@stripe-sdk/core 1.0.0 → 1.0.2

package/dist/index.js

@@ -14,12 +14,16 @@ var Stripe__default = /*#__PURE__*/_interopDefault(Stripe);
 var stripeInstance = null;
 var currentConfig = null;
 function initStripe(config) {
+  if (stripeInstance) {
+    console.warn("[@stripe-sdk/core] Stripe is already initialized. Re-initializing with new config.");
+  }
   currentConfig = config;
   stripeInstance = new Stripe__default.default(config.secretKey, {
     apiVersion: config.apiVersion ?? "2025-01-27.acacia",
+    maxNetworkRetries: config.maxNetworkRetries ?? 2,
     appInfo: config.appInfo ?? {
       name: "@stripe-sdk/core",
-      version: "1.0.0"
+      version: "1.0.1"
     }
   });
   return stripeInstance;
@@ -38,17 +42,27 @@ function getConfig() {
       "[@stripe-sdk/core] Stripe not initialized. Call initStripe({ secretKey, publishableKey }) first."
     );
   }
-  return currentConfig;
+  const { secretKey: _sk, ...safeConfig } = currentConfig;
+  return safeConfig;
 }
 
 // src/utils/errors.ts
+var SAFE_ERROR_MESSAGES = {
+  card_declined: "Your card was declined.",
+  expired_card: "Your card has expired.",
+  incorrect_cvc: "Incorrect security code.",
+  processing_error: "An error occurred while processing your card.",
+  incorrect_number: "The card number is incorrect.",
+  insufficient_funds: "Insufficient funds."
+};
 function handleStripeError(error) {
   if (error?.type) {
     const stripeError = error;
+    const safeMessage = stripeError.code && SAFE_ERROR_MESSAGES[stripeError.code] || getSafeMessage(stripeError.type);
     return {
       data: null,
       error: {
-        message: stripeError.message,
+        message: safeMessage,
         type: stripeError.type,
         code: stripeError.code,
         statusCode: stripeError.statusCode
@@ -58,31 +72,147 @@ function handleStripeError(error) {
   return {
     data: null,
     error: {
-      message: error instanceof Error ? error.message : "An unknown error occurred",
+      message: "An unexpected error occurred",
       type: "sdk_error"
     }
   };
 }
+function getSafeMessage(type) {
+  switch (type) {
+    case "card_error":
+      return "A card error occurred.";
+    case "invalid_request_error":
+      return "Invalid request. Please check your input.";
+    case "authentication_error":
+      return "Authentication failed.";
+    case "rate_limit_error":
+      return "Too many requests. Please try again later.";
+    case "api_error":
+      return "A payment processing error occurred. Please try again.";
+    default:
+      return "An unexpected error occurred.";
+  }
+}
 function success(data) {
   return { data, error: null };
 }
 
+// src/utils/validators.ts
+var STRIPE_ID_PREFIXES = {
+  customer: "cus_",
+  paymentIntent: "pi_",
+  paymentMethod: "pm_",
+  subscription: "sub_",
+  invoice: "in_",
+  invoiceItem: "ii_",
+  product: "prod_",
+  price: "price_",
+  coupon: "",
+  // coupons can have custom IDs
+  promotionCode: "promo_",
+  refund: "re_",
+  dispute: "dp_",
+  account: "acct_",
+  transfer: "tr_",
+  payout: "po_",
+  setupIntent: "seti_",
+  session: "cs_",
+  paymentLink: "plink_"
+};
+function validateStripeId(id, type) {
+  if (!id || typeof id !== "string") {
+    throw new Error(`${type} ID is required and must be a non-empty string`);
+  }
+  const prefix = STRIPE_ID_PREFIXES[type];
+  if (prefix && !id.startsWith(prefix)) {
+    throw new Error(`Invalid ${type} ID: expected prefix "${prefix}"`);
+  }
+}
+function validateAmount(amount, label = "amount") {
+  if (typeof amount !== "number" || !Number.isFinite(amount)) {
+    throw new Error(`${label} must be a finite number`);
+  }
+  if (!Number.isInteger(amount)) {
+    throw new Error(`${label} must be an integer (amount in smallest currency unit)`);
+  }
+  if (amount < 0) {
+    throw new Error(`${label} must not be negative`);
+  }
+  if (amount > 99999999) {
+    throw new Error(`${label} exceeds maximum allowed value (99999999)`);
+  }
+}
+function validateCurrency(currency) {
+  if (!currency || typeof currency !== "string") {
+    throw new Error("Currency is required");
+  }
+  const normalized = currency.trim().toLowerCase();
+  if (!/^[a-z]{3}$/.test(normalized)) {
+    throw new Error("Currency must be a valid 3-letter ISO 4217 code");
+  }
+  return normalized;
+}
+function validateUrl(url, label = "URL") {
+  if (!url || typeof url !== "string") {
+    throw new Error(`${label} is required`);
+  }
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new Error(`${label} must use http or https protocol`);
+    }
+  } catch (e) {
+    if (e instanceof Error && e.message.includes("protocol")) throw e;
+    throw new Error(`${label} must be a valid URL`);
+  }
+}
+function validateMetadata(metadata) {
+  const keys = Object.keys(metadata);
+  if (keys.length > 50) {
+    throw new Error("Metadata cannot have more than 50 keys");
+  }
+  for (const [key, value] of Object.entries(metadata)) {
+    if (key.length > 40) {
+      throw new Error(`Metadata key "${key}" exceeds 40 characters`);
+    }
+    if (typeof value !== "string") {
+      throw new Error(`Metadata value for key "${key}" must be a string`);
+    }
+    if (value.length > 500) {
+      throw new Error(`Metadata value for key "${key}" exceeds 500 characters`);
+    }
+  }
+}
+function sanitizeLimit(limit, defaultLimit = 10) {
+  if (limit === void 0) return defaultLimit;
+  return Math.min(Math.max(Math.floor(limit), 1), 100);
+}
+
 // src/server/payments/index.ts
-async function createPaymentIntent(input) {
+async function createPaymentIntent(input, options) {
   try {
+    validateAmount(input.amount);
+    const currency = validateCurrency(input.currency);
+    if (input.customerId) validateStripeId(input.customerId, "customer");
+    if (input.paymentMethodId) validateStripeId(input.paymentMethodId, "paymentMethod");
+    if (input.returnUrl) validateUrl(input.returnUrl, "returnUrl");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const paymentIntent = await stripe.paymentIntents.create({
-      amount: input.amount,
-      currency: input.currency,
-      customer: input.customerId,
-      payment_method: input.paymentMethodId,
-      metadata: input.metadata,
-      description: input.description,
-      receipt_email: input.receiptEmail,
-      setup_future_usage: input.setupFutureUsage,
-      automatic_payment_methods: input.automaticPaymentMethods === false || input.paymentMethodId ? void 0 : { enabled: true },
-      return_url: input.returnUrl
-    });
+    const paymentIntent = await stripe.paymentIntents.create(
+      {
+        amount: input.amount,
+        currency,
+        customer: input.customerId,
+        payment_method: input.paymentMethodId,
+        metadata: input.metadata,
+        description: input.description,
+        receipt_email: input.receiptEmail,
+        setup_future_usage: input.setupFutureUsage,
+        automatic_payment_methods: input.automaticPaymentMethods === false || input.paymentMethodId ? void 0 : { enabled: true },
+        return_url: input.returnUrl
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(paymentIntent);
   } catch (error) {
     return handleStripeError(error);
@@ -90,6 +220,7 @@ async function createPaymentIntent(input) {
 }
 async function retrievePaymentIntent(paymentIntentId) {
   try {
+    validateStripeId(paymentIntentId, "paymentIntent");
     const stripe = getStripe();
     const paymentIntent = await stripe.paymentIntents.retrieve(paymentIntentId);
     return success(paymentIntent);
@@ -99,6 +230,9 @@ async function retrievePaymentIntent(paymentIntentId) {
 }
 async function confirmPaymentIntent(input) {
   try {
+    validateStripeId(input.paymentIntentId, "paymentIntent");
+    if (input.paymentMethodId) validateStripeId(input.paymentMethodId, "paymentMethod");
+    if (input.returnUrl) validateUrl(input.returnUrl, "returnUrl");
     const stripe = getStripe();
     const paymentIntent = await stripe.paymentIntents.confirm(input.paymentIntentId, {
       payment_method: input.paymentMethodId,
@@ -111,6 +245,7 @@ async function confirmPaymentIntent(input) {
 }
 async function cancelPaymentIntent(paymentIntentId) {
   try {
+    validateStripeId(paymentIntentId, "paymentIntent");
     const stripe = getStripe();
     const paymentIntent = await stripe.paymentIntents.cancel(paymentIntentId);
     return success(paymentIntent);
@@ -120,9 +255,10 @@ async function cancelPaymentIntent(paymentIntentId) {
 }
 async function listPaymentIntents(input) {
   try {
+    if (input?.customerId) validateStripeId(input.customerId, "customer");
     const stripe = getStripe();
     const paymentIntents = await stripe.paymentIntents.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       customer: input?.customerId
@@ -132,28 +268,35 @@ async function listPaymentIntents(input) {
     return handleStripeError(error);
   }
 }
-async function createCheckoutSession(input) {
+async function createCheckoutSession(input, options) {
   try {
+    validateUrl(input.successUrl, "successUrl");
+    validateUrl(input.cancelUrl, "cancelUrl");
+    if (input.customerId) validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const session = await stripe.checkout.sessions.create({
-      mode: input.mode,
-      line_items: input.lineItems.map((item) => ({
-        price: item.priceId,
-        quantity: item.quantity
-      })),
-      success_url: input.successUrl,
-      cancel_url: input.cancelUrl,
-      customer: input.customerId,
-      customer_email: input.customerEmail,
-      metadata: input.metadata,
-      allow_promotion_codes: input.allowPromotionCodes,
-      shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0,
-      billing_address_collection: input.billingAddressCollection,
-      subscription_data: input.trialPeriodDays ? { trial_period_days: input.trialPeriodDays } : void 0,
-      tax_id_collection: input.taxIdCollection ? { enabled: true } : void 0,
-      automatic_tax: input.automaticTax ? { enabled: true } : void 0,
-      locale: input.locale
-    });
+    const session = await stripe.checkout.sessions.create(
+      {
+        mode: input.mode,
+        line_items: input.lineItems.map((item) => ({
+          price: item.priceId,
+          quantity: item.quantity
+        })),
+        success_url: input.successUrl,
+        cancel_url: input.cancelUrl,
+        customer: input.customerId,
+        customer_email: input.customerEmail,
+        metadata: input.metadata,
+        allow_promotion_codes: input.allowPromotionCodes,
+        shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0,
+        billing_address_collection: input.billingAddressCollection,
+        subscription_data: input.trialPeriodDays ? { trial_period_days: input.trialPeriodDays } : void 0,
+        tax_id_collection: input.taxIdCollection ? { enabled: true } : void 0,
+        automatic_tax: input.automaticTax ? { enabled: true } : void 0,
+        locale: input.locale
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(session);
   } catch (error) {
     return handleStripeError(error);
@@ -161,6 +304,7 @@ async function createCheckoutSession(input) {
 }
 async function retrieveCheckoutSession(sessionId) {
   try {
+    validateStripeId(sessionId, "session");
     const stripe = getStripe();
     const session = await stripe.checkout.sessions.retrieve(sessionId, {
       expand: ["line_items", "payment_intent", "subscription"]
@@ -174,7 +318,7 @@ async function listCheckoutSessions(input) {
   try {
     const stripe = getStripe();
     const sessions = await stripe.checkout.sessions.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -183,29 +327,36 @@ async function listCheckoutSessions(input) {
     return handleStripeError(error);
   }
 }
-async function createPaymentLink(input) {
+async function createPaymentLink(input, options) {
   try {
+    if (input.afterCompletion?.redirectUrl) {
+      validateUrl(input.afterCompletion.redirectUrl, "afterCompletion.redirectUrl");
+    }
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const paymentLink = await stripe.paymentLinks.create({
-      line_items: input.lineItems.map((item) => ({
-        price: item.priceId,
-        quantity: item.quantity,
-        adjustable_quantity: item.adjustableQuantity ? {
-          enabled: item.adjustableQuantity.enabled,
-          minimum: item.adjustableQuantity.minimum,
-          maximum: item.adjustableQuantity.maximum
-        } : void 0
-      })),
-      metadata: input.metadata,
-      after_completion: input.afterCompletion ? {
-        type: input.afterCompletion.type,
-        redirect: input.afterCompletion.redirectUrl ? { url: input.afterCompletion.redirectUrl } : void 0
-      } : void 0,
-      allow_promotion_codes: input.allowPromotionCodes,
-      automatic_tax: input.automaticTax ? { enabled: true } : void 0,
-      billing_address_collection: input.billingAddressCollection,
-      shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0
-    });
+    const paymentLink = await stripe.paymentLinks.create(
+      {
+        line_items: input.lineItems.map((item) => ({
+          price: item.priceId,
+          quantity: item.quantity,
+          adjustable_quantity: item.adjustableQuantity ? {
+            enabled: item.adjustableQuantity.enabled,
+            minimum: item.adjustableQuantity.minimum,
+            maximum: item.adjustableQuantity.maximum
+          } : void 0
+        })),
+        metadata: input.metadata,
+        after_completion: input.afterCompletion ? {
+          type: input.afterCompletion.type,
+          redirect: input.afterCompletion.redirectUrl ? { url: input.afterCompletion.redirectUrl } : void 0
+        } : void 0,
+        allow_promotion_codes: input.allowPromotionCodes,
+        automatic_tax: input.automaticTax ? { enabled: true } : void 0,
+        billing_address_collection: input.billingAddressCollection,
+        shipping_address_collection: input.shippingAddressCollection ? { allowed_countries: input.shippingAddressCollection.allowedCountries } : void 0
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(paymentLink);
   } catch (error) {
     return handleStripeError(error);
@@ -213,6 +364,7 @@ async function createPaymentLink(input) {
 }
 async function retrievePaymentLink(paymentLinkId) {
   try {
+    validateStripeId(paymentLinkId, "paymentLink");
     const stripe = getStripe();
     const paymentLink = await stripe.paymentLinks.retrieve(paymentLinkId);
     return success(paymentLink);
@@ -220,15 +372,20 @@ async function retrievePaymentLink(paymentLinkId) {
     return handleStripeError(error);
   }
 }
-async function createSetupIntent(input) {
+async function createSetupIntent(input, options) {
   try {
+    if (input.customerId) validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const setupIntent = await stripe.setupIntents.create({
-      customer: input.customerId,
-      payment_method_types: input.paymentMethodTypes,
-      usage: input.usage,
-      metadata: input.metadata
-    });
+    const setupIntent = await stripe.setupIntents.create(
+      {
+        customer: input.customerId,
+        payment_method_types: input.paymentMethodTypes,
+        usage: input.usage,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(setupIntent);
   } catch (error) {
     return handleStripeError(error);
@@ -236,6 +393,7 @@ async function createSetupIntent(input) {
 }
 async function retrieveSetupIntent(setupIntentId) {
   try {
+    validateStripeId(setupIntentId, "setupIntent");
     const stripe = getStripe();
     const setupIntent = await stripe.setupIntents.retrieve(setupIntentId);
     return success(setupIntent);
@@ -245,6 +403,7 @@ async function retrieveSetupIntent(setupIntentId) {
 }
 async function listPaymentMethods(customerId, type) {
   try {
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const paymentMethods = await stripe.paymentMethods.list({
       customer: customerId,
@@ -257,6 +416,8 @@ async function listPaymentMethods(customerId, type) {
 }
 async function attachPaymentMethod(paymentMethodId, customerId) {
   try {
+    validateStripeId(paymentMethodId, "paymentMethod");
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const paymentMethod = await stripe.paymentMethods.attach(paymentMethodId, {
       customer: customerId
@@ -268,6 +429,7 @@ async function attachPaymentMethod(paymentMethodId, customerId) {
 }
 async function detachPaymentMethod(paymentMethodId) {
   try {
+    validateStripeId(paymentMethodId, "paymentMethod");
     const stripe = getStripe();
     const paymentMethod = await stripe.paymentMethods.detach(paymentMethodId);
     return success(paymentMethod);
@@ -277,26 +439,31 @@ async function detachPaymentMethod(paymentMethodId) {
 }
 
 // src/server/customers/index.ts
-async function createCustomer(input) {
+async function createCustomer(input, options) {
   try {
+    if (input.paymentMethodId) validateStripeId(input.paymentMethodId, "paymentMethod");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const customer = await stripe.customers.create({
-      email: input.email,
-      name: input.name,
-      phone: input.phone,
-      description: input.description,
-      metadata: input.metadata,
-      payment_method: input.paymentMethodId,
-      invoice_settings: input.paymentMethodId ? { default_payment_method: input.paymentMethodId } : void 0,
-      address: input.address ? {
-        line1: input.address.line1,
-        line2: input.address.line2,
-        city: input.address.city,
-        state: input.address.state,
-        postal_code: input.address.postalCode,
-        country: input.address.country
-      } : void 0
-    });
+    const customer = await stripe.customers.create(
+      {
+        email: input.email,
+        name: input.name,
+        phone: input.phone,
+        description: input.description,
+        metadata: input.metadata,
+        payment_method: input.paymentMethodId,
+        invoice_settings: input.paymentMethodId ? { default_payment_method: input.paymentMethodId } : void 0,
+        address: input.address ? {
+          line1: input.address.line1,
+          line2: input.address.line2,
+          city: input.address.city,
+          state: input.address.state,
+          postal_code: input.address.postalCode,
+          country: input.address.country
+        } : void 0
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(customer);
   } catch (error) {
     return handleStripeError(error);
@@ -304,6 +471,7 @@ async function createCustomer(input) {
 }
 async function retrieveCustomer(customerId) {
   try {
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const customer = await stripe.customers.retrieve(customerId, {
       expand: ["subscriptions", "sources"]
@@ -321,6 +489,9 @@ async function retrieveCustomer(customerId) {
 }
 async function updateCustomer(input) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.defaultPaymentMethodId) validateStripeId(input.defaultPaymentMethodId, "paymentMethod");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const customer = await stripe.customers.update(input.customerId, {
       email: input.email,
@@ -345,6 +516,7 @@ async function updateCustomer(input) {
 }
 async function deleteCustomer(customerId) {
   try {
+    validateStripeId(customerId, "customer");
     const stripe = getStripe();
     const deleted = await stripe.customers.del(customerId);
     return success(deleted);
@@ -356,7 +528,7 @@ async function listCustomers(input) {
   try {
     const stripe = getStripe();
     const customers = await stripe.customers.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       email: input?.email
@@ -366,26 +538,42 @@ async function listCustomers(input) {
     return handleStripeError(error);
   }
 }
-async function searchCustomers(query, limit) {
+async function searchCustomers(input) {
   try {
+    const clauses = [];
+    if (input.email) clauses.push(`email:"${input.email.replace(/"/g, "")}"`);
+    if (input.name) clauses.push(`name:"${input.name.replace(/"/g, "")}"`);
+    if (input.phone) clauses.push(`phone:"${input.phone.replace(/"/g, "")}"`);
+    if (clauses.length === 0) {
+      return {
+        data: null,
+        error: { message: "At least one search field (email, name, phone) is required", type: "invalid_request_error" }
+      };
+    }
+    const query = clauses.join(" AND ");
     const stripe = getStripe();
     const customers = await stripe.customers.search({
       query,
-      limit: limit ?? 10
+      limit: sanitizeLimit(input.limit)
     });
     return success(customers);
   } catch (error) {
     return handleStripeError(error);
   }
 }
-async function createPortalSession(input) {
+async function createPortalSession(input, options) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.returnUrl) validateUrl(input.returnUrl, "returnUrl");
     const stripe = getStripe();
-    const session = await stripe.billingPortal.sessions.create({
-      customer: input.customerId,
-      return_url: input.returnUrl,
-      configuration: input.configuration
-    });
+    const session = await stripe.billingPortal.sessions.create(
+      {
+        customer: input.customerId,
+        return_url: input.returnUrl,
+        configuration: input.configuration
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(session);
   } catch (error) {
     return handleStripeError(error);
@@ -393,23 +581,28 @@ async function createPortalSession(input) {
 }
 
 // src/server/subscriptions/index.ts
-async function createSubscription(input) {
+async function createSubscription(input, options) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const items = input.items ? input.items.map((item) => ({ price: item.priceId, quantity: item.quantity })) : [{ price: input.priceId, quantity: input.quantity ?? 1 }];
-    const subscription = await stripe.subscriptions.create({
-      customer: input.customerId,
-      items,
-      metadata: input.metadata,
-      trial_period_days: input.trialPeriodDays,
-      coupon: input.couponId,
-      promotion_code: input.promotionCodeId,
-      payment_behavior: input.paymentBehavior ?? "default_incomplete",
-      cancel_at_period_end: input.cancelAtPeriodEnd,
-      billing_cycle_anchor: input.billingCycleAnchor,
-      proration_behavior: input.prorationBehavior,
-      expand: ["latest_invoice.payment_intent"]
-    });
+    const subscription = await stripe.subscriptions.create(
+      {
+        customer: input.customerId,
+        items,
+        metadata: input.metadata,
+        trial_period_days: input.trialPeriodDays,
+        coupon: input.couponId,
+        promotion_code: input.promotionCodeId,
+        payment_behavior: input.paymentBehavior ?? "default_incomplete",
+        cancel_at_period_end: input.cancelAtPeriodEnd,
+        billing_cycle_anchor: input.billingCycleAnchor,
+        proration_behavior: input.prorationBehavior,
+        expand: ["latest_invoice.payment_intent"]
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(subscription);
   } catch (error) {
     return handleStripeError(error);
@@ -417,6 +610,7 @@ async function createSubscription(input) {
 }
 async function retrieveSubscription(subscriptionId) {
   try {
+    validateStripeId(subscriptionId, "subscription");
     const stripe = getStripe();
     const subscription = await stripe.subscriptions.retrieve(subscriptionId, {
       expand: ["latest_invoice.payment_intent", "default_payment_method"]
@@ -428,6 +622,8 @@ async function retrieveSubscription(subscriptionId) {
 }
 async function updateSubscription(input) {
   try {
+    validateStripeId(input.subscriptionId, "subscription");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const params = {
       metadata: input.metadata,
@@ -450,6 +646,7 @@ async function updateSubscription(input) {
 }
 async function cancelSubscription(input) {
   try {
+    validateStripeId(input.subscriptionId, "subscription");
     const stripe = getStripe();
     if (input.cancelAtPeriodEnd) {
       const subscription2 = await stripe.subscriptions.update(input.subscriptionId, {
@@ -474,6 +671,7 @@ async function cancelSubscription(input) {
 }
 async function resumeSubscription(subscriptionId) {
   try {
+    validateStripeId(subscriptionId, "subscription");
     const stripe = getStripe();
     const subscription = await stripe.subscriptions.update(subscriptionId, {
       cancel_at_period_end: false
@@ -485,9 +683,10 @@ async function resumeSubscription(subscriptionId) {
 }
 async function listSubscriptions(input) {
   try {
+    if (input?.customerId) validateStripeId(input.customerId, "customer");
     const stripe = getStripe();
     const subscriptions = await stripe.subscriptions.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       customer: input?.customerId,
@@ -500,24 +699,32 @@ async function listSubscriptions(input) {
 }
 
 // src/server/products/index.ts
-async function createProduct(input) {
+async function createProduct(input, options) {
   try {
+    if (input.metadata) validateMetadata(input.metadata);
+    if (input.defaultPriceData) {
+      validateAmount(input.defaultPriceData.unitAmount, "unitAmount");
+      validateCurrency(input.defaultPriceData.currency);
+    }
     const stripe = getStripe();
-    const product = await stripe.products.create({
-      name: input.name,
-      description: input.description,
-      images: input.images,
-      metadata: input.metadata,
-      active: input.active,
-      default_price_data: input.defaultPriceData ? {
-        unit_amount: input.defaultPriceData.unitAmount,
-        currency: input.defaultPriceData.currency,
-        recurring: input.defaultPriceData.recurring ? {
-          interval: input.defaultPriceData.recurring.interval,
-          interval_count: input.defaultPriceData.recurring.intervalCount
+    const product = await stripe.products.create(
+      {
+        name: input.name,
+        description: input.description,
+        images: input.images,
+        metadata: input.metadata,
+        active: input.active,
+        default_price_data: input.defaultPriceData ? {
+          unit_amount: input.defaultPriceData.unitAmount,
+          currency: input.defaultPriceData.currency,
+          recurring: input.defaultPriceData.recurring ? {
+            interval: input.defaultPriceData.recurring.interval,
+            interval_count: input.defaultPriceData.recurring.intervalCount
+          } : void 0
         } : void 0
-      } : void 0
-    });
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(product);
   } catch (error) {
     return handleStripeError(error);
@@ -525,6 +732,7 @@ async function createProduct(input) {
 }
 async function retrieveProduct(productId) {
   try {
+    validateStripeId(productId, "product");
     const stripe = getStripe();
     const product = await stripe.products.retrieve(productId);
     return success(product);
@@ -534,6 +742,8 @@ async function retrieveProduct(productId) {
 }
 async function updateProduct(input) {
   try {
+    validateStripeId(input.productId, "product");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const product = await stripe.products.update(input.productId, {
       name: input.name,
@@ -549,6 +759,7 @@ async function updateProduct(input) {
 }
 async function archiveProduct(productId) {
   try {
+    validateStripeId(productId, "product");
     const stripe = getStripe();
     const product = await stripe.products.update(productId, { active: false });
     return success(product);
@@ -560,7 +771,7 @@ async function listProducts(input) {
   try {
     const stripe = getStripe();
     const products = await stripe.products.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       active: input?.active
@@ -570,8 +781,12 @@ async function listProducts(input) {
     return handleStripeError(error);
   }
 }
-async function createPrice(input) {
+async function createPrice(input, options) {
   try {
+    validateStripeId(input.productId, "product");
+    validateCurrency(input.currency);
+    if (input.unitAmount !== void 0) validateAmount(input.unitAmount, "unitAmount");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const params = {
       product: input.productId,
@@ -599,7 +814,10 @@ async function createPrice(input) {
     } else {
       params.unit_amount = input.unitAmount;
     }
-    const price = await stripe.prices.create(params);
+    const price = await stripe.prices.create(
+      params,
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(price);
   } catch (error) {
     return handleStripeError(error);
@@ -607,6 +825,7 @@ async function createPrice(input) {
 }
 async function retrievePrice(priceId) {
   try {
+    validateStripeId(priceId, "price");
     const stripe = getStripe();
     const price = await stripe.prices.retrieve(priceId);
     return success(price);
@@ -616,9 +835,10 @@ async function retrievePrice(priceId) {
 }
 async function listPrices(input) {
   try {
+    if (input?.productId) validateStripeId(input.productId, "product");
     const stripe = getStripe();
     const prices = await stripe.prices.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       product: input?.productId,
@@ -632,6 +852,7 @@ async function listPrices(input) {
 }
 async function archivePrice(priceId) {
   try {
+    validateStripeId(priceId, "price");
     const stripe = getStripe();
     const price = await stripe.prices.update(priceId, { active: false });
     return success(price);
@@ -641,17 +862,22 @@ async function archivePrice(priceId) {
 }
 
 // src/server/invoices/index.ts
-async function createInvoice(input) {
+async function createInvoice(input, options) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const invoice = await stripe.invoices.create({
-      customer: input.customerId,
-      collection_method: input.collectionMethod ?? "charge_automatically",
-      days_until_due: input.daysUntilDue,
-      metadata: input.metadata,
-      description: input.description,
-      auto_advance: input.autoAdvance
-    });
+    const invoice = await stripe.invoices.create(
+      {
+        customer: input.customerId,
+        collection_method: input.collectionMethod ?? "charge_automatically",
+        days_until_due: input.daysUntilDue,
+        metadata: input.metadata,
+        description: input.description,
+        auto_advance: input.autoAdvance
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(invoice);
   } catch (error) {
     return handleStripeError(error);
@@ -659,6 +885,7 @@ async function createInvoice(input) {
 }
 async function retrieveInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.retrieve(invoiceId);
     return success(invoice);
@@ -668,6 +895,7 @@ async function retrieveInvoice(invoiceId) {
 }
 async function finalizeInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.finalizeInvoice(invoiceId);
     return success(invoice);
@@ -677,6 +905,7 @@ async function finalizeInvoice(invoiceId) {
 }
 async function sendInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.sendInvoice(invoiceId);
     return success(invoice);
@@ -686,6 +915,7 @@ async function sendInvoice(invoiceId) {
 }
 async function payInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.pay(invoiceId);
     return success(invoice);
@@ -695,6 +925,7 @@ async function payInvoice(invoiceId) {
 }
 async function voidInvoice(invoiceId) {
   try {
+    validateStripeId(invoiceId, "invoice");
     const stripe = getStripe();
     const invoice = await stripe.invoices.voidInvoice(invoiceId);
     return success(invoice);
@@ -704,9 +935,10 @@ async function voidInvoice(invoiceId) {
 }
 async function listInvoices(input) {
   try {
+    if (input?.customerId) validateStripeId(input.customerId, "customer");
     const stripe = getStripe();
     const invoices = await stripe.invoices.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       customer: input?.customerId,
@@ -719,6 +951,8 @@ async function listInvoices(input) {
 }
 async function getUpcomingInvoice(customerId, subscriptionId) {
   try {
+    validateStripeId(customerId, "customer");
+    if (subscriptionId) validateStripeId(subscriptionId, "subscription");
     const stripe = getStripe();
     const invoice = await stripe.invoices.retrieveUpcoming({
       customer: customerId,
@@ -729,19 +963,28 @@ async function getUpcomingInvoice(customerId, subscriptionId) {
     return handleStripeError(error);
   }
 }
-async function createInvoiceItem(input) {
+async function createInvoiceItem(input, options) {
   try {
+    validateStripeId(input.customerId, "customer");
+    if (input.invoiceId) validateStripeId(input.invoiceId, "invoice");
+    if (input.priceId) validateStripeId(input.priceId, "price");
+    if (input.amount !== void 0) validateAmount(input.amount, "invoice item amount");
+    if (input.currency) validateCurrency(input.currency);
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const invoiceItem = await stripe.invoiceItems.create({
-      customer: input.customerId,
-      invoice: input.invoiceId,
-      price: input.priceId,
-      amount: input.amount,
-      currency: input.currency,
-      description: input.description,
-      quantity: input.quantity,
-      metadata: input.metadata
-    });
+    const invoiceItem = await stripe.invoiceItems.create(
+      {
+        customer: input.customerId,
+        invoice: input.invoiceId,
+        price: input.priceId,
+        amount: input.amount,
+        currency: input.currency,
+        description: input.description,
+        quantity: input.quantity,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(invoiceItem);
   } catch (error) {
     return handleStripeError(error);
@@ -749,16 +992,22 @@ async function createInvoiceItem(input) {
 }
 
 // src/server/refunds/index.ts
-async function createRefund(input) {
+async function createRefund(input, options) {
   try {
+    if (input.paymentIntentId) validateStripeId(input.paymentIntentId, "paymentIntent");
+    if (input.amount !== void 0) validateAmount(input.amount, "refund amount");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const refund = await stripe.refunds.create({
-      payment_intent: input.paymentIntentId,
-      charge: input.chargeId,
-      amount: input.amount,
-      reason: input.reason,
-      metadata: input.metadata
-    });
+    const refund = await stripe.refunds.create(
+      {
+        payment_intent: input.paymentIntentId,
+        charge: input.chargeId,
+        amount: input.amount,
+        reason: input.reason,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(refund);
   } catch (error) {
     return handleStripeError(error);
@@ -766,6 +1015,7 @@ async function createRefund(input) {
 }
 async function retrieveRefund(refundId) {
   try {
+    validateStripeId(refundId, "refund");
     const stripe = getStripe();
     const refund = await stripe.refunds.retrieve(refundId);
     return success(refund);
@@ -775,9 +1025,10 @@ async function retrieveRefund(refundId) {
 }
 async function listRefunds(input) {
   try {
+    if (input?.paymentIntentId) validateStripeId(input.paymentIntentId, "paymentIntent");
     const stripe = getStripe();
     const refunds = await stripe.refunds.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       payment_intent: input?.paymentIntentId,
@@ -790,6 +1041,7 @@ async function listRefunds(input) {
 }
 async function retrieveDispute(disputeId) {
   try {
+    validateStripeId(disputeId, "dispute");
     const stripe = getStripe();
     const dispute = await stripe.disputes.retrieve(disputeId);
     return success(dispute);
@@ -799,6 +1051,8 @@ async function retrieveDispute(disputeId) {
 }
 async function updateDispute(input) {
   try {
+    validateStripeId(input.disputeId, "dispute");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
     const dispute = await stripe.disputes.update(input.disputeId, {
       evidence: input.evidence ? {
@@ -820,6 +1074,7 @@ async function updateDispute(input) {
 }
 async function closeDispute(disputeId) {
   try {
+    validateStripeId(disputeId, "dispute");
     const stripe = getStripe();
     const dispute = await stripe.disputes.close(disputeId);
     return success(dispute);
@@ -831,7 +1086,7 @@ async function listDisputes(input) {
   try {
     const stripe = getStripe();
     const disputes = await stripe.disputes.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -842,17 +1097,21 @@ async function listDisputes(input) {
 }
 
 // src/server/connect/index.ts
-async function createConnectAccount(input) {
+async function createConnectAccount(input, options) {
   try {
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const account = await stripe.accounts.create({
-      type: input.type,
-      country: input.country,
-      email: input.email,
-      capabilities: input.capabilities,
-      business_type: input.businessType,
-      metadata: input.metadata
-    });
+    const account = await stripe.accounts.create(
+      {
+        type: input.type,
+        country: input.country,
+        email: input.email,
+        capabilities: input.capabilities,
+        business_type: input.businessType,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(account);
   } catch (error) {
     return handleStripeError(error);
@@ -860,6 +1119,7 @@ async function createConnectAccount(input) {
 }
 async function retrieveConnectAccount(accountId) {
   try {
+    validateStripeId(accountId, "account");
     const stripe = getStripe();
     const account = await stripe.accounts.retrieve(accountId);
     return success(account);
@@ -869,6 +1129,7 @@ async function retrieveConnectAccount(accountId) {
 }
 async function deleteConnectAccount(accountId) {
   try {
+    validateStripeId(accountId, "account");
     const stripe = getStripe();
     const deleted = await stripe.accounts.del(accountId);
     return success(deleted);
@@ -880,7 +1141,7 @@ async function listConnectAccounts(input) {
   try {
     const stripe = getStripe();
     const accounts = await stripe.accounts.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -891,6 +1152,9 @@ async function listConnectAccounts(input) {
 }
 async function createAccountLink(input) {
   try {
+    validateStripeId(input.accountId, "account");
+    validateUrl(input.refreshUrl, "refreshUrl");
+    validateUrl(input.returnUrl, "returnUrl");
     const stripe = getStripe();
     const accountLink = await stripe.accountLinks.create({
       account: input.accountId,
@@ -903,17 +1167,24 @@ async function createAccountLink(input) {
     return handleStripeError(error);
   }
 }
-async function createTransfer(input) {
+async function createTransfer(input, options) {
   try {
+    validateAmount(input.amount, "transfer amount");
+    validateCurrency(input.currency);
+    validateStripeId(input.destinationAccountId, "account");
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const transfer = await stripe.transfers.create({
-      amount: input.amount,
-      currency: input.currency,
-      destination: input.destinationAccountId,
-      description: input.description,
-      metadata: input.metadata,
-      source_transaction: input.sourceTransaction
-    });
+    const transfer = await stripe.transfers.create(
+      {
+        amount: input.amount,
+        currency: input.currency,
+        destination: input.destinationAccountId,
+        description: input.description,
+        metadata: input.metadata,
+        source_transaction: input.sourceTransaction
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(transfer);
   } catch (error) {
     return handleStripeError(error);
@@ -921,9 +1192,10 @@ async function createTransfer(input) {
 }
 async function listTransfers(input) {
   try {
+    if (input?.destinationAccountId) validateStripeId(input.destinationAccountId, "account");
     const stripe = getStripe();
     const transfers = await stripe.transfers.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       destination: input?.destinationAccountId
@@ -933,14 +1205,20 @@ async function listTransfers(input) {
     return handleStripeError(error);
   }
 }
-async function createPayout(amount, currency, metadata) {
+async function createPayout(amount, currency, metadata, options) {
   try {
+    validateAmount(amount, "payout amount");
+    const normalizedCurrency = validateCurrency(currency);
+    if (metadata) validateMetadata(metadata);
     const stripe = getStripe();
-    const payout = await stripe.payouts.create({
-      amount,
-      currency,
-      metadata
-    });
+    const payout = await stripe.payouts.create(
+      {
+        amount,
+        currency: normalizedCurrency,
+        metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(payout);
   } catch (error) {
     return handleStripeError(error);
@@ -950,7 +1228,7 @@ async function listPayouts(input) {
   try {
     const stripe = getStripe();
     const payouts = await stripe.payouts.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       status: input?.status
@@ -973,7 +1251,7 @@ async function listBalanceTransactions(input) {
   try {
     const stripe = getStripe();
     const transactions = await stripe.balanceTransactions.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       type: input?.type
@@ -985,20 +1263,26 @@ async function listBalanceTransactions(input) {
 }
 
 // src/server/coupons/index.ts
-async function createCoupon(input) {
+async function createCoupon(input, options) {
   try {
+    if (input.amountOff !== void 0) validateAmount(input.amountOff, "amountOff");
+    if (input.currency) validateCurrency(input.currency);
+    if (input.metadata) validateMetadata(input.metadata);
     const stripe = getStripe();
-    const coupon = await stripe.coupons.create({
-      percent_off: input.percentOff,
-      amount_off: input.amountOff,
-      currency: input.currency,
-      duration: input.duration,
-      duration_in_months: input.durationInMonths,
-      max_redemptions: input.maxRedemptions,
-      redeem_by: input.redeemBy,
-      name: input.name,
-      metadata: input.metadata
-    });
+    const coupon = await stripe.coupons.create(
+      {
+        percent_off: input.percentOff,
+        amount_off: input.amountOff,
+        currency: input.currency,
+        duration: input.duration,
+        duration_in_months: input.durationInMonths,
+        max_redemptions: input.maxRedemptions,
+        redeem_by: input.redeemBy,
+        name: input.name,
+        metadata: input.metadata
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(coupon);
   } catch (error) {
     return handleStripeError(error);
@@ -1006,6 +1290,7 @@ async function createCoupon(input) {
 }
 async function retrieveCoupon(couponId) {
   try {
+    validateStripeId(couponId, "coupon");
     const stripe = getStripe();
     const coupon = await stripe.coupons.retrieve(couponId);
     return success(coupon);
@@ -1015,6 +1300,7 @@ async function retrieveCoupon(couponId) {
 }
 async function deleteCoupon(couponId) {
   try {
+    validateStripeId(couponId, "coupon");
     const stripe = getStripe();
     const deleted = await stripe.coupons.del(couponId);
     return success(deleted);
@@ -1026,7 +1312,7 @@ async function listCoupons(input) {
   try {
     const stripe = getStripe();
     const coupons = await stripe.coupons.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore
     });
@@ -1035,22 +1321,32 @@ async function listCoupons(input) {
     return handleStripeError(error);
   }
 }
-async function createPromotionCode(input) {
+async function createPromotionCode(input, options) {
   try {
+    if (input.metadata) validateMetadata(input.metadata);
+    if (input.restrictions?.minimumAmountCurrency) {
+      validateCurrency(input.restrictions.minimumAmountCurrency);
+    }
+    if (input.restrictions?.minimumAmount !== void 0) {
+      validateAmount(input.restrictions.minimumAmount, "minimumAmount");
+    }
     const stripe = getStripe();
-    const promotionCode = await stripe.promotionCodes.create({
-      coupon: input.couponId,
-      code: input.code,
-      active: input.active,
-      max_redemptions: input.maxRedemptions,
-      expires_at: input.expiresAt,
-      metadata: input.metadata,
-      restrictions: input.restrictions ? {
-        first_time_transaction: input.restrictions.firstTimeTransaction,
-        minimum_amount: input.restrictions.minimumAmount,
-        minimum_amount_currency: input.restrictions.minimumAmountCurrency
-      } : void 0
-    });
+    const promotionCode = await stripe.promotionCodes.create(
+      {
+        coupon: input.couponId,
+        code: input.code,
+        active: input.active,
+        max_redemptions: input.maxRedemptions,
+        expires_at: input.expiresAt,
+        metadata: input.metadata,
+        restrictions: input.restrictions ? {
+          first_time_transaction: input.restrictions.firstTimeTransaction,
+          minimum_amount: input.restrictions.minimumAmount,
+          minimum_amount_currency: input.restrictions.minimumAmountCurrency
+        } : void 0
+      },
+      options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : void 0
+    );
     return success(promotionCode);
   } catch (error) {
     return handleStripeError(error);
@@ -1058,6 +1354,7 @@ async function createPromotionCode(input) {
 }
 async function retrievePromotionCode(promotionCodeId) {
   try {
+    validateStripeId(promotionCodeId, "promotionCode");
     const stripe = getStripe();
     const promotionCode = await stripe.promotionCodes.retrieve(promotionCodeId);
     return success(promotionCode);
@@ -1069,7 +1366,7 @@ async function listPromotionCodes(input) {
   try {
     const stripe = getStripe();
     const promotionCodes = await stripe.promotionCodes.list({
-      limit: input?.limit ?? 10,
+      limit: sanitizeLimit(input?.limit),
       starting_after: input?.startingAfter,
       ending_before: input?.endingBefore,
       coupon: input?.couponId,
@@ -1123,6 +1420,9 @@ function createWebhookHandler(config) {
 function createNextWebhookHandler(config) {
   const handler = createWebhookHandler(config);
   return async function POST(request) {
+    if (request.method !== "POST") {
+      return new Response(null, { status: 405 });
+    }
     try {
       const contentLength = request.headers.get("content-length");
       if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) {
@@ -1132,6 +1432,12 @@ function createNextWebhookHandler(config) {
         });
       }
       const body = await request.text();
+      if (body.length > MAX_BODY_SIZE) {
+        return new Response(JSON.stringify({ error: "Webhook body too large" }), {
+          status: 413,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
       const signature = request.headers.get("stripe-signature");
       if (!signature) {
         return new Response(JSON.stringify({ error: "Missing stripe-signature header" }), {
@@ -1145,8 +1451,8 @@ function createNextWebhookHandler(config) {
         headers: { "Content-Type": "application/json" }
       });
     } catch (error) {
-      const message = error instanceof Error ? error.message : "Webhook handler failed";
-      return new Response(JSON.stringify({ error: message }), {
+      console.error("[@stripe-sdk/core] Webhook error:", error instanceof Error ? error.message : "Unknown error");
+      return new Response(JSON.stringify({ error: "Webhook processing failed" }), {
         status: 400,
         headers: { "Content-Type": "application/json" }
       });
@@ -1170,8 +1476,8 @@ function createPagesWebhookHandler(webhookConfig) {
       const result = await handler(body, signature);
       res.status(200).json(result);
     } catch (error) {
-      const message = error instanceof Error ? error.message : "Webhook handler failed";
-      res.status(400).json({ error: message });
+      console.error("[@stripe-sdk/core] Webhook error:", error instanceof Error ? error.message : "Unknown error");
+      res.status(400).json({ error: "Webhook processing failed" });
     }
   };
 }
@@ -1199,16 +1505,21 @@ function getRawBody(req) {
     }
     const chunks = [];
     let totalLength = 0;
+    let rejected = false;
     req.on("data", (chunk) => {
+      if (rejected) return;
       const buf = Buffer.from(chunk);
       totalLength += buf.length;
       if (totalLength > MAX_BODY_SIZE) {
+        rejected = true;
         reject(new Error("Webhook body too large"));
         return;
       }
       chunks.push(buf);
     });
-    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => {
+      if (!rejected) resolve(Buffer.concat(chunks).toString("utf8"));
+    });
     req.on("error", reject);
   });
 }
@@ -1220,12 +1531,26 @@ function useStripeConfig() {
   }
   return context;
 }
+function validatePublishableKey(key) {
+  if (!key || typeof key !== "string") {
+    throw new Error("StripeProvider requires a publishableKey");
+  }
+  if (key.startsWith("sk_")) {
+    throw new Error(
+      "StripeProvider received a secret key (sk_*). Use a publishable key (pk_*) instead. Secret keys must NEVER be used on the client side."
+    );
+  }
+  if (!key.startsWith("pk_")) {
+    throw new Error('StripeProvider requires a publishable key starting with "pk_"');
+  }
+}
 function StripeProvider({
   publishableKey,
   children,
   options,
   locale
 }) {
+  validatePublishableKey(publishableKey);
   const stripePromise = react.useMemo(
     () => stripeJs.loadStripe(publishableKey, locale ? { locale } : void 0),
     [publishableKey, locale]
@@ -1240,6 +1565,10 @@ function StripeElementsProvider({
   locale,
   loader = "auto"
 }) {
+  validatePublishableKey(publishableKey);
+  if (!clientSecret || typeof clientSecret !== "string") {
+    throw new Error("StripeElementsProvider requires a clientSecret");
+  }
   const stripePromise = react.useMemo(
     () => stripeJs.loadStripe(publishableKey, locale ? { locale } : void 0),
     [publishableKey, locale]
@@ -1254,9 +1583,21 @@ function StripeElementsProvider({
   );
   return /* @__PURE__ */ jsxRuntime.jsx(StripeContext.Provider, { value: { publishableKey }, children: /* @__PURE__ */ jsxRuntime.jsx(reactStripeJs.Elements, { stripe: stripePromise, options, children }) });
 }
+function validateReturnUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new Error("returnUrl must use http or https protocol");
+    }
+  } catch {
+    throw new Error("returnUrl must be a valid URL");
+  }
+}
 function usePayment(options) {
   const stripe = reactStripeJs.useStripe();
   const elements = reactStripeJs.useElements();
+  const optionsRef = react.useRef(options);
+  optionsRef.current = options;
   const [state, setState] = react.useState({
     isProcessing: false,
     isSuccess: false,
@@ -1268,28 +1609,32 @@ function usePayment(options) {
       setState((s) => ({ ...s, error: "Stripe not loaded yet" }));
       return { success: false, error: "Stripe not loaded yet" };
     }
+    const returnUrl = overrides?.returnUrl ?? optionsRef.current?.returnUrl ?? (typeof window !== "undefined" ? window.location.href : "");
+    if (returnUrl && returnUrl !== window.location.href) {
+      validateReturnUrl(returnUrl);
+    }
     setState({ isProcessing: true, isSuccess: false, error: null, paymentIntentId: null });
     const { error, paymentIntent } = await stripe.confirmPayment({
       elements,
       confirmParams: {
-        return_url: overrides?.returnUrl ?? options?.returnUrl ?? (typeof window !== "undefined" ? window.location.href : "")
+        return_url: returnUrl
       },
       redirect: "if_required"
     });
     if (error) {
       const message = error.message ?? "Payment failed";
       setState({ isProcessing: false, isSuccess: false, error: message, paymentIntentId: null });
-      options?.onError?.(message);
+      optionsRef.current?.onError?.(message);
       return { success: false, error: message };
     }
     if (paymentIntent?.status === "succeeded") {
       setState({ isProcessing: false, isSuccess: true, error: null, paymentIntentId: paymentIntent.id });
-      options?.onSuccess?.(paymentIntent.id);
+      optionsRef.current?.onSuccess?.(paymentIntent.id);
       return { success: true, paymentIntentId: paymentIntent.id };
     }
     setState({ isProcessing: false, isSuccess: false, error: null, paymentIntentId: paymentIntent?.id ?? null });
     return { success: false, status: paymentIntent?.status };
-  }, [stripe, elements, options]);
+  }, [stripe, elements]);
   const reset = react.useCallback(() => {
     setState({ isProcessing: false, isSuccess: false, error: null, paymentIntentId: null });
   }, []);
@@ -1300,9 +1645,21 @@ function usePayment(options) {
     isReady: !!stripe && !!elements
   };
 }
+function validateReturnUrl2(url) {
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new Error("returnUrl must use http or https protocol");
+    }
+  } catch {
+    throw new Error("returnUrl must be a valid URL");
+  }
+}
 function useSetupIntent(options) {
   const stripe = reactStripeJs.useStripe();
   const elements = reactStripeJs.useElements();
+  const optionsRef = react.useRef(options);
+  optionsRef.current = options;
   const [state, setState] = react.useState({
     isProcessing: false,
     isSuccess: false,
@@ -1315,29 +1672,33 @@ function useSetupIntent(options) {
       setState((s) => ({ ...s, error: "Stripe not loaded yet" }));
       return { success: false, error: "Stripe not loaded yet" };
     }
+    const returnUrl = overrides?.returnUrl ?? optionsRef.current?.returnUrl ?? (typeof window !== "undefined" ? window.location.href : "");
+    if (returnUrl && returnUrl !== window.location.href) {
+      validateReturnUrl2(returnUrl);
+    }
     setState({ isProcessing: true, isSuccess: false, error: null, setupIntentId: null, paymentMethodId: null });
     const { error, setupIntent } = await stripe.confirmSetup({
       elements,
       confirmParams: {
-        return_url: overrides?.returnUrl ?? options?.returnUrl ?? (typeof window !== "undefined" ? window.location.href : "")
+        return_url: returnUrl
       },
       redirect: "if_required"
     });
     if (error) {
       const message = error.message ?? "Setup failed";
       setState({ isProcessing: false, isSuccess: false, error: message, setupIntentId: null, paymentMethodId: null });
-      options?.onError?.(message);
+      optionsRef.current?.onError?.(message);
       return { success: false, error: message };
     }
     if (setupIntent?.status === "succeeded") {
       const pmId = typeof setupIntent.payment_method === "string" ? setupIntent.payment_method : setupIntent.payment_method?.id ?? null;
       setState({ isProcessing: false, isSuccess: true, error: null, setupIntentId: setupIntent.id, paymentMethodId: pmId });
-      if (pmId) options?.onSuccess?.(setupIntent.id, pmId);
+      if (pmId) optionsRef.current?.onSuccess?.(setupIntent.id, pmId);
       return { success: true, setupIntentId: setupIntent.id, paymentMethodId: pmId };
     }
     setState({ isProcessing: false, isSuccess: false, error: null, setupIntentId: setupIntent?.id ?? null, paymentMethodId: null });
     return { success: false, status: setupIntent?.status };
-  }, [stripe, elements, options]);
+  }, [stripe, elements]);
   const reset = react.useCallback(() => {
     setState({ isProcessing: false, isSuccess: false, error: null, setupIntentId: null, paymentMethodId: null });
   }, []);
@@ -1348,6 +1709,14 @@ function useSetupIntent(options) {
     isReady: !!stripe && !!elements
   };
 }
+function isValidStripeUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.hostname.endsWith(".stripe.com") && parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 function useCheckout(options) {
   const [state, setState] = react.useState({
     isLoading: false,
@@ -1374,8 +1743,11 @@ function useCheckout(options) {
       options.onError?.(message);
       return { success: false, error: message };
     }
-  }, [options]);
+  }, [options.publishableKey, options.onError]);
   const redirectToPortal = react.useCallback((portalUrl) => {
+    if (!isValidStripeUrl(portalUrl)) {
+      throw new Error("Invalid portal URL: must be a valid stripe.com HTTPS URL");
+    }
     window.location.href = portalUrl;
   }, []);
   return {
@@ -1796,5 +2168,3 @@ exports.usePayment = usePayment;
 exports.useSetupIntent = useSetupIntent;
 exports.useStripeConfig = useStripeConfig;
 exports.voidInvoice = voidInvoice;
-//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map