@stripe-sdk/core 1.0.0 → 1.0.2

package/dist/server/index.mjs

@@ -4,12 +4,16 @@ import Stripe from 'stripe';
 var stripeInstance = null;
 var currentConfig = null;
 function initStripe(config) {
+  if (stripeInstance) {
+    console.warn("[@stripe-sdk/core] Stripe is already initialized. Re-initializing with new config.");
+  }
   currentConfig = config;
   stripeInstance = new Stripe(config.secretKey, {
     apiVersion: config.apiVersion ?? "2025-01-27.acacia",
+    maxNetworkRetries: config.maxNetworkRetries ?? 2,
     appInfo: config.appInfo ?? {
       name: "@stripe-sdk/core",
-      version: "1.0.0"
+      version: "1.0.1"
     }
   });
   return stripeInstance;
@@ -28,17 +32,27 @@ function getConfig() {
       "[@stripe-sdk/core] Stripe not initialized. Call initStripe({ secretKey, publishableKey }) first."
     );
   }
-  return currentConfig;
+  const { secretKey: _sk, ...safeConfig } = currentConfig;
+  return safeConfig;
 }
 
 // src/utils/errors.ts
+var SAFE_ERROR_MESSAGES = {
+  card_declined: "Your card was declined.",
+  expired_card: "Your card has expired.",
+  incorrect_cvc: "Incorrect security code.",
+  processing_error: "An error occurred while processing your card.",
+  incorrect_number: "The card number is incorrect.",
+  insufficient_funds: "Insufficient funds."
+};
 function handleStripeError(error) {
   if (error?.type) {
     const stripeError = error;
+    const safeMessage = stripeError.code && SAFE_ERROR_MESSAGES[stripeError.code] || getSafeMessage(stripeError.type);
     return {
       data: null,
       error: {
-        message: stripeError.message,
+        message: safeMessage,
         type: stripeError.type,
         code: stripeError.code,
         statusCode: stripeError.statusCode
@@ -48,31 +62,147 @@ function handleStripeError(error) {
   return {
     data: null,
     error: {
-      message: error instanceof Error ? error.message : "An unknown error occurred",
+      message: "An unexpected error occurred",
       type: "sdk_error"
     }
   };
 }
+function getSafeMessage(type) {
+  switch (type) {
+    case "card_error":
+      return "A card error occurred.";
+    case "invalid_request_error":
+      return "Invalid request. Please check your input.";
+    case "authentication_error":
+      return "Authentication failed.";
+    case "rate_limit_error":
+      return "Too many requests. Please try again later.";
+    case "api_error":
+      return "A payment processing error occurred. Please try again.";
+    default:
+      return "An unexpected error occurred.";
+  }
+}
 function success(data) {
   return { data, error: null };
 }
 
+// src/utils/validators.ts
+var STRIPE_ID_PREFIXES = {
+  customer: "cus_",
+  paymentIntent: "pi_",
+  paymentMethod: "pm_",
+  subscription: "sub_",
+  invoice: "in_",
+  invoiceItem: "ii_",
+  product: "prod_",
+  price: "price_",
+  coupon: "",
+  // coupons can have custom IDs
+  promotionCode: "promo_",
+  refund: "re_",
+  dispute: "dp_",
+  account: "acct_",
+  transfer: "tr_",
+  payout: "po_",
+  setupIntent: "seti_",
+  session: "cs_",
+  paymentLink: "plink_"
+};
+function validateStripeId(id, type) {
+  if (!id || typeof id !== "string") {
+    throw new Error(`${type} ID is required and must be a non-empty string`);
+  }
+  const prefix = STRIPE_ID_PREFIXES[type];
+  if (prefix && !id.startsWith(prefix)) {
+    throw new Error(`Invalid ${type} ID: expected prefix "${prefix}"`);
+  }
+}
+function validateAmount(amount, label = "amount") {
+  if (typeof amount !== "number" || !Number.isFinite(amount)) {
+    throw new Error(`${label} must be a finite number`);
+  }
+  if (!Number.isInteger(amount)) {
+    throw new Error(`${label} must be an integer (amount in smallest currency unit)`);
+  }
+  if (amount < 0) {
+    throw new Error(`${label} must not be negative`);
+  }
+  if (amount > 99999999) {
+    throw new Error(`${label} exceeds maximum allowed value (99999999)`);
+  }
+}
+function validateCurrency(currency) {
+  if (!currency || typeof currency !== "string") {
+    throw new Error("Currency is required");
+  }
+  const normalized = currency.trim().toLowerCase();
+  if (!/^[a-z]{3}$/.test(normalized)) {
+    throw new Error("Currency must be a valid 3-letter ISO 4217 code");
+  }
+  return normalized;
+}
+function validateUrl(url, label = "URL") {
+  if (!url || typeof url !== "string") {
+    throw new Error(`${label} is required`);
+  }
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new Error(`${label} must use http or https protocol`);
+    }
+  } catch (e) {
+    if (e instanceof Error && e.message.includes("protocol")) throw e;
+    throw new Error(`${label} must be a valid URL`);
+  }
+}
+function validateMetadata(metadata) {
+  const keys = Object.keys(metadata);
+  if (keys.length > 50) {
+    throw new Error("Metadata cannot have more than 50 keys");
+  }
+  for (const [key, value] of Object.entries(metadata)) {
+    if (key.length > 40) {
+      throw new Error(`Metadata key "${key}" exceeds 40 characters`);
+    }
+    if (typeof value !== "string") {
+      throw new Error(`Metadata value for key "${key}" must be a string`);
+    }
+    if (value.length > 500) {
+      throw new Error(`Metadata value for key "${key}" exceeds 500 characters`);
+    }
+  }
+}
+function sanitizeLimit(limit, defaultLimit = 10) {
+  if (limit === void 0) return defaultLimit;
+  return Math.min(Math.max(Math.floor(limit), 1), 100);
+}
+
 // src/server/payments/index.ts
-async function createPaymentIntent(input) {
-  try {
-    const stripe = getStripe();
-    const paymentIntent = await stripe.paymentIntents.create({
-      amount: input.amount,
-      currency: input.currency,
-      customer: input.customerId,
-      payment_method: input.paymentMethodId,
-      metadata: input.metadata,
-      description: input.description,
-      receipt_email: input.receiptEmail,
-      setup_future_usage: input.setupFutureUsage,
-      automatic_payment_methods: input.automaticPaymentMethods === false || input.paymentMethodId ? void 0 : { enabled: true },
-      return_url: input.returnUrl
-    });
+async function createPaymentIntent(input, options) {
+  try {
+    validateAmount(input.amount);
+    const currency = validateCurrency(input.currency);
+    if (input.customerId) validateStripeId(input.customerId, "customer");
+    if (input.paymentMethodId) validateStripeId(input.paymentMethodId, "paymentMethod");
+    if (input.returnUrl) validateUrl(input.returnUrl, "returnUrl");
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const paymentIntent = await stripe.paymentIntents.create(
+      {
+        amount: input.amount,
+        currency,
+        customer: input.customerId,
+        payment_method: input.paymentMethodId,
+        metadata: input.metadata,
+        description: input.description,
+        receipt_email: input.receiptEmail,
+        setup_future_usage: input.setupFutureUsage,
+        automatic_payment_methods: input.automaticPaymentMethods === false || input.paymentMethodId ? void 0 : { enabled: true },
+        return_url: input.returnUrl
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(paymentIntent);
   } catch (error) {
     return handleStripeError(error);
@@ -80,6 +210,7 @@ async function createPaymentIntent(input) {
 }
 async function retrievePaymentIntent(paymentIntentId) {
   try {
+    validateStripeId(paymentIntentId, "paymentIntent");
     const stripe = getStripe();
     const paymentIntent = await stripe.paymentIntents.retrieve(paymentIntentId);
     return success(paymentIntent);
@@ -89,6 +220,9 @@ async function retrievePaymentIntent(paymentIntentId) {
 }
 async function confirmPaymentIntent(input) {
   try {
+    validateStripeId(input.paymentIntentId, "paymentIntent");
+    if (input.paymentMethodId) validateStripeId(input.paymentMethodId, "paymentMethod");
+    if (input.returnUrl) validateUrl(input.returnUrl, "returnUrl");
     const stripe = getStripe();
     const paymentIntent = await stripe.paymentIntents.confirm(input.paymentIntentId, {
       payment_method: input.paymentMethodId,
@@ -101,6 +235,7 @@ async function confirmPaymentIntent(input) {
 }
 async function cancelPaymentIntent(paymentIntentId) {
   try {
+    validateStripeId(paymentIntentId, "paymentIntent");
     const stripe = getStripe();
     const paymentIntent = await stripe.paymentIntents.cancel(paymentIntentId);
     return success(paymentIntent);
@@ -110,9 +245,10 @@ async function cancelPaymentIntent(paymentIntentId) {
 }
 async function listPaymentIntents(input) {
   try {
+    if (input?.customerId) validateStripeId(input.customerId, "customer");
     const stripe = getStripe();
     const paymentIntents = await stripe.paymentIntents.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       customer: input?.customerId
@@ -122,28 +258,35 @@ async function listPaymentIntents(input) {
     return handleStripeError(error);
   }
 }
-async function createCheckoutSession(input) {
-  try {
-    const stripe = getStripe();
-    const session = await stripe.checkout.sessions.create({
-      mode: input.mode,
-      line_items: input.lineItems.map((item) => ({
-        price: item.priceId,
-        quantity: item.quantity
-      })),
-      success_url: input.successUrl,
-      cancel_url: input.cancelUrl,
-      customer: input.customerId,
-      customer_email: input.customerEmail,
-      metadata: input.metadata,
-      allow_promotion_codes: input.allowPromotionCodes,
-      shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0,
-      billing_address_collection: input.billingAddressCollection,
-      subscription_data: input.trialPeriodDays ? { trial_period_days: input.trialPeriodDays } : void 0,
-      tax_id_collection: input.taxIdCollection ? { enabled: true } : void 0,
-      automatic_tax: input.automaticTax ? { enabled: true } : void 0,
-      locale: input.locale
-    });
+async function createCheckoutSession(input, options) {
+  try {
+    validateUrl(input.successUrl, "successUrl");
+    validateUrl(input.cancelUrl, "cancelUrl");
+    if (input.customerId) validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const session = await stripe.checkout.sessions.create(
+      {
+        mode: input.mode,
+        line_items: input.lineItems.map((item) => ({
+          price: item.priceId,
+          quantity: item.quantity
+        })),
+        success_url: input.successUrl,
+        cancel_url: input.cancelUrl,
+        customer: input.customerId,
+        customer_email: input.customerEmail,
+        metadata: input.metadata,
+        allow_promotion_codes: input.allowPromotionCodes,
+        shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0,
+        billing_address_collection: input.billingAddressCollection,
+        subscription_data: input.trialPeriodDays ? { trial_period_days: input.trialPeriodDays } : void 0,
+        tax_id_collection: input.taxIdCollection ? { enabled: true } : void 0,
+        automatic_tax: input.automaticTax ? { enabled: true } : void 0,
+        locale: input.locale
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(session);
   } catch (error) {
     return handleStripeError(error);
@@ -151,6 +294,7 @@ async function createCheckoutSession(input) {
 }
 async function retrieveCheckoutSession(sessionId) {
   try {
+    validateStripeId(sessionId, "session");
     const stripe = getStripe();
     const session = await stripe.checkout.sessions.retrieve(sessionId, {
       expand: ["line_items", "payment_intent", "subscription"]
@@ -164,7 +308,7 @@ async function listCheckoutSessions(input) {
   try {
     const stripe = getStripe();
     const sessions = await stripe.checkout.sessions.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -173,29 +317,36 @@ async function listCheckoutSessions(input) {
     return handleStripeError(error);
   }
 }
-async function createPaymentLink(input) {
+async function createPaymentLink(input, options) {
   try {
-    const stripe = getStripe();
-    const paymentLink = await stripe.paymentLinks.create({
-      line_items: input.lineItems.map((item) => ({
-        price: item.priceId,
-        quantity: item.quantity,
-        adjustable_quantity: item.adjustableQuantity ? {
-          enabled: item.adjustableQuantity.enabled,
-          minimum: item.adjustableQuantity.minimum,
-          maximum: item.adjustableQuantity.maximum
-        } : void 0
-      })),
-      metadata: input.metadata,
-      after_completion: input.afterCompletion ? {
-        type: input.afterCompletion.type,
-        redirect: input.afterCompletion.redirectUrl ? { url: input.afterCompletion.redirectUrl } : void 0
-      } : void 0,
-      allow_promotion_codes: input.allowPromotionCodes,
-      automatic_tax: input.automaticTax ? { enabled: true } : void 0,
-      billing_address_collection: input.billingAddressCollection,
-      shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0
-    });
+    if (input.afterCompletion?.redirectUrl) {
+      validateUrl(input.afterCompletion.redirectUrl, "afterCompletion.redirectUrl");
+    }
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const paymentLink = await stripe.paymentLinks.create(
+      {
+        line_items: input.lineItems.map((item) => ({
+          price: item.priceId,
+          quantity: item.quantity,
+          adjustable_quantity: item.adjustableQuantity ? {
+            enabled: item.adjustableQuantity.enabled,
+            minimum: item.adjustableQuantity.minimum,
+            maximum: item.adjustableQuantity.maximum
+          } : void 0
+        })),
+        metadata: input.metadata,
+        after_completion: input.afterCompletion ? {
+          type: input.afterCompletion.type,
+          redirect: input.afterCompletion.redirectUrl ? { url: input.afterCompletion.redirectUrl } : void 0
+        } : void 0,
+        allow_promotion_codes: input.allowPromotionCodes,
+        automatic_tax: input.automaticTax ? { enabled: true } : void 0,
+        billing_address_collection: input.billingAddressCollection,
+        shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(paymentLink);
   } catch (error) {
     return handleStripeError(error);
@@ -203,6 +354,7 @@ async function createPaymentLink(input) {
 }
 async function retrievePaymentLink(paymentLinkId) {
   try {
+    validateStripeId(paymentLinkId, "paymentLink");
     const stripe = getStripe();
     const paymentLink = await stripe.paymentLinks.retrieve(paymentLinkId);
     return success(paymentLink);
@@ -210,15 +362,20 @@ async function retrievePaymentLink(paymentLinkId) {
     return handleStripeError(error);
   }
 }
-async function createSetupIntent(input) {
+async function createSetupIntent(input, options) {
   try {
+    if (input.customerId) validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const setupIntent = await stripe.setupIntents.create({
-      customer: input.customerId,
-      payment_method_types: input.paymentMethodTypes,
-      usage: input.usage,
-      metadata: input.metadata
-    });
+    const setupIntent = await stripe.setupIntents.create(
+      {
+        customer: input.customerId,
+        payment_method_types: input.paymentMethodTypes,
+        usage: input.usage,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(setupIntent);
   } catch (error) {
     return handleStripeError(error);
@@ -226,6 +383,7 @@ async function createSetupIntent(input) {
 }
 async function retrieveSetupIntent(setupIntentId) {
   try {
+    validateStripeId(setupIntentId, "setupIntent");
     const stripe = getStripe();
     const setupIntent = await stripe.setupIntents.retrieve(setupIntentId);
     return success(setupIntent);
@@ -235,6 +393,7 @@ async function retrieveSetupIntent(setupIntentId) {
 }
 async function listPaymentMethods(customerId, type) {
   try {
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const paymentMethods = await stripe.paymentMethods.list({
       customer: customerId,
@@ -247,6 +406,8 @@ async function listPaymentMethods(customerId, type) {
 }
 async function attachPaymentMethod(paymentMethodId, customerId) {
   try {
+    validateStripeId(paymentMethodId, "paymentMethod");
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const paymentMethod = await stripe.paymentMethods.attach(paymentMethodId, {
       customer: customerId
@@ -258,6 +419,7 @@ async function attachPaymentMethod(paymentMethodId, customerId) {
 }
 async function detachPaymentMethod(paymentMethodId) {
   try {
+    validateStripeId(paymentMethodId, "paymentMethod");
     const stripe = getStripe();
     const paymentMethod = await stripe.paymentMethods.detach(paymentMethodId);
     return success(paymentMethod);
@@ -267,26 +429,31 @@ async function detachPaymentMethod(paymentMethodId) {
 }
 
 // src/server/customers/index.ts
-async function createCustomer(input) {
-  try {
-    const stripe = getStripe();
-    const customer = await stripe.customers.create({
-      email: input.email,
-      name: input.name,
-      phone: input.phone,
-      description: input.description,
-      metadata: input.metadata,
-      payment_method: input.paymentMethodId,
-      invoice_settings: input.paymentMethodId ? { default_payment_method: input.paymentMethodId } : void 0,
-      address: input.address ? {
-        line1: input.address.line1,
-        line2: input.address.line2,
-        city: input.address.city,
-        state: input.address.state,
-        postal_code: input.address.postalCode,
-        country: input.address.country
-      } : void 0
-    });
+async function createCustomer(input, options) {
+  try {
+    if (input.paymentMethodId) validateStripeId(input.paymentMethodId, "paymentMethod");
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const customer = await stripe.customers.create(
+      {
+        email: input.email,
+        name: input.name,
+        phone: input.phone,
+        description: input.description,
+        metadata: input.metadata,
+        payment_method: input.paymentMethodId,
+        invoice_settings: input.paymentMethodId ? { default_payment_method: input.paymentMethodId } : void 0,
+        address: input.address ? {
+          line1: input.address.line1,
+          line2: input.address.line2,
+          city: input.address.city,
+          state: input.address.state,
+          postal_code: input.address.postalCode,
+          country: input.address.country
+        } : void 0
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(customer);
   } catch (error) {
     return handleStripeError(error);
@@ -294,6 +461,7 @@ async function createCustomer(input) {
 }
 async function retrieveCustomer(customerId) {
   try {
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const customer = await stripe.customers.retrieve(customerId, {
       expand: ["subscriptions", "sources"]
@@ -311,6 +479,9 @@ async function retrieveCustomer(customerId) {
 }
 async function updateCustomer(input) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.defaultPaymentMethodId) validateStripeId(input.defaultPaymentMethodId, "paymentMethod");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const customer = await stripe.customers.update(input.customerId, {
       email: input.email,
@@ -335,6 +506,7 @@ async function updateCustomer(input) {
 }
 async function deleteCustomer(customerId) {
   try {
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const deleted = await stripe.customers.del(customerId);
     return success(deleted);
@@ -346,7 +518,7 @@ async function listCustomers(input) {
   try {
     const stripe = getStripe();
     const customers = await stripe.customers.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       email: input?.email
@@ -356,26 +528,42 @@ async function listCustomers(input) {
     return handleStripeError(error);
   }
 }
-async function searchCustomers(query, limit) {
+async function searchCustomers(input) {
   try {
+    const clauses = [];
+    if (input.email) clauses.push(`email:"${input.email.replace(/"/g, "")}"`);
+    if (input.name) clauses.push(`name:"${input.name.replace(/"/g, "")}"`);
+    if (input.phone) clauses.push(`phone:"${input.phone.replace(/"/g, "")}"`);
+    if (clauses.length === 0) {
+      return {
+        data: null,
+        error: { message: "At least one search field (email, name, phone) is required", type: "invalid_request_error" }
+      };
+    }
+    const query = clauses.join(" AND ");
     const stripe = getStripe();
     const customers = await stripe.customers.search({
       query,
-      limit: limit ?? 10
+      limit: sanitizeLimit(input.limit)
     });
     return success(customers);
   } catch (error) {
     return handleStripeError(error);
   }
 }
-async function createPortalSession(input) {
+async function createPortalSession(input, options) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.returnUrl) validateUrl(input.returnUrl, "returnUrl");
     const stripe = getStripe();
-    const session = await stripe.billingPortal.sessions.create({
-      customer: input.customerId,
-      return_url: input.returnUrl,
-      configuration: input.configuration
-    });
+    const session = await stripe.billingPortal.sessions.create(
+      {
+        customer: input.customerId,
+        return_url: input.returnUrl,
+        configuration: input.configuration
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(session);
   } catch (error) {
     return handleStripeError(error);
@@ -383,23 +571,28 @@ async function createPortalSession(input) {
 }
 
 // src/server/subscriptions/index.ts
-async function createSubscription(input) {
+async function createSubscription(input, options) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const items = input.items ? input.items.map((item) => ({ price: item.priceId, quantity: item.quantity })) : [{ price: input.priceId, quantity: input.quantity ?? 1 }];
-    const subscription = await stripe.subscriptions.create({
-      customer: input.customerId,
-      items,
-      metadata: input.metadata,
-      trial_period_days: input.trialPeriodDays,
-      coupon: input.couponId,
-      promotion_code: input.promotionCodeId,
-      payment_behavior: input.paymentBehavior ?? "default_incomplete",
-      cancel_at_period_end: input.cancelAtPeriodEnd,
-      billing_cycle_anchor: input.billingCycleAnchor,
-      proration_behavior: input.prorationBehavior,
-      expand: ["latest_invoice.payment_intent"]
-    });
+    const subscription = await stripe.subscriptions.create(
+      {
+        customer: input.customerId,
+        items,
+        metadata: input.metadata,
+        trial_period_days: input.trialPeriodDays,
+        coupon: input.couponId,
+        promotion_code: input.promotionCodeId,
+        payment_behavior: input.paymentBehavior ?? "default_incomplete",
+        cancel_at_period_end: input.cancelAtPeriodEnd,
+        billing_cycle_anchor: input.billingCycleAnchor,
+        proration_behavior: input.prorationBehavior,
+        expand: ["latest_invoice.payment_intent"]
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(subscription);
   } catch (error) {
     return handleStripeError(error);
@@ -407,6 +600,7 @@ async function createSubscription(input) {
 }
 async function retrieveSubscription(subscriptionId) {
   try {
+    validateStripeId(subscriptionId, "subscription");
     const stripe = getStripe();
     const subscription = await stripe.subscriptions.retrieve(subscriptionId, {
       expand: ["latest_invoice.payment_intent", "default_payment_method"]
@@ -418,6 +612,8 @@ async function retrieveSubscription(subscriptionId) {
 }
 async function updateSubscription(input) {
   try {
+    validateStripeId(input.subscriptionId, "subscription");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const params = {
       metadata: input.metadata,
@@ -440,6 +636,7 @@ async function updateSubscription(input) {
 }
 async function cancelSubscription(input) {
   try {
+    validateStripeId(input.subscriptionId, "subscription");
     const stripe = getStripe();
     if (input.cancelAtPeriodEnd) {
       const subscription2 = await stripe.subscriptions.update(input.subscriptionId, {
@@ -464,6 +661,7 @@ async function cancelSubscription(input) {
 }
 async function resumeSubscription(subscriptionId) {
   try {
+    validateStripeId(subscriptionId, "subscription");
     const stripe = getStripe();
     const subscription = await stripe.subscriptions.update(subscriptionId, {
       cancel_at_period_end: false
@@ -475,9 +673,10 @@ async function resumeSubscription(subscriptionId) {
 }
 async function listSubscriptions(input) {
   try {
+    if (input?.customerId) validateStripeId(input.customerId, "customer");
     const stripe = getStripe();
     const subscriptions = await stripe.subscriptions.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       customer: input?.customerId,
@@ -490,24 +689,32 @@ async function listSubscriptions(input) {
 }
 
 // src/server/products/index.ts
-async function createProduct(input) {
+async function createProduct(input, options) {
   try {
+    if (input.metadata) validateMetadata(input.metadata);
+    if (input.defaultPriceData) {
+      validateAmount(input.defaultPriceData.unitAmount, "unitAmount");
+      validateCurrency(input.defaultPriceData.currency);
+    }
     const stripe = getStripe();
-    const product = await stripe.products.create({
-      name: input.name,
-      description: input.description,
-      images: input.images,
-      metadata: input.metadata,
-      active: input.active,
-      default_price_data: input.defaultPriceData ? {
-        unit_amount: input.defaultPriceData.unitAmount,
-        currency: input.defaultPriceData.currency,
-        recurring: input.defaultPriceData.recurring ? {
-          interval: input.defaultPriceData.recurring.interval,
-          interval_count: input.defaultPriceData.recurring.intervalCount
+    const product = await stripe.products.create(
+      {
+        name: input.name,
+        description: input.description,
+        images: input.images,
+        metadata: input.metadata,
+        active: input.active,
+        default_price_data: input.defaultPriceData ? {
+          unit_amount: input.defaultPriceData.unitAmount,
+          currency: input.defaultPriceData.currency,
+          recurring: input.defaultPriceData.recurring ? {
+            interval: input.defaultPriceData.recurring.interval,
+            interval_count: input.defaultPriceData.recurring.intervalCount
+          } : void 0
         } : void 0
-      } : void 0
-    });
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(product);
   } catch (error) {
     return handleStripeError(error);
@@ -515,6 +722,7 @@ async function createProduct(input) {
 }
 async function retrieveProduct(productId) {
   try {
+    validateStripeId(productId, "product");
     const stripe = getStripe();
     const product = await stripe.products.retrieve(productId);
     return success(product);
@@ -524,6 +732,8 @@ async function retrieveProduct(productId) {
 }
 async function updateProduct(input) {
   try {
+    validateStripeId(input.productId, "product");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const product = await stripe.products.update(input.productId, {
       name: input.name,
@@ -539,6 +749,7 @@ async function updateProduct(input) {
 }
 async function archiveProduct(productId) {
   try {
+    validateStripeId(productId, "product");
     const stripe = getStripe();
     const product = await stripe.products.update(productId, { active: false });
     return success(product);
@@ -550,7 +761,7 @@ async function listProducts(input) {
   try {
     const stripe = getStripe();
     const products = await stripe.products.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       active: input?.active
@@ -560,8 +771,12 @@ async function listProducts(input) {
     return handleStripeError(error);
   }
 }
-async function createPrice(input) {
+async function createPrice(input, options) {
   try {
+    validateStripeId(input.productId, "product");
+    validateCurrency(input.currency);
+    if (input.unitAmount !== void 0) validateAmount(input.unitAmount, "unitAmount");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const params = {
       product: input.productId,
@@ -589,7 +804,10 @@ async function createPrice(input) {
     } else {
       params.unit_amount = input.unitAmount;
     }
-    const price = await stripe.prices.create(params);
+    const price = await stripe.prices.create(
+      params,
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(price);
   } catch (error) {
     return handleStripeError(error);
@@ -597,6 +815,7 @@ async function createPrice(input) {
 }
 async function retrievePrice(priceId) {
   try {
+    validateStripeId(priceId, "price");
     const stripe = getStripe();
     const price = await stripe.prices.retrieve(priceId);
     return success(price);
@@ -606,9 +825,10 @@ async function retrievePrice(priceId) {
 }
 async function listPrices(input) {
   try {
+    if (input?.productId) validateStripeId(input.productId, "product");
     const stripe = getStripe();
     const prices = await stripe.prices.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       product: input?.productId,
@@ -622,6 +842,7 @@ async function listPrices(input) {
 }
 async function archivePrice(priceId) {
   try {
+    validateStripeId(priceId, "price");
     const stripe = getStripe();
     const price = await stripe.prices.update(priceId, { active: false });
     return success(price);
@@ -631,17 +852,22 @@ async function archivePrice(priceId) {
 }
 
 // src/server/invoices/index.ts
-async function createInvoice(input) {
-  try {
-    const stripe = getStripe();
-    const invoice = await stripe.invoices.create({
-      customer: input.customerId,
-      collection_method: input.collectionMethod ?? "charge_automatically",
-      days_until_due: input.daysUntilDue,
-      metadata: input.metadata,
-      description: input.description,
-      auto_advance: input.autoAdvance
-    });
+async function createInvoice(input, options) {
+  try {
+    validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const invoice = await stripe.invoices.create(
+      {
+        customer: input.customerId,
+        collection_method: input.collectionMethod ?? "charge_automatically",
+        days_until_due: input.daysUntilDue,
+        metadata: input.metadata,
+        description: input.description,
+        auto_advance: input.autoAdvance
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(invoice);
   } catch (error) {
     return handleStripeError(error);
@@ -649,6 +875,7 @@ async function createInvoice(input) {
 }
 async function retrieveInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.retrieve(invoiceId);
     return success(invoice);
@@ -658,6 +885,7 @@ async function retrieveInvoice(invoiceId) {
 }
 async function finalizeInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.finalizeInvoice(invoiceId);
     return success(invoice);
@@ -667,6 +895,7 @@ async function finalizeInvoice(invoiceId) {
 }
 async function sendInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.sendInvoice(invoiceId);
     return success(invoice);
@@ -676,6 +905,7 @@ async function sendInvoice(invoiceId) {
 }
 async function payInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.pay(invoiceId);
     return success(invoice);
@@ -685,6 +915,7 @@ async function payInvoice(invoiceId) {
 }
 async function voidInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.voidInvoice(invoiceId);
     return success(invoice);
@@ -694,9 +925,10 @@ async function voidInvoice(invoiceId) {
 }
 async function listInvoices(input) {
   try {
+    if (input?.customerId) validateStripeId(input.customerId, "customer");
     const stripe = getStripe();
     const invoices = await stripe.invoices.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       customer: input?.customerId,
@@ -709,6 +941,8 @@ async function listInvoices(input) {
 }
 async function getUpcomingInvoice(customerId, subscriptionId) {
   try {
+    validateStripeId(customerId, "customer");
+    if (subscriptionId) validateStripeId(subscriptionId, "subscription");
     const stripe = getStripe();
     const invoice = await stripe.invoices.retrieveUpcoming({
       customer: customerId,
@@ -719,19 +953,28 @@ async function getUpcomingInvoice(customerId, subscriptionId) {
     return handleStripeError(error);
   }
 }
-async function createInvoiceItem(input) {
+async function createInvoiceItem(input, options) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.invoiceId) validateStripeId(input.invoiceId, "invoice");
+    if (input.priceId) validateStripeId(input.priceId, "price");
+    if (input.amount !== void 0) validateAmount(input.amount, "invoice item amount");
+    if (input.currency) validateCurrency(input.currency);
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const invoiceItem = await stripe.invoiceItems.create({
-      customer: input.customerId,
-      invoice: input.invoiceId,
-      price: input.priceId,
-      amount: input.amount,
-      currency: input.currency,
-      description: input.description,
-      quantity: input.quantity,
-      metadata: input.metadata
-    });
+    const invoiceItem = await stripe.invoiceItems.create(
+      {
+        customer: input.customerId,
+        invoice: input.invoiceId,
+        price: input.priceId,
+        amount: input.amount,
+        currency: input.currency,
+        description: input.description,
+        quantity: input.quantity,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(invoiceItem);
   } catch (error) {
     return handleStripeError(error);
@@ -739,16 +982,22 @@ async function createInvoiceItem(input) {
 }
 
 // src/server/refunds/index.ts
-async function createRefund(input) {
-  try {
-    const stripe = getStripe();
-    const refund = await stripe.refunds.create({
-      payment_intent: input.paymentIntentId,
-      charge: input.chargeId,
-      amount: input.amount,
-      reason: input.reason,
-      metadata: input.metadata
-    });
+async function createRefund(input, options) {
+  try {
+    if (input.paymentIntentId) validateStripeId(input.paymentIntentId, "paymentIntent");
+    if (input.amount !== void 0) validateAmount(input.amount, "refund amount");
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const refund = await stripe.refunds.create(
+      {
+        payment_intent: input.paymentIntentId,
+        charge: input.chargeId,
+        amount: input.amount,
+        reason: input.reason,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(refund);
   } catch (error) {
     return handleStripeError(error);
@@ -756,6 +1005,7 @@ async function createRefund(input) {
 }
 async function retrieveRefund(refundId) {
   try {
+    validateStripeId(refundId, "refund");
     const stripe = getStripe();
     const refund = await stripe.refunds.retrieve(refundId);
     return success(refund);
@@ -765,9 +1015,10 @@ async function retrieveRefund(refundId) {
 }
 async function listRefunds(input) {
   try {
+    if (input?.paymentIntentId) validateStripeId(input.paymentIntentId, "paymentIntent");
     const stripe = getStripe();
     const refunds = await stripe.refunds.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       payment_intent: input?.paymentIntentId,
@@ -780,6 +1031,7 @@ async function listRefunds(input) {
 }
 async function retrieveDispute(disputeId) {
   try {
+    validateStripeId(disputeId, "dispute");
     const stripe = getStripe();
     const dispute = await stripe.disputes.retrieve(disputeId);
     return success(dispute);
@@ -789,6 +1041,8 @@ async function retrieveDispute(disputeId) {
 }
 async function updateDispute(input) {
   try {
+    validateStripeId(input.disputeId, "dispute");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const dispute = await stripe.disputes.update(input.disputeId, {
       evidence: input.evidence ? {
@@ -810,6 +1064,7 @@ async function updateDispute(input) {
 }
 async function closeDispute(disputeId) {
   try {
+    validateStripeId(disputeId, "dispute");
     const stripe = getStripe();
     const dispute = await stripe.disputes.close(disputeId);
     return success(dispute);
@@ -821,7 +1076,7 @@ async function listDisputes(input) {
   try {
     const stripe = getStripe();
     const disputes = await stripe.disputes.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -832,17 +1087,21 @@ async function listDisputes(input) {
 }
 
 // src/server/connect/index.ts
-async function createConnectAccount(input) {
-  try {
-    const stripe = getStripe();
-    const account = await stripe.accounts.create({
-      type: input.type,
-      country: input.country,
-      email: input.email,
-      capabilities: input.capabilities,
-      business_type: input.businessType,
-      metadata: input.metadata
-    });
+async function createConnectAccount(input, options) {
+  try {
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const account = await stripe.accounts.create(
+      {
+        type: input.type,
+        country: input.country,
+        email: input.email,
+        capabilities: input.capabilities,
+        business_type: input.businessType,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(account);
   } catch (error) {
     return handleStripeError(error);
@@ -850,6 +1109,7 @@ async function createConnectAccount(input) {
 }
 async function retrieveConnectAccount(accountId) {
   try {
+    validateStripeId(accountId, "account");
     const stripe = getStripe();
     const account = await stripe.accounts.retrieve(accountId);
     return success(account);
@@ -859,6 +1119,7 @@ async function retrieveConnectAccount(accountId) {
 }
 async function deleteConnectAccount(accountId) {
   try {
+    validateStripeId(accountId, "account");
     const stripe = getStripe();
     const deleted = await stripe.accounts.del(accountId);
     return success(deleted);
@@ -870,7 +1131,7 @@ async function listConnectAccounts(input) {
   try {
     const stripe = getStripe();
     const accounts = await stripe.accounts.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -881,6 +1142,9 @@ async function listConnectAccounts(input) {
 }
 async function createAccountLink(input) {
   try {
+    validateStripeId(input.accountId, "account");
+    validateUrl(input.refreshUrl, "refreshUrl");
+    validateUrl(input.returnUrl, "returnUrl");
     const stripe = getStripe();
     const accountLink = await stripe.accountLinks.create({
       account: input.accountId,
@@ -893,17 +1157,24 @@ async function createAccountLink(input) {
     return handleStripeError(error);
   }
 }
-async function createTransfer(input) {
+async function createTransfer(input, options) {
   try {
+    validateAmount(input.amount, "transfer amount");
+    validateCurrency(input.currency);
+    validateStripeId(input.destinationAccountId, "account");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const transfer = await stripe.transfers.create({
-      amount: input.amount,
-      currency: input.currency,
-      destination: input.destinationAccountId,
-      description: input.description,
-      metadata: input.metadata,
-      source_transaction: input.sourceTransaction
-    });
+    const transfer = await stripe.transfers.create(
+      {
+        amount: input.amount,
+        currency: input.currency,
+        destination: input.destinationAccountId,
+        description: input.description,
+        metadata: input.metadata,
+        source_transaction: input.sourceTransaction
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(transfer);
   } catch (error) {
     return handleStripeError(error);
@@ -911,9 +1182,10 @@ async function createTransfer(input) {
 }
 async function listTransfers(input) {
   try {
+    if (input?.destinationAccountId) validateStripeId(input.destinationAccountId, "account");
     const stripe = getStripe();
     const transfers = await stripe.transfers.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       destination: input?.destinationAccountId
@@ -923,14 +1195,20 @@ async function listTransfers(input) {
     return handleStripeError(error);
   }
 }
-async function createPayout(amount, currency, metadata) {
+async function createPayout(amount, currency, metadata, options) {
   try {
+    validateAmount(amount, "payout amount");
+    const normalizedCurrency = validateCurrency(currency);
+    if (metadata) validateMetadata(metadata);
     const stripe = getStripe();
-    const payout = await stripe.payouts.create({
-      amount,
-      currency,
-      metadata
-    });
+    const payout = await stripe.payouts.create(
+      {
+        amount,
+        currency: normalizedCurrency,
+        metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(payout);
   } catch (error) {
     return handleStripeError(error);
@@ -940,7 +1218,7 @@ async function listPayouts(input) {
   try {
     const stripe = getStripe();
     const payouts = await stripe.payouts.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       status: input?.status
@@ -963,7 +1241,7 @@ async function listBalanceTransactions(input) {
   try {
     const stripe = getStripe();
     const transactions = await stripe.balanceTransactions.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       type: input?.type
@@ -975,20 +1253,26 @@ async function listBalanceTransactions(input) {
 }
 
 // src/server/coupons/index.ts
-async function createCoupon(input) {
-  try {
-    const stripe = getStripe();
-    const coupon = await stripe.coupons.create({
-      percent_off: input.percentOff,
-      amount_off: input.amountOff,
-      currency: input.currency,
-      duration: input.duration,
-      duration_in_months: input.durationInMonths,
-      max_redemptions: input.maxRedemptions,
-      redeem_by: input.redeemBy,
-      name: input.name,
-      metadata: input.metadata
-    });
+async function createCoupon(input, options) {
+  try {
+    if (input.amountOff !== void 0) validateAmount(input.amountOff, "amountOff");
+    if (input.currency) validateCurrency(input.currency);
+    if (input.metadata) validateMetadata(input.metadata);
+    const stripe = getStripe();
+    const coupon = await stripe.coupons.create(
+      {
+        percent_off: input.percentOff,
+        amount_off: input.amountOff,
+        currency: input.currency,
+        duration: input.duration,
+        duration_in_months: input.durationInMonths,
+        max_redemptions: input.maxRedemptions,
+        redeem_by: input.redeemBy,
+        name: input.name,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(coupon);
   } catch (error) {
     return handleStripeError(error);
@@ -996,6 +1280,7 @@ async function createCoupon(input) {
 }
 async function retrieveCoupon(couponId) {
   try {
+    validateStripeId(couponId, "coupon");
     const stripe = getStripe();
     const coupon = await stripe.coupons.retrieve(couponId);
     return success(coupon);
@@ -1005,6 +1290,7 @@ async function retrieveCoupon(couponId) {
 }
 async function deleteCoupon(couponId) {
   try {
+    validateStripeId(couponId, "coupon");
     const stripe = getStripe();
     const deleted = await stripe.coupons.del(couponId);
     return success(deleted);
@@ -1016,7 +1302,7 @@ async function listCoupons(input) {
   try {
     const stripe = getStripe();
     const coupons = await stripe.coupons.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -1025,22 +1311,32 @@ async function listCoupons(input) {
     return handleStripeError(error);
   }
 }
-async function createPromotionCode(input) {
+async function createPromotionCode(input, options) {
   try {
+    if (input.metadata) validateMetadata(input.metadata);
+    if (input.restrictions?.minimumAmountCurrency) {
+      validateCurrency(input.restrictions.minimumAmountCurrency);
+    }
+    if (input.restrictions?.minimumAmount !== void 0) {
+      validateAmount(input.restrictions.minimumAmount, "minimumAmount");
+    }
     const stripe = getStripe();
-    const promotionCode = await stripe.promotionCodes.create({
-      coupon: input.couponId,
-      code: input.code,
-      active: input.active,
-      max_redemptions: input.maxRedemptions,
-      expires_at: input.expiresAt,
-      metadata: input.metadata,
-      restrictions: input.restrictions ? {
-        first_time_transaction: input.restrictions.firstTimeTransaction,
-        minimum_amount: input.restrictions.minimumAmount,
-        minimum_amount_currency: input.restrictions.minimumAmountCurrency
-      } : void 0
-    });
+    const promotionCode = await stripe.promotionCodes.create(
+      {
+        coupon: input.couponId,
+        code: input.code,
+        active: input.active,
+        max_redemptions: input.maxRedemptions,
+        expires_at: input.expiresAt,
+        metadata: input.metadata,
+        restrictions: input.restrictions ? {
+          first_time_transaction: input.restrictions.firstTimeTransaction,
+          minimum_amount: input.restrictions.minimumAmount,
+          minimum_amount_currency: input.restrictions.minimumAmountCurrency
+        } : void 0
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(promotionCode);
   } catch (error) {
     return handleStripeError(error);
@@ -1048,6 +1344,7 @@ async function createPromotionCode(input) {
 }
 async function retrievePromotionCode(promotionCodeId) {
   try {
+    validateStripeId(promotionCodeId, "promotionCode");
     const stripe = getStripe();
     const promotionCode = await stripe.promotionCodes.retrieve(promotionCodeId);
     return success(promotionCode);
@@ -1059,7 +1356,7 @@ async function listPromotionCodes(input) {
   try {
     const stripe = getStripe();
     const promotionCodes = await stripe.promotionCodes.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       coupon: input?.couponId,
@@ -1113,6 +1410,9 @@ function createWebhookHandler(config) {
 function createNextWebhookHandler(config) {
   const handler = createWebhookHandler(config);
   return async function POST(request) {
+    if (request.method !== "POST") {
+      return new Response(null, { status: 405 });
+    }
     try {
       const contentLength = request.headers.get("content-length");
       if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) {
@@ -1122,6 +1422,12 @@ function createNextWebhookHandler(config) {
         });
       }
       const body = await request.text();
+      if (body.length > MAX_BODY_SIZE) {
+        return new Response(JSON.stringify({ error: "Webhook body too large" }), {
+          status: 413,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
       const signature = request.headers.get("stripe-signature");
       if (!signature) {
         return new Response(JSON.stringify({ error: "Missing stripe-signature header" }), {
@@ -1135,8 +1441,8 @@ function createNextWebhookHandler(config) {
         headers: { "Content-Type": "application/json" }
       });
     } catch (error) {
-      const message = error instanceof Error ? error.message : "Webhook handler failed";
-      return new Response(JSON.stringify({ error: message }), {
+      console.error("[@stripe-sdk/core] Webhook error:", error instanceof Error ? error.message : "Unknown error");
+      return new Response(JSON.stringify({ error: "Webhook processing failed" }), {
         status: 400,
         headers: { "Content-Type": "application/json" }
       });
@@ -1160,8 +1466,8 @@ function createPagesWebhookHandler(webhookConfig) {
       const result = await handler(body, signature);
       res.status(200).json(result);
     } catch (error) {
-      const message = error instanceof Error ? error.message : "Webhook handler failed";
-      res.status(400).json({ error: message });
+      console.error("[@stripe-sdk/core] Webhook error:", error instanceof Error ? error.message : "Unknown error");
+      res.status(400).json({ error: "Webhook processing failed" });
     }
   };
 }
@@ -1189,20 +1495,23 @@ function getRawBody(req) {
     }
     const chunks = [];
     let totalLength = 0;
+    let rejected = false;
     req.on("data", (chunk) => {
+      if (rejected) return;
       const buf = Buffer.from(chunk);
       totalLength += buf.length;
       if (totalLength > MAX_BODY_SIZE) {
+        rejected = true;
         reject(new Error("Webhook body too large"));
         return;
       }
       chunks.push(buf);
     });
-    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => {
+      if (!rejected) resolve(Buffer.concat(chunks).toString("utf8"));
+    });
     req.on("error", reject);
   });
 }
 
 export { archivePrice, archiveProduct, attachPaymentMethod, cancelPaymentIntent, cancelSubscription, closeDispute, confirmPaymentIntent, createAccountLink, createCheckoutSession, createConnectAccount, createCoupon, createCustomer, createInvoice, createInvoiceItem, createNextWebhookHandler, createPagesWebhookHandler, createPaymentIntent, createPaymentLink, createPayout, createPortalSession, createPrice, createProduct, createPromotionCode, createRefund, createSetupIntent, createSubscription, createTransfer, createWebhookHandler, deleteConnectAccount, deleteCoupon, deleteCustomer, detachPaymentMethod, finalizeInvoice, getBalance, getConfig, getStripe, getUpcomingInvoice, initStripe, listBalanceTransactions, listCheckoutSessions, listConnectAccounts, listCoupons, listCustomers, listDisputes, listInvoices, listPaymentIntents, listPaymentMethods, listPayouts, listPrices, listProducts, listPromotionCodes, listRefunds, listSubscriptions, listTransfers, payInvoice, resumeSubscription, retrieveCheckoutSession, retrieveConnectAccount, retrieveCoupon, retrieveCustomer, retrieveDispute, retrieveInvoice, retrievePaymentIntent, retrievePaymentLink, retrievePrice, retrieveProduct, retrievePromotionCode, retrieveRefund, retrieveSetupIntent, retrieveSubscription, searchCustomers, sendInvoice, updateCustomer, updateDispute, updateProduct, updateSubscription, voidInvoice };
-//# sourceMappingURL=index.mjs.map
-//# sourceMappingURL=index.mjs.map