@lunora/payment 1.0.0-alpha.11 → 1.0.0-alpha.12

package/dist/index.mjs

@@ -6,8 +6,8 @@ export { entitlementsForReference, featureNames, hasActivePrice, resolveEntitlem
 export { LunoraPaymentError } from './packem_shared/LunoraPaymentError-B3hEzXSs.mjs';
 export { default as idempotencyKey } from './packem_shared/idempotencyKey-BFzDCA7g.mjs';
 export { addMoney, allocateMoney, compareMoney, formatMoney, fromMoneyJSON, isZeroDecimalCurrency, isZeroMoney, money, subtractMoney, toMoneyJSON, zeroMoney } from './packem_shared/addMoney-bCcs1nyw.mjs';
-export { createPolarAdapter } from './packem_shared/createPolarAdapter-BJtVGSlF.mjs';
-export { createStripeAdapter } from './packem_shared/createStripeAdapter-D40MVBXg.mjs';
+export { createPolarAdapter } from './packem_shared/createPolarAdapter-CgErk9zo.mjs';
+export { createStripeAdapter } from './packem_shared/createStripeAdapter-oDvMhpeX.mjs';
 export { reconcile } from './packem_shared/reconcile-CI1ukJF9.mjs';
 export { default as paymentTables } from './packem_shared/paymentTables-DccHwWr_.mjs';
 export { PAYMENT_TERMINAL_STATES, SUBSCRIPTION_TERMINAL_STATES, canTransitionPayment, canTransitionSubscription, nextPaymentState, nextSubscriptionState } from './packem_shared/PAYMENT_TERMINAL_STATES-DrxV0clv.mjs';

package/dist/packem_shared/{createPolarAdapter-BJtVGSlF.mjs → createPolarAdapter-CgErk9zo.mjs}

@@ -12,7 +12,10 @@ const PAYMENT_STATE_BY_POLAR_ORDER_STATUS = {
 const SUBSCRIPTION_STATE_BY_POLAR_STATUS = {
   active: "active",
   canceled: "canceled",
-  incomplete: "trialing",
+  // SECURITY: `incomplete` (first payment not completed) must not map to an
+  // entitling state — see the equivalent note in the Stripe adapter. Treat it as
+  // non-entitling `past_due`; reserve `trialing` for a genuine trial.
+  incomplete: "past_due",
   incomplete_expired: "canceled",
   past_due: "past_due",
   trialing: "trialing",

package/dist/packem_shared/{createStripeAdapter-D40MVBXg.mjs → createStripeAdapter-oDvMhpeX.mjs}

@@ -15,7 +15,14 @@ const PAYMENT_STATE_BY_STRIPE_STATUS = {
 const SUBSCRIPTION_STATE_BY_STRIPE_STATUS = {
   active: "active",
   canceled: "canceled",
-  incomplete: "trialing",
+  // SECURITY: `incomplete` means the FIRST payment has not succeeded (SCA
+  // `requires_action` or a failed initial charge). It must NOT map to an
+  // entitling state — Stripe's recommended `payment_behavior: "default_incomplete"`
+  // makes `incomplete` the initial status of every new subscription, so mapping
+  // it to `trialing` (which is in ACTIVE_STATES) would grant paid entitlements
+  // before any payment. Reserve `trialing` for a genuine Stripe trial (status
+  // `trialing`, mapped below); treat `incomplete` as non-entitling `past_due`.
+  incomplete: "past_due",
   incomplete_expired: "canceled",
   past_due: "past_due",
   paused: "paused",
@@ -102,12 +109,14 @@ const mapEvent = (eventId, eventType, object) => {
     }
     case "checkout.session.completed": {
       if (readString(object, "mode") === "subscription") {
+        const paymentStatus = readString(object, "payment_status");
+        const paid = paymentStatus === "paid" || paymentStatus === "no_payment_required";
         return {
           ...base,
           customerId: readString(object, "customer"),
           referenceId: readReferenceId(object),
           subscriptionId: readString(object, "subscription"),
-          type: "subscription.active"
+          type: paid ? "subscription.active" : "subscription.updated"
         };
       }
       const amountTotal = readNumber(object, "amount_total");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/payment",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.12",
   "description": "Provider-agnostic payments for Lunora: Stripe-first adapter, webhook sync, and subscription/payment state machine",
   "keywords": [
     "billing",
@@ -47,7 +47,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/server": "1.0.0-alpha.11",
+    "@lunora/server": "1.0.0-alpha.12",
     "@lunora/values": "1.0.0-alpha.3",
     "dinero.js": "2.0.2"
   },