@shware/purchase 5.2.2 → 6.0.0

package/dist/stripe/index.cjs

@@ -26,3 +26,4 @@ exports.mapTime = require_stripe_mapper.mapTime;
 exports.minorUnits = require_stripe_mapper.minorUnits;
 exports.price = require_stripe_mapper.price;
 exports.removePendingCheckout = require_stripe_pending_checkout.removePendingCheckout;
+exports.returnUrlSchema = require_stripe_schema.returnUrlSchema;

package/dist/stripe/index.d.cts

@@ -2,8 +2,8 @@ import { CancellationDetails } from "../subscription/index.cjs";
 import { PriceId, StripeConfig, StripeMode } from "./config.cjs";
 import { StripeEventHandler } from "./handler.cjs";
 import { BeginCheckoutProperties, CheckoutSession, LineItem, PaymentStatus, Price, ProductPrice, PurchaseProperties, getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.cjs";
-import { CreateCheckoutSessionDTO, cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.cjs";
+import { AllowedOrigins, CreateCheckoutSessionDTO, CreateCheckoutSessionSchemaOptions, cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.cjs";
 import { METADATA_KEYS } from "./metadata.cjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.cjs";
 import { Stripe } from "stripe";
-export { type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { type AllowedOrigins, type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type CreateCheckoutSessionSchemaOptions, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/index.d.mts

@@ -2,8 +2,8 @@ import { CancellationDetails } from "../subscription/index.mjs";
 import { PriceId, StripeConfig, StripeMode } from "./config.mjs";
 import { StripeEventHandler } from "./handler.mjs";
 import { BeginCheckoutProperties, CheckoutSession, LineItem, PaymentStatus, Price, ProductPrice, PurchaseProperties, getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.mjs";
-import { CreateCheckoutSessionDTO, cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.mjs";
+import { AllowedOrigins, CreateCheckoutSessionDTO, CreateCheckoutSessionSchemaOptions, cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.mjs";
 import { METADATA_KEYS } from "./metadata.mjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.mjs";
 import { Stripe } from "stripe";
-export { type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { type AllowedOrigins, type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type CreateCheckoutSessionSchemaOptions, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/index.mjs

@@ -1,7 +1,7 @@
 import { StripeConfig } from "./config.mjs";
 import { StripeEventHandler } from "./handler.mjs";
 import { getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.mjs";
-import { cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.mjs";
+import { cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.mjs";
 import { METADATA_KEYS } from "./metadata.mjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.mjs";
-export { METADATA_KEYS, StripeConfig, StripeEventHandler, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { METADATA_KEYS, StripeConfig, StripeEventHandler, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/schema.cjs

@@ -8,16 +8,56 @@ const cancellationDetailsSchema = (0, zod_mini.object)({
 	feedback: (0, zod_mini.optional)((0, zod_mini.nullable)((0, zod_mini.enum)(require_subscription_index.CANCELLATION_FEEDBACKS))),
 	resubscribeIntent: (0, zod_mini.optional)((0, zod_mini.nullable)((0, zod_mini.enum)(require_subscription_index.RESUBSCRIBE_INTENTS)))
 });
-function createCheckoutSessionSchema(productIds) {
+/**
+* Normalizes each allowed origin with `new URL()`, so `https://example.com/` and
+* `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a
+* misconfigured list must fail at startup, not let every return URL through or refuse them all.
+*/
+function normalizeOrigins(origins) {
+	return origins.map((origin) => {
+		const parsed = new URL(origin);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`returnUrl: ${origin} is not an http(s) origin`);
+		return parsed.origin;
+	});
+}
+/**
+* Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)
+* send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,
+* so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),
+* protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of
+* the origin, so an https-only list refuses `http:` too.
+*/
+function isAllowedReturnUrl(value, allowedOrigins) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.username !== "" || parsed.password !== "") return false;
+	return allowedOrigins.includes(parsed.origin);
+}
+/**
+* A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+* origin check anyone could create a session with their own account and hand out a
+* `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+* redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+*/
+function returnUrlSchema(allowedOrigins) {
+	const origins = normalizeOrigins(allowedOrigins);
+	return (0, zod_mini.url)().check((0, zod_mini.refine)((value) => isAllowedReturnUrl(value, origins), { message: `URL must be on ${origins.join(", ")}` }));
+}
+function createCheckoutSessionSchema(productIds, { allowedOrigins }) {
 	return (0, zod_mini.object)({
 		quantity: (0, zod_mini._default)((0, zod_mini.int)().check((0, zod_mini.gte)(1)), 1),
 		productId: (0, zod_mini.enum)(productIds),
-		cancelUrl: (0, zod_mini.optional)((0, zod_mini.url)()),
-		successUrl: (0, zod_mini.optional)((0, zod_mini.url)())
+		cancelUrl: (0, zod_mini.optional)(returnUrlSchema(allowedOrigins)),
+		successUrl: (0, zod_mini.optional)(returnUrlSchema(allowedOrigins))
 	});
 }
 //#endregion
 exports.cancellationDetailsSchema = cancellationDetailsSchema;
 exports.createCheckoutSessionSchema = createCheckoutSessionSchema;
+exports.returnUrlSchema = returnUrlSchema;
 
 //# sourceMappingURL=schema.cjs.map

package/dist/stripe/schema.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.cjs","names":["object","optional","nullable","string","maxLength","_enum","CANCELLATION_FEEDBACKS","RESUBSCRIBE_INTENTS","_default","int","gte","url"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\nexport function createCheckoutSessionSchema(productIds: string[]) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(url()),\n    successUrl: optional(url()),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;;AAeA,MAAa,6BAAA,GAA4BA,SAAAA,OAAAA,CAAO;CAC9C,UAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,UAAAA,CAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,WAAA,GAAUH,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAMC,2BAAAA,sBAAsB,CAAC,CAAC;CAC1D,oBAAA,GAAmBL,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAME,2BAAAA,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,4BAA4B,YAAsB;CAChE,QAAA,GAAOP,SAAAA,OAAAA,CAAO;EACZ,WAAA,GAAUQ,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GAAMC,SAAAA,IAAAA,CAAI,CAAC,CAAC,GAAG,CAAC;EACzC,YAAA,GAAWL,SAAAA,KAAAA,CAAM,UAAU;EAC3B,YAAA,GAAWJ,SAAAA,SAAAA,EAAAA,GAASU,SAAAA,IAAAA,CAAI,CAAC;EACzB,aAAA,GAAYV,SAAAA,SAAAA,EAAAA,GAASU,SAAAA,IAAAA,CAAI,CAAC;CAC5B,CAAC;AACH"}
+{"version":3,"file":"schema.cjs","names":["object","optional","nullable","string","maxLength","_enum","CANCELLATION_FEEDBACKS","RESUBSCRIBE_INTENTS","url","refine","_default","int","gte"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  refine,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\n/** At least one origin: an empty list would refuse every return URL. */\nexport type AllowedOrigins = readonly [string, ...string[]];\n\n/**\n * Normalizes each allowed origin with `new URL()`, so `https://example.com/` and\n * `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a\n * misconfigured list must fail at startup, not let every return URL through or refuse them all.\n */\nfunction normalizeOrigins(origins: AllowedOrigins): string[] {\n  return origins.map((origin) => {\n    const parsed = new URL(origin);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new Error(`returnUrl: ${origin} is not an http(s) origin`);\n    }\n    return parsed.origin;\n  });\n}\n\n/**\n * Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)\n * send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,\n * so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),\n * protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of\n * the origin, so an https-only list refuses `http:` too.\n */\nfunction isAllowedReturnUrl(value: string, allowedOrigins: readonly string[]): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return false;\n  }\n  if (parsed.username !== '' || parsed.password !== '') return false;\n  return allowedOrigins.includes(parsed.origin);\n}\n\n/**\n * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an\n * origin check anyone could create a session with their own account and hand out a\n * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open\n * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.\n */\nexport function returnUrlSchema(allowedOrigins: AllowedOrigins) {\n  const origins = normalizeOrigins(allowedOrigins);\n  return url().check(\n    refine((value) => isAllowedReturnUrl(value, origins), {\n      message: `URL must be on ${origins.join(', ')}`,\n    })\n  );\n}\n\nexport interface CreateCheckoutSessionSchemaOptions {\n  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */\n  allowedOrigins: AllowedOrigins;\n}\n\nexport function createCheckoutSessionSchema(\n  productIds: string[],\n  { allowedOrigins }: CreateCheckoutSessionSchemaOptions\n) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(returnUrlSchema(allowedOrigins)),\n    successUrl: optional(returnUrlSchema(allowedOrigins)),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;;AAgBA,MAAa,6BAAA,GAA4BA,SAAAA,OAAAA,CAAO;CAC9C,UAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,UAAAA,CAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,WAAA,GAAUH,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAMC,2BAAAA,sBAAsB,CAAC,CAAC;CAC1D,oBAAA,GAAmBL,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAME,2BAAAA,mBAAmB,CAAC,CAAC;AAClE,CAAC;;;;;;AAUD,SAAS,iBAAiB,SAAmC;CAC3D,OAAO,QAAQ,KAAK,WAAW;EAC7B,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SACtD,MAAM,IAAI,MAAM,cAAc,OAAO,0BAA0B;EAEjE,OAAO,OAAO;CAChB,CAAC;AACH;;;;;;;;AASA,SAAS,mBAAmB,OAAe,gBAA4C;CACrF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO;CAC7D,OAAO,eAAe,SAAS,OAAO,MAAM;AAC9C;;;;;;;AAQA,SAAgB,gBAAgB,gBAAgC;CAC9D,MAAM,UAAU,iBAAiB,cAAc;CAC/C,QAAA,GAAOC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GACXC,SAAAA,OAAAA,EAAQ,UAAU,mBAAmB,OAAO,OAAO,GAAG,EACpD,SAAS,kBAAkB,QAAQ,KAAK,IAAI,IAC9C,CAAC,CACH;AACF;AAOA,SAAgB,4BACd,YACA,EAAE,kBACF;CACA,QAAA,GAAOT,SAAAA,OAAAA,CAAO;EACZ,WAAA,GAAUU,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GAAMC,SAAAA,IAAAA,CAAI,CAAC,CAAC,GAAG,CAAC;EACzC,YAAA,GAAWP,SAAAA,KAAAA,CAAM,UAAU;EAC3B,YAAA,GAAWJ,SAAAA,SAAAA,CAAS,gBAAgB,cAAc,CAAC;EACnD,aAAA,GAAYA,SAAAA,SAAAA,CAAS,gBAAgB,cAAc,CAAC;CACtD,CAAC;AACH"}

package/dist/stripe/schema.d.cts

@@ -19,7 +19,20 @@ export declare const cancellationDetailsSchema: import("zod/mini").ZodMiniObject
     yes: "yes";
   }>>>;
 }, import("zod/v4/core").$strip>;
-export declare function createCheckoutSessionSchema(productIds: string[]): import("zod/mini").ZodMiniObject<{
+/** At least one origin: an empty list would refuse every return URL. */
+export type AllowedOrigins = readonly [string, ...string[]];
+/**
+ * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+ * origin check anyone could create a session with their own account and hand out a
+ * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+ * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+ */
+export declare function returnUrlSchema(allowedOrigins: AllowedOrigins): import("zod/mini").ZodMiniURL;
+export interface CreateCheckoutSessionSchemaOptions {
+  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */
+  allowedOrigins: AllowedOrigins;
+}
+export declare function createCheckoutSessionSchema(productIds: string[], { allowedOrigins }: CreateCheckoutSessionSchemaOptions): import("zod/mini").ZodMiniObject<{
   quantity: import("zod/mini").ZodMiniDefault<import("zod/mini").ZodMiniInt>;
   productId: import("zod/mini").ZodMiniEnum<{
     [x: string]: string;

package/dist/stripe/schema.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAea,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;wBAEc,4BAA4B,0CAAoB;;;;;;;yBAO/D;iBAMgB;EACf;EACA;EACA"}
+{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAgBa,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;;YAGU;;;;;;;wBAyCI,gBAAgB,gBAAgB,oCAAc;iBAS7C;;EAEf,gBAAgB;;wBAGF,4BACd,wBACE,kBAAkB,wDAAkC;;;;;;;yBAQvD;iBAMgB;EACf;EACA;EACA"}

package/dist/stripe/schema.d.mts

@@ -19,7 +19,20 @@ export declare const cancellationDetailsSchema: import("zod/mini").ZodMiniObject
     yes: "yes";
   }>>>;
 }, import("zod/v4/core").$strip>;
-export declare function createCheckoutSessionSchema(productIds: string[]): import("zod/mini").ZodMiniObject<{
+/** At least one origin: an empty list would refuse every return URL. */
+export type AllowedOrigins = readonly [string, ...string[]];
+/**
+ * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+ * origin check anyone could create a session with their own account and hand out a
+ * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+ * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+ */
+export declare function returnUrlSchema(allowedOrigins: AllowedOrigins): import("zod/mini").ZodMiniURL;
+export interface CreateCheckoutSessionSchemaOptions {
+  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */
+  allowedOrigins: AllowedOrigins;
+}
+export declare function createCheckoutSessionSchema(productIds: string[], { allowedOrigins }: CreateCheckoutSessionSchemaOptions): import("zod/mini").ZodMiniObject<{
   quantity: import("zod/mini").ZodMiniDefault<import("zod/mini").ZodMiniInt>;
   productId: import("zod/mini").ZodMiniEnum<{
     [x: string]: string;

package/dist/stripe/schema.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAea,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;wBAEc,4BAA4B,0CAAoB;;;;;;;yBAO/D;iBAMgB;EACf;EACA;EACA"}
+{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAgBa,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;;YAGU;;;;;;;wBAyCI,gBAAgB,gBAAgB,oCAAc;iBAS7C;;EAEf,gBAAgB;;wBAGF,4BACd,wBACE,kBAAkB,wDAAkC;;;;;;;yBAQvD;iBAMgB;EACf;EACA;EACA"}

package/dist/stripe/schema.mjs

@@ -1,5 +1,5 @@
 import { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from "../subscription/index.mjs";
-import { _default, enum as enum$1, gte, int, maxLength, nullable, object, optional, string, url } from "zod/mini";
+import { _default, enum as enum$1, gte, int, maxLength, nullable, object, optional, refine, string, url } from "zod/mini";
 //#region src/stripe/schema.ts
 /** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */
 const cancellationDetailsSchema = object({
@@ -7,15 +7,54 @@ const cancellationDetailsSchema = object({
 	feedback: optional(nullable(enum$1(CANCELLATION_FEEDBACKS))),
 	resubscribeIntent: optional(nullable(enum$1(RESUBSCRIBE_INTENTS)))
 });
-function createCheckoutSessionSchema(productIds) {
+/**
+* Normalizes each allowed origin with `new URL()`, so `https://example.com/` and
+* `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a
+* misconfigured list must fail at startup, not let every return URL through or refuse them all.
+*/
+function normalizeOrigins(origins) {
+	return origins.map((origin) => {
+		const parsed = new URL(origin);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`returnUrl: ${origin} is not an http(s) origin`);
+		return parsed.origin;
+	});
+}
+/**
+* Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)
+* send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,
+* so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),
+* protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of
+* the origin, so an https-only list refuses `http:` too.
+*/
+function isAllowedReturnUrl(value, allowedOrigins) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.username !== "" || parsed.password !== "") return false;
+	return allowedOrigins.includes(parsed.origin);
+}
+/**
+* A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+* origin check anyone could create a session with their own account and hand out a
+* `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+* redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+*/
+function returnUrlSchema(allowedOrigins) {
+	const origins = normalizeOrigins(allowedOrigins);
+	return url().check(refine((value) => isAllowedReturnUrl(value, origins), { message: `URL must be on ${origins.join(", ")}` }));
+}
+function createCheckoutSessionSchema(productIds, { allowedOrigins }) {
 	return object({
 		quantity: _default(int().check(gte(1)), 1),
 		productId: enum$1(productIds),
-		cancelUrl: optional(url()),
-		successUrl: optional(url())
+		cancelUrl: optional(returnUrlSchema(allowedOrigins)),
+		successUrl: optional(returnUrlSchema(allowedOrigins))
 	});
 }
 //#endregion
-export { cancellationDetailsSchema, createCheckoutSessionSchema };
+export { cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema };
 
 //# sourceMappingURL=schema.mjs.map

package/dist/stripe/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["_enum"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\nexport function createCheckoutSessionSchema(productIds: string[]) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(url()),\n    successUrl: optional(url()),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;AAeA,MAAa,4BAA4B,OAAO;CAC9C,SAAS,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,UAAU,SAAS,SAASA,OAAM,sBAAsB,CAAC,CAAC;CAC1D,mBAAmB,SAAS,SAASA,OAAM,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,4BAA4B,YAAsB;CAChE,OAAO,OAAO;EACZ,UAAU,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;EACzC,WAAWA,OAAM,UAAU;EAC3B,WAAW,SAAS,IAAI,CAAC;EACzB,YAAY,SAAS,IAAI,CAAC;CAC5B,CAAC;AACH"}
+{"version":3,"file":"schema.mjs","names":["_enum"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  refine,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\n/** At least one origin: an empty list would refuse every return URL. */\nexport type AllowedOrigins = readonly [string, ...string[]];\n\n/**\n * Normalizes each allowed origin with `new URL()`, so `https://example.com/` and\n * `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a\n * misconfigured list must fail at startup, not let every return URL through or refuse them all.\n */\nfunction normalizeOrigins(origins: AllowedOrigins): string[] {\n  return origins.map((origin) => {\n    const parsed = new URL(origin);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new Error(`returnUrl: ${origin} is not an http(s) origin`);\n    }\n    return parsed.origin;\n  });\n}\n\n/**\n * Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)\n * send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,\n * so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),\n * protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of\n * the origin, so an https-only list refuses `http:` too.\n */\nfunction isAllowedReturnUrl(value: string, allowedOrigins: readonly string[]): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return false;\n  }\n  if (parsed.username !== '' || parsed.password !== '') return false;\n  return allowedOrigins.includes(parsed.origin);\n}\n\n/**\n * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an\n * origin check anyone could create a session with their own account and hand out a\n * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open\n * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.\n */\nexport function returnUrlSchema(allowedOrigins: AllowedOrigins) {\n  const origins = normalizeOrigins(allowedOrigins);\n  return url().check(\n    refine((value) => isAllowedReturnUrl(value, origins), {\n      message: `URL must be on ${origins.join(', ')}`,\n    })\n  );\n}\n\nexport interface CreateCheckoutSessionSchemaOptions {\n  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */\n  allowedOrigins: AllowedOrigins;\n}\n\nexport function createCheckoutSessionSchema(\n  productIds: string[],\n  { allowedOrigins }: CreateCheckoutSessionSchemaOptions\n) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(returnUrlSchema(allowedOrigins)),\n    successUrl: optional(returnUrlSchema(allowedOrigins)),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;AAgBA,MAAa,4BAA4B,OAAO;CAC9C,SAAS,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,UAAU,SAAS,SAASA,OAAM,sBAAsB,CAAC,CAAC;CAC1D,mBAAmB,SAAS,SAASA,OAAM,mBAAmB,CAAC,CAAC;AAClE,CAAC;;;;;;AAUD,SAAS,iBAAiB,SAAmC;CAC3D,OAAO,QAAQ,KAAK,WAAW;EAC7B,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SACtD,MAAM,IAAI,MAAM,cAAc,OAAO,0BAA0B;EAEjE,OAAO,OAAO;CAChB,CAAC;AACH;;;;;;;;AASA,SAAS,mBAAmB,OAAe,gBAA4C;CACrF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO;CAC7D,OAAO,eAAe,SAAS,OAAO,MAAM;AAC9C;;;;;;;AAQA,SAAgB,gBAAgB,gBAAgC;CAC9D,MAAM,UAAU,iBAAiB,cAAc;CAC/C,OAAO,IAAI,CAAC,CAAC,MACX,QAAQ,UAAU,mBAAmB,OAAO,OAAO,GAAG,EACpD,SAAS,kBAAkB,QAAQ,KAAK,IAAI,IAC9C,CAAC,CACH;AACF;AAOA,SAAgB,4BACd,YACA,EAAE,kBACF;CACA,OAAO,OAAO;EACZ,UAAU,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;EACzC,WAAWA,OAAM,UAAU;EAC3B,WAAW,SAAS,gBAAgB,cAAc,CAAC;EACnD,YAAY,SAAS,gBAAgB,cAAc,CAAC;CACtD,CAAC;AACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/purchase",
-  "version": "5.2.2",
+  "version": "6.0.0",
   "private": false,
   "repository": {
     "type": "git",