@myzonerocks/pact 0.1.4 → 0.1.7

package/dist/src/message.js

@@ -20,9 +20,11 @@ export function intentHash(i) {
 // The bridge that moves value unchanged when the payer and recipient already
 // share a currency. Its identifier is a stable wire value carried in a quote.
 export const BRIDGE_PASSTHROUGH = "passthrough";
-export function quotePreimage(q) {
-    return new CanonicalWriter()
-        .str(domain("quote"))
+// writeQuoteFields appends a quote's fields to a writer in the one canonical order
+// shared by the signing preimage and the wire codec. The two callers differ only in
+// what frames the fields: the preimage prepends a domain tag, the wire form does not.
+export function writeQuoteFields(w, q) {
+    return w
         .str(q.id)
         .str(q.intentId)
         .str(q.payInAdapterId)
@@ -36,8 +38,11 @@ export function quotePreimage(q) {
         .str(q.fxRate)
         .u64(q.expiresAt)
         .str(q.providerQuoteRef)
-        .u64(q.latencyEstimateMs)
-        .preimage();
+        .u64(q.latencyEstimateMs);
+}
+export function quotePreimage(q) {
+    const w = new CanonicalWriter().str(domain("quote"));
+    return writeQuoteFields(w, q).preimage();
 }
 export function quoteHash(q) {
     return hashPreimage(quotePreimage(q));

package/dist/src/state.js

@@ -51,7 +51,9 @@ const transitions = {
     [State.Held]: new Set([State.Disbursing, State.Refunding, State.Expired]),
     [State.Disbursing]: new Set([State.Settled, State.Failed, State.Refunding]),
     [State.Refunding]: new Set([State.Refunded, State.Failed]),
-    [State.Settled]: new Set([State.Refunded]),
+    // A settled intent refunds through the same refunding step a bridged unwind uses,
+    // so the refund is claimed before any money moves and cannot fire twice.
+    [State.Settled]: new Set([State.Refunding, State.Refunded]),
     [State.Failed]: new Set(),
     [State.Expired]: new Set(),
     [State.Refunded]: new Set(),

package/dist/src/wire.js

@@ -1,6 +1,7 @@
 import { Money } from "./money.js";
 import { stateName } from "./state.js";
 import { CanonicalWriter } from "./canonical.js";
+import { writeQuoteFields } from "./message.js";
 // The wire codec serializes messages for transport. It is distinct from the
 // canonical signing preimage: signing binds a fixed subset of fields under a
 // domain tag, while the wire form carries every field so a peer can reconstruct
@@ -27,22 +28,7 @@ export function encodeIntent(i) {
         .preimage();
 }
 export function encodeQuote(q) {
-    return new CanonicalWriter()
-        .str(q.id)
-        .str(q.intentId)
-        .str(q.payInAdapterId)
-        .str(q.payInRail)
-        .str(q.payOutAdapterId)
-        .str(q.payOutRail)
-        .str(q.bridgeId)
-        .money(q.srcAmount)
-        .money(q.dstAmount)
-        .money(q.fees)
-        .str(q.fxRate)
-        .u64(q.expiresAt)
-        .str(q.providerQuoteRef)
-        .u64(q.latencyEstimateMs)
-        .preimage();
+    return writeQuoteFields(new CanonicalWriter(), q).preimage();
 }
 export function encodeAuthorization(a) {
     return new CanonicalWriter()

package/dist/test/initiate-guard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/initiate-guard.test.js

@@ -0,0 +1,38 @@
+import { describe, it, expect } from "vitest";
+import { Client } from "../src/client.js";
+import { Money } from "../src/money.js";
+import { State } from "../src/state.js";
+import { FakeLeg } from "./fake.js";
+import { Ed25519Signer, Ed25519Verifier } from "../src/signing.js";
+import { fromHex } from "../src/crypto.js";
+// Initiate may only collect from an authorized intent. This guards against a
+// replayed or out-of-order call charging the payer a second time, matching the
+// same guard in the Go, Dart, Swift, and Kotlin SDKs.
+describe("initiate state guard", () => {
+    it("refuses to initiate from any state but authorized", async () => {
+        const now = 1_700_000_000_000;
+        const seed = fromHex("00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff");
+        const signer = Ed25519Signer.fromSeed("alice", seed);
+        const verifier = new Ed25519Verifier(new Map([["alice", signer.publicKey]]));
+        let n = 0;
+        const ids = () => `id-${String(++n).padStart(3, "0")}`;
+        const wallet = new FakeLeg("wallet", "wallet", "USD", ids);
+        const client = new Client({ payIn: [wallet], payOut: [wallet], verifier, clock: () => now, idGen: ids });
+        const intent = client.createIntent({
+            senderRef: "alice",
+            recipientRef: "bob",
+            amount: Money.parse("USD", 2, "1500"),
+            expiresAt: now + 600_000,
+            allowedRails: ["wallet"],
+        });
+        const quotes = await client.quoteOptions(intent, [{ payInAdapterId: "wallet", currency: "USD", exponent: 2 }]);
+        const quote = await client.select(quotes, signer.identity());
+        // Before authorizing, the intent is only quoted, so initiate is refused.
+        await expect(client.initiate(intent, quote, { intentId: intent.id })).rejects.toThrow();
+        const auth = await client.authorize(intent, quote, signer);
+        await client.initiate(intent, quote, auth);
+        await client.advance(intent.id, "wallet", { intentId: intent.id, state: State.Settled, providerTxRef: "", onchainTxHash: "", reason: "", settledAt: 0 });
+        // Once settled, a replayed initiate must not collect again.
+        await expect(client.initiate(intent, quote, auth)).rejects.toThrow();
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myzonerocks/pact",
-  "version": "0.1.4",
+  "version": "0.1.7",
   "description": "TypeScript SDK for the PACT payment abstraction protocol",
   "license": "Apache-2.0",
   "repository": {

package/src/adapters/erc20.ts

@@ -74,6 +74,37 @@ export interface Erc20Config {
   // The confirmation depth a transfer must reach before it settles. Omitted uses
   // defaultMinConfirmations.
   minConfirmations?: number;
+  // Store persists broadcast transfers; defaults to an in-memory store. A deployment
+  // that must survive a restart with transfers in flight supplies a durable one.
+  store?: SentStore;
+}
+
+// SentRecord is the broadcast transfer a later settlement reads back: the intent, the
+// transaction hash, and the recipient and amount the on-chain receipt must match.
+export interface SentRecord {
+  intentId: string;
+  txHash: string;
+  to: string;
+  amount: bigint;
+}
+
+// SentStore records a broadcast transfer so its settlement can be polled after a
+// restart and a repeat for the same intent returns the first transfer. The default
+// keeps records in memory; a durable one survives a restart.
+export interface SentStore {
+  save(rec: SentRecord): Promise<void>;
+  byIntent(intentId: string): Promise<SentRecord | undefined>;
+}
+
+// MemorySentStore is the default in-process store.
+export class MemorySentStore implements SentStore {
+  private readonly byIntentMap = new Map<string, SentRecord>();
+  async save(rec: SentRecord): Promise<void> {
+    this.byIntentMap.set(rec.intentId, rec);
+  }
+  async byIntent(intentId: string): Promise<SentRecord | undefined> {
+    return this.byIntentMap.get(intentId);
+  }
 }
 
 // Erc20Leg settles a payment as an ERC-20 token transfer. Refunds are a
@@ -87,9 +118,9 @@ export class Erc20Leg implements PayInLeg, PayOutLeg {
   private readonly ids: () => string;
   private readonly decimals: number;
   private readonly minConf: number;
-  // Each broadcast transfer and what it was meant to move, so a settlement can
-  // confirm the mined transaction really matches the payment.
-  private readonly sent = new Map<string, { txHash: string; to: string; amount: bigint }>();
+  // Broadcast transfers, so a settlement can confirm the mined transaction really
+  // matches the payment, and a repeat returns the first transfer.
+  private readonly store: SentStore;
 
   constructor(cfg: Erc20Config) {
     if (!cfg.token || !cfg.currency) {
@@ -108,6 +139,7 @@ export class Erc20Leg implements PayInLeg, PayOutLeg {
     this.ids = cfg.ids;
     this.decimals = cfg.decimals;
     this.minConf = cfg.minConfirmations ?? defaultMinConfirmations;
+    this.store = cfg.store ?? new MemorySentStore();
   }
 
   // checkScale refuses an amount whose exponent does not match the token's
@@ -138,12 +170,12 @@ export class Erc20Leg implements PayInLeg, PayOutLeg {
     const net = quote.srcAmount.sub(quote.fees);
     // A repeat for the same intent returns the transfer already broadcast rather
     // than sending the payer's tokens twice.
-    const prev = this.sent.get(intentId);
+    const prev = await this.store.byIntent(intentId);
     if (prev) {
       return { providerRef: prev.txHash, received: net };
     }
     const txHash = await this.transfer(deliverTo, net.value());
-    this.sent.set(intentId, { txHash, to: normalizeAddress(deliverTo), amount: net.value() });
+    await this.store.save({ intentId, txHash, to: normalizeAddress(deliverTo), amount: net.value() });
     return { providerRef: txHash, received: net };
   }
 
@@ -152,13 +184,13 @@ export class Erc20Leg implements PayInLeg, PayOutLeg {
     this.checkScale(quote.dstAmount);
     // A repeat for the same intent returns the transfer already broadcast rather
     // than delivering the recipient's tokens twice.
-    const prev = this.sent.get(intentId);
+    const prev = await this.store.byIntent(intentId);
     if (prev) {
       return { providerRef: prev.txHash };
     }
     const amount = quote.dstAmount.value();
     const txHash = await this.transfer(recipientRef, amount);
-    this.sent.set(intentId, { txHash, to: normalizeAddress(recipientRef), amount });
+    await this.store.save({ intentId, txHash, to: normalizeAddress(recipientRef), amount });
     return { providerRef: txHash };
   }
 
@@ -184,7 +216,7 @@ export class Erc20Leg implements PayInLeg, PayOutLeg {
   // shallow success stays submitted so the host keeps polling; a revert or a
   // mismatch fails, so a dropped, reorged, or spoofed transfer never settles.
   async settlementEvent(intentId: string): Promise<AdapterEvent> {
-    const rec = this.sent.get(intentId);
+    const rec = await this.store.byIntent(intentId);
     if (!rec) {
       throw new Error("erc20: no broadcast transaction for intent");
     }

package/src/adapters/mpesa.ts

@@ -53,6 +53,10 @@ export interface B2CParams {
   phone: string;
   reference: string;
   remarks: string;
+  // Same across retries of one logical transfer and distinct between different
+  // transfers on the same intent (a payout versus a refund), so Daraja collapses a
+  // retry but never merges two separate movements.
+  idempotencyKey: string;
 }
 
 // B2CResult is what Daraja returns when a payout is accepted for delivery.
@@ -82,14 +86,40 @@ export interface DarajaApi {
   query(checkoutRequestId: string): Promise<StkQueryResult>;
 }
 
-// push remembers what settling an STK collection needs between initiating it and
-// the unsigned callback that reports its outcome: the intent, the payer to
-// refund, the amount, and the last state the callback recorded.
-interface PushRecord {
+// PushRecord is what settling or refunding an M-Pesa collection needs after the STK
+// push: the intent, the checkout id the unsigned callback arrives under, the payer to
+// refund, and the amount authorized.
+export interface PushRecord {
   intentId: string;
+  checkoutId: string;
   payerPhone: string;
   amount: number;
-  state: State;
+}
+
+// PushStore holds push records between initiating a collection and the callback that
+// resolves it. The default store keeps them in memory; a deployment that runs more than
+// one instance, or must survive a restart with collections in flight, supplies a
+// durable one so a callback never arrives to find its checkout forgotten.
+export interface PushStore {
+  save(rec: PushRecord): Promise<void>;
+  byIntent(intentId: string): Promise<PushRecord | undefined>;
+  byCheckout(checkoutId: string): Promise<PushRecord | undefined>;
+}
+
+// MemoryPushStore is the default in-process store.
+export class MemoryPushStore implements PushStore {
+  private readonly byIntentMap = new Map<string, PushRecord>();
+  private readonly byCheckoutMap = new Map<string, PushRecord>();
+  async save(rec: PushRecord): Promise<void> {
+    this.byIntentMap.set(rec.intentId, rec);
+    if (rec.checkoutId) this.byCheckoutMap.set(rec.checkoutId, rec);
+  }
+  async byIntent(intentId: string): Promise<PushRecord | undefined> {
+    return this.byIntentMap.get(intentId);
+  }
+  async byCheckout(checkoutId: string): Promise<PushRecord | undefined> {
+    return this.byCheckoutMap.get(checkoutId);
+  }
 }
 
 export interface MpesaConfig {
@@ -97,6 +127,9 @@ export interface MpesaConfig {
   api: DarajaApi;
   callbackURL: string;
   ids: () => string;
+  // Store persists push records; defaults to an in-memory store. A deployment that
+  // scales beyond one instance or must survive a restart supplies a durable one.
+  store?: PushStore;
 }
 
 // MpesaLeg moves mobile money over M-Pesa.
@@ -106,8 +139,7 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
   private readonly callbackURL: string;
   private readonly ids: () => string;
 
-  private readonly byIntent = new Map<string, PushRecord>();
-  private readonly byCheckout = new Map<string, PushRecord>();
+  private readonly store: PushStore;
 
   constructor(cfg: MpesaConfig) {
     if (!cfg.callbackURL) {
@@ -117,6 +149,7 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
     this.api = cfg.api;
     this.callbackURL = cfg.callbackURL;
     this.ids = cfg.ids;
+    this.store = cfg.store ?? new MemoryPushStore();
   }
 
   payInCapabilities(): PayInCapabilities {
@@ -140,7 +173,6 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
     if (!phone) {
       throw new Error("mpesa: collect requires the payer's phone");
     }
-    const rec: PushRecord = { intentId, payerPhone: phone, amount, state: State.Unspecified };
     const result = await this.api.stkPush({
       amount,
       payerPhone: phone,
@@ -148,8 +180,7 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
       description: "payment",
       callbackURL: this.callbackURL,
     });
-    this.byIntent.set(intentId, rec);
-    this.byCheckout.set(result.checkoutRequestId, rec);
+    await this.store.save({ intentId, checkoutId: result.checkoutRequestId, payerPhone: phone, amount });
     return { providerRef: result.checkoutRequestId, received: net };
   }
 
@@ -161,7 +192,7 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
     if (!phone) {
       throw new Error("mpesa: disburse requires the recipient's phone");
     }
-    const result = await this.api.b2cPayment({ amount, phone, reference: intentId, remarks: "payout" });
+    const result = await this.api.b2cPayment({ amount, phone, reference: intentId, remarks: "payout", idempotencyKey: `pact:payout:${intentId}` });
     return { providerRef: result.conversationId };
   }
 
@@ -173,7 +204,7 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
       throw new Error("mpesa: a collection can only be refunded by counter-transfer");
     }
     const shillings = wholeShillings(amount);
-    const rec = this.byIntent.get(intentId);
+    const rec = await this.store.byIntent(intentId);
     if (!rec) {
       throw new Error(`mpesa: no push for intent ${intentId}`);
     }
@@ -186,6 +217,7 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
       phone: rec.payerPhone,
       reference: intentId,
       remarks: reason,
+      idempotencyKey: `pact:refund:${intentId}`,
     });
     return {
       intentId,
@@ -215,7 +247,7 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
   async parseWebhook(raw: Uint8Array, _headers: Record<string, string[]>): Promise<AdapterEvent[]> {
     const envelope = JSON.parse(new TextDecoder().decode(raw)) as StkCallbackEnvelope;
     const cb = envelope.Body?.stkCallback;
-    const rec = cb ? this.byCheckout.get(cb.CheckoutRequestID) : undefined;
+    const rec = cb ? await this.store.byCheckout(cb.CheckoutRequestID) : undefined;
     if (!cb || !rec) {
       throw new Error(ErrUnknownCheckout);
     }
@@ -227,7 +259,6 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
       return [];
     }
     if (confirmed.resultCode !== 0) {
-      rec.state = State.Failed;
       return [
         {
           intentId: rec.intentId,
@@ -247,7 +278,6 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
     }
 
     const receipt = metadataString(cb.CallbackMetadata?.Item ?? [], "MpesaReceiptNumber");
-    rec.state = State.Settled;
     return [
       {
         intentId: rec.intentId,
@@ -447,6 +477,7 @@ class HttpDarajaApi implements DarajaApi {
   async b2cPayment(params: B2CParams): Promise<B2CResult> {
     const token = await this.token();
     const body = {
+      OriginatorConversationID: params.idempotencyKey,
       InitiatorName: this.creds.shortCode,
       CommandID: "BusinessPayment",
       Amount: params.amount,

package/src/adapters/paypal.ts

@@ -113,6 +113,37 @@ export interface PaypalConfig {
   currencies: string[];
   api: PaypalApi;
   ids: () => string;
+  // Store persists capture records; defaults to an in-memory store. A deployment that
+  // scales beyond one instance or must survive a restart supplies a durable one.
+  store?: CaptureStore;
+}
+
+// CaptureRecord is what settling or refunding a PayPal collection needs: the intent,
+// the capture id a refund binds to (empty until a server-side capture returns one),
+// and the amount the intent was quoted to collect.
+export interface CaptureRecord {
+  intentId: string;
+  captureId: string;
+  expected: { value: string; currency: string };
+}
+
+// CaptureStore holds capture records between creating an order and the webhook that
+// resolves it. The default keeps them in memory; a durable one lets a capture webhook
+// resolve across a restart or on a second instance.
+export interface CaptureStore {
+  save(rec: CaptureRecord): Promise<void>;
+  byIntent(intentId: string): Promise<CaptureRecord | undefined>;
+}
+
+// MemoryCaptureStore is the default in-process store.
+export class MemoryCaptureStore implements CaptureStore {
+  private readonly byIntentMap = new Map<string, CaptureRecord>();
+  async save(rec: CaptureRecord): Promise<void> {
+    this.byIntentMap.set(rec.intentId, rec);
+  }
+  async byIntent(intentId: string): Promise<CaptureRecord | undefined> {
+    return this.byIntentMap.get(intentId);
+  }
 }
 
 // PaypalLeg moves money over PayPal, serving both sides of a corridor.
@@ -121,16 +152,14 @@ export class PaypalLeg implements InteractivePayInLeg, PayOutLeg {
   private readonly currencies: string[];
   private readonly api: PaypalApi;
   private readonly ids: () => string;
-  private readonly captures = new Map<string, string>();
-  // What each intent was quoted to collect, so a capture webhook can be
-  // cross-checked: the paid amount and currency must match before it settles.
-  private readonly expected = new Map<string, { value: string; currency: string }>();
+  private readonly store: CaptureStore;
 
   constructor(cfg: PaypalConfig) {
     this.id = cfg.id ?? "paypal";
     this.currencies = cfg.currencies;
     this.api = cfg.api;
     this.ids = cfg.ids;
+    this.store = cfg.store ?? new MemoryCaptureStore();
   }
 
   payInCapabilities(): PayInCapabilities {
@@ -156,10 +185,10 @@ export class PaypalLeg implements InteractivePayInLeg, PayOutLeg {
       payee: deliverTo,
       referenceId: referencePrefix + intentId,
     });
-    this.captures.set(intentId, capture.captureId);
-    this.expected.set(intentId, {
-      value: majorAmount(quote.srcAmount.minor(), quote.srcAmount.exponent),
-      currency: quote.srcAmount.currency,
+    await this.store.save({
+      intentId,
+      captureId: capture.captureId,
+      expected: { value: majorAmount(quote.srcAmount.minor(), quote.srcAmount.exponent), currency: quote.srcAmount.currency },
     });
     return { providerRef: capture.captureId, received: quote.srcAmount.sub(quote.fees) };
   }
@@ -181,9 +210,10 @@ export class PaypalLeg implements InteractivePayInLeg, PayOutLeg {
       params.platformFee = majorAmount(quote.fees.minor(), quote.fees.exponent);
     }
     const order = await this.api.createOrder(params);
-    this.expected.set(intentId, {
-      value: majorAmount(quote.srcAmount.minor(), quote.srcAmount.exponent),
-      currency: quote.srcAmount.currency,
+    await this.store.save({
+      intentId,
+      captureId: "",
+      expected: { value: majorAmount(quote.srcAmount.minor(), quote.srcAmount.exponent), currency: quote.srcAmount.currency },
     });
     return { providerRef: order.id, clientSecret: order.id, method: "paypal" };
   }
@@ -207,10 +237,11 @@ export class PaypalLeg implements InteractivePayInLeg, PayOutLeg {
     if (kind !== RefundKind.Full && kind !== RefundKind.Partial) {
       throw new Error(`paypal: cannot perform refund kind ${kind}`);
     }
-    const captureId = this.captures.get(intentId);
-    if (!captureId) {
+    const rec = await this.store.byIntent(intentId);
+    if (!rec || !rec.captureId) {
       throw new Error(`paypal: no capture for intent ${intentId}`);
     }
+    const captureId = rec.captureId;
     // A partial refund names the amount in major units; a full refund leaves it
     // absent so PayPal returns the whole capture.
     const params: RefundParams =
@@ -255,10 +286,11 @@ export class PaypalLeg implements InteractivePayInLeg, PayOutLeg {
         // created the order, so a genuine, signed capture for a different order can
         // carry a target intent's id. Settle only when the captured amount and
         // currency match what the intent was quoted to collect.
-        const want = this.expected.get(intentId);
-        if (!want) {
+        const rec = await this.store.byIntent(intentId);
+        if (!rec) {
           throw new Error(`paypal: capture for unknown intent ${JSON.stringify(intentId)}`);
         }
+        const want = rec.expected;
         if (resource.amount?.value !== want.value || resource.amount?.currency_code !== want.currency) {
           throw new Error(
             `paypal: captured ${resource.amount?.value} ${resource.amount?.currency_code} does not match the quoted ${want.value} ${want.currency}`,

package/src/adapters/stripe.ts

@@ -353,8 +353,15 @@ function parseEvent(
   const event = JSON.parse(new TextDecoder().decode(payload)) as StripeEvent;
 
   switch (event.type) {
-    case "payment_intent.succeeded":
-      return oneEvent(decodePaymentIntent(event.data.object), State.Settled, "");
+    case "payment_intent.succeeded": {
+      // The webhook is signed by Stripe, so its amounts are authentic. A capture for
+      // less than the authorized amount must not settle the corridor as fully paid.
+      const pi = decodePaymentIntent(event.data.object);
+      if (pi.amountReceived < pi.amount) {
+        return oneEvent(pi, State.Failed, "captured amount is less than the authorized amount");
+      }
+      return oneEvent(pi, State.Settled, "");
+    }
     case "payment_intent.payment_failed":
       return oneEvent(decodePaymentIntent(event.data.object), State.Failed, "payment failed");
     case "charge.refunded":
@@ -368,18 +375,26 @@ interface WebhookIntent {
   id: string;
   metadata: Record<string, string>;
   created: number;
+  amount: number;
+  amountReceived: number;
 }
 
 function decodePaymentIntent(raw: unknown): WebhookIntent {
-  const obj = raw as { id?: string; metadata?: Record<string, string>; created?: number };
-  return { id: obj.id ?? "", metadata: obj.metadata ?? {}, created: obj.created ?? 0 };
+  const obj = raw as { id?: string; metadata?: Record<string, string>; created?: number; amount?: number; amount_received?: number };
+  return {
+    id: obj.id ?? "",
+    metadata: obj.metadata ?? {},
+    created: obj.created ?? 0,
+    amount: obj.amount ?? 0,
+    amountReceived: obj.amount_received ?? 0,
+  };
 }
 
 // decodeRefundedIntent reads the pact intent id off a refunded charge. A charge
 // carries the originating PaymentIntent id and copies its metadata.
 function decodeRefundedIntent(raw: unknown): WebhookIntent {
   const charge = raw as { payment_intent?: string; metadata?: Record<string, string>; created?: number };
-  return { id: charge.payment_intent ?? "", metadata: charge.metadata ?? {}, created: charge.created ?? 0 };
+  return { id: charge.payment_intent ?? "", metadata: charge.metadata ?? {}, created: charge.created ?? 0, amount: 0, amountReceived: 0 };
 }
 
 function oneEvent(pi: WebhookIntent, state: State, reason: string): AdapterEvent[] {
@@ -483,7 +498,7 @@ class HttpStripeApi implements StripeApi {
 
   private async send<T>(path: string, init: RequestInit): Promise<T> {
     const headers: Record<string, string> = {
-      ...((init.headers as Record<string, string>) ?? {}),
+      ...(init.headers as Record<string, string> | undefined),
       Authorization: `Bearer ${this.secretKey}`,
       "Stripe-Version": apiVersion,
     };

package/src/canonical.ts

@@ -61,6 +61,8 @@ export class CanonicalWriter {
   // byte value so the encoding never depends on insertion order. The sort is on
   // encoded bytes, not on UTF-16 code units, to match the other SDKs exactly.
   stringMap(kv: Readonly<Record<string, string>>): this {
+    // Object.keys returns a fresh array, so sorting it in place mutates nothing shared.
+    // oxlint-disable-next-line unicorn/no-array-sort
     const keys = Object.keys(kv).sort(compareUtf8);
     this.u64(keys.length);
     for (const k of keys) {