@h-ai/payment 0.1.0-alpha9 → 1.0.0-beta.10

package/dist/index.js

@@ -1,9 +1,10 @@
-import { paymentM, HaiPaymentError } from './chunk-4IUARFWH.js';
-export { HaiPaymentError } from './chunk-4IUARFWH.js';
+import { paymentM, HaiPaymentError } from './chunk-YQD4KPT5.js';
+export { HaiPaymentError } from './chunk-YQD4KPT5.js';
 import { z } from 'zod';
 import { core, err, ok } from '@h-ai/core';
+import { reldb } from '@h-ai/reldb';
 import { audit } from '@h-ai/audit';
-import { createVerify, createDecipheriv, randomBytes, createSign, createHmac } from 'crypto';
+import { createHash, createHmac, X509Certificate, createDecipheriv, randomBytes, createSign, createVerify } from 'crypto';
 import { Buffer } from 'buffer';
 
 var WechatPayConfigSchema = z.object({
@@ -11,20 +12,29 @@ var WechatPayConfigSchema = z.object({
   apiV3Key: z.string().min(1, paymentM("payment_configFieldRequired")),
   serialNo: z.string().min(1, paymentM("payment_configFieldRequired")),
   privateKey: z.string().min(1, paymentM("payment_configFieldRequired")),
-  platformCert: z.string().optional(),
+  /** 精确按 Wechatpay-Serial 选择平台证书/公钥，轮换期间同时配置新旧标识。 */
+  platformKeys: z.record(z.string().min(1), z.string().min(1)).refine((keys) => Object.keys(keys).length > 0, paymentM("payment_configFieldRequired")),
   appId: z.string().min(1, paymentM("payment_configFieldRequired"))
 });
 var AlipayConfigSchema = z.object({
   appId: z.string().min(1, paymentM("payment_configFieldRequired")),
+  sellerId: z.string().min(1, paymentM("payment_configFieldRequired")),
   privateKey: z.string().min(1, paymentM("payment_configFieldRequired")),
   alipayPublicKey: z.string().min(1, paymentM("payment_configFieldRequired")),
+  /** 手机网站支付完成后返回的可信 HTTPS 地址；仅用于页面导航，不能证明付款。 */
+  returnUrl: z.url({ protocol: /^https$/ }),
   signType: z.enum(["RSA2", "RSA"]).default("RSA2"),
   sandbox: z.boolean().default(false)
 });
 var StripeConfigSchema = z.object({
-  secretKey: z.string().min(1, paymentM("payment_configFieldRequired")),
-  webhookSecret: z.string().min(1, paymentM("payment_configFieldRequired"))
-});
+  secretKey: z.string().regex(/^(?:sk|rk)_(?:test|live)_\S+$/, paymentM("payment_stripeKeyInvalid")),
+  webhookSecret: z.string().min(1, paymentM("payment_configFieldRequired")),
+  /** 托管 Checkout 完成后的可信跳转地址，可含 {CHECKOUT_SESSION_ID}。 */
+  successUrl: z.url({ protocol: /^https?$/ }),
+  /** 托管 Checkout 取消按钮的可信跳转地址；省略时不显示返回按钮。 */
+  cancelUrl: z.url({ protocol: /^https?$/ }).optional(),
+  webhookToleranceSeconds: z.number().int().positive().default(300)
+}).strict();
 var PaymentConfigSchema = z.object({
   wechat: WechatPayConfigSchema.optional(),
   alipay: AlipayConfigSchema.optional(),
@@ -38,6 +48,35 @@ async function auditLog(input) {
     logger.warn("Failed to write payment audit log", { action: input.action, error: result.error.message });
   }
 }
+function isValidAmount(amount) {
+  return Number.isSafeInteger(amount) && amount > 0;
+}
+function validateCreateOrderInput(input) {
+  if (!isValidAmount(input.amount)) {
+    return err(
+      HaiPaymentError.INVALID_AMOUNT,
+      paymentM("payment_invalidAmount")
+    );
+  }
+  return ok(void 0);
+}
+function validateRefundInput(input) {
+  if (!isValidAmount(input.amount)) {
+    return err(
+      HaiPaymentError.INVALID_AMOUNT,
+      paymentM("payment_invalidAmount")
+    );
+  }
+  if (input.totalAmount !== void 0) {
+    if (!isValidAmount(input.totalAmount) || input.totalAmount < input.amount) {
+      return err(
+        HaiPaymentError.INVALID_AMOUNT,
+        paymentM("payment_invalidAmount")
+      );
+    }
+  }
+  return ok(void 0);
+}
 function registerProvider(provider) {
   providers.set(provider.name, provider);
 }
@@ -58,6 +97,9 @@ async function createOrder(providerName, input) {
   const result = requireProvider(providerName);
   if (!result.success)
     return result;
+  const validateResult = validateCreateOrderInput(input);
+  if (!validateResult.success)
+    return validateResult;
   const orderResult = await result.data.createOrder(input);
   if (orderResult.success) {
     await auditLog({
@@ -79,7 +121,7 @@ async function handleNotify(providerName, request) {
       action: "payment_notify",
       resource: "payment",
       resourceId: notifyResult.data.orderNo,
-      details: { provider: providerName, transactionId: notifyResult.data.transactionId, status: notifyResult.data.status, amount: notifyResult.data.amount }
+      details: { provider: providerName, transactionId: notifyResult.data.transactionId, eventId: notifyResult.data.eventId, status: notifyResult.data.status, amount: notifyResult.data.amount, currency: notifyResult.data.currency }
     });
   }
   return notifyResult;
@@ -94,6 +136,9 @@ async function refund(providerName, input) {
   const result = requireProvider(providerName);
   if (!result.success)
     return result;
+  const validateResult = validateRefundInput(input);
+  if (!validateResult.success)
+    return validateResult;
   const refundResult = await result.data.refund(input);
   if (refundResult.success) {
     await auditLog({
@@ -123,6 +168,15 @@ async function closeOrder(providerName, orderNo) {
 function clearProviders() {
   providers.clear();
 }
+
+// src/providers/payment-provider-http.ts
+var DEFAULT_PROVIDER_TIMEOUT_MS = 15e3;
+async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_PROVIDER_TIMEOUT_MS) {
+  return fetch(input, {
+    ...init,
+    signal: init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs)
+  });
+}
 function signAlipayParams(params, privateKey, signType = "RSA2") {
   const sorted = Object.keys(params).filter((k) => params[k] !== void 0 && params[k] !== "").sort().map((k) => `${k}=${params[k]}`).join("&");
   const algorithm = signType === "RSA2" ? "RSA-SHA256" : "RSA-SHA1";
@@ -132,7 +186,9 @@ function signAlipayParams(params, privateKey, signType = "RSA2") {
 }
 function verifyAlipayNotify(params, alipayPublicKey) {
   const sign = params.sign ?? "";
-  const signType = params.sign_type ?? "RSA2";
+  const signType = params.sign_type;
+  if (signType !== "RSA" && signType !== "RSA2")
+    return false;
   const sorted = Object.keys(params).filter((k) => k !== "sign" && k !== "sign_type" && params[k] !== void 0 && params[k] !== "").sort().map((k) => `${k}=${params[k]}`).join("&");
   const algorithm = signType === "RSA2" ? "RSA-SHA256" : "RSA-SHA1";
   const verify = createVerify(algorithm);
@@ -140,9 +196,96 @@ function verifyAlipayNotify(params, alipayPublicKey) {
   return verify.verify(alipayPublicKey, sign, "base64");
 }
 
-// src/providers/alipay/alipay-provider.ts
+// src/providers/alipay/payment-alipay-time.ts
+var beijingFormatter = new Intl.DateTimeFormat("en-CA", {
+  timeZone: "Asia/Shanghai",
+  year: "numeric",
+  month: "2-digit",
+  day: "2-digit",
+  hour: "2-digit",
+  minute: "2-digit",
+  second: "2-digit",
+  hourCycle: "h23"
+});
+function formatAlipayTime(date) {
+  const parts = Object.fromEntries(beijingFormatter.formatToParts(date).map((part) => [part.type, part.value]));
+  return `${parts.year}-${parts.month}-${parts.day} ${parts.hour}:${parts.minute}:${parts.second}`;
+}
+function parseAlipayTime(value) {
+  if (!/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(value))
+    return void 0;
+  const date = /* @__PURE__ */ new Date(`${value.replace(" ", "T")}+08:00`);
+  return Number.isFinite(date.getTime()) && formatAlipayTime(date) === value ? date : void 0;
+}
+var AlipayTimeSchema = z.string().refine((value) => parseAlipayTime(value) !== void 0);
+var AlipayResponseRootSchema = z.record(z.string(), z.unknown());
+var AlipayResponseSchema = z.object({
+  code: z.string().regex(/^\d{5}$/),
+  sub_code: z.string().optional()
+});
+var AlipayAmountSchema = z.string().regex(/^\d+(?:\.\d{1,2})?$/);
+var AlipayQueryResponseSchema = z.object({
+  out_trade_no: z.string().min(1),
+  trade_no: z.string().min(1),
+  trade_status: z.enum(["WAIT_BUYER_PAY", "TRADE_CLOSED", "TRADE_SUCCESS", "TRADE_FINISHED"]),
+  total_amount: AlipayAmountSchema,
+  send_pay_date: AlipayTimeSchema.optional()
+});
+var AlipayRefundResponseSchema = z.object({
+  out_trade_no: z.string().min(1),
+  trade_no: z.string().min(1),
+  refund_fee: AlipayAmountSchema,
+  fund_change: z.enum(["Y", "N"]).optional()
+});
+var AlipayCloseResponseSchema = z.object({
+  out_trade_no: z.string().min(1),
+  trade_no: z.string().min(1)
+});
+var AlipayNotifyParamsSchema = z.object({
+  app_id: z.string().min(1),
+  seller_id: z.string().min(1),
+  notify_id: z.string().min(1),
+  notify_type: z.literal("trade_status_sync"),
+  notify_time: AlipayTimeSchema,
+  sign_type: z.enum(["RSA", "RSA2"]),
+  sign: z.string().min(1),
+  out_trade_no: z.string().min(1),
+  trade_no: z.string().min(1),
+  trade_status: z.enum(["WAIT_BUYER_PAY", "TRADE_CLOSED", "TRADE_SUCCESS", "TRADE_FINISHED"]),
+  total_amount: AlipayAmountSchema,
+  gmt_payment: AlipayTimeSchema.optional()
+}).catchall(z.string()).refine((params) => !["TRADE_SUCCESS", "TRADE_FINISHED"].includes(params.trade_status) || !!params.gmt_payment);
+
+// src/providers/alipay/payment-provider-alipay.ts
 var ALIPAY_GATEWAY = "https://openapi.alipay.com/gateway.do";
 var ALIPAY_SANDBOX_GATEWAY = "https://openapi-sandbox.dl.alipaydev.com/gateway.do";
+function formatFenAmount(amount) {
+  const yuan = Math.floor(amount / 100);
+  const cents = String(amount % 100).padStart(2, "0");
+  return `${yuan}.${cents}`;
+}
+function parseAlipayAmount(value) {
+  const trimmedValue = value.trim();
+  if (!/^\d+(?:\.\d{1,2})?$/.test(trimmedValue)) {
+    throw new Error("Invalid Alipay amount");
+  }
+  const [yuanPart, centsPart = ""] = trimmedValue.split(".");
+  const amount = Number.parseInt(yuanPart, 10) * 100 + Number.parseInt(centsPart.padEnd(2, "0"), 10);
+  if (!Number.isSafeInteger(amount)) {
+    throw new TypeError("Invalid Alipay amount");
+  }
+  return amount;
+}
+function parseAlipayNotifyParams(body) {
+  const params = new URLSearchParams(body);
+  if (new Set(params.keys()).size !== [...params].length)
+    throw new Error("Ambiguous Alipay notification parameters");
+  const parseResult = AlipayNotifyParamsSchema.safeParse(Object.fromEntries(params.entries()));
+  if (!parseResult.success) {
+    throw new Error("Invalid Alipay notification parameters");
+  }
+  return parseResult.data;
+}
 function createAlipayProvider(config) {
   const gateway = config.sandbox ? ALIPAY_SANDBOX_GATEWAY : ALIPAY_GATEWAY;
   const signType = config.signType ?? "RSA2";
@@ -150,60 +293,78 @@ function createAlipayProvider(config) {
     return {
       app_id: config.appId,
       method,
+      format: "JSON",
       charset: "utf-8",
       sign_type: signType,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19),
+      timestamp: formatAlipayTime(/* @__PURE__ */ new Date()),
       version: "1.0",
       notify_url: notifyUrl
     };
   }
-  function getTradeConfig(tradeType) {
-    const map = {
-      jsapi: { method: "alipay.trade.create", productCode: "JSAPI_PAY" },
-      h5: { method: "alipay.trade.wap.pay", productCode: "QUICK_WAP_WAY" },
-      app: { method: "alipay.trade.app.pay", productCode: "QUICK_MSECURITY_PAY" },
-      native: { method: "alipay.trade.precreate", productCode: "FACE_TO_FACE_PAYMENT" }
-    };
-    return map[tradeType] ?? map.h5;
-  }
-  async function alipayRequest(params) {
+  async function alipayRequest(params, schema) {
     const sign = signAlipayParams(params, config.privateKey, signType);
     const allParams = { ...params, sign };
-    const queryString = Object.entries(allParams).map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join("&");
-    const response = await fetch(`${gateway}?${queryString}`, {
+    const timedResponse = await fetchWithTimeout(gateway, {
       method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" }
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams(allParams).toString()
     });
-    if (!response.ok) {
-      throw new Error(`Alipay API failed: ${response.status}`);
+    if (!timedResponse.ok) {
+      throw new Error(`Alipay API failed: ${timedResponse.status}`);
     }
-    return response.json();
+    let body;
+    try {
+      body = await timedResponse.json();
+    } catch {
+      throw new Error("Invalid Alipay JSON response");
+    }
+    const root = AlipayResponseRootSchema.safeParse(body);
+    const key = `${params.method.replace(/\./g, "_")}_response`;
+    if (!root.success || "error_response" in root.data) {
+      throw new Error("Invalid Alipay response envelope");
+    }
+    const response = root.data[key];
+    const common = AlipayResponseSchema.safeParse(response);
+    if (!common.success) {
+      throw new Error("Invalid Alipay response code");
+    }
+    if (common.data.code !== "10000") {
+      const subCode = common.data.sub_code;
+      const suffix = subCode && /^[\w.-]{1,80}$/.test(subCode) ? `, sub_code=${subCode}` : "";
+      throw new Error(`Alipay business request failed (code=${common.data.code}${suffix})`);
+    }
+    const parsed = schema.safeParse(response);
+    if (!parsed.success) {
+      throw new Error("Invalid Alipay business response");
+    }
+    return parsed.data;
   }
   return {
     name: "alipay",
     async createOrder(input) {
+      if (input.tradeType !== "h5")
+        return err(HaiPaymentError.UNSUPPORTED_TRADE_TYPE, paymentM("payment_unsupportedTradeType"));
+      if (input.currency !== void 0 && input.currency !== "CNY")
+        return err(HaiPaymentError.INVALID_INPUT, paymentM("payment_invalidCreateOrderInput"));
       try {
-        const { method, productCode } = getTradeConfig(input.tradeType);
-        const bizContent = JSON.stringify({
-          out_trade_no: input.orderNo,
-          total_amount: (input.amount / 100).toFixed(2),
-          // 分 → 元
-          subject: input.description,
-          product_code: productCode,
-          passback_params: input.metadata ? JSON.stringify(input.metadata) : void 0
-        });
-        const params = {
-          ...buildCommonParams(method, input.notifyUrl),
-          biz_content: bizContent
+        const fields = {
+          ...buildCommonParams("alipay.trade.wap.pay", input.notifyUrl),
+          return_url: config.returnUrl,
+          biz_content: JSON.stringify({
+            out_trade_no: input.orderNo,
+            total_amount: formatFenAmount(input.amount),
+            subject: input.description,
+            product_code: "QUICK_WAP_WAY",
+            passback_params: input.metadata ? encodeURIComponent(JSON.stringify(input.metadata)) : void 0
+          })
         };
-        const response = await alipayRequest(params);
-        const key = `${method.replace(/\./g, "_")}_response`;
-        const data = response[key];
         return ok({
           provider: "alipay",
-          tradeType: input.tradeType,
-          clientParams: data ?? {},
-          prepayId: data?.trade_no
+          tradeType: "h5",
+          clientParams: {
+            gateway,
+            fields: { ...fields, sign: signAlipayParams(fields, config.privateKey, signType) }
+          }
         });
       } catch (cause) {
         return err(
@@ -215,19 +376,22 @@ function createAlipayProvider(config) {
     },
     async handleNotify(request) {
       try {
-        const params = {};
-        const pairs = request.body.split("&");
-        for (const pair of pairs) {
-          const [key, ...rest] = pair.split("=");
-          params[decodeURIComponent(key)] = decodeURIComponent(rest.join("="));
-        }
-        const valid = verifyAlipayNotify(params, config.alipayPublicKey);
+        const params = parseAlipayNotifyParams(request.body);
+        const valid = params.sign_type === signType && verifyAlipayNotify(params, config.alipayPublicKey);
         if (!valid) {
           return err(
             HaiPaymentError.NOTIFY_VERIFY_FAILED,
             paymentM("payment_notifyVerifyFailed")
           );
         }
+        if (params.app_id !== config.appId || params.seller_id !== config.sellerId) {
+          return err(HaiPaymentError.NOTIFY_VERIFY_FAILED, paymentM("payment_notifyVerifyFailed"));
+        }
+        const notifiedAt = parseAlipayTime(params.notify_time);
+        const paidAt = params.gmt_payment ? parseAlipayTime(params.gmt_payment) : void 0;
+        if (notifiedAt.getTime() > Date.now() + 3e5 || paidAt && paidAt.getTime() > notifiedAt.getTime() + 3e5) {
+          throw new Error("Invalid Alipay notification time");
+        }
         const statusMap = {
           TRADE_SUCCESS: "paid",
           TRADE_CLOSED: "closed",
@@ -237,10 +401,11 @@ function createAlipayProvider(config) {
         return ok({
           orderNo: params.out_trade_no,
           transactionId: params.trade_no,
-          amount: Math.round(Number.parseFloat(params.total_amount) * 100),
-          // 元 → 分
-          status: statusMap[params.trade_status] ?? "pending",
-          paidAt: params.gmt_payment ? new Date(params.gmt_payment) : void 0,
+          eventId: params.notify_id,
+          amount: parseAlipayAmount(params.total_amount),
+          currency: "CNY",
+          status: statusMap[params.trade_status],
+          paidAt: ["TRADE_SUCCESS", "TRADE_FINISHED"].includes(params.trade_status) ? paidAt : void 0,
           raw: params
         });
       } catch (cause) {
@@ -258,8 +423,10 @@ function createAlipayProvider(config) {
           ...buildCommonParams(method, ""),
           biz_content: JSON.stringify({ out_trade_no: orderNo })
         };
-        const response = await alipayRequest(params);
-        const data = response.alipay_trade_query_response;
+        const data = await alipayRequest(params, AlipayQueryResponseSchema);
+        if (data.out_trade_no !== orderNo) {
+          throw new Error("Alipay response order mismatch");
+        }
         const statusMap = {
           TRADE_SUCCESS: "paid",
           TRADE_CLOSED: "closed",
@@ -268,10 +435,11 @@ function createAlipayProvider(config) {
         };
         return ok({
           orderNo,
-          transactionId: data?.trade_no,
-          status: statusMap[data?.trade_status] ?? "pending",
-          amount: Math.round(Number.parseFloat(data?.total_amount ?? "0") * 100),
-          paidAt: data?.send_pay_date ? new Date(data.send_pay_date) : void 0
+          transactionId: data.trade_no,
+          status: statusMap[data.trade_status],
+          amount: parseAlipayAmount(data.total_amount),
+          // 支付宝时间为北京时间，不能依赖节点的本地时区解释。
+          paidAt: data.send_pay_date ? parseAlipayTime(data.send_pay_date) : void 0
         });
       } catch (cause) {
         return err(
@@ -289,16 +457,19 @@ function createAlipayProvider(config) {
           biz_content: JSON.stringify({
             out_trade_no: input.orderNo,
             out_request_no: input.refundNo,
-            refund_amount: (input.amount / 100).toFixed(2),
+            refund_amount: formatFenAmount(input.amount),
             refund_reason: input.reason
           })
         };
-        const response = await alipayRequest(params);
-        const data = response.alipay_trade_refund_response;
+        const data = await alipayRequest(params, AlipayRefundResponseSchema);
+        if (data.out_trade_no !== input.orderNo) {
+          throw new Error("Alipay response order mismatch");
+        }
+        parseAlipayAmount(data.refund_fee);
         return ok({
           refundNo: input.refundNo,
-          refundId: data?.trade_no ?? "",
-          status: data?.fund_change === "Y" ? "success" : "processing"
+          refundId: data.trade_no,
+          status: data.fund_change === "Y" ? "success" : "processing"
         });
       } catch (cause) {
         return err(
@@ -315,7 +486,10 @@ function createAlipayProvider(config) {
           ...buildCommonParams(method, ""),
           biz_content: JSON.stringify({ out_trade_no: orderNo })
         };
-        await alipayRequest(params);
+        const data = await alipayRequest(params, AlipayCloseResponseSchema);
+        if (data.out_trade_no !== orderNo) {
+          throw new Error("Alipay response order mismatch");
+        }
         return ok(void 0);
       } catch (cause) {
         return err(
@@ -327,16 +501,237 @@ function createAlipayProvider(config) {
     }
   };
 }
+
+// src/providers/payment-provider-notify.ts
+function getNotifyHeader(headers, name) {
+  const values = Object.entries(headers).filter(([key]) => key.toLowerCase() === name.toLowerCase());
+  return values.length === 1 ? values[0][1] : void 0;
+}
+
+// src/providers/stripe/payment-stripe-repository-operation.ts
+var STRIPE_OPERATION_TABLE = "hai_payment_stripe_operations";
+var SAFE_RETRY_SECONDS = 23 * 60 * 60;
+var StripeOperationRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  /** 建表成功后才能发布 Provider；失败由 payment.init 返回。 */
+  async initialize() {
+    return this.db.ddl.createTable(STRIPE_OPERATION_TABLE, {
+      id: { type: "TEXT", primaryKey: true },
+      request_hash: { type: "TEXT", notNull: true },
+      result_json: { type: "JSON" },
+      payment_intent: { type: "TEXT" },
+      created_at: { type: "BIGINT", notNull: true }
+    }, true);
+  }
+  /** 数据库时间避免不同应用节点的系统时钟影响安全重试窗口。 */
+  nowSql() {
+    switch (this.db.config?.type) {
+      case "sqlite":
+        return "CAST(strftime('%s', 'now') AS INTEGER)";
+      case "postgresql":
+        return "CAST(EXTRACT(EPOCH FROM CURRENT_TIMESTAMP) AS BIGINT)";
+      case "mysql":
+        return "UNIX_TIMESTAMP()";
+      default:
+        throw new Error("Stripe operation repository requires an initialized database");
+    }
+  }
+  /**
+   * 读取持久操作记录，以共享数据库时间计算安全重试窗口，不根据渠道 metadata 列表猜订单。
+   * @param id - 按账户、模式、操作类型和业务标识生成的稳定摘要 ID。
+   * @returns 已保留的记录；无记录时为 null，result 为 null 仅代表结果未知。
+   * @throws 查询失败或持久结果 JSON 非法时抛错，由最近的 Provider 边界转为 HaiResult。
+   * @example 模块内部上下文
+   * ```ts
+   * async function lookup(repository: StripeOperationRepository, operationId: string) {
+   *   const record = await repository.load(operationId)
+   *   if (record?.result === null && !record.canRetry) {
+   *     throw new Error('Reconcile the channel outcome before retrying')
+   *   }
+   *   return record
+   * }
+   * ```
+   */
+  async load(id) {
+    const result = await this.db.sql.get(
+      `SELECT request_hash, result_json, payment_intent,
+       CASE WHEN created_at > (${this.nowSql()} - ${SAFE_RETRY_SECONDS}) THEN 1 ELSE 0 END AS can_retry
+       FROM ${STRIPE_OPERATION_TABLE} WHERE id = ?`,
+      [id]
+    );
+    if (!result.success)
+      throw new Error("Failed to load Stripe operation", { cause: result.error });
+    if (!result.data)
+      return null;
+    const row = result.data;
+    return {
+      requestHash: row.request_hash,
+      result: typeof row.result_json === "string" ? JSON.parse(row.result_json) : row.result_json,
+      paymentIntent: row.payment_intent,
+      canRetry: row.can_retry === true || row.can_retry === 1 || row.can_retry === "1"
+    };
+  }
+  /**
+   * 通过主键插入原子预留；并发节点只接受相同请求摘要，不覆盖已有参数或删除未知操作。
+   * @param id - 所有节点复用的稳定操作 ID，也是渠道幂等键。
+   * @param requestHash - 路径和排序后表单参数的规范摘要。
+   * @returns 数据库中唯一的操作记录；已有 result 必须复用而非重新请求渠道。
+   * @throws 预留/读取失败或同标识复用不同参数时抛错，由 Provider 转为操作失败。
+   * @example 模块内部上下文
+   * ```ts
+   * async function reserveOnce(repository: StripeOperationRepository, id: string, requestHash: string) {
+   *   const record = await repository.reserve(id, requestHash)
+   *   // result=null 可能是渠道执行后回执丢失；重试仍须原 id 且 canRetry=true。
+   *   if (record.result === null && !record.canRetry) throw new Error('Channel reconciliation required')
+   *   return record
+   * }
+   * ```
+   */
+  async reserve(id, requestHash) {
+    let record = await this.load(id);
+    if (!record) {
+      const inserted = await this.db.sql.execute(
+        `INSERT INTO ${STRIPE_OPERATION_TABLE} (id, request_hash, created_at) VALUES (?, ?, ${this.nowSql()})`,
+        [id, requestHash]
+      );
+      record = await this.load(id);
+      if (!record)
+        throw new Error("Failed to reserve Stripe operation", { cause: inserted.success ? void 0 : inserted.error });
+    }
+    if (record.requestHash !== requestHash)
+      throw new Error("Stripe operation identifier was reused with different parameters");
+    return record;
+  }
+  /**
+   * 以请求摘要和未完成状态作 CAS 发布渠道结果，再读取已持久化的唯一结果。
+   * @param id - 已成功预留的稳定操作 ID。
+   * @param requestHash - 与预留完全一致的规范请求摘要。
+   * @param result - 已经由渠道结果 Schema 校验、允许持久化的最小结果。
+   * @param paymentIntent - 已核对身份的 PaymentIntent；创建时尚未知可省略。
+   * @returns 数据库确认的结果，可能由并发完成者先写入；调用者须再按结果 Schema 解析。
+   * @throws 更新、重读或持久状态核对失败时抛错；不将未知状态伪装为成功。
+   * @example 模块内部上下文
+   * ```ts
+   * async function persistConfirmed(repository: StripeOperationRepository, id: string, digest: string, confirmedMapping: unknown) {
+   *   // 调用前渠道响应已校验；digest 来自首次预留，不能以新参数覆盖旧操作。
+   *   return repository.complete(id, digest, confirmedMapping)
+   * }
+   * ```
+   */
+  async complete(id, requestHash, result, paymentIntent) {
+    const updated = await this.db.sql.execute(
+      `UPDATE ${STRIPE_OPERATION_TABLE} SET result_json = ?, payment_intent = ?
+       WHERE id = ? AND request_hash = ? AND result_json IS NULL`,
+      [JSON.stringify(result), paymentIntent ?? null, id, requestHash]
+    );
+    if (!updated.success)
+      throw new Error("Failed to persist Stripe operation result", { cause: updated.error });
+    const persisted = await this.load(id);
+    if (!persisted || persisted.requestHash !== requestHash || persisted.result === null)
+      throw new Error("Stripe operation result was not persisted");
+    return persisted.result;
+  }
+  /**
+   * 只在订单映射已完成时首次补全或幂等确认同一 PaymentIntent，禁止迟到写覆盖渠道身份。
+   * @param id - 已确认 Checkout Session 映射的订单操作 ID。
+   * @param paymentIntent - 从该 Session 读取且通过订单/金额/币种核对的渠道标识。
+   * @throws 写入失败、订单未完成或已绑定不同 PaymentIntent 时抛错，由 Provider 转为失败。
+   * @example 模块内部上下文
+   * ```ts
+   * async function bindVerifiedIntent(repository: StripeOperationRepository, orderOperationId: string, verifiedIntentId: string) {
+   *   await repository.rememberPaymentIntent(orderOperationId, verifiedIntentId)
+   *   // 仅确认渠道身份映射，不代表宿主业务已履约。
+   * }
+   * ```
+   */
+  async rememberPaymentIntent(id, paymentIntent) {
+    const result = await this.db.sql.execute(
+      `UPDATE ${STRIPE_OPERATION_TABLE} SET payment_intent = ?
+       WHERE id = ? AND result_json IS NOT NULL AND (payment_intent IS NULL OR payment_intent = ?)`,
+      [paymentIntent, id, paymentIntent]
+    );
+    if (!result.success)
+      throw new Error("Failed to persist Stripe PaymentIntent", { cause: result.error });
+    const record = await this.load(id);
+    if (!record || record.paymentIntent !== paymentIntent)
+      throw new Error("Stripe PaymentIntent conflicts with the persisted mapping");
+  }
+};
+
+// src/providers/stripe/payment-provider-stripe.ts
 var STRIPE_API_BASE = "https://api.stripe.com/v1";
-function createStripeProvider(config) {
-  async function stripeRequest(method, path, body) {
-    const response = await fetch(`${STRIPE_API_BASE}${path}`, {
+var STRIPE_API_VERSION = "2026-09-30.endive";
+var StripeCreatedSessionSchema = z.object({
+  id: z.string().min(1),
+  url: z.url(),
+  payment_intent: z.string().min(1).nullable().optional()
+});
+var StripeOrderMappingSchema = z.object({
+  orderNo: z.string().min(1),
+  amount: z.number().int().positive(),
+  currency: z.string().regex(/^[A-Z]{3}$/),
+  session: StripeCreatedSessionSchema
+});
+var StripeRetrievedSessionSchema = z.object({
+  id: z.string().min(1),
+  metadata: z.object({ orderNo: z.string().min(1) }),
+  amount_total: z.number().int().nonnegative(),
+  currency: z.string().regex(/^[a-z]{3}$/i),
+  payment_status: z.enum(["paid", "unpaid", "no_payment_required"]),
+  payment_intent: z.string().min(1).nullable(),
+  status: z.enum(["open", "complete", "expired"])
+});
+var StripeRefundSchema = z.object({
+  id: z.string().min(1),
+  status: z.enum(["pending", "requires_action", "succeeded", "failed", "canceled"])
+});
+var StripeCheckoutEventSchema = z.object({
+  id: z.string().min(1),
+  livemode: z.boolean(),
+  // 本 Provider 只支持当前账户，不能消费 Connect/组织上下文的其它商户事件。
+  account: z.never().optional(),
+  context: z.never().optional(),
+  created: z.number().int().nonnegative().max(864e10),
+  type: z.enum([
+    "checkout.session.completed",
+    "checkout.session.async_payment_succeeded",
+    "checkout.session.async_payment_failed",
+    "checkout.session.expired"
+  ]),
+  data: z.object({
+    object: z.object({
+      object: z.literal("checkout.session"),
+      id: z.string().min(1),
+      mode: z.literal("payment"),
+      metadata: z.object({ orderNo: z.string().min(1).regex(/\S/) }).passthrough(),
+      amount_total: z.number().int().nonnegative(),
+      currency: z.string().regex(/^[a-z]{3}$/i),
+      payment_status: z.enum(["paid", "unpaid", "no_payment_required"])
+    }).passthrough()
+  }).passthrough()
+}).passthrough().refine((event) => {
+  const paid = event.data.object.payment_status !== "unpaid";
+  if (event.type === "checkout.session.async_payment_succeeded")
+    return paid;
+  if (event.type === "checkout.session.async_payment_failed" || event.type === "checkout.session.expired")
+    return !paid;
+  return true;
+}, { message: "Checkout event type contradicts payment status" });
+function createStripeProvider(config, repository = new StripeOperationRepository(reldb)) {
+  let accountScopePromise;
+  async function stripeRequest(method, path, options) {
+    const response = await fetchWithTimeout(`${STRIPE_API_BASE}${path}`, {
       method,
       headers: {
         "Authorization": `Bearer ${config.secretKey}`,
-        "Content-Type": "application/x-www-form-urlencoded"
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Stripe-Version": STRIPE_API_VERSION,
+        ...options?.idempotencyKey ? { "Idempotency-Key": options.idempotencyKey } : {}
       },
-      body: body ? Object.entries(body).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&") : void 0
+      body: options?.body ? Object.entries(options.body).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&") : void 0
     });
     if (!response.ok) {
       const errorText = await response.text();
@@ -344,19 +739,68 @@ function createStripeProvider(config) {
     }
     return response.json();
   }
-  const TIMESTAMP_TOLERANCE = 300;
+  async function accountScope() {
+    if (!accountScopePromise) {
+      accountScopePromise = (async () => {
+        const mode = /^(?:sk|rk)_(test|live)_/.exec(config.secretKey)?.[1];
+        if (!mode)
+          throw new Error("Stripe requires a test or live secret/restricted API key");
+        const account = z.object({ id: z.string().regex(/^acct_/).min(6) }).parse(await stripeRequest("GET", "/account"));
+        return `${account.id}:${mode}`;
+      })().catch((error) => {
+        accountScopePromise = void 0;
+        throw error;
+      });
+    }
+    return accountScopePromise;
+  }
+  async function operationId(kind, businessId) {
+    const digest = createHash("sha256").update(JSON.stringify([await accountScope(), kind, businessId])).digest("hex");
+    return `hai-payment-${kind}-${digest}`;
+  }
+  async function executeOperation(options) {
+    const requestHash = createHash("sha256").update(JSON.stringify([
+      options.path,
+      Object.entries(options.body).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+    ])).digest("hex");
+    const reserved = await repository.reserve(options.id, requestHash);
+    if (reserved.result !== null)
+      return options.resultSchema.parse(reserved.result);
+    if (!reserved.canRetry)
+      throw new Error("Stripe operation outcome is unknown beyond the safe retry window; reconcile before retrying");
+    const result = options.execute(await stripeRequest("POST", options.path, { body: options.body, idempotencyKey: options.id }));
+    return options.resultSchema.parse(await repository.complete(options.id, requestHash, result, options.paymentIntent?.(result)));
+  }
+  async function retrieveOrder(orderNo) {
+    const id = await operationId("order", orderNo);
+    const operation = await repository.load(id);
+    if (!operation || operation.result === null)
+      throw new Error("Stripe order has no confirmed persisted Session mapping");
+    const mapping = StripeOrderMappingSchema.parse(operation.result);
+    const session = StripeRetrievedSessionSchema.parse(await stripeRequest("GET", `/checkout/sessions/${encodeURIComponent(mapping.session.id)}`));
+    if (session.id !== mapping.session.id || session.metadata.orderNo !== orderNo || mapping.orderNo !== orderNo || session.amount_total !== mapping.amount || session.currency.toUpperCase() !== mapping.currency) {
+      throw new Error("Stripe Session does not match the persisted order");
+    }
+    if (session.payment_intent)
+      await repository.rememberPaymentIntent(id, session.payment_intent);
+    return session;
+  }
+  const TIMESTAMP_TOLERANCE = config.webhookToleranceSeconds ?? 300;
   function verifyWebhookSignature(payload, signature) {
-    const parts = signature.split(",");
-    const timestamp = parts.find((p) => p.startsWith("t="))?.slice(2) ?? "";
-    const v1 = parts.find((p) => p.startsWith("v1="))?.slice(3) ?? "";
-    const ts = Number.parseInt(timestamp, 10);
-    if (Number.isNaN(ts) || Math.abs(Math.floor(Date.now() / 1e3) - ts) > TIMESTAMP_TOLERANCE) {
+    const parts = signature.split(",").map((part) => part.trim());
+    const timestamps = parts.filter((p) => p.startsWith("t="));
+    if (timestamps.length !== 1)
+      return false;
+    const timestamp = timestamps[0].slice(2);
+    const signatures = parts.filter((p) => p.startsWith("v1=")).map((p) => p.slice(3));
+    const ts = Number(timestamp);
+    if (!/^(?:0|[1-9]\d{0,11})$/.test(timestamp) || !Number.isSafeInteger(ts) || Math.abs(Math.floor(Date.now() / 1e3) - ts) > TIMESTAMP_TOLERANCE) {
       return false;
     }
     const signedPayload = `${timestamp}.${payload}`;
     const expected = createHmac("sha256", config.webhookSecret).update(signedPayload).digest("hex");
     try {
-      return core.string.constantTimeEqual(v1, expected);
+      return signatures.some((v1) => /^[a-f0-9]{64}$/.test(v1) && core.string.constantTimeEqual(v1, expected));
     } catch {
       return false;
     }
@@ -364,27 +808,48 @@ function createStripeProvider(config) {
   return {
     name: "stripe",
     async createOrder(input) {
+      if (input.tradeType !== "h5")
+        return err(HaiPaymentError.UNSUPPORTED_TRADE_TYPE, paymentM("payment_unsupportedTradeType"));
       try {
+        z.string().min(1).regex(/\S/).parse(input.orderNo);
+        if (input.metadata && Object.hasOwn(input.metadata, "orderNo"))
+          throw new Error("Stripe metadata orderNo is reserved");
         const params = {
           "mode": "payment",
+          "ui_mode": "hosted_page",
+          "success_url": config.successUrl,
           "line_items[0][price_data][currency]": input.currency?.toLowerCase() ?? "usd",
           "line_items[0][price_data][product_data][name]": input.description,
           "line_items[0][price_data][unit_amount]": input.amount.toString(),
           "line_items[0][quantity]": "1"
         };
+        if (config.cancelUrl)
+          params.cancel_url = config.cancelUrl;
         params["metadata[orderNo]"] = input.orderNo;
         if (input.metadata) {
           for (const [k, v] of Object.entries(input.metadata)) {
             params[`metadata[${k}]`] = v;
           }
         }
-        const session = await stripeRequest("POST", "/checkout/sessions", params);
+        const mapping = await executeOperation({
+          id: await operationId("order", input.orderNo),
+          path: "/checkout/sessions",
+          body: params,
+          resultSchema: StripeOrderMappingSchema,
+          execute: (raw) => ({
+            orderNo: input.orderNo,
+            amount: input.amount,
+            currency: input.currency?.toUpperCase() ?? "USD",
+            session: StripeCreatedSessionSchema.parse(raw)
+          }),
+          paymentIntent: (result) => result.session.payment_intent
+        });
         return ok({
           provider: "stripe",
           tradeType: input.tradeType,
           clientParams: {
-            sessionId: session.id,
-            checkoutUrl: session.url
+            sessionId: mapping.session.id,
+            checkoutUrl: mapping.session.url
           }
         });
       } catch (cause) {
@@ -397,7 +862,7 @@ function createStripeProvider(config) {
     },
     async handleNotify(request) {
       try {
-        const signature = request.headers["stripe-signature"] ?? "";
+        const signature = getNotifyHeader(request.headers, "stripe-signature") ?? "";
         const valid = verifyWebhookSignature(request.body, signature);
         if (!valid) {
           return err(
@@ -405,40 +870,37 @@ function createStripeProvider(config) {
             paymentM("payment_notifyVerifyFailed")
           );
         }
-        const event = JSON.parse(request.body);
+        const parsed = StripeCheckoutEventSchema.safeParse(JSON.parse(request.body));
+        if (!parsed.success)
+          throw new Error("Invalid Stripe payment event");
+        const event = parsed.data;
+        if (event.livemode !== /^(?:sk|rk)_live_/.test(config.secretKey) || event.created > Math.floor(Date.now() / 1e3) + TIMESTAMP_TOLERANCE) {
+          return err(HaiPaymentError.NOTIFY_VERIFY_FAILED, paymentM("payment_notifyVerifyFailed"));
+        }
         const obj = event.data.object;
-        const orderNo = obj.metadata?.orderNo ?? "";
-        const statusMap = {
-          "checkout.session.completed": "paid",
-          "payment_intent.payment_failed": "failed"
-        };
+        const status = event.type === "checkout.session.expired" ? "closed" : event.type === "checkout.session.async_payment_failed" ? "failed" : obj.payment_status === "unpaid" ? "pending" : "paid";
         return ok({
-          orderNo,
+          orderNo: obj.metadata.orderNo,
           transactionId: obj.id,
-          amount: obj.amount_total ?? 0,
-          status: statusMap[event.type] ?? "pending",
-          paidAt: /* @__PURE__ */ new Date(),
+          eventId: event.id,
+          amount: obj.amount_total,
+          currency: obj.currency.toUpperCase(),
+          status,
+          // 使用支付成功事件的时间，使重复通知不会改变 paidAt；pending/failed/closed 不宣称已支付。
+          paidAt: status === "paid" ? new Date(event.created * 1e3) : void 0,
           raw: event
         });
-      } catch (cause) {
+      } catch {
         return err(
           HaiPaymentError.NOTIFY_PARSE_FAILED,
           paymentM("payment_notifyParseFailed"),
-          cause
+          new Error("Invalid Stripe payment notification")
         );
       }
     },
     async queryOrder(orderNo) {
       try {
-        const sessions = await stripeRequest("GET", `/checkout/sessions?limit=1&metadata[orderNo]=${encodeURIComponent(orderNo)}`);
-        const session = sessions.data[0];
-        if (!session) {
-          return ok({
-            orderNo,
-            status: "pending",
-            amount: 0
-          });
-        }
+        const session = await retrieveOrder(orderNo);
         const statusMap = {
           paid: "paid",
           unpaid: "pending",
@@ -447,7 +909,7 @@ function createStripeProvider(config) {
         return ok({
           orderNo,
           transactionId: session.id,
-          status: statusMap[session.payment_status] ?? "pending",
+          status: session.status === "expired" ? "closed" : statusMap[session.payment_status],
           amount: session.amount_total
         });
       } catch (cause) {
@@ -460,23 +922,34 @@ function createStripeProvider(config) {
     },
     async refund(input) {
       try {
-        const sessions = await stripeRequest("GET", `/checkout/sessions?limit=1&metadata[orderNo]=${encodeURIComponent(input.orderNo)}`);
-        const paymentIntent = sessions.data[0]?.payment_intent;
-        if (!paymentIntent) {
+        z.string().min(1).regex(/\S/).parse(input.refundNo);
+        const session = await retrieveOrder(input.orderNo);
+        if (!session.payment_intent || session.payment_status !== "paid") {
           return err(
             HaiPaymentError.REFUND_FAILED,
             paymentM("payment_refundFailed")
           );
         }
-        const refund2 = await stripeRequest("POST", "/refunds", {
-          payment_intent: paymentIntent,
-          amount: input.amount.toString(),
-          reason: input.reason ?? "requested_by_customer"
+        const body = {
+          "payment_intent": session.payment_intent,
+          "amount": input.amount.toString(),
+          "reason": "requested_by_customer",
+          "metadata[orderNo]": input.orderNo,
+          "metadata[refundNo]": input.refundNo
+        };
+        if (input.reason)
+          body["metadata[reason]"] = input.reason;
+        const refund2 = await executeOperation({
+          id: await operationId("refund", input.refundNo),
+          path: "/refunds",
+          body,
+          resultSchema: StripeRefundSchema,
+          execute: (raw) => StripeRefundSchema.parse(raw)
         });
         return ok({
           refundNo: input.refundNo,
           refundId: refund2.id,
-          status: refund2.status === "succeeded" ? "success" : "processing"
+          status: refund2.status === "succeeded" ? "success" : refund2.status === "failed" || refund2.status === "canceled" ? "failed" : "processing"
         });
       } catch (cause) {
         return err(
@@ -486,8 +959,31 @@ function createStripeProvider(config) {
         );
       }
     },
-    async closeOrder(_orderNo) {
-      return ok(void 0);
+    async closeOrder(orderNo) {
+      try {
+        const session = await retrieveOrder(orderNo);
+        if (session.payment_status !== "unpaid" || session.status === "complete")
+          throw new Error("A completed or paid Stripe Session cannot be closed");
+        if (session.status === "expired")
+          return ok(void 0);
+        try {
+          const expired = z.object({ id: z.string(), status: z.literal("expired") }).parse(
+            await stripeRequest("POST", `/checkout/sessions/${encodeURIComponent(session.id)}/expire`, {
+              body: {},
+              idempotencyKey: await operationId("close", orderNo)
+            })
+          );
+          if (expired.id !== session.id)
+            throw new Error("Stripe expiration response does not match the requested Session");
+        } catch (cause) {
+          const confirmed = await retrieveOrder(orderNo);
+          if (confirmed.status !== "expired" || confirmed.payment_status !== "unpaid")
+            throw cause;
+        }
+        return ok(void 0);
+      } catch (cause) {
+        return err(HaiPaymentError.CLOSE_ORDER_FAILED, paymentM("payment_closeOrderFailed"), cause);
+      }
     }
   };
 }
@@ -518,14 +1014,14 @@ prepay_id=${prepayId}
   sign.update(message);
   return sign.sign(privateKey, "base64");
 }
-function verifyNotifySignature(timestamp, nonce, body, signature, platformCert) {
+function verifyNotifySignature(timestamp, nonce, body, signature, platformKey) {
   const message = `${timestamp}
 ${nonce}
 ${body}
 `;
   const verify = createVerify("RSA-SHA256");
   verify.update(message);
-  return verify.verify(platformCert, signature, "base64");
+  return verify.verify(platformKey, signature, "base64");
 }
 function decryptResource(ciphertext, nonce, associatedData, apiV3Key) {
   const buf = Buffer.from(ciphertext, "base64");
@@ -537,17 +1033,67 @@ function decryptResource(ciphertext, nonce, associatedData, apiV3Key) {
   const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
   return decrypted.toString("utf-8");
 }
+var WechatNotifyEnvelopeSchema = z.object({
+  id: z.string().min(1),
+  create_time: z.iso.datetime({ offset: true }),
+  event_type: z.literal("TRANSACTION.SUCCESS"),
+  resource_type: z.literal("encrypt-resource"),
+  resource: z.object({
+    algorithm: z.literal("AEAD_AES_256_GCM"),
+    original_type: z.literal("transaction"),
+    ciphertext: z.string().min(1),
+    nonce: z.string().min(1),
+    associated_data: z.string().optional()
+  })
+});
+var WechatNotifyResourceSchema = z.object({
+  appid: z.string().min(1),
+  mchid: z.string().min(1),
+  out_trade_no: z.string().min(1),
+  transaction_id: z.string().min(1),
+  trade_state: z.literal("SUCCESS"),
+  amount: z.object({
+    total: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    currency: z.string().regex(/^[A-Z]{3}$/)
+  }).passthrough(),
+  success_time: z.iso.datetime({ offset: true })
+}).passthrough();
 
-// src/providers/wechat/wechat-pay-provider.ts
+// src/providers/wechat/payment-provider-wechat.ts
 var WECHAT_API_BASE = "https://api.mch.weixin.qq.com";
 function createWechatPayProvider(config) {
+  function verifyNotification(request) {
+    try {
+      const timestamp = getNotifyHeader(request.headers, "wechatpay-timestamp") ?? "";
+      const nonce = getNotifyHeader(request.headers, "wechatpay-nonce") ?? "";
+      const signature = getNotifyHeader(request.headers, "wechatpay-signature") ?? "";
+      const serial = getNotifyHeader(request.headers, "wechatpay-serial") ?? "";
+      const signatureType = getNotifyHeader(request.headers, "wechatpay-signature-type");
+      const now = Date.now();
+      if (!/^(?:0|[1-9]\d{0,11})$/.test(timestamp) || !Number.isSafeInteger(Number(timestamp)) || Math.abs(Math.floor(now / 1e3) - Number(timestamp)) > 300 || !nonce || !signature || !serial || signatureType !== void 0 && signatureType !== "WECHATPAY2-SHA256-RSA2048") {
+        return false;
+      }
+      const key = Object.hasOwn(config.platformKeys, serial) ? config.platformKeys[serial] : void 0;
+      if (!key)
+        return false;
+      if (key.includes("-----BEGIN CERTIFICATE-----")) {
+        const certificate = new X509Certificate(key);
+        if (certificate.serialNumber.toUpperCase() !== serial.toUpperCase() || now < Date.parse(certificate.validFrom) || now > Date.parse(certificate.validTo)) {
+          return false;
+        }
+      }
+      return verifyNotifySignature(timestamp, nonce, request.body, signature, key);
+    } catch {
+      return false;
+    }
+  }
   async function wechatRequest(method, path, body) {
     const timestamp = getTimestamp();
     const nonce = generateNonce();
     const bodyStr = body ? JSON.stringify(body) : "";
     const signature = signRequest(method, path, timestamp, nonce, bodyStr, config.privateKey);
     const authorization = `WECHATPAY2-SHA256-RSA2048 mchid="${config.mchId}",nonce_str="${nonce}",timestamp="${timestamp}",serial_no="${config.serialNo}",signature="${signature}"`;
-    const response = await fetch(`${WECHAT_API_BASE}${path}`, {
+    const response = await fetchWithTimeout(`${WECHAT_API_BASE}${path}`, {
       method,
       headers: {
         "Content-Type": "application/json",
@@ -562,18 +1108,14 @@ function createWechatPayProvider(config) {
     }
     return response.json();
   }
-  function getOrderPath(tradeType) {
-    const map = {
-      jsapi: "/v3/pay/transactions/jsapi",
-      h5: "/v3/pay/transactions/h5",
-      app: "/v3/pay/transactions/app",
-      native: "/v3/pay/transactions/native"
-    };
-    return map[tradeType] ?? "/v3/pay/transactions/jsapi";
-  }
   return {
     name: "wechat",
     async createOrder(input) {
+      if (input.tradeType !== "jsapi")
+        return err(HaiPaymentError.UNSUPPORTED_TRADE_TYPE, paymentM("payment_unsupportedTradeType"));
+      if (typeof input.userId !== "string" || !input.userId.trim() || input.userId.length > 128 || input.currency !== void 0 && input.currency !== "CNY") {
+        return err(HaiPaymentError.INVALID_INPUT, paymentM("payment_invalidCreateOrderInput"));
+      }
       try {
         const requestBody = {
           appid: config.appId,
@@ -583,35 +1125,26 @@ function createWechatPayProvider(config) {
           notify_url: input.notifyUrl,
           amount: {
             total: input.amount,
-            currency: input.currency ?? "CNY"
-          }
+            currency: "CNY"
+          },
+          payer: { openid: input.userId }
         };
-        if (input.tradeType === "jsapi" && input.userId) {
-          requestBody.payer = { openid: input.userId };
-        }
         if (input.metadata) {
           requestBody.attach = JSON.stringify(input.metadata);
         }
-        const path = getOrderPath(input.tradeType);
-        const response = await wechatRequest("POST", path, requestBody);
-        let clientParams = {};
-        if (input.tradeType === "jsapi") {
-          const timestamp = getTimestamp();
-          const nonce = generateNonce();
-          const paySign = signJsapi(config.appId, timestamp, nonce, response.prepay_id, config.privateKey);
-          clientParams = {
-            appId: config.appId,
-            timeStamp: timestamp,
-            nonceStr: nonce,
-            package: `prepay_id=${response.prepay_id}`,
-            signType: "RSA",
-            paySign
-          };
-        } else if (input.tradeType === "h5") {
-          clientParams = { h5Url: response.h5_url };
-        } else if (input.tradeType === "native") {
-          clientParams = { codeUrl: response.code_url };
-        }
+        const response = await wechatRequest("POST", "/v3/pay/transactions/jsapi", requestBody);
+        if (typeof response.prepay_id !== "string" || !response.prepay_id.trim())
+          throw new Error("Invalid Wechat JSAPI prepay response");
+        const timestamp = getTimestamp();
+        const nonce = generateNonce();
+        const clientParams = {
+          appId: config.appId,
+          timeStamp: timestamp,
+          nonceStr: nonce,
+          package: `prepay_id=${response.prepay_id}`,
+          signType: "RSA",
+          paySign: signJsapi(config.appId, timestamp, nonce, response.prepay_id, config.privateKey)
+        };
         return ok({
           provider: "wechat",
           tradeType: input.tradeType,
@@ -628,43 +1161,44 @@ function createWechatPayProvider(config) {
     },
     async handleNotify(request) {
       try {
-        const timestamp = request.headers["wechatpay-timestamp"] ?? "";
-        const nonce = request.headers["wechatpay-nonce"] ?? "";
-        const signature = request.headers["wechatpay-signature"] ?? "";
-        if (!config.platformCert) {
-          return err(
-            HaiPaymentError.NOTIFY_VERIFY_FAILED,
-            paymentM("payment_notifyVerifyFailed")
-          );
-        }
-        const valid = verifyNotifySignature(timestamp, nonce, request.body, signature, config.platformCert);
-        if (!valid) {
+        if (!verifyNotification(request)) {
           return err(
             HaiPaymentError.NOTIFY_VERIFY_FAILED,
             paymentM("payment_notifyVerifyFailed")
           );
         }
-        const body = JSON.parse(request.body);
+        const parsedBody = WechatNotifyEnvelopeSchema.safeParse(JSON.parse(request.body));
+        if (!parsedBody.success)
+          throw new Error("Invalid Wechat payment notification");
+        const body = parsedBody.data;
         const decrypted = decryptResource(
           body.resource.ciphertext,
           body.resource.nonce,
-          body.resource.associated_data,
+          body.resource.associated_data ?? "",
           config.apiV3Key
         );
-        const resource = JSON.parse(decrypted);
+        const parsedResource = WechatNotifyResourceSchema.safeParse(JSON.parse(decrypted));
+        if (!parsedResource.success)
+          throw new Error("Invalid Wechat payment notification resource");
+        const resource = parsedResource.data;
+        if (resource.appid !== config.appId || resource.mchid !== config.mchId) {
+          return err(HaiPaymentError.NOTIFY_VERIFY_FAILED, paymentM("payment_notifyVerifyFailed"));
+        }
         return ok({
           orderNo: resource.out_trade_no,
           transactionId: resource.transaction_id,
+          eventId: body.id,
           amount: resource.amount.total,
-          status: resource.trade_state === "SUCCESS" ? "paid" : "failed",
-          paidAt: resource.success_time ? new Date(resource.success_time) : void 0,
+          currency: resource.amount.currency,
+          status: "paid",
+          paidAt: new Date(resource.success_time),
           raw: resource
         });
-      } catch (cause) {
+      } catch {
         return err(
           HaiPaymentError.NOTIFY_PARSE_FAILED,
           paymentM("payment_notifyParseFailed"),
-          cause
+          new Error("Invalid Wechat payment notification")
         );
       }
     },
@@ -754,6 +1288,7 @@ var payment = {
    * 初始化支付模块
    *
    * 根据提供的配置自动注册对应的 Provider。
+   * Stripe 要求共享 reldb 已初始化；仓库就绪后才发布 Provider，关闭时不代替宿主关闭 reldb。
    *
    * @param config - 支付配置
    */
@@ -782,6 +1317,16 @@ var payment = {
         );
       }
       const parsed = parseResult.data;
+      let stripeProvider;
+      if (parsed.stripe) {
+        if (!reldb.isInitialized)
+          return err(HaiPaymentError.CONFIG_ERROR, paymentM("payment_stripeDatabaseRequired"));
+        const repository = new StripeOperationRepository(reldb);
+        const ready = await repository.initialize();
+        if (!ready.success)
+          return err(HaiPaymentError.CONFIG_ERROR, paymentM("payment_stripeStoreInitFailed"), ready.error);
+        stripeProvider = createStripeProvider(parsed.stripe, repository);
+      }
       clearProviders();
       if (parsed.wechat) {
         registerProvider(createWechatPayProvider(parsed.wechat));
@@ -789,9 +1334,8 @@ var payment = {
       if (parsed.alipay) {
         registerProvider(createAlipayProvider(parsed.alipay));
       }
-      if (parsed.stripe) {
-        registerProvider(createStripeProvider(parsed.stripe));
-      }
+      if (stripeProvider)
+        registerProvider(stripeProvider);
       currentConfig = parsed;
       logger2.info("Payment module initialized", {
         providers: [