@alphawebai/hs-prism 0.1.0-rc.47 → 0.1.0-rc.49

package/dist/src/alphaweb/manifest.d.ts

@@ -1,7 +1,7 @@
 export declare const ALPHAWEB_STRIPE_WEBHOOK_EVENTS: readonly ["charge.dispute.closed", "charge.dispute.created", "charge.dispute.funds_reinstated", "charge.dispute.funds_withdrawn", "charge.dispute.updated", "mandate.updated", "payment_intent.amount_capturable_updated", "payment_intent.canceled", "payment_intent.payment_failed", "payment_intent.processing", "payment_intent.requires_action", "payment_intent.succeeded", "payment_method.attached", "payment_method.automatically_updated", "payment_method.detached", "payment_method.updated", "refund.created", "refund.failed", "refund.updated", "setup_intent.canceled", "setup_intent.requires_action", "setup_intent.setup_failed", "setup_intent.succeeded"];
 export declare const ALPHAWEB_PAYPAL_WEBHOOK_EVENTS: readonly ["CHECKOUT.ORDER.APPROVED", "CHECKOUT.ORDER.COMPLETED", "CHECKOUT.ORDER.PROCESSED", "CHECKOUT.PAYMENT-APPROVAL.REVERSED", "CUSTOMER.DISPUTE.CREATED", "CUSTOMER.DISPUTE.RESOLVED", "CUSTOMER.DISPUTE.UPDATED", "PAYMENT.AUTHORIZATION.CREATED", "PAYMENT.AUTHORIZATION.VOIDED", "PAYMENT.CAPTURE.COMPLETED", "PAYMENT.CAPTURE.DECLINED", "PAYMENT.CAPTURE.PENDING", "PAYMENT.CAPTURE.REFUNDED", "PAYMENT.CAPTURE.REVERSED", "PAYMENT.REFUND.FAILED", "PAYMENT.REFUND.PENDING", "RISK.DISPUTE.CREATED", "VAULT.PAYMENT-TOKEN.CREATED", "VAULT.PAYMENT-TOKEN.DELETED", "VAULT.PAYMENT-TOKEN.DELETION-INITIATED"];
 export declare const ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST: Readonly<{
-    readonly release: "0.1.0-rc.47";
+    readonly release: "0.1.0-rc.49";
     readonly upstreamCommit: "b07af7d9dac271de729548e74217ddcf895c602b";
     readonly medusaRange: ">=2.17.2 <2.18.0";
     readonly stripeApiVersion: "2026-06-24.dahlia";

package/dist/src/alphaweb/manifest.js

@@ -49,7 +49,7 @@ exports.ALPHAWEB_PAYPAL_WEBHOOK_EVENTS = Object.freeze([
     'VAULT.PAYMENT-TOKEN.DELETION-INITIATED',
 ]);
 exports.ALPHAWEB_PRISM_COMPATIBILITY_MANIFEST = Object.freeze({
-    release: '0.1.0-rc.47',
+    release: '0.1.0-rc.49',
     upstreamCommit: 'b07af7d9dac271de729548e74217ddcf895c602b',
     medusaRange: '>=2.17.2 <2.18.0',
     stripeApiVersion: '2026-06-24.dahlia',

package/dist/src/alphaweb/paypal-connector.js

@@ -705,7 +705,7 @@ function normalizePayPalWebhook(input, binding) {
     const invoiceId = objectKind === 'dispute'
         ? consistentString(disputeTransactions.map((transaction) => stringOf(transaction.invoice_number)))
         : stringOf(resource.invoice_id) ?? stringOf(purchaseUnit.invoice_id);
-    const medusaPaymentSessionId = objectKind === 'dispute'
+    const customId = objectKind === 'dispute'
         ? consistentString(disputeTransactions.map((transaction) => stringOf(transaction.custom)))
         : stringOf(resource.custom_id) ?? stringOf(purchaseUnit.custom_id);
     const connectorPaymentId = stringOf(related.order_id) ??
@@ -742,7 +742,14 @@ function normalizePayPalWebhook(input, binding) {
     const vaultDetails = type.startsWith('VAULT.PAYMENT-TOKEN.')
         ? resource
         : paymentSourceVault;
-    const merchantOperationId = invoiceId;
+    // A repeat charge uses its idempotency key as PayPal's invoice ID, while the
+    // order's custom ID retains the payment operation owner. Checkout invoices
+    // continue to identify the operation and custom IDs may identify a session.
+    const repeatCharge = invoiceId?.startsWith('aw:') && customId?.startsWith('payop_');
+    const merchantOperationId = repeatCharge
+        ? customId
+        : invoiceId;
+    const medusaPaymentSessionId = repeatCharge ? null : customId;
     const normalized = {
         ...envelope,
         customerId: stringOf(recordOf(vaultDetails.customer).id) ??
@@ -1103,7 +1110,25 @@ class PrismPayPalConnector {
             });
             const responseOperationId = stringOf(response.merchantTransactionId);
             if (responseOperationId && responseOperationId !== input.operationId) {
-                throw configurationError('PayPal payment ownership does not match the payment operation.', 'PRISM_PAYMENT_OWNERSHIP');
+                // PayPal repeat charges return their merchant charge/invoice reference
+                // through PSync. Verify the order's distinct custom ID and exact amount
+                // before accepting that reference for the saved payment operation.
+                const order = recordOf(await this.paypalRequest('GET', `/v2/checkout/orders/${encodeURIComponent(input.connectorPaymentId)}`));
+                const units = Array.isArray(order.purchase_units) ? order.purchase_units : [];
+                const unit = units.length === 1 ? recordOf(units[0]) : {};
+                const orderAmount = recordOf(unit.amount);
+                const currency = stringOf(orderAmount.currency_code)?.toLowerCase();
+                const value = stringOf(orderAmount.value);
+                const ownedAmount = currency && value
+                    ? (0, money_1.toProviderMinorAmount)({ medusaAmount: value, currency })
+                    : null;
+                if (stringOf(order.id) !== input.connectorPaymentId ||
+                    stringOf(unit.custom_id) !== input.operationId ||
+                    stringOf(unit.invoice_id) !== responseOperationId ||
+                    currency !== input.money.currency.toLowerCase() ||
+                    ownedAmount !== BigInt(input.money.amountMinor)) {
+                    throw configurationError('PayPal payment ownership does not match the payment operation.', 'PRISM_PAYMENT_OWNERSHIP');
+                }
             }
             const responseAmount = recordOf(response.amount);
             const amountMinor = integerOf(responseAmount.minorAmount);

package/dist/src/payments/generated/libconnector_service_ffi.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/src/payments/generated/libconnector_service_ffi.so
-size: 105630648 bytes
-sha256: 93607402e9d0d7ffa2a03ca3c6ca04573d10d767acc8dca694864c2f65280ffc
+size: 105624624 bytes
+sha256: 02988fe20af64d5bbbcde81861e2592b66fad08f80680b5a7382026df9e0e382

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphawebai/hs-prism",
-  "version": "0.1.0-rc.47",
+  "version": "0.1.0-rc.49",
   "description": "Hyperswitch Payments SDK — Node.js client for connector integrations via UniFFI FFI",
   "main": "dist/src/index.js",
   "exports": {