@payloadcms/plugin-ecommerce 4.0.0-canary.33 → 4.0.0-canary.34

package/dist/payments/adapters/stripe/confirmOrder.spec.js

@@ -1,14 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
-const mockCustomersList = vi.fn();
-const mockCustomersCreate = vi.fn();
 const mockPaymentIntentsRetrieve = vi.fn();
 vi.mock('stripe', ()=>{
     const MockStripe = function() {
         return {
-            customers: {
-                list: mockCustomersList,
-                create: mockCustomersCreate
-            },
             paymentIntents: {
                 retrieve: mockPaymentIntentsRetrieve
             }
@@ -18,148 +12,243 @@ vi.mock('stripe', ()=>{
         default: MockStripe
     };
 });
-import { confirmOrder } from './confirmOrder';
-const defaultCartItemsSnapshot = JSON.stringify([
-    {
-        id: 'item-1',
-        quantity: 1
-    }
-]);
-const createMockPaymentIntent = (status)=>({
+import { confirmOrder } from './confirmOrder.js';
+const createTransaction = (overrides = {})=>({
+        amount: 1000,
+        cart: 'cart-123',
+        currency: 'USD',
+        customer: 'user-123',
+        id: 'txn-123',
+        items: [
+            {
+                id: 'item-1',
+                product: 'product-123',
+                quantity: 1
+            }
+        ],
+        order: undefined,
+        status: 'pending',
+        stripe: {
+            customerID: 'cus-123',
+            paymentIntentID: 'pi_123'
+        },
+        ...overrides
+    });
+const createPaymentIntent = (overrides = {})=>({
         amount: 1000,
         currency: 'usd',
+        customer: 'cus-123',
+        id: 'pi_123',
         metadata: {
             cartID: 'cart-123',
-            cartItemsSnapshot: defaultCartItemsSnapshot,
+            cartItemsSnapshot: JSON.stringify([
+                {
+                    id: 'item-1',
+                    product: 'product-123',
+                    quantity: 1
+                }
+            ]),
             shippingAddress: JSON.stringify({
                 city: 'Test City'
             })
         },
-        status
+        status: 'succeeded',
+        ...overrides
     });
-const createMockPayload = ()=>({
-        create: vi.fn().mockResolvedValue({
-            id: 'order-123'
-        }),
-        find: vi.fn().mockResolvedValue({
-            docs: [
-                {
-                    id: 'txn-123'
-                }
-            ],
-            totalDocs: 1
-        }),
-        logger: {
-            error: vi.fn()
-        },
-        update: vi.fn().mockResolvedValue({})
+const createHarness = ({ transaction = createTransaction(), transactionCopies = 1, user = {
+    id: 'user-123'
+} } = {})=>{
+    const find = vi.fn().mockResolvedValue({
+        docs: Array.from({
+            length: transactionCopies
+        }, ()=>transaction),
+        totalDocs: transactionCopies
     });
-const createMockReq = (payload)=>({
-        payload,
-        user: {
-            id: 'user-123'
-        }
+    const loggerError = vi.fn();
+    const finalizeOrder = vi.fn().mockResolvedValue({
+        accessToken: 'access-123',
+        id: 'order-123'
+    });
+    const req = {
+        payload: {
+            find,
+            logger: {
+                error: loggerError
+            }
+        },
+        user
+    };
+    return {
+        finalizeOrder,
+        find,
+        loggerError,
+        req
+    };
+};
+const runConfirmation = ({ data = {}, harness })=>confirmOrder({
+        secretKey: 'sk_test_123'
+    })({
+        data: {
+            cartID: 'cart-123',
+            customerEmail: 'buyer@example.com',
+            paymentIntentID: 'pi_123',
+            ...data
+        },
+        finalizeOrder: harness.finalizeOrder,
+        req: harness.req
     });
-describe('confirmOrder - payment status check', ()=>{
-    const secretKey = 'sk_test_123';
+describe('confirmOrder', ()=>{
     beforeEach(()=>{
         vi.clearAllMocks();
-        mockCustomersList.mockResolvedValue({
-            data: [
-                {
-                    id: 'cus-123'
-                }
-            ]
-        });
-        mockCustomersCreate.mockResolvedValue({
-            id: 'cus-new'
-        });
+        mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent());
     });
-    it('should throw when paymentIntent status is requires_payment_method', async ()=>{
-        mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('requires_payment_method'));
-        const mockPayload = createMockPayload();
-        const handler = confirmOrder({
-            secretKey
+    it('should delegate provider-validated settlement data to the core finalizer', async ()=>{
+        const harness = createHarness();
+        const result = await runConfirmation({
+            harness
         });
-        await expect(handler({
-            data: {
-                customerEmail: 'test@test.com',
-                paymentIntentID: 'pi_123'
+        expect(harness.finalizeOrder).toHaveBeenCalledWith({
+            orderData: {
+                amount: 1000,
+                currency: 'USD',
+                customer: 'user-123',
+                items: [
+                    {
+                        id: 'item-1',
+                        product: 'product-123',
+                        quantity: 1
+                    }
+                ],
+                shippingAddress: {
+                    city: 'Test City'
+                },
+                status: 'processing'
             },
-            req: createMockReq(mockPayload)
-        })).rejects.toThrow('Payment not completed.');
-        expect(mockPayload.create).not.toHaveBeenCalled();
+            transactionID: 'txn-123'
+        });
+        expect(result).toEqual({
+            accessToken: 'access-123',
+            message: 'Payment initiated successfully',
+            orderID: 'order-123',
+            transactionID: 'txn-123'
+        });
     });
-    it('should throw when paymentIntent status is canceled', async ()=>{
-        mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('canceled'));
-        const mockPayload = createMockPayload();
-        const handler = confirmOrder({
-            secretKey
+    it('should return the transaction ID again when the core finalizer returns an existing order', async ()=>{
+        const harness = createHarness();
+        harness.finalizeOrder.mockResolvedValue({
+            accessToken: 'existing-access',
+            id: 'existing-order'
+        });
+        const result = await runConfirmation({
+            harness
+        });
+        expect(result).toEqual({
+            accessToken: 'existing-access',
+            message: 'Payment initiated successfully',
+            orderID: 'existing-order',
+            transactionID: 'txn-123'
         });
-        await expect(handler({
-            data: {
-                customerEmail: 'test@test.com',
-                paymentIntentID: 'pi_123'
-            },
-            req: createMockReq(mockPayload)
-        })).rejects.toThrow('Payment not completed.');
-        expect(mockPayload.create).not.toHaveBeenCalled();
     });
-    it('should throw when paymentIntent status is processing', async ()=>{
-        mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('processing'));
-        const mockPayload = createMockPayload();
-        const handler = confirmOrder({
-            secretKey
+    it('should delegate guest order ownership using the validated email', async ()=>{
+        const harness = createHarness({
+            transaction: createTransaction({
+                customer: undefined,
+                customerEmail: 'buyer@example.com',
+                stripe: {
+                    customerID: 'cus-guest',
+                    paymentIntentID: 'pi_123'
+                }
+            }),
+            user: null
         });
-        await expect(handler({
-            data: {
-                customerEmail: 'test@test.com',
-                paymentIntentID: 'pi_123'
-            },
-            req: createMockReq(mockPayload)
+        mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent({
+            customer: 'cus-guest'
+        }));
+        await runConfirmation({
+            harness
+        });
+        expect(harness.finalizeOrder).toHaveBeenCalledWith({
+            orderData: expect.objectContaining({
+                customerEmail: 'buyer@example.com'
+            }),
+            transactionID: 'txn-123'
+        });
+    });
+    it.each([
+        'requires_payment_method',
+        'canceled',
+        'processing'
+    ])('should reject a PaymentIntent with %s status before finalization', async (status)=>{
+        const harness = createHarness();
+        mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent({
+            status
+        }));
+        await expect(runConfirmation({
+            harness
         })).rejects.toThrow('Payment not completed.');
-        expect(mockPayload.create).not.toHaveBeenCalled();
+        expect(harness.finalizeOrder).not.toHaveBeenCalled();
     });
-    it('should not update cart or transaction when payment has not succeeded', async ()=>{
-        mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('requires_payment_method'));
-        const mockPayload = createMockPayload();
-        const handler = confirmOrder({
-            secretKey
+    it('should reject multiple matching transactions before finalization', async ()=>{
+        const harness = createHarness({
+            transactionCopies: 2
         });
-        await expect(handler({
-            data: {
-                customerEmail: 'test@test.com',
-                paymentIntentID: 'pi_123'
-            },
-            req: createMockReq(mockPayload)
-        })).rejects.toThrow();
-        expect(mockPayload.update).not.toHaveBeenCalled();
+        await expect(runConfirmation({
+            harness
+        })).rejects.toThrow('exactly one transaction');
+        expect(mockPaymentIntentsRetrieve).not.toHaveBeenCalled();
+        expect(harness.finalizeOrder).not.toHaveBeenCalled();
     });
-    it('should create order when paymentIntent status is succeeded', async ()=>{
-        mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('succeeded'));
-        const mockPayload = createMockPayload();
-        const handler = confirmOrder({
-            secretKey
-        });
-        const result = await handler({
-            data: {
-                customerEmail: 'test@test.com',
-                paymentIntentID: 'pi_123'
-            },
-            req: createMockReq(mockPayload)
-        });
-        expect(mockPayload.create).toHaveBeenCalledWith(expect.objectContaining({
-            collection: 'orders',
-            data: expect.objectContaining({
-                amount: 1000,
-                currency: 'USD',
-                status: 'processing'
+    it('should reject a transaction that does not belong to the canonical cart', async ()=>{
+        const harness = createHarness({
+            transaction: createTransaction({
+                cart: 'cart-other'
             })
+        });
+        await expect(runConfirmation({
+            harness
+        })).rejects.toThrow('cart');
+        expect(harness.finalizeOrder).not.toHaveBeenCalled();
+    });
+    it('should reject provider amount drift before finalization', async ()=>{
+        const harness = createHarness();
+        mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent({
+            amount: 999
         }));
-        expect(result).toEqual(expect.objectContaining({
-            orderID: 'order-123',
-            transactionID: 'txn-123'
+        await expect(runConfirmation({
+            harness
+        })).rejects.toThrow('amount');
+        expect(harness.finalizeOrder).not.toHaveBeenCalled();
+    });
+    it('should reject provider item drift before finalization', async ()=>{
+        const harness = createHarness();
+        mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent({
+            metadata: {
+                ...createPaymentIntent().metadata,
+                cartItemsSnapshot: JSON.stringify([
+                    {
+                        id: 'item-1',
+                        product: 'product-123',
+                        quantity: 2
+                    }
+                ])
+            }
         }));
+        await expect(runConfirmation({
+            harness
+        })).rejects.toThrow('items');
+        expect(harness.finalizeOrder).not.toHaveBeenCalled();
+    });
+    it('should log and propagate finalization failures', async ()=>{
+        const harness = createHarness();
+        const error = new Error('inventory update failed');
+        harness.finalizeOrder.mockRejectedValue(error);
+        await expect(runConfirmation({
+            harness
+        })).rejects.toThrow(error.message);
+        expect(harness.loggerError).toHaveBeenCalledWith({
+            err: error,
+            msg: 'Error confirming order with Stripe'
+        });
     });
 });
 

package/dist/payments/adapters/stripe/confirmOrder.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/payments/adapters/stripe/confirmOrder.spec.ts"],"sourcesContent":["import { beforeEach, describe, expect, it, vi } from 'vitest'\n\nconst mockCustomersList = vi.fn()\nconst mockCustomersCreate = vi.fn()\nconst mockPaymentIntentsRetrieve = vi.fn()\n\nvi.mock('stripe', () => {\n  const MockStripe = function () {\n    return {\n      customers: {\n        list: mockCustomersList,\n        create: mockCustomersCreate,\n      },\n      paymentIntents: {\n        retrieve: mockPaymentIntentsRetrieve,\n      },\n    }\n  }\n\n  return { default: MockStripe }\n})\n\nimport { confirmOrder } from './confirmOrder'\n\nconst defaultCartItemsSnapshot = JSON.stringify([{ id: 'item-1', quantity: 1 }])\n\nconst createMockPaymentIntent = (status: string) => ({\n  amount: 1000,\n  currency: 'usd',\n  metadata: {\n    cartID: 'cart-123',\n    cartItemsSnapshot: defaultCartItemsSnapshot,\n    shippingAddress: JSON.stringify({ city: 'Test City' }),\n  },\n  status,\n})\n\nconst createMockPayload = () => ({\n  create: vi.fn().mockResolvedValue({ id: 'order-123' }),\n  find: vi.fn().mockResolvedValue({\n    docs: [{ id: 'txn-123' }],\n    totalDocs: 1,\n  }),\n  logger: { error: vi.fn() },\n  update: vi.fn().mockResolvedValue({}),\n})\n\nconst createMockReq = (payload: ReturnType<typeof createMockPayload>) =>\n  ({\n    payload,\n    user: { id: 'user-123' },\n  }) as any\n\ndescribe('confirmOrder - payment status check', () => {\n  const secretKey = 'sk_test_123'\n\n  beforeEach(() => {\n    vi.clearAllMocks()\n\n    mockCustomersList.mockResolvedValue({ data: [{ id: 'cus-123' }] })\n    mockCustomersCreate.mockResolvedValue({ id: 'cus-new' })\n  })\n\n  it('should throw when paymentIntent status is requires_payment_method', async () => {\n    mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('requires_payment_method'))\n\n    const mockPayload = createMockPayload()\n    const handler = confirmOrder({ secretKey })\n\n    await expect(\n      handler({\n        data: { customerEmail: 'test@test.com', paymentIntentID: 'pi_123' },\n        req: createMockReq(mockPayload),\n      }),\n    ).rejects.toThrow('Payment not completed.')\n\n    expect(mockPayload.create).not.toHaveBeenCalled()\n  })\n\n  it('should throw when paymentIntent status is canceled', async () => {\n    mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('canceled'))\n\n    const mockPayload = createMockPayload()\n    const handler = confirmOrder({ secretKey })\n\n    await expect(\n      handler({\n        data: { customerEmail: 'test@test.com', paymentIntentID: 'pi_123' },\n        req: createMockReq(mockPayload),\n      }),\n    ).rejects.toThrow('Payment not completed.')\n\n    expect(mockPayload.create).not.toHaveBeenCalled()\n  })\n\n  it('should throw when paymentIntent status is processing', async () => {\n    mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('processing'))\n\n    const mockPayload = createMockPayload()\n    const handler = confirmOrder({ secretKey })\n\n    await expect(\n      handler({\n        data: { customerEmail: 'test@test.com', paymentIntentID: 'pi_123' },\n        req: createMockReq(mockPayload),\n      }),\n    ).rejects.toThrow('Payment not completed.')\n\n    expect(mockPayload.create).not.toHaveBeenCalled()\n  })\n\n  it('should not update cart or transaction when payment has not succeeded', async () => {\n    mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('requires_payment_method'))\n\n    const mockPayload = createMockPayload()\n    const handler = confirmOrder({ secretKey })\n\n    await expect(\n      handler({\n        data: { customerEmail: 'test@test.com', paymentIntentID: 'pi_123' },\n        req: createMockReq(mockPayload),\n      }),\n    ).rejects.toThrow()\n\n    expect(mockPayload.update).not.toHaveBeenCalled()\n  })\n\n  it('should create order when paymentIntent status is succeeded', async () => {\n    mockPaymentIntentsRetrieve.mockResolvedValue(createMockPaymentIntent('succeeded'))\n\n    const mockPayload = createMockPayload()\n    const handler = confirmOrder({ secretKey })\n\n    const result = await handler({\n      data: { customerEmail: 'test@test.com', paymentIntentID: 'pi_123' },\n      req: createMockReq(mockPayload),\n    })\n\n    expect(mockPayload.create).toHaveBeenCalledWith(\n      expect.objectContaining({\n        collection: 'orders',\n        data: expect.objectContaining({\n          amount: 1000,\n          currency: 'USD',\n          status: 'processing',\n        }),\n      }),\n    )\n\n    expect(result).toEqual(\n      expect.objectContaining({\n        orderID: 'order-123',\n        transactionID: 'txn-123',\n      }),\n    )\n  })\n})\n"],"names":["beforeEach","describe","expect","it","vi","mockCustomersList","fn","mockCustomersCreate","mockPaymentIntentsRetrieve","mock","MockStripe","customers","list","create","paymentIntents","retrieve","default","confirmOrder","defaultCartItemsSnapshot","JSON","stringify","id","quantity","createMockPaymentIntent","status","amount","currency","metadata","cartID","cartItemsSnapshot","shippingAddress","city","createMockPayload","mockResolvedValue","find","docs","totalDocs","logger","error","update","createMockReq","payload","user","secretKey","clearAllMocks","data","mockPayload","handler","customerEmail","paymentIntentID","req","rejects","toThrow","not","toHaveBeenCalled","result","toHaveBeenCalledWith","objectContaining","collection","toEqual","orderID","transactionID"],"mappings":"AAAA,SAASA,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE7D,MAAMC,oBAAoBD,GAAGE,EAAE;AAC/B,MAAMC,sBAAsBH,GAAGE,EAAE;AACjC,MAAME,6BAA6BJ,GAAGE,EAAE;AAExCF,GAAGK,IAAI,CAAC,UAAU;IAChB,MAAMC,aAAa;QACjB,OAAO;YACLC,WAAW;gBACTC,MAAMP;gBACNQ,QAAQN;YACV;YACAO,gBAAgB;gBACdC,UAAUP;YACZ;QACF;IACF;IAEA,OAAO;QAAEQ,SAASN;IAAW;AAC/B;AAEA,SAASO,YAAY,QAAQ,iBAAgB;AAE7C,MAAMC,2BAA2BC,KAAKC,SAAS,CAAC;IAAC;QAAEC,IAAI;QAAUC,UAAU;IAAE;CAAE;AAE/E,MAAMC,0BAA0B,CAACC,SAAoB,CAAA;QACnDC,QAAQ;QACRC,UAAU;QACVC,UAAU;YACRC,QAAQ;YACRC,mBAAmBX;YACnBY,iBAAiBX,KAAKC,SAAS,CAAC;gBAAEW,MAAM;YAAY;QACtD;QACAP;IACF,CAAA;AAEA,MAAMQ,oBAAoB,IAAO,CAAA;QAC/BnB,QAAQT,GAAGE,EAAE,GAAG2B,iBAAiB,CAAC;YAAEZ,IAAI;QAAY;QACpDa,MAAM9B,GAAGE,EAAE,GAAG2B,iBAAiB,CAAC;YAC9BE,MAAM;gBAAC;oBAAEd,IAAI;gBAAU;aAAE;YACzBe,WAAW;QACb;QACAC,QAAQ;YAAEC,OAAOlC,GAAGE,EAAE;QAAG;QACzBiC,QAAQnC,GAAGE,EAAE,GAAG2B,iBAAiB,CAAC,CAAC;IACrC,CAAA;AAEA,MAAMO,gBAAgB,CAACC,UACpB,CAAA;QACCA;QACAC,MAAM;YAAErB,IAAI;QAAW;IACzB,CAAA;AAEFpB,SAAS,uCAAuC;IAC9C,MAAM0C,YAAY;IAElB3C,WAAW;QACTI,GAAGwC,aAAa;QAEhBvC,kBAAkB4B,iBAAiB,CAAC;YAAEY,MAAM;gBAAC;oBAAExB,IAAI;gBAAU;aAAE;QAAC;QAChEd,oBAAoB0B,iBAAiB,CAAC;YAAEZ,IAAI;QAAU;IACxD;IAEAlB,GAAG,qEAAqE;QACtEK,2BAA2ByB,iBAAiB,CAACV,wBAAwB;QAErE,MAAMuB,cAAcd;QACpB,MAAMe,UAAU9B,aAAa;YAAE0B;QAAU;QAEzC,MAAMzC,OACJ6C,QAAQ;YACNF,MAAM;gBAAEG,eAAe;gBAAiBC,iBAAiB;YAAS;YAClEC,KAAKV,cAAcM;QACrB,IACAK,OAAO,CAACC,OAAO,CAAC;QAElBlD,OAAO4C,YAAYjC,MAAM,EAAEwC,GAAG,CAACC,gBAAgB;IACjD;IAEAnD,GAAG,sDAAsD;QACvDK,2BAA2ByB,iBAAiB,CAACV,wBAAwB;QAErE,MAAMuB,cAAcd;QACpB,MAAMe,UAAU9B,aAAa;YAAE0B;QAAU;QAEzC,MAAMzC,OACJ6C,QAAQ;YACNF,MAAM;gBAAEG,eAAe;gBAAiBC,iBAAiB;YAAS;YAClEC,KAAKV,cAAcM;QACrB,IACAK,OAAO,CAACC,OAAO,CAAC;QAElBlD,OAAO4C,YAAYjC,MAAM,EAAEwC,GAAG,CAACC,gBAAgB;IACjD;IAEAnD,GAAG,wDAAwD;QACzDK,2BAA2ByB,iBAAiB,CAACV,wBAAwB;QAErE,MAAMuB,cAAcd;QACpB,MAAMe,UAAU9B,aAAa;YAAE0B;QAAU;QAEzC,MAAMzC,OACJ6C,QAAQ;YACNF,MAAM;gBAAEG,eAAe;gBAAiBC,iBAAiB;YAAS;YAClEC,KAAKV,cAAcM;QACrB,IACAK,OAAO,CAACC,OAAO,CAAC;QAElBlD,OAAO4C,YAAYjC,MAAM,EAAEwC,GAAG,CAACC,gBAAgB;IACjD;IAEAnD,GAAG,wEAAwE;QACzEK,2BAA2ByB,iBAAiB,CAACV,wBAAwB;QAErE,MAAMuB,cAAcd;QACpB,MAAMe,UAAU9B,aAAa;YAAE0B;QAAU;QAEzC,MAAMzC,OACJ6C,QAAQ;YACNF,MAAM;gBAAEG,eAAe;gBAAiBC,iBAAiB;YAAS;YAClEC,KAAKV,cAAcM;QACrB,IACAK,OAAO,CAACC,OAAO;QAEjBlD,OAAO4C,YAAYP,MAAM,EAAEc,GAAG,CAACC,gBAAgB;IACjD;IAEAnD,GAAG,8DAA8D;QAC/DK,2BAA2ByB,iBAAiB,CAACV,wBAAwB;QAErE,MAAMuB,cAAcd;QACpB,MAAMe,UAAU9B,aAAa;YAAE0B;QAAU;QAEzC,MAAMY,SAAS,MAAMR,QAAQ;YAC3BF,MAAM;gBAAEG,eAAe;gBAAiBC,iBAAiB;YAAS;YAClEC,KAAKV,cAAcM;QACrB;QAEA5C,OAAO4C,YAAYjC,MAAM,EAAE2C,oBAAoB,CAC7CtD,OAAOuD,gBAAgB,CAAC;YACtBC,YAAY;YACZb,MAAM3C,OAAOuD,gBAAgB,CAAC;gBAC5BhC,QAAQ;gBACRC,UAAU;gBACVF,QAAQ;YACV;QACF;QAGFtB,OAAOqD,QAAQI,OAAO,CACpBzD,OAAOuD,gBAAgB,CAAC;YACtBG,SAAS;YACTC,eAAe;QACjB;IAEJ;AACF"}
+{"version":3,"sources":["../../../../src/payments/adapters/stripe/confirmOrder.spec.ts"],"sourcesContent":["import { beforeEach, describe, expect, it, vi } from 'vitest'\n\nconst mockPaymentIntentsRetrieve = vi.fn()\n\nvi.mock('stripe', () => {\n  const MockStripe = function () {\n    return {\n      paymentIntents: {\n        retrieve: mockPaymentIntentsRetrieve,\n      },\n    }\n  }\n\n  return { default: MockStripe }\n})\n\nimport { confirmOrder } from './confirmOrder.js'\n\ntype ConfirmOrderArgs = Parameters<ReturnType<typeof confirmOrder>>[0]\n\nconst createTransaction = (overrides: Record<string, unknown> = {}) => ({\n  amount: 1000,\n  cart: 'cart-123',\n  currency: 'USD',\n  customer: 'user-123',\n  id: 'txn-123',\n  items: [{ id: 'item-1', product: 'product-123', quantity: 1 }],\n  order: undefined,\n  status: 'pending',\n  stripe: {\n    customerID: 'cus-123',\n    paymentIntentID: 'pi_123',\n  },\n  ...overrides,\n})\n\nconst createPaymentIntent = (overrides: Record<string, unknown> = {}) => ({\n  amount: 1000,\n  currency: 'usd',\n  customer: 'cus-123',\n  id: 'pi_123',\n  metadata: {\n    cartID: 'cart-123',\n    cartItemsSnapshot: JSON.stringify([{ id: 'item-1', product: 'product-123', quantity: 1 }]),\n    shippingAddress: JSON.stringify({ city: 'Test City' }),\n  },\n  status: 'succeeded',\n  ...overrides,\n})\n\nconst createHarness = ({\n  transaction = createTransaction(),\n  transactionCopies = 1,\n  user = { id: 'user-123' } as null | Record<string, unknown>,\n}: {\n  transaction?: Record<string, unknown>\n  transactionCopies?: number\n  user?: null | Record<string, unknown>\n} = {}) => {\n  const find = vi.fn().mockResolvedValue({\n    docs: Array.from({ length: transactionCopies }, () => transaction),\n    totalDocs: transactionCopies,\n  })\n  const loggerError = vi.fn()\n  const finalizeOrder = vi.fn().mockResolvedValue({ accessToken: 'access-123', id: 'order-123' })\n  const req = {\n    payload: {\n      find,\n      logger: { error: loggerError },\n    },\n    user,\n  } as unknown as ConfirmOrderArgs['req']\n\n  return { finalizeOrder, find, loggerError, req }\n}\n\nconst runConfirmation = ({\n  data = {},\n  harness,\n}: {\n  data?: Record<string, unknown>\n  harness: ReturnType<typeof createHarness>\n}) =>\n  confirmOrder({ secretKey: 'sk_test_123' })({\n    data: {\n      cartID: 'cart-123',\n      customerEmail: 'buyer@example.com',\n      paymentIntentID: 'pi_123',\n      ...data,\n    },\n    finalizeOrder: harness.finalizeOrder,\n    req: harness.req,\n  })\n\ndescribe('confirmOrder', () => {\n  beforeEach(() => {\n    vi.clearAllMocks()\n    mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent())\n  })\n\n  it('should delegate provider-validated settlement data to the core finalizer', async () => {\n    const harness = createHarness()\n\n    const result = await runConfirmation({ harness })\n\n    expect(harness.finalizeOrder).toHaveBeenCalledWith({\n      orderData: {\n        amount: 1000,\n        currency: 'USD',\n        customer: 'user-123',\n        items: [{ id: 'item-1', product: 'product-123', quantity: 1 }],\n        shippingAddress: { city: 'Test City' },\n        status: 'processing',\n      },\n      transactionID: 'txn-123',\n    })\n    expect(result).toEqual({\n      accessToken: 'access-123',\n      message: 'Payment initiated successfully',\n      orderID: 'order-123',\n      transactionID: 'txn-123',\n    })\n  })\n\n  it('should return the transaction ID again when the core finalizer returns an existing order', async () => {\n    const harness = createHarness()\n    harness.finalizeOrder.mockResolvedValue({\n      accessToken: 'existing-access',\n      id: 'existing-order',\n    })\n\n    const result = await runConfirmation({ harness })\n\n    expect(result).toEqual({\n      accessToken: 'existing-access',\n      message: 'Payment initiated successfully',\n      orderID: 'existing-order',\n      transactionID: 'txn-123',\n    })\n  })\n\n  it('should delegate guest order ownership using the validated email', async () => {\n    const harness = createHarness({\n      transaction: createTransaction({\n        customer: undefined,\n        customerEmail: 'buyer@example.com',\n        stripe: {\n          customerID: 'cus-guest',\n          paymentIntentID: 'pi_123',\n        },\n      }),\n      user: null,\n    })\n    mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent({ customer: 'cus-guest' }))\n\n    await runConfirmation({ harness })\n\n    expect(harness.finalizeOrder).toHaveBeenCalledWith({\n      orderData: expect.objectContaining({ customerEmail: 'buyer@example.com' }),\n      transactionID: 'txn-123',\n    })\n  })\n\n  it.each(['requires_payment_method', 'canceled', 'processing'])(\n    'should reject a PaymentIntent with %s status before finalization',\n    async (status) => {\n      const harness = createHarness()\n      mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent({ status }))\n\n      await expect(runConfirmation({ harness })).rejects.toThrow('Payment not completed.')\n\n      expect(harness.finalizeOrder).not.toHaveBeenCalled()\n    },\n  )\n\n  it('should reject multiple matching transactions before finalization', async () => {\n    const harness = createHarness({ transactionCopies: 2 })\n\n    await expect(runConfirmation({ harness })).rejects.toThrow('exactly one transaction')\n\n    expect(mockPaymentIntentsRetrieve).not.toHaveBeenCalled()\n    expect(harness.finalizeOrder).not.toHaveBeenCalled()\n  })\n\n  it('should reject a transaction that does not belong to the canonical cart', async () => {\n    const harness = createHarness({\n      transaction: createTransaction({ cart: 'cart-other' }),\n    })\n\n    await expect(runConfirmation({ harness })).rejects.toThrow('cart')\n\n    expect(harness.finalizeOrder).not.toHaveBeenCalled()\n  })\n\n  it('should reject provider amount drift before finalization', async () => {\n    const harness = createHarness()\n    mockPaymentIntentsRetrieve.mockResolvedValue(createPaymentIntent({ amount: 999 }))\n\n    await expect(runConfirmation({ harness })).rejects.toThrow('amount')\n\n    expect(harness.finalizeOrder).not.toHaveBeenCalled()\n  })\n\n  it('should reject provider item drift before finalization', async () => {\n    const harness = createHarness()\n    mockPaymentIntentsRetrieve.mockResolvedValue(\n      createPaymentIntent({\n        metadata: {\n          ...createPaymentIntent().metadata,\n          cartItemsSnapshot: JSON.stringify([\n            { id: 'item-1', product: 'product-123', quantity: 2 },\n          ]),\n        },\n      }),\n    )\n\n    await expect(runConfirmation({ harness })).rejects.toThrow('items')\n\n    expect(harness.finalizeOrder).not.toHaveBeenCalled()\n  })\n\n  it('should log and propagate finalization failures', async () => {\n    const harness = createHarness()\n    const error = new Error('inventory update failed')\n    harness.finalizeOrder.mockRejectedValue(error)\n\n    await expect(runConfirmation({ harness })).rejects.toThrow(error.message)\n\n    expect(harness.loggerError).toHaveBeenCalledWith({\n      err: error,\n      msg: 'Error confirming order with Stripe',\n    })\n  })\n})\n"],"names":["beforeEach","describe","expect","it","vi","mockPaymentIntentsRetrieve","fn","mock","MockStripe","paymentIntents","retrieve","default","confirmOrder","createTransaction","overrides","amount","cart","currency","customer","id","items","product","quantity","order","undefined","status","stripe","customerID","paymentIntentID","createPaymentIntent","metadata","cartID","cartItemsSnapshot","JSON","stringify","shippingAddress","city","createHarness","transaction","transactionCopies","user","find","mockResolvedValue","docs","Array","from","length","totalDocs","loggerError","finalizeOrder","accessToken","req","payload","logger","error","runConfirmation","data","harness","secretKey","customerEmail","clearAllMocks","result","toHaveBeenCalledWith","orderData","transactionID","toEqual","message","orderID","objectContaining","each","rejects","toThrow","not","toHaveBeenCalled","Error","mockRejectedValue","err","msg"],"mappings":"AAAA,SAASA,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE7D,MAAMC,6BAA6BD,GAAGE,EAAE;AAExCF,GAAGG,IAAI,CAAC,UAAU;IAChB,MAAMC,aAAa;QACjB,OAAO;YACLC,gBAAgB;gBACdC,UAAUL;YACZ;QACF;IACF;IAEA,OAAO;QAAEM,SAASH;IAAW;AAC/B;AAEA,SAASI,YAAY,QAAQ,oBAAmB;AAIhD,MAAMC,oBAAoB,CAACC,YAAqC,CAAC,CAAC,GAAM,CAAA;QACtEC,QAAQ;QACRC,MAAM;QACNC,UAAU;QACVC,UAAU;QACVC,IAAI;QACJC,OAAO;YAAC;gBAAED,IAAI;gBAAUE,SAAS;gBAAeC,UAAU;YAAE;SAAE;QAC9DC,OAAOC;QACPC,QAAQ;QACRC,QAAQ;YACNC,YAAY;YACZC,iBAAiB;QACnB;QACA,GAAGd,SAAS;IACd,CAAA;AAEA,MAAMe,sBAAsB,CAACf,YAAqC,CAAC,CAAC,GAAM,CAAA;QACxEC,QAAQ;QACRE,UAAU;QACVC,UAAU;QACVC,IAAI;QACJW,UAAU;YACRC,QAAQ;YACRC,mBAAmBC,KAAKC,SAAS,CAAC;gBAAC;oBAAEf,IAAI;oBAAUE,SAAS;oBAAeC,UAAU;gBAAE;aAAE;YACzFa,iBAAiBF,KAAKC,SAAS,CAAC;gBAAEE,MAAM;YAAY;QACtD;QACAX,QAAQ;QACR,GAAGX,SAAS;IACd,CAAA;AAEA,MAAMuB,gBAAgB,CAAC,EACrBC,cAAczB,mBAAmB,EACjC0B,oBAAoB,CAAC,EACrBC,OAAO;IAAErB,IAAI;AAAW,CAAmC,EAK5D,GAAG,CAAC,CAAC;IACJ,MAAMsB,OAAOrC,GAAGE,EAAE,GAAGoC,iBAAiB,CAAC;QACrCC,MAAMC,MAAMC,IAAI,CAAC;YAAEC,QAAQP;QAAkB,GAAG,IAAMD;QACtDS,WAAWR;IACb;IACA,MAAMS,cAAc5C,GAAGE,EAAE;IACzB,MAAM2C,gBAAgB7C,GAAGE,EAAE,GAAGoC,iBAAiB,CAAC;QAAEQ,aAAa;QAAc/B,IAAI;IAAY;IAC7F,MAAMgC,MAAM;QACVC,SAAS;YACPX;YACAY,QAAQ;gBAAEC,OAAON;YAAY;QAC/B;QACAR;IACF;IAEA,OAAO;QAAES;QAAeR;QAAMO;QAAaG;IAAI;AACjD;AAEA,MAAMI,kBAAkB,CAAC,EACvBC,OAAO,CAAC,CAAC,EACTC,OAAO,EAIR,GACC7C,aAAa;QAAE8C,WAAW;IAAc,GAAG;QACzCF,MAAM;YACJzB,QAAQ;YACR4B,eAAe;YACf/B,iBAAiB;YACjB,GAAG4B,IAAI;QACT;QACAP,eAAeQ,QAAQR,aAAa;QACpCE,KAAKM,QAAQN,GAAG;IAClB;AAEFlD,SAAS,gBAAgB;IACvBD,WAAW;QACTI,GAAGwD,aAAa;QAChBvD,2BAA2BqC,iBAAiB,CAACb;IAC/C;IAEA1B,GAAG,4EAA4E;QAC7E,MAAMsD,UAAUpB;QAEhB,MAAMwB,SAAS,MAAMN,gBAAgB;YAAEE;QAAQ;QAE/CvD,OAAOuD,QAAQR,aAAa,EAAEa,oBAAoB,CAAC;YACjDC,WAAW;gBACThD,QAAQ;gBACRE,UAAU;gBACVC,UAAU;gBACVE,OAAO;oBAAC;wBAAED,IAAI;wBAAUE,SAAS;wBAAeC,UAAU;oBAAE;iBAAE;gBAC9Da,iBAAiB;oBAAEC,MAAM;gBAAY;gBACrCX,QAAQ;YACV;YACAuC,eAAe;QACjB;QACA9D,OAAO2D,QAAQI,OAAO,CAAC;YACrBf,aAAa;YACbgB,SAAS;YACTC,SAAS;YACTH,eAAe;QACjB;IACF;IAEA7D,GAAG,4FAA4F;QAC7F,MAAMsD,UAAUpB;QAChBoB,QAAQR,aAAa,CAACP,iBAAiB,CAAC;YACtCQ,aAAa;YACb/B,IAAI;QACN;QAEA,MAAM0C,SAAS,MAAMN,gBAAgB;YAAEE;QAAQ;QAE/CvD,OAAO2D,QAAQI,OAAO,CAAC;YACrBf,aAAa;YACbgB,SAAS;YACTC,SAAS;YACTH,eAAe;QACjB;IACF;IAEA7D,GAAG,mEAAmE;QACpE,MAAMsD,UAAUpB,cAAc;YAC5BC,aAAazB,kBAAkB;gBAC7BK,UAAUM;gBACVmC,eAAe;gBACfjC,QAAQ;oBACNC,YAAY;oBACZC,iBAAiB;gBACnB;YACF;YACAY,MAAM;QACR;QACAnC,2BAA2BqC,iBAAiB,CAACb,oBAAoB;YAAEX,UAAU;QAAY;QAEzF,MAAMqC,gBAAgB;YAAEE;QAAQ;QAEhCvD,OAAOuD,QAAQR,aAAa,EAAEa,oBAAoB,CAAC;YACjDC,WAAW7D,OAAOkE,gBAAgB,CAAC;gBAAET,eAAe;YAAoB;YACxEK,eAAe;QACjB;IACF;IAEA7D,GAAGkE,IAAI,CAAC;QAAC;QAA2B;QAAY;KAAa,EAC3D,oEACA,OAAO5C;QACL,MAAMgC,UAAUpB;QAChBhC,2BAA2BqC,iBAAiB,CAACb,oBAAoB;YAAEJ;QAAO;QAE1E,MAAMvB,OAAOqD,gBAAgB;YAAEE;QAAQ,IAAIa,OAAO,CAACC,OAAO,CAAC;QAE3DrE,OAAOuD,QAAQR,aAAa,EAAEuB,GAAG,CAACC,gBAAgB;IACpD;IAGFtE,GAAG,oEAAoE;QACrE,MAAMsD,UAAUpB,cAAc;YAAEE,mBAAmB;QAAE;QAErD,MAAMrC,OAAOqD,gBAAgB;YAAEE;QAAQ,IAAIa,OAAO,CAACC,OAAO,CAAC;QAE3DrE,OAAOG,4BAA4BmE,GAAG,CAACC,gBAAgB;QACvDvE,OAAOuD,QAAQR,aAAa,EAAEuB,GAAG,CAACC,gBAAgB;IACpD;IAEAtE,GAAG,0EAA0E;QAC3E,MAAMsD,UAAUpB,cAAc;YAC5BC,aAAazB,kBAAkB;gBAAEG,MAAM;YAAa;QACtD;QAEA,MAAMd,OAAOqD,gBAAgB;YAAEE;QAAQ,IAAIa,OAAO,CAACC,OAAO,CAAC;QAE3DrE,OAAOuD,QAAQR,aAAa,EAAEuB,GAAG,CAACC,gBAAgB;IACpD;IAEAtE,GAAG,2DAA2D;QAC5D,MAAMsD,UAAUpB;QAChBhC,2BAA2BqC,iBAAiB,CAACb,oBAAoB;YAAEd,QAAQ;QAAI;QAE/E,MAAMb,OAAOqD,gBAAgB;YAAEE;QAAQ,IAAIa,OAAO,CAACC,OAAO,CAAC;QAE3DrE,OAAOuD,QAAQR,aAAa,EAAEuB,GAAG,CAACC,gBAAgB;IACpD;IAEAtE,GAAG,yDAAyD;QAC1D,MAAMsD,UAAUpB;QAChBhC,2BAA2BqC,iBAAiB,CAC1Cb,oBAAoB;YAClBC,UAAU;gBACR,GAAGD,sBAAsBC,QAAQ;gBACjCE,mBAAmBC,KAAKC,SAAS,CAAC;oBAChC;wBAAEf,IAAI;wBAAUE,SAAS;wBAAeC,UAAU;oBAAE;iBACrD;YACH;QACF;QAGF,MAAMpB,OAAOqD,gBAAgB;YAAEE;QAAQ,IAAIa,OAAO,CAACC,OAAO,CAAC;QAE3DrE,OAAOuD,QAAQR,aAAa,EAAEuB,GAAG,CAACC,gBAAgB;IACpD;IAEAtE,GAAG,kDAAkD;QACnD,MAAMsD,UAAUpB;QAChB,MAAMiB,QAAQ,IAAIoB,MAAM;QACxBjB,QAAQR,aAAa,CAAC0B,iBAAiB,CAACrB;QAExC,MAAMpD,OAAOqD,gBAAgB;YAAEE;QAAQ,IAAIa,OAAO,CAACC,OAAO,CAACjB,MAAMY,OAAO;QAExEhE,OAAOuD,QAAQT,WAAW,EAAEc,oBAAoB,CAAC;YAC/Cc,KAAKtB;YACLuB,KAAK;QACP;IACF;AACF"}

package/dist/payments/adapters/stripe/validateSettlement.d.ts

@@ -0,0 +1,37 @@
+type SettlementPaymentIntent = {
+    amount?: unknown;
+    currency?: unknown;
+    customer?: unknown;
+    id?: unknown;
+    metadata?: unknown;
+    status?: unknown;
+};
+type SettlementTransaction = {
+    amount?: unknown;
+    cart?: unknown;
+    currency?: unknown;
+    customer?: unknown;
+    customerEmail?: unknown;
+    id?: unknown;
+    items?: unknown;
+    order?: unknown;
+    status?: unknown;
+    stripe?: unknown;
+};
+type SettlementValidationArgs = {
+    canonicalCartID: unknown;
+    cartItemsSnapshot: unknown;
+    customerEmail: unknown;
+    paymentIntent: SettlementPaymentIntent;
+    paymentIntentID: string;
+    transaction: SettlementTransaction;
+    user?: {
+        id?: unknown;
+    } | null;
+};
+export declare const getRelationshipID: (value: unknown) => string | undefined;
+export declare const normalizeEmail: (value: unknown) => string | undefined;
+export declare const normalizeCartItems: (items: unknown) => unknown[];
+export declare const validateSettlement: ({ canonicalCartID, cartItemsSnapshot, customerEmail, paymentIntent, paymentIntentID, transaction, user, }: SettlementValidationArgs) => void;
+export {};
+//# sourceMappingURL=validateSettlement.d.ts.map

package/dist/payments/adapters/stripe/validateSettlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateSettlement.d.ts","sourceRoot":"","sources":["../../../../src/payments/adapters/stripe/validateSettlement.ts"],"names":[],"mappings":"AAEA,KAAK,uBAAuB,GAAG;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,KAAK,qBAAqB,GAAG;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC9B,eAAe,EAAE,OAAO,CAAA;IACxB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,aAAa,EAAE,OAAO,CAAA;IACtB,aAAa,EAAE,uBAAuB,CAAA;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,qBAAqB,CAAA;IAClC,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,MAAM,GAAG,SAY3D,CAAA;AAED,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,MAAM,GAAG,SAQxD,CAAA;AAED,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,OAAO,EA0C1D,CAAA;AAED,eAAO,MAAM,kBAAkB,8GAQ5B,wBAAwB,KAAG,IA2E7B,CAAA"}

package/dist/payments/adapters/stripe/validateSettlement.js

@@ -0,0 +1,157 @@
+export const getRelationshipID = (value)=>{
+    const relationshipID = isRecord(value) ? value.id : value;
+    if (typeof relationshipID === 'number' && Number.isFinite(relationshipID)) {
+        return String(relationshipID);
+    }
+    if (typeof relationshipID === 'string' && relationshipID.trim()) {
+        return relationshipID;
+    }
+    return undefined;
+};
+export const normalizeEmail = (value)=>{
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const normalizedEmail = value.trim().toLowerCase();
+    return normalizedEmail || undefined;
+};
+export const normalizeCartItems = (items)=>{
+    if (!Array.isArray(items) || items.length === 0) {
+        throw new Error('Cart items are missing or invalid');
+    }
+    return items.map((item)=>{
+        if (!isRecord(item)) {
+            throw new Error('Cart items are missing or invalid');
+        }
+        const productID = getRelationshipID(item.product);
+        if (!productID || typeof item.quantity !== 'number' || !Number.isFinite(item.quantity)) {
+            throw new Error('Cart items are missing or invalid');
+        }
+        return Object.fromEntries(Object.entries(item).flatMap(([key, value])=>{
+            if (key === 'product') {
+                return [
+                    [
+                        key,
+                        productID
+                    ]
+                ];
+            }
+            if (key === 'variant') {
+                if (value === null || value === undefined) {
+                    return [];
+                }
+                const variantID = getRelationshipID(value);
+                if (!variantID) {
+                    throw new Error('Cart item variant relationship is invalid');
+                }
+                return [
+                    [
+                        key,
+                        variantID
+                    ]
+                ];
+            }
+            const normalizedValue = normalizeValue(value);
+            return normalizedValue === undefined ? [] : [
+                [
+                    key,
+                    normalizedValue
+                ]
+            ];
+        }));
+    });
+};
+export const validateSettlement = ({ canonicalCartID, cartItemsSnapshot, customerEmail, paymentIntent, paymentIntentID, transaction, user })=>{
+    if (paymentIntentID !== getNestedString(transaction, 'stripe', 'paymentIntentID') || paymentIntentID !== paymentIntent.id) {
+        throw new Error('PaymentIntent does not match the transaction');
+    }
+    const normalizedCartID = getRelationshipID(canonicalCartID);
+    if (!normalizedCartID || normalizedCartID !== getRelationshipID(transaction.cart)) {
+        throw new Error('Canonical cart does not match the transaction cart');
+    }
+    const metadata = isRecord(paymentIntent.metadata) ? paymentIntent.metadata : undefined;
+    if (normalizedCartID !== getRelationshipID(metadata?.cartID)) {
+        throw new Error('Canonical cart does not match the PaymentIntent cart');
+    }
+    const transactionCustomerID = getRelationshipID(transaction.customer);
+    if (user !== null && user !== undefined) {
+        const authenticatedUserID = getRelationshipID(user.id);
+        if (!authenticatedUserID) {
+            throw new Error('Authenticated customer ID is missing or invalid');
+        }
+        if (transactionCustomerID !== authenticatedUserID) {
+            throw new Error('Authenticated customer does not match the transaction customer');
+        }
+    } else {
+        if (transactionCustomerID) {
+            throw new Error('Guest transaction belongs to an authenticated customer');
+        }
+        const normalizedCustomerEmail = normalizeEmail(customerEmail);
+        if (!normalizedCustomerEmail || normalizedCustomerEmail !== normalizeEmail(transaction.customerEmail)) {
+            throw new Error('Guest email does not match the transaction email');
+        }
+    }
+    const stripeCustomerID = getNestedString(transaction, 'stripe', 'customerID');
+    if (!stripeCustomerID || stripeCustomerID !== getRelationshipID(paymentIntent.customer)) {
+        throw new Error('Stripe customer does not match the transaction');
+    }
+    if (paymentIntent.amount !== transaction.amount) {
+        throw new Error('Stripe amount does not match the transaction amount');
+    }
+    if (typeof paymentIntent.currency !== 'string' || typeof transaction.currency !== 'string' || paymentIntent.currency.toUpperCase() !== transaction.currency) {
+        throw new Error('Stripe currency does not match the transaction currency');
+    }
+    const normalizedSnapshot = normalizeCartItems(cartItemsSnapshot);
+    const normalizedTransactionItems = normalizeCartItems(transaction.items);
+    if (stableSerialize(normalizedSnapshot) !== stableSerialize(normalizedTransactionItems)) {
+        throw new Error('Stripe cart items do not match the transaction items');
+    }
+    if (paymentIntent.status !== 'succeeded') {
+        throw new Error('Payment not completed.');
+    }
+};
+const getNestedString = (value, groupName, fieldName)=>{
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const group = value[groupName];
+    if (!isRecord(group) || typeof group[fieldName] !== 'string') {
+        return undefined;
+    }
+    return group[fieldName];
+};
+const isRecord = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+const normalizeValue = (value)=>{
+    if (Array.isArray(value)) {
+        return value.map((entry)=>normalizeValue(entry));
+    }
+    if (isRecord(value)) {
+        return Object.fromEntries(Object.entries(value).flatMap(([entryKey, entryValue])=>{
+            const normalizedValue = normalizeValue(entryValue);
+            return normalizedValue === undefined ? [] : [
+                [
+                    entryKey,
+                    normalizedValue
+                ]
+            ];
+        }));
+    }
+    if (value === null || typeof value === 'boolean' || typeof value === 'number' || typeof value === 'string') {
+        return value;
+    }
+    if (value === undefined) {
+        return undefined;
+    }
+    throw new Error('Cart items contain unsupported data');
+};
+const stableSerialize = (value)=>{
+    if (Array.isArray(value)) {
+        return `[${value.map((entry)=>stableSerialize(entry)).join(',')}]`;
+    }
+    if (isRecord(value)) {
+        return `{${Object.keys(value).sort().map((key)=>`${JSON.stringify(key)}:${stableSerialize(value[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+};
+
+//# sourceMappingURL=validateSettlement.js.map

package/dist/payments/adapters/stripe/validateSettlement.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/payments/adapters/stripe/validateSettlement.ts"],"sourcesContent":["type RecordValue = Record<string, unknown>\n\ntype SettlementPaymentIntent = {\n  amount?: unknown\n  currency?: unknown\n  customer?: unknown\n  id?: unknown\n  metadata?: unknown\n  status?: unknown\n}\n\ntype SettlementTransaction = {\n  amount?: unknown\n  cart?: unknown\n  currency?: unknown\n  customer?: unknown\n  customerEmail?: unknown\n  id?: unknown\n  items?: unknown\n  order?: unknown\n  status?: unknown\n  stripe?: unknown\n}\n\ntype SettlementValidationArgs = {\n  canonicalCartID: unknown\n  cartItemsSnapshot: unknown\n  customerEmail: unknown\n  paymentIntent: SettlementPaymentIntent\n  paymentIntentID: string\n  transaction: SettlementTransaction\n  user?: { id?: unknown } | null\n}\n\nexport const getRelationshipID = (value: unknown): string | undefined => {\n  const relationshipID = isRecord(value) ? value.id : value\n\n  if (typeof relationshipID === 'number' && Number.isFinite(relationshipID)) {\n    return String(relationshipID)\n  }\n\n  if (typeof relationshipID === 'string' && relationshipID.trim()) {\n    return relationshipID\n  }\n\n  return undefined\n}\n\nexport const normalizeEmail = (value: unknown): string | undefined => {\n  if (typeof value !== 'string') {\n    return undefined\n  }\n\n  const normalizedEmail = value.trim().toLowerCase()\n\n  return normalizedEmail || undefined\n}\n\nexport const normalizeCartItems = (items: unknown): unknown[] => {\n  if (!Array.isArray(items) || items.length === 0) {\n    throw new Error('Cart items are missing or invalid')\n  }\n\n  return items.map((item) => {\n    if (!isRecord(item)) {\n      throw new Error('Cart items are missing or invalid')\n    }\n\n    const productID = getRelationshipID(item.product)\n\n    if (!productID || typeof item.quantity !== 'number' || !Number.isFinite(item.quantity)) {\n      throw new Error('Cart items are missing or invalid')\n    }\n\n    return Object.fromEntries(\n      Object.entries(item).flatMap(([key, value]) => {\n        if (key === 'product') {\n          return [[key, productID]]\n        }\n\n        if (key === 'variant') {\n          if (value === null || value === undefined) {\n            return []\n          }\n\n          const variantID = getRelationshipID(value)\n\n          if (!variantID) {\n            throw new Error('Cart item variant relationship is invalid')\n          }\n\n          return [[key, variantID]]\n        }\n\n        const normalizedValue = normalizeValue(value)\n\n        return normalizedValue === undefined ? [] : [[key, normalizedValue]]\n      }),\n    )\n  })\n}\n\nexport const validateSettlement = ({\n  canonicalCartID,\n  cartItemsSnapshot,\n  customerEmail,\n  paymentIntent,\n  paymentIntentID,\n  transaction,\n  user,\n}: SettlementValidationArgs): void => {\n  if (\n    paymentIntentID !== getNestedString(transaction, 'stripe', 'paymentIntentID') ||\n    paymentIntentID !== paymentIntent.id\n  ) {\n    throw new Error('PaymentIntent does not match the transaction')\n  }\n\n  const normalizedCartID = getRelationshipID(canonicalCartID)\n\n  if (!normalizedCartID || normalizedCartID !== getRelationshipID(transaction.cart)) {\n    throw new Error('Canonical cart does not match the transaction cart')\n  }\n\n  const metadata = isRecord(paymentIntent.metadata) ? paymentIntent.metadata : undefined\n\n  if (normalizedCartID !== getRelationshipID(metadata?.cartID)) {\n    throw new Error('Canonical cart does not match the PaymentIntent cart')\n  }\n\n  const transactionCustomerID = getRelationshipID(transaction.customer)\n\n  if (user !== null && user !== undefined) {\n    const authenticatedUserID = getRelationshipID(user.id)\n\n    if (!authenticatedUserID) {\n      throw new Error('Authenticated customer ID is missing or invalid')\n    }\n\n    if (transactionCustomerID !== authenticatedUserID) {\n      throw new Error('Authenticated customer does not match the transaction customer')\n    }\n  } else {\n    if (transactionCustomerID) {\n      throw new Error('Guest transaction belongs to an authenticated customer')\n    }\n\n    const normalizedCustomerEmail = normalizeEmail(customerEmail)\n\n    if (\n      !normalizedCustomerEmail ||\n      normalizedCustomerEmail !== normalizeEmail(transaction.customerEmail)\n    ) {\n      throw new Error('Guest email does not match the transaction email')\n    }\n  }\n\n  const stripeCustomerID = getNestedString(transaction, 'stripe', 'customerID')\n\n  if (!stripeCustomerID || stripeCustomerID !== getRelationshipID(paymentIntent.customer)) {\n    throw new Error('Stripe customer does not match the transaction')\n  }\n\n  if (paymentIntent.amount !== transaction.amount) {\n    throw new Error('Stripe amount does not match the transaction amount')\n  }\n\n  if (\n    typeof paymentIntent.currency !== 'string' ||\n    typeof transaction.currency !== 'string' ||\n    paymentIntent.currency.toUpperCase() !== transaction.currency\n  ) {\n    throw new Error('Stripe currency does not match the transaction currency')\n  }\n\n  const normalizedSnapshot = normalizeCartItems(cartItemsSnapshot)\n  const normalizedTransactionItems = normalizeCartItems(transaction.items)\n\n  if (stableSerialize(normalizedSnapshot) !== stableSerialize(normalizedTransactionItems)) {\n    throw new Error('Stripe cart items do not match the transaction items')\n  }\n\n  if (paymentIntent.status !== 'succeeded') {\n    throw new Error('Payment not completed.')\n  }\n}\n\nconst getNestedString = (\n  value: unknown,\n  groupName: string,\n  fieldName: string,\n): string | undefined => {\n  if (!isRecord(value)) {\n    return undefined\n  }\n\n  const group = value[groupName]\n\n  if (!isRecord(group) || typeof group[fieldName] !== 'string') {\n    return undefined\n  }\n\n  return group[fieldName]\n}\n\nconst isRecord = (value: unknown): value is RecordValue =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\nconst normalizeValue = (value: unknown): unknown => {\n  if (Array.isArray(value)) {\n    return value.map((entry) => normalizeValue(entry))\n  }\n\n  if (isRecord(value)) {\n    return Object.fromEntries(\n      Object.entries(value).flatMap(([entryKey, entryValue]) => {\n        const normalizedValue = normalizeValue(entryValue)\n\n        return normalizedValue === undefined ? [] : [[entryKey, normalizedValue]]\n      }),\n    )\n  }\n\n  if (\n    value === null ||\n    typeof value === 'boolean' ||\n    typeof value === 'number' ||\n    typeof value === 'string'\n  ) {\n    return value\n  }\n\n  if (value === undefined) {\n    return undefined\n  }\n\n  throw new Error('Cart items contain unsupported data')\n}\n\nconst stableSerialize = (value: unknown): string => {\n  if (Array.isArray(value)) {\n    return `[${value.map((entry) => stableSerialize(entry)).join(',')}]`\n  }\n\n  if (isRecord(value)) {\n    return `{${Object.keys(value)\n      .sort()\n      .map((key) => `${JSON.stringify(key)}:${stableSerialize(value[key])}`)\n      .join(',')}}`\n  }\n\n  return JSON.stringify(value)\n}\n"],"names":["getRelationshipID","value","relationshipID","isRecord","id","Number","isFinite","String","trim","undefined","normalizeEmail","normalizedEmail","toLowerCase","normalizeCartItems","items","Array","isArray","length","Error","map","item","productID","product","quantity","Object","fromEntries","entries","flatMap","key","variantID","normalizedValue","normalizeValue","validateSettlement","canonicalCartID","cartItemsSnapshot","customerEmail","paymentIntent","paymentIntentID","transaction","user","getNestedString","normalizedCartID","cart","metadata","cartID","transactionCustomerID","customer","authenticatedUserID","normalizedCustomerEmail","stripeCustomerID","amount","currency","toUpperCase","normalizedSnapshot","normalizedTransactionItems","stableSerialize","status","groupName","fieldName","group","entry","entryKey","entryValue","join","keys","sort","JSON","stringify"],"mappings":"AAkCA,OAAO,MAAMA,oBAAoB,CAACC;IAChC,MAAMC,iBAAiBC,SAASF,SAASA,MAAMG,EAAE,GAAGH;IAEpD,IAAI,OAAOC,mBAAmB,YAAYG,OAAOC,QAAQ,CAACJ,iBAAiB;QACzE,OAAOK,OAAOL;IAChB;IAEA,IAAI,OAAOA,mBAAmB,YAAYA,eAAeM,IAAI,IAAI;QAC/D,OAAON;IACT;IAEA,OAAOO;AACT,EAAC;AAED,OAAO,MAAMC,iBAAiB,CAACT;IAC7B,IAAI,OAAOA,UAAU,UAAU;QAC7B,OAAOQ;IACT;IAEA,MAAME,kBAAkBV,MAAMO,IAAI,GAAGI,WAAW;IAEhD,OAAOD,mBAAmBF;AAC5B,EAAC;AAED,OAAO,MAAMI,qBAAqB,CAACC;IACjC,IAAI,CAACC,MAAMC,OAAO,CAACF,UAAUA,MAAMG,MAAM,KAAK,GAAG;QAC/C,MAAM,IAAIC,MAAM;IAClB;IAEA,OAAOJ,MAAMK,GAAG,CAAC,CAACC;QAChB,IAAI,CAACjB,SAASiB,OAAO;YACnB,MAAM,IAAIF,MAAM;QAClB;QAEA,MAAMG,YAAYrB,kBAAkBoB,KAAKE,OAAO;QAEhD,IAAI,CAACD,aAAa,OAAOD,KAAKG,QAAQ,KAAK,YAAY,CAAClB,OAAOC,QAAQ,CAACc,KAAKG,QAAQ,GAAG;YACtF,MAAM,IAAIL,MAAM;QAClB;QAEA,OAAOM,OAAOC,WAAW,CACvBD,OAAOE,OAAO,CAACN,MAAMO,OAAO,CAAC,CAAC,CAACC,KAAK3B,MAAM;YACxC,IAAI2B,QAAQ,WAAW;gBACrB,OAAO;oBAAC;wBAACA;wBAAKP;qBAAU;iBAAC;YAC3B;YAEA,IAAIO,QAAQ,WAAW;gBACrB,IAAI3B,UAAU,QAAQA,UAAUQ,WAAW;oBACzC,OAAO,EAAE;gBACX;gBAEA,MAAMoB,YAAY7B,kBAAkBC;gBAEpC,IAAI,CAAC4B,WAAW;oBACd,MAAM,IAAIX,MAAM;gBAClB;gBAEA,OAAO;oBAAC;wBAACU;wBAAKC;qBAAU;iBAAC;YAC3B;YAEA,MAAMC,kBAAkBC,eAAe9B;YAEvC,OAAO6B,oBAAoBrB,YAAY,EAAE,GAAG;gBAAC;oBAACmB;oBAAKE;iBAAgB;aAAC;QACtE;IAEJ;AACF,EAAC;AAED,OAAO,MAAME,qBAAqB,CAAC,EACjCC,eAAe,EACfC,iBAAiB,EACjBC,aAAa,EACbC,aAAa,EACbC,eAAe,EACfC,WAAW,EACXC,IAAI,EACqB;IACzB,IACEF,oBAAoBG,gBAAgBF,aAAa,UAAU,sBAC3DD,oBAAoBD,cAAchC,EAAE,EACpC;QACA,MAAM,IAAIc,MAAM;IAClB;IAEA,MAAMuB,mBAAmBzC,kBAAkBiC;IAE3C,IAAI,CAACQ,oBAAoBA,qBAAqBzC,kBAAkBsC,YAAYI,IAAI,GAAG;QACjF,MAAM,IAAIxB,MAAM;IAClB;IAEA,MAAMyB,WAAWxC,SAASiC,cAAcO,QAAQ,IAAIP,cAAcO,QAAQ,GAAGlC;IAE7E,IAAIgC,qBAAqBzC,kBAAkB2C,UAAUC,SAAS;QAC5D,MAAM,IAAI1B,MAAM;IAClB;IAEA,MAAM2B,wBAAwB7C,kBAAkBsC,YAAYQ,QAAQ;IAEpE,IAAIP,SAAS,QAAQA,SAAS9B,WAAW;QACvC,MAAMsC,sBAAsB/C,kBAAkBuC,KAAKnC,EAAE;QAErD,IAAI,CAAC2C,qBAAqB;YACxB,MAAM,IAAI7B,MAAM;QAClB;QAEA,IAAI2B,0BAA0BE,qBAAqB;YACjD,MAAM,IAAI7B,MAAM;QAClB;IACF,OAAO;QACL,IAAI2B,uBAAuB;YACzB,MAAM,IAAI3B,MAAM;QAClB;QAEA,MAAM8B,0BAA0BtC,eAAeyB;QAE/C,IACE,CAACa,2BACDA,4BAA4BtC,eAAe4B,YAAYH,aAAa,GACpE;YACA,MAAM,IAAIjB,MAAM;QAClB;IACF;IAEA,MAAM+B,mBAAmBT,gBAAgBF,aAAa,UAAU;IAEhE,IAAI,CAACW,oBAAoBA,qBAAqBjD,kBAAkBoC,cAAcU,QAAQ,GAAG;QACvF,MAAM,IAAI5B,MAAM;IAClB;IAEA,IAAIkB,cAAcc,MAAM,KAAKZ,YAAYY,MAAM,EAAE;QAC/C,MAAM,IAAIhC,MAAM;IAClB;IAEA,IACE,OAAOkB,cAAce,QAAQ,KAAK,YAClC,OAAOb,YAAYa,QAAQ,KAAK,YAChCf,cAAce,QAAQ,CAACC,WAAW,OAAOd,YAAYa,QAAQ,EAC7D;QACA,MAAM,IAAIjC,MAAM;IAClB;IAEA,MAAMmC,qBAAqBxC,mBAAmBqB;IAC9C,MAAMoB,6BAA6BzC,mBAAmByB,YAAYxB,KAAK;IAEvE,IAAIyC,gBAAgBF,wBAAwBE,gBAAgBD,6BAA6B;QACvF,MAAM,IAAIpC,MAAM;IAClB;IAEA,IAAIkB,cAAcoB,MAAM,KAAK,aAAa;QACxC,MAAM,IAAItC,MAAM;IAClB;AACF,EAAC;AAED,MAAMsB,kBAAkB,CACtBvC,OACAwD,WACAC;IAEA,IAAI,CAACvD,SAASF,QAAQ;QACpB,OAAOQ;IACT;IAEA,MAAMkD,QAAQ1D,KAAK,CAACwD,UAAU;IAE9B,IAAI,CAACtD,SAASwD,UAAU,OAAOA,KAAK,CAACD,UAAU,KAAK,UAAU;QAC5D,OAAOjD;IACT;IAEA,OAAOkD,KAAK,CAACD,UAAU;AACzB;AAEA,MAAMvD,WAAW,CAACF,QAChB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACc,MAAMC,OAAO,CAACf;AAEhE,MAAM8B,iBAAiB,CAAC9B;IACtB,IAAIc,MAAMC,OAAO,CAACf,QAAQ;QACxB,OAAOA,MAAMkB,GAAG,CAAC,CAACyC,QAAU7B,eAAe6B;IAC7C;IAEA,IAAIzD,SAASF,QAAQ;QACnB,OAAOuB,OAAOC,WAAW,CACvBD,OAAOE,OAAO,CAACzB,OAAO0B,OAAO,CAAC,CAAC,CAACkC,UAAUC,WAAW;YACnD,MAAMhC,kBAAkBC,eAAe+B;YAEvC,OAAOhC,oBAAoBrB,YAAY,EAAE,GAAG;gBAAC;oBAACoD;oBAAU/B;iBAAgB;aAAC;QAC3E;IAEJ;IAEA,IACE7B,UAAU,QACV,OAAOA,UAAU,aACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU,UACjB;QACA,OAAOA;IACT;IAEA,IAAIA,UAAUQ,WAAW;QACvB,OAAOA;IACT;IAEA,MAAM,IAAIS,MAAM;AAClB;AAEA,MAAMqC,kBAAkB,CAACtD;IACvB,IAAIc,MAAMC,OAAO,CAACf,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAEA,MAAMkB,GAAG,CAAC,CAACyC,QAAUL,gBAAgBK,QAAQG,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE;IAEA,IAAI5D,SAASF,QAAQ;QACnB,OAAO,CAAC,CAAC,EAAEuB,OAAOwC,IAAI,CAAC/D,OACpBgE,IAAI,GACJ9C,GAAG,CAAC,CAACS,MAAQ,GAAGsC,KAAKC,SAAS,CAACvC,KAAK,CAAC,EAAE2B,gBAAgBtD,KAAK,CAAC2B,IAAI,GAAG,EACpEmC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB;IAEA,OAAOG,KAAKC,SAAS,CAAClE;AACxB"}