@openlup/platform 0.20.0 → 0.21.0

package/dist/payments/stripe/stripeSandboxPaymentExecutionAdapter.js

@@ -0,0 +1,220 @@
+import { failureEvidencePayload } from "./paymentFailureEvidence.js";
+import { declineFromError, declinedExecutionFacts } from "./executionDecline.js";
+import { noIssuerWasAsked } from "./stripeIntentConfirmationEvidence.js";
+/** The one place this adapter spells its own provider identity. */
+export const PROVIDER_KIND = "stripe";
+export function createStripeSandboxPaymentExecutionAdapter({ client, defaultFlow = "one_time_payment", }) {
+    return {
+        async execute(input) {
+            const flow = stripeFlow(input.providerFlow ?? defaultFlow);
+            // A reusable-mandate PaymentIntent (setup_future_usage) requires a Stripe
+            // Customer. Ensure-or-create one for the client when none was passed.
+            let customerRef = input.customerRef;
+            if (!customerRef && input.saveForFutureUse && input.clientId && client.ensureCustomer) {
+                customerRef = await client.ensureCustomer({ clientId: input.clientId, metadata: { clientId: input.clientId } }, 
+                // A provider attempt is per click; a Stripe Customer is per OpenLup
+                // client. A stable key avoids orphan Customers when checkout recovery
+                // is reloaded before the first method webhook stores the reference.
+                { idempotencyKey: `openlup:stripe:customer:${input.clientId}` });
+            }
+            const created = flow === "setup_reusable_method"
+                ? await client.createSetupIntent({
+                    customer: customerRef,
+                    paymentMethod: input.paymentMethodRef,
+                    usage: "off_session",
+                    metadata: metadataFor(input, flow),
+                }, { idempotencyKey: input.providerIdempotencyKey })
+                : await client.createPaymentIntent({
+                    amount: input.amountMinor,
+                    currency: input.currency.toLowerCase(),
+                    customer: customerRef,
+                    paymentMethod: input.paymentMethodRef,
+                    offSession: flow === "off_session_payment" ? true : undefined,
+                    setupFutureUsage: input.saveForFutureUse ? "off_session" : undefined,
+                    metadata: metadataFor(input, flow),
+                }, { idempotencyKey: input.providerIdempotencyKey }).catch((error) => {
+                    // An off-session charge is confirmed inside this call, so the payer's
+                    // issuer can refuse it here and nowhere else. That refusal is a FACT,
+                    // not an ambiguous call: rethrowing it makes the renewal orchestrator
+                    // record an indeterminate outcome, which applies no result, opens no
+                    // dunning case and tells the customer nothing. Every other error class
+                    // — network, auth, config, rate limit — keeps throwing, because after
+                    // those the charge may still have been accepted and only the
+                    // fail-closed path is safe.
+                    const decline = flow === "off_session_payment" ? declineFromError(error) : null;
+                    if (!decline)
+                        throw error;
+                    return decline;
+                });
+            if ("decline" in created)
+                return { ...executionResultBase(input, flow), ...declinedExecutionFacts(created) };
+            const intent = created;
+            return {
+                ...executionResultBase(input, flow),
+                providerAttemptId: intent.id,
+                providerSessionId: intent.id,
+                attemptStatus: attemptStatusFromStripe(intent),
+                nextActionKind: nextActionKindFromStripe(intent),
+                // `clientSecret` is the single canonical exit for the FE to confirm with
+                // the provider's browser SDK. It MUST NOT be persisted or duplicated
+                // into `responsePayload` (the latter is logged); the consumer reads it
+                // once from the top-level result and discards.
+                clientSecret: intent.client_secret ?? null,
+                customerProviderRef: intent.customer ?? null,
+                paymentMethodRef: intent.payment_method ?? null,
+                webhookExpected: true,
+                recoveryRequired: intent.status === "requires_action" && flow === "off_session_payment",
+                responsePayload: {
+                    providerStatus: intent.status,
+                    providerAttemptId: intent.id,
+                    providerSessionIdPresent: Boolean(intent.client_secret),
+                    latestChargePresent: Boolean(intent.latest_charge),
+                    customerRefPresent: Boolean(intent.customer),
+                    paymentMethodRefPresent: Boolean(intent.payment_method),
+                    ...failureEvidencePayload(intent.diagnosticFailureEvidence),
+                },
+            };
+        },
+    };
+}
+export function parseStripePaymentWebhookEvent(rawPayload) {
+    const eventId = readString(rawPayload, "id");
+    const eventType = readString(rawPayload, "type");
+    const data = readObject(rawPayload, "data");
+    const object = readObject(data, "object");
+    const providerPaymentId = readString(object, "id");
+    const amount = readOptionalNumber(object, "amount_received") ?? readOptionalNumber(object, "amount");
+    const currency = readOptionalString(object, "currency")?.toUpperCase();
+    return {
+        provider_event_id: eventId,
+        event_type: canonicalStripeEventType(eventType, object),
+        payment_provider_id: providerPaymentId,
+        amount_minor: amount,
+        next_action_kind: nextActionKindFromStripe({
+            status: readOptionalString(object, "status") ?? "",
+            next_action: readOptionalObject(object, "next_action"),
+        }) ?? undefined,
+        raw_payload: {
+            provider: PROVIDER_KIND,
+            eventId,
+            eventType,
+            providerPaymentId,
+            amountMinor: amount,
+            currency,
+        },
+    };
+}
+/** The facts every result of this adapter carries, whatever the provider answered. */
+function executionResultBase(input, flow) {
+    return {
+        provider: PROVIDER_KIND,
+        requestPayload: {
+            providerIdempotencyKey: input.providerIdempotencyKey,
+            providerRequestFingerprint: input.providerRequestFingerprint,
+            providerFlow: flow,
+            amountMinor: input.amountMinor,
+            currency: input.currency,
+            orderRef: input.orderRef,
+        },
+    };
+}
+function stripeFlow(flow) {
+    if (flow === "one_time_payment" || flow === "setup_reusable_method" || flow === "off_session_payment") {
+        return flow;
+    }
+    throw new Error(`Unsupported Stripe provider flow: ${flow}`);
+}
+function metadataFor(input, flow) {
+    const metadata = {
+        source: "openlup.payment-control",
+        paymentIntentId: input.paymentIntentId,
+        orderRef: input.orderRef,
+        providerRequestFingerprint: input.providerRequestFingerprint,
+        providerFlow: flow,
+    };
+    if (input.clientId)
+        metadata.clientId = input.clientId;
+    if (input.mode === "subscription_cycle")
+        metadata.mode = input.mode;
+    return metadata;
+}
+/**
+ * What the durable attempt row is allowed to claim about this execution.
+ *
+ * Takes the intent, not just its status, because the two states sharing
+ * `requires_payment_method` differ only in what else is on the object: a fresh
+ * intent the payer never confirmed, and one an issuer has just refused (which
+ * carries a payment error and usually a charge).
+ *
+ * `processing` claims money is moving, and a catch-all used to reach it — so a
+ * never-confirmed intent was recorded as a charge in flight, and a payer was
+ * told their payment was already processing when no issuer had been asked.
+ * `sent_to_provider` is the truth: the request reached the provider, no outcome
+ * is known. It belongs to every live-attempt set the platform keeps, so the
+ * correction costs no watchdog coverage, and it is fail-closed at the
+ * provider-attempt admission gate exactly as `processing` is — admission does
+ * not widen by one state.
+ *
+ * The catch-all stays `processing` on purpose: an unrecognised provider status is
+ * not evidence that nothing happened.
+ */
+function attemptStatusFromStripe(intent) {
+    if (intent.status === "requires_action" || intent.status === "requires_confirmation") {
+        return "requires_action";
+    }
+    if (noIssuerWasAsked(intent))
+        return "sent_to_provider";
+    return "processing";
+}
+function nextActionKindFromStripe(intent) {
+    if (intent.status !== "requires_action" && intent.status !== "requires_confirmation")
+        return null;
+    if (intent.next_action?.type === "redirect_to_url")
+        return "redirect";
+    if (intent.next_action?.type === "use_stripe_sdk")
+        return "3ds_challenge";
+    return "sca_required";
+}
+function canonicalStripeEventType(stripeEventType, object) {
+    if (stripeEventType === "payment_intent.succeeded")
+        return "payment.succeeded";
+    if (stripeEventType === "payment_intent.payment_failed" || stripeEventType === "payment_intent.canceled") {
+        return "payment.failed";
+    }
+    if (stripeEventType === "payment_intent.requires_action")
+        return "payment.requires_action";
+    if (stripeEventType === "charge.refunded")
+        return "payment.refunded";
+    if (stripeEventType.startsWith("charge.dispute."))
+        return "payment.disputed";
+    const status = readOptionalString(object, "status");
+    if (status === "requires_action")
+        return "payment.requires_action";
+    throw new Error(`Unsupported Stripe webhook event: ${stripeEventType}`);
+}
+function readObject(value, key) {
+    const raw = value[key];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error(`Stripe payload missing object ${key}`);
+    }
+    return raw;
+}
+function readOptionalObject(value, key) {
+    const raw = value[key];
+    return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+}
+function readString(value, key) {
+    const raw = value[key];
+    if (typeof raw !== "string" || raw.length === 0) {
+        throw new Error(`Stripe payload missing string ${key}`);
+    }
+    return raw;
+}
+function readOptionalString(value, key) {
+    const raw = value[key];
+    return typeof raw === "string" && raw.length > 0 ? raw : undefined;
+}
+function readOptionalNumber(value, key) {
+    const raw = value[key];
+    return typeof raw === "number" ? raw : undefined;
+}

package/dist/payments/stripe/stripeWebhookNormalizer.d.ts

@@ -0,0 +1,14 @@
+import { type ProviderWebhookWithMethodLifecycle } from "./methodFacts.js";
+/**
+ * Convert a verified raw Stripe webhook payload into the plural handler's
+ * `NormalizedProviderPaymentWebhook` shape.
+ *
+ * Reusable method extraction (Wave C): populated for `setup_intent.succeeded`
+ * always, and for `payment_intent.succeeded` when `setup_future_usage` was
+ * requested at PaymentIntent creation. Requires `metadata.clientId` to be set
+ * (the adapter does this when the runtime caller passes `clientId` through
+ * `PaymentExecutionInput`). When metadata is missing, `reusableMethod` stays
+ * null and the plural handler skips the method-ref upsert — safe degradation
+ * rather than crashing the webhook.
+ */
+export declare function normalizeStripeWebhookEvent(rawPayload: Record<string, unknown>): ProviderWebhookWithMethodLifecycle;

package/dist/payments/stripe/stripeWebhookNormalizer.js

@@ -0,0 +1,243 @@
+import { stripeWebhookPayload } from "./stripeFailureEvidence.js";
+import { stripeRefundEvidence } from "./stripeRefundEvidence.js";
+import { expiryInstantFromMonthYear } from "@openlup/core/payment";
+import { methodFactSnapshotKeys } from "./methodFacts.js";
+const PROVIDER_KIND = "stripe";
+const METHOD_LIFECYCLE_EVENTS = {
+    "payment_method.attached": { kind: "method_registered", canonical: "setup.succeeded" },
+    "payment_method.automatically_updated": { kind: "method_updated", canonical: "setup.succeeded" },
+    "payment_method.detached": { kind: "method_revoked", canonical: "setup.failed" },
+};
+const SUPPORTED_EVENT_TYPES = new Set([
+    "payment.requires_action",
+    "payment.succeeded",
+    "payment.failed",
+    "payment.refunded",
+    "payment.disputed",
+    "setup.succeeded",
+    "setup.failed",
+    "setup.requires_action",
+]);
+/**
+ * Convert a verified raw Stripe webhook payload into the plural handler's
+ * `NormalizedProviderPaymentWebhook` shape.
+ *
+ * Reusable method extraction (Wave C): populated for `setup_intent.succeeded`
+ * always, and for `payment_intent.succeeded` when `setup_future_usage` was
+ * requested at PaymentIntent creation. Requires `metadata.clientId` to be set
+ * (the adapter does this when the runtime caller passes `clientId` through
+ * `PaymentExecutionInput`). When metadata is missing, `reusableMethod` stays
+ * null and the plural handler skips the method-ref upsert — safe degradation
+ * rather than crashing the webhook.
+ */
+export function normalizeStripeWebhookEvent(rawPayload) {
+    const providerEventId = readString(rawPayload, "id");
+    const eventType = readString(rawPayload, "type");
+    const data = readObject(rawPayload, "data");
+    const object = readObject(data, "object");
+    const canonicalEventType = mapStripeEventType(eventType, object);
+    const providerPaymentId = resolveLinkagePaymentId(eventType, object);
+    // Payment-control compares this against the intent's `amount_cents` (the order
+    // total) as a tamper guard, so we want the PaymentIntent's authorized `amount`,
+    // not `amount_received`. On a declined/canceled PI Stripe reports
+    // `amount_received: 0` while `amount` still holds the full total — and `??`
+    // does NOT treat `0` as nullish, so reading `amount_received` first yielded a
+    // `0` that tripped the amount-mismatch guard and left every failed event
+    // unreconciled (intent stuck `processing`, inventory holds leaked). Prefer
+    // `amount`; fall back to `amount_received` only when `amount` is absent.
+    const amountMinor = readOptionalNumber(object, "amount") ??
+        readOptionalNumber(object, "amount_received") ??
+        null;
+    const currency = readOptionalString(object, "currency")?.toUpperCase() ?? null;
+    const occurredAt = readOccurredAt(rawPayload);
+    const reusableMethod = extractReusableMethod(canonicalEventType, object);
+    const refund = stripeRefundEvidence(eventType, object);
+    return {
+        provider: PROVIDER_KIND,
+        providerEventId,
+        eventType: canonicalEventType,
+        providerPaymentId,
+        paymentIntentId: null,
+        paymentAttemptId: null,
+        amountMinor,
+        currency,
+        occurredAt,
+        refundKind: refund.refundKind,
+        rawPayload: {
+            ...stripeWebhookPayload({ eventId: providerEventId, eventType, providerPaymentId, amountMinor, currency }, object),
+            ...(refund.snapshot ? { stripeRefundSnapshot: refund.snapshot } : {}),
+        },
+        reusableMethod,
+        methodLifecycle: extractMethodLifecycle(eventType, object, providerEventId, occurredAt),
+    };
+}
+/** The neutral transition this delivery reports, or null when it reports none. */
+function extractMethodLifecycle(rawEventType, object, providerEventId, occurredAt) {
+    const mapping = METHOD_LIFECYCLE_EVENTS[rawEventType];
+    // On a method-family event the webhook object IS the method, so its own id is
+    // the reference the stored row is keyed by.
+    const providerMethodRef = readOptionalString(object, "id");
+    if (!mapping || !providerMethodRef)
+        return null;
+    const replacement = readMethodFacts(object);
+    return { kind: mapping.kind, providerKind: PROVIDER_KIND, providerMethodRef, providerEventId, occurredAt, replacement };
+}
+/**
+ * Scheme label, trailing digits and expiry, from whichever of the three shapes
+ * the payload carries them in: the method object itself at the top level, an
+ * expanded method one level down, or a charge-shaped object's method details.
+ * A payload carrying none of them yields null, not a row of empty facts.
+ */
+function readMethodFacts(object) {
+    const card = readOptionalObject(object, "card")
+        ?? readOptionalObject(readOptionalObject(object, "payment_method") ?? {}, "card")
+        ?? readOptionalObject(readOptionalObject(object, "payment_method_details") ?? {}, "card");
+    if (!card)
+        return null;
+    const schemeLabel = readOptionalString(card, "brand") ?? null;
+    const lastDigits = readOptionalString(card, "last4") ?? null;
+    const expiresAt = expiryInstantFromMonthYear(readOptionalNumber(card, "exp_month") ?? null, readOptionalNumber(card, "exp_year") ?? null);
+    if (!schemeLabel && !lastDigits && !expiresAt)
+        return null;
+    return { schemeLabel, lastDigits, expiresAt };
+}
+/**
+ * Resolve the provider payment id used to LINK this event to the local payment
+ * attempt. Payment-control matches inbound events to an attempt by
+ * `commerce_payment_attempts.provider_attempt_id`, which holds the Stripe
+ * PaymentIntent id (`pi_…`).
+ *
+ * For `payment_intent.*` events the webhook object IS the PaymentIntent, so its
+ * `id` is already the linkage key. For `charge.*` (incl. `charge.dispute.*`)
+ * the object is a Charge (`ch_…`) or Dispute (`dp_…`) whose own id never
+ * matches an attempt — but it carries `payment_intent` pointing back at the PI.
+ * Using that field is what lets `charge.refunded` / `charge.dispute.created`
+ * resolve to the order and drive `applyPaymentResult`; without it refunds and
+ * disputes were ingested but silently never applied. Falls back to the object
+ * id when `payment_intent` is absent (defensive — keeps the event recordable).
+ */
+function resolveLinkagePaymentId(stripeEventType, object) {
+    if (stripeEventType.startsWith("charge.")) {
+        const paymentIntentId = readOptionalString(object, "payment_intent");
+        if (paymentIntentId)
+            return paymentIntentId;
+    }
+    return readString(object, "id");
+}
+function mapStripeEventType(stripeEventType, object) {
+    if (stripeEventType === "payment_intent.succeeded")
+        return "payment.succeeded";
+    if (stripeEventType === "payment_intent.payment_failed")
+        return "payment.failed";
+    if (stripeEventType === "payment_intent.canceled")
+        return "payment.failed";
+    if (stripeEventType === "payment_intent.requires_action")
+        return "payment.requires_action";
+    if (stripeEventType === "setup_intent.succeeded")
+        return "setup.succeeded";
+    if (stripeEventType === "setup_intent.setup_failed")
+        return "setup.failed";
+    if (stripeEventType === "setup_intent.requires_action")
+        return "setup.requires_action";
+    if (stripeEventType === "charge.refunded")
+        return "payment.refunded";
+    if (stripeEventType.startsWith("charge.dispute."))
+        return "payment.disputed";
+    const methodLifecycle = METHOD_LIFECYCLE_EVENTS[stripeEventType];
+    if (methodLifecycle)
+        return methodLifecycle.canonical;
+    const status = readOptionalString(object, "status");
+    if (status === "requires_action")
+        return "payment.requires_action";
+    const guess = `payment.${stripeEventType}`;
+    if (SUPPORTED_EVENT_TYPES.has(guess))
+        return guess;
+    throw new Error(`Unsupported Stripe webhook event: ${stripeEventType}`);
+}
+function extractReusableMethod(canonicalEventType, object) {
+    const isSetupSucceeded = canonicalEventType === "setup.succeeded";
+    const isPaymentSucceededWithSaveCard = canonicalEventType === "payment.succeeded" &&
+        readOptionalString(object, "setup_future_usage") === "off_session";
+    if (!isSetupSucceeded && !isPaymentSucceededWithSaveCard)
+        return null;
+    const customer = readOptionalString(object, "customer");
+    // The method arrives as a bare id, or as an expanded object when the payload
+    // also carries its facts; both address the same stored method.
+    const paymentMethod = readOptionalString(object, "payment_method")
+        ?? readOptionalString(readOptionalObject(object, "payment_method") ?? {}, "id");
+    const metadata = readOptionalObject(object, "metadata");
+    const clientId = metadata ? readOptionalString(metadata, "clientId") : undefined;
+    const subscriptionId = metadata ? readOptionalString(metadata, "subscriptionId") : undefined;
+    const mode = metadata ? readOptionalString(metadata, "mode") : undefined;
+    const recoveryCaseId = metadata ? readOptionalString(metadata, "recoveryCaseId") : undefined;
+    const metadataSource = metadata ? readOptionalString(metadata, "source") : undefined;
+    if (!customer || !paymentMethod || !clientId)
+        return null;
+    return {
+        clientId,
+        // W11.7 Wave D-4a — recovery setup-method flow tags `subscriptionId` in
+        // SetupIntent metadata so this upsert binds the new method to the
+        // subscription the dunning case targets. One-time + initial save-card
+        // (Wave C) flows leave the field null because no subscription exists yet.
+        subscriptionId: subscriptionId ?? null,
+        providerCustomerRef: customer,
+        providerMethodRef: paymentMethod,
+        providerMandateRef: null,
+        methodKind: "card",
+        status: "active",
+        consentSnapshot: {
+            source: "stripe_webhook",
+            eventType: canonicalEventType,
+            checkoutMode: mode ?? null,
+            recoveryCaseId: recoveryCaseId ?? null,
+            metadataSource: metadataSource ?? null,
+            // Additive facts only, and only when the payload actually carried them.
+            // The setup event carries the method's id and nothing else, so this is
+            // usually empty there and filled later by the method-family delivery.
+            ...methodFactSnapshotKeys(readMethodFacts(object)),
+        },
+    };
+}
+function readOccurredAt(rawPayload) {
+    const created = rawPayload.created;
+    if (typeof created === "number" && Number.isFinite(created)) {
+        return new Date(created * 1000).toISOString();
+    }
+    if (typeof created === "string") {
+        const parsed = new Date(created);
+        if (!Number.isNaN(parsed.getTime()))
+            return parsed.toISOString();
+    }
+    // Stripe always sends `created` on event payloads; fall back defensively if
+    // missing rather than refusing the event — downstream RPC still records the
+    // signature-verified facts.
+    return new Date(0).toISOString();
+}
+function readObject(value, key) {
+    const raw = value[key];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error(`Stripe payload missing object ${key}`);
+    }
+    return raw;
+}
+function readOptionalObject(value, key) {
+    const raw = value[key];
+    return raw && typeof raw === "object" && !Array.isArray(raw)
+        ? raw
+        : null;
+}
+function readString(value, key) {
+    const raw = value[key];
+    if (typeof raw !== "string" || raw.length === 0) {
+        throw new Error(`Stripe payload missing string ${key}`);
+    }
+    return raw;
+}
+function readOptionalString(value, key) {
+    const raw = value[key];
+    return typeof raw === "string" && raw.length > 0 ? raw : undefined;
+}
+function readOptionalNumber(value, key) {
+    const raw = value[key];
+    return typeof raw === "number" ? raw : undefined;
+}

package/dist/payments/stripe/webhookSignature.d.ts

@@ -0,0 +1,14 @@
+export declare const STRIPE_TIMESTAMP_TOLERANCE_SECONDS = 300;
+export declare function verifyStripeSignature(input: {
+    rawBody: string;
+    signatureHeader: string | undefined;
+    /**
+     * One or many endpoint secrets to accept. Multi-secret support lets a single
+     * route accept signatures from both the dashboard webhook endpoint and a
+     * local `stripe listen` CLI tunnel; the signature is accepted if ANY secret
+     * verifies. An empty array (or missing single secret) fails closed.
+     */
+    endpointSecret: string | readonly string[];
+    /** Injectable clock (UTC seconds) for deterministic tests; defaults to now. */
+    now?: () => number;
+}): boolean;

package/dist/payments/stripe/webhookSignature.js

@@ -0,0 +1,43 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export const STRIPE_TIMESTAMP_TOLERANCE_SECONDS = 300;
+export function verifyStripeSignature(input) {
+    const parts = Object.fromEntries((input.signatureHeader ?? "")
+        .split(",")
+        .map((part) => part.split("="))
+        .filter(([key, value]) => key && value));
+    const timestamp = parts.t;
+    const signature = parts.v1;
+    if (!timestamp || !signature)
+        return false;
+    // Reject replays outside the tolerance window before doing the HMAC work. A
+    // valid signature on a stale timestamp (captured-and-replayed event) must not
+    // pass; the future-skew bound tolerates small clock drift between Stripe and us.
+    const timestampSec = Number(timestamp);
+    if (!Number.isFinite(timestampSec))
+        return false;
+    const now = input.now ?? (() => Math.floor(Date.now() / 1000));
+    const ageSec = now() - timestampSec;
+    if (ageSec > STRIPE_TIMESTAMP_TOLERANCE_SECONDS)
+        return false;
+    if (ageSec < -STRIPE_TIMESTAMP_TOLERANCE_SECONDS)
+        return false;
+    const secrets = Array.isArray(input.endpointSecret)
+        ? input.endpointSecret
+        : input.endpointSecret
+            ? [input.endpointSecret]
+            : [];
+    return secrets.some((secret) => {
+        if (!secret)
+            return false;
+        const expected = hmac(`${timestamp}.${input.rawBody}`, secret);
+        return timingSafeStringEqual(signature, expected);
+    });
+}
+function hmac(value, secret) {
+    return createHmac("sha256", secret).update(value).digest("hex");
+}
+function timingSafeStringEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}

package/dist/payments/tpay/blikRecurringMapper.d.ts

@@ -0,0 +1,37 @@
+export interface TpayBlikAliasRegistrationInput {
+    orderRef: string;
+    amountMinor: number;
+    currency: string;
+    customerEmail: string;
+    staticWebhookUrl: string;
+    consentRef: string;
+}
+export interface TpayBlikAliasChargeInput {
+    orderRef: string;
+    payId: string;
+    amountMinor: number;
+    currency: string;
+    staticWebhookUrl: string;
+}
+export declare function buildTpayBlikAliasRegistrationDraft(input: TpayBlikAliasRegistrationInput): {
+    provider: string;
+    requestKind: string;
+    orderRef: string;
+    amount: number;
+    currency: string;
+    customer: {
+        email: string;
+    };
+    webhookUrl: string;
+    consentRef: string;
+    fallbackRequiredWhenAliasUnavailable: boolean;
+};
+export declare function buildTpayBlikAliasChargeDraft(input: TpayBlikAliasChargeInput): {
+    provider: string;
+    requestKind: string;
+    orderRef: string;
+    payId: string;
+    amount: number;
+    currency: string;
+    webhookUrl: string;
+};

package/dist/payments/tpay/blikRecurringMapper.js

@@ -0,0 +1,24 @@
+export function buildTpayBlikAliasRegistrationDraft(input) {
+    return {
+        provider: "tpay",
+        requestKind: "blik_alias_registration",
+        orderRef: input.orderRef,
+        amount: input.amountMinor,
+        currency: input.currency,
+        customer: { email: input.customerEmail },
+        webhookUrl: input.staticWebhookUrl,
+        consentRef: input.consentRef,
+        fallbackRequiredWhenAliasUnavailable: true,
+    };
+}
+export function buildTpayBlikAliasChargeDraft(input) {
+    return {
+        provider: "tpay",
+        requestKind: "blik_alias_charge",
+        orderRef: input.orderRef,
+        payId: input.payId,
+        amount: input.amountMinor,
+        currency: input.currency,
+        webhookUrl: input.staticWebhookUrl,
+    };
+}

package/dist/payments/tpay/capabilities.d.ts

@@ -0,0 +1,3 @@
+import type { PaymentAdapterCapabilities } from "../contracts/index.js";
+/** Bank-redirect, one-time-code and unattended Model O attempts are supported with host payer/method input; account availability remains verification_pending. */
+export declare const tpayPaymentCapabilities: Readonly<PaymentAdapterCapabilities>;

package/dist/payments/tpay/capabilities.js

@@ -0,0 +1,18 @@
+/** Bank-redirect, one-time-code and unattended Model O attempts are supported with host payer/method input; account availability remains verification_pending. */
+export const tpayPaymentCapabilities = Object.freeze({
+    providerKind: "tpay",
+    captureFlows: Object.freeze([
+        Object.freeze({ kind: "bank_redirect", handoff: "redirect", methodFamilies: Object.freeze(["bank-redirect"]) }),
+        Object.freeze({ kind: "one_time_code", handoff: "customer-authorization", methodFamilies: Object.freeze(["one-time-code"]) }),
+    ]),
+    requiresStoredMandateEvidence: true,
+    assessMandate: snapshot => snapshot.recurringModel === "O" ? { chargeable: true }
+        : { chargeable: false, blockReason: "mandate_model_unsupported_for_unattended_charge" },
+    unattendedChargeFlow: "recurring_charge",
+    payerContext: Object.freeze({ requiresPayerBlock: true, customerRefFallsBackToContactEmail: false }),
+    methodHealth: Object.freeze({ requiresCustomerRef: false, requiredMethodKind: "blik_payid", requiresPayerContact: true }),
+    terminalOutcomeReporting: Object.freeze({ kind: "attempt_records", silenceBecomesSuspectAfterMinutes: 360 }),
+    mandateUpsertIsSubscriptionScoped: true,
+    supportedCurrencies: Object.freeze(["PLN"]), unattended: "supported", readback: "supported", close: "unsupported",
+    exactAbsence: "unsupported", refundObservation: "supported", refundCreate: "unsupported", authorizationCaptureSplit: "unsupported",
+});