@alphawebai/hs-prism 0.1.0-rc.46 → 0.1.0-rc.48

package/dist/src/alphaweb/manifest.d.ts

@@ -1,7 +1,7 @@
 export declare const ALPHAWEB_STRIPE_WEBHOOK_EVENTS: readonly ["charge.dispute.closed", "charge.dispute.created", "charge.dispute.funds_reinstated", "charge.dispute.funds_withdrawn", "charge.dispute.updated", "mandate.updated", "payment_intent.amount_capturable_updated", "payment_intent.canceled", "payment_intent.payment_failed", "payment_intent.processing", "payment_intent.requires_action", "payment_intent.succeeded", "payment_method.attached", "payment_method.automatically_updated", "payment_method.detached", "payment_method.updated", "refund.created", "refund.failed", "refund.updated", "setup_intent.canceled", "setup_intent.requires_action", "setup_intent.setup_failed", "setup_intent.succeeded"];
 export declare const ALPHAWEB_PAYPAL_WEBHOOK_EVENTS: readonly ["CHECKOUT.ORDER.APPROVED", "CHECKOUT.ORDER.COMPLETED", "CHECKOUT.ORDER.PROCESSED", "CHECKOUT.PAYMENT-APPROVAL.REVERSED", "CUSTOMER.DISPUTE.CREATED", "CUSTOMER.DISPUTE.RESOLVED", "CUSTOMER.DISPUTE.UPDATED", "PAYMENT.AUTHORIZATION.CREATED", "PAYMENT.AUTHORIZATION.VOIDED", "PAYMENT.CAPTURE.COMPLETED", "PAYMENT.CAPTURE.DECLINED", "PAYMENT.CAPTURE.PENDING", "PAYMENT.CAPTURE.REFUNDED", "PAYMENT.CAPTURE.REVERSED", "PAYMENT.REFUND.FAILED", "PAYMENT.REFUND.PENDING", "RISK.DISPUTE.CREATED", "VAULT.PAYMENT-TOKEN.CREATED", "VAULT.PAYMENT-TOKEN.DELETED", "VAULT.PAYMENT-TOKEN.DELETION-INITIATED"];
 export declare const ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST: Readonly<{
-    readonly release: "0.1.0-rc.46";
+    readonly release: "0.1.0-rc.48";
     readonly upstreamCommit: "b07af7d9dac271de729548e74217ddcf895c602b";
     readonly medusaRange: ">=2.17.2 <2.18.0";
     readonly stripeApiVersion: "2026-06-24.dahlia";

package/dist/src/alphaweb/manifest.js

@@ -49,7 +49,7 @@ exports.ALPHAWEB_PAYPAL_WEBHOOK_EVENTS = Object.freeze([
     'VAULT.PAYMENT-TOKEN.DELETION-INITIATED',
 ]);
 exports.ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST = Object.freeze({
-    release: '0.1.0-rc.46',
+    release: '0.1.0-rc.48',
     upstreamCommit: 'b07af7d9dac271de729548e74217ddcf895c602b',
     medusaRange: '>=2.17.2 <2.18.0',
     stripeApiVersion: '2026-06-24.dahlia',

package/dist/src/alphaweb/paypal-connector.js

@@ -705,7 +705,7 @@ function normalizePayPalWebhook(input, binding) {
     const invoiceId = objectKind === 'dispute'
         ? consistentString(disputeTransactions.map((transaction) => stringOf(transaction.invoice_number)))
         : stringOf(resource.invoice_id) ?? stringOf(purchaseUnit.invoice_id);
-    const medusaPaymentSessionId = objectKind === 'dispute'
+    const customId = objectKind === 'dispute'
         ? consistentString(disputeTransactions.map((transaction) => stringOf(transaction.custom)))
         : stringOf(resource.custom_id) ?? stringOf(purchaseUnit.custom_id);
     const connectorPaymentId = stringOf(related.order_id) ??
@@ -742,7 +742,14 @@ function normalizePayPalWebhook(input, binding) {
     const vaultDetails = type.startsWith('VAULT.PAYMENT-TOKEN.')
         ? resource
         : paymentSourceVault;
-    const merchantOperationId = invoiceId;
+    // A repeat charge uses its idempotency key as PayPal's invoice ID, while the
+    // order's custom ID retains the payment operation owner. Checkout invoices
+    // continue to identify the operation and custom IDs may identify a session.
+    const repeatCharge = invoiceId?.startsWith('aw:') && customId?.startsWith('payop_');
+    const merchantOperationId = repeatCharge
+        ? customId
+        : invoiceId;
+    const medusaPaymentSessionId = repeatCharge ? null : customId;
     const normalized = {
         ...envelope,
         customerId: stringOf(recordOf(vaultDetails.customer).id) ??
@@ -1103,7 +1110,25 @@ class PrismPayPalConnector {
             });
             const responseOperationId = stringOf(response.merchantTransactionId);
             if (responseOperationId && responseOperationId !== input.operationId) {
-                throw configurationError('PayPal payment ownership does not match the payment operation.', 'PRISM_PAYMENT_OWNERSHIP');
+                // PayPal repeat charges return their merchant charge/invoice reference
+                // through PSync. Verify the order's distinct custom ID and exact amount
+                // before accepting that reference for the saved payment operation.
+                const order = recordOf(await this.paypalRequest('GET', `/v2/checkout/orders/${encodeURIComponent(input.connectorPaymentId)}`));
+                const units = Array.isArray(order.purchase_units) ? order.purchase_units : [];
+                const unit = units.length === 1 ? recordOf(units[0]) : {};
+                const orderAmount = recordOf(unit.amount);
+                const currency = stringOf(orderAmount.currency_code)?.toLowerCase();
+                const value = stringOf(orderAmount.value);
+                const ownedAmount = currency && value
+                    ? (0, money_1.toProviderMinorAmount)({ medusaAmount: value, currency })
+                    : null;
+                if (stringOf(order.id) !== input.connectorPaymentId ||
+                    stringOf(unit.custom_id) !== input.operationId ||
+                    stringOf(unit.invoice_id) !== responseOperationId ||
+                    currency !== input.money.currency.toLowerCase() ||
+                    ownedAmount !== BigInt(input.money.amountMinor)) {
+                    throw configurationError('PayPal payment ownership does not match the payment operation.', 'PRISM_PAYMENT_OWNERSHIP');
+                }
             }
             const responseAmount = recordOf(response.amount);
             const amountMinor = integerOf(responseAmount.minorAmount);

package/dist/src/alphaweb/stripe-connector.d.ts

@@ -1,5 +1,5 @@
 import { types } from '../payments/generated/proto';
-import type { PrismCancelInput, PrismCaptureInput, PrismCreateWebhookEndpointInput, PrismDeleteWebhookEndpointInput, PrismDisputeResult, PrismEstablishReusableReferenceInput, PrismFindPaymentInput, PrismFindRefundInput, PrismMerchantOperation, PrismPaymentResult, PrismRefundInput, PrismRefundResult, PrismRetrieveDisputeInput, PrismRetrieveRefundInput, PrismRetryPaymentInput, PrismReusableReferenceDerivation, PrismRetrieveWebhookEndpointInput, PrismRetrievePaymentInput, PrismStripeConnectorOptions, PrismStripeConnectorV1, PrismStripeRuntimeVerification, PrismStripeRuntimeVerificationInput, PrismUpdateWebhookEndpointInput, PrismWebhookEndpoint, PrismWebhookEndpointCreated, PrismWebhookParseInput, PrismWebhookParseResult } from './types';
+import type { PrismCancelInput, PrismCaptureInput, PrismCreateWebhookEndpointInput, PrismDeleteWebhookEndpointInput, PrismDisputeResult, PrismEstablishReusableReferenceInput, PrismFindPaymentInput, PrismFindRefundInput, PrismFutureUsePurpose, PrismMerchantOperation, PrismPaymentResult, PrismRefundInput, PrismRefundResult, PrismRetrieveDisputeInput, PrismRetrieveRefundInput, PrismRetryPaymentInput, PrismReusableReferenceDerivation, PrismRetrieveWebhookEndpointInput, PrismRetrievePaymentInput, PrismStripeConnectorOptions, PrismStripeConnectorV1, PrismStripeRuntimeVerification, PrismStripeRuntimeVerificationInput, PrismUpdateWebhookEndpointInput, PrismWebhookEndpoint, PrismWebhookEndpointCreated, PrismWebhookParseInput, PrismWebhookParseResult } from './types';
 interface MerchantAuthenticationPort {
     createClientAuthenticationToken(input: types.IMerchantAuthenticationServiceCreateClientAuthenticationTokenRequest): Promise<types.MerchantAuthenticationServiceCreateClientAuthenticationTokenResponse>;
 }
@@ -30,7 +30,15 @@ export declare class PrismStripeConnector implements PrismStripeConnectorV1 {
     private assertOperation;
     private recoverRepeatPayment;
     private stripeRequest;
-    private checkoutPaymentMethodSelection;
+    /** Read-only selection shared by deferred Elements and PaymentIntent creation. */
+    checkoutPaymentMethodSelection(input: {
+        purposes: readonly PrismFutureUsePurpose[];
+        paymentMethodConfigurationId?: string;
+        captureMethod?: 'automatic' | 'manual';
+    }): Promise<{
+        paymentMethodConfigurationId: string;
+        excludedPaymentMethodTypes: string[];
+    } | undefined>;
     createPayment(input: PrismMerchantOperation): Promise<PrismPaymentResult>;
     repeatPayment(input: PrismMerchantOperation): Promise<PrismPaymentResult>;
     retryPayment(input: PrismRetryPaymentInput): Promise<PrismPaymentResult>;

package/dist/src/alphaweb/stripe-connector.js

@@ -761,13 +761,12 @@ class PrismStripeConnector {
             clearTimeout(timeout);
         }
     }
+    /** Read-only selection shared by deferred Elements and PaymentIntent creation. */
     async checkoutPaymentMethodSelection(input) {
-        const purposes = input.futureUse?.purposes ??
-            (input.metadata.alphaweb_setup_future_usage === 'off_session' ? ['post_purchase'] : []);
+        const purposes = input.purposes;
         if (purposes.length === 0)
             return undefined;
-        const configurationId = input.methodSelection.kind === 'interactive_dynamic'
-            ? input.methodSelection.paymentMethodConfigurationId : undefined;
+        const configurationId = input.paymentMethodConfigurationId;
         let configuration;
         if (configurationId) {
             configuration = recordOf(await this.stripeRequest('GET', `/payment_method_configurations/${encodeURIComponent(configurationId)}`));
@@ -796,7 +795,7 @@ class PrismStripeConnector {
             const method = ['apple_pay', 'google_pay', 'cartes_bancaires'].includes(type) ? 'card' : type;
             const profile = STRIPE_REUSABLE_PAYMENT_METHOD_PROFILES[method];
             return !profile || !supportsStripeFutureUse(profile, purposes) || profile.requiresGeneratedDebit ||
-                (input.metadata.alphaweb_capture_method === 'manual' && !profile.supportsManualCapture);
+                (input.captureMethod === 'manual' && !profile.supportsManualCapture);
         }).map(([type]) => type);
         if (!methods.some(([type, value]) => !excludedPaymentMethodTypes.includes(type) &&
             recordOf(value).available === true && recordOf(recordOf(value).display_preference).value === 'on')) {
@@ -813,7 +812,12 @@ class PrismStripeConnector {
             throw configurationError('Interactive Stripe checkout requires a publishable key.', 'PRISM_PUBLISHABLE_KEY_REQUIRED');
         }
         try {
-            const methodSelection = await this.checkoutPaymentMethodSelection(input);
+            const methodSelection = await this.checkoutPaymentMethodSelection({
+                purposes: input.futureUse?.purposes ??
+                    (input.metadata.alphaweb_setup_future_usage === 'off_session' ? ['post_purchase'] : []),
+                paymentMethodConfigurationId: input.methodSelection.paymentMethodConfigurationId,
+                captureMethod: input.metadata.alphaweb_capture_method === 'manual' ? 'manual' : 'automatic',
+            });
             const response = await this.dependencies.merchantAuthentication.createClientAuthenticationToken({
                 merchantClientSessionId: input.idempotencyKey,
                 testMode: this.options.environment === 'test',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphawebai/hs-prism",
-  "version": "0.1.0-rc.46",
+  "version": "0.1.0-rc.48",
   "description": "Hyperswitch Payments SDK — Node.js client for connector integrations via UniFFI FFI",
   "main": "dist/src/index.js",
   "exports": {