@proxy-checkout/stripe-server-js 0.0.0-pr-76.20.1 → 0.0.0-pr-76.21.1

package/README.md

@@ -4,7 +4,7 @@ Server-side Stripe adapter for Proxy Checkout. It owns the Stripe-specific integ
 
 - **`requiredMetadata(proxySession)`** — the `proxy_session_id` metadata Proxy needs on the Checkout Session, Subscription, and PaymentIntent.
 - **`assertCheckoutSessionBelongsToProxy` / `assertSubscriptionBelongsToProxy` / `assertPaymentIntentBelongsToProxy`** — provider-object ownership checks.
-- **`openCheckout(...)`** — records payer-opened, validates the typed cart, injects required metadata, creates the Stripe Checkout Session with deterministic idempotency, records the Proxy provider binding, and returns the client secret. The merchant only supplies app-specific Stripe params.
+- **`openCheckout(...)`** — records payer-opened, validates/reconciles the typed cart with rollback, injects required metadata, creates the Stripe Checkout Session with deterministic idempotency, records the Proxy provider binding, and returns the client secret. The merchant only supplies app-specific Stripe params.
 - **`syncCheckoutCart(...)`** — validates the stored Proxy provider binding, then updates the Proxy cart and the Stripe Checkout `line_items` in the safest order with deterministic rollback/reconciliation (`ProxyStripeCartSyncError`).
 
 PSP-agnostic primitives (sessions, subscriptions, webhooks, lifecycle) live in [`@proxy-checkout/server-js`](https://www.npmjs.com/package/@proxy-checkout/server-js). This package is an additive adapter on top and is dependency-free: you inject your own `Stripe` instance and your `@proxy-checkout/server-js` client.

package/dist/open-checkout.js

@@ -7,7 +7,7 @@
  * metadata placement, idempotency, and binding reconciliation.
  */
 import { ProxyCheckoutValidationError } from "@proxy-checkout/server-js";
-import { ProxyStripeOpenCheckoutError } from "./errors.js";
+import { ProxyStripeCartSyncError, ProxyStripeOpenCheckoutError } from "./errors.js";
 import { assertCheckoutSessionBelongsToProxy, injectRequiredCheckoutSessionMetadata, } from "./metadata.js";
 import { normalizePsp } from "./psp.js";
 export async function openCheckout(options) {
@@ -27,8 +27,29 @@ export async function openCheckout(options) {
     const offer = options.validateCart
         ? await options.validateCart({ cart, session: proxySession })
         : undefined;
+    if (proxySession.providerCheckoutSessionId !== null) {
+        assertExistingBindingMatches(proxySession, psp);
+        const checkoutSession = (await options.stripe.checkout.sessions.retrieve(proxySession.providerCheckoutSessionId));
+        assertCheckoutSessionBelongsToProxy(checkoutSession, proxySession.id);
+        return {
+            binding: bindingFromSession(proxySession),
+            cart,
+            checkoutSession,
+            clientSecret: checkoutSession.client_secret ?? null,
+            offer,
+            proxySession,
+            proxySessionId: proxySession.id,
+        };
+    }
+    let rollbackCart;
     const reconciledCart = await options.reconcileCart?.({ cart, offer, session: proxySession });
     if (reconciledCart) {
+        const priorCart = {
+            amountMinor: proxySession.amountMinor,
+            cartSnapshot: proxySession.cartSnapshot,
+            cartVersion: proxySession.cartVersion,
+            currency: proxySession.currency,
+        };
         const updatedCart = await options.proxy.sessions.cart.set(proxySession.id, {
             amountMinor: reconciledCart.amountMinor,
             cartSnapshot: reconciledCart.cartSnapshot,
@@ -36,6 +57,10 @@ export async function openCheckout(options) {
             expectedCartVersion: proxySession.cartVersion,
             requestId: options.requestId,
         });
+        rollbackCart = {
+            ...priorCart,
+            expectedCartVersion: updatedCart.cartVersion,
+        };
         proxySession = {
             ...proxySession,
             amountMinor: updatedCart.amountMinor,
@@ -46,12 +71,26 @@ export async function openCheckout(options) {
         };
         cart = reconciledCart.cart;
     }
-    if (proxySession.providerCheckoutSessionId !== null) {
-        assertExistingBindingMatches(proxySession, psp);
-        const checkoutSession = (await options.stripe.checkout.sessions.retrieve(proxySession.providerCheckoutSessionId));
+    try {
+        const params = await options.buildCheckoutSessionParams({
+            cart,
+            offer,
+            proxySession,
+            stripe: options.stripe,
+        });
+        const checkoutSession = (await options.stripe.checkout.sessions.create(injectRequiredCheckoutSessionMetadata(params, proxySession.id), buildStripeRequestOptions(options, proxySession.id, psp)));
+        // Fail closed if the merchant forgot to place proxy_session_id metadata.
         assertCheckoutSessionBelongsToProxy(checkoutSession, proxySession.id);
+        const binding = await recordOrReconcileProviderBinding({
+            checkoutSessionId: checkoutSession.id,
+            proxy: options.proxy,
+            proxySessionId: proxySession.id,
+            psp,
+            requestId: options.requestId,
+            stripe: options.stripe,
+        });
         return {
-            binding: bindingFromSession(proxySession),
+            binding,
             cart,
             checkoutSession,
             clientSecret: checkoutSession.client_secret ?? null,
@@ -60,32 +99,18 @@ export async function openCheckout(options) {
             proxySessionId: proxySession.id,
         };
     }
-    const params = await options.buildCheckoutSessionParams({
-        cart,
-        offer,
-        proxySession,
-        stripe: options.stripe,
-    });
-    const checkoutSession = (await options.stripe.checkout.sessions.create(injectRequiredCheckoutSessionMetadata(params, proxySession.id), buildStripeRequestOptions(options, proxySession.id, psp)));
-    // Fail closed if the merchant forgot to place proxy_session_id metadata.
-    assertCheckoutSessionBelongsToProxy(checkoutSession, proxySession.id);
-    const binding = await recordOrReconcileProviderBinding({
-        checkoutSessionId: checkoutSession.id,
-        proxy: options.proxy,
-        proxySessionId: proxySession.id,
-        psp,
-        requestId: options.requestId,
-        stripe: options.stripe,
-    });
-    return {
-        binding,
-        cart,
-        checkoutSession,
-        clientSecret: checkoutSession.client_secret ?? null,
-        offer,
-        proxySession,
-        proxySessionId: proxySession.id,
-    };
+    catch (cause) {
+        if (rollbackCart) {
+            await rollbackReconciledCart({
+                cause,
+                proxy: options.proxy,
+                proxySessionId: proxySession.id,
+                requestId: options.requestId,
+                rollbackCart,
+            });
+        }
+        throw cause;
+    }
 }
 function buildStripeRequestOptions(options, proxySessionId, psp) {
     return {
@@ -113,6 +138,25 @@ function bindingFromSession(proxySession) {
         updatedAt: proxySession.updatedAt,
     };
 }
+async function rollbackReconciledCart(input) {
+    try {
+        await input.proxy.sessions.cart.set(input.proxySessionId, {
+            amountMinor: input.rollbackCart.amountMinor,
+            cartSnapshot: input.rollbackCart.cartSnapshot,
+            currency: input.rollbackCart.currency,
+            expectedCartVersion: input.rollbackCart.expectedCartVersion,
+            requestId: input.requestId,
+        });
+    }
+    catch (rollbackCause) {
+        throw new ProxyStripeCartSyncError("openCheckout failed after reconciling the Proxy cart, and the rollback failed; carts may be out of sync.", {
+            cause: input.cause,
+            code: "reconciliation_failed",
+            reconciled: false,
+            rollbackCause,
+        });
+    }
+}
 async function recordOrReconcileProviderBinding(input) {
     try {
         return await input.proxy.sessions.recordProviderBinding(input.proxySessionId, {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 export declare const proxyCheckoutStripeServerSdkName = "@proxy-checkout/stripe-server-js";
-export declare const proxyCheckoutStripeServerSdkVersion = "0.0.0-pr-76.20.1";
+export declare const proxyCheckoutStripeServerSdkVersion = "0.0.0-pr-76.21.1";

package/dist/version.js

@@ -1,2 +1,2 @@
 export const proxyCheckoutStripeServerSdkName = "@proxy-checkout/stripe-server-js";
-export const proxyCheckoutStripeServerSdkVersion = "0.0.0-pr-76.20.1";
+export const proxyCheckoutStripeServerSdkVersion = "0.0.0-pr-76.21.1";

package/package.json

@@ -7,13 +7,13 @@
   "sideEffects": false,
   "type": "module",
   "types": "./dist/index.d.ts",
-  "version": "0.0.0-pr-76.20.1",
+  "version": "0.0.0-pr-76.21.1",
   "devDependencies": {
     "@types/node": "^24.12.4",
     "@vitest/coverage-v8": "4.1.7",
     "typescript": "^6.0.3",
     "vitest": "4.1.7",
-    "@proxy-checkout/server-js": "0.0.4-pr-76.20.1"
+    "@proxy-checkout/server-js": "0.0.4-pr-76.21.1"
   },
   "exports": {
     ".": {