@shware/purchase 5.2.2 → 7.0.0

package/README.md

@@ -12,18 +12,18 @@ signatures and calling store APIs stays in your app, with the official SDKs.
 ```sh
 pnpm add @shware/purchase zod
 # optional peers, only for the subpaths you use
-pnpm add stripe                            # @shware/purchase/stripe (^22.6.2 || ^23.0.0)
+pnpm add stripe                            # @shware/purchase/stripe (^23.0.0)
 pnpm add @apple/app-store-server-library   # @shware/purchase/app-store (^3.1.0)
 ```
 
 ## Entry points
 
-| Import path                    | Contents                                                                                                                     |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
-| `@shware/purchase`             | Subscription model (`PLATFORMS`, `SUBSCRIPTION_STATUSES`, `AVAILABLE_STATUSES`, cancellation types) and the three configs    |
-| `@shware/purchase/stripe`      | `StripeEventHandler`, Stripe mappers, checkout schemas, `METADATA_KEYS`, analytics helpers, browser pending-checkout helpers |
-| `@shware/purchase/app-store`   | `AppStoreNotificationHandler` for App Store Server Notifications V2, `mapCancellationDetails`                                |
-| `@shware/purchase/google-play` | Real-time developer notification (RTDN) types and enums, subscription state and cancellation mappers                         |
+| Import path                    | Contents                                                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `@shware/purchase`             | Subscription model (`PLATFORMS`, `SUBSCRIPTION_STATUSES`, `AVAILABLE_STATUSES`, cancellation types) and the three configs                              |
+| `@shware/purchase/stripe`      | `StripeThinEventHandler`, `StripeEventHandler`, Stripe mappers, checkout schemas, `METADATA_KEYS`, analytics helpers, browser pending-checkout helpers |
+| `@shware/purchase/app-store`   | `AppStoreNotificationHandler` for App Store Server Notifications V2, `mapCancellationDetails`                                                          |
+| `@shware/purchase/google-play` | Real-time developer notification (RTDN) types and enums, subscription state and cancellation mappers                                                   |
 
 ## Subscription model
 
@@ -131,14 +131,38 @@ so existing subscribers keep resolving.
 
 ### Webhooks
 
-Verify the signature with the Stripe SDK, then dispatch with `StripeEventHandler`. `on` is typed
-per event, so each handler receives the right `event.data.object`; `process` throws for an event
-type with no handler.
+Two dispatchers, one per Stripe [event format](https://docs.stripe.com/events/how-events-work#event-formats).
+Both are typed per event type, run every handler registered for a type, and throw from `process`
+for a type with no handler.
+
+| Handler                  | Event format | Verify with                                | Handlers receive                         |
+| ------------------------ | ------------ | ------------------------------------------ | ---------------------------------------- |
+| `StripeThinEventHandler` | thin         | `stripe.parseEventNotificationAsync(...)`  | the typed notification (`v1.*` types)    |
+| `StripeEventHandler`     | snapshot     | `stripe.webhooks.constructEventAsync(...)` | `event.data.object` for the event's type |
+
+Which to use: Stripe recommends thin events for new integrations, and so do we. Use snapshot
+events when you need the full payload as it was when the event fired, or
+`data.previous_attributes`.
+
+#### Thin events (recommended)
+
+A thin event only says which object changed (`type`, `id`, `created`, `reason`, `related_object`),
+so each handler reads current state from Stripe with `notification.fetchRelatedObject()` (or the
+full event with `fetchEvent()`). The SDK never pre-fetches: some handlers only need
+`related_object.id`. `on` is keyed by thin event type (`v1.customer.subscription.updated`, ...),
+so `fetchRelatedObject()` resolves to the right Stripe object. Delivery order carries no meaning:
+re-read state instead of applying payloads in order, and dedupe one-off facts (credits, payments,
+refunds) with idempotency keys. `StripeThinEventNotificationOf<T>` types a handler shared across
+several types.
+
+Create the event destination with the thin payload style and the `v1.*` types you handle. A
+Cloudflare Workers route with Hono (`parseEventNotificationAsync` uses Web Crypto there):
 
 ```ts
 import {
   METADATA_KEYS,
-  StripeEventHandler,
+  StripeThinEventHandler,
+  type StripeThinEventNotificationOf,
   mapCancellationDetails,
   mapSubscriptionStatus,
   mapTime,
@@ -147,23 +171,31 @@ import Stripe from 'stripe';
 
 const stripe = new Stripe(env.STRIPE_SECRET_KEY);
 
-export async function processStripeEvent(signature: string, body: string) {
-  const event = await stripe.webhooks.constructEventAsync(
-    body,
-    signature,
+const handler = StripeThinEventHandler.create()
+  .on('v1.checkout.session.completed', handleCheckoutSessionCompleted)
+  .on('v1.invoice.paid', handleInvoicePaid)
+  .on('v1.customer.subscription.created', handleSubscriptionEvent)
+  .on('v1.customer.subscription.updated', handleSubscriptionEvent)
+  .on('v1.customer.subscription.deleted', handleSubscriptionEvent);
+
+app.post('/webhooks/stripe', async (c) => {
+  const notification = await stripe.parseEventNotificationAsync(
+    await c.req.text(),
+    c.req.header('stripe-signature') ?? '',
     env.STRIPE_WEBHOOK_SECRET
   );
-
-  await StripeEventHandler.create()
-    .on('checkout.session.completed', handleCheckoutSessionCompleted)
-    .on('invoice.payment_succeeded', handleInvoicePaymentSucceeded)
-    .on('customer.subscription.created', handleSubscriptionEvent)
-    .on('customer.subscription.updated', handleSubscriptionEvent)
-    .on('customer.subscription.deleted', handleSubscriptionEvent)
-    .process(event);
-}
-
-async function handleSubscriptionEvent(sub: Stripe.Subscription) {
+  await handler.process(notification);
+  return c.body(null, 204);
+});
+
+async function handleSubscriptionEvent(
+  notification: StripeThinEventNotificationOf<
+    | 'v1.customer.subscription.created'
+    | 'v1.customer.subscription.updated'
+    | 'v1.customer.subscription.deleted'
+  >
+) {
+  const sub = await notification.fetchRelatedObject(); // Stripe.Subscription, current state
   const userId = sub.metadata[METADATA_KEYS.USER_ID];
   const productId = sub.metadata[METADATA_KEYS.PRODUCT_ID];
   await saveSubscription({
@@ -178,6 +210,41 @@ async function handleSubscriptionEvent(sub: Stripe.Subscription) {
 }
 ```
 
+#### Snapshot events
+
+`on` is keyed by snapshot event type (`customer.subscription.updated`, ...) and each handler
+receives that event's `data.object`, typed.
+
+```ts
+import { StripeEventHandler } from '@shware/purchase/stripe';
+
+export async function processStripeEvent(signature: string, body: string) {
+  const event = await stripe.webhooks.constructEventAsync(
+    body,
+    signature,
+    env.STRIPE_WEBHOOK_SECRET
+  );
+
+  await StripeEventHandler.create()
+    .on('invoice.payment_succeeded', handleInvoicePaymentSucceeded) // (invoice: Stripe.Invoice)
+    .on('customer.subscription.updated', handleSubscription) // (sub: Stripe.Subscription)
+    .process(event);
+}
+```
+
+#### Moving from snapshot to thin events
+
+- Switch the event destination to the thin payload style; `parseEventNotificationAsync` rejects
+  snapshot payloads.
+- Replace `constructEventAsync` with `parseEventNotificationAsync` and `StripeEventHandler` with
+  `StripeThinEventHandler`.
+- Prefix every `on` type with `v1.` (`invoice.paid` becomes `v1.invoice.paid`).
+- Handlers receive the notification instead of `event.data.object`: call
+  `await notification.fetchRelatedObject()`, or use `notification.related_object.id` when the id
+  is enough. The fetched object is current state, so handlers must not depend on delivery order.
+- The mappers (`mapSubscriptionStatus`, `mapInvoice`, `mapCancellationDetails`, ...) take the
+  fetched objects unchanged.
+
 ### Checkout
 
 `createCheckoutSessionSchema(productIds)` is a `zod/mini` schema for the create-checkout request

package/dist/stripe/index.cjs

@@ -2,12 +2,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_stripe_config = require("./config.cjs");
 const require_stripe_handler = require("./handler.cjs");
 const require_stripe_mapper = require("./mapper.cjs");
+const require_stripe_thin_handler = require("./thin-handler.cjs");
 const require_stripe_schema = require("./schema.cjs");
 const require_stripe_metadata = require("./metadata.cjs");
 const require_stripe_pending_checkout = require("./pending-checkout.cjs");
 exports.METADATA_KEYS = require_stripe_metadata.METADATA_KEYS;
 exports.StripeConfig = require_stripe_config.StripeConfig;
 exports.StripeEventHandler = require_stripe_handler.StripeEventHandler;
+exports.StripeThinEventHandler = require_stripe_thin_handler.StripeThinEventHandler;
 exports.addPendingCheckout = require_stripe_pending_checkout.addPendingCheckout;
 exports.cancellationDetailsSchema = require_stripe_schema.cancellationDetailsSchema;
 exports.createCheckoutSessionSchema = require_stripe_schema.createCheckoutSessionSchema;
@@ -26,3 +28,4 @@ exports.mapTime = require_stripe_mapper.mapTime;
 exports.minorUnits = require_stripe_mapper.minorUnits;
 exports.price = require_stripe_mapper.price;
 exports.removePendingCheckout = require_stripe_pending_checkout.removePendingCheckout;
+exports.returnUrlSchema = require_stripe_schema.returnUrlSchema;

package/dist/stripe/index.d.cts

@@ -2,8 +2,9 @@ import { CancellationDetails } from "../subscription/index.cjs";
 import { PriceId, StripeConfig, StripeMode } from "./config.cjs";
 import { StripeEventHandler } from "./handler.cjs";
 import { BeginCheckoutProperties, CheckoutSession, LineItem, PaymentStatus, Price, ProductPrice, PurchaseProperties, getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.cjs";
-import { CreateCheckoutSessionDTO, cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.cjs";
+import { StripeThinEventHandler, StripeThinEventNotificationOf, StripeThinEventType } from "./thin-handler.cjs";
+import { AllowedOrigins, CreateCheckoutSessionDTO, CreateCheckoutSessionSchemaOptions, cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.cjs";
 import { METADATA_KEYS } from "./metadata.cjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.cjs";
 import { Stripe } from "stripe";
-export { type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { type AllowedOrigins, type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type CreateCheckoutSessionSchemaOptions, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, StripeThinEventHandler, type StripeThinEventNotificationOf, type StripeThinEventType, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/index.d.mts

@@ -2,8 +2,9 @@ import { CancellationDetails } from "../subscription/index.mjs";
 import { PriceId, StripeConfig, StripeMode } from "./config.mjs";
 import { StripeEventHandler } from "./handler.mjs";
 import { BeginCheckoutProperties, CheckoutSession, LineItem, PaymentStatus, Price, ProductPrice, PurchaseProperties, getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.mjs";
-import { CreateCheckoutSessionDTO, cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.mjs";
+import { StripeThinEventHandler, StripeThinEventNotificationOf, StripeThinEventType } from "./thin-handler.mjs";
+import { AllowedOrigins, CreateCheckoutSessionDTO, CreateCheckoutSessionSchemaOptions, cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.mjs";
 import { METADATA_KEYS } from "./metadata.mjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.mjs";
 import { Stripe } from "stripe";
-export { type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { type AllowedOrigins, type BeginCheckoutProperties, type CancellationDetails, type CheckoutSession, type CreateCheckoutSessionDTO, type CreateCheckoutSessionSchemaOptions, type LineItem, METADATA_KEYS, type PaymentStatus, type Price, type PriceId, type ProductPrice, type PurchaseProperties, type Stripe, StripeConfig, StripeEventHandler, type StripeMode, StripeThinEventHandler, type StripeThinEventNotificationOf, type StripeThinEventType, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/index.mjs

@@ -1,7 +1,8 @@
 import { StripeConfig } from "./config.mjs";
 import { StripeEventHandler } from "./handler.mjs";
 import { getBeginCheckoutProperties, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price } from "./mapper.mjs";
-import { cancellationDetailsSchema, createCheckoutSessionSchema } from "./schema.mjs";
+import { StripeThinEventHandler } from "./thin-handler.mjs";
+import { cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema } from "./schema.mjs";
 import { METADATA_KEYS } from "./metadata.mjs";
 import { addPendingCheckout, getPendingCheckouts, removePendingCheckout } from "./pending-checkout.mjs";
-export { METADATA_KEYS, StripeConfig, StripeEventHandler, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout };
+export { METADATA_KEYS, StripeConfig, StripeEventHandler, StripeThinEventHandler, addPendingCheckout, cancellationDetailsSchema, createCheckoutSessionSchema, getBeginCheckoutProperties, getPendingCheckouts, getPurchaseProperties, mapCancellationDetails, mapCharge, mapCheckoutSession, mapInvoice, mapLineItem, mapPaymentIntent, mapPrice, mapSubscriptionStatus, mapTime, minorUnits, price, removePendingCheckout, returnUrlSchema };

package/dist/stripe/schema.cjs

@@ -8,16 +8,56 @@ const cancellationDetailsSchema = (0, zod_mini.object)({
 	feedback: (0, zod_mini.optional)((0, zod_mini.nullable)((0, zod_mini.enum)(require_subscription_index.CANCELLATION_FEEDBACKS))),
 	resubscribeIntent: (0, zod_mini.optional)((0, zod_mini.nullable)((0, zod_mini.enum)(require_subscription_index.RESUBSCRIBE_INTENTS)))
 });
-function createCheckoutSessionSchema(productIds) {
+/**
+* Normalizes each allowed origin with `new URL()`, so `https://example.com/` and
+* `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a
+* misconfigured list must fail at startup, not let every return URL through or refuse them all.
+*/
+function normalizeOrigins(origins) {
+	return origins.map((origin) => {
+		const parsed = new URL(origin);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`returnUrl: ${origin} is not an http(s) origin`);
+		return parsed.origin;
+	});
+}
+/**
+* Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)
+* send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,
+* so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),
+* protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of
+* the origin, so an https-only list refuses `http:` too.
+*/
+function isAllowedReturnUrl(value, allowedOrigins) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.username !== "" || parsed.password !== "") return false;
+	return allowedOrigins.includes(parsed.origin);
+}
+/**
+* A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+* origin check anyone could create a session with their own account and hand out a
+* `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+* redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+*/
+function returnUrlSchema(allowedOrigins) {
+	const origins = normalizeOrigins(allowedOrigins);
+	return (0, zod_mini.url)().check((0, zod_mini.refine)((value) => isAllowedReturnUrl(value, origins), { message: `URL must be on ${origins.join(", ")}` }));
+}
+function createCheckoutSessionSchema(productIds, { allowedOrigins }) {
 	return (0, zod_mini.object)({
 		quantity: (0, zod_mini._default)((0, zod_mini.int)().check((0, zod_mini.gte)(1)), 1),
 		productId: (0, zod_mini.enum)(productIds),
-		cancelUrl: (0, zod_mini.optional)((0, zod_mini.url)()),
-		successUrl: (0, zod_mini.optional)((0, zod_mini.url)())
+		cancelUrl: (0, zod_mini.optional)(returnUrlSchema(allowedOrigins)),
+		successUrl: (0, zod_mini.optional)(returnUrlSchema(allowedOrigins))
 	});
 }
 //#endregion
 exports.cancellationDetailsSchema = cancellationDetailsSchema;
 exports.createCheckoutSessionSchema = createCheckoutSessionSchema;
+exports.returnUrlSchema = returnUrlSchema;
 
 //# sourceMappingURL=schema.cjs.map

package/dist/stripe/schema.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.cjs","names":["object","optional","nullable","string","maxLength","_enum","CANCELLATION_FEEDBACKS","RESUBSCRIBE_INTENTS","_default","int","gte","url"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\nexport function createCheckoutSessionSchema(productIds: string[]) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(url()),\n    successUrl: optional(url()),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;;AAeA,MAAa,6BAAA,GAA4BA,SAAAA,OAAAA,CAAO;CAC9C,UAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,UAAAA,CAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,WAAA,GAAUH,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAMC,2BAAAA,sBAAsB,CAAC,CAAC;CAC1D,oBAAA,GAAmBL,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAME,2BAAAA,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,4BAA4B,YAAsB;CAChE,QAAA,GAAOP,SAAAA,OAAAA,CAAO;EACZ,WAAA,GAAUQ,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GAAMC,SAAAA,IAAAA,CAAI,CAAC,CAAC,GAAG,CAAC;EACzC,YAAA,GAAWL,SAAAA,KAAAA,CAAM,UAAU;EAC3B,YAAA,GAAWJ,SAAAA,SAAAA,EAAAA,GAASU,SAAAA,IAAAA,CAAI,CAAC;EACzB,aAAA,GAAYV,SAAAA,SAAAA,EAAAA,GAASU,SAAAA,IAAAA,CAAI,CAAC;CAC5B,CAAC;AACH"}
+{"version":3,"file":"schema.cjs","names":["object","optional","nullable","string","maxLength","_enum","CANCELLATION_FEEDBACKS","RESUBSCRIBE_INTENTS","url","refine","_default","int","gte"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  refine,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\n/** At least one origin: an empty list would refuse every return URL. */\nexport type AllowedOrigins = readonly [string, ...string[]];\n\n/**\n * Normalizes each allowed origin with `new URL()`, so `https://example.com/` and\n * `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a\n * misconfigured list must fail at startup, not let every return URL through or refuse them all.\n */\nfunction normalizeOrigins(origins: AllowedOrigins): string[] {\n  return origins.map((origin) => {\n    const parsed = new URL(origin);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new Error(`returnUrl: ${origin} is not an http(s) origin`);\n    }\n    return parsed.origin;\n  });\n}\n\n/**\n * Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)\n * send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,\n * so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),\n * protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of\n * the origin, so an https-only list refuses `http:` too.\n */\nfunction isAllowedReturnUrl(value: string, allowedOrigins: readonly string[]): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return false;\n  }\n  if (parsed.username !== '' || parsed.password !== '') return false;\n  return allowedOrigins.includes(parsed.origin);\n}\n\n/**\n * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an\n * origin check anyone could create a session with their own account and hand out a\n * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open\n * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.\n */\nexport function returnUrlSchema(allowedOrigins: AllowedOrigins) {\n  const origins = normalizeOrigins(allowedOrigins);\n  return url().check(\n    refine((value) => isAllowedReturnUrl(value, origins), {\n      message: `URL must be on ${origins.join(', ')}`,\n    })\n  );\n}\n\nexport interface CreateCheckoutSessionSchemaOptions {\n  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */\n  allowedOrigins: AllowedOrigins;\n}\n\nexport function createCheckoutSessionSchema(\n  productIds: string[],\n  { allowedOrigins }: CreateCheckoutSessionSchemaOptions\n) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(returnUrlSchema(allowedOrigins)),\n    successUrl: optional(returnUrlSchema(allowedOrigins)),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;;AAgBA,MAAa,6BAAA,GAA4BA,SAAAA,OAAAA,CAAO;CAC9C,UAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,UAAAA,CAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,WAAA,GAAUH,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAMC,2BAAAA,sBAAsB,CAAC,CAAC;CAC1D,oBAAA,GAAmBL,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,SAAAA,EAAAA,GAASG,SAAAA,KAAAA,CAAME,2BAAAA,mBAAmB,CAAC,CAAC;AAClE,CAAC;;;;;;AAUD,SAAS,iBAAiB,SAAmC;CAC3D,OAAO,QAAQ,KAAK,WAAW;EAC7B,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SACtD,MAAM,IAAI,MAAM,cAAc,OAAO,0BAA0B;EAEjE,OAAO,OAAO;CAChB,CAAC;AACH;;;;;;;;AASA,SAAS,mBAAmB,OAAe,gBAA4C;CACrF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO;CAC7D,OAAO,eAAe,SAAS,OAAO,MAAM;AAC9C;;;;;;;AAQA,SAAgB,gBAAgB,gBAAgC;CAC9D,MAAM,UAAU,iBAAiB,cAAc;CAC/C,QAAA,GAAOC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GACXC,SAAAA,OAAAA,EAAQ,UAAU,mBAAmB,OAAO,OAAO,GAAG,EACpD,SAAS,kBAAkB,QAAQ,KAAK,IAAI,IAC9C,CAAC,CACH;AACF;AAOA,SAAgB,4BACd,YACA,EAAE,kBACF;CACA,QAAA,GAAOT,SAAAA,OAAAA,CAAO;EACZ,WAAA,GAAUU,SAAAA,SAAAA,EAAAA,GAASC,SAAAA,IAAAA,CAAI,CAAC,CAAC,OAAA,GAAMC,SAAAA,IAAAA,CAAI,CAAC,CAAC,GAAG,CAAC;EACzC,YAAA,GAAWP,SAAAA,KAAAA,CAAM,UAAU;EAC3B,YAAA,GAAWJ,SAAAA,SAAAA,CAAS,gBAAgB,cAAc,CAAC;EACnD,aAAA,GAAYA,SAAAA,SAAAA,CAAS,gBAAgB,cAAc,CAAC;CACtD,CAAC;AACH"}

package/dist/stripe/schema.d.cts

@@ -19,7 +19,20 @@ export declare const cancellationDetailsSchema: import("zod/mini").ZodMiniObject
     yes: "yes";
   }>>>;
 }, import("zod/v4/core").$strip>;
-export declare function createCheckoutSessionSchema(productIds: string[]): import("zod/mini").ZodMiniObject<{
+/** At least one origin: an empty list would refuse every return URL. */
+export type AllowedOrigins = readonly [string, ...string[]];
+/**
+ * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+ * origin check anyone could create a session with their own account and hand out a
+ * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+ * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+ */
+export declare function returnUrlSchema(allowedOrigins: AllowedOrigins): import("zod/mini").ZodMiniURL;
+export interface CreateCheckoutSessionSchemaOptions {
+  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */
+  allowedOrigins: AllowedOrigins;
+}
+export declare function createCheckoutSessionSchema(productIds: string[], { allowedOrigins }: CreateCheckoutSessionSchemaOptions): import("zod/mini").ZodMiniObject<{
   quantity: import("zod/mini").ZodMiniDefault<import("zod/mini").ZodMiniInt>;
   productId: import("zod/mini").ZodMiniEnum<{
     [x: string]: string;

package/dist/stripe/schema.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAea,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;wBAEc,4BAA4B,0CAAoB;;;;;;;yBAO/D;iBAMgB;EACf;EACA;EACA"}
+{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAgBa,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;;YAGU;;;;;;;wBAyCI,gBAAgB,gBAAgB,oCAAc;iBAS7C;;EAEf,gBAAgB;;wBAGF,4BACd,wBACE,kBAAkB,wDAAkC;;;;;;;yBAQvD;iBAMgB;EACf;EACA;EACA"}

package/dist/stripe/schema.d.mts

@@ -19,7 +19,20 @@ export declare const cancellationDetailsSchema: import("zod/mini").ZodMiniObject
     yes: "yes";
   }>>>;
 }, import("zod/v4/core").$strip>;
-export declare function createCheckoutSessionSchema(productIds: string[]): import("zod/mini").ZodMiniObject<{
+/** At least one origin: an empty list would refuse every return URL. */
+export type AllowedOrigins = readonly [string, ...string[]];
+/**
+ * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+ * origin check anyone could create a session with their own account and hand out a
+ * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+ * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+ */
+export declare function returnUrlSchema(allowedOrigins: AllowedOrigins): import("zod/mini").ZodMiniURL;
+export interface CreateCheckoutSessionSchemaOptions {
+  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */
+  allowedOrigins: AllowedOrigins;
+}
+export declare function createCheckoutSessionSchema(productIds: string[], { allowedOrigins }: CreateCheckoutSessionSchemaOptions): import("zod/mini").ZodMiniObject<{
   quantity: import("zod/mini").ZodMiniDefault<import("zod/mini").ZodMiniInt>;
   productId: import("zod/mini").ZodMiniEnum<{
     [x: string]: string;

package/dist/stripe/schema.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAea,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;wBAEc,4BAA4B,0CAAoB;;;;;;;yBAO/D;iBAMgB;EACf;EACA;EACA"}
+{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/stripe/schema.ts"],"mappings":";;;qBAgBa,8CAAyB;;;;;;;;;;;;;;;;;yBAIpC;;YAGU;;;;;;;wBAyCI,gBAAgB,gBAAgB,oCAAc;iBAS7C;;EAEf,gBAAgB;;wBAGF,4BACd,wBACE,kBAAkB,wDAAkC;;;;;;;yBAQvD;iBAMgB;EACf;EACA;EACA"}

package/dist/stripe/schema.mjs

@@ -1,5 +1,5 @@
 import { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from "../subscription/index.mjs";
-import { _default, enum as enum$1, gte, int, maxLength, nullable, object, optional, string, url } from "zod/mini";
+import { _default, enum as enum$1, gte, int, maxLength, nullable, object, optional, refine, string, url } from "zod/mini";
 //#region src/stripe/schema.ts
 /** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */
 const cancellationDetailsSchema = object({
@@ -7,15 +7,54 @@ const cancellationDetailsSchema = object({
 	feedback: optional(nullable(enum$1(CANCELLATION_FEEDBACKS))),
 	resubscribeIntent: optional(nullable(enum$1(RESUBSCRIBE_INTENTS)))
 });
-function createCheckoutSessionSchema(productIds) {
+/**
+* Normalizes each allowed origin with `new URL()`, so `https://example.com/` and
+* `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a
+* misconfigured list must fail at startup, not let every return URL through or refuse them all.
+*/
+function normalizeOrigins(origins) {
+	return origins.map((origin) => {
+		const parsed = new URL(origin);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`returnUrl: ${origin} is not an http(s) origin`);
+		return parsed.origin;
+	});
+}
+/**
+* Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)
+* send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,
+* so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),
+* protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of
+* the origin, so an https-only list refuses `http:` too.
+*/
+function isAllowedReturnUrl(value, allowedOrigins) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.username !== "" || parsed.password !== "") return false;
+	return allowedOrigins.includes(parsed.origin);
+}
+/**
+* A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an
+* origin check anyone could create a session with their own account and hand out a
+* `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open
+* redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.
+*/
+function returnUrlSchema(allowedOrigins) {
+	const origins = normalizeOrigins(allowedOrigins);
+	return url().check(refine((value) => isAllowedReturnUrl(value, origins), { message: `URL must be on ${origins.join(", ")}` }));
+}
+function createCheckoutSessionSchema(productIds, { allowedOrigins }) {
 	return object({
 		quantity: _default(int().check(gte(1)), 1),
 		productId: enum$1(productIds),
-		cancelUrl: optional(url()),
-		successUrl: optional(url())
+		cancelUrl: optional(returnUrlSchema(allowedOrigins)),
+		successUrl: optional(returnUrlSchema(allowedOrigins))
 	});
 }
 //#endregion
-export { cancellationDetailsSchema, createCheckoutSessionSchema };
+export { cancellationDetailsSchema, createCheckoutSessionSchema, returnUrlSchema };
 
 //# sourceMappingURL=schema.mjs.map

package/dist/stripe/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["_enum"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\nexport function createCheckoutSessionSchema(productIds: string[]) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(url()),\n    successUrl: optional(url()),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;AAeA,MAAa,4BAA4B,OAAO;CAC9C,SAAS,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,UAAU,SAAS,SAASA,OAAM,sBAAsB,CAAC,CAAC;CAC1D,mBAAmB,SAAS,SAASA,OAAM,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,4BAA4B,YAAsB;CAChE,OAAO,OAAO;EACZ,UAAU,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;EACzC,WAAWA,OAAM,UAAU;EAC3B,WAAW,SAAS,IAAI,CAAC;EACzB,YAAY,SAAS,IAAI,CAAC;CAC5B,CAAC;AACH"}
+{"version":3,"file":"schema.mjs","names":["_enum"],"sources":["../../src/stripe/schema.ts"],"sourcesContent":["import {\n  _default,\n  enum as _enum,\n  gte,\n  int,\n  maxLength,\n  nullable,\n  object,\n  optional,\n  refine,\n  string,\n  url,\n} from 'zod/mini';\nimport { CANCELLATION_FEEDBACKS, RESUBSCRIBE_INTENTS } from '../subscription/index';\n\n/** What our own cancel dialog may send along with a cancellation (see `CancellationDetails`). */\nexport const cancellationDetailsSchema = object({\n  comment: optional(nullable(string().check(maxLength(1024)))),\n  feedback: optional(nullable(_enum(CANCELLATION_FEEDBACKS))),\n  resubscribeIntent: optional(nullable(_enum(RESUBSCRIBE_INTENTS))),\n});\n\n/** At least one origin: an empty list would refuse every return URL. */\nexport type AllowedOrigins = readonly [string, ...string[]];\n\n/**\n * Normalizes each allowed origin with `new URL()`, so `https://example.com/` and\n * `https://example.com` are the same entry. Throws on anything that is not an http(s) origin: a\n * misconfigured list must fail at startup, not let every return URL through or refuse them all.\n */\nfunction normalizeOrigins(origins: AllowedOrigins): string[] {\n  return origins.map((origin) => {\n    const parsed = new URL(origin);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new Error(`returnUrl: ${origin} is not an http(s) origin`);\n    }\n    return parsed.origin;\n  });\n}\n\n/**\n * Whether `value` may be handed to Stripe as a URL its hosted pages (Checkout, the billing portal)\n * send the browser back to. Origins are compared as parsed by `new URL()`, never by string prefix,\n * so a lookalike host (`https://example.com.evil.com`), userinfo (`https://example.com@evil.com`),\n * protocol-relative (`//evil.com`) and `javascript:` values are all refused. The scheme is part of\n * the origin, so an https-only list refuses `http:` too.\n */\nfunction isAllowedReturnUrl(value: string, allowedOrigins: readonly string[]): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return false;\n  }\n  if (parsed.username !== '' || parsed.password !== '') return false;\n  return allowedOrigins.includes(parsed.origin);\n}\n\n/**\n * A client-supplied return / success / cancel URL. It goes straight to Stripe, so without an\n * origin check anyone could create a session with their own account and hand out a\n * `checkout.stripe.com` / `billing.stripe.com` link that ends on a page of their choosing: an open\n * redirect behind a trusted domain. `allowedOrigins` is usually just the web app's origin.\n */\nexport function returnUrlSchema(allowedOrigins: AllowedOrigins) {\n  const origins = normalizeOrigins(allowedOrigins);\n  return url().check(\n    refine((value) => isAllowedReturnUrl(value, origins), {\n      message: `URL must be on ${origins.join(', ')}`,\n    })\n  );\n}\n\nexport interface CreateCheckoutSessionSchemaOptions {\n  /** Origins (`https://example.com`) `cancelUrl` and `successUrl` may point at; see `returnUrlSchema`. */\n  allowedOrigins: AllowedOrigins;\n}\n\nexport function createCheckoutSessionSchema(\n  productIds: string[],\n  { allowedOrigins }: CreateCheckoutSessionSchemaOptions\n) {\n  return object({\n    quantity: _default(int().check(gte(1)), 1),\n    productId: _enum(productIds),\n    cancelUrl: optional(returnUrlSchema(allowedOrigins)),\n    successUrl: optional(returnUrlSchema(allowedOrigins)),\n  });\n}\n\n// Kept under the stripe entry for callers that imported it from here; the type is platform\n// neutral and lives with the subscription statuses.\nexport type { CancellationDetails } from '../subscription/index';\n\nexport interface CreateCheckoutSessionDTO {\n  productId: string;\n  cancelUrl?: string;\n  successUrl?: `${string}session_id={CHECKOUT_SESSION_ID}${string}`;\n}\n"],"mappings":";;;;AAgBA,MAAa,4BAA4B,OAAO;CAC9C,SAAS,SAAS,SAAS,OAAO,CAAC,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC,CAAC;CAC3D,UAAU,SAAS,SAASA,OAAM,sBAAsB,CAAC,CAAC;CAC1D,mBAAmB,SAAS,SAASA,OAAM,mBAAmB,CAAC,CAAC;AAClE,CAAC;;;;;;AAUD,SAAS,iBAAiB,SAAmC;CAC3D,OAAO,QAAQ,KAAK,WAAW;EAC7B,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SACtD,MAAM,IAAI,MAAM,cAAc,OAAO,0BAA0B;EAEjE,OAAO,OAAO;CAChB,CAAC;AACH;;;;;;;;AASA,SAAS,mBAAmB,OAAe,gBAA4C;CACrF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI,OAAO;CAC7D,OAAO,eAAe,SAAS,OAAO,MAAM;AAC9C;;;;;;;AAQA,SAAgB,gBAAgB,gBAAgC;CAC9D,MAAM,UAAU,iBAAiB,cAAc;CAC/C,OAAO,IAAI,CAAC,CAAC,MACX,QAAQ,UAAU,mBAAmB,OAAO,OAAO,GAAG,EACpD,SAAS,kBAAkB,QAAQ,KAAK,IAAI,IAC9C,CAAC,CACH;AACF;AAOA,SAAgB,4BACd,YACA,EAAE,kBACF;CACA,OAAO,OAAO;EACZ,UAAU,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;EACzC,WAAWA,OAAM,UAAU;EAC3B,WAAW,SAAS,gBAAgB,cAAc,CAAC;EACnD,YAAY,SAAS,gBAAgB,cAAc,CAAC;CACtD,CAAC;AACH"}

package/dist/stripe/thin-handler.cjs

@@ -0,0 +1,40 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/stripe/thin-handler.ts
+/**
+* Stripe thin event dispatcher keyed by event type (`v1.customer.subscription.updated`, ...). The
+* caller verifies and parses the payload with `stripe.parseEventNotificationAsync` first and passes
+* the notification in. A thin event only says which object changed, so each handler reads current
+* state itself with `notification.fetchRelatedObject()` (or `fetchEvent()`). Nothing is pre-fetched
+* here: some handlers only need `related_object.id`, and fetching inside the handler keeps the API
+* call next to the code that uses its result. Delivery order carries no meaning: handlers re-read
+* state instead of applying a payload, and dedupe one-off facts with idempotency keys.
+*
+* The thin-event counterpart of StripeEventHandler, which dispatches snapshot events. Thin event
+* types and `parseEventNotificationAsync` need stripe-node 23+.
+*/
+var StripeThinEventHandler = class StripeThinEventHandler {
+	handlers;
+	constructor() {
+		this.handlers = /* @__PURE__ */ new Map();
+	}
+	static create() {
+		return new StripeThinEventHandler();
+	}
+	on = (type, handler) => {
+		if (!this.handlers.has(type)) this.handlers.set(type, []);
+		this.handlers.get(type)?.push(handler);
+		return this;
+	};
+	process = async (notification) => {
+		const eventHandlers = this.handlers.get(notification.type);
+		if (eventHandlers) await Promise.all(eventHandlers.map((handler) => handler(notification)));
+		else {
+			console.error(`No stripe event handler found for event type: ${notification.type}`);
+			throw new Error(`No stripe event handler found for event type: ${notification.type}`);
+		}
+	};
+};
+//#endregion
+exports.StripeThinEventHandler = StripeThinEventHandler;
+
+//# sourceMappingURL=thin-handler.cjs.map

package/dist/stripe/thin-handler.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"thin-handler.cjs","names":[],"sources":["../../src/stripe/thin-handler.ts"],"sourcesContent":["import type { Stripe } from 'stripe';\n\ntype StripeEventNotification = Stripe.V2.Core.EventNotification;\n\nexport type StripeThinEventType = StripeEventNotification['type'];\n\nexport type StripeThinEventNotificationOf<T extends StripeThinEventType> = Extract<\n  StripeEventNotification,\n  { type: T }\n>;\n\ntype EventHandlerFn<T extends StripeThinEventType = StripeThinEventType> = (\n  notification: StripeThinEventNotificationOf<T>\n) => Promise<void>;\n\n/**\n * Stripe thin event dispatcher keyed by event type (`v1.customer.subscription.updated`, ...). The\n * caller verifies and parses the payload with `stripe.parseEventNotificationAsync` first and passes\n * the notification in. A thin event only says which object changed, so each handler reads current\n * state itself with `notification.fetchRelatedObject()` (or `fetchEvent()`). Nothing is pre-fetched\n * here: some handlers only need `related_object.id`, and fetching inside the handler keeps the API\n * call next to the code that uses its result. Delivery order carries no meaning: handlers re-read\n * state instead of applying a payload, and dedupe one-off facts with idempotency keys.\n *\n * The thin-event counterpart of StripeEventHandler, which dispatches snapshot events. Thin event\n * types and `parseEventNotificationAsync` need stripe-node 23+.\n */\nexport class StripeThinEventHandler {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  private readonly handlers: Map<StripeThinEventType, Array<EventHandlerFn<any>>>;\n\n  private constructor() {\n    this.handlers = new Map();\n  }\n\n  static create() {\n    return new StripeThinEventHandler();\n  }\n\n  on = <T extends StripeThinEventType>(type: T, handler: EventHandlerFn<T>) => {\n    if (!this.handlers.has(type)) {\n      this.handlers.set(type, []);\n    }\n\n    this.handlers.get(type)?.push(handler);\n    return this;\n  };\n\n  process = async (notification: StripeEventNotification): Promise<void> => {\n    const eventHandlers = this.handlers.get(notification.type);\n    if (eventHandlers) {\n      await Promise.all(eventHandlers.map((handler) => handler(notification)));\n    } else {\n      console.error(`No stripe event handler found for event type: ${notification.type}`);\n      throw new Error(`No stripe event handler found for event type: ${notification.type}`);\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AA2BA,IAAa,yBAAb,MAAa,uBAAuB;CAElC;CAEA,cAAsB;EACpB,KAAK,2BAAW,IAAI,IAAI;CAC1B;CAEA,OAAO,SAAS;EACd,OAAO,IAAI,uBAAuB;CACpC;CAEA,MAAqC,MAAS,YAA+B;EAC3E,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,GACzB,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC;EAG5B,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO;EACrC,OAAO;CACT;CAEA,UAAU,OAAO,iBAAyD;EACxE,MAAM,gBAAgB,KAAK,SAAS,IAAI,aAAa,IAAI;EACzD,IAAI,eACF,MAAM,QAAQ,IAAI,cAAc,KAAK,YAAY,QAAQ,YAAY,CAAC,CAAC;OAClE;GACL,QAAQ,MAAM,iDAAiD,aAAa,MAAM;GAClF,MAAM,IAAI,MAAM,iDAAiD,aAAa,MAAM;EACtF;CACF;AACF"}

package/dist/stripe/thin-handler.d.cts

@@ -0,0 +1,30 @@
+import { Stripe } from "stripe";
+//#region src/stripe/thin-handler.d.ts
+type StripeEventNotification = Stripe.V2.Core.EventNotification;
+export type StripeThinEventType = StripeEventNotification['type'];
+export type StripeThinEventNotificationOf<T extends StripeThinEventType> = Extract<StripeEventNotification, {
+  type: T;
+}>;
+type EventHandlerFn<T extends StripeThinEventType = StripeThinEventType> = (notification: StripeThinEventNotificationOf<T>) => Promise<void>;
+/**
+ * Stripe thin event dispatcher keyed by event type (`v1.customer.subscription.updated`, ...). The
+ * caller verifies and parses the payload with `stripe.parseEventNotificationAsync` first and passes
+ * the notification in. A thin event only says which object changed, so each handler reads current
+ * state itself with `notification.fetchRelatedObject()` (or `fetchEvent()`). Nothing is pre-fetched
+ * here: some handlers only need `related_object.id`, and fetching inside the handler keeps the API
+ * call next to the code that uses its result. Delivery order carries no meaning: handlers re-read
+ * state instead of applying a payload, and dedupe one-off facts with idempotency keys.
+ *
+ * The thin-event counterpart of StripeEventHandler, which dispatches snapshot events. Thin event
+ * types and `parseEventNotificationAsync` need stripe-node 23+.
+ */
+export declare class StripeThinEventHandler {
+  private readonly handlers;
+  private constructor();
+  static create(): StripeThinEventHandler;
+  on: <T extends StripeThinEventType>(type: T, handler: EventHandlerFn<T>) => this;
+  process: (notification: StripeEventNotification) => Promise<void>;
+}
+//#endregion
+export {};
+//# sourceMappingURL=thin-handler.d.cts.map

package/dist/stripe/thin-handler.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thin-handler.d.cts","names":[],"sources":["../../src/stripe/thin-handler.ts"],"mappings":";;KAEK,0BAA0B,OAAO,GAAG,KAAK;YAElC,sBAAsB;YAEtB,8BAA8B,UAAU,uBAAuB,QACzE;EACE,MAAM;;KAGL,eAAe,UAAU,sBAAsB,wBAClD,cAAc,8BAA8B,OACzC;;;;;;;;;;;;;qBAcQ;mBAEM;UAEV;SAIA,UAAM;EAIb,KAAM,UAAU,qBAAmB,MAAQ,GAAC,SAAW,eAAe;EAStE,UAAO,cAAwB,4BAA0B"}

package/dist/stripe/thin-handler.d.mts

@@ -0,0 +1,30 @@
+import { Stripe } from "stripe";
+//#region src/stripe/thin-handler.d.ts
+type StripeEventNotification = Stripe.V2.Core.EventNotification;
+export type StripeThinEventType = StripeEventNotification['type'];
+export type StripeThinEventNotificationOf<T extends StripeThinEventType> = Extract<StripeEventNotification, {
+  type: T;
+}>;
+type EventHandlerFn<T extends StripeThinEventType = StripeThinEventType> = (notification: StripeThinEventNotificationOf<T>) => Promise<void>;
+/**
+ * Stripe thin event dispatcher keyed by event type (`v1.customer.subscription.updated`, ...). The
+ * caller verifies and parses the payload with `stripe.parseEventNotificationAsync` first and passes
+ * the notification in. A thin event only says which object changed, so each handler reads current
+ * state itself with `notification.fetchRelatedObject()` (or `fetchEvent()`). Nothing is pre-fetched
+ * here: some handlers only need `related_object.id`, and fetching inside the handler keeps the API
+ * call next to the code that uses its result. Delivery order carries no meaning: handlers re-read
+ * state instead of applying a payload, and dedupe one-off facts with idempotency keys.
+ *
+ * The thin-event counterpart of StripeEventHandler, which dispatches snapshot events. Thin event
+ * types and `parseEventNotificationAsync` need stripe-node 23+.
+ */
+export declare class StripeThinEventHandler {
+  private readonly handlers;
+  private constructor();
+  static create(): StripeThinEventHandler;
+  on: <T extends StripeThinEventType>(type: T, handler: EventHandlerFn<T>) => this;
+  process: (notification: StripeEventNotification) => Promise<void>;
+}
+//#endregion
+export {};
+//# sourceMappingURL=thin-handler.d.mts.map

package/dist/stripe/thin-handler.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thin-handler.d.mts","names":[],"sources":["../../src/stripe/thin-handler.ts"],"mappings":";;KAEK,0BAA0B,OAAO,GAAG,KAAK;YAElC,sBAAsB;YAEtB,8BAA8B,UAAU,uBAAuB,QACzE;EACE,MAAM;;KAGL,eAAe,UAAU,sBAAsB,wBAClD,cAAc,8BAA8B,OACzC;;;;;;;;;;;;;qBAcQ;mBAEM;UAEV;SAIA,UAAM;EAIb,KAAM,UAAU,qBAAmB,MAAQ,GAAC,SAAW,eAAe;EAStE,UAAO,cAAwB,4BAA0B"}

package/dist/stripe/thin-handler.mjs

@@ -0,0 +1,39 @@
+//#region src/stripe/thin-handler.ts
+/**
+* Stripe thin event dispatcher keyed by event type (`v1.customer.subscription.updated`, ...). The
+* caller verifies and parses the payload with `stripe.parseEventNotificationAsync` first and passes
+* the notification in. A thin event only says which object changed, so each handler reads current
+* state itself with `notification.fetchRelatedObject()` (or `fetchEvent()`). Nothing is pre-fetched
+* here: some handlers only need `related_object.id`, and fetching inside the handler keeps the API
+* call next to the code that uses its result. Delivery order carries no meaning: handlers re-read
+* state instead of applying a payload, and dedupe one-off facts with idempotency keys.
+*
+* The thin-event counterpart of StripeEventHandler, which dispatches snapshot events. Thin event
+* types and `parseEventNotificationAsync` need stripe-node 23+.
+*/
+var StripeThinEventHandler = class StripeThinEventHandler {
+	handlers;
+	constructor() {
+		this.handlers = /* @__PURE__ */ new Map();
+	}
+	static create() {
+		return new StripeThinEventHandler();
+	}
+	on = (type, handler) => {
+		if (!this.handlers.has(type)) this.handlers.set(type, []);
+		this.handlers.get(type)?.push(handler);
+		return this;
+	};
+	process = async (notification) => {
+		const eventHandlers = this.handlers.get(notification.type);
+		if (eventHandlers) await Promise.all(eventHandlers.map((handler) => handler(notification)));
+		else {
+			console.error(`No stripe event handler found for event type: ${notification.type}`);
+			throw new Error(`No stripe event handler found for event type: ${notification.type}`);
+		}
+	};
+};
+//#endregion
+export { StripeThinEventHandler };
+
+//# sourceMappingURL=thin-handler.mjs.map

package/dist/stripe/thin-handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"thin-handler.mjs","names":[],"sources":["../../src/stripe/thin-handler.ts"],"sourcesContent":["import type { Stripe } from 'stripe';\n\ntype StripeEventNotification = Stripe.V2.Core.EventNotification;\n\nexport type StripeThinEventType = StripeEventNotification['type'];\n\nexport type StripeThinEventNotificationOf<T extends StripeThinEventType> = Extract<\n  StripeEventNotification,\n  { type: T }\n>;\n\ntype EventHandlerFn<T extends StripeThinEventType = StripeThinEventType> = (\n  notification: StripeThinEventNotificationOf<T>\n) => Promise<void>;\n\n/**\n * Stripe thin event dispatcher keyed by event type (`v1.customer.subscription.updated`, ...). The\n * caller verifies and parses the payload with `stripe.parseEventNotificationAsync` first and passes\n * the notification in. A thin event only says which object changed, so each handler reads current\n * state itself with `notification.fetchRelatedObject()` (or `fetchEvent()`). Nothing is pre-fetched\n * here: some handlers only need `related_object.id`, and fetching inside the handler keeps the API\n * call next to the code that uses its result. Delivery order carries no meaning: handlers re-read\n * state instead of applying a payload, and dedupe one-off facts with idempotency keys.\n *\n * The thin-event counterpart of StripeEventHandler, which dispatches snapshot events. Thin event\n * types and `parseEventNotificationAsync` need stripe-node 23+.\n */\nexport class StripeThinEventHandler {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  private readonly handlers: Map<StripeThinEventType, Array<EventHandlerFn<any>>>;\n\n  private constructor() {\n    this.handlers = new Map();\n  }\n\n  static create() {\n    return new StripeThinEventHandler();\n  }\n\n  on = <T extends StripeThinEventType>(type: T, handler: EventHandlerFn<T>) => {\n    if (!this.handlers.has(type)) {\n      this.handlers.set(type, []);\n    }\n\n    this.handlers.get(type)?.push(handler);\n    return this;\n  };\n\n  process = async (notification: StripeEventNotification): Promise<void> => {\n    const eventHandlers = this.handlers.get(notification.type);\n    if (eventHandlers) {\n      await Promise.all(eventHandlers.map((handler) => handler(notification)));\n    } else {\n      console.error(`No stripe event handler found for event type: ${notification.type}`);\n      throw new Error(`No stripe event handler found for event type: ${notification.type}`);\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA2BA,IAAa,yBAAb,MAAa,uBAAuB;CAElC;CAEA,cAAsB;EACpB,KAAK,2BAAW,IAAI,IAAI;CAC1B;CAEA,OAAO,SAAS;EACd,OAAO,IAAI,uBAAuB;CACpC;CAEA,MAAqC,MAAS,YAA+B;EAC3E,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,GACzB,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC;EAG5B,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO;EACrC,OAAO;CACT;CAEA,UAAU,OAAO,iBAAyD;EACxE,MAAM,gBAAgB,KAAK,SAAS,IAAI,aAAa,IAAI;EACzD,IAAI,eACF,MAAM,QAAQ,IAAI,cAAc,KAAK,YAAY,QAAQ,YAAY,CAAC,CAAC;OAClE;GACL,QAAQ,MAAM,iDAAiD,aAAa,MAAM;GAClF,MAAM,IAAI,MAAM,iDAAiD,aAAa,MAAM;EACtF;CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/purchase",
-  "version": "5.2.2",
+  "version": "7.0.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -70,7 +70,7 @@
   },
   "peerDependencies": {
     "@apple/app-store-server-library": "^3.1.0",
-    "stripe": "^22.6.2 || ^23.0.0",
+    "stripe": "^23.0.0",
     "zod": "^4.6.5"
   },
   "peerDependenciesMeta": {