@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/dist/modules/payment_gateways/lib/gateway-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/payment_gateways/lib/gateway-service.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  getGatewayAdapter,\n  type CreateSessionInput,\n  type CreateSessionResult,\n  type CaptureResult,\n  type RefundResult,\n  type CancelResult,\n  type GatewayAdapter,\n  type GatewayPaymentStatus,\n  type PaymentGatewayPresentationRequest,\n  type UnifiedPaymentStatus,\n} from '@open-mercato/shared/modules/payment_gateways/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { IntegrationLogService } from '../../integrations/lib/log-service'\nimport { conflict } from '@open-mercato/shared/lib/crud/errors'\nimport { GatewaySessionInitialization, GatewayTransaction } from '../data/entities'\nimport { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'\nimport { emitPaymentGatewayEvent } from '../events'\nimport { readGatewayMetadata, readWebhookLog } from './transaction-fields'\nimport {\n  completePaymentOperation,\n  failPaymentOperation,\n  preparePaymentOperation,\n} from './payment-operation-idempotency'\nimport {\n  buildPaymentSessionOperationKey,\n  claimPaymentSessionInitialization,\n  findPaymentSessionInitialization,\n  reclaimPaymentSessionInitialization,\n  refreshPaymentSessionInitialization,\n  releasePaymentSessionInitialization,\n} from './session-idempotency'\n\nconst PAYMENT_SESSION_CLAIM_STALE_MS = 30_000\nconst PAYMENT_SESSION_WAIT_INTERVAL_MS = 25\n\nfunction assertManualActionAllowed(action: ManualGatewayAction, transaction: GatewayTransaction): void {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (!canApplyManualAction(action, current)) {\n    throw conflict(`Cannot ${action} a payment in status \"${current}\"`)\n  }\n}\n\nfunction assertCaptureAmountAllowed(amount: number | undefined, transaction: GatewayTransaction): void {\n  if (amount !== undefined && amount > Number(transaction.amount)) {\n    throw conflict(`Capture amount ${amount} exceeds authorized transaction amount ${transaction.amount}`)\n  }\n}\n\nfunction applyAdapterResultStatus(\n  action: ManualGatewayAction,\n  transaction: GatewayTransaction,\n  resultStatus: UnifiedPaymentStatus,\n): boolean {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (resultStatus === current) return false\n  if (isValidTransition(resultStatus, current)) return false\n  if (!isValidTransition(current, resultStatus)) {\n    throw conflict(\n      `Gateway returned status \"${resultStatus}\" which is not a valid transition from \"${current}\" for ${action}`,\n    )\n  }\n  transaction.unifiedStatus = resultStatus\n  return true\n}\n\nexport interface PaymentGatewayServiceDeps {\n  em: EntityManager\n  integrationCredentialsService: CredentialsService\n  integrationStateService?: IntegrationStateService\n  integrationLogService?: IntegrationLogService\n  sessionClaimOptions?: {\n    staleAfterMs?: number\n    heartbeatIntervalMs?: number\n    pollIntervalMs?: number\n  }\n}\n\nexport interface CreatePaymentSessionInput {\n  providerKey: string\n  paymentId: string\n  idempotencyKey?: string\n  orderId?: string\n  amount: number\n  currencyCode: string\n  captureMethod?: 'automatic' | 'manual'\n  paymentTypes?: string[]\n  description?: string\n  successUrl?: string\n  cancelUrl?: string\n  metadata?: Record<string, unknown>\n  presentation?: PaymentGatewayPresentationRequest\n  organizationId: string\n  tenantId: string\n}\n\nexport function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {\n  const { em, integrationCredentialsService, integrationLogService } = deps\n  const claimStaleAfterMs = Math.max(1, deps.sessionClaimOptions?.staleAfterMs ?? PAYMENT_SESSION_CLAIM_STALE_MS)\n  const claimHeartbeatIntervalMs = Math.max(\n    1,\n    deps.sessionClaimOptions?.heartbeatIntervalMs ?? Math.floor(claimStaleAfterMs / 3),\n  )\n  const claimPollIntervalMs = Math.max(1, deps.sessionClaimOptions?.pollIntervalMs ?? PAYMENT_SESSION_WAIT_INTERVAL_MS)\n\n  async function findTransactionOrThrow(\n    transactionId: string,\n    scope: { organizationId: string; tenantId: string },\n    targetEm: EntityManager = em,\n  ): Promise<GatewayTransaction> {\n    const transaction = await findOneWithDecryption(\n      targetEm,\n      GatewayTransaction,\n      {\n        id: transactionId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n    if (!transaction) {\n      throw new Error('Transaction not found')\n    }\n    return transaction\n  }\n\n  function readProviderSessionId(transaction: GatewayTransaction): string {\n    if (typeof transaction.providerSessionId === 'string' && transaction.providerSessionId.trim().length > 0) {\n      return transaction.providerSessionId\n    }\n    throw new Error('Transaction is missing provider session id')\n  }\n\n  async function emitStatusEvent(status: UnifiedPaymentStatus, payload: Record<string, unknown>) {\n    type PaymentGatewayEventId = Parameters<typeof emitPaymentGatewayEvent>[0]\n    const eventMap: Partial<Record<UnifiedPaymentStatus, PaymentGatewayEventId>> = {\n      authorized: 'payment_gateways.payment.authorized',\n      captured: 'payment_gateways.payment.captured',\n      failed: 'payment_gateways.payment.failed',\n      refunded: 'payment_gateways.payment.refunded',\n      cancelled: 'payment_gateways.payment.cancelled',\n    }\n    const eventId = eventMap[status]\n    if (!eventId) return\n    await emitPaymentGatewayEvent(eventId, payload)\n  }\n\n  async function writeTransactionLog(\n    providerKey: string,\n    scope: { organizationId: string; tenantId: string },\n    transactionId: string,\n    level: 'info' | 'warn' | 'error',\n    message: string,\n    payload?: Record<string, unknown> | null,\n    code?: string | null,\n  ) {\n    if (!integrationLogService) return\n    await integrationLogService.write({\n      integrationId: `gateway_${providerKey}`,\n      scopeEntityType: 'payment_transaction',\n      scopeEntityId: transactionId,\n      level,\n      message,\n      code,\n      payload: payload ?? null,\n    }, scope)\n  }\n\n  async function resolveAdapterAndCredentials(providerKey: string, scope: { organizationId: string; tenantId: string }) {\n    const integrationId = `gateway_${providerKey}`\n    const selectedVersion = deps.integrationStateService\n      ? await deps.integrationStateService.resolveApiVersion(integrationId, scope)\n      : undefined\n    const adapter = getGatewayAdapter(providerKey, selectedVersion)\n    if (!adapter) {\n      throw new Error(\n        selectedVersion\n          ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})`\n          : `No gateway adapter registered for provider: ${providerKey}`,\n      )\n    }\n    const credentials = await integrationCredentialsService.resolve(integrationId, scope) ?? {}\n\n    return { adapter, credentials }\n  }\n\n  type ManualOperationResult = CaptureResult | RefundResult | CancelResult\n\n  async function executeManualOperation<TResult extends ManualOperationResult>(input: {\n    action: ManualGatewayAction\n    transactionId: string\n    operationId?: string\n    payload: Record<string, unknown>\n    scope: { organizationId: string; tenantId: string }\n    assertInitialAllowed?: (transaction: GatewayTransaction) => void\n    invoke: (context: {\n      adapter: GatewayAdapter\n      credentials: Record<string, unknown>\n      transaction: GatewayTransaction\n      idempotencyKey: string\n    }) => Promise<TResult>\n    applyResult: (transaction: GatewayTransaction, result: TResult) => void\n    afterCommit: (transaction: GatewayTransaction, result: TResult) => Promise<void>\n  }): Promise<TResult> {\n    const transaction = await findTransactionOrThrow(input.transactionId, input.scope)\n    const prepared = await preparePaymentOperation({\n      em,\n      transactionId: transaction.id,\n      providerKey: transaction.providerKey,\n      action: input.action,\n      operationId: input.operationId,\n      payload: input.payload,\n      scope: input.scope,\n      assertInitialAllowed: () => {\n        assertManualActionAllowed(input.action, transaction)\n        input.assertInitialAllowed?.(transaction)\n      },\n    })\n    if (prepared.kind === 'completed') {\n      if (prepared.result.status !== transaction.unifiedStatus) {\n        throw conflict(\n          `Cannot replay ${input.action} because the payment status has changed since the operation completed`,\n        )\n      }\n      return prepared.result as unknown as TResult\n    }\n\n    try {\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n      const result = await input.invoke({\n        adapter,\n        credentials,\n        transaction,\n        idempotencyKey: prepared.claim.providerIdempotencyKey,\n      })\n      const statusChanged = await completePaymentOperation(\n        em,\n        prepared.claim,\n        result as unknown as Record<string, unknown>,\n        async (tx) => {\n          const current = await findTransactionOrThrow(input.transactionId, input.scope, tx)\n          const changed = applyAdapterResultStatus(input.action, current, result.status)\n          input.applyResult(current, result)\n          return changed\n        },\n      )\n      if (statusChanged) {\n        await emitStatusEvent(result.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await input.afterCommit(transaction, result)\n      return result\n    } catch (error: unknown) {\n      await Promise.allSettled([failPaymentOperation(em, prepared.claim)])\n      throw error\n    }\n  }\n\n  function createGatewayTransaction(\n    manager: EntityManager,\n    input: CreatePaymentSessionInput,\n    session: CreateSessionResult,\n    id?: string,\n  ): GatewayTransaction {\n    const data = {\n      paymentId: input.paymentId,\n      providerKey: input.providerKey,\n      providerSessionId: session.sessionId,\n      unifiedStatus: session.status,\n      redirectUrl: session.redirectUrl\n        ?? (session.clientSession?.type === 'redirect' ? session.clientSession.redirectUrl : null),\n      clientSecret: session.clientSecret ?? null,\n      amount: String(input.amount),\n      currencyCode: input.currencyCode,\n      gatewayMetadata: {\n        ...(session.providerData ?? {}),\n        ...(session.clientSession ? { clientSession: session.clientSession } : {}),\n      },\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      deletedAt: null,\n    }\n    return id\n      ? manager.create(GatewayTransaction, { id, ...data })\n      : manager.create(GatewayTransaction, data)\n  }\n\n  function restoreSession(transaction: GatewayTransaction): CreateSessionResult {\n    const metadata = readGatewayMetadata(transaction.gatewayMetadata)\n    const { clientSession, ...providerData } = metadata\n    return {\n      sessionId: readProviderSessionId(transaction),\n      status: transaction.unifiedStatus as UnifiedPaymentStatus,\n      ...(transaction.clientSecret ? { clientSecret: transaction.clientSecret } : {}),\n      ...(transaction.redirectUrl ? { redirectUrl: transaction.redirectUrl } : {}),\n      ...(Object.keys(providerData).length > 0 ? { providerData } : {}),\n      ...(clientSession && typeof clientSession === 'object'\n        ? { clientSession: clientSession as CreateSessionResult['clientSession'] }\n        : {}),\n    }\n  }\n\n  async function recordCreatedSession(\n    transaction: GatewayTransaction,\n    input: CreatePaymentSessionInput,\n    scope: { organizationId: string; tenantId: string },\n  ): Promise<void> {\n    await emitPaymentGatewayEvent('payment_gateways.session.created', {\n      transactionId: transaction.id,\n      paymentId: transaction.paymentId,\n      providerKey: transaction.providerKey,\n      status: transaction.unifiedStatus,\n      organizationId: transaction.organizationId,\n      tenantId: transaction.tenantId,\n    })\n    await writeTransactionLog(\n      transaction.providerKey,\n      scope,\n      transaction.id,\n      'info',\n      'Payment session created',\n      {\n        paymentId: transaction.paymentId,\n        providerSessionId: transaction.providerSessionId,\n        status: transaction.unifiedStatus,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n      },\n    )\n  }\n\n  function startClaimHeartbeat(\n    ownership: { id: string; claimToken: string },\n    scope: { organizationId: string; tenantId: string },\n  ): () => Promise<void> {\n    let stopped = false\n    let timer: ReturnType<typeof setTimeout> | null = null\n    let pendingRefresh = Promise.resolve()\n\n    const schedule = () => {\n      timer = setTimeout(() => {\n        pendingRefresh = refreshPaymentSessionInitialization(em, ownership, scope, new Date())\n          .then(\n            (refreshed) => {\n              if (refreshed && !stopped) schedule()\n            },\n            () => {\n              if (!stopped) schedule()\n            },\n          )\n      }, claimHeartbeatIntervalMs)\n    }\n    schedule()\n\n    return async () => {\n      stopped = true\n      if (timer) clearTimeout(timer)\n      await pendingRefresh\n    }\n  }\n\n  return {\n    async createPaymentSession(input: CreatePaymentSessionInput): Promise<{ transaction: GatewayTransaction; session: CreateSessionResult }> {\n      const scope = { organizationId: input.organizationId, tenantId: input.tenantId }\n      const { adapter, credentials } = await resolveAdapterAndCredentials(input.providerKey, scope)\n\n      const sessionInput: CreateSessionInput = {\n        paymentId: input.paymentId,\n        orderId: input.orderId,\n        idempotencyKey: input.idempotencyKey,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n        captureMethod: input.captureMethod,\n        paymentTypes: input.paymentTypes,\n        description: input.description,\n        successUrl: input.successUrl,\n        cancelUrl: input.cancelUrl,\n        metadata: input.metadata,\n        presentation: input.presentation,\n        credentials,\n      }\n\n      if (!input.idempotencyKey) {\n        const session = await adapter.createSession(sessionInput)\n        const transaction = createGatewayTransaction(em, input, session)\n        await em.persist(transaction).flush()\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n\n      const operationKey = buildPaymentSessionOperationKey({\n        idempotencyKey: input.idempotencyKey,\n        paymentId: input.paymentId,\n        providerKey: input.providerKey,\n        scope,\n      })\n      while (true) {\n        const existing = await findPaymentSessionInitialization(em, operationKey, input.providerKey, scope)\n        if (existing?.gatewayTransactionId) {\n          const transaction = await findOneWithDecryption(\n            em.fork(),\n            GatewayTransaction,\n            {\n              id: existing.gatewayTransactionId,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n              deletedAt: null,\n            },\n            undefined,\n            scope,\n          )\n          if (!transaction) {\n            throw new Error('Completed payment session is missing its gateway transaction')\n          }\n          return { transaction, session: restoreSession(transaction) }\n        }\n\n        const claimedAt = new Date()\n        const staleBefore = new Date(claimedAt.getTime() - claimStaleAfterMs)\n        const ownership = existing\n          ? await reclaimPaymentSessionInitialization(em, existing, scope, claimedAt, staleBefore)\n          : await claimPaymentSessionInitialization(em, operationKey, input.providerKey, scope, claimedAt)\n\n        if (!ownership) {\n          await new Promise((resolve) => setTimeout(resolve, claimPollIntervalMs))\n          continue\n        }\n\n        let session: CreateSessionResult\n        const stopHeartbeat = startClaimHeartbeat(ownership, scope)\n        try {\n          session = await adapter.createSession({ ...sessionInput, idempotencyKey: operationKey })\n        } catch (error) {\n          await releasePaymentSessionInitialization(em, ownership, scope).catch(() => undefined)\n          throw error\n        } finally {\n          await stopHeartbeat()\n        }\n\n        const transactionId = randomUUID()\n        const transaction = await em.fork().transactional(async (transactionEm) => {\n          const finalizedRows = await transactionEm.nativeUpdate(\n            GatewaySessionInitialization,\n            {\n              id: ownership.id,\n              claimToken: ownership.claimToken,\n              gatewayTransactionId: null,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n            },\n            {\n              gatewayTransactionId: transactionId,\n              claimToken: null,\n              claimedAt: null,\n              updatedAt: new Date(),\n            },\n          )\n          if (finalizedRows === 0) return null\n          const created = createGatewayTransaction(transactionEm, input, session, transactionId)\n          await transactionEm.persist(created).flush()\n          return created\n        })\n\n        if (!transaction) {\n          continue\n        }\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n    },\n\n    async capturePayment(\n      transactionId: string,\n      amount: number | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CaptureResult> {\n      return executeManualOperation({\n        action: 'capture',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null },\n        scope,\n        assertInitialAllowed: (transaction) => assertCaptureAmountAllowed(amount, transaction),\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.capture({\n          sessionId: readProviderSessionId(transaction),\n          amount,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            captureResult: result.providerData,\n          }\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment captured',\n          { amount: amount ?? null, status: result.status, capturedAmount: result.capturedAmount },\n        ),\n      })\n    },\n\n    async refundPayment(\n      transactionId: string,\n      amount: number | undefined,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<RefundResult> {\n      return executeManualOperation({\n        action: 'refund',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null, reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.refund({\n          sessionId: readProviderSessionId(transaction),\n          amount,\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayRefundId = result.refundId\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            refundResult: result.providerData,\n          }\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment refunded',\n          { amount: amount ?? null, reason: reason ?? null, status: result.status, refundId: result.refundId },\n        ),\n      })\n    },\n\n    async cancelPayment(\n      transactionId: string,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CancelResult> {\n      return executeManualOperation({\n        action: 'cancel',\n        transactionId,\n        operationId,\n        payload: { reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.cancel({\n          sessionId: readProviderSessionId(transaction),\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: () => {},\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment cancelled',\n          { reason: reason ?? null, status: result.status },\n        ),\n      })\n    },\n\n    async getPaymentStatus(transactionId: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayPaymentStatus> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n\n      const status = await adapter.getStatus({\n        sessionId: readProviderSessionId(transaction),\n        credentials,\n      })\n\n      if (status.status !== transaction.unifiedStatus && isValidTransition(transaction.unifiedStatus as UnifiedPaymentStatus, status.status)) {\n        const previousStatus = transaction.unifiedStatus\n        transaction.unifiedStatus = status.status\n        transaction.gatewayStatus = status.status\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), statusResult: status.providerData ?? null }\n        transaction.lastPolledAt = new Date()\n        await em.flush()\n        await emitStatusEvent(status.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n        await writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment status updated by poller',\n          {\n            previousStatus,\n            nextStatus: status.status,\n          },\n        )\n      }\n\n      return status\n    },\n\n    async syncTransactionStatus(transactionId: string, update: {\n      unifiedStatus: UnifiedPaymentStatus\n      providerStatus?: string\n      providerData?: Record<string, unknown>\n      webhookEvent?: {\n        eventType: string\n        idempotencyKey: string\n        processed: boolean\n        receivedAt?: string\n      }\n    }, scope: { organizationId: string; tenantId: string }): Promise<void> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const currentStatus = transaction.unifiedStatus as UnifiedPaymentStatus\n      const canTransition = isValidTransition(currentStatus, update.unifiedStatus)\n      const shouldApplyStatus = canTransition && update.unifiedStatus !== currentStatus\n      const previousStatus = transaction.unifiedStatus\n      if (shouldApplyStatus) {\n        transaction.unifiedStatus = update.unifiedStatus\n      }\n      if (update.providerStatus) {\n        transaction.gatewayStatus = update.providerStatus\n      }\n      if (update.providerData) {\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), ...update.providerData }\n      }\n      if (update.webhookEvent) {\n        const webhookLog = readWebhookLog(transaction.webhookLog)\n        webhookLog.push({\n          eventType: update.webhookEvent.eventType,\n          receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),\n          idempotencyKey: update.webhookEvent.idempotencyKey,\n          unifiedStatus: update.unifiedStatus,\n          processed: update.webhookEvent.processed,\n        })\n        transaction.webhookLog = webhookLog\n      }\n      transaction.lastWebhookAt = new Date()\n      await em.flush()\n      if (shouldApplyStatus) {\n        await emitStatusEvent(update.unifiedStatus, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await writeTransactionLog(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n        transaction.id,\n        shouldApplyStatus ? 'info' : 'warn',\n        shouldApplyStatus ? 'Payment status synchronized from webhook' : 'Webhook received with no status transition',\n        {\n          previousStatus,\n          nextStatus: update.unifiedStatus,\n          providerStatus: update.providerStatus ?? null,\n          eventType: update.webhookEvent?.eventType ?? null,\n          idempotencyKey: update.webhookEvent?.idempotencyKey ?? null,\n        },\n      )\n    },\n\n    async findTransaction(id: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          id,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async findTransactionBySessionId(\n      providerSessionId: string,\n      scope: { organizationId: string; tenantId: string },\n      providerKey?: string,\n    ): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          providerSessionId,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n          ...(providerKey ? { providerKey } : {}),\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async listTransactionsForStatusPolling(scope?: {\n      organizationId?: string\n      tenantId?: string\n      providerKey?: string\n      limit?: number\n    }): Promise<GatewayTransaction[]> {\n      const where: Record<string, unknown> = {\n        unifiedStatus: { $in: ['pending', 'authorized', 'partially_captured'] },\n        deletedAt: null,\n      }\n      if (scope?.organizationId) where.organizationId = scope.organizationId\n      if (scope?.tenantId) where.tenantId = scope.tenantId\n      if (scope?.providerKey) where.providerKey = scope.providerKey\n\n      return findWithDecryption(\n        em,\n        GatewayTransaction,\n        where,\n        {\n          orderBy: { updatedAt: 'asc' },\n          limit: scope?.limit ?? 100,\n        },\n        scope,\n      )\n    },\n  }\n}\n\nexport type PaymentGatewayService = ReturnType<typeof createPaymentGatewayService>\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,OAUK;AAIP,SAAS,gBAAgB;AACzB,SAAS,8BAA8B,0BAA0B;AACjE,SAAS,sBAAsB,yBAAmD;AAClF,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,sBAAsB;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AACvC,MAAM,mCAAmC;AAEzC,SAAS,0BAA0B,QAA6B,aAAuC;AACrG,QAAM,UAAU,YAAY;AAC5B,MAAI,CAAC,qBAAqB,QAAQ,OAAO,GAAG;AAC1C,UAAM,SAAS,UAAU,MAAM,yBAAyB,OAAO,GAAG;AAAA,EACpE;AACF;AAEA,SAAS,2BAA2B,QAA4B,aAAuC;AACrG,MAAI,WAAW,UAAa,SAAS,OAAO,YAAY,MAAM,GAAG;AAC/D,UAAM,SAAS,kBAAkB,MAAM,0CAA0C,YAAY,MAAM,EAAE;AAAA,EACvG;AACF;AAEA,SAAS,yBACP,QACA,aACA,cACS;AACT,QAAM,UAAU,YAAY;AAC5B,MAAI,iBAAiB,QAAS,QAAO;AACrC,MAAI,kBAAkB,cAAc,OAAO,EAAG,QAAO;AACrD,MAAI,CAAC,kBAAkB,SAAS,YAAY,GAAG;AAC7C,UAAM;AAAA,MACJ,4BAA4B,YAAY,2CAA2C,OAAO,SAAS,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,cAAY,gBAAgB;AAC5B,SAAO;AACT;AAgCO,SAAS,4BAA4B,MAAiC;AAC3E,QAAM,EAAE,IAAI,+BAA+B,sBAAsB,IAAI;AACrE,QAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,qBAAqB,gBAAgB,8BAA8B;AAC9G,QAAM,2BAA2B,KAAK;AAAA,IACpC;AAAA,IACA,KAAK,qBAAqB,uBAAuB,KAAK,MAAM,oBAAoB,CAAC;AAAA,EACnF;AACA,QAAM,sBAAsB,KAAK,IAAI,GAAG,KAAK,qBAAqB,kBAAkB,gCAAgC;AAEpH,iBAAe,uBACb,eACA,OACA,WAA0B,IACG;AAC7B,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,sBAAsB,aAAyC;AACtE,QAAI,OAAO,YAAY,sBAAsB,YAAY,YAAY,kBAAkB,KAAK,EAAE,SAAS,GAAG;AACxG,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,iBAAe,gBAAgB,QAA8B,SAAkC;AAE7F,UAAM,WAAyE;AAAA,MAC7E,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AACA,UAAM,UAAU,SAAS,MAAM;AAC/B,QAAI,CAAC,QAAS;AACd,UAAM,wBAAwB,SAAS,OAAO;AAAA,EAChD;AAEA,iBAAe,oBACb,aACA,OACA,eACA,OACA,SACA,SACA,MACA;AACA,QAAI,CAAC,sBAAuB;AAC5B,UAAM,sBAAsB,MAAM;AAAA,MAChC,eAAe,WAAW,WAAW;AAAA,MACrC,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,GAAG,KAAK;AAAA,EACV;AAEA,iBAAe,6BAA6B,aAAqB,OAAqD;AACpH,UAAM,gBAAgB,WAAW,WAAW;AAC5C,UAAM,kBAAkB,KAAK,0BACzB,MAAM,KAAK,wBAAwB,kBAAkB,eAAe,KAAK,IACzE;AACJ,UAAM,UAAU,kBAAkB,aAAa,eAAe;AAC9D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,kBACI,+CAA+C,WAAW,cAAc,eAAe,MACvF,+CAA+C,WAAW;AAAA,MAChE;AAAA,IACF;AACA,UAAM,cAAc,MAAM,8BAA8B,QAAQ,eAAe,KAAK,KAAK,CAAC;AAE1F,WAAO,EAAE,SAAS,YAAY;AAAA,EAChC;AAIA,iBAAe,uBAA8D,OAexD;AACnB,UAAM,cAAc,MAAM,uBAAuB,MAAM,eAAe,MAAM,KAAK;AACjF,UAAM,WAAW,MAAM,wBAAwB;AAAA,MAC7C;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B,aAAa,YAAY;AAAA,MACzB,QAAQ,MAAM;AAAA,MACd,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,MACb,sBAAsB,MAAM;AAC1B,kCAA0B,MAAM,QAAQ,WAAW;AACnD,cAAM,uBAAuB,WAAW;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,QAAI,SAAS,SAAS,aAAa;AACjC,UAAI,SAAS,OAAO,WAAW,YAAY,eAAe;AACxD,cAAM;AAAA,UACJ,iBAAiB,MAAM,MAAM;AAAA,QAC/B;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,QAAI;AACF,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AACA,YAAM,SAAS,MAAM,MAAM,OAAO;AAAA,QAChC;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,SAAS,MAAM;AAAA,MACjC,CAAC;AACD,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA,SAAS;AAAA,QACT;AAAA,QACA,OAAO,OAAO;AACZ,gBAAM,UAAU,MAAM,uBAAuB,MAAM,eAAe,MAAM,OAAO,EAAE;AACjF,gBAAM,UAAU,yBAAyB,MAAM,QAAQ,SAAS,OAAO,MAAM;AAC7E,gBAAM,YAAY,SAAS,MAAM;AACjC,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,eAAe;AACjB,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,YAAY,aAAa,MAAM;AAC3C,aAAO;AAAA,IACT,SAAS,OAAgB;AACvB,YAAM,QAAQ,WAAW,CAAC,qBAAqB,IAAI,SAAS,KAAK,CAAC,CAAC;AACnE,YAAM;AAAA,IACR;AAAA,EACF;AAEA,WAAS,yBACP,SACA,OACA,SACA,IACoB;AACpB,UAAM,OAAO;AAAA,MACX,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,mBAAmB,QAAQ;AAAA,MAC3B,eAAe,QAAQ;AAAA,MACvB,aAAa,QAAQ,gBACf,QAAQ,eAAe,SAAS,aAAa,QAAQ,cAAc,cAAc;AAAA,MACvF,cAAc,QAAQ,gBAAgB;AAAA,MACtC,QAAQ,OAAO,MAAM,MAAM;AAAA,MAC3B,cAAc,MAAM;AAAA,MACpB,iBAAiB;AAAA,QACf,GAAI,QAAQ,gBAAgB,CAAC;AAAA,QAC7B,GAAI,QAAQ,gBAAgB,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,MAC1E;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AACA,WAAO,KACH,QAAQ,OAAO,oBAAoB,EAAE,IAAI,GAAG,KAAK,CAAC,IAClD,QAAQ,OAAO,oBAAoB,IAAI;AAAA,EAC7C;AAEA,WAAS,eAAe,aAAsD;AAC5E,UAAM,WAAW,oBAAoB,YAAY,eAAe;AAChE,UAAM,EAAE,eAAe,GAAG,aAAa,IAAI;AAC3C,WAAO;AAAA,MACL,WAAW,sBAAsB,WAAW;AAAA,MAC5C,QAAQ,YAAY;AAAA,MACpB,GAAI,YAAY,eAAe,EAAE,cAAc,YAAY,aAAa,IAAI,CAAC;AAAA,MAC7E,GAAI,YAAY,cAAc,EAAE,aAAa,YAAY,YAAY,IAAI,CAAC;AAAA,MAC1E,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,iBAAiB,OAAO,kBAAkB,WAC1C,EAAE,cAAqE,IACvE,CAAC;AAAA,IACP;AAAA,EACF;AAEA,iBAAe,qBACb,aACA,OACA,OACe;AACf,UAAM,wBAAwB,oCAAoC;AAAA,MAChE,eAAe,YAAY;AAAA,MAC3B,WAAW,YAAY;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,QAAQ,YAAY;AAAA,MACpB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB,CAAC;AACD,UAAM;AAAA,MACJ,YAAY;AAAA,MACZ;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,YAAY;AAAA,QACvB,mBAAmB,YAAY;AAAA,QAC/B,QAAQ,YAAY;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,oBACP,WACA,OACqB;AACrB,QAAI,UAAU;AACd,QAAI,QAA8C;AAClD,QAAI,iBAAiB,QAAQ,QAAQ;AAErC,UAAM,WAAW,MAAM;AACrB,cAAQ,WAAW,MAAM;AACvB,yBAAiB,oCAAoC,IAAI,WAAW,OAAO,oBAAI,KAAK,CAAC,EAClF;AAAA,UACC,CAAC,cAAc;AACb,gBAAI,aAAa,CAAC,QAAS,UAAS;AAAA,UACtC;AAAA,UACA,MAAM;AACJ,gBAAI,CAAC,QAAS,UAAS;AAAA,UACzB;AAAA,QACF;AAAA,MACJ,GAAG,wBAAwB;AAAA,IAC7B;AACA,aAAS;AAET,WAAO,YAAY;AACjB,gBAAU;AACV,UAAI,MAAO,cAAa,KAAK;AAC7B,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,qBAAqB,OAA8G;AACvI,YAAM,QAAQ,EAAE,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAC/E,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM,6BAA6B,MAAM,aAAa,KAAK;AAE5F,YAAM,eAAmC;AAAA,QACvC,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,QACpB,eAAe,MAAM;AAAA,QACrB,cAAc,MAAM;AAAA,QACpB,aAAa,MAAM;AAAA,QACnB,YAAY,MAAM;AAAA,QAClB,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,QAChB,cAAc,MAAM;AAAA,QACpB;AAAA,MACF;AAEA,UAAI,CAAC,MAAM,gBAAgB;AACzB,cAAM,UAAU,MAAM,QAAQ,cAAc,YAAY;AACxD,cAAM,cAAc,yBAAyB,IAAI,OAAO,OAAO;AAC/D,cAAM,GAAG,QAAQ,WAAW,EAAE,MAAM;AACpC,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAEA,YAAM,eAAe,gCAAgC;AAAA,QACnD,gBAAgB,MAAM;AAAA,QACtB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB;AAAA,MACF,CAAC;AACD,aAAO,MAAM;AACX,cAAM,WAAW,MAAM,iCAAiC,IAAI,cAAc,MAAM,aAAa,KAAK;AAClG,YAAI,UAAU,sBAAsB;AAClC,gBAAMA,eAAc,MAAM;AAAA,YACxB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,IAAI,SAAS;AAAA,cACb,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,cAChB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,CAACA,cAAa;AAChB,kBAAM,IAAI,MAAM,8DAA8D;AAAA,UAChF;AACA,iBAAO,EAAE,aAAAA,cAAa,SAAS,eAAeA,YAAW,EAAE;AAAA,QAC7D;AAEA,cAAM,YAAY,oBAAI,KAAK;AAC3B,cAAM,cAAc,IAAI,KAAK,UAAU,QAAQ,IAAI,iBAAiB;AACpE,cAAM,YAAY,WACd,MAAM,oCAAoC,IAAI,UAAU,OAAO,WAAW,WAAW,IACrF,MAAM,kCAAkC,IAAI,cAAc,MAAM,aAAa,OAAO,SAAS;AAEjG,YAAI,CAAC,WAAW;AACd,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,mBAAmB,CAAC;AACvE;AAAA,QACF;AAEA,YAAI;AACJ,cAAM,gBAAgB,oBAAoB,WAAW,KAAK;AAC1D,YAAI;AACF,oBAAU,MAAM,QAAQ,cAAc,EAAE,GAAG,cAAc,gBAAgB,aAAa,CAAC;AAAA,QACzF,SAAS,OAAO;AACd,gBAAM,oCAAoC,IAAI,WAAW,KAAK,EAAE,MAAM,MAAM,MAAS;AACrF,gBAAM;AAAA,QACR,UAAE;AACA,gBAAM,cAAc;AAAA,QACtB;AAEA,cAAM,gBAAgB,WAAW;AACjC,cAAM,cAAc,MAAM,GAAG,KAAK,EAAE,cAAc,OAAO,kBAAkB;AACzE,gBAAM,gBAAgB,MAAM,cAAc;AAAA,YACxC;AAAA,YACA;AAAA,cACE,IAAI,UAAU;AAAA,cACd,YAAY,UAAU;AAAA,cACtB,sBAAsB;AAAA,cACtB,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,YAClB;AAAA,YACA;AAAA,cACE,sBAAsB;AAAA,cACtB,YAAY;AAAA,cACZ,WAAW;AAAA,cACX,WAAW,oBAAI,KAAK;AAAA,YACtB;AAAA,UACF;AACA,cAAI,kBAAkB,EAAG,QAAO;AAChC,gBAAM,UAAU,yBAAyB,eAAe,OAAO,SAAS,aAAa;AACrF,gBAAM,cAAc,QAAQ,OAAO,EAAE,MAAM;AAC3C,iBAAO;AAAA,QACT,CAAC;AAED,YAAI,CAAC,aAAa;AAChB;AAAA,QACF;AACA,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAAA,IACF;AAAA,IAEA,MAAM,eACJ,eACA,QACA,OACA,aACwB;AACxB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,sBAAsB,CAAC,gBAAgB,2BAA2B,QAAQ,WAAW;AAAA,QACrF,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,QAAQ;AAAA,UACjF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,eAAe,OAAO;AAAA,UACxB;AAAA,QACF;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,gBAAgB,OAAO,eAAe;AAAA,QACzF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,KAAK;AAAA,QAC1D;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB,OAAO;AACrC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,cAAc,OAAO;AAAA,UACvB;AAAA,QACF;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,QACrG;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,MAAM;AAAA,QAAC;AAAA,QACpB,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,OAAO;AAAA,QAClD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,eAAuB,OAAoF;AAChI,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AAEA,YAAM,SAAS,MAAM,QAAQ,UAAU;AAAA,QACrC,WAAW,sBAAsB,WAAW;AAAA,QAC5C;AAAA,MACF,CAAC;AAED,UAAI,OAAO,WAAW,YAAY,iBAAiB,kBAAkB,YAAY,eAAuC,OAAO,MAAM,GAAG;AACtI,cAAM,iBAAiB,YAAY;AACnC,oBAAY,gBAAgB,OAAO;AACnC,oBAAY,gBAAgB,OAAO;AACnC,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,cAAc,OAAO,gBAAgB,KAAK;AAC/H,oBAAY,eAAe,oBAAI,KAAK;AACpC,cAAM,GAAG,MAAM;AACf,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AACD,cAAM;AAAA,UACJ,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA,YAAY,OAAO;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,sBAAsB,eAAuB,QAUhD,OAAoE;AACrE,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,gBAAgB,YAAY;AAClC,YAAM,gBAAgB,kBAAkB,eAAe,OAAO,aAAa;AAC3E,YAAM,oBAAoB,iBAAiB,OAAO,kBAAkB;AACpE,YAAM,iBAAiB,YAAY;AACnC,UAAI,mBAAmB;AACrB,oBAAY,gBAAgB,OAAO;AAAA,MACrC;AACA,UAAI,OAAO,gBAAgB;AACzB,oBAAY,gBAAgB,OAAO;AAAA,MACrC;AACA,UAAI,OAAO,cAAc;AACvB,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,GAAG,OAAO,aAAa;AAAA,MAC9G;AACA,UAAI,OAAO,cAAc;AACvB,cAAM,aAAa,eAAe,YAAY,UAAU;AACxD,mBAAW,KAAK;AAAA,UACd,WAAW,OAAO,aAAa;AAAA,UAC/B,YAAY,OAAO,aAAa,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,UACrE,gBAAgB,OAAO,aAAa;AAAA,UACpC,eAAe,OAAO;AAAA,UACtB,WAAW,OAAO,aAAa;AAAA,QACjC,CAAC;AACD,oBAAY,aAAa;AAAA,MAC3B;AACA,kBAAY,gBAAgB,oBAAI,KAAK;AACrC,YAAM,GAAG,MAAM;AACf,UAAI,mBAAmB;AACrB,cAAM,gBAAgB,OAAO,eAAe;AAAA,UAC1C,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM;AAAA,QACJ,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,QAC7E,YAAY;AAAA,QACZ,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB,6CAA6C;AAAA,QACjE;AAAA,UACE;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,WAAW,OAAO,cAAc,aAAa;AAAA,UAC7C,gBAAgB,OAAO,cAAc,kBAAkB;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,IAAY,OAAyF;AACzH,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,2BACJ,mBACA,OACA,aACoC;AACpC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,UACX,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,QACvC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,iCAAiC,OAKL;AAChC,YAAM,QAAiC;AAAA,QACrC,eAAe,EAAE,KAAK,CAAC,WAAW,cAAc,oBAAoB,EAAE;AAAA,QACtE,WAAW;AAAA,MACb;AACA,UAAI,OAAO,eAAgB,OAAM,iBAAiB,MAAM;AACxD,UAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAI,OAAO,YAAa,OAAM,cAAc,MAAM;AAElD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,SAAS,EAAE,WAAW,MAAM;AAAA,UAC5B,OAAO,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  getGatewayAdapter,\n  type CreateSessionInput,\n  type CreateSessionResult,\n  type CaptureResult,\n  type RefundResult,\n  type CancelResult,\n  type GatewayAdapter,\n  type GatewayPaymentStatus,\n  type PaymentGatewayPresentationRequest,\n  type PaymentOrderTotalResolver,\n  type UnifiedPaymentStatus,\n} from '@open-mercato/shared/modules/payment_gateways/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { IntegrationLogService } from '../../integrations/lib/log-service'\nimport { conflict, CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { GatewayPaymentOperation, GatewaySessionInitialization, GatewayTransaction } from '../data/entities'\nimport { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'\nimport { emitPaymentGatewayEvent } from '../events'\nimport { readGatewayMetadata, readWebhookLog } from './transaction-fields'\nimport { reconcileSessionAmountWithOrder } from './order-amount-reconciliation'\nimport {\n  alignCapturedAmountWithStatus,\n  assertCaptureWithinRemaining,\n  formatAmountUnits,\n  parseAmountUnits,\n  releaseCaptureAmount,\n  reserveCaptureAmount,\n  settleCapturedAmount,\n} from './capture-ledger'\nimport {\n  completePaymentOperation,\n  failPaymentOperation,\n  preparePaymentOperation,\n} from './payment-operation-idempotency'\nimport {\n  buildPaymentSessionOperationKey,\n  claimPaymentSessionInitialization,\n  findPaymentSessionInitialization,\n  reclaimPaymentSessionInitialization,\n  refreshPaymentSessionInitialization,\n  releasePaymentSessionInitialization,\n} from './session-idempotency'\n\nconst PAYMENT_SESSION_CLAIM_STALE_MS = 30_000\nconst PAYMENT_SESSION_WAIT_INTERVAL_MS = 25\nconst logger = createLogger('payment_gateways').child({ component: 'gateway-service' })\n\nfunction assertManualActionAllowed(action: ManualGatewayAction, transaction: GatewayTransaction): void {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (!canApplyManualAction(action, current)) {\n    throw conflict(`Cannot ${action} a payment in status \"${current}\"`)\n  }\n}\n\nfunction applyAdapterResultStatus(\n  action: ManualGatewayAction,\n  transaction: GatewayTransaction,\n  resultStatus: UnifiedPaymentStatus,\n): boolean {\n  const current = transaction.unifiedStatus as UnifiedPaymentStatus\n  if (resultStatus === current) return false\n  if (isValidTransition(resultStatus, current)) return false\n  if (!isValidTransition(current, resultStatus)) {\n    throw conflict(\n      `Gateway returned status \"${resultStatus}\" which is not a valid transition from \"${current}\" for ${action}`,\n    )\n  }\n  transaction.unifiedStatus = resultStatus\n  return true\n}\n\nexport interface PaymentGatewayServiceDeps {\n  em: EntityManager\n  integrationCredentialsService: CredentialsService\n  integrationStateService?: IntegrationStateService\n  integrationLogService?: IntegrationLogService\n  /**\n   * Optional seam supplied by the module that owns orders (`sales` by default).\n   * When absent, session amounts cannot be reconciled and are accepted as-is.\n   */\n  paymentOrderTotalResolver?: PaymentOrderTotalResolver | null\n  sessionClaimOptions?: {\n    staleAfterMs?: number\n    heartbeatIntervalMs?: number\n    pollIntervalMs?: number\n  }\n}\n\nexport interface CreatePaymentSessionInput {\n  providerKey: string\n  paymentId: string\n  idempotencyKey?: string\n  orderId?: string\n  amount: number\n  currencyCode: string\n  captureMethod?: 'automatic' | 'manual'\n  paymentTypes?: string[]\n  description?: string\n  successUrl?: string\n  cancelUrl?: string\n  metadata?: Record<string, unknown>\n  presentation?: PaymentGatewayPresentationRequest\n  organizationId: string\n  tenantId: string\n}\n\nexport function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {\n  const { em, integrationCredentialsService, integrationLogService } = deps\n  const claimStaleAfterMs = Math.max(1, deps.sessionClaimOptions?.staleAfterMs ?? PAYMENT_SESSION_CLAIM_STALE_MS)\n  const claimHeartbeatIntervalMs = Math.max(\n    1,\n    deps.sessionClaimOptions?.heartbeatIntervalMs ?? Math.floor(claimStaleAfterMs / 3),\n  )\n  const claimPollIntervalMs = Math.max(1, deps.sessionClaimOptions?.pollIntervalMs ?? PAYMENT_SESSION_WAIT_INTERVAL_MS)\n\n  async function findTransactionOrThrow(\n    transactionId: string,\n    scope: { organizationId: string; tenantId: string },\n    targetEm: EntityManager = em,\n  ): Promise<GatewayTransaction> {\n    const transaction = await findOneWithDecryption(\n      targetEm,\n      GatewayTransaction,\n      {\n        id: transactionId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n    if (!transaction) {\n      throw new Error('Transaction not found')\n    }\n    return transaction\n  }\n\n  function readProviderSessionId(transaction: GatewayTransaction): string {\n    if (typeof transaction.providerSessionId === 'string' && transaction.providerSessionId.trim().length > 0) {\n      return transaction.providerSessionId\n    }\n    throw new Error('Transaction is missing provider session id')\n  }\n\n  async function emitStatusEvent(status: UnifiedPaymentStatus, payload: Record<string, unknown>) {\n    type PaymentGatewayEventId = Parameters<typeof emitPaymentGatewayEvent>[0]\n    const eventMap: Partial<Record<UnifiedPaymentStatus, PaymentGatewayEventId>> = {\n      authorized: 'payment_gateways.payment.authorized',\n      captured: 'payment_gateways.payment.captured',\n      failed: 'payment_gateways.payment.failed',\n      refunded: 'payment_gateways.payment.refunded',\n      cancelled: 'payment_gateways.payment.cancelled',\n    }\n    const eventId = eventMap[status]\n    if (!eventId) return\n    await emitPaymentGatewayEvent(eventId, payload)\n  }\n\n  async function writeTransactionLog(\n    providerKey: string,\n    scope: { organizationId: string; tenantId: string },\n    transactionId: string,\n    level: 'info' | 'warn' | 'error',\n    message: string,\n    payload?: Record<string, unknown> | null,\n    code?: string | null,\n  ) {\n    if (!integrationLogService) return\n    await integrationLogService.write({\n      integrationId: `gateway_${providerKey}`,\n      scopeEntityType: 'payment_transaction',\n      scopeEntityId: transactionId,\n      level,\n      message,\n      code,\n      payload: payload ?? null,\n    }, scope)\n  }\n\n  async function resolveAdapterAndCredentials(providerKey: string, scope: { organizationId: string; tenantId: string }) {\n    const integrationId = `gateway_${providerKey}`\n    const selectedVersion = deps.integrationStateService\n      ? await deps.integrationStateService.resolveApiVersion(integrationId, scope)\n      : undefined\n    const adapter = getGatewayAdapter(providerKey, selectedVersion)\n    if (!adapter) {\n      const message = selectedVersion\n        ? `No gateway adapter registered for provider: ${providerKey} (version: ${selectedVersion})`\n        : `No gateway adapter registered for provider: ${providerKey}`\n      throw new CrudHttpError(422, { error: message })\n    }\n    const credentials = await integrationCredentialsService.resolve(integrationId, scope) ?? {}\n\n    return { adapter, credentials }\n  }\n\n  type ManualOperationResult = CaptureResult | RefundResult | CancelResult\n\n  async function executeManualOperation<TResult extends ManualOperationResult>(input: {\n    action: ManualGatewayAction\n    transactionId: string\n    operationId?: string\n    payload: Record<string, unknown>\n    scope: { organizationId: string; tenantId: string }\n    assertInitialAllowed?: (transaction: GatewayTransaction) => void\n    beforeInvoke?: (context: { transaction: GatewayTransaction; operation: GatewayPaymentOperation }) => Promise<void>\n    releaseOnFailure?: (context: {\n      transaction: GatewayTransaction\n      operation: GatewayPaymentOperation\n      providerInvoked: boolean\n    }) => Promise<void>\n    invoke: (context: {\n      adapter: GatewayAdapter\n      credentials: Record<string, unknown>\n      transaction: GatewayTransaction\n      idempotencyKey: string\n    }) => Promise<TResult>\n    applyResult: (transaction: GatewayTransaction, result: TResult) => void\n    afterCommit: (transaction: GatewayTransaction, result: TResult) => Promise<void>\n  }): Promise<TResult> {\n    const transaction = await findTransactionOrThrow(input.transactionId, input.scope)\n    const prepared = await preparePaymentOperation({\n      em,\n      transactionId: transaction.id,\n      providerKey: transaction.providerKey,\n      action: input.action,\n      operationId: input.operationId,\n      payload: input.payload,\n      scope: input.scope,\n      assertInitialAllowed: () => {\n        assertManualActionAllowed(input.action, transaction)\n        input.assertInitialAllowed?.(transaction)\n      },\n    })\n    if (prepared.kind === 'completed') {\n      if (prepared.result.status !== transaction.unifiedStatus) {\n        throw conflict(\n          `Cannot replay ${input.action} because the payment status has changed since the operation completed`,\n        )\n      }\n      return prepared.result as unknown as TResult\n    }\n\n    const operation = prepared.claim.record\n    // Everything after this flips to true is post-settlement: the provider moved the money and the\n    // completion transaction committed it. A later event or logging failure must not undo either,\n    // so the failure path below only runs while the operation can still be rolled back.\n    let settled = false\n    // Flips once the provider call returned, so the failure path can tell \"the provider never\n    // moved the money\" from \"the provider moved it and only our bookkeeping failed\" \u2014 the two\n    // cases need opposite rollback decisions.\n    let providerInvoked = false\n    try {\n      await input.beforeInvoke?.({ transaction, operation })\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n      const result = await input.invoke({\n        adapter,\n        credentials,\n        transaction,\n        idempotencyKey: prepared.claim.providerIdempotencyKey,\n      })\n      providerInvoked = true\n      const statusChanged = await completePaymentOperation(\n        em,\n        prepared.claim,\n        result as unknown as Record<string, unknown>,\n        async (tx) => {\n          const current = await findTransactionOrThrow(input.transactionId, input.scope, tx)\n          const changed = applyAdapterResultStatus(input.action, current, result.status)\n          input.applyResult(current, result)\n          return changed\n        },\n      )\n      settled = true\n      if (statusChanged) {\n        await emitStatusEvent(result.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await input.afterCommit(transaction, result)\n      return result\n    } catch (error: unknown) {\n      if (!settled) {\n        if (input.releaseOnFailure) {\n          await input.releaseOnFailure({ transaction, operation, providerInvoked }).catch(() => undefined)\n        }\n        await Promise.allSettled([failPaymentOperation(em, prepared.claim)])\n      }\n      throw error\n    }\n  }\n\n  function createGatewayTransaction(\n    manager: EntityManager,\n    input: CreatePaymentSessionInput,\n    session: CreateSessionResult,\n    id?: string,\n  ): GatewayTransaction {\n    const data = {\n      paymentId: input.paymentId,\n      providerKey: input.providerKey,\n      providerSessionId: session.sessionId,\n      unifiedStatus: session.status,\n      redirectUrl: session.redirectUrl\n        ?? (session.clientSession?.type === 'redirect' ? session.clientSession.redirectUrl : null),\n      clientSecret: session.clientSecret ?? null,\n      amount: String(input.amount),\n      // An automatic-capture session comes back already captured, so the ledger has to start\n      // at the full amount \u2014 otherwise a later manual capture would look like the first one.\n      capturedAmount: session.status === 'captured' ? String(input.amount) : '0',\n      currencyCode: input.currencyCode,\n      gatewayMetadata: {\n        ...(session.providerData ?? {}),\n        ...(session.clientSession ? { clientSession: session.clientSession } : {}),\n      },\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      deletedAt: null,\n    }\n    return id\n      ? manager.create(GatewayTransaction, { id, ...data })\n      : manager.create(GatewayTransaction, data)\n  }\n\n  function restoreSession(transaction: GatewayTransaction): CreateSessionResult {\n    const metadata = readGatewayMetadata(transaction.gatewayMetadata)\n    const { clientSession, ...providerData } = metadata\n    return {\n      sessionId: readProviderSessionId(transaction),\n      status: transaction.unifiedStatus as UnifiedPaymentStatus,\n      ...(transaction.clientSecret ? { clientSecret: transaction.clientSecret } : {}),\n      ...(transaction.redirectUrl ? { redirectUrl: transaction.redirectUrl } : {}),\n      ...(Object.keys(providerData).length > 0 ? { providerData } : {}),\n      ...(clientSession && typeof clientSession === 'object'\n        ? { clientSession: clientSession as CreateSessionResult['clientSession'] }\n        : {}),\n    }\n  }\n\n  async function recordCreatedSession(\n    transaction: GatewayTransaction,\n    input: CreatePaymentSessionInput,\n    scope: { organizationId: string; tenantId: string },\n  ): Promise<void> {\n    await emitPaymentGatewayEvent('payment_gateways.session.created', {\n      transactionId: transaction.id,\n      paymentId: transaction.paymentId,\n      providerKey: transaction.providerKey,\n      status: transaction.unifiedStatus,\n      organizationId: transaction.organizationId,\n      tenantId: transaction.tenantId,\n    })\n    await writeTransactionLog(\n      transaction.providerKey,\n      scope,\n      transaction.id,\n      'info',\n      'Payment session created',\n      {\n        paymentId: transaction.paymentId,\n        providerSessionId: transaction.providerSessionId,\n        status: transaction.unifiedStatus,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n      },\n    )\n  }\n\n  function startClaimHeartbeat(\n    ownership: { id: string; claimToken: string },\n    scope: { organizationId: string; tenantId: string },\n  ): () => Promise<void> {\n    let stopped = false\n    let timer: ReturnType<typeof setTimeout> | null = null\n    let pendingRefresh = Promise.resolve()\n\n    const schedule = () => {\n      timer = setTimeout(() => {\n        pendingRefresh = refreshPaymentSessionInitialization(em, ownership, scope, new Date())\n          .then(\n            (refreshed) => {\n              if (refreshed && !stopped) schedule()\n            },\n            () => {\n              if (!stopped) schedule()\n            },\n          )\n      }, claimHeartbeatIntervalMs)\n    }\n    schedule()\n\n    return async () => {\n      stopped = true\n      if (timer) clearTimeout(timer)\n      await pendingRefresh\n    }\n  }\n\n  return {\n    async createPaymentSession(input: CreatePaymentSessionInput): Promise<{ transaction: GatewayTransaction; session: CreateSessionResult }> {\n      const scope = { organizationId: input.organizationId, tenantId: input.tenantId }\n      await reconcileSessionAmountWithOrder({\n        orderId: input.orderId,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n        scope,\n        resolver: deps.paymentOrderTotalResolver,\n      })\n      const { adapter, credentials } = await resolveAdapterAndCredentials(input.providerKey, scope)\n\n      const sessionInput: CreateSessionInput = {\n        paymentId: input.paymentId,\n        orderId: input.orderId,\n        idempotencyKey: input.idempotencyKey,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        amount: input.amount,\n        currencyCode: input.currencyCode,\n        captureMethod: input.captureMethod,\n        paymentTypes: input.paymentTypes,\n        description: input.description,\n        successUrl: input.successUrl,\n        cancelUrl: input.cancelUrl,\n        metadata: input.metadata,\n        presentation: input.presentation,\n        credentials,\n      }\n\n      if (!input.idempotencyKey) {\n        const session = await adapter.createSession(sessionInput)\n        const transaction = createGatewayTransaction(em, input, session)\n        await em.persist(transaction).flush()\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n\n      const operationKey = buildPaymentSessionOperationKey({\n        idempotencyKey: input.idempotencyKey,\n        paymentId: input.paymentId,\n        providerKey: input.providerKey,\n        scope,\n      })\n      while (true) {\n        const existing = await findPaymentSessionInitialization(em, operationKey, input.providerKey, scope)\n        if (existing?.gatewayTransactionId) {\n          const transaction = await findOneWithDecryption(\n            em.fork(),\n            GatewayTransaction,\n            {\n              id: existing.gatewayTransactionId,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n              deletedAt: null,\n            },\n            undefined,\n            scope,\n          )\n          if (!transaction) {\n            throw new Error('[internal] Completed payment session is missing its gateway transaction')\n          }\n          return { transaction, session: restoreSession(transaction) }\n        }\n\n        const claimedAt = new Date()\n        const staleBefore = new Date(claimedAt.getTime() - claimStaleAfterMs)\n        const ownership = existing\n          ? await reclaimPaymentSessionInitialization(em, existing, scope, claimedAt, staleBefore)\n          : await claimPaymentSessionInitialization(em, operationKey, input.providerKey, scope, claimedAt)\n\n        if (!ownership) {\n          await new Promise((resolve) => setTimeout(resolve, claimPollIntervalMs))\n          continue\n        }\n\n        let session: CreateSessionResult\n        const stopHeartbeat = startClaimHeartbeat(ownership, scope)\n        try {\n          session = await adapter.createSession({ ...sessionInput, idempotencyKey: operationKey })\n        } catch (error) {\n          try {\n            await releasePaymentSessionInitialization(em, ownership, scope)\n          } catch (releaseError) {\n            logger.warn('Failed to release payment session initialization claim', {\n              claimId: ownership.id,\n              providerKey: input.providerKey,\n              err: releaseError,\n            })\n          }\n          throw error\n        } finally {\n          await stopHeartbeat()\n        }\n\n        const transactionId = randomUUID()\n        const transaction = await em.fork().transactional(async (transactionEm) => {\n          const finalizedRows = await transactionEm.nativeUpdate(\n            GatewaySessionInitialization,\n            {\n              id: ownership.id,\n              claimToken: ownership.claimToken,\n              gatewayTransactionId: null,\n              organizationId: scope.organizationId,\n              tenantId: scope.tenantId,\n            },\n            {\n              gatewayTransactionId: transactionId,\n              claimToken: null,\n              claimedAt: null,\n              updatedAt: new Date(),\n            },\n          )\n          if (finalizedRows === 0) return null\n          const created = createGatewayTransaction(transactionEm, input, session, transactionId)\n          await transactionEm.persist(created).flush()\n          return created\n        })\n\n        if (!transaction) {\n          continue\n        }\n        await recordCreatedSession(transaction, input, scope)\n        return { transaction, session }\n      }\n    },\n\n    async capturePayment(\n      transactionId: string,\n      amount: number | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CaptureResult> {\n      let reservedUnits: bigint | null = null\n      let providerAmount = amount\n      return executeManualOperation({\n        action: 'capture',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null },\n        scope,\n        assertInitialAllowed: (transaction) => { assertCaptureWithinRemaining(transaction, amount) },\n        beforeInvoke: async ({ transaction, operation }) => {\n          const alreadyCapturedUnits = parseAmountUnits(transaction.capturedAmount)\n          reservedUnits = await reserveCaptureAmount(em, { transaction, operation, amount, scope })\n          // \"Capture the rest\" has to name the remaining amount once part of the authorization is\n          // already captured, otherwise the provider would capture the full amount a second time.\n          if (amount === undefined && alreadyCapturedUnits > 0n) {\n            providerAmount = Number(formatAmountUnits(reservedUnits))\n          }\n        },\n        // The slice goes back only while the provider has not been called yet. Once the capture\n        // call returned, the money may already have moved and only the completion transaction\n        // failed, so releasing would reopen the authorization for a fresh operation id and allow an\n        // over-capture. Holding the reservation is the conservative outcome: a retry of this same\n        // operation id reuses both the reservation and the provider idempotency key, so the provider\n        // itself collapses the duplicate.\n        releaseOnFailure: async ({ transaction, operation, providerInvoked }) => {\n          if (reservedUnits === null) return\n          if (providerInvoked) {\n            await writeTransactionLog(\n              transaction.providerKey,\n              { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n              transaction.id,\n              'warn',\n              'Capture reservation stays outstanding because the provider call already returned',\n              { operationId: operation.operationId, reservedAmount: formatAmountUnits(reservedUnits) },\n            )\n            return\n          }\n          const released = await releaseCaptureAmount(em, { transactionId, operation, reservedUnits, scope })\n          if (released) return\n          await writeTransactionLog(\n            transaction.providerKey,\n            { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n            transaction.id,\n            'warn',\n            'Capture reservation stays outstanding after a failed capture',\n            { operationId: operation.operationId, reservedAmount: formatAmountUnits(reservedUnits) },\n          )\n        },\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.capture({\n          sessionId: readProviderSessionId(transaction),\n          amount: providerAmount,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            captureResult: result.providerData,\n          }\n          if (reservedUnits !== null) settleCapturedAmount(transaction, reservedUnits, result.capturedAmount)\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment captured',\n          { amount: amount ?? null, status: result.status, capturedAmount: result.capturedAmount },\n        ),\n      })\n    },\n\n    async refundPayment(\n      transactionId: string,\n      amount: number | undefined,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<RefundResult> {\n      return executeManualOperation({\n        action: 'refund',\n        transactionId,\n        operationId,\n        payload: { amount: amount ?? null, reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.refund({\n          sessionId: readProviderSessionId(transaction),\n          amount,\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: (transaction, result) => {\n          transaction.gatewayRefundId = result.refundId\n          transaction.gatewayMetadata = {\n            ...readGatewayMetadata(transaction.gatewayMetadata),\n            refundResult: result.providerData,\n          }\n        },\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment refunded',\n          { amount: amount ?? null, reason: reason ?? null, status: result.status, refundId: result.refundId },\n        ),\n      })\n    },\n\n    async cancelPayment(\n      transactionId: string,\n      reason: string | undefined,\n      scope: { organizationId: string; tenantId: string },\n      operationId?: string,\n    ): Promise<CancelResult> {\n      return executeManualOperation({\n        action: 'cancel',\n        transactionId,\n        operationId,\n        payload: { reason: reason ?? null },\n        scope,\n        invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.cancel({\n          sessionId: readProviderSessionId(transaction),\n          reason,\n          credentials,\n          idempotencyKey,\n        }),\n        applyResult: () => {},\n        afterCommit: (transaction, result) => writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment cancelled',\n          { reason: reason ?? null, status: result.status },\n        ),\n      })\n    },\n\n    async getPaymentStatus(transactionId: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayPaymentStatus> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const { adapter, credentials } = await resolveAdapterAndCredentials(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n      )\n\n      const status = await adapter.getStatus({\n        sessionId: readProviderSessionId(transaction),\n        credentials,\n      })\n\n      if (status.status !== transaction.unifiedStatus && isValidTransition(transaction.unifiedStatus as UnifiedPaymentStatus, status.status)) {\n        const previousStatus = transaction.unifiedStatus\n        transaction.unifiedStatus = status.status\n        alignCapturedAmountWithStatus(transaction, status.status)\n        transaction.gatewayStatus = status.status\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), statusResult: status.providerData ?? null }\n        transaction.lastPolledAt = new Date()\n        await em.flush()\n        await emitStatusEvent(status.status, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n        await writeTransactionLog(\n          transaction.providerKey,\n          { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n          transaction.id,\n          'info',\n          'Payment status updated by poller',\n          {\n            previousStatus,\n            nextStatus: status.status,\n          },\n        )\n      }\n\n      return status\n    },\n\n    async syncTransactionStatus(transactionId: string, update: {\n      unifiedStatus: UnifiedPaymentStatus\n      providerStatus?: string\n      providerData?: Record<string, unknown>\n      webhookEvent?: {\n        eventType: string\n        idempotencyKey: string\n        processed: boolean\n        receivedAt?: string\n      }\n    }, scope: { organizationId: string; tenantId: string }): Promise<void> {\n      const transaction = await findTransactionOrThrow(transactionId, scope)\n      const currentStatus = transaction.unifiedStatus as UnifiedPaymentStatus\n      const canTransition = isValidTransition(currentStatus, update.unifiedStatus)\n      const shouldApplyStatus = canTransition && update.unifiedStatus !== currentStatus\n      const previousStatus = transaction.unifiedStatus\n      if (shouldApplyStatus) {\n        transaction.unifiedStatus = update.unifiedStatus\n        alignCapturedAmountWithStatus(transaction, update.unifiedStatus)\n      }\n      if (update.providerStatus) {\n        transaction.gatewayStatus = update.providerStatus\n      }\n      if (update.providerData) {\n        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), ...update.providerData }\n      }\n      if (update.webhookEvent) {\n        const webhookLog = readWebhookLog(transaction.webhookLog)\n        webhookLog.push({\n          eventType: update.webhookEvent.eventType,\n          receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),\n          idempotencyKey: update.webhookEvent.idempotencyKey,\n          unifiedStatus: update.unifiedStatus,\n          processed: update.webhookEvent.processed,\n        })\n        transaction.webhookLog = webhookLog\n      }\n      transaction.lastWebhookAt = new Date()\n      await em.flush()\n      if (shouldApplyStatus) {\n        await emitStatusEvent(update.unifiedStatus, {\n          transactionId: transaction.id,\n          paymentId: transaction.paymentId,\n          providerKey: transaction.providerKey,\n          previousStatus,\n          organizationId: transaction.organizationId,\n          tenantId: transaction.tenantId,\n        })\n      }\n      await writeTransactionLog(\n        transaction.providerKey,\n        { organizationId: transaction.organizationId, tenantId: transaction.tenantId },\n        transaction.id,\n        shouldApplyStatus ? 'info' : 'warn',\n        shouldApplyStatus ? 'Payment status synchronized from webhook' : 'Webhook received with no status transition',\n        {\n          previousStatus,\n          nextStatus: update.unifiedStatus,\n          providerStatus: update.providerStatus ?? null,\n          eventType: update.webhookEvent?.eventType ?? null,\n          idempotencyKey: update.webhookEvent?.idempotencyKey ?? null,\n        },\n      )\n    },\n\n    async findTransaction(id: string, scope: { organizationId: string; tenantId: string }): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          id,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async findTransactionBySessionId(\n      providerSessionId: string,\n      scope: { organizationId: string; tenantId: string },\n      providerKey?: string,\n    ): Promise<GatewayTransaction | null> {\n      return findOneWithDecryption(\n        em,\n        GatewayTransaction,\n        {\n          providerSessionId,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n          deletedAt: null,\n          ...(providerKey ? { providerKey } : {}),\n        },\n        undefined,\n        scope,\n      )\n    },\n\n    async listTransactionsForStatusPolling(scope?: {\n      organizationId?: string\n      tenantId?: string\n      providerKey?: string\n      limit?: number\n    }): Promise<GatewayTransaction[]> {\n      const where: Record<string, unknown> = {\n        unifiedStatus: { $in: ['pending', 'authorized', 'partially_captured'] },\n        deletedAt: null,\n      }\n      if (scope?.organizationId) where.organizationId = scope.organizationId\n      if (scope?.tenantId) where.tenantId = scope.tenantId\n      if (scope?.providerKey) where.providerKey = scope.providerKey\n\n      return findWithDecryption(\n        em,\n        GatewayTransaction,\n        where,\n        {\n          orderBy: { updatedAt: 'asc' },\n          limit: scope?.limit ?? 100,\n        },\n        scope,\n      )\n    },\n  }\n}\n\nexport type PaymentGatewayService = ReturnType<typeof createPaymentGatewayService>\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,OAWK;AAIP,SAAS,UAAU,qBAAqB;AACxC,SAAkC,8BAA8B,0BAA0B;AAC1F,SAAS,sBAAsB,yBAAmD;AAClF,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,sBAAsB;AACpD,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iCAAiC;AACvC,MAAM,mCAAmC;AACzC,MAAM,SAAS,aAAa,kBAAkB,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAEtF,SAAS,0BAA0B,QAA6B,aAAuC;AACrG,QAAM,UAAU,YAAY;AAC5B,MAAI,CAAC,qBAAqB,QAAQ,OAAO,GAAG;AAC1C,UAAM,SAAS,UAAU,MAAM,yBAAyB,OAAO,GAAG;AAAA,EACpE;AACF;AAEA,SAAS,yBACP,QACA,aACA,cACS;AACT,QAAM,UAAU,YAAY;AAC5B,MAAI,iBAAiB,QAAS,QAAO;AACrC,MAAI,kBAAkB,cAAc,OAAO,EAAG,QAAO;AACrD,MAAI,CAAC,kBAAkB,SAAS,YAAY,GAAG;AAC7C,UAAM;AAAA,MACJ,4BAA4B,YAAY,2CAA2C,OAAO,SAAS,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,cAAY,gBAAgB;AAC5B,SAAO;AACT;AAqCO,SAAS,4BAA4B,MAAiC;AAC3E,QAAM,EAAE,IAAI,+BAA+B,sBAAsB,IAAI;AACrE,QAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,qBAAqB,gBAAgB,8BAA8B;AAC9G,QAAM,2BAA2B,KAAK;AAAA,IACpC;AAAA,IACA,KAAK,qBAAqB,uBAAuB,KAAK,MAAM,oBAAoB,CAAC;AAAA,EACnF;AACA,QAAM,sBAAsB,KAAK,IAAI,GAAG,KAAK,qBAAqB,kBAAkB,gCAAgC;AAEpH,iBAAe,uBACb,eACA,OACA,WAA0B,IACG;AAC7B,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AAEA,WAAS,sBAAsB,aAAyC;AACtE,QAAI,OAAO,YAAY,sBAAsB,YAAY,YAAY,kBAAkB,KAAK,EAAE,SAAS,GAAG;AACxG,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,iBAAe,gBAAgB,QAA8B,SAAkC;AAE7F,UAAM,WAAyE;AAAA,MAC7E,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AACA,UAAM,UAAU,SAAS,MAAM;AAC/B,QAAI,CAAC,QAAS;AACd,UAAM,wBAAwB,SAAS,OAAO;AAAA,EAChD;AAEA,iBAAe,oBACb,aACA,OACA,eACA,OACA,SACA,SACA,MACA;AACA,QAAI,CAAC,sBAAuB;AAC5B,UAAM,sBAAsB,MAAM;AAAA,MAChC,eAAe,WAAW,WAAW;AAAA,MACrC,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,GAAG,KAAK;AAAA,EACV;AAEA,iBAAe,6BAA6B,aAAqB,OAAqD;AACpH,UAAM,gBAAgB,WAAW,WAAW;AAC5C,UAAM,kBAAkB,KAAK,0BACzB,MAAM,KAAK,wBAAwB,kBAAkB,eAAe,KAAK,IACzE;AACJ,UAAM,UAAU,kBAAkB,aAAa,eAAe;AAC9D,QAAI,CAAC,SAAS;AACZ,YAAM,UAAU,kBACZ,+CAA+C,WAAW,cAAc,eAAe,MACvF,+CAA+C,WAAW;AAC9D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,IACjD;AACA,UAAM,cAAc,MAAM,8BAA8B,QAAQ,eAAe,KAAK,KAAK,CAAC;AAE1F,WAAO,EAAE,SAAS,YAAY;AAAA,EAChC;AAIA,iBAAe,uBAA8D,OAqBxD;AACnB,UAAM,cAAc,MAAM,uBAAuB,MAAM,eAAe,MAAM,KAAK;AACjF,UAAM,WAAW,MAAM,wBAAwB;AAAA,MAC7C;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B,aAAa,YAAY;AAAA,MACzB,QAAQ,MAAM;AAAA,MACd,aAAa,MAAM;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,MACb,sBAAsB,MAAM;AAC1B,kCAA0B,MAAM,QAAQ,WAAW;AACnD,cAAM,uBAAuB,WAAW;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,QAAI,SAAS,SAAS,aAAa;AACjC,UAAI,SAAS,OAAO,WAAW,YAAY,eAAe;AACxD,cAAM;AAAA,UACJ,iBAAiB,MAAM,MAAM;AAAA,QAC/B;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,YAAY,SAAS,MAAM;AAIjC,QAAI,UAAU;AAId,QAAI,kBAAkB;AACtB,QAAI;AACF,YAAM,MAAM,eAAe,EAAE,aAAa,UAAU,CAAC;AACrD,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AACA,YAAM,SAAS,MAAM,MAAM,OAAO;AAAA,QAChC;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,SAAS,MAAM;AAAA,MACjC,CAAC;AACD,wBAAkB;AAClB,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA,SAAS;AAAA,QACT;AAAA,QACA,OAAO,OAAO;AACZ,gBAAM,UAAU,MAAM,uBAAuB,MAAM,eAAe,MAAM,OAAO,EAAE;AACjF,gBAAM,UAAU,yBAAyB,MAAM,QAAQ,SAAS,OAAO,MAAM;AAC7E,gBAAM,YAAY,SAAS,MAAM;AACjC,iBAAO;AAAA,QACT;AAAA,MACF;AACA,gBAAU;AACV,UAAI,eAAe;AACjB,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,YAAY,aAAa,MAAM;AAC3C,aAAO;AAAA,IACT,SAAS,OAAgB;AACvB,UAAI,CAAC,SAAS;AACZ,YAAI,MAAM,kBAAkB;AAC1B,gBAAM,MAAM,iBAAiB,EAAE,aAAa,WAAW,gBAAgB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QACjG;AACA,cAAM,QAAQ,WAAW,CAAC,qBAAqB,IAAI,SAAS,KAAK,CAAC,CAAC;AAAA,MACrE;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,WAAS,yBACP,SACA,OACA,SACA,IACoB;AACpB,UAAM,OAAO;AAAA,MACX,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,mBAAmB,QAAQ;AAAA,MAC3B,eAAe,QAAQ;AAAA,MACvB,aAAa,QAAQ,gBACf,QAAQ,eAAe,SAAS,aAAa,QAAQ,cAAc,cAAc;AAAA,MACvF,cAAc,QAAQ,gBAAgB;AAAA,MACtC,QAAQ,OAAO,MAAM,MAAM;AAAA;AAAA;AAAA,MAG3B,gBAAgB,QAAQ,WAAW,aAAa,OAAO,MAAM,MAAM,IAAI;AAAA,MACvE,cAAc,MAAM;AAAA,MACpB,iBAAiB;AAAA,QACf,GAAI,QAAQ,gBAAgB,CAAC;AAAA,QAC7B,GAAI,QAAQ,gBAAgB,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,MAC1E;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AACA,WAAO,KACH,QAAQ,OAAO,oBAAoB,EAAE,IAAI,GAAG,KAAK,CAAC,IAClD,QAAQ,OAAO,oBAAoB,IAAI;AAAA,EAC7C;AAEA,WAAS,eAAe,aAAsD;AAC5E,UAAM,WAAW,oBAAoB,YAAY,eAAe;AAChE,UAAM,EAAE,eAAe,GAAG,aAAa,IAAI;AAC3C,WAAO;AAAA,MACL,WAAW,sBAAsB,WAAW;AAAA,MAC5C,QAAQ,YAAY;AAAA,MACpB,GAAI,YAAY,eAAe,EAAE,cAAc,YAAY,aAAa,IAAI,CAAC;AAAA,MAC7E,GAAI,YAAY,cAAc,EAAE,aAAa,YAAY,YAAY,IAAI,CAAC;AAAA,MAC1E,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,iBAAiB,OAAO,kBAAkB,WAC1C,EAAE,cAAqE,IACvE,CAAC;AAAA,IACP;AAAA,EACF;AAEA,iBAAe,qBACb,aACA,OACA,OACe;AACf,UAAM,wBAAwB,oCAAoC;AAAA,MAChE,eAAe,YAAY;AAAA,MAC3B,WAAW,YAAY;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,QAAQ,YAAY;AAAA,MACpB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB,CAAC;AACD,UAAM;AAAA,MACJ,YAAY;AAAA,MACZ;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,YAAY;AAAA,QACvB,mBAAmB,YAAY;AAAA,QAC/B,QAAQ,YAAY;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,oBACP,WACA,OACqB;AACrB,QAAI,UAAU;AACd,QAAI,QAA8C;AAClD,QAAI,iBAAiB,QAAQ,QAAQ;AAErC,UAAM,WAAW,MAAM;AACrB,cAAQ,WAAW,MAAM;AACvB,yBAAiB,oCAAoC,IAAI,WAAW,OAAO,oBAAI,KAAK,CAAC,EAClF;AAAA,UACC,CAAC,cAAc;AACb,gBAAI,aAAa,CAAC,QAAS,UAAS;AAAA,UACtC;AAAA,UACA,MAAM;AACJ,gBAAI,CAAC,QAAS,UAAS;AAAA,UACzB;AAAA,QACF;AAAA,MACJ,GAAG,wBAAwB;AAAA,IAC7B;AACA,aAAS;AAET,WAAO,YAAY;AACjB,gBAAU;AACV,UAAI,MAAO,cAAa,KAAK;AAC7B,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,qBAAqB,OAA8G;AACvI,YAAM,QAAQ,EAAE,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAC/E,YAAM,gCAAgC;AAAA,QACpC,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,QACpB;AAAA,QACA,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM,6BAA6B,MAAM,aAAa,KAAK;AAE5F,YAAM,eAAmC;AAAA,QACvC,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,QACpB,eAAe,MAAM;AAAA,QACrB,cAAc,MAAM;AAAA,QACpB,aAAa,MAAM;AAAA,QACnB,YAAY,MAAM;AAAA,QAClB,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,QAChB,cAAc,MAAM;AAAA,QACpB;AAAA,MACF;AAEA,UAAI,CAAC,MAAM,gBAAgB;AACzB,cAAM,UAAU,MAAM,QAAQ,cAAc,YAAY;AACxD,cAAM,cAAc,yBAAyB,IAAI,OAAO,OAAO;AAC/D,cAAM,GAAG,QAAQ,WAAW,EAAE,MAAM;AACpC,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAEA,YAAM,eAAe,gCAAgC;AAAA,QACnD,gBAAgB,MAAM;AAAA,QACtB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB;AAAA,MACF,CAAC;AACD,aAAO,MAAM;AACX,cAAM,WAAW,MAAM,iCAAiC,IAAI,cAAc,MAAM,aAAa,KAAK;AAClG,YAAI,UAAU,sBAAsB;AAClC,gBAAMA,eAAc,MAAM;AAAA,YACxB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,IAAI,SAAS;AAAA,cACb,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,cAChB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,CAACA,cAAa;AAChB,kBAAM,IAAI,MAAM,yEAAyE;AAAA,UAC3F;AACA,iBAAO,EAAE,aAAAA,cAAa,SAAS,eAAeA,YAAW,EAAE;AAAA,QAC7D;AAEA,cAAM,YAAY,oBAAI,KAAK;AAC3B,cAAM,cAAc,IAAI,KAAK,UAAU,QAAQ,IAAI,iBAAiB;AACpE,cAAM,YAAY,WACd,MAAM,oCAAoC,IAAI,UAAU,OAAO,WAAW,WAAW,IACrF,MAAM,kCAAkC,IAAI,cAAc,MAAM,aAAa,OAAO,SAAS;AAEjG,YAAI,CAAC,WAAW;AACd,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,mBAAmB,CAAC;AACvE;AAAA,QACF;AAEA,YAAI;AACJ,cAAM,gBAAgB,oBAAoB,WAAW,KAAK;AAC1D,YAAI;AACF,oBAAU,MAAM,QAAQ,cAAc,EAAE,GAAG,cAAc,gBAAgB,aAAa,CAAC;AAAA,QACzF,SAAS,OAAO;AACd,cAAI;AACF,kBAAM,oCAAoC,IAAI,WAAW,KAAK;AAAA,UAChE,SAAS,cAAc;AACrB,mBAAO,KAAK,0DAA0D;AAAA,cACpE,SAAS,UAAU;AAAA,cACnB,aAAa,MAAM;AAAA,cACnB,KAAK;AAAA,YACP,CAAC;AAAA,UACH;AACA,gBAAM;AAAA,QACR,UAAE;AACA,gBAAM,cAAc;AAAA,QACtB;AAEA,cAAM,gBAAgB,WAAW;AACjC,cAAM,cAAc,MAAM,GAAG,KAAK,EAAE,cAAc,OAAO,kBAAkB;AACzE,gBAAM,gBAAgB,MAAM,cAAc;AAAA,YACxC;AAAA,YACA;AAAA,cACE,IAAI,UAAU;AAAA,cACd,YAAY,UAAU;AAAA,cACtB,sBAAsB;AAAA,cACtB,gBAAgB,MAAM;AAAA,cACtB,UAAU,MAAM;AAAA,YAClB;AAAA,YACA;AAAA,cACE,sBAAsB;AAAA,cACtB,YAAY;AAAA,cACZ,WAAW;AAAA,cACX,WAAW,oBAAI,KAAK;AAAA,YACtB;AAAA,UACF;AACA,cAAI,kBAAkB,EAAG,QAAO;AAChC,gBAAM,UAAU,yBAAyB,eAAe,OAAO,SAAS,aAAa;AACrF,gBAAM,cAAc,QAAQ,OAAO,EAAE,MAAM;AAC3C,iBAAO;AAAA,QACT,CAAC;AAED,YAAI,CAAC,aAAa;AAChB;AAAA,QACF;AACA,cAAM,qBAAqB,aAAa,OAAO,KAAK;AACpD,eAAO,EAAE,aAAa,QAAQ;AAAA,MAChC;AAAA,IACF;AAAA,IAEA,MAAM,eACJ,eACA,QACA,OACA,aACwB;AACxB,UAAI,gBAA+B;AACnC,UAAI,iBAAiB;AACrB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,sBAAsB,CAAC,gBAAgB;AAAE,uCAA6B,aAAa,MAAM;AAAA,QAAE;AAAA,QAC3F,cAAc,OAAO,EAAE,aAAa,UAAU,MAAM;AAClD,gBAAM,uBAAuB,iBAAiB,YAAY,cAAc;AACxE,0BAAgB,MAAM,qBAAqB,IAAI,EAAE,aAAa,WAAW,QAAQ,MAAM,CAAC;AAGxF,cAAI,WAAW,UAAa,uBAAuB,IAAI;AACrD,6BAAiB,OAAO,kBAAkB,aAAa,CAAC;AAAA,UAC1D;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOA,kBAAkB,OAAO,EAAE,aAAa,WAAW,gBAAgB,MAAM;AACvE,cAAI,kBAAkB,KAAM;AAC5B,cAAI,iBAAiB;AACnB,kBAAM;AAAA,cACJ,YAAY;AAAA,cACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,cAC7E,YAAY;AAAA,cACZ;AAAA,cACA;AAAA,cACA,EAAE,aAAa,UAAU,aAAa,gBAAgB,kBAAkB,aAAa,EAAE;AAAA,YACzF;AACA;AAAA,UACF;AACA,gBAAM,WAAW,MAAM,qBAAqB,IAAI,EAAE,eAAe,WAAW,eAAe,MAAM,CAAC;AAClG,cAAI,SAAU;AACd,gBAAM;AAAA,YACJ,YAAY;AAAA,YACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,YAC7E,YAAY;AAAA,YACZ;AAAA,YACA;AAAA,YACA,EAAE,aAAa,UAAU,aAAa,gBAAgB,kBAAkB,aAAa,EAAE;AAAA,UACzF;AAAA,QACF;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,QAAQ;AAAA,UACjF,WAAW,sBAAsB,WAAW;AAAA,UAC5C,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,eAAe,OAAO;AAAA,UACxB;AACA,cAAI,kBAAkB,KAAM,sBAAqB,aAAa,eAAe,OAAO,cAAc;AAAA,QACpG;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,gBAAgB,OAAO,eAAe;AAAA,QACzF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,KAAK;AAAA,QAC1D;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,CAAC,aAAa,WAAW;AACpC,sBAAY,kBAAkB,OAAO;AACrC,sBAAY,kBAAkB;AAAA,YAC5B,GAAG,oBAAoB,YAAY,eAAe;AAAA,YAClD,cAAc,OAAO;AAAA,UACvB;AAAA,QACF;AAAA,QACA,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,UAAU,MAAM,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AAAA,QACrG;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,cACJ,eACA,QACA,OACA,aACuB;AACvB,aAAO,uBAAuB;AAAA,QAC5B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,SAAS,EAAE,QAAQ,UAAU,KAAK;AAAA,QAClC;AAAA,QACA,QAAQ,CAAC,EAAE,SAAS,aAAa,aAAa,eAAe,MAAM,QAAQ,OAAO;AAAA,UAChF,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,QACD,aAAa,MAAM;AAAA,QAAC;AAAA,QACpB,aAAa,CAAC,aAAa,WAAW;AAAA,UACpC,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,UAAU,MAAM,QAAQ,OAAO,OAAO;AAAA,QAClD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,eAAuB,OAAoF;AAChI,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,EAAE,SAAS,YAAY,IAAI,MAAM;AAAA,QACrC,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,MAC/E;AAEA,YAAM,SAAS,MAAM,QAAQ,UAAU;AAAA,QACrC,WAAW,sBAAsB,WAAW;AAAA,QAC5C;AAAA,MACF,CAAC;AAED,UAAI,OAAO,WAAW,YAAY,iBAAiB,kBAAkB,YAAY,eAAuC,OAAO,MAAM,GAAG;AACtI,cAAM,iBAAiB,YAAY;AACnC,oBAAY,gBAAgB,OAAO;AACnC,sCAA8B,aAAa,OAAO,MAAM;AACxD,oBAAY,gBAAgB,OAAO;AACnC,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,cAAc,OAAO,gBAAgB,KAAK;AAC/H,oBAAY,eAAe,oBAAI,KAAK;AACpC,cAAM,GAAG,MAAM;AACf,cAAM,gBAAgB,OAAO,QAAQ;AAAA,UACnC,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AACD,cAAM;AAAA,UACJ,YAAY;AAAA,UACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,UAC7E,YAAY;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,YACE;AAAA,YACA,YAAY,OAAO;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,sBAAsB,eAAuB,QAUhD,OAAoE;AACrE,YAAM,cAAc,MAAM,uBAAuB,eAAe,KAAK;AACrE,YAAM,gBAAgB,YAAY;AAClC,YAAM,gBAAgB,kBAAkB,eAAe,OAAO,aAAa;AAC3E,YAAM,oBAAoB,iBAAiB,OAAO,kBAAkB;AACpE,YAAM,iBAAiB,YAAY;AACnC,UAAI,mBAAmB;AACrB,oBAAY,gBAAgB,OAAO;AACnC,sCAA8B,aAAa,OAAO,aAAa;AAAA,MACjE;AACA,UAAI,OAAO,gBAAgB;AACzB,oBAAY,gBAAgB,OAAO;AAAA,MACrC;AACA,UAAI,OAAO,cAAc;AACvB,oBAAY,kBAAkB,EAAE,GAAG,oBAAoB,YAAY,eAAe,GAAG,GAAG,OAAO,aAAa;AAAA,MAC9G;AACA,UAAI,OAAO,cAAc;AACvB,cAAM,aAAa,eAAe,YAAY,UAAU;AACxD,mBAAW,KAAK;AAAA,UACd,WAAW,OAAO,aAAa;AAAA,UAC/B,YAAY,OAAO,aAAa,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,UACrE,gBAAgB,OAAO,aAAa;AAAA,UACpC,eAAe,OAAO;AAAA,UACtB,WAAW,OAAO,aAAa;AAAA,QACjC,CAAC;AACD,oBAAY,aAAa;AAAA,MAC3B;AACA,kBAAY,gBAAgB,oBAAI,KAAK;AACrC,YAAM,GAAG,MAAM;AACf,UAAI,mBAAmB;AACrB,cAAM,gBAAgB,OAAO,eAAe;AAAA,UAC1C,eAAe,YAAY;AAAA,UAC3B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB,CAAC;AAAA,MACH;AACA,YAAM;AAAA,QACJ,YAAY;AAAA,QACZ,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,QAC7E,YAAY;AAAA,QACZ,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB,6CAA6C;AAAA,QACjE;AAAA,UACE;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,WAAW,OAAO,cAAc,aAAa;AAAA,UAC7C,gBAAgB,OAAO,cAAc,kBAAkB;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,IAAY,OAAyF;AACzH,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,2BACJ,mBACA,OACA,aACoC;AACpC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,WAAW;AAAA,UACX,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,QACvC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,iCAAiC,OAKL;AAChC,YAAM,QAAiC;AAAA,QACrC,eAAe,EAAE,KAAK,CAAC,WAAW,cAAc,oBAAoB,EAAE;AAAA,QACtE,WAAW;AAAA,MACb;AACA,UAAI,OAAO,eAAgB,OAAM,iBAAiB,MAAM;AACxD,UAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAI,OAAO,YAAa,OAAM,cAAc,MAAM;AAElD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,SAAS,EAAE,WAAW,MAAM;AAAA,UAC5B,OAAO,OAAO,SAAS;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["transaction"]
 }

package/dist/modules/payment_gateways/lib/order-amount-reconciliation.js

@@ -0,0 +1,58 @@
+import { conflict } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createFallbackTranslator } from "@open-mercato/shared/lib/i18n/translate";
+const AMOUNT_TOLERANCE = 1e-4;
+function normalizeCurrencyCode(currencyCode) {
+  return currencyCode.trim().toUpperCase();
+}
+async function resolveConflictTranslator() {
+  try {
+    const { translate } = await resolveTranslations();
+    return translate;
+  } catch {
+    return createFallbackTranslator({});
+  }
+}
+function isPaymentOrderTotalResolver(candidate) {
+  return !!candidate && typeof candidate === "object" && typeof candidate.resolveOrderTotal === "function";
+}
+function assertSessionAmountMatchesOrderTotal(requested, orderTotal, translate) {
+  if (normalizeCurrencyCode(requested.currencyCode) !== normalizeCurrencyCode(orderTotal.currencyCode)) {
+    throw conflict(translate(
+      "payment_gateways.errors.sessionCurrencyMismatch",
+      "Payment session currency {currencyCode} does not match the currency of order {orderId}",
+      { currencyCode: normalizeCurrencyCode(requested.currencyCode), orderId: requested.orderId }
+    ));
+  }
+  if (Math.abs(requested.amount - orderTotal.amountDue) > AMOUNT_TOLERANCE) {
+    throw conflict(translate(
+      "payment_gateways.errors.sessionAmountMismatch",
+      "Payment session amount {amount} does not match the amount due for order {orderId}",
+      { amount: requested.amount, orderId: requested.orderId }
+    ));
+  }
+}
+async function reconcileSessionAmountWithOrder(input) {
+  const { orderId, resolver } = input;
+  if (!orderId || !resolver) return;
+  const orderTotal = await resolver.resolveOrderTotal(orderId, input.scope);
+  const translate = await resolveConflictTranslator();
+  if (!orderTotal) {
+    throw conflict(translate(
+      "payment_gateways.errors.sessionOrderNotFound",
+      "Order {orderId} was not found in the current scope",
+      { orderId }
+    ));
+  }
+  assertSessionAmountMatchesOrderTotal(
+    { orderId, amount: input.amount, currencyCode: input.currencyCode },
+    orderTotal,
+    translate
+  );
+}
+export {
+  assertSessionAmountMatchesOrderTotal,
+  isPaymentOrderTotalResolver,
+  reconcileSessionAmountWithOrder
+};
+//# sourceMappingURL=order-amount-reconciliation.js.map

package/dist/modules/payment_gateways/lib/order-amount-reconciliation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/payment_gateways/lib/order-amount-reconciliation.ts"],
+  "sourcesContent": ["import { conflict } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createFallbackTranslator, type TranslateWithFallbackFn } from '@open-mercato/shared/lib/i18n/translate'\nimport type {\n  PaymentGatewayScope,\n  PaymentOrderTotal,\n  PaymentOrderTotalResolver,\n} from '@open-mercato/shared/modules/payment_gateways/types'\n\n/** Amounts are stored as numeric(18,4); anything below that is rounding noise, not a mismatch. */\nconst AMOUNT_TOLERANCE = 0.0001\n\nfunction normalizeCurrencyCode(currencyCode: string): string {\n  return currencyCode.trim().toUpperCase()\n}\n\n/**\n * Conflict copy is served from the module catalog on a request path. Contexts\n * without a registered module dictionary (CLI commands, workers, unit tests)\n * fall back to the English template shipped with each call, so a missing\n * dictionary degrades the wording of a rejection but never its outcome.\n */\nasync function resolveConflictTranslator(): Promise<TranslateWithFallbackFn> {\n  try {\n    const { translate } = await resolveTranslations()\n    return translate\n  } catch {\n    return createFallbackTranslator({})\n  }\n}\n\nexport function isPaymentOrderTotalResolver(candidate: unknown): candidate is PaymentOrderTotalResolver {\n  return !!candidate\n    && typeof candidate === 'object'\n    && typeof (candidate as PaymentOrderTotalResolver).resolveOrderTotal === 'function'\n}\n\nexport function assertSessionAmountMatchesOrderTotal(\n  requested: { orderId: string; amount: number; currencyCode: string },\n  orderTotal: PaymentOrderTotal,\n  translate: TranslateWithFallbackFn,\n): void {\n  if (normalizeCurrencyCode(requested.currencyCode) !== normalizeCurrencyCode(orderTotal.currencyCode)) {\n    throw conflict(translate(\n      'payment_gateways.errors.sessionCurrencyMismatch',\n      'Payment session currency {currencyCode} does not match the currency of order {orderId}',\n      { currencyCode: normalizeCurrencyCode(requested.currencyCode), orderId: requested.orderId },\n    ))\n  }\n  if (Math.abs(requested.amount - orderTotal.amountDue) > AMOUNT_TOLERANCE) {\n    throw conflict(translate(\n      'payment_gateways.errors.sessionAmountMismatch',\n      'Payment session amount {amount} does not match the amount due for order {orderId}',\n      { amount: requested.amount, orderId: requested.orderId },\n    ))\n  }\n}\n\n/**\n * Reconciles a caller-supplied session amount against the authoritative amount\n * due for the referenced order. Reconciliation is skipped when the request\n * references no order, or when no module registered a resolver (for example an\n * installation without the `sales` module) \u2014 there is nothing authoritative to\n * compare against in either case. A referenced order that does not resolve\n * inside the caller's tenant/organization scope is rejected exactly like an\n * unknown one, so the response never reveals whether it exists elsewhere.\n */\nexport async function reconcileSessionAmountWithOrder(input: {\n  orderId?: string\n  amount: number\n  currencyCode: string\n  scope: PaymentGatewayScope\n  resolver?: PaymentOrderTotalResolver | null\n}): Promise<void> {\n  const { orderId, resolver } = input\n  if (!orderId || !resolver) return\n\n  const orderTotal = await resolver.resolveOrderTotal(orderId, input.scope)\n  const translate = await resolveConflictTranslator()\n  if (!orderTotal) {\n    throw conflict(translate(\n      'payment_gateways.errors.sessionOrderNotFound',\n      'Order {orderId} was not found in the current scope',\n      { orderId },\n    ))\n  }\n\n  assertSessionAmountMatchesOrderTotal(\n    { orderId, amount: input.amount, currencyCode: input.currencyCode },\n    orderTotal,\n    translate,\n  )\n}\n"],
+  "mappings": "AAAA,SAAS,gBAAgB;AACzB,SAAS,2BAA2B;AACpC,SAAS,gCAA8D;AAQvE,MAAM,mBAAmB;AAEzB,SAAS,sBAAsB,cAA8B;AAC3D,SAAO,aAAa,KAAK,EAAE,YAAY;AACzC;AAQA,eAAe,4BAA8D;AAC3E,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,yBAAyB,CAAC,CAAC;AAAA,EACpC;AACF;AAEO,SAAS,4BAA4B,WAA4D;AACtG,SAAO,CAAC,CAAC,aACJ,OAAO,cAAc,YACrB,OAAQ,UAAwC,sBAAsB;AAC7E;AAEO,SAAS,qCACd,WACA,YACA,WACM;AACN,MAAI,sBAAsB,UAAU,YAAY,MAAM,sBAAsB,WAAW,YAAY,GAAG;AACpG,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,cAAc,sBAAsB,UAAU,YAAY,GAAG,SAAS,UAAU,QAAQ;AAAA,IAC5F,CAAC;AAAA,EACH;AACA,MAAI,KAAK,IAAI,UAAU,SAAS,WAAW,SAAS,IAAI,kBAAkB;AACxE,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,UAAU,QAAQ,SAAS,UAAU,QAAQ;AAAA,IACzD,CAAC;AAAA,EACH;AACF;AAWA,eAAsB,gCAAgC,OAMpC;AAChB,QAAM,EAAE,SAAS,SAAS,IAAI;AAC9B,MAAI,CAAC,WAAW,CAAC,SAAU;AAE3B,QAAM,aAAa,MAAM,SAAS,kBAAkB,SAAS,MAAM,KAAK;AACxE,QAAM,YAAY,MAAM,0BAA0B;AAClD,MAAI,CAAC,YAAY;AACf,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,QAAQ;AAAA,IACZ,CAAC;AAAA,EACH;AAEA;AAAA,IACE,EAAE,SAAS,QAAQ,MAAM,QAAQ,cAAc,MAAM,aAAa;AAAA,IAClE;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/payment_gateways/lib/payment-operation-idempotency.js

@@ -119,6 +119,7 @@ async function preparePaymentOperation(input) {
     attemptToken: claim.attemptToken,
     attemptCount: 1,
     result: null,
+    reservedAmount: null,
     leaseExpiresAt: claim.leaseExpiresAt,
     organizationId: input.scope.organizationId,
     tenantId: input.scope.tenantId,

package/dist/modules/payment_gateways/lib/payment-operation-idempotency.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/payment_gateways/lib/payment-operation-idempotency.ts"],
-  "sourcesContent": ["import { createHash, randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { GatewayPaymentOperation } from '../data/entities'\nimport type { ManualGatewayAction } from './status-machine'\n\ntype Scope = { organizationId: string; tenantId: string }\ntype OperationStatus = 'in_progress' | 'succeeded' | 'failed'\n\nconst OPERATION_LEASE_MS = 10 * 60 * 1000\nconst OPERATION_UNIQUE_CONSTRAINT = 'gateway_payment_operations_scope_operation_unique'\n\nexport type ClaimedPaymentOperation = {\n  record: GatewayPaymentOperation\n  attemptToken: string\n  providerIdempotencyKey: string\n}\n\nexport type PreparedPaymentOperation =\n  | { kind: 'completed'; result: Record<string, unknown> }\n  | { kind: 'claimed'; claim: ClaimedPaymentOperation }\n\ntype PreparePaymentOperationInput = {\n  em: EntityManager\n  transactionId: string\n  providerKey: string\n  action: ManualGatewayAction\n  operationId?: string\n  payload: Record<string, unknown>\n  scope: Scope\n  assertInitialAllowed: () => void\n}\n\nfunction digest(value: unknown): string {\n  return createHash('sha256').update(JSON.stringify(value)).digest('hex')\n}\n\nfunction operationConflict(code: string, operationId: string, message: string): CrudHttpError {\n  return new CrudHttpError(409, { error: message, code, operationId })\n}\n\nasync function findOperation(\n  em: EntityManager,\n  operationId: string,\n  scope: Scope,\n): Promise<GatewayPaymentOperation | null> {\n  return findOneWithDecryption(\n    em,\n    GatewayPaymentOperation,\n    {\n      operationId,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n}\n\nfunction buildOperationIdentity(input: Omit<PreparePaymentOperationInput, 'em' | 'assertInitialAllowed'>) {\n  const requestHash = digest({\n    transactionId: input.transactionId,\n    providerKey: input.providerKey,\n    action: input.action,\n    payload: input.payload,\n  })\n  const operationId = input.operationId ?? `auto_${requestHash}`\n  const providerIdempotencyKey = `om-pg-${digest({\n    tenantId: input.scope.tenantId,\n    organizationId: input.scope.organizationId,\n    transactionId: input.transactionId,\n    action: input.action,\n    operationId,\n  })}`\n  return { operationId, providerIdempotencyKey, requestHash }\n}\n\nfunction claimFields(now: Date) {\n  return {\n    status: 'in_progress' as OperationStatus,\n    attemptToken: randomUUID(),\n    leaseExpiresAt: new Date(now.getTime() + OPERATION_LEASE_MS),\n    updatedAt: now,\n  }\n}\n\nasync function resolveExistingOperation(\n  em: EntityManager,\n  existing: GatewayPaymentOperation,\n  identity: ReturnType<typeof buildOperationIdentity>,\n): Promise<PreparedPaymentOperation> {\n  if (existing.requestHash !== identity.requestHash) {\n    throw operationConflict(\n      'payment_operation_conflict',\n      identity.operationId,\n      'Payment operation id was already used with a different request',\n    )\n  }\n  if (existing.providerIdempotencyKey !== identity.providerIdempotencyKey) {\n    throw operationConflict(\n      'payment_operation_conflict',\n      identity.operationId,\n      'Payment operation id resolved to a different provider request',\n    )\n  }\n  if (existing.status === 'succeeded' && existing.result) {\n    return { kind: 'completed', result: existing.result }\n  }\n\n  const now = new Date()\n  const stale = existing.status === 'in_progress'\n    && existing.leaseExpiresAt instanceof Date\n    && existing.leaseExpiresAt <= now\n  if (existing.status !== 'failed' && !stale) {\n    throw operationConflict(\n      'payment_operation_in_progress',\n      identity.operationId,\n      'Payment operation is already in progress',\n    )\n  }\n\n  const next = claimFields(now)\n  const where = existing.status === 'failed'\n    ? { id: existing.id, status: 'failed', attemptToken: existing.attemptToken }\n    : { id: existing.id, status: 'in_progress', attemptToken: existing.attemptToken, leaseExpiresAt: { $lt: now } }\n  const claimed = await em.nativeUpdate(\n    GatewayPaymentOperation,\n    where,\n    { ...next, attemptCount: existing.attemptCount + 1 },\n  )\n  if (claimed !== 1) {\n    throw operationConflict(\n      'payment_operation_in_progress',\n      identity.operationId,\n      'Payment operation is already in progress',\n    )\n  }\n  Object.assign(existing, next, { attemptCount: existing.attemptCount + 1 })\n  return {\n    kind: 'claimed',\n    claim: {\n      record: existing,\n      attemptToken: next.attemptToken,\n      providerIdempotencyKey: existing.providerIdempotencyKey,\n    },\n  }\n}\n\nexport async function preparePaymentOperation(\n  input: PreparePaymentOperationInput,\n): Promise<PreparedPaymentOperation> {\n  const identity = buildOperationIdentity(input)\n  const existing = await findOperation(input.em, identity.operationId, input.scope)\n  if (existing) {\n    return resolveExistingOperation(input.em, existing, identity)\n  }\n\n  input.assertInitialAllowed()\n  const now = new Date()\n  const claim = claimFields(now)\n  const record = input.em.create(GatewayPaymentOperation, {\n    operationId: identity.operationId,\n    transactionId: input.transactionId,\n    operationType: input.action,\n    providerKey: input.providerKey,\n    requestHash: identity.requestHash,\n    providerIdempotencyKey: identity.providerIdempotencyKey,\n    status: claim.status,\n    attemptToken: claim.attemptToken,\n    attemptCount: 1,\n    result: null,\n    leaseExpiresAt: claim.leaseExpiresAt,\n    organizationId: input.scope.organizationId,\n    tenantId: input.scope.tenantId,\n    createdAt: now,\n    updatedAt: now,\n  })\n  try {\n    await input.em.persist(record).flush()\n    return {\n      kind: 'claimed',\n      claim: {\n        record,\n        attemptToken: claim.attemptToken,\n        providerIdempotencyKey: identity.providerIdempotencyKey,\n      },\n    }\n  } catch (error: unknown) {\n    if (!isUniqueViolation(error, OPERATION_UNIQUE_CONSTRAINT) && !isUniqueViolation(error)) {\n      throw error\n    }\n    const winner = await findOperation(input.em, identity.operationId, input.scope)\n    if (!winner) throw error\n    return resolveExistingOperation(input.em, winner, identity)\n  }\n}\n\nexport async function completePaymentOperation<T extends Record<string, unknown>>(\n  em: EntityManager,\n  claim: ClaimedPaymentOperation,\n  result: T,\n  applyResult: (tx: EntityManager) => Promise<boolean>,\n): Promise<boolean> {\n  const statusChanged = await em.transactional(async (tx) => {\n    const completed = await tx.nativeUpdate(\n      GatewayPaymentOperation,\n      { id: claim.record.id, status: 'in_progress', attemptToken: claim.attemptToken },\n      { status: 'succeeded', result, leaseExpiresAt: null, updatedAt: new Date() },\n    )\n    if (completed !== 1) {\n      throw operationConflict(\n        'payment_operation_claim_lost',\n        claim.record.operationId,\n        'Payment operation claim is no longer active',\n      )\n    }\n    const changed = await applyResult(tx)\n    await tx.flush()\n    return changed\n  })\n  Object.assign(claim.record, { status: 'succeeded', result, leaseExpiresAt: null })\n  return statusChanged\n}\n\nexport async function failPaymentOperation(\n  em: EntityManager,\n  claim: ClaimedPaymentOperation,\n): Promise<void> {\n  const failed = await em.nativeUpdate(\n    GatewayPaymentOperation,\n    { id: claim.record.id, status: 'in_progress', attemptToken: claim.attemptToken },\n    { status: 'failed', leaseExpiresAt: null, updatedAt: new Date() },\n  )\n  if (failed === 1) {\n    Object.assign(claim.record, { status: 'failed', leaseExpiresAt: null })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,kBAAkB;AAEvC,SAAS,eAAe,yBAAyB;AACjD,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AAMxC,MAAM,qBAAqB,KAAK,KAAK;AACrC,MAAM,8BAA8B;AAuBpC,SAAS,OAAO,OAAwB;AACtC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,OAAO,KAAK;AACxE;AAEA,SAAS,kBAAkB,MAAc,aAAqB,SAAgC;AAC5F,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,SAAS,MAAM,YAAY,CAAC;AACrE;AAEA,eAAe,cACb,IACA,aACA,OACyC;AACzC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,OAA0E;AACxG,QAAM,cAAc,OAAO;AAAA,IACzB,eAAe,MAAM;AAAA,IACrB,aAAa,MAAM;AAAA,IACnB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,QAAM,cAAc,MAAM,eAAe,QAAQ,WAAW;AAC5D,QAAM,yBAAyB,SAAS,OAAO;AAAA,IAC7C,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,eAAe,MAAM;AAAA,IACrB,QAAQ,MAAM;AAAA,IACd;AAAA,EACF,CAAC,CAAC;AACF,SAAO,EAAE,aAAa,wBAAwB,YAAY;AAC5D;AAEA,SAAS,YAAY,KAAW;AAC9B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,cAAc,WAAW;AAAA,IACzB,gBAAgB,IAAI,KAAK,IAAI,QAAQ,IAAI,kBAAkB;AAAA,IAC3D,WAAW;AAAA,EACb;AACF;AAEA,eAAe,yBACb,IACA,UACA,UACmC;AACnC,MAAI,SAAS,gBAAgB,SAAS,aAAa;AACjD,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,2BAA2B,SAAS,wBAAwB;AACvE,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,eAAe,SAAS,QAAQ;AACtD,WAAO,EAAE,MAAM,aAAa,QAAQ,SAAS,OAAO;AAAA,EACtD;AAEA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,QAAQ,SAAS,WAAW,iBAC7B,SAAS,0BAA0B,QACnC,SAAS,kBAAkB;AAChC,MAAI,SAAS,WAAW,YAAY,CAAC,OAAO;AAC1C,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,YAAY,GAAG;AAC5B,QAAM,QAAQ,SAAS,WAAW,WAC9B,EAAE,IAAI,SAAS,IAAI,QAAQ,UAAU,cAAc,SAAS,aAAa,IACzE,EAAE,IAAI,SAAS,IAAI,QAAQ,eAAe,cAAc,SAAS,cAAc,gBAAgB,EAAE,KAAK,IAAI,EAAE;AAChH,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,GAAG,MAAM,cAAc,SAAS,eAAe,EAAE;AAAA,EACrD;AACA,MAAI,YAAY,GAAG;AACjB,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,UAAU,MAAM,EAAE,cAAc,SAAS,eAAe,EAAE,CAAC;AACzE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,cAAc,KAAK;AAAA,MACnB,wBAAwB,SAAS;AAAA,IACnC;AAAA,EACF;AACF;AAEA,eAAsB,wBACpB,OACmC;AACnC,QAAM,WAAW,uBAAuB,KAAK;AAC7C,QAAM,WAAW,MAAM,cAAc,MAAM,IAAI,SAAS,aAAa,MAAM,KAAK;AAChF,MAAI,UAAU;AACZ,WAAO,yBAAyB,MAAM,IAAI,UAAU,QAAQ;AAAA,EAC9D;AAEA,QAAM,qBAAqB;AAC3B,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,QAAQ,YAAY,GAAG;AAC7B,QAAM,SAAS,MAAM,GAAG,OAAO,yBAAyB;AAAA,IACtD,aAAa,SAAS;AAAA,IACtB,eAAe,MAAM;AAAA,IACrB,eAAe,MAAM;AAAA,IACrB,aAAa,MAAM;AAAA,IACnB,aAAa,SAAS;AAAA,IACtB,wBAAwB,SAAS;AAAA,IACjC,QAAQ,MAAM;AAAA,IACd,cAAc,MAAM;AAAA,IACpB,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,gBAAgB,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,UAAU,MAAM,MAAM;AAAA,IACtB,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI;AACF,UAAM,MAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AACrC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,QACL;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,wBAAwB,SAAS;AAAA,MACnC;AAAA,IACF;AAAA,EACF,SAAS,OAAgB;AACvB,QAAI,CAAC,kBAAkB,OAAO,2BAA2B,KAAK,CAAC,kBAAkB,KAAK,GAAG;AACvF,YAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,cAAc,MAAM,IAAI,SAAS,aAAa,MAAM,KAAK;AAC9E,QAAI,CAAC,OAAQ,OAAM;AACnB,WAAO,yBAAyB,MAAM,IAAI,QAAQ,QAAQ;AAAA,EAC5D;AACF;AAEA,eAAsB,yBACpB,IACA,OACA,QACA,aACkB;AAClB,QAAM,gBAAgB,MAAM,GAAG,cAAc,OAAO,OAAO;AACzD,UAAM,YAAY,MAAM,GAAG;AAAA,MACzB;AAAA,MACA,EAAE,IAAI,MAAM,OAAO,IAAI,QAAQ,eAAe,cAAc,MAAM,aAAa;AAAA,MAC/E,EAAE,QAAQ,aAAa,QAAQ,gBAAgB,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC7E;AACA,QAAI,cAAc,GAAG;AACnB,YAAM;AAAA,QACJ;AAAA,QACA,MAAM,OAAO;AAAA,QACb;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,YAAY,EAAE;AACpC,UAAM,GAAG,MAAM;AACf,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,MAAM,QAAQ,EAAE,QAAQ,aAAa,QAAQ,gBAAgB,KAAK,CAAC;AACjF,SAAO;AACT;AAEA,eAAsB,qBACpB,IACA,OACe;AACf,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,IACA,EAAE,IAAI,MAAM,OAAO,IAAI,QAAQ,eAAe,cAAc,MAAM,aAAa;AAAA,IAC/E,EAAE,QAAQ,UAAU,gBAAgB,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,EAClE;AACA,MAAI,WAAW,GAAG;AAChB,WAAO,OAAO,MAAM,QAAQ,EAAE,QAAQ,UAAU,gBAAgB,KAAK,CAAC;AAAA,EACxE;AACF;",
+  "sourcesContent": ["import { createHash, randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { GatewayPaymentOperation } from '../data/entities'\nimport type { ManualGatewayAction } from './status-machine'\n\ntype Scope = { organizationId: string; tenantId: string }\ntype OperationStatus = 'in_progress' | 'succeeded' | 'failed'\n\nconst OPERATION_LEASE_MS = 10 * 60 * 1000\nconst OPERATION_UNIQUE_CONSTRAINT = 'gateway_payment_operations_scope_operation_unique'\n\nexport type ClaimedPaymentOperation = {\n  record: GatewayPaymentOperation\n  attemptToken: string\n  providerIdempotencyKey: string\n}\n\nexport type PreparedPaymentOperation =\n  | { kind: 'completed'; result: Record<string, unknown> }\n  | { kind: 'claimed'; claim: ClaimedPaymentOperation }\n\ntype PreparePaymentOperationInput = {\n  em: EntityManager\n  transactionId: string\n  providerKey: string\n  action: ManualGatewayAction\n  operationId?: string\n  payload: Record<string, unknown>\n  scope: Scope\n  assertInitialAllowed: () => void\n}\n\nfunction digest(value: unknown): string {\n  return createHash('sha256').update(JSON.stringify(value)).digest('hex')\n}\n\nfunction operationConflict(code: string, operationId: string, message: string): CrudHttpError {\n  return new CrudHttpError(409, { error: message, code, operationId })\n}\n\nasync function findOperation(\n  em: EntityManager,\n  operationId: string,\n  scope: Scope,\n): Promise<GatewayPaymentOperation | null> {\n  return findOneWithDecryption(\n    em,\n    GatewayPaymentOperation,\n    {\n      operationId,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n}\n\nfunction buildOperationIdentity(input: Omit<PreparePaymentOperationInput, 'em' | 'assertInitialAllowed'>) {\n  const requestHash = digest({\n    transactionId: input.transactionId,\n    providerKey: input.providerKey,\n    action: input.action,\n    payload: input.payload,\n  })\n  const operationId = input.operationId ?? `auto_${requestHash}`\n  const providerIdempotencyKey = `om-pg-${digest({\n    tenantId: input.scope.tenantId,\n    organizationId: input.scope.organizationId,\n    transactionId: input.transactionId,\n    action: input.action,\n    operationId,\n  })}`\n  return { operationId, providerIdempotencyKey, requestHash }\n}\n\nfunction claimFields(now: Date) {\n  return {\n    status: 'in_progress' as OperationStatus,\n    attemptToken: randomUUID(),\n    leaseExpiresAt: new Date(now.getTime() + OPERATION_LEASE_MS),\n    updatedAt: now,\n  }\n}\n\nasync function resolveExistingOperation(\n  em: EntityManager,\n  existing: GatewayPaymentOperation,\n  identity: ReturnType<typeof buildOperationIdentity>,\n): Promise<PreparedPaymentOperation> {\n  if (existing.requestHash !== identity.requestHash) {\n    throw operationConflict(\n      'payment_operation_conflict',\n      identity.operationId,\n      'Payment operation id was already used with a different request',\n    )\n  }\n  if (existing.providerIdempotencyKey !== identity.providerIdempotencyKey) {\n    throw operationConflict(\n      'payment_operation_conflict',\n      identity.operationId,\n      'Payment operation id resolved to a different provider request',\n    )\n  }\n  if (existing.status === 'succeeded' && existing.result) {\n    return { kind: 'completed', result: existing.result }\n  }\n\n  const now = new Date()\n  const stale = existing.status === 'in_progress'\n    && existing.leaseExpiresAt instanceof Date\n    && existing.leaseExpiresAt <= now\n  if (existing.status !== 'failed' && !stale) {\n    throw operationConflict(\n      'payment_operation_in_progress',\n      identity.operationId,\n      'Payment operation is already in progress',\n    )\n  }\n\n  const next = claimFields(now)\n  const where = existing.status === 'failed'\n    ? { id: existing.id, status: 'failed', attemptToken: existing.attemptToken }\n    : { id: existing.id, status: 'in_progress', attemptToken: existing.attemptToken, leaseExpiresAt: { $lt: now } }\n  const claimed = await em.nativeUpdate(\n    GatewayPaymentOperation,\n    where,\n    { ...next, attemptCount: existing.attemptCount + 1 },\n  )\n  if (claimed !== 1) {\n    throw operationConflict(\n      'payment_operation_in_progress',\n      identity.operationId,\n      'Payment operation is already in progress',\n    )\n  }\n  Object.assign(existing, next, { attemptCount: existing.attemptCount + 1 })\n  return {\n    kind: 'claimed',\n    claim: {\n      record: existing,\n      attemptToken: next.attemptToken,\n      providerIdempotencyKey: existing.providerIdempotencyKey,\n    },\n  }\n}\n\nexport async function preparePaymentOperation(\n  input: PreparePaymentOperationInput,\n): Promise<PreparedPaymentOperation> {\n  const identity = buildOperationIdentity(input)\n  const existing = await findOperation(input.em, identity.operationId, input.scope)\n  if (existing) {\n    return resolveExistingOperation(input.em, existing, identity)\n  }\n\n  input.assertInitialAllowed()\n  const now = new Date()\n  const claim = claimFields(now)\n  const record = input.em.create(GatewayPaymentOperation, {\n    operationId: identity.operationId,\n    transactionId: input.transactionId,\n    operationType: input.action,\n    providerKey: input.providerKey,\n    requestHash: identity.requestHash,\n    providerIdempotencyKey: identity.providerIdempotencyKey,\n    status: claim.status,\n    attemptToken: claim.attemptToken,\n    attemptCount: 1,\n    result: null,\n    reservedAmount: null,\n    leaseExpiresAt: claim.leaseExpiresAt,\n    organizationId: input.scope.organizationId,\n    tenantId: input.scope.tenantId,\n    createdAt: now,\n    updatedAt: now,\n  })\n  try {\n    await input.em.persist(record).flush()\n    return {\n      kind: 'claimed',\n      claim: {\n        record,\n        attemptToken: claim.attemptToken,\n        providerIdempotencyKey: identity.providerIdempotencyKey,\n      },\n    }\n  } catch (error: unknown) {\n    if (!isUniqueViolation(error, OPERATION_UNIQUE_CONSTRAINT) && !isUniqueViolation(error)) {\n      throw error\n    }\n    const winner = await findOperation(input.em, identity.operationId, input.scope)\n    if (!winner) throw error\n    return resolveExistingOperation(input.em, winner, identity)\n  }\n}\n\nexport async function completePaymentOperation<T extends Record<string, unknown>>(\n  em: EntityManager,\n  claim: ClaimedPaymentOperation,\n  result: T,\n  applyResult: (tx: EntityManager) => Promise<boolean>,\n): Promise<boolean> {\n  const statusChanged = await em.transactional(async (tx) => {\n    const completed = await tx.nativeUpdate(\n      GatewayPaymentOperation,\n      { id: claim.record.id, status: 'in_progress', attemptToken: claim.attemptToken },\n      { status: 'succeeded', result, leaseExpiresAt: null, updatedAt: new Date() },\n    )\n    if (completed !== 1) {\n      throw operationConflict(\n        'payment_operation_claim_lost',\n        claim.record.operationId,\n        'Payment operation claim is no longer active',\n      )\n    }\n    const changed = await applyResult(tx)\n    await tx.flush()\n    return changed\n  })\n  Object.assign(claim.record, { status: 'succeeded', result, leaseExpiresAt: null })\n  return statusChanged\n}\n\nexport async function failPaymentOperation(\n  em: EntityManager,\n  claim: ClaimedPaymentOperation,\n): Promise<void> {\n  const failed = await em.nativeUpdate(\n    GatewayPaymentOperation,\n    { id: claim.record.id, status: 'in_progress', attemptToken: claim.attemptToken },\n    { status: 'failed', leaseExpiresAt: null, updatedAt: new Date() },\n  )\n  if (failed === 1) {\n    Object.assign(claim.record, { status: 'failed', leaseExpiresAt: null })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,kBAAkB;AAEvC,SAAS,eAAe,yBAAyB;AACjD,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AAMxC,MAAM,qBAAqB,KAAK,KAAK;AACrC,MAAM,8BAA8B;AAuBpC,SAAS,OAAO,OAAwB;AACtC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,OAAO,KAAK;AACxE;AAEA,SAAS,kBAAkB,MAAc,aAAqB,SAAgC;AAC5F,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,SAAS,MAAM,YAAY,CAAC;AACrE;AAEA,eAAe,cACb,IACA,aACA,OACyC;AACzC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,OAA0E;AACxG,QAAM,cAAc,OAAO;AAAA,IACzB,eAAe,MAAM;AAAA,IACrB,aAAa,MAAM;AAAA,IACnB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,QAAM,cAAc,MAAM,eAAe,QAAQ,WAAW;AAC5D,QAAM,yBAAyB,SAAS,OAAO;AAAA,IAC7C,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,eAAe,MAAM;AAAA,IACrB,QAAQ,MAAM;AAAA,IACd;AAAA,EACF,CAAC,CAAC;AACF,SAAO,EAAE,aAAa,wBAAwB,YAAY;AAC5D;AAEA,SAAS,YAAY,KAAW;AAC9B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,cAAc,WAAW;AAAA,IACzB,gBAAgB,IAAI,KAAK,IAAI,QAAQ,IAAI,kBAAkB;AAAA,IAC3D,WAAW;AAAA,EACb;AACF;AAEA,eAAe,yBACb,IACA,UACA,UACmC;AACnC,MAAI,SAAS,gBAAgB,SAAS,aAAa;AACjD,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,2BAA2B,SAAS,wBAAwB;AACvE,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,eAAe,SAAS,QAAQ;AACtD,WAAO,EAAE,MAAM,aAAa,QAAQ,SAAS,OAAO;AAAA,EACtD;AAEA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,QAAQ,SAAS,WAAW,iBAC7B,SAAS,0BAA0B,QACnC,SAAS,kBAAkB;AAChC,MAAI,SAAS,WAAW,YAAY,CAAC,OAAO;AAC1C,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,YAAY,GAAG;AAC5B,QAAM,QAAQ,SAAS,WAAW,WAC9B,EAAE,IAAI,SAAS,IAAI,QAAQ,UAAU,cAAc,SAAS,aAAa,IACzE,EAAE,IAAI,SAAS,IAAI,QAAQ,eAAe,cAAc,SAAS,cAAc,gBAAgB,EAAE,KAAK,IAAI,EAAE;AAChH,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,GAAG,MAAM,cAAc,SAAS,eAAe,EAAE;AAAA,EACrD;AACA,MAAI,YAAY,GAAG;AACjB,UAAM;AAAA,MACJ;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,UAAU,MAAM,EAAE,cAAc,SAAS,eAAe,EAAE,CAAC;AACzE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,cAAc,KAAK;AAAA,MACnB,wBAAwB,SAAS;AAAA,IACnC;AAAA,EACF;AACF;AAEA,eAAsB,wBACpB,OACmC;AACnC,QAAM,WAAW,uBAAuB,KAAK;AAC7C,QAAM,WAAW,MAAM,cAAc,MAAM,IAAI,SAAS,aAAa,MAAM,KAAK;AAChF,MAAI,UAAU;AACZ,WAAO,yBAAyB,MAAM,IAAI,UAAU,QAAQ;AAAA,EAC9D;AAEA,QAAM,qBAAqB;AAC3B,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,QAAQ,YAAY,GAAG;AAC7B,QAAM,SAAS,MAAM,GAAG,OAAO,yBAAyB;AAAA,IACtD,aAAa,SAAS;AAAA,IACtB,eAAe,MAAM;AAAA,IACrB,eAAe,MAAM;AAAA,IACrB,aAAa,MAAM;AAAA,IACnB,aAAa,SAAS;AAAA,IACtB,wBAAwB,SAAS;AAAA,IACjC,QAAQ,MAAM;AAAA,IACd,cAAc,MAAM;AAAA,IACpB,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,UAAU,MAAM,MAAM;AAAA,IACtB,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI;AACF,UAAM,MAAM,GAAG,QAAQ,MAAM,EAAE,MAAM;AACrC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,QACL;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,wBAAwB,SAAS;AAAA,MACnC;AAAA,IACF;AAAA,EACF,SAAS,OAAgB;AACvB,QAAI,CAAC,kBAAkB,OAAO,2BAA2B,KAAK,CAAC,kBAAkB,KAAK,GAAG;AACvF,YAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,cAAc,MAAM,IAAI,SAAS,aAAa,MAAM,KAAK;AAC9E,QAAI,CAAC,OAAQ,OAAM;AACnB,WAAO,yBAAyB,MAAM,IAAI,QAAQ,QAAQ;AAAA,EAC5D;AACF;AAEA,eAAsB,yBACpB,IACA,OACA,QACA,aACkB;AAClB,QAAM,gBAAgB,MAAM,GAAG,cAAc,OAAO,OAAO;AACzD,UAAM,YAAY,MAAM,GAAG;AAAA,MACzB;AAAA,MACA,EAAE,IAAI,MAAM,OAAO,IAAI,QAAQ,eAAe,cAAc,MAAM,aAAa;AAAA,MAC/E,EAAE,QAAQ,aAAa,QAAQ,gBAAgB,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC7E;AACA,QAAI,cAAc,GAAG;AACnB,YAAM;AAAA,QACJ;AAAA,QACA,MAAM,OAAO;AAAA,QACb;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,YAAY,EAAE;AACpC,UAAM,GAAG,MAAM;AACf,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,MAAM,QAAQ,EAAE,QAAQ,aAAa,QAAQ,gBAAgB,KAAK,CAAC;AACjF,SAAO;AACT;AAEA,eAAsB,qBACpB,IACA,OACe;AACf,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,IACA,EAAE,IAAI,MAAM,OAAO,IAAI,QAAQ,eAAe,cAAc,MAAM,aAAa;AAAA,IAC/E,EAAE,QAAQ,UAAU,gBAAgB,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,EAClE;AACA,MAAI,WAAW,GAAG;AAChB,WAAO,OAAO,MAAM,QAAQ,EAAE,QAAQ,UAAU,gBAAgB,KAAK,CAAC;AAAA,EACxE;AACF;",
   "names": []
 }

package/dist/modules/payment_gateways/lib/session-idempotency.js

@@ -2,6 +2,9 @@ import { createHash, randomUUID } from "node:crypto";
 import { UniqueConstraintViolationException } from "@mikro-orm/core";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { GatewaySessionInitialization } from "../data/entities.js";
+const PAYMENT_SESSION_REPLAY_WINDOW_MS = 24 * 60 * 60 * 1e3;
+const PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE = "payment-gateway-session-initialization-prune";
+const PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE = 1e3;
 function buildPaymentSessionOperationKey(input) {
   const digest = createHash("sha256").update(JSON.stringify([
     input.scope.tenantId,
@@ -93,10 +96,40 @@ async function refreshPaymentSessionInitialization(em, ownership, scope, claimed
   );
   return refreshedRows > 0;
 }
+async function pruneCompletedPaymentSessionInitializations(em, scope, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const batchSize = options.batchSize ?? PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE;
+  if (!Number.isInteger(batchSize) || batchSize < 1) {
+    throw new Error("[internal] Payment-session initialization prune batch size must be a positive integer");
+  }
+  const cutoff = new Date(now.getTime() - PAYMENT_SESSION_REPLAY_WINDOW_MS);
+  const connection = em.getConnection();
+  const result = await connection.execute(
+    `
+    delete from gateway_session_initializations
+    where id in (
+      select id from gateway_session_initializations
+      where tenant_id = ?
+        and organization_id = ?
+        and gateway_transaction_id is not null
+        and updated_at < ?
+      order by updated_at asc
+      limit ?
+    )
+    `,
+    [scope.tenantId, scope.organizationId, cutoff, batchSize],
+    "run"
+  );
+  return result?.affectedRows ?? result?.rowCount ?? 0;
+}
 export {
+  PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE,
+  PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE,
+  PAYMENT_SESSION_REPLAY_WINDOW_MS,
   buildPaymentSessionOperationKey,
   claimPaymentSessionInitialization,
   findPaymentSessionInitialization,
+  pruneCompletedPaymentSessionInitializations,
   reclaimPaymentSessionInitialization,
   refreshPaymentSessionInitialization,
   releasePaymentSessionInitialization

package/dist/modules/payment_gateways/lib/session-idempotency.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/payment_gateways/lib/session-idempotency.ts"],
-  "sourcesContent": ["import { createHash, randomUUID } from 'node:crypto'\nimport { UniqueConstraintViolationException } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { GatewaySessionInitialization } from '../data/entities'\n\ntype Scope = { organizationId: string; tenantId: string }\n\nexport type OwnedPaymentSessionInitialization = {\n  id: string\n  claimToken: string\n}\n\nexport function buildPaymentSessionOperationKey(input: {\n  idempotencyKey: string\n  paymentId: string\n  providerKey: string\n  scope: Scope\n}): string {\n  const digest = createHash('sha256')\n    .update(JSON.stringify([\n      input.scope.tenantId,\n      input.scope.organizationId,\n      input.providerKey,\n      input.paymentId,\n      input.idempotencyKey,\n    ]))\n    .digest('hex')\n  return `om-payment-session:${digest}`\n}\n\nexport async function findPaymentSessionInitialization(\n  em: EntityManager,\n  operationKey: string,\n  providerKey: string,\n  scope: Scope,\n): Promise<GatewaySessionInitialization | null> {\n  return findOneWithDecryption(\n    em.fork(),\n    GatewaySessionInitialization,\n    {\n      operationKey,\n      providerKey,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n}\n\nexport async function claimPaymentSessionInitialization(\n  em: EntityManager,\n  operationKey: string,\n  providerKey: string,\n  scope: Scope,\n  claimedAt: Date,\n): Promise<OwnedPaymentSessionInitialization | null> {\n  const claimEm = em.fork()\n  const claimToken = randomUUID()\n  const record = claimEm.create(GatewaySessionInitialization, {\n    operationKey,\n    providerKey,\n    claimToken,\n    claimedAt,\n    gatewayTransactionId: null,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n  try {\n    await claimEm.persist(record).flush()\n    return { id: record.id, claimToken }\n  } catch (error: unknown) {\n    if (error instanceof UniqueConstraintViolationException) return null\n    throw error\n  }\n}\n\nexport async function reclaimPaymentSessionInitialization(\n  em: EntityManager,\n  claim: GatewaySessionInitialization,\n  scope: Scope,\n  claimedAt: Date,\n  staleBefore: Date,\n): Promise<OwnedPaymentSessionInitialization | null> {\n  const claimToken = randomUUID()\n  const claimedRows = await em.fork().nativeUpdate(\n    GatewaySessionInitialization,\n    {\n      id: claim.id,\n      operationKey: claim.operationKey,\n      providerKey: claim.providerKey,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      gatewayTransactionId: null,\n      $or: [\n        { claimToken: null },\n        { claimedAt: { $lt: staleBefore } },\n      ],\n    },\n    { claimToken, claimedAt, updatedAt: claimedAt },\n  )\n  return claimedRows > 0 ? { id: claim.id, claimToken } : null\n}\n\nexport async function releasePaymentSessionInitialization(\n  em: EntityManager,\n  ownership: OwnedPaymentSessionInitialization,\n  scope: Scope,\n): Promise<void> {\n  await em.fork().nativeUpdate(\n    GatewaySessionInitialization,\n    {\n      id: ownership.id,\n      claimToken: ownership.claimToken,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      gatewayTransactionId: null,\n    },\n    { claimToken: null, claimedAt: null, updatedAt: new Date() },\n  )\n}\n\nexport async function refreshPaymentSessionInitialization(\n  em: EntityManager,\n  ownership: OwnedPaymentSessionInitialization,\n  scope: Scope,\n  claimedAt: Date,\n): Promise<boolean> {\n  const refreshedRows = await em.fork().nativeUpdate(\n    GatewaySessionInitialization,\n    {\n      id: ownership.id,\n      claimToken: ownership.claimToken,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      gatewayTransactionId: null,\n    },\n    { claimedAt, updatedAt: claimedAt },\n  )\n  return refreshedRows > 0\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,kBAAkB;AACvC,SAAS,0CAA0C;AAEnD,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAStC,SAAS,gCAAgC,OAKrC;AACT,QAAM,SAAS,WAAW,QAAQ,EAC/B,OAAO,KAAK,UAAU;AAAA,IACrB,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC,CAAC,EACD,OAAO,KAAK;AACf,SAAO,sBAAsB,MAAM;AACrC;AAEA,eAAsB,iCACpB,IACA,cACA,aACA,OAC8C;AAC9C,SAAO;AAAA,IACL,GAAG,KAAK;AAAA,IACR;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,kCACpB,IACA,cACA,aACA,OACA,WACmD;AACnD,QAAM,UAAU,GAAG,KAAK;AACxB,QAAM,aAAa,WAAW;AAC9B,QAAM,SAAS,QAAQ,OAAO,8BAA8B;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBAAsB;AAAA,IACtB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,EAAE,MAAM;AACpC,WAAO,EAAE,IAAI,OAAO,IAAI,WAAW;AAAA,EACrC,SAAS,OAAgB;AACvB,QAAI,iBAAiB,mCAAoC,QAAO;AAChE,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,oCACpB,IACA,OACA,OACA,WACA,aACmD;AACnD,QAAM,aAAa,WAAW;AAC9B,QAAM,cAAc,MAAM,GAAG,KAAK,EAAE;AAAA,IAClC;AAAA,IACA;AAAA,MACE,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,sBAAsB;AAAA,MACtB,KAAK;AAAA,QACH,EAAE,YAAY,KAAK;AAAA,QACnB,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF;AAAA,IACA,EAAE,YAAY,WAAW,WAAW,UAAU;AAAA,EAChD;AACA,SAAO,cAAc,IAAI,EAAE,IAAI,MAAM,IAAI,WAAW,IAAI;AAC1D;AAEA,eAAsB,oCACpB,IACA,WACA,OACe;AACf,QAAM,GAAG,KAAK,EAAE;AAAA,IACd;AAAA,IACA;AAAA,MACE,IAAI,UAAU;AAAA,MACd,YAAY,UAAU;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,sBAAsB;AAAA,IACxB;AAAA,IACA,EAAE,YAAY,MAAM,WAAW,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,EAC7D;AACF;AAEA,eAAsB,oCACpB,IACA,WACA,OACA,WACkB;AAClB,QAAM,gBAAgB,MAAM,GAAG,KAAK,EAAE;AAAA,IACpC;AAAA,IACA;AAAA,MACE,IAAI,UAAU;AAAA,MACd,YAAY,UAAU;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,sBAAsB;AAAA,IACxB;AAAA,IACA,EAAE,WAAW,WAAW,UAAU;AAAA,EACpC;AACA,SAAO,gBAAgB;AACzB;",
+  "sourcesContent": ["import { createHash, randomUUID } from 'node:crypto'\nimport { UniqueConstraintViolationException } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { GatewaySessionInitialization } from '../data/entities'\n\ntype Scope = { organizationId: string; tenantId: string }\n\nexport const PAYMENT_SESSION_REPLAY_WINDOW_MS = 24 * 60 * 60 * 1000\nexport const PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE =\n  'payment-gateway-session-initialization-prune'\nexport const PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE = 1_000\n\nexport type OwnedPaymentSessionInitialization = {\n  id: string\n  claimToken: string\n}\n\nexport function buildPaymentSessionOperationKey(input: {\n  idempotencyKey: string\n  paymentId: string\n  providerKey: string\n  scope: Scope\n}): string {\n  const digest = createHash('sha256')\n    .update(JSON.stringify([\n      input.scope.tenantId,\n      input.scope.organizationId,\n      input.providerKey,\n      input.paymentId,\n      input.idempotencyKey,\n    ]))\n    .digest('hex')\n  return `om-payment-session:${digest}`\n}\n\nexport async function findPaymentSessionInitialization(\n  em: EntityManager,\n  operationKey: string,\n  providerKey: string,\n  scope: Scope,\n): Promise<GatewaySessionInitialization | null> {\n  return findOneWithDecryption(\n    em.fork(),\n    GatewaySessionInitialization,\n    {\n      operationKey,\n      providerKey,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n}\n\nexport async function claimPaymentSessionInitialization(\n  em: EntityManager,\n  operationKey: string,\n  providerKey: string,\n  scope: Scope,\n  claimedAt: Date,\n): Promise<OwnedPaymentSessionInitialization | null> {\n  const claimEm = em.fork()\n  const claimToken = randomUUID()\n  const record = claimEm.create(GatewaySessionInitialization, {\n    operationKey,\n    providerKey,\n    claimToken,\n    claimedAt,\n    gatewayTransactionId: null,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n  try {\n    await claimEm.persist(record).flush()\n    return { id: record.id, claimToken }\n  } catch (error: unknown) {\n    if (error instanceof UniqueConstraintViolationException) return null\n    throw error\n  }\n}\n\nexport async function reclaimPaymentSessionInitialization(\n  em: EntityManager,\n  claim: GatewaySessionInitialization,\n  scope: Scope,\n  claimedAt: Date,\n  staleBefore: Date,\n): Promise<OwnedPaymentSessionInitialization | null> {\n  const claimToken = randomUUID()\n  const claimedRows = await em.fork().nativeUpdate(\n    GatewaySessionInitialization,\n    {\n      id: claim.id,\n      operationKey: claim.operationKey,\n      providerKey: claim.providerKey,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      gatewayTransactionId: null,\n      $or: [\n        { claimToken: null },\n        { claimedAt: { $lt: staleBefore } },\n      ],\n    },\n    { claimToken, claimedAt, updatedAt: claimedAt },\n  )\n  return claimedRows > 0 ? { id: claim.id, claimToken } : null\n}\n\nexport async function releasePaymentSessionInitialization(\n  em: EntityManager,\n  ownership: OwnedPaymentSessionInitialization,\n  scope: Scope,\n): Promise<void> {\n  await em.fork().nativeUpdate(\n    GatewaySessionInitialization,\n    {\n      id: ownership.id,\n      claimToken: ownership.claimToken,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      gatewayTransactionId: null,\n    },\n    { claimToken: null, claimedAt: null, updatedAt: new Date() },\n  )\n}\n\nexport async function refreshPaymentSessionInitialization(\n  em: EntityManager,\n  ownership: OwnedPaymentSessionInitialization,\n  scope: Scope,\n  claimedAt: Date,\n): Promise<boolean> {\n  const refreshedRows = await em.fork().nativeUpdate(\n    GatewaySessionInitialization,\n    {\n      id: ownership.id,\n      claimToken: ownership.claimToken,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      gatewayTransactionId: null,\n    },\n    { claimedAt, updatedAt: claimedAt },\n  )\n  return refreshedRows > 0\n}\n\nexport async function pruneCompletedPaymentSessionInitializations(\n  em: EntityManager,\n  scope: Scope,\n  options: { now?: Date; batchSize?: number } = {},\n): Promise<number> {\n  const now = options.now ?? new Date()\n  const batchSize = options.batchSize ?? PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE\n  if (!Number.isInteger(batchSize) || batchSize < 1) {\n    throw new Error('[internal] Payment-session initialization prune batch size must be a positive integer')\n  }\n  const cutoff = new Date(now.getTime() - PAYMENT_SESSION_REPLAY_WINDOW_MS)\n  const connection = em.getConnection()\n  const result = await connection.execute(\n    `\n    delete from gateway_session_initializations\n    where id in (\n      select id from gateway_session_initializations\n      where tenant_id = ?\n        and organization_id = ?\n        and gateway_transaction_id is not null\n        and updated_at < ?\n      order by updated_at asc\n      limit ?\n    )\n    `,\n    [scope.tenantId, scope.organizationId, cutoff, batchSize],\n    'run',\n  ) as { affectedRows?: number; rowCount?: number } | undefined\n  return result?.affectedRows ?? result?.rowCount ?? 0\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,kBAAkB;AACvC,SAAS,0CAA0C;AAEnD,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAItC,MAAM,mCAAmC,KAAK,KAAK,KAAK;AACxD,MAAM,6CACX;AACK,MAAM,kDAAkD;AAOxD,SAAS,gCAAgC,OAKrC;AACT,QAAM,SAAS,WAAW,QAAQ,EAC/B,OAAO,KAAK,UAAU;AAAA,IACrB,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC,CAAC,EACD,OAAO,KAAK;AACf,SAAO,sBAAsB,MAAM;AACrC;AAEA,eAAsB,iCACpB,IACA,cACA,aACA,OAC8C;AAC9C,SAAO;AAAA,IACL,GAAG,KAAK;AAAA,IACR;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,kCACpB,IACA,cACA,aACA,OACA,WACmD;AACnD,QAAM,UAAU,GAAG,KAAK;AACxB,QAAM,aAAa,WAAW;AAC9B,QAAM,SAAS,QAAQ,OAAO,8BAA8B;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBAAsB;AAAA,IACtB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,EAAE,MAAM;AACpC,WAAO,EAAE,IAAI,OAAO,IAAI,WAAW;AAAA,EACrC,SAAS,OAAgB;AACvB,QAAI,iBAAiB,mCAAoC,QAAO;AAChE,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,oCACpB,IACA,OACA,OACA,WACA,aACmD;AACnD,QAAM,aAAa,WAAW;AAC9B,QAAM,cAAc,MAAM,GAAG,KAAK,EAAE;AAAA,IAClC;AAAA,IACA;AAAA,MACE,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,sBAAsB;AAAA,MACtB,KAAK;AAAA,QACH,EAAE,YAAY,KAAK;AAAA,QACnB,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF;AAAA,IACA,EAAE,YAAY,WAAW,WAAW,UAAU;AAAA,EAChD;AACA,SAAO,cAAc,IAAI,EAAE,IAAI,MAAM,IAAI,WAAW,IAAI;AAC1D;AAEA,eAAsB,oCACpB,IACA,WACA,OACe;AACf,QAAM,GAAG,KAAK,EAAE;AAAA,IACd;AAAA,IACA;AAAA,MACE,IAAI,UAAU;AAAA,MACd,YAAY,UAAU;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,sBAAsB;AAAA,IACxB;AAAA,IACA,EAAE,YAAY,MAAM,WAAW,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,EAC7D;AACF;AAEA,eAAsB,oCACpB,IACA,WACA,OACA,WACkB;AAClB,QAAM,gBAAgB,MAAM,GAAG,KAAK,EAAE;AAAA,IACpC;AAAA,IACA;AAAA,MACE,IAAI,UAAU;AAAA,MACd,YAAY,UAAU;AAAA,MACtB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,sBAAsB;AAAA,IACxB;AAAA,IACA,EAAE,WAAW,WAAW,UAAU;AAAA,EACpC;AACA,SAAO,gBAAgB;AACzB;AAEA,eAAsB,4CACpB,IACA,OACA,UAA8C,CAAC,GAC9B;AACjB,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAAG;AACjD,UAAM,IAAI,MAAM,uFAAuF;AAAA,EACzG;AACA,QAAM,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,gCAAgC;AACxE,QAAM,aAAa,GAAG,cAAc;AACpC,QAAM,SAAS,MAAM,WAAW;AAAA,IAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,CAAC,MAAM,UAAU,MAAM,gBAAgB,QAAQ,SAAS;AAAA,IACxD;AAAA,EACF;AACA,SAAO,QAAQ,gBAAgB,QAAQ,YAAY;AACrD;",
   "names": []
 }

package/dist/modules/payment_gateways/migrations/Migration20260725101500_payment_gateways.js

@@ -0,0 +1,16 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260725101500_payment_gateways extends Migration {
+  up() {
+    this.addSql(`alter table "gateway_transactions" add column "captured_amount" numeric(18,4) not null default '0';`);
+    this.addSql(`alter table "gateway_payment_operations" add column "reserved_amount" numeric(18,4) null;`);
+    this.addSql(`update "gateway_transactions" as t set "captured_amount" = coalesce((select sum((o."result"->>'capturedAmount')::numeric) from "gateway_payment_operations" as o where o."transaction_id" = t."id" and o."operation_type" = 'capture' and o."status" = 'succeeded'), case when t."unified_status" in ('captured', 'refunded', 'partially_refunded') then t."amount" else 0 end);`);
+  }
+  down() {
+    this.addSql(`alter table "gateway_payment_operations" drop column "reserved_amount";`);
+    this.addSql(`alter table "gateway_transactions" drop column "captured_amount";`);
+  }
+}
+export {
+  Migration20260725101500_payment_gateways
+};
+//# sourceMappingURL=Migration20260725101500_payment_gateways.js.map

package/dist/modules/payment_gateways/migrations/Migration20260725101500_payment_gateways.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/payment_gateways/migrations/Migration20260725101500_payment_gateways.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260725101500_payment_gateways extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`alter table \"gateway_transactions\" add column \"captured_amount\" numeric(18,4) not null default '0';`);\n    this.addSql(`alter table \"gateway_payment_operations\" add column \"reserved_amount\" numeric(18,4) null;`);\n    // Backfill the captured-to-date ledger from the succeeded capture operations, which are the\n    // only capture path since the payment operation ledger landed. Transactions captured before\n    // that (no succeeded capture rows) fall back to their full amount when their status says the\n    // money was taken. A historical `partially_captured` transaction has no recoverable captured\n    // amount, so it starts at 0 and can still be over-captured once.\n    this.addSql(`update \"gateway_transactions\" as t set \"captured_amount\" = coalesce((select sum((o.\"result\"->>'capturedAmount')::numeric) from \"gateway_payment_operations\" as o where o.\"transaction_id\" = t.\"id\" and o.\"operation_type\" = 'capture' and o.\"status\" = 'succeeded'), case when t.\"unified_status\" in ('captured', 'refunded', 'partially_refunded') then t.\"amount\" else 0 end);`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`alter table \"gateway_payment_operations\" drop column \"reserved_amount\";`);\n    this.addSql(`alter table \"gateway_transactions\" drop column \"captured_amount\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,iDAAiD,UAAU;AAAA,EAE7D,KAA2B;AAClC,SAAK,OAAO,qGAAqG;AACjH,SAAK,OAAO,2FAA2F;AAMvG,SAAK,OAAO,kXAAkX;AAAA,EAChY;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,yEAAyE;AACrF,SAAK,OAAO,mEAAmE;AAAA,EACjF;AAEF;",
+  "names": []
+}

package/dist/modules/payment_gateways/migrations/Migration20260803103035_payment_gateways.js

@@ -0,0 +1,18 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260803103035_payment_gateways extends Migration {
+  isTransactional() {
+    return false;
+  }
+  up() {
+    this.addSql(
+      'create index concurrently if not exists "gateway_session_initializations_prune_idx" on "gateway_session_initializations" ("tenant_id", "organization_id", "updated_at") where "gateway_transaction_id" is not null;'
+    );
+  }
+  down() {
+    this.addSql('drop index concurrently if exists "gateway_session_initializations_prune_idx";');
+  }
+}
+export {
+  Migration20260803103035_payment_gateways
+};
+//# sourceMappingURL=Migration20260803103035_payment_gateways.js.map

package/dist/modules/payment_gateways/migrations/Migration20260803103035_payment_gateways.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/payment_gateways/migrations/Migration20260803103035_payment_gateways.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations'\n\nexport class Migration20260803103035_payment_gateways extends Migration {\n  override isTransactional(): boolean {\n    return false\n  }\n\n  override up(): void | Promise<void> {\n    this.addSql(\n      'create index concurrently if not exists \"gateway_session_initializations_prune_idx\" on \"gateway_session_initializations\" (\"tenant_id\", \"organization_id\", \"updated_at\") where \"gateway_transaction_id\" is not null;',\n    )\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql('drop index concurrently if exists \"gateway_session_initializations_prune_idx\";')\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,iDAAiD,UAAU;AAAA,EAC7D,kBAA2B;AAClC,WAAO;AAAA,EACT;AAAA,EAES,KAA2B;AAClC,SAAK;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,gFAAgF;AAAA,EAC9F;AACF;",
+  "names": []
+}

package/dist/modules/payment_gateways/setup.js

@@ -1,13 +1,60 @@
+import { createHash } from "node:crypto";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE } from "./lib/session-idempotency.js";
+const logger = createLogger("payment_gateways");
+function stableScheduleUuid(stableKey) {
+  const hex = createHash("sha256").update(stableKey).digest("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+async function registerSessionInitializationPruneSchedule(container, scope) {
+  if (!container) return false;
+  const cradle = container;
+  if (typeof cradle.hasRegistration !== "function" || !cradle.hasRegistration("schedulerService")) {
+    return false;
+  }
+  const schedulerService = container.resolve("schedulerService");
+  await schedulerService.register({
+    id: stableScheduleUuid(
+      `payment_gateways:session-initialization-prune:${scope.tenantId}:${scope.organizationId}`
+    ),
+    name: "Payment-session initialization prune",
+    description: "Delete completed payment-session initialization claims after the 24-hour replay window.",
+    scopeType: "organization",
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    scheduleType: "interval",
+    scheduleValue: "24h",
+    timezone: "UTC",
+    targetType: "queue",
+    targetQueue: PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE,
+    targetPayload: scope,
+    sourceType: "module",
+    sourceModule: "payment_gateways",
+    isEnabled: true
+  });
+  return true;
+}
+async function ensureSessionInitializationPruneSchedule(container, scope) {
+  try {
+    await registerSessionInitializationPruneSchedule(container, scope);
+  } catch (error) {
+    logger.warn("Failed to register payment-session initialization prune schedule", { err: error });
+  }
+}
 const setup = {
   defaultRoleFeatures: {
     superadmin: ["payment_gateways.*"],
     admin: ["payment_gateways.*"],
     employee: ["payment_gateways.view"]
+  },
+  async seedDefaults({ container, tenantId, organizationId }) {
+    await ensureSessionInitializationPruneSchedule(container, { tenantId, organizationId });
   }
 };
 var setup_default = setup;
 export {
   setup_default as default,
+  registerSessionInitializationPruneSchedule,
   setup
 };
 //# sourceMappingURL=setup.js.map

package/dist/modules/payment_gateways/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/payment_gateways/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['payment_gateways.*'],\n    admin: ['payment_gateways.*'],\n    employee: ['payment_gateways.view'],\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,oBAAoB;AAAA,IACjC,OAAO,CAAC,oBAAoB;AAAA,IAC5B,UAAU,CAAC,uBAAuB;AAAA,EACpC;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE } from './lib/session-idempotency'\n\ntype SchedulerServiceLike = {\n  register: (registration: Record<string, unknown>) => Promise<void>\n}\n\nconst logger = createLogger('payment_gateways')\n\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nexport async function registerSessionInitializationPruneSchedule(\n  container: import('awilix').AwilixContainer | undefined,\n  scope: { tenantId: string; organizationId: string },\n): Promise<boolean> {\n  if (!container) return false\n  const cradle = container as { hasRegistration?: (name: string) => boolean }\n  if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) {\n    return false\n  }\n\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n  await schedulerService.register({\n    id: stableScheduleUuid(\n      `payment_gateways:session-initialization-prune:${scope.tenantId}:${scope.organizationId}`,\n    ),\n    name: 'Payment-session initialization prune',\n    description: 'Delete completed payment-session initialization claims after the 24-hour replay window.',\n    scopeType: 'organization',\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    scheduleType: 'interval',\n    scheduleValue: '24h',\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE,\n    targetPayload: scope,\n    sourceType: 'module',\n    sourceModule: 'payment_gateways',\n    isEnabled: true,\n  })\n  return true\n}\n\nasync function ensureSessionInitializationPruneSchedule(\n  container: import('awilix').AwilixContainer | undefined,\n  scope: { tenantId: string; organizationId: string },\n): Promise<void> {\n  try {\n    await registerSessionInitializationPruneSchedule(container, scope)\n  } catch (error) {\n    logger.warn('Failed to register payment-session initialization prune schedule', { err: error })\n  }\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['payment_gateways.*'],\n    admin: ['payment_gateways.*'],\n    employee: ['payment_gateways.view'],\n  },\n\n  async seedDefaults({ container, tenantId, organizationId }) {\n    await ensureSessionInitializationPruneSchedule(container, { tenantId, organizationId })\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAE7B,SAAS,kDAAkD;AAM3D,MAAM,SAAS,aAAa,kBAAkB;AAE9C,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,eAAsB,2CACpB,WACA,OACkB;AAClB,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,GAAG;AAC/F,WAAO;AAAA,EACT;AAEA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,MACF,iDAAiD,MAAM,QAAQ,IAAI,MAAM,cAAc;AAAA,IACzF;AAAA,IACA,MAAM;AAAA,IACN,aAAa;AAAA,IACb,WAAW;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,cAAc;AAAA,IACd,eAAe;AAAA,IACf,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACD,SAAO;AACT;AAEA,eAAe,yCACb,WACA,OACe;AACf,MAAI;AACF,UAAM,2CAA2C,WAAW,KAAK;AAAA,EACnE,SAAS,OAAO;AACd,WAAO,KAAK,oEAAoE,EAAE,KAAK,MAAM,CAAC;AAAA,EAChG;AACF;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,oBAAoB;AAAA,IACjC,OAAO,CAAC,oBAAoB;AAAA,IAC5B,UAAU,CAAC,uBAAuB;AAAA,EACpC;AAAA,EAEA,MAAM,aAAa,EAAE,WAAW,UAAU,eAAe,GAAG;AAC1D,UAAM,yCAAyC,WAAW,EAAE,UAAU,eAAe,CAAC;AAAA,EACxF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }