@alphawebai/hs-prism 0.1.0-rc.41 → 0.1.0-rc.42

package/dist/src/alphaweb/manifest.d.ts

@@ -1,7 +1,7 @@
 export declare const ALPHAWEB_STRIPE_WEBHOOK_EVENTS: readonly ["charge.dispute.closed", "charge.dispute.created", "charge.dispute.funds_reinstated", "charge.dispute.funds_withdrawn", "charge.dispute.updated", "mandate.updated", "payment_intent.amount_capturable_updated", "payment_intent.canceled", "payment_intent.payment_failed", "payment_intent.processing", "payment_intent.requires_action", "payment_intent.succeeded", "payment_method.attached", "payment_method.automatically_updated", "payment_method.detached", "payment_method.updated", "refund.created", "refund.failed", "refund.updated", "setup_intent.canceled", "setup_intent.requires_action", "setup_intent.setup_failed", "setup_intent.succeeded"];
 export declare const ALPHAWEB_PAYPAL_WEBHOOK_EVENTS: readonly ["CHECKOUT.ORDER.APPROVED", "CHECKOUT.ORDER.COMPLETED", "CHECKOUT.ORDER.PROCESSED", "CHECKOUT.PAYMENT-APPROVAL.REVERSED", "CUSTOMER.DISPUTE.CREATED", "CUSTOMER.DISPUTE.RESOLVED", "CUSTOMER.DISPUTE.UPDATED", "PAYMENT.AUTHORIZATION.CREATED", "PAYMENT.AUTHORIZATION.VOIDED", "PAYMENT.CAPTURE.COMPLETED", "PAYMENT.CAPTURE.DECLINED", "PAYMENT.CAPTURE.PENDING", "PAYMENT.CAPTURE.REFUNDED", "PAYMENT.CAPTURE.REVERSED", "PAYMENT.REFUND.FAILED", "PAYMENT.REFUND.PENDING", "RISK.DISPUTE.CREATED", "VAULT.PAYMENT-TOKEN.CREATED", "VAULT.PAYMENT-TOKEN.DELETED", "VAULT.PAYMENT-TOKEN.DELETION-INITIATED"];
 export declare const ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST: Readonly<{
-    readonly release: "0.1.0-rc.41";
+    readonly release: "0.1.0-rc.42";
     readonly upstreamCommit: "b07af7d9dac271de729548e74217ddcf895c602b";
     readonly medusaRange: ">=2.17.2 <2.18.0";
     readonly stripeApiVersion: "2026-06-24.dahlia";
@@ -24,6 +24,7 @@ export declare const ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST: Readonly<{
     readonly connectorCapabilities: {
         readonly stripe: {
             readonly browserSession: "stripe_payment_element";
+            readonly manualAuthorizationCheckout: "v1";
             readonly oneTimePayment: true;
             readonly futureUse: true;
             readonly repeatPayment: true;

package/dist/src/alphaweb/manifest.js

@@ -49,7 +49,7 @@ exports.ALPHAWEB_PAYPAL_WEBHOOK_EVENTS = Object.freeze([
     'VAULT.PAYMENT-TOKEN.DELETION-INITIATED',
 ]);
 exports.ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST = Object.freeze({
-    release: '0.1.0-rc.41',
+    release: '0.1.0-rc.42',
     upstreamCommit: 'b07af7d9dac271de729548e74217ddcf895c602b',
     medusaRange: '>=2.17.2 <2.18.0',
     stripeApiVersion: '2026-06-24.dahlia',
@@ -72,6 +72,7 @@ exports.ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST = Object.freeze({
     connectorCapabilities: {
         stripe: {
             browserSession: 'stripe_payment_element',
+            manualAuthorizationCheckout: 'v1',
             oneTimePayment: true,
             futureUse: true,
             repeatPayment: true,

package/dist/src/alphaweb/stripe-connector.d.ts

@@ -1,9 +1,10 @@
 import { types } from '../payments/generated/proto';
-import type { PrismCancelInput, PrismCaptureInput, PrismCreateWebhookEndpointInput, PrismDeleteWebhookEndpointInput, PrismDisputeResult, PrismEstablishReusableReferenceInput, PrismFindPaymentInput, PrismFindRefundInput, PrismMerchantOperation, PrismPaymentResult, PrismRefundInput, PrismRefundResult, PrismRetrieveDisputeInput, PrismRetrieveRefundInput, PrismRetryPaymentInput, PrismReusableReferenceDerivation, PrismRetrieveWebhookEndpointInput, PrismRetrievePaymentInput, PrismStripeConnectorOptions, PrismStripeConnectorV1, PrismStripeRuntimeVerification, PrismStripeRuntimeVerificationInput, PrismUpdateWebhookEndpointInput, PrismWebhookEndpoint, PrismWebhookEndpointCreated, PrismWebhookParseInput, PrismWebhookParseResult } from './types';
+import type { PrismCancelInput, PrismCaptureInput, PrismCreateWebhookEndpointInput, PrismDeleteWebhookEndpointInput, PrismDisputeResult, PrismEstablishReusableReferenceInput, PrismFindPaymentInput, PrismFindRefundInput, PrismMerchantOperation, PrismPaymentResult, PrismRefundInput, PrismRefundResult, PrismRetrieveDisputeInput, PrismRetrieveRefundInput, PrismRetryPaymentInput, PrismReusableReferenceDerivation, PrismRetrieveWebhookEndpointInput, PrismRetrievePaymentInput, PrismStripeConnectorOptions, PrismStripeConnectorV1, PrismStripeAuthorizationOwner, PrismStripeAuthorization, PrismStripeIncrementAuthorizationInput, PrismStripeCaptureAuthorizationInput, PrismStripeRuntimeVerification, PrismStripeRuntimeVerificationInput, PrismUpdateWebhookEndpointInput, PrismWebhookEndpoint, PrismWebhookEndpointCreated, PrismWebhookParseInput, PrismWebhookParseResult } from './types';
 interface MerchantAuthenticationPort {
     createClientAuthenticationToken(input: types.IMerchantAuthenticationServiceCreateClientAuthenticationTokenRequest): Promise<types.MerchantAuthenticationServiceCreateClientAuthenticationTokenResponse>;
 }
 interface PaymentPort {
+    incrementalAuthorization?(input: types.IPaymentServiceIncrementalAuthorizationRequest): Promise<types.PaymentServiceIncrementalAuthorizationResponse>;
     get(input: types.IPaymentServiceGetRequest): Promise<types.PaymentServiceGetResponse>;
     capture(input: types.IPaymentServiceCaptureRequest): Promise<types.PaymentServiceCaptureResponse>;
     void(input: types.IPaymentServiceVoidRequest): Promise<types.PaymentServiceVoidResponse>;
@@ -36,6 +37,9 @@ export declare class PrismStripeConnector implements PrismStripeConnectorV1 {
     retrievePayment(input: PrismRetrievePaymentInput): Promise<PrismPaymentResult>;
     establishReusableReference(input: PrismEstablishReusableReferenceInput): Promise<PrismReusableReferenceDerivation>;
     findPaymentsByMerchantOperation(input: PrismFindPaymentInput): Promise<PrismPaymentResult[]>;
+    retrieveAuthorization(input: PrismStripeAuthorizationOwner): Promise<PrismStripeAuthorization>;
+    incrementAuthorization(input: PrismStripeIncrementAuthorizationInput): Promise<PrismStripeAuthorization>;
+    captureAuthorization(input: PrismStripeCaptureAuthorizationInput): Promise<PrismStripeAuthorization>;
     capturePayment(input: PrismCaptureInput): Promise<PrismPaymentResult>;
     cancelPayment(input: PrismCancelInput): Promise<PrismPaymentResult>;
     refundPayment(input: PrismRefundInput): Promise<PrismRefundResult>;

package/dist/src/alphaweb/stripe-connector.js

@@ -735,6 +735,7 @@ class PrismStripeConnector {
                                 : 'validation',
                     ...(providerCode ? { providerCode } : {}),
                     ...(requestId ? { providerRequestId: requestId } : {}),
+                    providerHttpStatus: response.status,
                     retryable: response.status === 429 || response.status >= 500,
                     outcome: response.status >= 500 ? 'ambiguous' : 'definitely_not_applied',
                     safeMessage: 'Stripe rejected the payment operation.',
@@ -764,11 +765,13 @@ class PrismStripeConnector {
                 payment: {
                     amount: moneyMessage(input.money),
                     connectorCustomerId: input.customerReference,
-                    setupFutureUsage: Boolean(input.futureUse) ||
+                    setupFutureUsage: input.kind === 'combined_checkout' ||
+                        Boolean(input.futureUse) ||
                         input.metadata.alphaweb_setup_future_usage === 'off_session'
                         ? proto_1.types.FutureUsage.OFF_SESSION
                         : proto_1.types.FutureUsage.FUTURE_USAGE_UNSPECIFIED,
-                    captureMethod: input.metadata.alphaweb_capture_method === 'manual'
+                    captureMethod: input.kind === 'combined_checkout' ||
+                        input.metadata.alphaweb_capture_method === 'manual'
                         ? proto_1.types.CaptureMethod.MANUAL
                         : proto_1.types.CaptureMethod.AUTOMATIC,
                     paymentMethodConfigurationId: input.methodSelection.paymentMethodConfigurationId,
@@ -1073,6 +1076,124 @@ class PrismStripeConnector {
         }
         throw validationError('Stripe payment search exceeded the bounded reconciliation window.', 'PRISM_SEARCH_LIMIT');
     }
+    async retrieveAuthorization(input) {
+        assertIdentifier(input.rootOperationId, 'rootOperationId');
+        assertIdentifier(input.connectorPaymentId, 'connectorPaymentId');
+        if (input.credentialBindingId !== this.options.credentialBindingId ||
+            input.providerAccountId !== this.options.providerAccountId ||
+            input.livemode !== (this.options.environment === 'live')) {
+            throw configurationError('Stripe authorization ownership does not match runtime.', 'PRISM_PAYMENT_OWNERSHIP');
+        }
+        const raw = recordOf(await this.stripeRequest('GET', `/payment_intents/${encodeURIComponent(input.connectorPaymentId)}?expand[]=latest_charge`));
+        const intent = parseStripePaymentIntent(raw);
+        const capturable = integerOf(raw.amount_capturable);
+        const received = integerOf(raw.amount_received);
+        const charge = recordOf(raw.latest_charge);
+        if (intent.id !== input.connectorPaymentId || intent.metadata.alphaweb_operation_id !== input.rootOperationId ||
+            intent.metadata.alphaweb_operation_kind !== 'combined_checkout' || intent.livemode !== input.livemode ||
+            raw.capture_method !== 'manual' || capturable === null || received === null || capturable < 0 || received < 0 ||
+            !Number.isSafeInteger(capturable) || !Number.isSafeInteger(received)) {
+            throw configurationError('Stripe authorization does not match its checkout.', 'PRISM_PAYMENT_OWNERSHIP');
+        }
+        (0, money_1.assertSafeProviderMoney)({ amountMinor: intent.amount.toString(), currency: intent.currency });
+        const captureId = stringOf(charge.id);
+        if (received > 0 && (!captureId || charge.payment_intent !== intent.id ||
+            charge.livemode !== input.livemode || charge.captured !== true || charge.paid !== true ||
+            charge.amount_captured !== received || charge.currency !== intent.currency)) {
+            throw configurationError('Stripe capture evidence does not match its checkout.', 'PRISM_CAPTURE_OWNERSHIP');
+        }
+        const card = recordOf(recordOf(charge.payment_method_details).card);
+        const clientSecret = stringOf(raw.client_secret);
+        return {
+            connectorPaymentId: intent.id, status: normalizedStripeIntentStatus(intent),
+            money: { amountMinor: intent.amount.toString(), currency: intent.currency },
+            amountCapturable: capturable.toString(), amountReceived: received.toString(),
+            incrementalAuthorizationAvailable: recordOf(card.incremental_authorization).status === 'available',
+            lastAdjustmentId: intent.metadata.alphaweb_adjustment_id ?? null,
+            connectorCaptureId: received > 0 ? captureId : null,
+            ...(['requires_payment_method', 'requires_customer_action'].includes(normalizedStripeIntentStatus(intent)) &&
+                clientSecret?.startsWith(`${intent.id}_secret_`) ? { clientSecret } : {}),
+        };
+    }
+    async incrementAuthorization(input) {
+        assertIdentifier(input.idempotencyKey, 'idempotencyKey');
+        const target = (0, money_1.assertSafeProviderMoney)(input.money);
+        const expected = (0, money_1.assertSafeProviderMoney)(input.expectedMoney);
+        const observed = await this.retrieveAuthorization(input);
+        if (observed.status !== 'authorized' || observed.amountReceived !== '0' ||
+            observed.money.currency !== target.currency || expected.currency !== target.currency ||
+            BigInt(observed.amountCapturable) < BigInt(observed.money.amountMinor)) {
+            throw validationError('Stripe authorization cannot be adjusted in this state.', 'PRISM_AUTHORIZATION_STATE');
+        }
+        if (observed.lastAdjustmentId === input.idempotencyKey && observed.money.amountMinor === input.money.amountMinor)
+            return observed;
+        if (BigInt(observed.amountCapturable) < BigInt(input.expectedMoney.amountMinor)) {
+            throw configurationError('Stripe no longer covers the approved selection.', 'PRISM_AUTHORIZATION_AMOUNT');
+        }
+        // A smaller final total is captured for less, without modifying the hold.
+        if (BigInt(input.money.amountMinor) <= BigInt(observed.amountCapturable))
+            return observed;
+        if (!observed.incrementalAuthorizationAvailable) {
+            throw validationError('This payment cannot authorize a higher total. The offer was not added.', 'PRISM_INCREMENT_UNAVAILABLE');
+        }
+        const increment = this.dependencies.payments.incrementalAuthorization;
+        if (!increment)
+            throw configurationError('Prism lacks incremental authorization.', 'PRISM_CAPABILITY_UNSUPPORTED');
+        try {
+            const result = await increment.call(this.dependencies.payments, {
+                merchantAuthorizationId: input.idempotencyKey,
+                connectorTransactionId: input.connectorPaymentId, amount: moneyMessage(input.money),
+            });
+            const error = recordOf(result.error);
+            if (result.statusCode >= 400 || Object.keys(error).length) {
+                throw new error_1.PrismOperationError({
+                    category: result.statusCode >= 500 ? 'provider_server' : 'declined',
+                    outcome: result.statusCode >= 500 ? 'ambiguous' : 'definitely_not_applied', retryable: false,
+                    providerHttpStatus: result.statusCode, providerCode: stringOf(error.code) ?? undefined,
+                    safeMessage: 'Stripe did not authorize the higher total. The offer was not added.',
+                });
+            }
+        }
+        catch (error) {
+            throw (0, error_1.normalizePrismError)(error);
+        }
+        let aligned;
+        try {
+            aligned = await this.retrieveAuthorization(input);
+        }
+        catch (error) {
+            throw new error_1.PrismOperationError({ ...(0, error_1.normalizePrismError)(error).shape, outcome: 'ambiguous', retryable: false });
+        }
+        if (aligned.lastAdjustmentId !== input.idempotencyKey || aligned.money.amountMinor !== input.money.amountMinor ||
+            aligned.status !== 'authorized' || BigInt(aligned.amountCapturable) < BigInt(input.money.amountMinor)) {
+            throw new error_1.PrismOperationError({ category: 'unknown', outcome: 'ambiguous', retryable: false,
+                providerCode: 'PRISM_INCREMENT_EVIDENCE', safeMessage: 'Stripe authorization update is awaiting verification.' });
+        }
+        return aligned;
+    }
+    async captureAuthorization(input) {
+        assertIdentifier(input.idempotencyKey, 'idempotencyKey');
+        const target = (0, money_1.assertSafeProviderMoney)(input.money);
+        const observed = await this.retrieveAuthorization(input);
+        if (observed.money.currency !== target.currency)
+            throw configurationError('Stripe capture currency changed.', 'PRISM_CAPTURE_OWNERSHIP');
+        if (observed.status === 'captured' && observed.amountReceived === input.money.amountMinor)
+            return observed;
+        if (observed.status !== 'authorized' || observed.amountReceived !== '0' || BigInt(observed.amountCapturable) < BigInt(input.money.amountMinor)) {
+            throw validationError('Stripe has not authorized the final checkout total.', 'PRISM_CAPTURE_AMOUNT');
+        }
+        const result = await this.capturePayment({ operationId: input.rootOperationId, idempotencyKey: input.idempotencyKey,
+            connectorPaymentId: input.connectorPaymentId, money: input.money });
+        if (result.status === 'failed')
+            throw new error_1.PrismOperationError({ category: 'declined',
+                outcome: 'definitely_not_applied', retryable: false, safeMessage: 'Stripe declined the final capture.' });
+        try {
+            return await this.retrieveAuthorization(input);
+        }
+        catch (error) {
+            throw new error_1.PrismOperationError({ ...(0, error_1.normalizePrismError)(error).shape, outcome: 'ambiguous', retryable: false });
+        }
+    }
     async capturePayment(input) {
         assertIdentifier(input.idempotencyKey, 'idempotencyKey');
         try {

package/dist/src/alphaweb/types.d.ts

@@ -327,7 +327,39 @@ export interface PrismConnectorV1 {
     deleteWebhookEndpoint(input: PrismDeleteWebhookEndpointInput): Promise<void>;
     retrieveWebhookEndpoint(input: PrismRetrieveWebhookEndpointInput): Promise<PrismWebhookEndpoint>;
 }
-export type PrismStripeConnectorV1 = PrismConnectorV1;
+export interface PrismStripeAuthorizationOwner {
+    rootOperationId: string;
+    connectorPaymentId: string;
+    credentialBindingId: string;
+    providerAccountId: string;
+    livemode: boolean;
+}
+export interface PrismStripeAuthorization {
+    connectorPaymentId: string;
+    status: PrismNormalizedPaymentStatus;
+    money: PrismMoney;
+    amountCapturable: string;
+    amountReceived: string;
+    incrementalAuthorizationAvailable: boolean;
+    lastAdjustmentId: string | null;
+    connectorCaptureId: string | null;
+    /** Only returned for an unconfirmed, owned PaymentIntent. Never log this. */
+    clientSecret?: string;
+}
+export interface PrismStripeIncrementAuthorizationInput extends PrismStripeAuthorizationOwner {
+    expectedMoney: PrismMoney;
+    money: PrismMoney;
+    idempotencyKey: string;
+}
+export interface PrismStripeCaptureAuthorizationInput extends PrismStripeAuthorizationOwner {
+    money: PrismMoney;
+    idempotencyKey: string;
+}
+export interface PrismStripeConnectorV1 extends PrismConnectorV1 {
+    retrieveAuthorization?(input: PrismStripeAuthorizationOwner): Promise<PrismStripeAuthorization>;
+    incrementAuthorization?(input: PrismStripeIncrementAuthorizationInput): Promise<PrismStripeAuthorization>;
+    captureAuthorization?(input: PrismStripeCaptureAuthorizationInput): Promise<PrismStripeAuthorization>;
+}
 export type PrismPayPalOrderLifecycleStatus = 'CREATED' | 'SAVED' | 'PAYER_ACTION_REQUIRED' | 'APPROVED' | 'VOIDED' | 'COMPLETED' | 'UNKNOWN';
 export interface PrismPayPalOrderLifecycle {
     orderStatus: PrismPayPalOrderLifecycleStatus;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphawebai/hs-prism",
-  "version": "0.1.0-rc.41",
+  "version": "0.1.0-rc.42",
   "description": "Hyperswitch Payments SDK — Node.js client for connector integrations via UniFFI FFI",
   "main": "dist/src/index.js",
   "exports": {