
 export declare const ALPHAWEB_STRIPE_WEBHOOK_EVENTS: readonly ["charge.dispute.closed", "charge.dispute.created", "charge.dispute.funds_reinstated", "charge.dispute.funds_withdrawn", "charge.dispute.updated", "mandate.updated", "payment_intent.amount_capturable_updated", "payment_intent.canceled", "payment_intent.payment_failed", "payment_intent.processing", "payment_intent.requires_action", "payment_intent.succeeded", "payment_method.attached", "payment_method.automatically_updated", "payment_method.detached", "payment_method.updated", "refund.created", "refund.failed", "refund.updated", "setup_intent.canceled", "setup_intent.requires_action", "setup_intent.setup_failed", "setup_intent.succeeded"];
 export declare const ALPHAWEB_PAYPAL_WEBHOOK_EVENTS: readonly ["CHECKOUT.ORDER.APPROVED", "CHECKOUT.ORDER.COMPLETED", "CHECKOUT.ORDER.PROCESSED", "CHECKOUT.PAYMENT-APPROVAL.REVERSED", "CUSTOMER.DISPUTE.CREATED", "CUSTOMER.DISPUTE.RESOLVED", "CUSTOMER.DISPUTE.UPDATED", "PAYMENT.AUTHORIZATION.CREATED", "PAYMENT.AUTHORIZATION.VOIDED", "PAYMENT.CAPTURE.COMPLETED", "PAYMENT.CAPTURE.DECLINED", "PAYMENT.CAPTURE.PENDING", "PAYMENT.CAPTURE.REFUNDED", "PAYMENT.CAPTURE.REVERSED", "PAYMENT.REFUND.FAILED", "PAYMENT.REFUND.PENDING", "RISK.DISPUTE.CREATED", "VAULT.PAYMENT-TOKEN.CREATED", "VAULT.PAYMENT-TOKEN.DELETED", "VAULT.PAYMENT-TOKEN.DELETION-INITIATED"];
 export declare const ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST: Readonly<{
-    readonly release: "0.1.0-rc.30";
+    readonly release: "0.1.0-rc.32";
     readonly upstreamCommit: "b07af7d9dac271de729548e74217ddcf895c602b";
     readonly medusaRange: ">=2.17.2 <2.18.0";
     readonly stripeApiVersion: "2026-06-24.dahlia";

package/dist/src/alphaweb/manifest.js

@@ -49,7 +49,7 @@ exports.ALPHAWEB_PAYPAL_WEBHOOK_EVENTS = Object.freeze([
     'VAULT.PAYMENT-TOKEN.DELETION-INITIATED',
 ]);
 exports.ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST = Object.freeze({
-    release: '0.1.0-rc.30',
+    release: '0.1.0-rc.32',
     upstreamCommit: 'b07af7d9dac271de729548e74217ddcf895c602b',
     medusaRange: '>=2.17.2 <2.18.0',
     stripeApiVersion: '2026-06-24.dahlia',

package/dist/src/alphaweb/paypal-connector.js

@@ -349,6 +349,9 @@ function paypalWebhookObjectKind(type) {
     }
     if (type.startsWith('PAYMENT.AUTHORIZATION.'))
         return 'authorization';
+    if (type === 'PAYMENT.CAPTURE.REFUNDED' || type === 'PAYMENT.CAPTURE.REVERSED') {
+        return 'refund';
+    }
     if (type.startsWith('PAYMENT.CAPTURE.'))
         return 'capture';
     if (type.startsWith('PAYMENT.REFUND.'))
@@ -396,8 +399,49 @@ function paypalWebhookPurchaseUnit(resource) {
         return {};
     return recordOf(resource.purchase_units[0]);
 }
-function paypalWebhookMoney(resource, purchaseUnit) {
-    const amount = recordOf(resource.amount ?? purchaseUnit.amount);
+function paypalWebhookLinkedId(resource, collection) {
+    if (!Array.isArray(resource.links))
+        return null;
+    for (const linkValue of resource.links) {
+        const link = recordOf(linkValue);
+        const relationship = stringOf(link.rel);
+        if (collection === 'orders' && relationship !== 'up')
+            continue;
+        if (collection === 'captures' && relationship !== 'up' && relationship !== 'capture')
+            continue;
+        const href = stringOf(link.href);
+        if (!href)
+            continue;
+        try {
+            const segments = new URL(href).pathname.split('/').filter(Boolean);
+            const collectionIndex = segments.findIndex((segment) => segment === collection);
+            const id = collectionIndex >= 0 ? segments[collectionIndex + 1] : undefined;
+            if (id)
+                return id;
+        }
+        catch {
+            // An invalid provider link is not authoritative correlation evidence.
+        }
+    }
+    return null;
+}
+function paypalDisputeTransactionInfo(resource) {
+    if (!Array.isArray(resource.disputed_transactions))
+        return [];
+    return resource.disputed_transactions.map((transactionValue) => {
+        const transaction = recordOf(transactionValue);
+        const transactionInfo = recordOf(transaction.transaction_info);
+        return Object.keys(transactionInfo).length > 0 ? transactionInfo : transaction;
+    });
+}
+function consistentString(values) {
+    if (values.length === 0 || values.some((value) => value === null))
+        return null;
+    const unique = new Set(values);
+    return unique.size === 1 ? [...unique][0] : null;
+}
+function paypalWebhookMoney(resource, purchaseUnit, objectKind) {
+    const amount = recordOf(objectKind === 'dispute' ? resource.dispute_amount : resource.amount ?? purchaseUnit.amount);
     const currency = stringOf(amount.currency_code)?.toLowerCase();
     const value = stringOf(amount.value);
     if (!currency || !value)
@@ -412,6 +456,58 @@ function paypalWebhookMoney(resource, purchaseUnit) {
         return null;
     }
 }
+function paypalWebhookRefundStatus(type, resource) {
+    if (type === 'PAYMENT.CAPTURE.REFUNDED' || type === 'PAYMENT.CAPTURE.REVERSED') {
+        return 'succeeded';
+    }
+    if (type === 'PAYMENT.REFUND.FAILED')
+        return 'failed';
+    if (type === 'PAYMENT.REFUND.PENDING')
+        return 'pending';
+    const status = stringOf(resource.status)?.toUpperCase();
+    if (status === 'COMPLETED' || status === 'REFUNDED' || status === 'REVERSED') {
+        return 'succeeded';
+    }
+    if (status === 'PENDING')
+        return 'pending';
+    if (status === 'FAILED' || status === 'DECLINED' || status === 'DENIED')
+        return 'failed';
+    if (status === 'CANCELED' || status === 'CANCELLED')
+        return 'canceled';
+    return 'unknown';
+}
+function paypalWebhookSafeData(type, resource, disputeTransactions, parentCaptureId) {
+    const safeData = Object.fromEntries(['status', 'reason'].flatMap((key) => {
+        const value = resource[key];
+        return value === null || ['string', 'number', 'boolean'].includes(typeof value)
+            ? [[key, value]]
+            : [];
+    }));
+    if (parentCaptureId)
+        safeData.parent_capture_id = parentCaptureId;
+    if (type === 'PAYMENT.CAPTURE.REFUNDED')
+        safeData.refund_semantics = 'merchant_refund';
+    if (type === 'PAYMENT.CAPTURE.REVERSED')
+        safeData.refund_semantics = 'provider_reversal';
+    if (type.includes('DISPUTE')) {
+        const rawStatus = stringOf(resource.status)?.toUpperCase();
+        safeData.dispute_status =
+            type === 'CUSTOMER.DISPUTE.RESOLVED' || rawStatus === 'RESOLVED' ? 'closed' : 'opened';
+        const lifeCycleStage = stringOf(resource.dispute_life_cycle_stage);
+        if (lifeCycleStage)
+            safeData.dispute_life_cycle_stage = lifeCycleStage;
+        const outcomeCode = stringOf(recordOf(resource.dispute_outcome).outcome_code);
+        if (outcomeCode)
+            safeData.outcome_code = outcomeCode;
+        const sellerTransactionId = consistentString(disputeTransactions.map((transaction) => stringOf(transaction.seller_transaction_id)));
+        if (sellerTransactionId)
+            safeData.paypal_seller_transaction_id = sellerTransactionId;
+        const buyerTransactionId = consistentString(disputeTransactions.map((transaction) => stringOf(transaction.buyer_transaction_id)));
+        if (buyerTransactionId)
+            safeData.paypal_buyer_transaction_id = buyerTransactionId;
+    }
+    return safeData;
+}
 function normalizePayPalWebhook(input, binding) {
     let parsed;
     try {
@@ -427,33 +523,24 @@ function normalizePayPalWebhook(input, binding) {
     const resourceVersion = stringOf(event.resource_version);
     const resource = recordOf(event.resource);
     const purchaseUnit = paypalWebhookPurchaseUnit(resource);
-    const objectId = stringOf(resource.id);
+    const objectKind = paypalWebhookObjectKind(type ?? '');
+    const objectId = objectKind === 'dispute' ? stringOf(resource.dispute_id) : stringOf(resource.id);
     if (!providerEventId || !type || !createdAt || !objectId) {
         throw validationError('The verified PayPal event identity is incomplete.', 'PRISM_WEBHOOK_IDENTITY');
     }
     const related = recordOf(recordOf(resource.supplementary_data).related_ids);
-    const linkedOrderId = Array.isArray(resource.links)
-        ? resource.links.map(recordOf).flatMap((link) => {
-            if (stringOf(link.rel) !== 'up')
-                return [];
-            const href = stringOf(link.href);
-            if (!href)
-                return [];
-            try {
-                const segments = new URL(href).pathname.split('/').filter(Boolean);
-                const orderIndex = segments.findIndex((segment) => segment === 'orders');
-                return orderIndex >= 0 && segments[orderIndex + 1] ? [segments[orderIndex + 1]] : [];
-            }
-            catch {
-                return [];
-            }
-        })[0] ?? null
-        : null;
-    const invoiceId = stringOf(resource.invoice_id) ?? stringOf(purchaseUnit.invoice_id);
-    const medusaPaymentSessionId = stringOf(resource.custom_id) ?? stringOf(purchaseUnit.custom_id);
+    const linkedOrderId = paypalWebhookLinkedId(resource, 'orders');
+    const linkedCaptureId = paypalWebhookLinkedId(resource, 'captures');
+    const parentCaptureId = stringOf(related.capture_id) ?? stringOf(resource.capture_id) ?? linkedCaptureId;
+    const disputeTransactions = paypalDisputeTransactionInfo(resource);
+    const invoiceId = objectKind === 'dispute'
+        ? consistentString(disputeTransactions.map((transaction) => stringOf(transaction.invoice_number)))
+        : stringOf(resource.invoice_id) ?? stringOf(purchaseUnit.invoice_id);
+    const medusaPaymentSessionId = objectKind === 'dispute'
+        ? consistentString(disputeTransactions.map((transaction) => stringOf(transaction.custom)))
+        : stringOf(resource.custom_id) ?? stringOf(purchaseUnit.custom_id);
     const connectorPaymentId = stringOf(related.order_id) ??
         linkedOrderId ??
-        stringOf(resource.invoice_id) ??
         (type.startsWith('CHECKOUT.ORDER.') ? objectId : null);
     const bodyDigest = (0, node_crypto_1.createHash)('sha256').update(input.rawBody).digest('hex');
     const envelope = {
@@ -465,7 +552,7 @@ function normalizePayPalWebhook(input, binding) {
         apiVersion: resourceVersion,
         type,
         createdAt,
-        objectKind: paypalWebhookObjectKind(type),
+        objectKind,
         objectId,
         connectorPaymentId,
         paymentIntentId: null,
@@ -481,12 +568,12 @@ function normalizePayPalWebhook(input, binding) {
             },
         };
     }
-    const money = paypalWebhookMoney(resource, purchaseUnit);
+    const money = paypalWebhookMoney(resource, purchaseUnit, objectKind);
     const paymentSourceVault = recordOf(recordOf(recordOf(recordOf(resource.payment_source).paypal).attributes).vault);
     const vaultDetails = type.startsWith('VAULT.PAYMENT-TOKEN.')
         ? resource
         : paymentSourceVault;
-    const merchantOperationId = invoiceId ?? connectorPaymentId;
+    const merchantOperationId = invoiceId;
     const normalized = {
         ...envelope,
         customerId: stringOf(recordOf(vaultDetails.customer).id) ??
@@ -497,24 +584,39 @@ function normalizePayPalWebhook(input, binding) {
         medusaPaymentSessionId,
         status: paypalWebhookStatus(type, resource),
         money,
-        refunds: type.startsWith('PAYMENT.REFUND.') && money
+        refunds: objectKind === 'refund' && money && parentCaptureId
             ? [
                 {
                     refundId: objectId,
-                    chargeId: stringOf(related.capture_id),
+                    chargeId: parentCaptureId,
                     paymentIntentId: null,
-                    status: type === 'PAYMENT.REFUND.FAILED' ? 'failed' : 'pending',
+                    status: paypalWebhookRefundStatus(type, resource),
                     money,
                 },
             ]
             : [],
-        safeData: Object.fromEntries(['status', 'reason', 'outcome_code', 'dispute_amount'].flatMap((key) => {
-            const value = resource[key];
-            return value === null || ['string', 'number', 'boolean'].includes(typeof value)
-                ? [[key, value]]
-                : [];
-        })),
+        safeData: paypalWebhookSafeData(type, resource, disputeTransactions, parentCaptureId),
     };
+    if (objectKind === 'refund' && (!money || !parentCaptureId)) {
+        return {
+            status: 'normalization_failed',
+            envelope,
+            error: {
+                code: 'WEBHOOK_OBJECT_INVALID',
+                safeMessage: 'The PayPal refund event is missing money or its parent capture identity.',
+            },
+        };
+    }
+    if (objectKind === 'dispute' && !money) {
+        return {
+            status: 'normalization_failed',
+            envelope,
+            error: {
+                code: 'WEBHOOK_OBJECT_INVALID',
+                safeMessage: 'The PayPal dispute event is missing dispute amount or currency.',
+            },
+        };
+    }
     return { status: 'normalized', event: normalized };
 }
 class PrismPayPalConnector {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphawebai/hs-prism",
-  "version": "0.1.0-rc.30",
+  "version": "0.1.0-rc.32",
   "description": "Hyperswitch Payments SDK — Node.js client for connector integrations via UniFFI FFI",
   "main": "dist/src/index.js",
   "exports": {