@pithy-sh/payments 0.1.0

package/src/rails/lemonSqueezy/api.ts

@@ -0,0 +1,192 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { z } from "zod";
+import { PaymentsProviderUnavailableError, PaymentsRailNotConfiguredError } from "../../error/errors";
+
+/**
+ * The one door out to Lemon Squeezy, and the mapping from how it answered to what that means.
+ *
+ * Reached with `fetch` and JSON:API rather than through the `@lemonsqueezy/lemonsqueezy.js` package, for the
+ * reason `stripe/api.ts` gives: four calls are needed — create a checkout, read an order, read a
+ * subscription, read a customer — and each is one request. Every other third-party API in this repo is
+ * spoken to the same way: `fetch` out, Zod in.
+ *
+ * ## JSON:API, and the one thing it costs
+ *
+ * Lemon Squeezy speaks JSON:API, so every answer is `{ data: { id, type, attributes: {…} } }` and every
+ * request body is the same shape. The `id` is a **string containing an integer**, and the integers are
+ * **per object type**: order `8801` and subscription-invoice `8801` are different objects. Nothing in this
+ * module cares, but {@link namespacedId} exists because the projection very much does — see `objects.ts`.
+ *
+ * The `Accept` and `Content-Type` are `application/vnd.api+json`, which the API enforces. A request sent as
+ * `application/json` is refused with a 415, and that refusal reads as a configuration failure rather than
+ * as anything a buyer did — which is exactly how the mapping below treats it.
+ *
+ * ## How an answer is read
+ *
+ * **A 5xx or a 429 is `payments/provider_unavailable` (503).** Lemon Squeezy is up but not answering. The
+ * caller retries, and on the webhook path that code passes through the guard unchanged so the store
+ * redelivers rather than being told its signature was bad.
+ *
+ * **Every other 4xx is `payments/rail_not_configured` (404).** A 4xx here is never the buyer's fault: these
+ * requests are built entirely from config, from the credential bundle, and from rows we wrote. A rejected
+ * API key, a variant that does not belong to this store, a store id that is not ours — all one statement,
+ * that this project's Lemon Squeezy rail is not set up to do what it was asked.
+ *
+ * **A 404 is an absent resource only for a caller that said it was probing.** `absentOn404` is how a
+ * refresh distinguishes "Lemon Squeezy no longer knows this subscription" — a normal answer, which the
+ * contract says is `undefined` — from "our API key is wrong". Only a caller that knows the difference may
+ * claim it.
+ *
+ * **Nothing in a refusal carries the API key.** `detail` is written to an operator's logs, so anything
+ * key-shaped in a message is redacted before it gets there.
+ */
+
+/** Lemon Squeezy's REST base. Public and stable, so it is pinned rather than configured. */
+export const LEMON_SQUEEZY_API_BASE = "https://api.lemonsqueezy.com/v1";
+
+/** The media type JSON:API mandates, and which this API enforces on both directions. */
+const JSON_API_MEDIA_TYPE = "application/vnd.api+json";
+
+/** One outbound request, narrowed to what this rail's endpoints need. */
+export interface LemonSqueezyHttpRequest {
+  /** The HTTP method. */
+  method?: string;
+  /** Request headers — the bearer key and the JSON:API media type. */
+  headers?: Record<string, string>;
+  /** The JSON:API body, on a POST. */
+  body?: string;
+}
+
+/** What this rail needs of a response. Structural, so a test can answer without building a `Response`. */
+export interface LemonSqueezyHttpResponse {
+  /** Whether the status is 2xx. */
+  ok: boolean;
+  /** The HTTP status. */
+  status: number;
+  /** The body as text — read once, then parsed here, so a non-JSON body is reportable rather than a throw. */
+  text(): Promise<string>;
+}
+
+/** The HTTP seam. One explicit parameter defaulting to the runtime's `fetch`, as every rail has. */
+export type LemonSqueezyHttpFetch = (url: string, init?: LemonSqueezyHttpRequest) => Promise<LemonSqueezyHttpResponse>;
+
+/** The runtime's own `fetch`, adapted to the seam. */
+export const lemonSqueezyHttpFetch: LemonSqueezyHttpFetch = (url, init) =>
+  fetch(url, init as RequestInit) as unknown as Promise<LemonSqueezyHttpResponse>;
+
+/** Lemon Squeezy's error envelope — JSON:API's `errors` array, of which only the first is worth reporting. */
+const LemonSqueezyApiError = z.object({
+  errors: z.array(
+    z.object({ status: z.string().optional(), title: z.string().optional(), detail: z.string().optional() }),
+  ),
+});
+
+/** What one call needs: what it is for, the key, and optionally a body or a probe flag. */
+export interface LemonSqueezyJsonOptions {
+  /** What was being asked for, in an operator's words. Lands in every refusal's `detail`. */
+  what: string;
+  /** The Lemon Squeezy API key. */
+  apiKey: string;
+  /** The JSON:API request body, on a POST. */
+  body?: unknown;
+  /** The query string, already composed. */
+  query?: Record<string, string>;
+  /** Whether a 404 means "no such object" rather than "this rail is misconfigured". */
+  absentOn404?: boolean;
+}
+
+/**
+ * One call to Lemon Squeezy. Returns the parsed body, or `undefined` for a probing caller's 404.
+ *
+ * `unknown` rather than a typed answer: the caller narrows with its own Zod object, because what a
+ * subscription looks like is `objects.ts`'s business and not this module's.
+ */
+export async function lemonSqueezyJson(
+  transport: LemonSqueezyHttpFetch,
+  path: string,
+  options: LemonSqueezyJsonOptions,
+): Promise<unknown | undefined> {
+  const query =
+    options.query === undefined || Object.keys(options.query).length === 0
+      ? ""
+      : `?${new URLSearchParams(options.query).toString()}`;
+  const headers: Record<string, string> = {
+    authorization: `Bearer ${options.apiKey}`,
+    accept: JSON_API_MEDIA_TYPE,
+  };
+  if (options.body !== undefined) headers["content-type"] = JSON_API_MEDIA_TYPE;
+
+  let response: LemonSqueezyHttpResponse;
+  try {
+    response = await transport(`${LEMON_SQUEEZY_API_BASE}${path}${query}`, {
+      method: options.body === undefined ? "GET" : "POST",
+      headers,
+      body: options.body === undefined ? undefined : JSON.stringify(options.body),
+    });
+  } catch (cause) {
+    throw new PaymentsProviderUnavailableError(
+      { detail: `Lemon Squeezy did not answer when asked for ${options.what}.` },
+      { cause },
+    );
+  }
+
+  const text = await response.text();
+
+  if (!response.ok) {
+    if (response.status === 404 && options.absentOn404) return undefined;
+    throw refusal(response.status, text, options);
+  }
+
+  try {
+    return JSON.parse(text) as unknown;
+  } catch (cause) {
+    throw new PaymentsProviderUnavailableError(
+      { detail: `Lemon Squeezy answered with a non-JSON body when asked for ${options.what}.` },
+      { cause },
+    );
+  }
+}
+
+/** The refusal for a non-2xx answer: retryable if the store is struggling, a configuration failure otherwise. */
+function refusal(status: number, body: string, options: LemonSqueezyJsonOptions): PaymentsProviderUnavailableError {
+  if (status === 429 || status >= 500) {
+    return new PaymentsProviderUnavailableError({
+      detail: `Lemon Squeezy answered ${status} when asked for ${options.what}. ${lemonSqueezySaid(body)}`,
+    });
+  }
+
+  const key = status === 401 || status === 403 ? " Check the API key stored for this environment." : "";
+  return new PaymentsRailNotConfiguredError({
+    detail: `Lemon Squeezy refused the request for ${options.what} with ${status}.${key} ${lemonSqueezySaid(body)}`,
+  });
+}
+
+/** Lemon Squeezy's own account of the failure, redacted. Empty when the body was not its error envelope. */
+function lemonSqueezySaid(body: string): string {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body) as unknown;
+  } catch {
+    return "";
+  }
+  const envelope = LemonSqueezyApiError.safeParse(parsed);
+  if (!envelope.success) return "";
+  const first = envelope.data.errors[0];
+  if (first === undefined) return "";
+  const parts = [first.title, first.detail].filter((part): part is string => part !== undefined);
+  return parts.length === 0 ? "" : `Lemon Squeezy said: ${redactLemonSqueezySecrets(parts.join(" / "))}.`;
+}
+
+/**
+ * Blank out anything key-shaped in text bound for a log.
+ *
+ * Belt and braces, exactly as the Stripe rail's equivalent: `detail` is written to an operator's logs, and
+ * a credential that reaches one has to be rotated. Lemon Squeezy API keys are long opaque strings with no
+ * fixed prefix, so what is matched is the shape a JWT-ish or base64url key takes at 40 characters or more —
+ * long enough that a variant id, a store id, or an ordinary sentence cannot trip it.
+ */
+export function redactLemonSqueezySecrets(text: string): string {
+  return text.replace(/\b[A-Za-z0-9_-]{40,}\b/g, "…");
+}

package/src/rails/lemonSqueezy/checkout.ts

@@ -0,0 +1,186 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { PithyError } from "@pithy-sh/core/src/error/pithyError";
+import { z } from "zod";
+import { encodeSubjectReference } from "../../data/subject";
+import { PaymentsDiscountInvalidError, PaymentsProviderUnavailableError } from "../../error/errors";
+import type { PaymentsLemonSqueezyCredentials } from "../../secret/registry";
+import type { CheckoutHandoff, CheckoutSessionInput } from "../contract";
+import { type LemonSqueezyHttpFetch, lemonSqueezyHttpFetch, lemonSqueezyJson } from "./api";
+import {
+  accountReferenceProof,
+  LEMON_SQUEEZY_CUSTOM_ACCOUNT,
+  LEMON_SQUEEZY_CUSTOM_ENV,
+  LEMON_SQUEEZY_CUSTOM_PROOF,
+} from "./objects";
+
+/**
+ * Hosted checkout, and nothing else.
+ *
+ * Lemon Squeezy presents the payment page, takes the money as **merchant of record**, and owns the sales
+ * tax, the VAT registration, the invoice and the dunning. Pithy sends a browser there and hears the outcome
+ * on a webhook. That division is the whole reason this rail exists, and there is no card field anywhere in
+ * this package.
+ *
+ * ## What this call stamps, and why each of them
+ *
+ * **The resolved subject, in `checkout_data.custom`.** A Lemon Squeezy purchase is only ever heard about
+ * through a webhook, and that webhook carries a `customer_id` and no Pithy holder. This is the pairing, and it
+ * is why the `/checkout` route resolves the subject through the configured seam and never from a request body:
+ * a client that could name it could attach its purchase to somebody else's account, or somebody else's
+ * purchase to its own.
+ *
+ * The value is `encodeSubjectReference`'s output — `user:ada`, `organization:acme` — and **both halves travel
+ * or neither does**. Nothing keeps an organization id from equalling some user's, so a bare id read back at
+ * the far end would eventually hand one holder's purchase to the other. A bare id is also exactly what this
+ * rail stamped before subjects existed, and `decodeSubjectReference` refuses one on purpose: the purchase
+ * orphans, replayable, rather than being attributed to a stranger. The key name is unchanged through all of
+ * that — see `objects.ts`.
+ *
+ * **This deployment's environment, in the same place.** A Lemon Squeezy store is one namespace across every
+ * environment — test mode is a flag on an object, not a separate store — so `dev` and `staging` pointed at
+ * one store hear each other's webhooks. The stamp is what lets each ignore the other's.
+ *
+ * **Both keys are snake_case.** Lemon Squeezy normalizes custom keys before echoing them back, so a
+ * camelCase key sent is a snake_case key returned, and a reader looking for what it sent finds nothing. The
+ * binding silently never happens. Both sides read the same two constants, and a round-trip test pins it.
+ *
+ * ## What it deliberately does not do
+ *
+ * No quantity, no discount code, no plan-change or proration logic, and no price. The variant *is* the
+ * price — that is Lemon Squeezy's model — and a checkout that could name an amount would be a checkout a
+ * client could name an amount on.
+ */
+
+/** What creating a checkout needs beyond the input: the credentials, the deployment, and the transport. */
+export interface LemonSqueezyCheckoutOptions {
+  /** The rail's credentials. `apiKey` creates the checkout; `storeId` says which store it belongs to. */
+  credentials: PaymentsLemonSqueezyCredentials;
+  /** This deployment's `ENVIRONMENT`, stamped so its own webhooks are recognizable. */
+  deployment?: string;
+  /** The HTTP seam. Defaults to the runtime's `fetch`. */
+  transport?: LemonSqueezyHttpFetch;
+}
+
+/** A created checkout, narrowed to the one field a browser needs. */
+const LemonSqueezyCheckout = z
+  .object({
+    data: z
+      .object({
+        id: z.string().describe("The checkout's id."),
+        attributes: z
+          .object({ url: z.string().min(1).describe("The hosted page to send the browser to.") })
+          .loose()
+          .describe("The checkout's fields."),
+      })
+      .loose(),
+  })
+  .describe("A created Lemon Squeezy checkout, as much of it as a redirect needs.");
+
+/** Create a hosted checkout for one product, and return where to send the browser. */
+export async function createLemonSqueezyCheckoutSession(
+  input: CheckoutSessionInput,
+  options: LemonSqueezyCheckoutOptions,
+): Promise<CheckoutHandoff> {
+  // One encoding, from the one function. The webhook reads it back through `decodeSubjectReference`, and a
+  // second spelling anywhere is a purchase stamped by one code path and read by another.
+  const accountReference = encodeSubjectReference(input.subject);
+
+  const custom: Record<string, string> = { [LEMON_SQUEEZY_CUSTOM_ACCOUNT]: accountReference };
+  if (options.deployment !== undefined) {
+    custom[LEMON_SQUEEZY_CUSTOM_ENV] = options.deployment;
+    // The proof, without which the two values above are worth nothing: a stranger can set them from a
+    // public storefront buy link, and both key names are exported constants. This is the part they cannot
+    // produce. See `accountReferenceProof`.
+    custom[LEMON_SQUEEZY_CUSTOM_PROOF] = await accountReferenceProof(
+      accountReference,
+      options.deployment,
+      options.credentials.webhookSecret,
+    );
+  }
+
+  const created = await withDiscountRefusal(input.discountCode, () =>
+    lemonSqueezyJson(options.transport ?? lemonSqueezyHttpFetch, "/checkouts", {
+      what: "a checkout",
+      apiKey: options.credentials.apiKey,
+      body: {
+        data: {
+          type: "checkouts",
+          attributes: {
+            checkout_data: {
+              // The resolved subject, echoed back on every webhook this purchase produces.
+              custom,
+              // The code, handed over exactly as the caller typed it. Lemon Squeezy resolves it and computes
+              // the price; nothing here validates it or multiplies anything. Unlike Stripe there is no id to
+              // look up — the store takes the customer-facing string — so an unusable code is learned from
+              // the store's own refusal, which `lemonSqueezyJson` surfaces below.
+              ...(input.discountCode === undefined ? {} : { discount_code: input.discountCode }),
+            },
+            product_options: {
+              redirect_url: input.successUrl,
+            },
+            checkout_options: {
+              // Lemon Squeezy's own page, unembedded. Pithy owns no payment UI.
+              embed: false,
+            },
+          },
+          relationships: {
+            store: { data: { type: "stores", id: options.credentials.storeId } },
+            variant: { data: { type: "variants", id: input.providerProductId } },
+          },
+        },
+      },
+    }),
+  );
+
+  const parsed = LemonSqueezyCheckout.safeParse(created);
+  if (!parsed.success) {
+    // Lemon Squeezy created something and did not say where to send the browser. A redirect to an absent
+    // URL is worse than a refusal the caller can retry.
+    throw new PaymentsProviderUnavailableError({
+      detail: "Lemon Squeezy created a checkout with no URL to redirect to.",
+    });
+  }
+  return { kind: "redirect", url: parsed.data.data.attributes.url };
+}
+
+/**
+ * Re-read a refused checkout as a refused *code*, when a code was sent.
+ *
+ * Lemon Squeezy takes the customer-facing string rather than an id, so there is no lookup to learn a bad
+ * code from before the fact — the store's refusal of the whole checkout is the first news of it. Left alone
+ * that surfaces as `payments/rail_not_configured`, which tells a customer this payment method is
+ * unavailable when what actually happened is that their code was not accepted.
+ *
+ * The reclassification is narrow and its reasoning is the same one `api.ts` uses to call a 4xx a
+ * configuration failure: **every other input to this request comes from config, the credential bundle, or a
+ * row we wrote.** The discount code is the only caller-influenced value in it, so when one was sent and the
+ * store refuses on the caller's side of the line, the code is what it refused. A 5xx or a 429 is untouched —
+ * that is the store struggling, not judging — and so is a refusal when no code was sent at all.
+ *
+ * The store's own sentence rides in `detail` for the operator; the customer gets the code back and an action
+ * they can take.
+ */
+async function withDiscountRefusal<T>(code: string | undefined, call: () => Promise<T>): Promise<T> {
+  if (code === undefined) return await call();
+  try {
+    return await call();
+  } catch (cause) {
+    // A 401 or a 403 is our credentials, not their code, and `api.ts` folds both into
+    // `rail_not_configured` — so reclassifying every one of those would tell a customer their perfectly
+    // good code was rejected while the real fault is an API key nobody rotated. `detail` still carries the
+    // status, which is what distinguishes them.
+    const credentials = /with 40[13]\./.test(cause instanceof PithyError ? (cause.payload.detail ?? "") : "");
+    if (cause instanceof PithyError && cause.payload.code === "payments/rail_not_configured" && !credentials) {
+      throw new PaymentsDiscountInvalidError(
+        {
+          message: `"${code}" is not a discount code we can accept.`,
+          detail: `Lemon Squeezy refused a checkout carrying discount code "${code}". ${cause.payload.detail ?? ""}`,
+        },
+        { cause },
+      );
+    }
+    throw cause;
+  }
+}

package/src/rails/lemonSqueezy/discounts.ts

@@ -0,0 +1,166 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { z } from "zod";
+import type { CreatedDiscount, DiscountTerms } from "../../data/discount";
+import { PaymentsDiscountInvalidError } from "../../error/errors";
+import type { PaymentsLemonSqueezyCredentials } from "../../secret/registry";
+import type { ListedDiscount } from "../contract";
+import { type LemonSqueezyHttpFetch, lemonSqueezyHttpFetch, lemonSqueezyJson } from "./api";
+
+/**
+ * Minting a discount at Lemon Squeezy, from the normalized terms.
+ *
+ * One object rather than Stripe's two: a Discount carries the money, the duration, the redemption limit and
+ * the expiry together, and the code is a field on it rather than a separate object.
+ *
+ * ## The two translations that decide whether a customer is charged correctly
+ *
+ * **Duration.** Lemon Squeezy counts in **billing periods** — `duration_in_months` is its field name, and
+ * the name is a trap, because the store applies the number to renewals rather than to months. That happens
+ * to be the unit `DiscountDuration` already uses, so the number passes through unchanged. **This is the rail
+ * where the value is *not* converted, and Stripe is the one where it is** — which is precisely why neither
+ * rail's field name was allowed to become the normalized one. `discounts.test.ts` pins an annual plan on
+ * both rails and asserts the two produce the same customer-visible term from different numbers.
+ *
+ * **Expiry.** `redeemableUntil` means the code can no longer be *claimed*. Lemon Squeezy's `expires_at`
+ * stops redemption and leaves an existing subscriber's discount running, which is the same meaning — so it
+ * maps directly, and a test pins that a code already redeemed keeps its rate past the date.
+ *
+ * ## Amount, and the currency that arrives at the customer
+ *
+ * A fixed amount carries a currency; Lemon Squeezy applies it against a store whose subscriptions have their
+ * own. A mismatch is not refused at creation by the store — it fails at *redemption*, in front of whoever
+ * typed the code. `createDiscount` on this rail therefore refuses a fixed amount in a currency the store
+ * does not use before sending anything, naming both currencies, which is the only moment the adopter is
+ * still the one reading the error.
+ */
+
+/** What creating a discount needs: the credentials, the store's currency, and the transport. */
+export interface LemonSqueezyDiscountOptions {
+  /** The rail's credentials. `apiKey` creates; `storeId` says which store it belongs to. */
+  credentials: PaymentsLemonSqueezyCredentials;
+  /**
+   * The currency this store prices in, when it is known.
+   *
+   * Supplied so a fixed amount in another currency is refused here rather than at redemption. Absent means
+   * the check cannot be made and the store's own judgment stands — better than inventing a currency.
+   */
+  storeCurrency?: string;
+  /** The HTTP seam. Defaults to the runtime's `fetch`. */
+  transport?: LemonSqueezyHttpFetch;
+}
+
+/** A created discount, narrowed to what an adopter needs back. */
+const LemonSqueezyDiscount = z
+  .object({
+    data: z
+      .object({
+        id: z.string().min(1),
+        attributes: z.object({ code: z.string().min(1) }).loose(),
+      })
+      .loose(),
+  })
+  .loose();
+
+/** Create a discount and return the code a customer will type. */
+export async function createLemonSqueezyDiscount(
+  terms: DiscountTerms,
+  options: LemonSqueezyDiscountOptions,
+): Promise<CreatedDiscount> {
+  if (
+    terms.amount.kind === "fixed" &&
+    options.storeCurrency !== undefined &&
+    options.storeCurrency.toLowerCase() !== terms.amount.currency.toLowerCase()
+  ) {
+    // Refused before anything is sent. At the store this would be accepted and then fail when somebody
+    // redeems it — so the adopter who can fix it would never see the error, and the customer who cannot
+    // would.
+    throw new PaymentsDiscountInvalidError({
+      message: "That discount is in a currency this store does not sell in.",
+      action: `Create it in ${options.storeCurrency.toUpperCase()}, or use a percentage instead.`,
+      detail: `A fixed discount of ${terms.amount.amountMinor} ${terms.amount.currency.toUpperCase()} cannot apply to a store selling in ${options.storeCurrency.toUpperCase()}. Lemon Squeezy accepts the object and refuses it at redemption, in front of the customer.`,
+    });
+  }
+
+  const attributes: Record<string, unknown> = {
+    name: terms.code ?? "Discount",
+    amount_type: terms.amount.kind === "percent" ? "percent" : "fixed",
+    amount: terms.amount.kind === "percent" ? terms.amount.percent : terms.amount.amountMinor,
+    // `once` | `forever` | `repeating`, the same three words. Only the number beneath differs.
+    duration: terms.duration.kind,
+    is_limited_redemptions: terms.maxRedemptions !== undefined,
+  };
+  if (terms.code !== undefined) attributes.code = terms.code;
+  if (terms.duration.kind === "repeating") {
+    // **Not converted.** The field is called `duration_in_months` and counts billing periods; see the module
+    // doc. Converting here is the annual-plan defect, committed on the other rail.
+    attributes.duration_in_months = terms.duration.billingPeriods;
+  }
+  if (terms.maxRedemptions !== undefined) attributes.max_redemptions = terms.maxRedemptions;
+  if (terms.redeemableUntil !== undefined) attributes.expires_at = terms.redeemableUntil.toISOString();
+
+  const created = await lemonSqueezyJson(options.transport ?? lemonSqueezyHttpFetch, "/discounts", {
+    what: "a discount",
+    apiKey: options.credentials.apiKey,
+    body: {
+      data: {
+        type: "discounts",
+        attributes,
+        relationships: { store: { data: { type: "stores", id: options.credentials.storeId } } },
+      },
+    },
+  });
+
+  const parsed = LemonSqueezyDiscount.safeParse(created);
+  if (!parsed.success) {
+    throw new PaymentsDiscountInvalidError({
+      detail: "Lemon Squeezy created a discount and returned no code for it.",
+    });
+  }
+  return { code: parsed.data.data.attributes.code, providerDiscountId: parsed.data.data.id, terms };
+}
+
+/** Lemon Squeezy's discount list, narrowed to what a management pane shows. */
+const LemonSqueezyDiscountList = z
+  .object({
+    data: z.array(
+      z
+        .object({
+          id: z.string().min(1),
+          attributes: z
+            .object({
+              code: z.string().min(1),
+              amount: z.number().nullish(),
+              amount_type: z.string().nullish(),
+              duration: z.string().nullish(),
+            })
+            .loose(),
+        })
+        .loose(),
+    ),
+  })
+  .loose();
+
+/** The discount codes this store holds. */
+export async function listLemonSqueezyDiscounts(
+  options: LemonSqueezyDiscountOptions,
+): Promise<readonly ListedDiscount[]> {
+  const found = await lemonSqueezyJson(options.transport ?? lemonSqueezyHttpFetch, "/discounts", {
+    what: "the discount codes",
+    apiKey: options.credentials.apiKey,
+    query: { "filter[store_id]": options.credentials.storeId },
+  });
+  const parsed = LemonSqueezyDiscountList.safeParse(found);
+  if (!parsed.success) return [];
+  return parsed.data.data.map((discount) => ({
+    code: discount.attributes.code,
+    providerDiscountId: discount.id,
+    amount:
+      discount.attributes.amount_type === "percent"
+        ? `${discount.attributes.amount ?? 0}%`
+        : `${discount.attributes.amount ?? 0} ${options.storeCurrency ?? ""}`.trim(),
+    // Lemon Squeezy does not report a redemption count on the discount object.
+    redemptions: null,
+  }));
+}