@lunora/payment 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/{packem_shared/createStripeAdapter-D40MVBXg.mjs → providers/stripe.mjs}

@@ -1,7 +1,8 @@
-import idempotencyKey from './idempotencyKey-BFzDCA7g.mjs';
-import { a as asRecord, r as readString, c as readNumber, b as readBoolean } from './json-Db337f36.mjs';
-import { compareMoney, money, zeroMoney } from './addMoney-bCcs1nyw.mjs';
-import { verifyStripeSignature } from './constantTimeEqual-CfY0jYcL.mjs';
+import { LunoraPaymentError } from '../packem_shared/LunoraPaymentError-BeQlhkZj.mjs';
+import idempotencyKey from '../packem_shared/idempotencyKey-BFzDCA7g.mjs';
+import { r as readString, c as readBoolean, b as readNumber, a as asRecord } from '../packem_shared/json-DhcPm8EO.mjs';
+import { compareMoney, money, zeroMoney } from '../packem_shared/addMoney-jSh_7TfF.mjs';
+import { s as stateToEventType } from '../packem_shared/subscription-event-CwEsWRCK.mjs';
 
 const PAYMENT_STATE_BY_STRIPE_STATUS = {
   canceled: "canceled",
@@ -15,7 +16,14 @@ const PAYMENT_STATE_BY_STRIPE_STATUS = {
 const SUBSCRIPTION_STATE_BY_STRIPE_STATUS = {
   active: "active",
   canceled: "canceled",
-  incomplete: "trialing",
+  // SECURITY: `incomplete` means the FIRST payment has not succeeded (SCA
+  // `requires_action` or a failed initial charge). It must NOT map to an
+  // entitling state — Stripe's recommended `payment_behavior: "default_incomplete"`
+  // makes `incomplete` the initial status of every new subscription, so mapping
+  // it to `trialing` (which is in ACTIVE_STATES) would grant paid entitlements
+  // before any payment. Reserve `trialing` for a genuine Stripe trial (status
+  // `trialing`, mapped below); treat `incomplete` as non-entitling `past_due`.
+  incomplete: "past_due",
   incomplete_expired: "canceled",
   past_due: "past_due",
   paused: "paused",
@@ -31,61 +39,49 @@ const firstItem = (object) => {
 const firstPriceId = (object) => readString(asRecord(firstItem(object).price), "id");
 const firstQuantity = (object) => readNumber(firstItem(object), "quantity");
 const periodEndMs = (object) => {
-  const seconds = readNumber(object, "current_period_end");
+  const seconds = readNumber(firstItem(object), "current_period_end") ?? readNumber(object, "current_period_end");
   return seconds === void 0 ? void 0 : seconds * 1e3;
 };
 const periodStartMs = (object) => {
-  const seconds = readNumber(object, "current_period_start");
+  const seconds = readNumber(firstItem(object), "current_period_start") ?? readNumber(object, "current_period_start");
   return seconds === void 0 ? void 0 : seconds * 1e3;
 };
-const intentToSession = (intent) => {
-  const amount = money(BigInt(intent.amount), intent.currency);
-  const state = PAYMENT_STATE_BY_STRIPE_STATUS[intent.status] ?? "initiated";
+const intentToSession = (input) => {
+  const intent = asRecord(input);
+  const currency = readString(intent, "currency") ?? "usd";
+  const amountValue = readNumber(intent, "amount") ?? 0;
+  const amount = money(BigInt(Math.round(amountValue)), currency);
+  const state = PAYMENT_STATE_BY_STRIPE_STATUS[readString(intent, "status") ?? ""] ?? "initiated";
   const now = Date.now();
   return {
     amount,
-    capturedAmount: state === "captured" ? money(BigInt(intent.amount_received ?? intent.amount), intent.currency) : zeroMoney(intent.currency),
+    capturedAmount: state === "captured" ? money(BigInt(Math.round(readNumber(intent, "amount_received") ?? amountValue)), currency) : zeroMoney(currency),
     createdAt: now,
-    id: intent.id,
+    id: readString(intent, "id") ?? "",
     provider: "stripe",
-    referenceId: intent.metadata?.referenceId ?? "",
-    refundedAmount: zeroMoney(intent.currency),
+    referenceId: readReferenceId(intent) ?? "",
+    refundedAmount: zeroMoney(currency),
     state,
     updatedAt: now
   };
 };
-const subscriptionFromStripe = (subscription) => {
+const subscriptionFromStripe = (input) => {
+  const subscription = asRecord(input);
   const now = Date.now();
   return {
-    cancelAtPeriodEnd: subscription.cancel_at_period_end ?? false,
+    cancelAtPeriodEnd: readBoolean(subscription, "cancel_at_period_end") ?? false,
     createdAt: now,
-    currentPeriodEnd: subscription.current_period_end ? subscription.current_period_end * 1e3 : void 0,
-    currentPeriodStart: subscription.current_period_start ? subscription.current_period_start * 1e3 : void 0,
-    id: subscription.id,
-    priceId: subscription.items?.data[0]?.price?.id ?? "",
+    currentPeriodEnd: periodEndMs(subscription),
+    currentPeriodStart: periodStartMs(subscription),
+    id: readString(subscription, "id") ?? "",
+    priceId: firstPriceId(subscription) ?? "",
     provider: "stripe",
-    quantity: subscription.items?.data[0]?.quantity ?? 1,
-    referenceId: subscription.metadata?.referenceId ?? "",
-    state: SUBSCRIPTION_STATE_BY_STRIPE_STATUS[subscription.status] ?? "active",
+    quantity: firstQuantity(subscription) ?? 1,
+    referenceId: readReferenceId(subscription) ?? "",
+    state: SUBSCRIPTION_STATE_BY_STRIPE_STATUS[readString(subscription, "status") ?? ""] ?? "active",
     updatedAt: now
   };
 };
-const subscriptionEventType = (status) => {
-  const state = status ? SUBSCRIPTION_STATE_BY_STRIPE_STATUS[status] : void 0;
-  if (state === "canceled") {
-    return "subscription.canceled";
-  }
-  if (state === "past_due") {
-    return "subscription.past_due";
-  }
-  if (state === "paused") {
-    return "subscription.paused";
-  }
-  if (state === "active" || state === "trialing") {
-    return "subscription.active";
-  }
-  return "subscription.updated";
-};
 const mapEvent = (eventId, eventType, object) => {
   const base = { eventId, provider: "stripe", raw: { object, type: eventType } };
   const currency = readString(object, "currency") ?? "usd";
@@ -93,7 +89,7 @@ const mapEvent = (eventId, eventType, object) => {
     case "charge.refunded": {
       return {
         ...base,
-        amount: money(BigInt(readNumber(object, "amount_refunded") ?? 0), currency),
+        amount: money(BigInt(Math.round(readNumber(object, "amount_refunded") ?? 0)), currency),
         amountKind: "absolute",
         referenceId: readReferenceId(object),
         sessionId: readString(object, "payment_intent") ?? readString(object, "id"),
@@ -102,18 +98,20 @@ const mapEvent = (eventId, eventType, object) => {
     }
     case "checkout.session.completed": {
       if (readString(object, "mode") === "subscription") {
+        const paymentStatus = readString(object, "payment_status");
+        const paid = paymentStatus === "paid" || paymentStatus === "no_payment_required";
         return {
           ...base,
           customerId: readString(object, "customer"),
           referenceId: readReferenceId(object),
           subscriptionId: readString(object, "subscription"),
-          type: "subscription.active"
+          type: paid ? "subscription.active" : "subscription.updated"
         };
       }
       const amountTotal = readNumber(object, "amount_total");
       return {
         ...base,
-        amount: amountTotal === void 0 ? void 0 : money(BigInt(amountTotal), currency),
+        amount: amountTotal === void 0 ? void 0 : money(BigInt(Math.round(amountTotal)), currency),
         customerId: readString(object, "customer"),
         referenceId: readReferenceId(object),
         sessionId: readString(object, "payment_intent") ?? readString(object, "id"),
@@ -132,7 +130,7 @@ const mapEvent = (eventId, eventType, object) => {
         quantity: firstQuantity(object),
         referenceId: readReferenceId(object),
         subscriptionId: readString(object, "id"),
-        type: subscriptionEventType(readString(object, "status"))
+        type: stateToEventType(SUBSCRIPTION_STATE_BY_STRIPE_STATUS[readString(object, "status") ?? ""])
       };
     }
     case "customer.subscription.deleted": {
@@ -141,7 +139,7 @@ const mapEvent = (eventId, eventType, object) => {
     case "payment_intent.amount_capturable_updated": {
       return {
         ...base,
-        amount: money(BigInt(readNumber(object, "amount") ?? 0), currency),
+        amount: money(BigInt(Math.round(readNumber(object, "amount") ?? 0)), currency),
         referenceId: readReferenceId(object),
         sessionId: readString(object, "id"),
         type: "payment.authorized"
@@ -153,7 +151,7 @@ const mapEvent = (eventId, eventType, object) => {
     case "payment_intent.succeeded": {
       return {
         ...base,
-        amount: money(BigInt(readNumber(object, "amount_received") ?? readNumber(object, "amount") ?? 0), currency),
+        amount: money(BigInt(Math.round(readNumber(object, "amount_received") ?? readNumber(object, "amount") ?? 0)), currency),
         customerId: readString(object, "customer"),
         referenceId: readReferenceId(object),
         sessionId: readString(object, "id"),
@@ -166,7 +164,8 @@ const mapEvent = (eventId, eventType, object) => {
   }
 };
 const createStripeAdapter = (options) => {
-  const { client, webhookSecret } = options;
+  const { webhookSecret } = options;
+  const client = options.client;
   return {
     cancelPayment: async (sessionId, paymentOptions) => {
       const intent = await client.paymentIntents.cancel(sessionId, void 0, { idempotencyKey: paymentOptions?.idempotencyKey });
@@ -218,10 +217,14 @@ const createStripeAdapter = (options) => {
     identifier: "stripe",
     parseWebhook: async ({ headers, payload }) => {
       const signatureHeader = headers.get("stripe-signature") ?? "";
-      await verifyStripeSignature({ payload, secret: webhookSecret, signatureHeader, toleranceSeconds: options.webhookToleranceSeconds });
-      const event = asRecord(JSON.parse(payload));
+      let event;
+      try {
+        event = await client.webhooks.constructEventAsync(payload, signatureHeader, webhookSecret, options.webhookToleranceSeconds);
+      } catch (error) {
+        throw new LunoraPaymentError("WEBHOOK_SIGNATURE_INVALID", error instanceof Error ? error.message : "invalid webhook signature");
+      }
       const object = asRecord(asRecord(event.data).object);
-      return mapEvent(readString(event, "id") ?? "", readString(event, "type") ?? "", object);
+      return mapEvent(event.id, event.type, object);
     },
     refundPayment: async (input) => {
       await client.refunds.create(
@@ -243,7 +246,7 @@ const createStripeAdapter = (options) => {
         {
           event_name: input.featureId,
           identifier: input.idempotencyKey,
-          payload: { stripe_customer_id: input.customerId, value: String(input.quantity) },
+          payload: { stripe_customer_id: input.customerId ?? "", value: String(input.quantity) },
           timestamp: input.timestamp === void 0 ? void 0 : Math.floor(input.timestamp / 1e3)
         },
         { idempotencyKey: input.idempotencyKey }
@@ -255,11 +258,9 @@ const createStripeAdapter = (options) => {
     },
     updateSubscription: async (subscriptionId, patch) => {
       const parameters = {};
-      if (patch.quantity !== void 0) {
-        parameters.quantity = patch.quantity;
-      }
-      if (patch.priceId) {
-        parameters.items = [{ price: patch.priceId }];
+      if (patch.priceId !== void 0 || patch.quantity !== void 0) {
+        const current = await client.subscriptions.retrieve(subscriptionId);
+        parameters.items = [{ id: current.items.data[0]?.id, price: patch.priceId, quantity: patch.quantity }];
       }
       const subscription = await client.subscriptions.update(subscriptionId, parameters);
       return subscriptionFromStripe(subscription);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/payment",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.21",
   "description": "Provider-agnostic payments for Lunora: Stripe-first adapter, webhook sync, and subscription/payment state machine",
   "keywords": [
     "billing",
@@ -26,7 +26,7 @@
     "directory": "packages/payment"
   },
   "files": [
-    "dist",
+    "./dist",
     "__assets__",
     "README.md",
     "LICENSE.md"
@@ -41,20 +41,61 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.mjs"
     },
+    "./stripe": {
+      "types": "./dist/providers/stripe.d.ts",
+      "import": "./dist/providers/stripe.mjs"
+    },
+    "./polar": {
+      "types": "./dist/providers/polar.d.ts",
+      "import": "./dist/providers/polar.mjs"
+    },
+    "./autumn": {
+      "types": "./dist/providers/autumn.d.ts",
+      "import": "./dist/providers/autumn.mjs"
+    },
+    "./autumn-features": {
+      "types": "./dist/providers/autumn-features.d.ts",
+      "import": "./dist/providers/autumn-features.mjs"
+    },
+    "./dodopayments": {
+      "types": "./dist/providers/dodopayments.d.ts",
+      "import": "./dist/providers/dodopayments.mjs"
+    },
+    "./creem": {
+      "types": "./dist/providers/creem.d.ts",
+      "import": "./dist/providers/creem.mjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@lunora/server": "1.0.0-alpha.2",
-    "@lunora/values": "1.0.0-alpha.1",
+    "@lunora/errors": "1.0.0-alpha.3",
+    "@lunora/server": "1.0.0-alpha.21",
+    "@lunora/values": "1.0.0-alpha.6",
     "dinero.js": "2.0.2"
   },
   "peerDependencies": {
-    "stripe": "^19.0.0"
+    "@polar-sh/sdk": "^0.48.0",
+    "autumn-js": "^1.2.0",
+    "creem": "^1.5.0",
+    "dodopayments": "^2.41.0",
+    "stripe": "^22.0.0"
   },
   "peerDependenciesMeta": {
+    "@polar-sh/sdk": {
+      "optional": true
+    },
+    "autumn-js": {
+      "optional": true
+    },
+    "creem": {
+      "optional": true
+    },
+    "dodopayments": {
+      "optional": true
+    },
     "stripe": {
       "optional": true
     }

package/dist/packem_shared/json-Db337f36.mjs

@@ -1,6 +0,0 @@
-const asRecord = (value) => typeof value === "object" && value !== null ? value : {};
-const readString = (object, key) => typeof object[key] === "string" ? object[key] : void 0;
-const readNumber = (object, key) => typeof object[key] === "number" ? object[key] : void 0;
-const readBoolean = (object, key) => typeof object[key] === "boolean" ? object[key] : void 0;
-
-export { asRecord as a, readBoolean as b, readNumber as c, readString as r };