@shware/purchase 5.2.1 → 6.0.0

package/dist/stripe/index.cjs

@@ -26,3 +26,4 @@ exports.mapTime = require_stripe_mapper.mapTime;
 exports.minorUnits = require_stripe_mapper.minorUnits;
 exports.price = require_stripe_mapper.price;
 exports.removePendingCheckout = require_stripe_pending_checkout.removePendingCheckout;
+exports.returnUrlSchema = require_stripe_schema.returnUrlSchema;

package/dist/stripe/index.d.cts

@@ -2,8 +2,8 @@ import { CancellationDetails } from "../subscription/index.cjs";
 import { PriceId, StripeConfig, StripeMode } from "./config.cjs";
 import { StripeEventHandler } from "./handler.cjs";
 import { BeginCheckoutProperties, CheckoutSession, LineItem, PaymentStatus, Price, ProductPrice, PurchaseProperties, getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.cjs";
-import { CreateCheckoutSessionDTO, cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.cjs";
+import { AllowedOrigins, CreateCheckoutSessionDTO, CreateCheckoutSessionSchemaOptions, cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.cjs";
 import { METADATA_KEYS } from "./metadata.cjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.cjs";
 import { Stripe } from "stripe";
-export { type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { type AllowedOrigins, type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type CreateCheckoutSessionSchemaOptions, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/index.d.mts

@@ -2,8 +2,8 @@ import { CancellationDetails } from "../subscription/index.mjs";
 import { PriceId, StripeConfig, StripeMode } from "./config.mjs";
 import { StripeEventHandler } from "./handler.mjs";
 import { BeginCheckoutProperties, CheckoutSession, LineItem, PaymentStatus, Price, ProductPrice, PurchaseProperties, getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.mjs";
-import { CreateCheckoutSessionDTO, cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.mjs";
+import { AllowedOrigins, CreateCheckoutSessionDTO, CreateCheckoutSessionSchemaOptions, cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.mjs";
 import { METADATA_KEYS } from "./metadata.mjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.mjs";
 import { Stripe } from "stripe";
-export { type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { type AllowedOrigins, type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type CreateCheckoutSessionSchemaOptions, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/index.mjs

@@ -1,7 +1,7 @@
 import { StripeConfig } from "./config.mjs";
 import { StripeEventHandler } from "./handler.mjs";
 import { getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.mjs";
-import { cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.mjs";
+import { cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.mjs";
 import { METADATA_KEYS } from "./metadata.mjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.mjs";
-export { METADATA_KEYS, StripeConfig, StripeEventHandler, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { METADATA_KEYS, StripeConfig, StripeEventHandler, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/mapper.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_subscription_index = require("../subscription/index.cjs");
+let _shware_utils = require("@shware/utils");
 //#region src/stripe/mapper.ts
 function mapTime(stripeTimestampSeconds) {
 	if (!stripeTimestampSeconds) return null;
@@ -114,26 +115,9 @@ function mapSubscriptionStatus(status) {
 			throw new Error(`Invalid stripe status: ${String(status)}`);
 	}
 }
-const ZERO_DECIMAL_CURRENCIES = [
-	"BIF",
-	"CLP",
-	"DJF",
-	"GNF",
-	"JPY",
-	"KMF",
-	"KRW",
-	"MGA",
-	"PYG",
-	"RWF",
-	"UGX",
-	"VND",
-	"VUV",
-	"XAF",
-	"XOF",
-	"XPF"
-];
+/** How many Stripe API amount units make one unit of `currency` (1, 100 or 1000). */
 function minorUnits(currency) {
-	return ZERO_DECIMAL_CURRENCIES.includes(currency.toUpperCase()) ? 1 : 100;
+	return (0, _shware_utils.stripeMinorUnits)(currency);
 }
 function price(value, currency) {
 	return value / minorUnits(currency);
@@ -216,7 +200,12 @@ function mapCancellationDetails(subscription) {
 	};
 }
 //#endregion
-exports.ZERO_DECIMAL_CURRENCIES = ZERO_DECIMAL_CURRENCIES;
+Object.defineProperty(exports, "ZERO_DECIMAL_CURRENCIES", {
+	enumerable: true,
+	get: function() {
+		return _shware_utils.ZERO_DECIMAL_CURRENCIES;
+	}
+});
 exports.getBeginCheckoutProperties = getBeginCheckoutProperties;
 exports.getPurchaseProperties = getPurchaseProperties;
 exports.mapCancellationDetails = mapCancellationDetails;

package/dist/stripe/mapper.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mapper.cjs","names":["CANCELLATION_FEEDBACKS"],"sources":["../../src/stripe/mapper.ts"],"sourcesContent":["import type { Stripe } from 'stripe';\nimport {\n  CANCELLATION_FEEDBACKS,\n  type CancellationDetails,\n  type CancellationFeedback,\n  type SubscriptionStatus,\n} from '../subscription/index';\n\nexport function mapTime<T extends number | null>(\n  stripeTimestampSeconds: T\n): T extends number ? string : null {\n  if (!stripeTimestampSeconds) return null as T extends number ? string : null;\n  return new Date(stripeTimestampSeconds * 1000).toISOString() as T extends number ? string : null;\n}\n\nexport type Price = {\n  id: string;\n  type: Stripe.Price.Type;\n  active: boolean;\n  billing_scheme: Stripe.Price.BillingScheme;\n  currency: Stripe.Price['currency'];\n  unit_amount: number | null;\n  unit_amount_decimal: string | null;\n  recurring: Stripe.Price.Recurring | null;\n};\n\nexport function mapPrice(price: Stripe.Price): Price {\n  return {\n    id: price.id,\n    type: price.type,\n    active: price.active,\n    billing_scheme: price.billing_scheme,\n    currency: price.currency,\n    unit_amount: price.unit_amount,\n    unit_amount_decimal: price.unit_amount_decimal?.toString() ?? null,\n    recurring: price.recurring,\n  };\n}\n\nexport interface LineItem {\n  id: string;\n  currency: string;\n  quantity: number | null;\n  description: string | null;\n  amount_tax: number;\n  amount_total: number;\n  amount_subtotal: number;\n  amount_discount: number;\n  price: Price | null;\n}\n\nexport function mapLineItem(item: Stripe.LineItem): LineItem {\n  return {\n    id: item.price\n      ? typeof item.price.product === 'string'\n        ? item.price.product\n        : item.price.product.id\n      : item.id,\n    currency: item.currency,\n    quantity: item.quantity,\n    description: item.description,\n    amount_tax: item.amount_tax,\n    amount_total: item.amount_total,\n    amount_subtotal: item.amount_subtotal,\n    amount_discount: item.amount_discount,\n    price: item.price ? mapPrice(item.price) : null,\n  };\n}\n\n// Re-exported under our own name so consumers need not reach into stripe's namespace.\n// Open-ended since stripe 22.4: a status the API adds later is not a type error.\nexport type PaymentStatus = Stripe.Checkout.Session.PaymentStatus;\n\n// Declared rather than inferred from mapCheckoutSession: an inferred shape is\n// structural, so a consumer's declaration emit has to spell out payment_status\n// through stripe's internal module path — TS2883 in any package that reaches\n// stripe transitively instead of depending on it (see line_items/price too).\nexport interface CheckoutSession {\n  id: string;\n  url: string | null;\n  coupon: string | undefined;\n  livemode: boolean;\n  expires_at: number;\n  payment_status: PaymentStatus;\n  currency: string | null;\n  amount_total: number | null;\n  line_items: LineItem[] | undefined;\n}\n\nexport function mapCheckoutSession(session: Stripe.Checkout.Session): CheckoutSession {\n  let coupon: string | undefined = undefined;\n  if (Array.isArray(session.discounts) && session.discounts.length !== 0) {\n    const discount = session.discounts[0];\n    if (discount.coupon && typeof discount.coupon === 'object') {\n      coupon = discount.coupon.id;\n    } else if (typeof discount.coupon === 'string') {\n      coupon = discount.coupon;\n    } else {\n      coupon = undefined;\n    }\n  }\n\n  return {\n    id: session.id,\n    url: session.url,\n    coupon,\n    livemode: session.livemode,\n    expires_at: session.expires_at,\n    payment_status: session.payment_status,\n    currency: session.currency,\n    amount_total: session.amount_total,\n    line_items: session.line_items?.data.map(mapLineItem),\n  };\n}\n\nexport function mapInvoice(i: Stripe.Invoice) {\n  return {\n    id: i.id,\n    number: i.number,\n    total: i.total,\n    subtotal: i.subtotal,\n    amount_due: i.amount_due,\n    amount_paid: i.amount_paid,\n    amount_remaining: i.amount_remaining,\n    currency: i.currency,\n    billing_reason: i.billing_reason,\n    hosted_invoice_url: i.hosted_invoice_url,\n    invoice_pdf: i.invoice_pdf,\n    receipt_number: i.receipt_number,\n    status: i.status,\n    created: i.created,\n    period_start: i.period_start,\n    period_end: i.period_end,\n  };\n}\n\nexport function mapPaymentIntent(intent: Stripe.PaymentIntent) {\n  return {\n    id: intent.id,\n    amount: intent.amount,\n    amount_capturable: intent.amount_capturable,\n    amount_received: intent.amount_received,\n    currency: intent.currency,\n    client_secret: intent.client_secret,\n    description: intent.description,\n    status: intent.status,\n    created: intent.created,\n  };\n}\n\nexport function mapCharge(charge: Stripe.Charge) {\n  return {\n    id: charge.id,\n    description: charge.description,\n    currency: charge.currency,\n    amount: charge.amount,\n    amount_captured: charge.amount_captured,\n    amount_refunded: charge.amount_refunded,\n    receipt_email: charge.receipt_email,\n    receipt_number: charge.receipt_number,\n    receipt_url: charge.receipt_url,\n    status: charge.status,\n    created: charge.created,\n    payment_intent:\n      charge.payment_intent && typeof charge.payment_intent === 'object'\n        ? mapPaymentIntent(charge.payment_intent)\n        : undefined,\n  };\n}\n\nexport type ProductPrice = {\n  id: string;\n  type: Stripe.Price.Type;\n  unit_amount: number;\n  currency: Stripe.Price['currency'];\n  product: {\n    id: Stripe.Product['id'];\n    name: Stripe.Product['name'];\n    description: Stripe.Product['description'];\n    livemode: Stripe.Product['livemode'];\n  };\n};\n\nexport function mapSubscriptionStatus(status: Stripe.Subscription.Status): SubscriptionStatus {\n  switch (status) {\n    case 'active':\n      return 'ACTIVE';\n    case 'canceled':\n      return 'CANCELED';\n    case 'incomplete':\n      return 'INCOMPLETE';\n    case 'incomplete_expired':\n      return 'INCOMPLETE_EXPIRED';\n    case 'past_due':\n      return 'PAST_DUE';\n    case 'paused':\n      return 'PAUSED';\n    case 'trialing':\n      return 'TRIALING';\n    case 'unpaid':\n      return 'UNPAID';\n    default: {\n      console.error(`Invalid stripe status: ${String(status)}`);\n      throw new Error(`Invalid stripe status: ${String(status)}`);\n    }\n  }\n}\n\nexport const ZERO_DECIMAL_CURRENCIES = [\n  'BIF',\n  'CLP',\n  'DJF',\n  'GNF',\n  'JPY',\n  'KMF',\n  'KRW',\n  'MGA',\n  'PYG',\n  'RWF',\n  'UGX',\n  'VND',\n  'VUV',\n  'XAF',\n  'XOF',\n  'XPF',\n];\n\nexport function minorUnits(currency: string) {\n  return ZERO_DECIMAL_CURRENCIES.includes(currency.toUpperCase()) ? 1 : 100;\n}\n\nexport function price(value: number, currency: string) {\n  return value / minorUnits(currency);\n}\n\nexport interface Item {\n  item_id: string;\n  item_name: string;\n  affiliation?: 'Google Store' | (string & {});\n  coupon?: string;\n  discount?: number;\n  index?: number;\n  item_brand?: string;\n  item_category?: string;\n  item_category2?: string;\n  item_category3?: string;\n  item_category4?: string;\n  item_category5?: string;\n  item_list_id?: string;\n  item_list_name?: string;\n  item_variant?: string;\n  location_id?: string;\n  price?: number;\n  quantity?: number;\n}\n\nexport interface PurchaseProperties {\n  currency: string;\n  value: number;\n  transaction_id: string;\n  coupon?: string;\n  shipping?: number;\n  tax?: number;\n  items?: Item[];\n}\n\nexport interface BeginCheckoutProperties {\n  currency: string;\n  value: number;\n  coupon?: string;\n  items: Item[];\n}\n\n// Google Ads rejects conversion transaction IDs longer than 64 characters.\n// https://support.google.com/google-ads/answer/6386790\nconst GOOGLE_ADS_TRANSACTION_ID_MAX = 64;\n\n/**\n * GA4 purchase events feed Google Ads conversions, whose transaction IDs are\n * capped at 64 characters — but Stripe checkout session ids exceed that:\n * around 2021 they grew from ~32 chars (`cs_live_` + 24 random chars) to ~66\n * (`cs_live_a` + 57), with no announcement. Stripe treats id length/format as\n * opaque and backwards-compatible, guaranteeing only that ids never exceed\n * 255 chars, so they may grow again at any time.\n *\n * Dropping the fixed `cs_live_`/`cs_test_` prefix brings the id under 64\n * while staying reversible: prepend the prefix (livemode tells which) to\n * reconstruct the full session id for Stripe dashboard lookups. The payment\n * intent id (~27 chars) is not a substitute — it only exists on\n * `mode: 'payment'` sessions (subscription-mode sessions carry it on the\n * invoice instead), and its short length is just as unguaranteed as the\n * session id's was.\n *\n * Must stay deterministic: GA4/Google Ads dedupe purchases by\n * transaction_id, and the same session may be tracked from multiple paths.\n */\nfunction toTransactionId(sessionId: string): string {\n  const stripped = sessionId.replace(/^cs_(live|test)_/, '');\n  if (stripped.length > GOOGLE_ADS_TRANSACTION_ID_MAX) {\n    console.warn(\n      `transaction_id still exceeds ${GOOGLE_ADS_TRANSACTION_ID_MAX} chars after stripping ` +\n        `the prefix — Stripe may have lengthened session ids again; truncating: ${sessionId}`\n    );\n  }\n  return stripped.slice(0, GOOGLE_ADS_TRANSACTION_ID_MAX);\n}\n\nexport function getPurchaseProperties(session: CheckoutSession): PurchaseProperties {\n  let value: number;\n  let currency: string;\n  if (!session.amount_total || !session.currency) {\n    value = session.line_items?.reduce((acc, item) => acc + item.amount_total, 0) ?? 0;\n    currency = session.line_items?.[0]?.currency ?? 'usd';\n  } else {\n    value = session.amount_total;\n    currency = session.currency;\n  }\n\n  return {\n    transaction_id: toTransactionId(session.id),\n    value: price(value, currency),\n    currency: currency.toUpperCase(),\n    coupon: session.coupon,\n    items: session.line_items?.map((item, index) => ({\n      index,\n      item_id: item.id,\n      item_name: item.description ?? '',\n      price: price(item.amount_total, item.currency),\n      quantity: item.quantity ?? 1,\n      discount: price(item.amount_discount, item.currency),\n    })),\n  };\n}\n\nexport function getBeginCheckoutProperties(p: ProductPrice): BeginCheckoutProperties {\n  return {\n    currency: p.currency.toUpperCase(),\n    value: price(p.unit_amount, p.currency),\n    items: [\n      {\n        item_id: p.product.id,\n        item_name: p.product.name,\n        price: price(p.unit_amount, p.currency),\n      },\n    ],\n  };\n}\n\n/**\n * Stripe's `cancellation_details` in the shared shape. The object is present on every\n * subscription with all three fields null, so an active one maps to null rather than an empty\n * record. `reason` says who acted: `cancellation_requested` is the customer (or us on their\n * behalf), the payment reasons are Stripe ending it.\n */\nexport function mapCancellationDetails(\n  subscription: Pick<Stripe.Subscription, 'cancellation_details'>\n): CancellationDetails | null {\n  const details = subscription.cancellation_details;\n  if (!details || (!details.reason && !details.feedback && !details.comment)) return null;\n  return {\n    initiator:\n      details.reason === 'payment_failed' || details.reason === 'payment_disputed'\n        ? 'system'\n        : 'user',\n    reason: details.reason ?? null,\n    // Stripe's feedback vocabulary is ours; anything it adds later is reported as \"other\".\n    feedback: details.feedback\n      ? (CANCELLATION_FEEDBACKS as readonly string[]).includes(details.feedback)\n        ? (details.feedback as CancellationFeedback)\n        : 'other'\n      : null,\n    comment: details.comment ?? null,\n  };\n}\n"],"mappings":";;;AAQA,SAAgB,QACd,wBACkC;CAClC,IAAI,CAAC,wBAAwB,OAAO;CACpC,wBAAO,IAAI,KAAK,yBAAyB,GAAI,EAAA,CAAE,YAAY;AAC7D;AAaA,SAAgB,SAAS,OAA4B;CACnD,OAAO;EACL,IAAI,MAAM;EACV,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,gBAAgB,MAAM;EACtB,UAAU,MAAM;EAChB,aAAa,MAAM;EACnB,qBAAqB,MAAM,qBAAqB,SAAS,KAAK;EAC9D,WAAW,MAAM;CACnB;AACF;AAcA,SAAgB,YAAY,MAAiC;CAC3D,OAAO;EACL,IAAI,KAAK,QACL,OAAO,KAAK,MAAM,YAAY,WAC5B,KAAK,MAAM,UACX,KAAK,MAAM,QAAQ,KACrB,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,aAAa,KAAK;EAClB,YAAY,KAAK;EACjB,cAAc,KAAK;EACnB,iBAAiB,KAAK;EACtB,iBAAiB,KAAK;EACtB,OAAO,KAAK,QAAQ,SAAS,KAAK,KAAK,IAAI;CAC7C;AACF;AAsBA,SAAgB,mBAAmB,SAAmD;CACpF,IAAI,SAA6B,KAAA;CACjC,IAAI,MAAM,QAAQ,QAAQ,SAAS,KAAK,QAAQ,UAAU,WAAW,GAAG;EACtE,MAAM,WAAW,QAAQ,UAAU;EACnC,IAAI,SAAS,UAAU,OAAO,SAAS,WAAW,UAChD,SAAS,SAAS,OAAO;OACpB,IAAI,OAAO,SAAS,WAAW,UACpC,SAAS,SAAS;OAElB,SAAS,KAAA;CAEb;CAEA,OAAO;EACL,IAAI,QAAQ;EACZ,KAAK,QAAQ;EACb;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,gBAAgB,QAAQ;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,YAAY,QAAQ,YAAY,KAAK,IAAI,WAAW;CACtD;AACF;AAEA,SAAgB,WAAW,GAAmB;CAC5C,OAAO;EACL,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,YAAY,EAAE;EACd,aAAa,EAAE;EACf,kBAAkB,EAAE;EACpB,UAAU,EAAE;EACZ,gBAAgB,EAAE;EAClB,oBAAoB,EAAE;EACtB,aAAa,EAAE;EACf,gBAAgB,EAAE;EAClB,QAAQ,EAAE;EACV,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,YAAY,EAAE;CAChB;AACF;AAEA,SAAgB,iBAAiB,QAA8B;CAC7D,OAAO;EACL,IAAI,OAAO;EACX,QAAQ,OAAO;EACf,mBAAmB,OAAO;EAC1B,iBAAiB,OAAO;EACxB,UAAU,OAAO;EACjB,eAAe,OAAO;EACtB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;CAClB;AACF;AAEA,SAAgB,UAAU,QAAuB;CAC/C,OAAO;EACL,IAAI,OAAO;EACX,aAAa,OAAO;EACpB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,iBAAiB,OAAO;EACxB,iBAAiB,OAAO;EACxB,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,gBACE,OAAO,kBAAkB,OAAO,OAAO,mBAAmB,WACtD,iBAAiB,OAAO,cAAc,IACtC,KAAA;CACR;AACF;AAeA,SAAgB,sBAAsB,QAAwD;CAC5F,QAAQ,QAAR;EACE,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,cACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT;GACE,QAAQ,MAAM,0BAA0B,OAAO,MAAM,GAAG;GACxD,MAAM,IAAI,MAAM,0BAA0B,OAAO,MAAM,GAAG;CAE9D;AACF;AAEA,MAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,WAAW,UAAkB;CAC3C,OAAO,wBAAwB,SAAS,SAAS,YAAY,CAAC,IAAI,IAAI;AACxE;AAEA,SAAgB,MAAM,OAAe,UAAkB;CACrD,OAAO,QAAQ,WAAW,QAAQ;AACpC;AA0CA,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;AAqBtC,SAAS,gBAAgB,WAA2B;CAClD,MAAM,WAAW,UAAU,QAAQ,oBAAoB,EAAE;CACzD,IAAI,SAAS,SAAS,+BACpB,QAAQ,KACN,gCAAgC,8BAA8B,gGACc,WAC9E;CAEF,OAAO,SAAS,MAAM,GAAG,6BAA6B;AACxD;AAEA,SAAgB,sBAAsB,SAA8C;CAClF,IAAI;CACJ,IAAI;CACJ,IAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,UAAU;EAC9C,QAAQ,QAAQ,YAAY,QAAQ,KAAK,SAAS,MAAM,KAAK,cAAc,CAAC,KAAK;EACjF,WAAW,QAAQ,aAAa,EAAE,EAAE,YAAY;CAClD,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ;CACrB;CAEA,OAAO;EACL,gBAAgB,gBAAgB,QAAQ,EAAE;EAC1C,OAAO,MAAM,OAAO,QAAQ;EAC5B,UAAU,SAAS,YAAY;EAC/B,QAAQ,QAAQ;EAChB,OAAO,QAAQ,YAAY,KAAK,MAAM,WAAW;GAC/C;GACA,SAAS,KAAK;GACd,WAAW,KAAK,eAAe;GAC/B,OAAO,MAAM,KAAK,cAAc,KAAK,QAAQ;GAC7C,UAAU,KAAK,YAAY;GAC3B,UAAU,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACrD,EAAE;CACJ;AACF;AAEA,SAAgB,2BAA2B,GAA0C;CACnF,OAAO;EACL,UAAU,EAAE,SAAS,YAAY;EACjC,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACtC,OAAO,CACL;GACE,SAAS,EAAE,QAAQ;GACnB,WAAW,EAAE,QAAQ;GACrB,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACxC,CACF;CACF;AACF;;;;;;;AAQA,SAAgB,uBACd,cAC4B;CAC5B,MAAM,UAAU,aAAa;CAC7B,IAAI,CAAC,WAAY,CAAC,QAAQ,UAAU,CAAC,QAAQ,YAAY,CAAC,QAAQ,SAAU,OAAO;CACnF,OAAO;EACL,WACE,QAAQ,WAAW,oBAAoB,QAAQ,WAAW,qBACtD,WACA;EACN,QAAQ,QAAQ,UAAU;EAE1B,UAAU,QAAQ,WACbA,2BAAAA,uBAA6C,SAAS,QAAQ,QAAQ,IACpE,QAAQ,WACT,UACF;EACJ,SAAS,QAAQ,WAAW;CAC9B;AACF"}
+{"version":3,"file":"mapper.cjs","names":["stripeMinorUnits","CANCELLATION_FEEDBACKS"],"sources":["../../src/stripe/mapper.ts"],"sourcesContent":["import { stripeMinorUnits } from '@shware/utils';\nimport type { Stripe } from 'stripe';\nimport {\n  CANCELLATION_FEEDBACKS,\n  type CancellationDetails,\n  type CancellationFeedback,\n  type SubscriptionStatus,\n} from '../subscription/index';\n\nexport function mapTime<T extends number | null>(\n  stripeTimestampSeconds: T\n): T extends number ? string : null {\n  if (!stripeTimestampSeconds) return null as T extends number ? string : null;\n  return new Date(stripeTimestampSeconds * 1000).toISOString() as T extends number ? string : null;\n}\n\nexport type Price = {\n  id: string;\n  type: Stripe.Price.Type;\n  active: boolean;\n  billing_scheme: Stripe.Price.BillingScheme;\n  currency: Stripe.Price['currency'];\n  unit_amount: number | null;\n  unit_amount_decimal: string | null;\n  recurring: Stripe.Price.Recurring | null;\n};\n\nexport function mapPrice(price: Stripe.Price): Price {\n  return {\n    id: price.id,\n    type: price.type,\n    active: price.active,\n    billing_scheme: price.billing_scheme,\n    currency: price.currency,\n    unit_amount: price.unit_amount,\n    unit_amount_decimal: price.unit_amount_decimal?.toString() ?? null,\n    recurring: price.recurring,\n  };\n}\n\nexport interface LineItem {\n  id: string;\n  currency: string;\n  quantity: number | null;\n  description: string | null;\n  amount_tax: number;\n  amount_total: number;\n  amount_subtotal: number;\n  amount_discount: number;\n  price: Price | null;\n}\n\nexport function mapLineItem(item: Stripe.LineItem): LineItem {\n  return {\n    id: item.price\n      ? typeof item.price.product === 'string'\n        ? item.price.product\n        : item.price.product.id\n      : item.id,\n    currency: item.currency,\n    quantity: item.quantity,\n    description: item.description,\n    amount_tax: item.amount_tax,\n    amount_total: item.amount_total,\n    amount_subtotal: item.amount_subtotal,\n    amount_discount: item.amount_discount,\n    price: item.price ? mapPrice(item.price) : null,\n  };\n}\n\n// Re-exported under our own name so consumers need not reach into stripe's namespace.\n// Open-ended since stripe 22.4: a status the API adds later is not a type error.\nexport type PaymentStatus = Stripe.Checkout.Session.PaymentStatus;\n\n// Declared rather than inferred from mapCheckoutSession: an inferred shape is\n// structural, so a consumer's declaration emit has to spell out payment_status\n// through stripe's internal module path — TS2883 in any package that reaches\n// stripe transitively instead of depending on it (see line_items/price too).\nexport interface CheckoutSession {\n  id: string;\n  url: string | null;\n  coupon: string | undefined;\n  livemode: boolean;\n  expires_at: number;\n  payment_status: PaymentStatus;\n  currency: string | null;\n  amount_total: number | null;\n  line_items: LineItem[] | undefined;\n}\n\nexport function mapCheckoutSession(session: Stripe.Checkout.Session): CheckoutSession {\n  let coupon: string | undefined = undefined;\n  if (Array.isArray(session.discounts) && session.discounts.length !== 0) {\n    const discount = session.discounts[0];\n    if (discount.coupon && typeof discount.coupon === 'object') {\n      coupon = discount.coupon.id;\n    } else if (typeof discount.coupon === 'string') {\n      coupon = discount.coupon;\n    } else {\n      coupon = undefined;\n    }\n  }\n\n  return {\n    id: session.id,\n    url: session.url,\n    coupon,\n    livemode: session.livemode,\n    expires_at: session.expires_at,\n    payment_status: session.payment_status,\n    currency: session.currency,\n    amount_total: session.amount_total,\n    line_items: session.line_items?.data.map(mapLineItem),\n  };\n}\n\nexport function mapInvoice(i: Stripe.Invoice) {\n  return {\n    id: i.id,\n    number: i.number,\n    total: i.total,\n    subtotal: i.subtotal,\n    amount_due: i.amount_due,\n    amount_paid: i.amount_paid,\n    amount_remaining: i.amount_remaining,\n    currency: i.currency,\n    billing_reason: i.billing_reason,\n    hosted_invoice_url: i.hosted_invoice_url,\n    invoice_pdf: i.invoice_pdf,\n    receipt_number: i.receipt_number,\n    status: i.status,\n    created: i.created,\n    period_start: i.period_start,\n    period_end: i.period_end,\n  };\n}\n\nexport function mapPaymentIntent(intent: Stripe.PaymentIntent) {\n  return {\n    id: intent.id,\n    amount: intent.amount,\n    amount_capturable: intent.amount_capturable,\n    amount_received: intent.amount_received,\n    currency: intent.currency,\n    client_secret: intent.client_secret,\n    description: intent.description,\n    status: intent.status,\n    created: intent.created,\n  };\n}\n\nexport function mapCharge(charge: Stripe.Charge) {\n  return {\n    id: charge.id,\n    description: charge.description,\n    currency: charge.currency,\n    amount: charge.amount,\n    amount_captured: charge.amount_captured,\n    amount_refunded: charge.amount_refunded,\n    receipt_email: charge.receipt_email,\n    receipt_number: charge.receipt_number,\n    receipt_url: charge.receipt_url,\n    status: charge.status,\n    created: charge.created,\n    payment_intent:\n      charge.payment_intent && typeof charge.payment_intent === 'object'\n        ? mapPaymentIntent(charge.payment_intent)\n        : undefined,\n  };\n}\n\nexport type ProductPrice = {\n  id: string;\n  type: Stripe.Price.Type;\n  unit_amount: number;\n  currency: Stripe.Price['currency'];\n  product: {\n    id: Stripe.Product['id'];\n    name: Stripe.Product['name'];\n    description: Stripe.Product['description'];\n    livemode: Stripe.Product['livemode'];\n  };\n};\n\nexport function mapSubscriptionStatus(status: Stripe.Subscription.Status): SubscriptionStatus {\n  switch (status) {\n    case 'active':\n      return 'ACTIVE';\n    case 'canceled':\n      return 'CANCELED';\n    case 'incomplete':\n      return 'INCOMPLETE';\n    case 'incomplete_expired':\n      return 'INCOMPLETE_EXPIRED';\n    case 'past_due':\n      return 'PAST_DUE';\n    case 'paused':\n      return 'PAUSED';\n    case 'trialing':\n      return 'TRIALING';\n    case 'unpaid':\n      return 'UNPAID';\n    default: {\n      console.error(`Invalid stripe status: ${String(status)}`);\n      throw new Error(`Invalid stripe status: ${String(status)}`);\n    }\n  }\n}\n\nexport { ZERO_DECIMAL_CURRENCIES } from '@shware/utils';\n\n/** How many Stripe API amount units make one unit of `currency` (1, 100 or 1000). */\nexport function minorUnits(currency: string) {\n  return stripeMinorUnits(currency);\n}\n\nexport function price(value: number, currency: string) {\n  return value / minorUnits(currency);\n}\n\nexport interface Item {\n  item_id: string;\n  item_name: string;\n  affiliation?: 'Google Store' | (string & {});\n  coupon?: string;\n  discount?: number;\n  index?: number;\n  item_brand?: string;\n  item_category?: string;\n  item_category2?: string;\n  item_category3?: string;\n  item_category4?: string;\n  item_category5?: string;\n  item_list_id?: string;\n  item_list_name?: string;\n  item_variant?: string;\n  location_id?: string;\n  price?: number;\n  quantity?: number;\n}\n\nexport interface PurchaseProperties {\n  currency: string;\n  value: number;\n  transaction_id: string;\n  coupon?: string;\n  shipping?: number;\n  tax?: number;\n  items?: Item[];\n}\n\nexport interface BeginCheckoutProperties {\n  currency: string;\n  value: number;\n  coupon?: string;\n  items: Item[];\n}\n\n// Google Ads rejects conversion transaction IDs longer than 64 characters.\n// https://support.google.com/google-ads/answer/6386790\nconst GOOGLE_ADS_TRANSACTION_ID_MAX = 64;\n\n/**\n * GA4 purchase events feed Google Ads conversions, whose transaction IDs are\n * capped at 64 characters — but Stripe checkout session ids exceed that:\n * around 2021 they grew from ~32 chars (`cs_live_` + 24 random chars) to ~66\n * (`cs_live_a` + 57), with no announcement. Stripe treats id length/format as\n * opaque and backwards-compatible, guaranteeing only that ids never exceed\n * 255 chars, so they may grow again at any time.\n *\n * Dropping the fixed `cs_live_`/`cs_test_` prefix brings the id under 64\n * while staying reversible: prepend the prefix (livemode tells which) to\n * reconstruct the full session id for Stripe dashboard lookups. The payment\n * intent id (~27 chars) is not a substitute — it only exists on\n * `mode: 'payment'` sessions (subscription-mode sessions carry it on the\n * invoice instead), and its short length is just as unguaranteed as the\n * session id's was.\n *\n * Must stay deterministic: GA4/Google Ads dedupe purchases by\n * transaction_id, and the same session may be tracked from multiple paths.\n */\nfunction toTransactionId(sessionId: string): string {\n  const stripped = sessionId.replace(/^cs_(live|test)_/, '');\n  if (stripped.length > GOOGLE_ADS_TRANSACTION_ID_MAX) {\n    console.warn(\n      `transaction_id still exceeds ${GOOGLE_ADS_TRANSACTION_ID_MAX} chars after stripping ` +\n        `the prefix — Stripe may have lengthened session ids again; truncating: ${sessionId}`\n    );\n  }\n  return stripped.slice(0, GOOGLE_ADS_TRANSACTION_ID_MAX);\n}\n\nexport function getPurchaseProperties(session: CheckoutSession): PurchaseProperties {\n  let value: number;\n  let currency: string;\n  if (!session.amount_total || !session.currency) {\n    value = session.line_items?.reduce((acc, item) => acc + item.amount_total, 0) ?? 0;\n    currency = session.line_items?.[0]?.currency ?? 'usd';\n  } else {\n    value = session.amount_total;\n    currency = session.currency;\n  }\n\n  return {\n    transaction_id: toTransactionId(session.id),\n    value: price(value, currency),\n    currency: currency.toUpperCase(),\n    coupon: session.coupon,\n    items: session.line_items?.map((item, index) => ({\n      index,\n      item_id: item.id,\n      item_name: item.description ?? '',\n      price: price(item.amount_total, item.currency),\n      quantity: item.quantity ?? 1,\n      discount: price(item.amount_discount, item.currency),\n    })),\n  };\n}\n\nexport function getBeginCheckoutProperties(p: ProductPrice): BeginCheckoutProperties {\n  return {\n    currency: p.currency.toUpperCase(),\n    value: price(p.unit_amount, p.currency),\n    items: [\n      {\n        item_id: p.product.id,\n        item_name: p.product.name,\n        price: price(p.unit_amount, p.currency),\n      },\n    ],\n  };\n}\n\n/**\n * Stripe's `cancellation_details` in the shared shape. The object is present on every\n * subscription with all three fields null, so an active one maps to null rather than an empty\n * record. `reason` says who acted: `cancellation_requested` is the customer (or us on their\n * behalf), the payment reasons are Stripe ending it.\n */\nexport function mapCancellationDetails(\n  subscription: Pick<Stripe.Subscription, 'cancellation_details'>\n): CancellationDetails | null {\n  const details = subscription.cancellation_details;\n  if (!details || (!details.reason && !details.feedback && !details.comment)) return null;\n  return {\n    initiator:\n      details.reason === 'payment_failed' || details.reason === 'payment_disputed'\n        ? 'system'\n        : 'user',\n    reason: details.reason ?? null,\n    // Stripe's feedback vocabulary is ours; anything it adds later is reported as \"other\".\n    feedback: details.feedback\n      ? (CANCELLATION_FEEDBACKS as readonly string[]).includes(details.feedback)\n        ? (details.feedback as CancellationFeedback)\n        : 'other'\n      : null,\n    comment: details.comment ?? null,\n  };\n}\n"],"mappings":";;;;AASA,SAAgB,QACd,wBACkC;CAClC,IAAI,CAAC,wBAAwB,OAAO;CACpC,wBAAO,IAAI,KAAK,yBAAyB,GAAI,EAAA,CAAE,YAAY;AAC7D;AAaA,SAAgB,SAAS,OAA4B;CACnD,OAAO;EACL,IAAI,MAAM;EACV,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,gBAAgB,MAAM;EACtB,UAAU,MAAM;EAChB,aAAa,MAAM;EACnB,qBAAqB,MAAM,qBAAqB,SAAS,KAAK;EAC9D,WAAW,MAAM;CACnB;AACF;AAcA,SAAgB,YAAY,MAAiC;CAC3D,OAAO;EACL,IAAI,KAAK,QACL,OAAO,KAAK,MAAM,YAAY,WAC5B,KAAK,MAAM,UACX,KAAK,MAAM,QAAQ,KACrB,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,aAAa,KAAK;EAClB,YAAY,KAAK;EACjB,cAAc,KAAK;EACnB,iBAAiB,KAAK;EACtB,iBAAiB,KAAK;EACtB,OAAO,KAAK,QAAQ,SAAS,KAAK,KAAK,IAAI;CAC7C;AACF;AAsBA,SAAgB,mBAAmB,SAAmD;CACpF,IAAI,SAA6B,KAAA;CACjC,IAAI,MAAM,QAAQ,QAAQ,SAAS,KAAK,QAAQ,UAAU,WAAW,GAAG;EACtE,MAAM,WAAW,QAAQ,UAAU;EACnC,IAAI,SAAS,UAAU,OAAO,SAAS,WAAW,UAChD,SAAS,SAAS,OAAO;OACpB,IAAI,OAAO,SAAS,WAAW,UACpC,SAAS,SAAS;OAElB,SAAS,KAAA;CAEb;CAEA,OAAO;EACL,IAAI,QAAQ;EACZ,KAAK,QAAQ;EACb;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,gBAAgB,QAAQ;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,YAAY,QAAQ,YAAY,KAAK,IAAI,WAAW;CACtD;AACF;AAEA,SAAgB,WAAW,GAAmB;CAC5C,OAAO;EACL,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,YAAY,EAAE;EACd,aAAa,EAAE;EACf,kBAAkB,EAAE;EACpB,UAAU,EAAE;EACZ,gBAAgB,EAAE;EAClB,oBAAoB,EAAE;EACtB,aAAa,EAAE;EACf,gBAAgB,EAAE;EAClB,QAAQ,EAAE;EACV,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,YAAY,EAAE;CAChB;AACF;AAEA,SAAgB,iBAAiB,QAA8B;CAC7D,OAAO;EACL,IAAI,OAAO;EACX,QAAQ,OAAO;EACf,mBAAmB,OAAO;EAC1B,iBAAiB,OAAO;EACxB,UAAU,OAAO;EACjB,eAAe,OAAO;EACtB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;CAClB;AACF;AAEA,SAAgB,UAAU,QAAuB;CAC/C,OAAO;EACL,IAAI,OAAO;EACX,aAAa,OAAO;EACpB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,iBAAiB,OAAO;EACxB,iBAAiB,OAAO;EACxB,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,gBACE,OAAO,kBAAkB,OAAO,OAAO,mBAAmB,WACtD,iBAAiB,OAAO,cAAc,IACtC,KAAA;CACR;AACF;AAeA,SAAgB,sBAAsB,QAAwD;CAC5F,QAAQ,QAAR;EACE,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,cACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT;GACE,QAAQ,MAAM,0BAA0B,OAAO,MAAM,GAAG;GACxD,MAAM,IAAI,MAAM,0BAA0B,OAAO,MAAM,GAAG;CAE9D;AACF;;AAKA,SAAgB,WAAW,UAAkB;CAC3C,QAAA,GAAOA,cAAAA,iBAAAA,CAAiB,QAAQ;AAClC;AAEA,SAAgB,MAAM,OAAe,UAAkB;CACrD,OAAO,QAAQ,WAAW,QAAQ;AACpC;AA0CA,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;AAqBtC,SAAS,gBAAgB,WAA2B;CAClD,MAAM,WAAW,UAAU,QAAQ,oBAAoB,EAAE;CACzD,IAAI,SAAS,SAAS,+BACpB,QAAQ,KACN,gCAAgC,8BAA8B,gGACc,WAC9E;CAEF,OAAO,SAAS,MAAM,GAAG,6BAA6B;AACxD;AAEA,SAAgB,sBAAsB,SAA8C;CAClF,IAAI;CACJ,IAAI;CACJ,IAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,UAAU;EAC9C,QAAQ,QAAQ,YAAY,QAAQ,KAAK,SAAS,MAAM,KAAK,cAAc,CAAC,KAAK;EACjF,WAAW,QAAQ,aAAa,EAAE,EAAE,YAAY;CAClD,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ;CACrB;CAEA,OAAO;EACL,gBAAgB,gBAAgB,QAAQ,EAAE;EAC1C,OAAO,MAAM,OAAO,QAAQ;EAC5B,UAAU,SAAS,YAAY;EAC/B,QAAQ,QAAQ;EAChB,OAAO,QAAQ,YAAY,KAAK,MAAM,WAAW;GAC/C;GACA,SAAS,KAAK;GACd,WAAW,KAAK,eAAe;GAC/B,OAAO,MAAM,KAAK,cAAc,KAAK,QAAQ;GAC7C,UAAU,KAAK,YAAY;GAC3B,UAAU,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACrD,EAAE;CACJ;AACF;AAEA,SAAgB,2BAA2B,GAA0C;CACnF,OAAO;EACL,UAAU,EAAE,SAAS,YAAY;EACjC,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACtC,OAAO,CACL;GACE,SAAS,EAAE,QAAQ;GACnB,WAAW,EAAE,QAAQ;GACrB,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACxC,CACF;CACF;AACF;;;;;;;AAQA,SAAgB,uBACd,cAC4B;CAC5B,MAAM,UAAU,aAAa;CAC7B,IAAI,CAAC,WAAY,CAAC,QAAQ,UAAU,CAAC,QAAQ,YAAY,CAAC,QAAQ,SAAU,OAAO;CACnF,OAAO;EACL,WACE,QAAQ,WAAW,oBAAoB,QAAQ,WAAW,qBACtD,WACA;EACN,QAAQ,QAAQ,UAAU;EAE1B,UAAU,QAAQ,WACbC,2BAAAA,uBAA6C,SAAS,QAAQ,QAAQ,IACpE,QAAQ,WACT,UACF;EACJ,SAAS,QAAQ,WAAW;CAC9B;AACF"}

package/dist/stripe/mapper.d.cts

@@ -1,5 +1,6 @@
 import { CancellationDetails, SubscriptionStatus } from "../subscription/index.cjs";
 import { Stripe } from "stripe";
+import { ZERO_DECIMAL_CURRENCIES } from "@shware/utils";
 //#region src/stripe/mapper.d.ts
 export declare function mapTime<T extends number | null>(stripeTimestampSeconds: T): T extends number ? string : null;
 export type Price = {
@@ -104,8 +105,8 @@ export type ProductPrice = {
   };
 };
 export declare function mapSubscriptionStatus(status: Stripe.Subscription.Status): SubscriptionStatus;
-export declare const ZERO_DECIMAL_CURRENCIES: string[];
-export declare function minorUnits(currency: string): 1 | 100;
+/** How many Stripe API amount units make one unit of `currency` (1, 100 or 1000). */
+export declare function minorUnits(currency: string): 1 | 100 | 1000;
 export declare function price(value: number, currency: string): number;
 export interface Item {
   item_id: string;
@@ -152,4 +153,5 @@ export declare function getBeginCheckoutProperties(p: ProductPrice): BeginChecko
  */
 export declare function mapCancellationDetails(subscription: Pick<Stripe.Subscription, 'cancellation_details'>): CancellationDetails | null;
 //#endregion
+export { ZERO_DECIMAL_CURRENCIES };
 //# sourceMappingURL=mapper.d.cts.map

package/dist/stripe/mapper.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"mapper.d.cts","names":[],"sources":["../../src/stripe/mapper.ts"],"mappings":";;;wBAQgB,QAAQ,yBACtB,wBAAwB,IACvB;YAKS;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,gBAAgB,OAAO,MAAM;EAC7B,UAAU,OAAO;EACjB;EACA;EACA,WAAW,OAAO,MAAM;;wBAGV,SAAS,OAAO,OAAO,QAAQ;iBAa9B;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO;;wBAGO,YAAY,MAAM,OAAO,WAAW;YAoBxC,gBAAgB,OAAO,SAAS,QAAQ;iBAMnC;EACf;EACA;EACA;EACA;EACA;EACA,gBAAgB;EAChB;EACA;EACA,YAAY;;wBAGE,mBAAmB,SAAS,OAAO,SAAS,UAAU;wBA0BtD,WAAW,GAAG,OAAO;EAEjC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,gBAAc,OAAA,QAAA;EACd;EACA;EACA;EACA,QAAM,OAAA,QAAA;EACN;EACA;EACA;;wBAIY,iBAAiB,QAAQ,OAAO;EAE5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,cAAA;EACN;;wBAIY,UAAU,QAAQ,OAAO;EAErC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,OAAA;EACN;EACA;;;;;;;;;;;;YAOQ;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,UAAU,OAAO;EACjB;IACE,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,UAAU,OAAO;;;wBAIL,sBAAsB,QAAQ,OAAO,aAAa,SAAS;qBAyB9D;wBAmBG,WAAW;wBAIX,MAAM,eAAe;iBAIpB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;;iBAGO;EACf;EACA;EACA;EACA,OAAO;;wBAqCO,sBAAsB,SAAS,kBAAkB;wBA2BjD,2BAA2B,GAAG,eAAe;;;;;;;wBAoB7C,uBACd,cAAc,KAAK,OAAO,wCACzB"}
+{"version":3,"file":"mapper.d.cts","names":[],"sources":["../../src/stripe/mapper.ts"],"mappings":";;;;wBASgB,QAAQ,yBACtB,wBAAwB,IACvB;YAKS;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,gBAAgB,OAAO,MAAM;EAC7B,UAAU,OAAO;EACjB;EACA;EACA,WAAW,OAAO,MAAM;;wBAGV,SAAS,OAAO,OAAO,QAAQ;iBAa9B;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO;;wBAGO,YAAY,MAAM,OAAO,WAAW;YAoBxC,gBAAgB,OAAO,SAAS,QAAQ;iBAMnC;EACf;EACA;EACA;EACA;EACA;EACA,gBAAgB;EAChB;EACA;EACA,YAAY;;wBAGE,mBAAmB,SAAS,OAAO,SAAS,UAAU;wBA0BtD,WAAW,GAAG,OAAO;EAEjC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,gBAAc,OAAA,QAAA;EACd;EACA;EACA;EACA,QAAM,OAAA,QAAA;EACN;EACA;EACA;;wBAIY,iBAAiB,QAAQ,OAAO;EAE5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,cAAA;EACN;;wBAIY,UAAU,QAAQ,OAAO;EAErC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,OAAA;EACN;EACA;;;;;;;;;;;;YAOQ;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,UAAU,OAAO;EACjB;IACE,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,UAAU,OAAO;;;wBAIL,sBAAsB,QAAQ,OAAO,aAAa,SAAS;;wBA4B3D,WAAW;wBAIX,MAAM,eAAe;iBAIpB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;;iBAGO;EACf;EACA;EACA;EACA,OAAO;;wBAqCO,sBAAsB,SAAS,kBAAkB;wBA2BjD,2BAA2B,GAAG,eAAe;;;;;;;wBAoB7C,uBACd,cAAc,KAAK,OAAO,wCACzB"}

package/dist/stripe/mapper.d.mts

@@ -1,4 +1,5 @@
 import { CancellationDetails, SubscriptionStatus } from "../subscription/index.mjs";
+import { ZERO_DECIMAL_CURRENCIES } from "@shware/utils";
 import { Stripe } from "stripe";
 //#region src/stripe/mapper.d.ts
 export declare function mapTime<T extends number | null>(stripeTimestampSeconds: T): T extends number ? string : null;
@@ -104,8 +105,8 @@ export type ProductPrice = {
   };
 };
 export declare function mapSubscriptionStatus(status: Stripe.Subscription.Status): SubscriptionStatus;
-export declare const ZERO_DECIMAL_CURRENCIES: string[];
-export declare function minorUnits(currency: string): 1 | 100;
+/** How many Stripe API amount units make one unit of `currency` (1, 100 or 1000). */
+export declare function minorUnits(currency: string): 1 | 100 | 1000;
 export declare function price(value: number, currency: string): number;
 export interface Item {
   item_id: string;
@@ -152,4 +153,5 @@ export declare function getBeginCheckoutProperties(p: ProductPrice): BeginChecko
  */
 export declare function mapCancellationDetails(subscription: Pick<Stripe.Subscription, 'cancellation_details'>): CancellationDetails | null;
 //#endregion
+export { ZERO_DECIMAL_CURRENCIES };
 //# sourceMappingURL=mapper.d.mts.map

package/dist/stripe/mapper.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"mapper.d.mts","names":[],"sources":["../../src/stripe/mapper.ts"],"mappings":";;;wBAQgB,QAAQ,yBACtB,wBAAwB,IACvB;YAKS;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,gBAAgB,OAAO,MAAM;EAC7B,UAAU,OAAO;EACjB;EACA;EACA,WAAW,OAAO,MAAM;;wBAGV,SAAS,OAAO,OAAO,QAAQ;iBAa9B;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO;;wBAGO,YAAY,MAAM,OAAO,WAAW;YAoBxC,gBAAgB,OAAO,SAAS,QAAQ;iBAMnC;EACf;EACA;EACA;EACA;EACA;EACA,gBAAgB;EAChB;EACA;EACA,YAAY;;wBAGE,mBAAmB,SAAS,OAAO,SAAS,UAAU;wBA0BtD,WAAW,GAAG,OAAO;EAEjC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,gBAAc,OAAA,QAAA;EACd;EACA;EACA;EACA,QAAM,OAAA,QAAA;EACN;EACA;EACA;;wBAIY,iBAAiB,QAAQ,OAAO;EAE5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,cAAA;EACN;;wBAIY,UAAU,QAAQ,OAAO;EAErC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,OAAA;EACN;EACA;;;;;;;;;;;;YAOQ;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,UAAU,OAAO;EACjB;IACE,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,UAAU,OAAO;;;wBAIL,sBAAsB,QAAQ,OAAO,aAAa,SAAS;qBAyB9D;wBAmBG,WAAW;wBAIX,MAAM,eAAe;iBAIpB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;;iBAGO;EACf;EACA;EACA;EACA,OAAO;;wBAqCO,sBAAsB,SAAS,kBAAkB;wBA2BjD,2BAA2B,GAAG,eAAe;;;;;;;wBAoB7C,uBACd,cAAc,KAAK,OAAO,wCACzB"}
+{"version":3,"file":"mapper.d.mts","names":[],"sources":["../../src/stripe/mapper.ts"],"mappings":";;;;wBASgB,QAAQ,yBACtB,wBAAwB,IACvB;YAKS;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,gBAAgB,OAAO,MAAM;EAC7B,UAAU,OAAO;EACjB;EACA;EACA,WAAW,OAAO,MAAM;;wBAGV,SAAS,OAAO,OAAO,QAAQ;iBAa9B;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,OAAO;;wBAGO,YAAY,MAAM,OAAO,WAAW;YAoBxC,gBAAgB,OAAO,SAAS,QAAQ;iBAMnC;EACf;EACA;EACA;EACA;EACA;EACA,gBAAgB;EAChB;EACA;EACA,YAAY;;wBAGE,mBAAmB,SAAS,OAAO,SAAS,UAAU;wBA0BtD,WAAW,GAAG,OAAO;EAEjC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,gBAAc,OAAA,QAAA;EACd;EACA;EACA;EACA,QAAM,OAAA,QAAA;EACN;EACA;EACA;;wBAIY,iBAAiB,QAAQ,OAAO;EAE5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,cAAA;EACN;;wBAIY,UAAU,QAAQ,OAAO;EAErC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAM,OAAA,OAAA;EACN;EACA;;;;;;;;;;;;YAOQ;EACV;EACA,MAAM,OAAO,MAAM;EACnB;EACA,UAAU,OAAO;EACjB;IACE,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,UAAU,OAAO;;;wBAIL,sBAAsB,QAAQ,OAAO,aAAa,SAAS;;wBA4B3D,WAAW;wBAIX,MAAM,eAAe;iBAIpB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;;iBAGO;EACf;EACA;EACA;EACA,OAAO;;wBAqCO,sBAAsB,SAAS,kBAAkB;wBA2BjD,2BAA2B,GAAG,eAAe;;;;;;;wBAoB7C,uBACd,cAAc,KAAK,OAAO,wCACzB"}

package/dist/stripe/mapper.mjs

@@ -1,4 +1,5 @@
 import { CANCELLATION_FEEDBACKS } from "../subscription/index.mjs";
+import { ZERO_DECIMAL_CURRENCIES, stripeMinorUnits } from "@shware/utils";
 //#region src/stripe/mapper.ts
 function mapTime(stripeTimestampSeconds) {
 	if (!stripeTimestampSeconds) return null;
@@ -113,26 +114,9 @@ function mapSubscriptionStatus(status) {
 			throw new Error(`Invalid stripe status: ${String(status)}`);
 	}
 }
-const ZERO_DECIMAL_CURRENCIES = [
-	"BIF",
-	"CLP",
-	"DJF",
-	"GNF",
-	"JPY",
-	"KMF",
-	"KRW",
-	"MGA",
-	"PYG",
-	"RWF",
-	"UGX",
-	"VND",
-	"VUV",
-	"XAF",
-	"XOF",
-	"XPF"
-];
+/** How many Stripe API amount units make one unit of `currency` (1, 100 or 1000). */
 function minorUnits(currency) {
-	return ZERO_DECIMAL_CURRENCIES.includes(currency.toUpperCase()) ? 1 : 100;
+	return stripeMinorUnits(currency);
 }
 function price(value, currency) {
 	return value / minorUnits(currency);

package/dist/stripe/mapper.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mapper.mjs","names":[],"sources":["../../src/stripe/mapper.ts"],"sourcesContent":["import type { Stripe } from 'stripe';\nimport {\n  CANCELLATION_FEEDBACKS,\n  type CancellationDetails,\n  type CancellationFeedback,\n  type SubscriptionStatus,\n} from '../subscription/index';\n\nexport function mapTime<T extends number | null>(\n  stripeTimestampSeconds: T\n): T extends number ? string : null {\n  if (!stripeTimestampSeconds) return null as T extends number ? string : null;\n  return new Date(stripeTimestampSeconds * 1000).toISOString() as T extends number ? string : null;\n}\n\nexport type Price = {\n  id: string;\n  type: Stripe.Price.Type;\n  active: boolean;\n  billing_scheme: Stripe.Price.BillingScheme;\n  currency: Stripe.Price['currency'];\n  unit_amount: number | null;\n  unit_amount_decimal: string | null;\n  recurring: Stripe.Price.Recurring | null;\n};\n\nexport function mapPrice(price: Stripe.Price): Price {\n  return {\n    id: price.id,\n    type: price.type,\n    active: price.active,\n    billing_scheme: price.billing_scheme,\n    currency: price.currency,\n    unit_amount: price.unit_amount,\n    unit_amount_decimal: price.unit_amount_decimal?.toString() ?? null,\n    recurring: price.recurring,\n  };\n}\n\nexport interface LineItem {\n  id: string;\n  currency: string;\n  quantity: number | null;\n  description: string | null;\n  amount_tax: number;\n  amount_total: number;\n  amount_subtotal: number;\n  amount_discount: number;\n  price: Price | null;\n}\n\nexport function mapLineItem(item: Stripe.LineItem): LineItem {\n  return {\n    id: item.price\n      ? typeof item.price.product === 'string'\n        ? item.price.product\n        : item.price.product.id\n      : item.id,\n    currency: item.currency,\n    quantity: item.quantity,\n    description: item.description,\n    amount_tax: item.amount_tax,\n    amount_total: item.amount_total,\n    amount_subtotal: item.amount_subtotal,\n    amount_discount: item.amount_discount,\n    price: item.price ? mapPrice(item.price) : null,\n  };\n}\n\n// Re-exported under our own name so consumers need not reach into stripe's namespace.\n// Open-ended since stripe 22.4: a status the API adds later is not a type error.\nexport type PaymentStatus = Stripe.Checkout.Session.PaymentStatus;\n\n// Declared rather than inferred from mapCheckoutSession: an inferred shape is\n// structural, so a consumer's declaration emit has to spell out payment_status\n// through stripe's internal module path — TS2883 in any package that reaches\n// stripe transitively instead of depending on it (see line_items/price too).\nexport interface CheckoutSession {\n  id: string;\n  url: string | null;\n  coupon: string | undefined;\n  livemode: boolean;\n  expires_at: number;\n  payment_status: PaymentStatus;\n  currency: string | null;\n  amount_total: number | null;\n  line_items: LineItem[] | undefined;\n}\n\nexport function mapCheckoutSession(session: Stripe.Checkout.Session): CheckoutSession {\n  let coupon: string | undefined = undefined;\n  if (Array.isArray(session.discounts) && session.discounts.length !== 0) {\n    const discount = session.discounts[0];\n    if (discount.coupon && typeof discount.coupon === 'object') {\n      coupon = discount.coupon.id;\n    } else if (typeof discount.coupon === 'string') {\n      coupon = discount.coupon;\n    } else {\n      coupon = undefined;\n    }\n  }\n\n  return {\n    id: session.id,\n    url: session.url,\n    coupon,\n    livemode: session.livemode,\n    expires_at: session.expires_at,\n    payment_status: session.payment_status,\n    currency: session.currency,\n    amount_total: session.amount_total,\n    line_items: session.line_items?.data.map(mapLineItem),\n  };\n}\n\nexport function mapInvoice(i: Stripe.Invoice) {\n  return {\n    id: i.id,\n    number: i.number,\n    total: i.total,\n    subtotal: i.subtotal,\n    amount_due: i.amount_due,\n    amount_paid: i.amount_paid,\n    amount_remaining: i.amount_remaining,\n    currency: i.currency,\n    billing_reason: i.billing_reason,\n    hosted_invoice_url: i.hosted_invoice_url,\n    invoice_pdf: i.invoice_pdf,\n    receipt_number: i.receipt_number,\n    status: i.status,\n    created: i.created,\n    period_start: i.period_start,\n    period_end: i.period_end,\n  };\n}\n\nexport function mapPaymentIntent(intent: Stripe.PaymentIntent) {\n  return {\n    id: intent.id,\n    amount: intent.amount,\n    amount_capturable: intent.amount_capturable,\n    amount_received: intent.amount_received,\n    currency: intent.currency,\n    client_secret: intent.client_secret,\n    description: intent.description,\n    status: intent.status,\n    created: intent.created,\n  };\n}\n\nexport function mapCharge(charge: Stripe.Charge) {\n  return {\n    id: charge.id,\n    description: charge.description,\n    currency: charge.currency,\n    amount: charge.amount,\n    amount_captured: charge.amount_captured,\n    amount_refunded: charge.amount_refunded,\n    receipt_email: charge.receipt_email,\n    receipt_number: charge.receipt_number,\n    receipt_url: charge.receipt_url,\n    status: charge.status,\n    created: charge.created,\n    payment_intent:\n      charge.payment_intent && typeof charge.payment_intent === 'object'\n        ? mapPaymentIntent(charge.payment_intent)\n        : undefined,\n  };\n}\n\nexport type ProductPrice = {\n  id: string;\n  type: Stripe.Price.Type;\n  unit_amount: number;\n  currency: Stripe.Price['currency'];\n  product: {\n    id: Stripe.Product['id'];\n    name: Stripe.Product['name'];\n    description: Stripe.Product['description'];\n    livemode: Stripe.Product['livemode'];\n  };\n};\n\nexport function mapSubscriptionStatus(status: Stripe.Subscription.Status): SubscriptionStatus {\n  switch (status) {\n    case 'active':\n      return 'ACTIVE';\n    case 'canceled':\n      return 'CANCELED';\n    case 'incomplete':\n      return 'INCOMPLETE';\n    case 'incomplete_expired':\n      return 'INCOMPLETE_EXPIRED';\n    case 'past_due':\n      return 'PAST_DUE';\n    case 'paused':\n      return 'PAUSED';\n    case 'trialing':\n      return 'TRIALING';\n    case 'unpaid':\n      return 'UNPAID';\n    default: {\n      console.error(`Invalid stripe status: ${String(status)}`);\n      throw new Error(`Invalid stripe status: ${String(status)}`);\n    }\n  }\n}\n\nexport const ZERO_DECIMAL_CURRENCIES = [\n  'BIF',\n  'CLP',\n  'DJF',\n  'GNF',\n  'JPY',\n  'KMF',\n  'KRW',\n  'MGA',\n  'PYG',\n  'RWF',\n  'UGX',\n  'VND',\n  'VUV',\n  'XAF',\n  'XOF',\n  'XPF',\n];\n\nexport function minorUnits(currency: string) {\n  return ZERO_DECIMAL_CURRENCIES.includes(currency.toUpperCase()) ? 1 : 100;\n}\n\nexport function price(value: number, currency: string) {\n  return value / minorUnits(currency);\n}\n\nexport interface Item {\n  item_id: string;\n  item_name: string;\n  affiliation?: 'Google Store' | (string & {});\n  coupon?: string;\n  discount?: number;\n  index?: number;\n  item_brand?: string;\n  item_category?: string;\n  item_category2?: string;\n  item_category3?: string;\n  item_category4?: string;\n  item_category5?: string;\n  item_list_id?: string;\n  item_list_name?: string;\n  item_variant?: string;\n  location_id?: string;\n  price?: number;\n  quantity?: number;\n}\n\nexport interface PurchaseProperties {\n  currency: string;\n  value: number;\n  transaction_id: string;\n  coupon?: string;\n  shipping?: number;\n  tax?: number;\n  items?: Item[];\n}\n\nexport interface BeginCheckoutProperties {\n  currency: string;\n  value: number;\n  coupon?: string;\n  items: Item[];\n}\n\n// Google Ads rejects conversion transaction IDs longer than 64 characters.\n// https://support.google.com/google-ads/answer/6386790\nconst GOOGLE_ADS_TRANSACTION_ID_MAX = 64;\n\n/**\n * GA4 purchase events feed Google Ads conversions, whose transaction IDs are\n * capped at 64 characters — but Stripe checkout session ids exceed that:\n * around 2021 they grew from ~32 chars (`cs_live_` + 24 random chars) to ~66\n * (`cs_live_a` + 57), with no announcement. Stripe treats id length/format as\n * opaque and backwards-compatible, guaranteeing only that ids never exceed\n * 255 chars, so they may grow again at any time.\n *\n * Dropping the fixed `cs_live_`/`cs_test_` prefix brings the id under 64\n * while staying reversible: prepend the prefix (livemode tells which) to\n * reconstruct the full session id for Stripe dashboard lookups. The payment\n * intent id (~27 chars) is not a substitute — it only exists on\n * `mode: 'payment'` sessions (subscription-mode sessions carry it on the\n * invoice instead), and its short length is just as unguaranteed as the\n * session id's was.\n *\n * Must stay deterministic: GA4/Google Ads dedupe purchases by\n * transaction_id, and the same session may be tracked from multiple paths.\n */\nfunction toTransactionId(sessionId: string): string {\n  const stripped = sessionId.replace(/^cs_(live|test)_/, '');\n  if (stripped.length > GOOGLE_ADS_TRANSACTION_ID_MAX) {\n    console.warn(\n      `transaction_id still exceeds ${GOOGLE_ADS_TRANSACTION_ID_MAX} chars after stripping ` +\n        `the prefix — Stripe may have lengthened session ids again; truncating: ${sessionId}`\n    );\n  }\n  return stripped.slice(0, GOOGLE_ADS_TRANSACTION_ID_MAX);\n}\n\nexport function getPurchaseProperties(session: CheckoutSession): PurchaseProperties {\n  let value: number;\n  let currency: string;\n  if (!session.amount_total || !session.currency) {\n    value = session.line_items?.reduce((acc, item) => acc + item.amount_total, 0) ?? 0;\n    currency = session.line_items?.[0]?.currency ?? 'usd';\n  } else {\n    value = session.amount_total;\n    currency = session.currency;\n  }\n\n  return {\n    transaction_id: toTransactionId(session.id),\n    value: price(value, currency),\n    currency: currency.toUpperCase(),\n    coupon: session.coupon,\n    items: session.line_items?.map((item, index) => ({\n      index,\n      item_id: item.id,\n      item_name: item.description ?? '',\n      price: price(item.amount_total, item.currency),\n      quantity: item.quantity ?? 1,\n      discount: price(item.amount_discount, item.currency),\n    })),\n  };\n}\n\nexport function getBeginCheckoutProperties(p: ProductPrice): BeginCheckoutProperties {\n  return {\n    currency: p.currency.toUpperCase(),\n    value: price(p.unit_amount, p.currency),\n    items: [\n      {\n        item_id: p.product.id,\n        item_name: p.product.name,\n        price: price(p.unit_amount, p.currency),\n      },\n    ],\n  };\n}\n\n/**\n * Stripe's `cancellation_details` in the shared shape. The object is present on every\n * subscription with all three fields null, so an active one maps to null rather than an empty\n * record. `reason` says who acted: `cancellation_requested` is the customer (or us on their\n * behalf), the payment reasons are Stripe ending it.\n */\nexport function mapCancellationDetails(\n  subscription: Pick<Stripe.Subscription, 'cancellation_details'>\n): CancellationDetails | null {\n  const details = subscription.cancellation_details;\n  if (!details || (!details.reason && !details.feedback && !details.comment)) return null;\n  return {\n    initiator:\n      details.reason === 'payment_failed' || details.reason === 'payment_disputed'\n        ? 'system'\n        : 'user',\n    reason: details.reason ?? null,\n    // Stripe's feedback vocabulary is ours; anything it adds later is reported as \"other\".\n    feedback: details.feedback\n      ? (CANCELLATION_FEEDBACKS as readonly string[]).includes(details.feedback)\n        ? (details.feedback as CancellationFeedback)\n        : 'other'\n      : null,\n    comment: details.comment ?? null,\n  };\n}\n"],"mappings":";;AAQA,SAAgB,QACd,wBACkC;CAClC,IAAI,CAAC,wBAAwB,OAAO;CACpC,wBAAO,IAAI,KAAK,yBAAyB,GAAI,EAAA,CAAE,YAAY;AAC7D;AAaA,SAAgB,SAAS,OAA4B;CACnD,OAAO;EACL,IAAI,MAAM;EACV,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,gBAAgB,MAAM;EACtB,UAAU,MAAM;EAChB,aAAa,MAAM;EACnB,qBAAqB,MAAM,qBAAqB,SAAS,KAAK;EAC9D,WAAW,MAAM;CACnB;AACF;AAcA,SAAgB,YAAY,MAAiC;CAC3D,OAAO;EACL,IAAI,KAAK,QACL,OAAO,KAAK,MAAM,YAAY,WAC5B,KAAK,MAAM,UACX,KAAK,MAAM,QAAQ,KACrB,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,aAAa,KAAK;EAClB,YAAY,KAAK;EACjB,cAAc,KAAK;EACnB,iBAAiB,KAAK;EACtB,iBAAiB,KAAK;EACtB,OAAO,KAAK,QAAQ,SAAS,KAAK,KAAK,IAAI;CAC7C;AACF;AAsBA,SAAgB,mBAAmB,SAAmD;CACpF,IAAI,SAA6B,KAAA;CACjC,IAAI,MAAM,QAAQ,QAAQ,SAAS,KAAK,QAAQ,UAAU,WAAW,GAAG;EACtE,MAAM,WAAW,QAAQ,UAAU;EACnC,IAAI,SAAS,UAAU,OAAO,SAAS,WAAW,UAChD,SAAS,SAAS,OAAO;OACpB,IAAI,OAAO,SAAS,WAAW,UACpC,SAAS,SAAS;OAElB,SAAS,KAAA;CAEb;CAEA,OAAO;EACL,IAAI,QAAQ;EACZ,KAAK,QAAQ;EACb;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,gBAAgB,QAAQ;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,YAAY,QAAQ,YAAY,KAAK,IAAI,WAAW;CACtD;AACF;AAEA,SAAgB,WAAW,GAAmB;CAC5C,OAAO;EACL,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,YAAY,EAAE;EACd,aAAa,EAAE;EACf,kBAAkB,EAAE;EACpB,UAAU,EAAE;EACZ,gBAAgB,EAAE;EAClB,oBAAoB,EAAE;EACtB,aAAa,EAAE;EACf,gBAAgB,EAAE;EAClB,QAAQ,EAAE;EACV,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,YAAY,EAAE;CAChB;AACF;AAEA,SAAgB,iBAAiB,QAA8B;CAC7D,OAAO;EACL,IAAI,OAAO;EACX,QAAQ,OAAO;EACf,mBAAmB,OAAO;EAC1B,iBAAiB,OAAO;EACxB,UAAU,OAAO;EACjB,eAAe,OAAO;EACtB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;CAClB;AACF;AAEA,SAAgB,UAAU,QAAuB;CAC/C,OAAO;EACL,IAAI,OAAO;EACX,aAAa,OAAO;EACpB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,iBAAiB,OAAO;EACxB,iBAAiB,OAAO;EACxB,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,gBACE,OAAO,kBAAkB,OAAO,OAAO,mBAAmB,WACtD,iBAAiB,OAAO,cAAc,IACtC,KAAA;CACR;AACF;AAeA,SAAgB,sBAAsB,QAAwD;CAC5F,QAAQ,QAAR;EACE,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,cACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT;GACE,QAAQ,MAAM,0BAA0B,OAAO,MAAM,GAAG;GACxD,MAAM,IAAI,MAAM,0BAA0B,OAAO,MAAM,GAAG;CAE9D;AACF;AAEA,MAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,WAAW,UAAkB;CAC3C,OAAO,wBAAwB,SAAS,SAAS,YAAY,CAAC,IAAI,IAAI;AACxE;AAEA,SAAgB,MAAM,OAAe,UAAkB;CACrD,OAAO,QAAQ,WAAW,QAAQ;AACpC;AA0CA,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;AAqBtC,SAAS,gBAAgB,WAA2B;CAClD,MAAM,WAAW,UAAU,QAAQ,oBAAoB,EAAE;CACzD,IAAI,SAAS,SAAS,+BACpB,QAAQ,KACN,gCAAgC,8BAA8B,gGACc,WAC9E;CAEF,OAAO,SAAS,MAAM,GAAG,6BAA6B;AACxD;AAEA,SAAgB,sBAAsB,SAA8C;CAClF,IAAI;CACJ,IAAI;CACJ,IAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,UAAU;EAC9C,QAAQ,QAAQ,YAAY,QAAQ,KAAK,SAAS,MAAM,KAAK,cAAc,CAAC,KAAK;EACjF,WAAW,QAAQ,aAAa,EAAE,EAAE,YAAY;CAClD,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ;CACrB;CAEA,OAAO;EACL,gBAAgB,gBAAgB,QAAQ,EAAE;EAC1C,OAAO,MAAM,OAAO,QAAQ;EAC5B,UAAU,SAAS,YAAY;EAC/B,QAAQ,QAAQ;EAChB,OAAO,QAAQ,YAAY,KAAK,MAAM,WAAW;GAC/C;GACA,SAAS,KAAK;GACd,WAAW,KAAK,eAAe;GAC/B,OAAO,MAAM,KAAK,cAAc,KAAK,QAAQ;GAC7C,UAAU,KAAK,YAAY;GAC3B,UAAU,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACrD,EAAE;CACJ;AACF;AAEA,SAAgB,2BAA2B,GAA0C;CACnF,OAAO;EACL,UAAU,EAAE,SAAS,YAAY;EACjC,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACtC,OAAO,CACL;GACE,SAAS,EAAE,QAAQ;GACnB,WAAW,EAAE,QAAQ;GACrB,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACxC,CACF;CACF;AACF;;;;;;;AAQA,SAAgB,uBACd,cAC4B;CAC5B,MAAM,UAAU,aAAa;CAC7B,IAAI,CAAC,WAAY,CAAC,QAAQ,UAAU,CAAC,QAAQ,YAAY,CAAC,QAAQ,SAAU,OAAO;CACnF,OAAO;EACL,WACE,QAAQ,WAAW,oBAAoB,QAAQ,WAAW,qBACtD,WACA;EACN,QAAQ,QAAQ,UAAU;EAE1B,UAAU,QAAQ,WACb,uBAA6C,SAAS,QAAQ,QAAQ,IACpE,QAAQ,WACT,UACF;EACJ,SAAS,QAAQ,WAAW;CAC9B;AACF"}
+{"version":3,"file":"mapper.mjs","names":[],"sources":["../../src/stripe/mapper.ts"],"sourcesContent":["import { stripeMinorUnits } from '@shware/utils';\nimport type { Stripe } from 'stripe';\nimport {\n  CANCELLATION_FEEDBACKS,\n  type CancellationDetails,\n  type CancellationFeedback,\n  type SubscriptionStatus,\n} from '../subscription/index';\n\nexport function mapTime<T extends number | null>(\n  stripeTimestampSeconds: T\n): T extends number ? string : null {\n  if (!stripeTimestampSeconds) return null as T extends number ? string : null;\n  return new Date(stripeTimestampSeconds * 1000).toISOString() as T extends number ? string : null;\n}\n\nexport type Price = {\n  id: string;\n  type: Stripe.Price.Type;\n  active: boolean;\n  billing_scheme: Stripe.Price.BillingScheme;\n  currency: Stripe.Price['currency'];\n  unit_amount: number | null;\n  unit_amount_decimal: string | null;\n  recurring: Stripe.Price.Recurring | null;\n};\n\nexport function mapPrice(price: Stripe.Price): Price {\n  return {\n    id: price.id,\n    type: price.type,\n    active: price.active,\n    billing_scheme: price.billing_scheme,\n    currency: price.currency,\n    unit_amount: price.unit_amount,\n    unit_amount_decimal: price.unit_amount_decimal?.toString() ?? null,\n    recurring: price.recurring,\n  };\n}\n\nexport interface LineItem {\n  id: string;\n  currency: string;\n  quantity: number | null;\n  description: string | null;\n  amount_tax: number;\n  amount_total: number;\n  amount_subtotal: number;\n  amount_discount: number;\n  price: Price | null;\n}\n\nexport function mapLineItem(item: Stripe.LineItem): LineItem {\n  return {\n    id: item.price\n      ? typeof item.price.product === 'string'\n        ? item.price.product\n        : item.price.product.id\n      : item.id,\n    currency: item.currency,\n    quantity: item.quantity,\n    description: item.description,\n    amount_tax: item.amount_tax,\n    amount_total: item.amount_total,\n    amount_subtotal: item.amount_subtotal,\n    amount_discount: item.amount_discount,\n    price: item.price ? mapPrice(item.price) : null,\n  };\n}\n\n// Re-exported under our own name so consumers need not reach into stripe's namespace.\n// Open-ended since stripe 22.4: a status the API adds later is not a type error.\nexport type PaymentStatus = Stripe.Checkout.Session.PaymentStatus;\n\n// Declared rather than inferred from mapCheckoutSession: an inferred shape is\n// structural, so a consumer's declaration emit has to spell out payment_status\n// through stripe's internal module path — TS2883 in any package that reaches\n// stripe transitively instead of depending on it (see line_items/price too).\nexport interface CheckoutSession {\n  id: string;\n  url: string | null;\n  coupon: string | undefined;\n  livemode: boolean;\n  expires_at: number;\n  payment_status: PaymentStatus;\n  currency: string | null;\n  amount_total: number | null;\n  line_items: LineItem[] | undefined;\n}\n\nexport function mapCheckoutSession(session: Stripe.Checkout.Session): CheckoutSession {\n  let coupon: string | undefined = undefined;\n  if (Array.isArray(session.discounts) && session.discounts.length !== 0) {\n    const discount = session.discounts[0];\n    if (discount.coupon && typeof discount.coupon === 'object') {\n      coupon = discount.coupon.id;\n    } else if (typeof discount.coupon === 'string') {\n      coupon = discount.coupon;\n    } else {\n      coupon = undefined;\n    }\n  }\n\n  return {\n    id: session.id,\n    url: session.url,\n    coupon,\n    livemode: session.livemode,\n    expires_at: session.expires_at,\n    payment_status: session.payment_status,\n    currency: session.currency,\n    amount_total: session.amount_total,\n    line_items: session.line_items?.data.map(mapLineItem),\n  };\n}\n\nexport function mapInvoice(i: Stripe.Invoice) {\n  return {\n    id: i.id,\n    number: i.number,\n    total: i.total,\n    subtotal: i.subtotal,\n    amount_due: i.amount_due,\n    amount_paid: i.amount_paid,\n    amount_remaining: i.amount_remaining,\n    currency: i.currency,\n    billing_reason: i.billing_reason,\n    hosted_invoice_url: i.hosted_invoice_url,\n    invoice_pdf: i.invoice_pdf,\n    receipt_number: i.receipt_number,\n    status: i.status,\n    created: i.created,\n    period_start: i.period_start,\n    period_end: i.period_end,\n  };\n}\n\nexport function mapPaymentIntent(intent: Stripe.PaymentIntent) {\n  return {\n    id: intent.id,\n    amount: intent.amount,\n    amount_capturable: intent.amount_capturable,\n    amount_received: intent.amount_received,\n    currency: intent.currency,\n    client_secret: intent.client_secret,\n    description: intent.description,\n    status: intent.status,\n    created: intent.created,\n  };\n}\n\nexport function mapCharge(charge: Stripe.Charge) {\n  return {\n    id: charge.id,\n    description: charge.description,\n    currency: charge.currency,\n    amount: charge.amount,\n    amount_captured: charge.amount_captured,\n    amount_refunded: charge.amount_refunded,\n    receipt_email: charge.receipt_email,\n    receipt_number: charge.receipt_number,\n    receipt_url: charge.receipt_url,\n    status: charge.status,\n    created: charge.created,\n    payment_intent:\n      charge.payment_intent && typeof charge.payment_intent === 'object'\n        ? mapPaymentIntent(charge.payment_intent)\n        : undefined,\n  };\n}\n\nexport type ProductPrice = {\n  id: string;\n  type: Stripe.Price.Type;\n  unit_amount: number;\n  currency: Stripe.Price['currency'];\n  product: {\n    id: Stripe.Product['id'];\n    name: Stripe.Product['name'];\n    description: Stripe.Product['description'];\n    livemode: Stripe.Product['livemode'];\n  };\n};\n\nexport function mapSubscriptionStatus(status: Stripe.Subscription.Status): SubscriptionStatus {\n  switch (status) {\n    case 'active':\n      return 'ACTIVE';\n    case 'canceled':\n      return 'CANCELED';\n    case 'incomplete':\n      return 'INCOMPLETE';\n    case 'incomplete_expired':\n      return 'INCOMPLETE_EXPIRED';\n    case 'past_due':\n      return 'PAST_DUE';\n    case 'paused':\n      return 'PAUSED';\n    case 'trialing':\n      return 'TRIALING';\n    case 'unpaid':\n      return 'UNPAID';\n    default: {\n      console.error(`Invalid stripe status: ${String(status)}`);\n      throw new Error(`Invalid stripe status: ${String(status)}`);\n    }\n  }\n}\n\nexport { ZERO_DECIMAL_CURRENCIES } from '@shware/utils';\n\n/** How many Stripe API amount units make one unit of `currency` (1, 100 or 1000). */\nexport function minorUnits(currency: string) {\n  return stripeMinorUnits(currency);\n}\n\nexport function price(value: number, currency: string) {\n  return value / minorUnits(currency);\n}\n\nexport interface Item {\n  item_id: string;\n  item_name: string;\n  affiliation?: 'Google Store' | (string & {});\n  coupon?: string;\n  discount?: number;\n  index?: number;\n  item_brand?: string;\n  item_category?: string;\n  item_category2?: string;\n  item_category3?: string;\n  item_category4?: string;\n  item_category5?: string;\n  item_list_id?: string;\n  item_list_name?: string;\n  item_variant?: string;\n  location_id?: string;\n  price?: number;\n  quantity?: number;\n}\n\nexport interface PurchaseProperties {\n  currency: string;\n  value: number;\n  transaction_id: string;\n  coupon?: string;\n  shipping?: number;\n  tax?: number;\n  items?: Item[];\n}\n\nexport interface BeginCheckoutProperties {\n  currency: string;\n  value: number;\n  coupon?: string;\n  items: Item[];\n}\n\n// Google Ads rejects conversion transaction IDs longer than 64 characters.\n// https://support.google.com/google-ads/answer/6386790\nconst GOOGLE_ADS_TRANSACTION_ID_MAX = 64;\n\n/**\n * GA4 purchase events feed Google Ads conversions, whose transaction IDs are\n * capped at 64 characters — but Stripe checkout session ids exceed that:\n * around 2021 they grew from ~32 chars (`cs_live_` + 24 random chars) to ~66\n * (`cs_live_a` + 57), with no announcement. Stripe treats id length/format as\n * opaque and backwards-compatible, guaranteeing only that ids never exceed\n * 255 chars, so they may grow again at any time.\n *\n * Dropping the fixed `cs_live_`/`cs_test_` prefix brings the id under 64\n * while staying reversible: prepend the prefix (livemode tells which) to\n * reconstruct the full session id for Stripe dashboard lookups. The payment\n * intent id (~27 chars) is not a substitute — it only exists on\n * `mode: 'payment'` sessions (subscription-mode sessions carry it on the\n * invoice instead), and its short length is just as unguaranteed as the\n * session id's was.\n *\n * Must stay deterministic: GA4/Google Ads dedupe purchases by\n * transaction_id, and the same session may be tracked from multiple paths.\n */\nfunction toTransactionId(sessionId: string): string {\n  const stripped = sessionId.replace(/^cs_(live|test)_/, '');\n  if (stripped.length > GOOGLE_ADS_TRANSACTION_ID_MAX) {\n    console.warn(\n      `transaction_id still exceeds ${GOOGLE_ADS_TRANSACTION_ID_MAX} chars after stripping ` +\n        `the prefix — Stripe may have lengthened session ids again; truncating: ${sessionId}`\n    );\n  }\n  return stripped.slice(0, GOOGLE_ADS_TRANSACTION_ID_MAX);\n}\n\nexport function getPurchaseProperties(session: CheckoutSession): PurchaseProperties {\n  let value: number;\n  let currency: string;\n  if (!session.amount_total || !session.currency) {\n    value = session.line_items?.reduce((acc, item) => acc + item.amount_total, 0) ?? 0;\n    currency = session.line_items?.[0]?.currency ?? 'usd';\n  } else {\n    value = session.amount_total;\n    currency = session.currency;\n  }\n\n  return {\n    transaction_id: toTransactionId(session.id),\n    value: price(value, currency),\n    currency: currency.toUpperCase(),\n    coupon: session.coupon,\n    items: session.line_items?.map((item, index) => ({\n      index,\n      item_id: item.id,\n      item_name: item.description ?? '',\n      price: price(item.amount_total, item.currency),\n      quantity: item.quantity ?? 1,\n      discount: price(item.amount_discount, item.currency),\n    })),\n  };\n}\n\nexport function getBeginCheckoutProperties(p: ProductPrice): BeginCheckoutProperties {\n  return {\n    currency: p.currency.toUpperCase(),\n    value: price(p.unit_amount, p.currency),\n    items: [\n      {\n        item_id: p.product.id,\n        item_name: p.product.name,\n        price: price(p.unit_amount, p.currency),\n      },\n    ],\n  };\n}\n\n/**\n * Stripe's `cancellation_details` in the shared shape. The object is present on every\n * subscription with all three fields null, so an active one maps to null rather than an empty\n * record. `reason` says who acted: `cancellation_requested` is the customer (or us on their\n * behalf), the payment reasons are Stripe ending it.\n */\nexport function mapCancellationDetails(\n  subscription: Pick<Stripe.Subscription, 'cancellation_details'>\n): CancellationDetails | null {\n  const details = subscription.cancellation_details;\n  if (!details || (!details.reason && !details.feedback && !details.comment)) return null;\n  return {\n    initiator:\n      details.reason === 'payment_failed' || details.reason === 'payment_disputed'\n        ? 'system'\n        : 'user',\n    reason: details.reason ?? null,\n    // Stripe's feedback vocabulary is ours; anything it adds later is reported as \"other\".\n    feedback: details.feedback\n      ? (CANCELLATION_FEEDBACKS as readonly string[]).includes(details.feedback)\n        ? (details.feedback as CancellationFeedback)\n        : 'other'\n      : null,\n    comment: details.comment ?? null,\n  };\n}\n"],"mappings":";;;AASA,SAAgB,QACd,wBACkC;CAClC,IAAI,CAAC,wBAAwB,OAAO;CACpC,wBAAO,IAAI,KAAK,yBAAyB,GAAI,EAAA,CAAE,YAAY;AAC7D;AAaA,SAAgB,SAAS,OAA4B;CACnD,OAAO;EACL,IAAI,MAAM;EACV,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,gBAAgB,MAAM;EACtB,UAAU,MAAM;EAChB,aAAa,MAAM;EACnB,qBAAqB,MAAM,qBAAqB,SAAS,KAAK;EAC9D,WAAW,MAAM;CACnB;AACF;AAcA,SAAgB,YAAY,MAAiC;CAC3D,OAAO;EACL,IAAI,KAAK,QACL,OAAO,KAAK,MAAM,YAAY,WAC5B,KAAK,MAAM,UACX,KAAK,MAAM,QAAQ,KACrB,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,aAAa,KAAK;EAClB,YAAY,KAAK;EACjB,cAAc,KAAK;EACnB,iBAAiB,KAAK;EACtB,iBAAiB,KAAK;EACtB,OAAO,KAAK,QAAQ,SAAS,KAAK,KAAK,IAAI;CAC7C;AACF;AAsBA,SAAgB,mBAAmB,SAAmD;CACpF,IAAI,SAA6B,KAAA;CACjC,IAAI,MAAM,QAAQ,QAAQ,SAAS,KAAK,QAAQ,UAAU,WAAW,GAAG;EACtE,MAAM,WAAW,QAAQ,UAAU;EACnC,IAAI,SAAS,UAAU,OAAO,SAAS,WAAW,UAChD,SAAS,SAAS,OAAO;OACpB,IAAI,OAAO,SAAS,WAAW,UACpC,SAAS,SAAS;OAElB,SAAS,KAAA;CAEb;CAEA,OAAO;EACL,IAAI,QAAQ;EACZ,KAAK,QAAQ;EACb;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,gBAAgB,QAAQ;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,YAAY,QAAQ,YAAY,KAAK,IAAI,WAAW;CACtD;AACF;AAEA,SAAgB,WAAW,GAAmB;CAC5C,OAAO;EACL,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,YAAY,EAAE;EACd,aAAa,EAAE;EACf,kBAAkB,EAAE;EACpB,UAAU,EAAE;EACZ,gBAAgB,EAAE;EAClB,oBAAoB,EAAE;EACtB,aAAa,EAAE;EACf,gBAAgB,EAAE;EAClB,QAAQ,EAAE;EACV,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,YAAY,EAAE;CAChB;AACF;AAEA,SAAgB,iBAAiB,QAA8B;CAC7D,OAAO;EACL,IAAI,OAAO;EACX,QAAQ,OAAO;EACf,mBAAmB,OAAO;EAC1B,iBAAiB,OAAO;EACxB,UAAU,OAAO;EACjB,eAAe,OAAO;EACtB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;CAClB;AACF;AAEA,SAAgB,UAAU,QAAuB;CAC/C,OAAO;EACL,IAAI,OAAO;EACX,aAAa,OAAO;EACpB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,iBAAiB,OAAO;EACxB,iBAAiB,OAAO;EACxB,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,aAAa,OAAO;EACpB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,gBACE,OAAO,kBAAkB,OAAO,OAAO,mBAAmB,WACtD,iBAAiB,OAAO,cAAc,IACtC,KAAA;CACR;AACF;AAeA,SAAgB,sBAAsB,QAAwD;CAC5F,QAAQ,QAAR;EACE,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,cACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT,KAAK,YACH,OAAO;EACT,KAAK,UACH,OAAO;EACT;GACE,QAAQ,MAAM,0BAA0B,OAAO,MAAM,GAAG;GACxD,MAAM,IAAI,MAAM,0BAA0B,OAAO,MAAM,GAAG;CAE9D;AACF;;AAKA,SAAgB,WAAW,UAAkB;CAC3C,OAAO,iBAAiB,QAAQ;AAClC;AAEA,SAAgB,MAAM,OAAe,UAAkB;CACrD,OAAO,QAAQ,WAAW,QAAQ;AACpC;AA0CA,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;AAqBtC,SAAS,gBAAgB,WAA2B;CAClD,MAAM,WAAW,UAAU,QAAQ,oBAAoB,EAAE;CACzD,IAAI,SAAS,SAAS,+BACpB,QAAQ,KACN,gCAAgC,8BAA8B,gGACc,WAC9E;CAEF,OAAO,SAAS,MAAM,GAAG,6BAA6B;AACxD;AAEA,SAAgB,sBAAsB,SAA8C;CAClF,IAAI;CACJ,IAAI;CACJ,IAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,UAAU;EAC9C,QAAQ,QAAQ,YAAY,QAAQ,KAAK,SAAS,MAAM,KAAK,cAAc,CAAC,KAAK;EACjF,WAAW,QAAQ,aAAa,EAAE,EAAE,YAAY;CAClD,OAAO;EACL,QAAQ,QAAQ;EAChB,WAAW,QAAQ;CACrB;CAEA,OAAO;EACL,gBAAgB,gBAAgB,QAAQ,EAAE;EAC1C,OAAO,MAAM,OAAO,QAAQ;EAC5B,UAAU,SAAS,YAAY;EAC/B,QAAQ,QAAQ;EAChB,OAAO,QAAQ,YAAY,KAAK,MAAM,WAAW;GAC/C;GACA,SAAS,KAAK;GACd,WAAW,KAAK,eAAe;GAC/B,OAAO,MAAM,KAAK,cAAc,KAAK,QAAQ;GAC7C,UAAU,KAAK,YAAY;GAC3B,UAAU,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACrD,EAAE;CACJ;AACF;AAEA,SAAgB,2BAA2B,GAA0C;CACnF,OAAO;EACL,UAAU,EAAE,SAAS,YAAY;EACjC,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACtC,OAAO,CACL;GACE,SAAS,EAAE,QAAQ;GACnB,WAAW,EAAE,QAAQ;GACrB,OAAO,MAAM,EAAE,aAAa,EAAE,QAAQ;EACxC,CACF;CACF;AACF;;;;;;;AAQA,SAAgB,uBACd,cAC4B;CAC5B,MAAM,UAAU,aAAa;CAC7B,IAAI,CAAC,WAAY,CAAC,QAAQ,UAAU,CAAC,QAAQ,YAAY,CAAC,QAAQ,SAAU,OAAO;CACnF,OAAO;EACL,WACE,QAAQ,WAAW,oBAAoB,QAAQ,WAAW,qBACtD,WACA;EACN,QAAQ,QAAQ,UAAU;EAE1B,UAAU,QAAQ,WACb,uBAA6C,SAAS,QAAQ,QAAQ,IACpE,QAAQ,WACT,UACF;EACJ,SAAS,QAAQ,WAAW;CAC9B;AACF"}

package/dist/stripe/schema.cjs

@@ -8,16 +8,56 @@ const cancellationDetailsSchema = (0, zod_mini.object)({
 	feedback: (0, zod_mini.optional)((0, zod_mini.nullable)((0, zod_mini.enum)(require_subscription_index.CANCELLATION_FEEDBACKS))),
 	resubscribeIntent: (0, zod_mini.optional)((0, zod_mini.nullable)((0, zod_mini.enum)(require_subscription_index.RESUBSCRIBE_INTENTS)))
 });
-function createCheckoutSessionSchema(productIds) {
+/**
+* Normalizes each allowed origin with `new URL()`, so `https://example.com/` and
+* `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a
+* misconfigured list must fail at startup, not let every return URL through or refuse them all.
+*/
+function normalizeOrigins(origins) {
+	return origins.map((origin) => {
+		const parsed = new URL(origin);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`returnUrl: ${origin} is not an http(s) origin`);
+		return parsed.origin;
+	});
+}
+/**
+* Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)
+* send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,
+* so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),
+* protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of
+* the origin, so an https-only list refuses `http:` too.
+*/
+function isAllowedReturnUrl(value, allowedOrigins) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.username !== "" || parsed.password !== "") return false;
+	return allowedOrigins.includes(parsed.origin);
+}
+/**
+* A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+* origin check anyone could create a session with their own account and hand out a
+* `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+* redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+*/
+function returnUrlSchema(allowedOrigins) {
+	const origins = normalizeOrigins(allowedOrigins);
+	return (0, zod_mini.url)().check((0, zod_mini.refine)((value) => isAllowedReturnUrl(value, origins), { message: `URL must be on ${origins.join(", ")}` }));
+}
+function createCheckoutSessionSchema(productIds, { allowedOrigins }) {
 	return (0, zod_mini.object)({
 		quantity: (0, zod_mini._default)((0, zod_mini.int)().check((0, zod_mini.gte)(1)), 1),
 		productId: (0, zod_mini.enum)(productIds),
-		cancelUrl: (0, zod_mini.optional)((0, zod_mini.url)()),
-		successUrl: (0, zod_mini.optional)((0, zod_mini.url)())
+		cancelUrl: (0, zod_mini.optional)(returnUrlSchema(allowedOrigins)),
+		successUrl: (0, zod_mini.optional)(returnUrlSchema(allowedOrigins))
 	});
 }
 //#endregion
 exports.cancellationDetailsSchema = cancellationDetailsSchema;
 exports.createCheckoutSessionSchema = createCheckoutSessionSchema;
+exports.returnUrlSchema = returnUrlSchema;
 
 //# sourceMappingURL=schema.cjs.map

package/dist/stripe/schema.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.cjs","names":["object","optional","nullable","string","maxLength","_enum","CANCELLATION_FEEDBACKS","RESUBSCRIBE_INTENTS","_default","int","gte","url"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\nexport function createCheckoutSessionSchema(productIds: string[]) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(url()),\n    successUrl: optional(url()),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;;AAeA,MAAa,6BAAA,GAA4BA,SAAAA,OAAAA,CAAO;CAC9C,UAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,UAAAA,CAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,WAAA,GAAUH,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAMC,2BAAAA,sBAAsB,CAAC,CAAC;CAC1D,oBAAA,GAAmBL,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAME,2BAAAA,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,4BAA4B,YAAsB;CAChE,QAAA,GAAOP,SAAAA,OAAAA,CAAO;EACZ,WAAA,GAAUQ,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GAAMC,SAAAA,IAAAA,CAAI,CAAC,CAAC,GAAG,CAAC;EACzC,YAAA,GAAWL,SAAAA,KAAAA,CAAM,UAAU;EAC3B,YAAA,GAAWJ,SAAAA,SAAAA,EAAAA,GAASU,SAAAA,IAAAA,CAAI,CAAC;EACzB,aAAA,GAAYV,SAAAA,SAAAA,EAAAA,GAASU,SAAAA,IAAAA,CAAI,CAAC;CAC5B,CAAC;AACH"}
+{"version":3,"file":"schema.cjs","names":["object","optional","nullable","string","maxLength","_enum","CANCELLATION_FEEDBACKS","RESUBSCRIBE_INTENTS","url","refine","_default","int","gte"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  refine,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\n/** At least one origin: an empty list would refuse every return URL. */\nexport type AllowedOrigins = readonly [string, ...string[]];\n\n/**\n * Normalizes each allowed origin with `new URL()`, so `https://example.com/` and\n * `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a\n * misconfigured list must fail at startup, not let every return URL through or refuse them all.\n */\nfunction normalizeOrigins(origins: AllowedOrigins): string[] {\n  return origins.map((origin) => {\n    const parsed = new URL(origin);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new Error(`returnUrl: ${origin} is not an http(s) origin`);\n    }\n    return parsed.origin;\n  });\n}\n\n/**\n * Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)\n * send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,\n * so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),\n * protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of\n * the origin, so an https-only list refuses `http:` too.\n */\nfunction isAllowedReturnUrl(value: string, allowedOrigins: readonly string[]): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return false;\n  }\n  if (parsed.username !== '' || parsed.password !== '') return false;\n  return allowedOrigins.includes(parsed.origin);\n}\n\n/**\n * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an\n * origin check anyone could create a session with their own account and hand out a\n * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open\n * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.\n */\nexport function returnUrlSchema(allowedOrigins: AllowedOrigins) {\n  const origins = normalizeOrigins(allowedOrigins);\n  return url().check(\n    refine((value) => isAllowedReturnUrl(value, origins), {\n      message: `URL must be on ${origins.join(', ')}`,\n    })\n  );\n}\n\nexport interface CreateCheckoutSessionSchemaOptions {\n  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */\n  allowedOrigins: AllowedOrigins;\n}\n\nexport function createCheckoutSessionSchema(\n  productIds: string[],\n  { allowedOrigins }: CreateCheckoutSessionSchemaOptions\n) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(returnUrlSchema(allowedOrigins)),\n    successUrl: optional(returnUrlSchema(allowedOrigins)),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;;AAgBA,MAAa,6BAAA,GAA4BA,SAAAA,OAAAA,CAAO;CAC9C,UAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,UAAAA,CAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,WAAA,GAAUH,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAMC,2BAAAA,sBAAsB,CAAC,CAAC;CAC1D,oBAAA,GAAmBL,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAME,2BAAAA,mBAAmB,CAAC,CAAC;AAClE,CAAC;;;;;;AAUD,SAAS,iBAAiB,SAAmC;CAC3D,OAAO,QAAQ,KAAK,WAAW;EAC7B,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SACtD,MAAM,IAAI,MAAM,cAAc,OAAO,0BAA0B;EAEjE,OAAO,OAAO;CAChB,CAAC;AACH;;;;;;;;AASA,SAAS,mBAAmB,OAAe,gBAA4C;CACrF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO;CAC7D,OAAO,eAAe,SAAS,OAAO,MAAM;AAC9C;;;;;;;AAQA,SAAgB,gBAAgB,gBAAgC;CAC9D,MAAM,UAAU,iBAAiB,cAAc;CAC/C,QAAA,GAAOC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GACXC,SAAAA,OAAAA,EAAQ,UAAU,mBAAmB,OAAO,OAAO,GAAG,EACpD,SAAS,kBAAkB,QAAQ,KAAK,IAAI,IAC9C,CAAC,CACH;AACF;AAOA,SAAgB,4BACd,YACA,EAAE,kBACF;CACA,QAAA,GAAOT,SAAAA,OAAAA,CAAO;EACZ,WAAA,GAAUU,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GAAMC,SAAAA,IAAAA,CAAI,CAAC,CAAC,GAAG,CAAC;EACzC,YAAA,GAAWP,SAAAA,KAAAA,CAAM,UAAU;EAC3B,YAAA,GAAWJ,SAAAA,SAAAA,CAAS,gBAAgB,cAAc,CAAC;EACnD,aAAA,GAAYA,SAAAA,SAAAA,CAAS,gBAAgB,cAAc,CAAC;CACtD,CAAC;AACH"}

package/dist/stripe/schema.d.cts

@@ -19,7 +19,20 @@ export declare const cancellationDetailsSchema: import("zod/mini").ZodMiniObject
     yes: "yes";
   }>>>;
 }, import("zod/v4/core").$strip>;
-export declare function createCheckoutSessionSchema(productIds: string[]): import("zod/mini").ZodMiniObject<{
+/** At least one origin: an empty list would refuse every return URL. */
+export type AllowedOrigins = readonly [string, ...string[]];
+/**
+ * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+ * origin check anyone could create a session with their own account and hand out a
+ * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+ * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+ */
+export declare function returnUrlSchema(allowedOrigins: AllowedOrigins): import("zod/mini").ZodMiniURL;
+export interface CreateCheckoutSessionSchemaOptions {
+  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */
+  allowedOrigins: AllowedOrigins;
+}
+export declare function createCheckoutSessionSchema(productIds: string[], { allowedOrigins }: CreateCheckoutSessionSchemaOptions): import("zod/mini").ZodMiniObject<{
   quantity: import("zod/mini").ZodMiniDefault<import("zod/mini").ZodMiniInt>;
   productId: import("zod/mini").ZodMiniEnum<{
     [x: string]: string;

package/dist/stripe/schema.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAea,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;wBAEc,4BAA4B,0CAAoB;;;;;;;yBAO/D;iBAMgB;EACf;EACA;EACA"}
+{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAgBa,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;;YAGU;;;;;;;wBAyCI,gBAAgB,gBAAgB,oCAAc;iBAS7C;;EAEf,gBAAgB;;wBAGF,4BACd,wBACE,kBAAkB,wDAAkC;;;;;;;yBAQvD;iBAMgB;EACf;EACA;EACA"}

package/dist/stripe/schema.d.mts

@@ -19,7 +19,20 @@ export declare const cancellationDetailsSchema: import("zod/mini").ZodMiniObject
     yes: "yes";
   }>>>;
 }, import("zod/v4/core").$strip>;
-export declare function createCheckoutSessionSchema(productIds: string[]): import("zod/mini").ZodMiniObject<{
+/** At least one origin: an empty list would refuse every return URL. */
+export type AllowedOrigins = readonly [string, ...string[]];
+/**
+ * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+ * origin check anyone could create a session with their own account and hand out a
+ * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+ * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+ */
+export declare function returnUrlSchema(allowedOrigins: AllowedOrigins): import("zod/mini").ZodMiniURL;
+export interface CreateCheckoutSessionSchemaOptions {
+  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */
+  allowedOrigins: AllowedOrigins;
+}
+export declare function createCheckoutSessionSchema(productIds: string[], { allowedOrigins }: CreateCheckoutSessionSchemaOptions): import("zod/mini").ZodMiniObject<{
   quantity: import("zod/mini").ZodMiniDefault<import("zod/mini").ZodMiniInt>;
   productId: import("zod/mini").ZodMiniEnum<{
     [x: string]: string;

package/dist/stripe/schema.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAea,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;wBAEc,4BAA4B,0CAAoB;;;;;;;yBAO/D;iBAMgB;EACf;EACA;EACA"}
+{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAgBa,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;;YAGU;;;;;;;wBAyCI,gBAAgB,gBAAgB,oCAAc;iBAS7C;;EAEf,gBAAgB;;wBAGF,4BACd,wBACE,kBAAkB,wDAAkC;;;;;;;yBAQvD;iBAMgB;EACf;EACA;EACA"}

package/dist/stripe/schema.mjs

@@ -1,5 +1,5 @@
 import { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from "../subscription/index.mjs";
-import { _default, enum as enum$1, gte, int, maxLength, nullable, object, optional, string, url } from "zod/mini";
+import { _default, enum as enum$1, gte, int, maxLength, nullable, object, optional, refine, string, url } from "zod/mini";
 //#region src/stripe/schema.ts
 /** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */
 const cancellationDetailsSchema = object({
@@ -7,15 +7,54 @@ const cancellationDetailsSchema = object({
 	feedback: optional(nullable(enum$1(CANCELLATION_FEEDBACKS))),
 	resubscribeIntent: optional(nullable(enum$1(RESUBSCRIBE_INTENTS)))
 });
-function createCheckoutSessionSchema(productIds) {
+/**
+* Normalizes each allowed origin with `new URL()`, so `https://example.com/` and
+* `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a
+* misconfigured list must fail at startup, not let every return URL through or refuse them all.
+*/
+function normalizeOrigins(origins) {
+	return origins.map((origin) => {
+		const parsed = new URL(origin);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`returnUrl: ${origin} is not an http(s) origin`);
+		return parsed.origin;
+	});
+}
+/**
+* Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)
+* send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,
+* so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),
+* protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of
+* the origin, so an https-only list refuses `http:` too.
+*/
+function isAllowedReturnUrl(value, allowedOrigins) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.username !== "" || parsed.password !== "") return false;
+	return allowedOrigins.includes(parsed.origin);
+}
+/**
+* A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+* origin check anyone could create a session with their own account and hand out a
+* `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+* redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+*/
+function returnUrlSchema(allowedOrigins) {
+	const origins = normalizeOrigins(allowedOrigins);
+	return url().check(refine((value) => isAllowedReturnUrl(value, origins), { message: `URL must be on ${origins.join(", ")}` }));
+}
+function createCheckoutSessionSchema(productIds, { allowedOrigins }) {
 	return object({
 		quantity: _default(int().check(gte(1)), 1),
 		productId: enum$1(productIds),
-		cancelUrl: optional(url()),
-		successUrl: optional(url())
+		cancelUrl: optional(returnUrlSchema(allowedOrigins)),
+		successUrl: optional(returnUrlSchema(allowedOrigins))
 	});
 }
 //#endregion
-export { cancellationDetailsSchema, createCheckoutSessionSchema };
+export { cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema };
 
 //# sourceMappingURL=schema.mjs.map

package/dist/stripe/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["_enum"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\nexport function createCheckoutSessionSchema(productIds: string[]) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(url()),\n    successUrl: optional(url()),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;AAeA,MAAa,4BAA4B,OAAO;CAC9C,SAAS,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,UAAU,SAAS,SAASA,OAAM,sBAAsB,CAAC,CAAC;CAC1D,mBAAmB,SAAS,SAASA,OAAM,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,4BAA4B,YAAsB;CAChE,OAAO,OAAO;EACZ,UAAU,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;EACzC,WAAWA,OAAM,UAAU;EAC3B,WAAW,SAAS,IAAI,CAAC;EACzB,YAAY,SAAS,IAAI,CAAC;CAC5B,CAAC;AACH"}
+{"version":3,"file":"schema.mjs","names":["_enum"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  refine,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\n/** At least one origin: an empty list would refuse every return URL. */\nexport type AllowedOrigins = readonly [string, ...string[]];\n\n/**\n * Normalizes each allowed origin with `new URL()`, so `https://example.com/` and\n * `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a\n * misconfigured list must fail at startup, not let every return URL through or refuse them all.\n */\nfunction normalizeOrigins(origins: AllowedOrigins): string[] {\n  return origins.map((origin) => {\n    const parsed = new URL(origin);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new Error(`returnUrl: ${origin} is not an http(s) origin`);\n    }\n    return parsed.origin;\n  });\n}\n\n/**\n * Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)\n * send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,\n * so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),\n * protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of\n * the origin, so an https-only list refuses `http:` too.\n */\nfunction isAllowedReturnUrl(value: string, allowedOrigins: readonly string[]): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return false;\n  }\n  if (parsed.username !== '' || parsed.password !== '') return false;\n  return allowedOrigins.includes(parsed.origin);\n}\n\n/**\n * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an\n * origin check anyone could create a session with their own account and hand out a\n * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open\n * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.\n */\nexport function returnUrlSchema(allowedOrigins: AllowedOrigins) {\n  const origins = normalizeOrigins(allowedOrigins);\n  return url().check(\n    refine((value) => isAllowedReturnUrl(value, origins), {\n      message: `URL must be on ${origins.join(', ')}`,\n    })\n  );\n}\n\nexport interface CreateCheckoutSessionSchemaOptions {\n  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */\n  allowedOrigins: AllowedOrigins;\n}\n\nexport function createCheckoutSessionSchema(\n  productIds: string[],\n  { allowedOrigins }: CreateCheckoutSessionSchemaOptions\n) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(returnUrlSchema(allowedOrigins)),\n    successUrl: optional(returnUrlSchema(allowedOrigins)),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;AAgBA,MAAa,4BAA4B,OAAO;CAC9C,SAAS,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,UAAU,SAAS,SAASA,OAAM,sBAAsB,CAAC,CAAC;CAC1D,mBAAmB,SAAS,SAASA,OAAM,mBAAmB,CAAC,CAAC;AAClE,CAAC;;;;;;AAUD,SAAS,iBAAiB,SAAmC;CAC3D,OAAO,QAAQ,KAAK,WAAW;EAC7B,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SACtD,MAAM,IAAI,MAAM,cAAc,OAAO,0BAA0B;EAEjE,OAAO,OAAO;CAChB,CAAC;AACH;;;;;;;;AASA,SAAS,mBAAmB,OAAe,gBAA4C;CACrF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO;CAC7D,OAAO,eAAe,SAAS,OAAO,MAAM;AAC9C;;;;;;;AAQA,SAAgB,gBAAgB,gBAAgC;CAC9D,MAAM,UAAU,iBAAiB,cAAc;CAC/C,OAAO,IAAI,CAAC,CAAC,MACX,QAAQ,UAAU,mBAAmB,OAAO,OAAO,GAAG,EACpD,SAAS,kBAAkB,QAAQ,KAAK,IAAI,IAC9C,CAAC,CACH;AACF;AAOA,SAAgB,4BACd,YACA,EAAE,kBACF;CACA,OAAO,OAAO;EACZ,UAAU,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;EACzC,WAAWA,OAAM,UAAU;EAC3B,WAAW,SAAS,gBAAgB,cAAc,CAAC;EACnD,YAAY,SAAS,gBAAgB,cAAc,CAAC;CACtD,CAAC;AACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/purchase",
-  "version": "5.2.1",
+  "version": "6.0.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -56,7 +56,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@shware/utils": "^1.7.0",
+    "@shware/utils": "^1.8.0",
     "@types/ms": "^2.1.0",
     "ms": "^2.1.3"
   },