better-auth-mercadopago 0.1.3 → 0.1.5

package/dist/index.mjs

@@ -0,0 +1,1653 @@
+// index.ts
+import { generateId } from "better-auth";
+import { APIError as APIError2, createAuthEndpoint } from "better-auth/api";
+import {
+  Customer,
+  MercadoPagoConfig,
+  Payment,
+  PreApproval,
+  PreApprovalPlan,
+  Preference
+} from "mercadopago";
+import { z } from "zod";
+
+// security.ts
+import crypto from "crypto";
+import { APIError } from "better-auth/api";
+function verifyWebhookSignature(params) {
+  const { xSignature, xRequestId, dataId, secret } = params;
+  if (!xSignature || !xRequestId) {
+    return false;
+  }
+  const parts = xSignature.split(",");
+  const ts = parts.find((p) => p.startsWith("ts="))?.split("=")[1];
+  const hash = parts.find((p) => p.startsWith("v1="))?.split("=")[1];
+  if (!ts || !hash) {
+    return false;
+  }
+  const manifest = `id:${dataId};request-id:${xRequestId};ts:${ts};`;
+  const hmac = crypto.createHmac("sha256", secret);
+  hmac.update(manifest);
+  const expectedHash = hmac.digest("hex");
+  return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(expectedHash));
+}
+var RateLimiter = class {
+  constructor() {
+    this.attempts = /* @__PURE__ */ new Map();
+  }
+  check(key, maxAttempts, windowMs) {
+    const now = Date.now();
+    const record = this.attempts.get(key);
+    if (!record || now > record.resetAt) {
+      this.attempts.set(key, {
+        count: 1,
+        resetAt: now + windowMs
+      });
+      return true;
+    }
+    if (record.count >= maxAttempts) {
+      return false;
+    }
+    record.count++;
+    return true;
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [key, record] of this.attempts.entries()) {
+      if (now > record.resetAt) {
+        this.attempts.delete(key);
+      }
+    }
+  }
+};
+var rateLimiter = new RateLimiter();
+setInterval(() => rateLimiter.cleanup(), 5 * 60 * 1e3);
+function validatePaymentAmount(requestedAmount, mpPaymentAmount, tolerance = 0.01) {
+  const diff = Math.abs(requestedAmount - mpPaymentAmount);
+  return diff <= tolerance;
+}
+function sanitizeMetadata(metadata) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      continue;
+    }
+    if (typeof value === "string" && value.length > 5e3) {
+      sanitized[key] = value.substring(0, 5e3);
+    } else if (typeof value === "object" && value !== null) {
+      sanitized[key] = sanitizeMetadata(value);
+    } else {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
+function validateCallbackUrl(url, allowedDomains) {
+  try {
+    const parsed = new URL(url);
+    if (process.env.NODE_ENV === "production" && parsed.protocol !== "https:") {
+      return false;
+    }
+    const hostname = parsed.hostname;
+    return allowedDomains.some((domain) => {
+      if (domain.startsWith("*.")) {
+        const baseDomain = domain.substring(2);
+        return hostname.endsWith(baseDomain);
+      }
+      return hostname === domain;
+    });
+  } catch {
+    return false;
+  }
+}
+function validateIdempotencyKey(key) {
+  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  const customRegex = /^[a-zA-Z0-9_-]{8,64}$/;
+  return uuidRegex.test(key) || customRegex.test(key);
+}
+var MercadoPagoError = class extends Error {
+  constructor(code, message, statusCode = 400, details) {
+    super(message);
+    this.code = code;
+    this.message = message;
+    this.statusCode = statusCode;
+    this.details = details;
+    this.name = "MercadoPagoError";
+  }
+  toAPIError() {
+    const errorMap = {
+      400: "BAD_REQUEST",
+      401: "UNAUTHORIZED",
+      403: "FORBIDDEN",
+      404: "NOT_FOUND",
+      429: "TOO_MANY_REQUESTS",
+      500: "INTERNAL_SERVER_ERROR"
+    };
+    const type = errorMap[this.statusCode] || "BAD_REQUEST";
+    return new APIError(type, {
+      message: this.message,
+      details: this.details
+    });
+  }
+};
+function handleMercadoPagoError(error) {
+  if (error.status) {
+    const mpError = new MercadoPagoError(
+      error.code || "unknown_error",
+      error.message || "An error occurred with Mercado Pago",
+      error.status,
+      error.cause
+    );
+    throw mpError.toAPIError();
+  }
+  throw new APIError("INTERNAL_SERVER_ERROR", {
+    message: "Failed to process Mercado Pago request"
+  });
+}
+var VALID_WEBHOOK_TOPICS = [
+  "payment",
+  "merchant_order",
+  "subscription_preapproval",
+  "subscription_preapproval_plan",
+  "subscription_authorized_payment",
+  "point_integration_wh",
+  "topic_claims_integration_wh",
+  "topic_merchant_order_wh",
+  "delivery_cancellation"
+];
+function isValidWebhookTopic(topic) {
+  return VALID_WEBHOOK_TOPICS.includes(topic);
+}
+var IdempotencyStore = class {
+  constructor() {
+    // biome-ignore lint/suspicious/noExplicitAny: <necessary>
+    this.store = /* @__PURE__ */ new Map();
+  }
+  // biome-ignore lint/suspicious/noExplicitAny: <necessary>
+  get(key) {
+    const record = this.store.get(key);
+    if (!record || Date.now() > record.expiresAt) {
+      this.store.delete(key);
+      return null;
+    }
+    return record.result;
+  }
+  // biome-ignore lint/suspicious/noExplicitAny: <necessary>
+  set(key, result, ttlMs = 24 * 60 * 60 * 1e3) {
+    this.store.set(key, {
+      result,
+      expiresAt: Date.now() + ttlMs
+    });
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [key, record] of this.store.entries()) {
+      if (now > record.expiresAt) {
+        this.store.delete(key);
+      }
+    }
+  }
+};
+var idempotencyStore = new IdempotencyStore();
+setInterval(() => idempotencyStore.cleanup(), 60 * 60 * 1e3);
+var ValidationRules = {
+  email: (email) => {
+    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return regex.test(email) && email.length <= 255;
+  },
+  amount: (amount) => {
+    return amount > 0 && amount <= 999999999 && !Number.isNaN(amount);
+  },
+  currency: (currency) => {
+    const validCurrencies = [
+      "ARS",
+      "BRL",
+      "CLP",
+      "MXN",
+      "COP",
+      "PEN",
+      "UYU",
+      "USD"
+    ];
+    return validCurrencies.includes(currency);
+  },
+  frequency: (frequency) => {
+    return frequency > 0 && frequency <= 365 && Number.isInteger(frequency);
+  },
+  userId: (userId) => {
+    return /^[a-zA-Z0-9_-]{1,100}$/.test(userId);
+  }
+};
+
+// client.ts
+var mercadoPagoClient = () => {
+  return {
+    id: "mercado-pago",
+    $InferServerPlugin: {},
+    getActions: ($fetch) => ({
+      /**
+       * Get or create a Mercado Pago customer for the authenticated user
+       */
+      getOrCreateCustomer: async (data, fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/customer",
+          {
+            method: "POST",
+            body: data || {},
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Create a payment and get checkout URL
+       *
+       * @example
+       * ```ts
+       * const { data } = await authClient.mercadoPago.createPayment({
+       *   items: [{
+       *     title: "Premium Plan",
+       *     quantity: 1,
+       *     unitPrice: 99.90,
+       *     currencyId: "ARS"
+       *   }]
+       * });
+       *
+       * // Redirect user to checkout
+       * window.location.href = data.checkoutUrl;
+       * ```
+       */
+      createPayment: async (data, fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/payment/create",
+          {
+            method: "POST",
+            body: data,
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Create a marketplace payment with automatic split
+       *
+       * You need to have the seller's MP User ID (collector_id) which they get
+       * after authorizing your app via OAuth.
+       *
+       * @example
+       * ```ts
+       * const { data } = await authClient.mercadoPago.createPayment({
+       *   items: [{
+       *     title: "Product from Seller",
+       *     quantity: 1,
+       *     unitPrice: 100
+       *   }],
+       *   marketplace: {
+       *     collectorId: "123456789", // Seller's MP User ID
+       *     applicationFeePercentage: 10 // Platform keeps 10%
+       *   }
+       * });
+       * ```
+       */
+      createMarketplacePayment: async (data, fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/payment/create",
+          {
+            method: "POST",
+            body: data,
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Create a subscription with recurring payments
+       *
+       * Supports two modes:
+       * 1. With preapproval plan (reusable): Pass preapprovalPlanId
+       * 2. Direct subscription (one-off): Pass reason + autoRecurring
+       *
+       * @example With plan
+       * ```ts
+       * const { data } = await authClient.mercadoPago.createSubscription({
+       *   preapprovalPlanId: "plan_abc123"
+       * });
+       * ```
+       *
+       * @example Direct (without plan)
+       * ```ts
+       * const { data } = await authClient.mercadoPago.createSubscription({
+       *   reason: "Premium Monthly Plan",
+       *   autoRecurring: {
+       *     frequency: 1,
+       *     frequencyType: "months",
+       *     transactionAmount: 99.90,
+       *     currencyId: "ARS"
+       *   }
+       * });
+       * ```
+       */
+      createSubscription: async (data, fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/subscription/create",
+          {
+            method: "POST",
+            body: data,
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Cancel a subscription
+       *
+       * @example
+       * ```ts
+       * await authClient.mercadoPago.cancelSubscription({
+       *   subscriptionId: "sub_123"
+       * });
+       * ```
+       */
+      cancelSubscription: async (data, fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/subscription/cancel",
+          {
+            method: "POST",
+            body: data,
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Create a reusable preapproval plan (subscription template)
+       *
+       * Plans can be reused for multiple subscriptions. Create once,
+       * use many times with createSubscription({ preapprovalPlanId })
+       *
+       * @example
+       * ```ts
+       * const { data } = await authClient.mercadoPago.createPreapprovalPlan({
+       *   reason: "Premium Monthly",
+       *   autoRecurring: {
+       *     frequency: 1,
+       *     frequencyType: "months",
+       *     transactionAmount: 99.90,
+       *     freeTrial: {
+       *       frequency: 7,
+       *       frequencyType: "days"
+       *     }
+       *   },
+       *   repetitions: 12 // 12 months, omit for infinite
+       * });
+       *
+       * // Use the plan
+       * const planId = data.plan.mercadoPagoPlanId;
+       * ```
+       */
+      createPreapprovalPlan: async (data, fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/plan/create",
+          {
+            method: "POST",
+            body: data,
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * List all preapproval plans
+       *
+       * @example
+       * ```ts
+       * const { data } = await authClient.mercadoPago.listPreapprovalPlans();
+       *
+       * data.plans.forEach(plan => {
+       *   console.log(plan.reason); // "Premium Monthly"
+       *   console.log(plan.transactionAmount); // 99.90
+       * });
+       * ```
+       */
+      listPreapprovalPlans: async (fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/plans",
+          {
+            method: "GET",
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Get payment by ID
+       */
+      getPayment: async (paymentId, fetchOptions) => {
+        return await $fetch(
+          `/mercado-pago/payment/${paymentId}`,
+          {
+            method: "GET",
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * List all payments for the authenticated user
+       *
+       * @example
+       * ```ts
+       * const { data } = await authClient.mercadoPago.listPayments({
+       *   limit: 20,
+       *   offset: 0
+       * });
+       * ```
+       */
+      listPayments: async (params, fetchOptions) => {
+        const query = new URLSearchParams();
+        if (params?.limit) query.set("limit", params.limit.toString());
+        if (params?.offset) query.set("offset", params.offset.toString());
+        return await $fetch(
+          `/mercado-pago/payments?${query.toString()}`,
+          {
+            method: "GET",
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * List all subscriptions for the authenticated user
+       *
+       * @example
+       * ```ts
+       * const { data } = await authClient.mercadoPago.listSubscriptions();
+       * ```
+       */
+      listSubscriptions: async (fetchOptions) => {
+        return await $fetch(
+          `/mercado-pago/subscriptions`,
+          {
+            method: "GET",
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Get OAuth authorization URL for marketplace sellers
+       *
+       * This is Step 1 of OAuth flow. Redirect the seller to this URL so they
+       * can authorize your app to process payments on their behalf.
+       *
+       * @example
+       * ```ts
+       * const { data } = await authClient.mercadoPago.getOAuthUrl({
+       *   redirectUri: "https://myapp.com/oauth/callback"
+       * });
+       *
+       * // Redirect seller to authorize
+       * window.location.href = data.authUrl;
+       * ```
+       */
+      getOAuthUrl: async (params, fetchOptions) => {
+        const query = new URLSearchParams();
+        query.set("redirectUri", params.redirectUri);
+        return await $fetch(
+          `/mercado-pago/oauth/authorize?${query.toString()}`,
+          {
+            method: "GET",
+            ...fetchOptions
+          }
+        );
+      },
+      /**
+       * Exchange OAuth code for access token
+       *
+       * This is Step 2 of OAuth flow. After the seller authorizes and MP redirects
+       * them back with a code, exchange that code for an access token.
+       *
+       * @example
+       * ```ts
+       * // In your /oauth/callback page:
+       * const code = new URLSearchParams(window.location.search).get("code");
+       *
+       * const { data } = await authClient.mercadoPago.exchangeOAuthCode({
+       *   code,
+       *   redirectUri: "https://myapp.com/oauth/callback"
+       * });
+       *
+       * // Now you have the seller's MP User ID
+       * console.log(data.oauthToken.mercadoPagoUserId);
+       * ```
+       */
+      exchangeOAuthCode: async (data, fetchOptions) => {
+        return await $fetch(
+          "/mercado-pago/oauth/callback",
+          {
+            method: "POST",
+            body: data,
+            ...fetchOptions
+          }
+        );
+      }
+    })
+  };
+};
+
+// index.ts
+var mercadoPagoPlugin = (options) => {
+  const client = new MercadoPagoConfig({
+    accessToken: options.accessToken
+  });
+  const preferenceClient = new Preference(client);
+  const paymentClient = new Payment(client);
+  const customerClient = new Customer(client);
+  const preApprovalClient = new PreApproval(client);
+  const preApprovalPlanClient = new PreApprovalPlan(client);
+  return {
+    id: "mercado-pago",
+    schema: {
+      // Customer table - stores MP customer info
+      mercadoPagoCustomer: {
+        fields: {
+          id: { type: "string", required: true },
+          userId: {
+            type: "string",
+            required: true,
+            references: { model: "user", field: "id", onDelete: "cascade" }
+          },
+          mercadoPagoId: { type: "string", required: true, unique: true },
+          email: { type: "string", required: true },
+          createdAt: { type: "date", required: true },
+          updatedAt: { type: "date", required: true }
+        }
+      },
+      // Payment table - one-time payments
+      mercadoPagoPayment: {
+        fields: {
+          id: { type: "string", required: true },
+          userId: {
+            type: "string",
+            required: true,
+            references: { model: "user", field: "id", onDelete: "cascade" }
+          },
+          mercadoPagoPaymentId: {
+            type: "string",
+            required: true,
+            unique: true
+          },
+          preferenceId: { type: "string", required: true },
+          status: { type: "string", required: true },
+          // pending, approved, authorized, rejected, cancelled, refunded, charged_back
+          statusDetail: { type: "string" },
+          // accredited, pending_contingency, pending_review_manual, cc_rejected_*, etc
+          amount: { type: "number", required: true },
+          currency: { type: "string", required: true },
+          paymentMethodId: { type: "string" },
+          // visa, master, pix, etc
+          paymentTypeId: { type: "string" },
+          // credit_card, debit_card, ticket, etc
+          metadata: { type: "string" },
+          // JSON stringified
+          createdAt: { type: "date", required: true },
+          updatedAt: { type: "date", required: true }
+        }
+      },
+      // Subscription table
+      mercadoPagoSubscription: {
+        fields: {
+          id: { type: "string", required: true },
+          userId: {
+            type: "string",
+            required: true,
+            references: { model: "user", field: "id", onDelete: "cascade" }
+          },
+          mercadoPagoSubscriptionId: {
+            type: "string",
+            required: true,
+            unique: true
+          },
+          planId: { type: "string", required: true },
+          status: { type: "string", required: true },
+          // authorized, paused, cancelled, pending
+          reason: { type: "string" },
+          // Reason for status (e.g., payment_failed, user_cancelled)
+          nextPaymentDate: { type: "date" },
+          lastPaymentDate: { type: "date" },
+          summarized: { type: "string" },
+          // JSON with charges, charged_amount, pending_charge_amount
+          metadata: { type: "string" },
+          // JSON stringified
+          createdAt: { type: "date", required: true },
+          updatedAt: { type: "date", required: true }
+        }
+      },
+      // Preapproval Plan table (reusable subscription plans)
+      mercadoPagoPreapprovalPlan: {
+        fields: {
+          id: { type: "string", required: true },
+          mercadoPagoPlanId: { type: "string", required: true, unique: true },
+          reason: { type: "string", required: true },
+          // Plan description
+          frequency: { type: "number", required: true },
+          frequencyType: { type: "string", required: true },
+          // days, months
+          transactionAmount: { type: "number", required: true },
+          currencyId: { type: "string", required: true },
+          repetitions: { type: "number" },
+          // null = infinite
+          freeTrial: { type: "string" },
+          // JSON with frequency and frequency_type
+          metadata: { type: "string" },
+          // JSON stringified
+          createdAt: { type: "date", required: true },
+          updatedAt: { type: "date", required: true }
+        }
+      },
+      // Split payments table (for marketplace)
+      mercadoPagoMarketplaceSplit: {
+        fields: {
+          id: { type: "string", required: true },
+          paymentId: {
+            type: "string",
+            required: true,
+            references: {
+              model: "mercadoPagoPayment",
+              field: "id",
+              onDelete: "cascade"
+            }
+          },
+          // Changed naming to be more clear
+          collectorId: { type: "string", required: true },
+          // MP User ID who receives the money (seller)
+          collectorEmail: { type: "string", required: true },
+          // Email of who receives money
+          applicationFeeAmount: { type: "number" },
+          // Platform commission in absolute value
+          applicationFeePercentage: { type: "number" },
+          // Platform commission percentage
+          netAmount: { type: "number", required: true },
+          // Amount that goes to collector (seller)
+          metadata: { type: "string" },
+          createdAt: { type: "date", required: true }
+        }
+      },
+      // OAuth tokens for marketplace (to make payments on behalf of sellers)
+      mercadoPagoOAuthToken: {
+        fields: {
+          id: { type: "string", required: true },
+          userId: {
+            type: "string",
+            required: true,
+            references: { model: "user", field: "id", onDelete: "cascade" }
+          },
+          accessToken: { type: "string", required: true },
+          refreshToken: { type: "string", required: true },
+          publicKey: { type: "string", required: true },
+          mercadoPagoUserId: { type: "string", required: true, unique: true },
+          expiresAt: { type: "date", required: true },
+          createdAt: { type: "date", required: true },
+          updatedAt: { type: "date", required: true }
+        }
+      }
+    },
+    endpoints: {
+      // Get or create customer automatically
+      getOrCreateCustomer: createAuthEndpoint(
+        "/mercado-pago/customer",
+        {
+          method: "POST",
+          requireAuth: true,
+          body: z.object({
+            email: z.string().email().optional(),
+            firstName: z.string().optional(),
+            lastName: z.string().optional()
+          })
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED", {
+              message: "You must be logged in"
+            });
+          }
+          const { email, firstName, lastName } = ctx.body;
+          const userEmail = email || session.user.email;
+          const existingCustomer = await ctx.context.adapter.findOne({
+            model: "mercadoPagoCustomer",
+            where: [{ field: "userId", value: session.user.id }]
+          });
+          if (existingCustomer) {
+            return ctx.json({ customer: existingCustomer });
+          }
+          const mpCustomer = await customerClient.create({
+            body: {
+              email: userEmail,
+              first_name: firstName,
+              last_name: lastName
+            }
+          });
+          const customer = await ctx.context.adapter.create({
+            model: "mercadoPagoCustomer",
+            data: {
+              id: generateId(),
+              userId: session.user.id,
+              mercadoPagoId: mpCustomer.id,
+              email: userEmail,
+              createdAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date()
+            }
+          });
+          return ctx.json({ customer });
+        }
+      ),
+      // OAuth: Get authorization URL for marketplace sellers
+      getOAuthUrl: createAuthEndpoint(
+        "/mercado-pago/oauth/authorize",
+        {
+          method: "GET",
+          requireAuth: true,
+          query: z.object({
+            redirectUri: z.string().url()
+          })
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          if (!options.appId) {
+            throw new APIError2("BAD_REQUEST", {
+              message: "OAuth not configured. Please provide appId in plugin options"
+            });
+          }
+          const { redirectUri } = ctx.query;
+          if (!ctx.context.isTrustedOrigin(redirectUri)) {
+            throw new APIError2("FORBIDDEN", {
+              message: "Redirect URI not in trusted origins"
+            });
+          }
+          const authUrl = `https://auth.mercadopago.com/authorization?client_id=${options.appId}&response_type=code&platform_id=mp&state=${session.user.id}&redirect_uri=${encodeURIComponent(redirectUri)}`;
+          return ctx.json({ authUrl });
+        }
+      ),
+      // OAuth: Exchange code for access token
+      exchangeOAuthCode: createAuthEndpoint(
+        "/mercado-pago/oauth/callback",
+        {
+          method: "POST",
+          requireAuth: true,
+          body: z.object({
+            code: z.string(),
+            redirectUri: z.string().url()
+          })
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          if (!options.appId || !options.appSecret) {
+            throw new APIError2("BAD_REQUEST", {
+              message: "OAuth not configured"
+            });
+          }
+          const { code, redirectUri } = ctx.body;
+          const tokenResponse = await fetch(
+            "https://api.mercadopago.com/oauth/token",
+            {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({
+                client_id: options.appId,
+                client_secret: options.appSecret,
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: redirectUri
+              })
+            }
+          );
+          if (!tokenResponse.ok) {
+            throw new APIError2("BAD_REQUEST", {
+              message: "Failed to exchange OAuth code"
+            });
+          }
+          const tokenData = await tokenResponse.json();
+          const oauthToken = await ctx.context.adapter.create({
+            model: "mercadoPagoOAuthToken",
+            data: {
+              id: generateId(),
+              userId: session.user.id,
+              accessToken: tokenData.access_token,
+              refreshToken: tokenData.refresh_token,
+              publicKey: tokenData.public_key,
+              mercadoPagoUserId: tokenData.user_id.toString(),
+              expiresAt: new Date(Date.now() + tokenData.expires_in * 1e3),
+              createdAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date()
+            }
+          });
+          return ctx.json({
+            success: true,
+            oauthToken: {
+              id: oauthToken.id,
+              mercadoPagoUserId: oauthToken.mercadoPagoUserId,
+              expiresAt: oauthToken.expiresAt
+            }
+          });
+        }
+      ),
+      // Create a reusable preapproval plan (subscription plan)
+      createPreapprovalPlan: createAuthEndpoint(
+        "/mercado-pago/plan/create",
+        {
+          method: "POST",
+          body: z.object({
+            reason: z.string(),
+            // Plan description (e.g., "Premium Monthly")
+            autoRecurring: z.object({
+              frequency: z.number(),
+              // 1, 7, 30, etc
+              frequencyType: z.enum(["days", "months"]),
+              transactionAmount: z.number(),
+              currencyId: z.string().default("ARS"),
+              freeTrial: z.object({
+                frequency: z.number(),
+                frequencyType: z.enum(["days", "months"])
+              }).optional()
+            }),
+            repetitions: z.number().optional(),
+            // null = infinite
+            backUrl: z.string().optional(),
+            metadata: z.record(z.any()).optional()
+          })
+        },
+        async (ctx) => {
+          const { reason, autoRecurring, repetitions, backUrl, metadata } = ctx.body;
+          const baseUrl = options.baseUrl || ctx.context.baseURL;
+          const planBody = {
+            reason,
+            auto_recurring: {
+              frequency: autoRecurring.frequency,
+              frequency_type: autoRecurring.frequencyType,
+              transaction_amount: autoRecurring.transactionAmount,
+              currency_id: autoRecurring.currencyId
+            },
+            back_url: backUrl || `${baseUrl}/plan/created`
+          };
+          if (repetitions && planBody.auto_recurring) {
+            planBody.auto_recurring.repetitions = repetitions;
+          }
+          if (autoRecurring.freeTrial && planBody.auto_recurring) {
+            planBody.auto_recurring.free_trial = {
+              frequency: autoRecurring.freeTrial.frequency,
+              frequency_type: autoRecurring.freeTrial.frequencyType
+            };
+          }
+          const mpPlan = await preApprovalPlanClient.create({ body: planBody });
+          const plan = await ctx.context.adapter.create({
+            model: "mercadoPagoPreapprovalPlan",
+            data: {
+              id: generateId(),
+              mercadoPagoPlanId: mpPlan.id,
+              reason,
+              frequency: autoRecurring.frequency,
+              frequencyType: autoRecurring.frequencyType,
+              transactionAmount: autoRecurring.transactionAmount,
+              currencyId: autoRecurring.currencyId,
+              repetitions: repetitions || null,
+              freeTrial: autoRecurring.freeTrial ? JSON.stringify(autoRecurring.freeTrial) : null,
+              metadata: JSON.stringify(metadata || {}),
+              createdAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date()
+            }
+          });
+          return ctx.json({ plan });
+        }
+      ),
+      // List all preapproval plans
+      listPreapprovalPlans: createAuthEndpoint(
+        "/mercado-pago/plans",
+        {
+          method: "GET"
+        },
+        async (ctx) => {
+          const plans = await ctx.context.adapter.findMany({
+            model: "mercadoPagoPreapprovalPlan"
+          });
+          return ctx.json({ plans });
+        }
+      ),
+      // Create payment preference
+      createPayment: createAuthEndpoint(
+        "/mercado-pago/payment/create",
+        {
+          method: "POST",
+          requireAuth: true,
+          body: z.object({
+            items: z.array(
+              z.object({
+                id: z.string(),
+                title: z.string().min(1).max(256),
+                quantity: z.number().int().min(1).max(1e4),
+                unitPrice: z.number().positive().max(999999999),
+                currencyId: z.string().default("ARS")
+              })
+            ).min(1).max(100),
+            metadata: z.record(z.any()).optional(),
+            marketplace: z.object({
+              collectorId: z.string(),
+              applicationFee: z.number().positive().optional(),
+              applicationFeePercentage: z.number().min(0).max(100).optional()
+            }).optional(),
+            successUrl: z.string().url().optional(),
+            failureUrl: z.string().url().optional(),
+            pendingUrl: z.string().url().optional(),
+            idempotencyKey: z.string().optional()
+          })
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          const rateLimitKey = `payment:create:${session.user.id}`;
+          if (!rateLimiter.check(rateLimitKey, 10, 60 * 1e3)) {
+            throw new APIError2("TOO_MANY_REQUESTS", {
+              message: "Too many payment creation attempts. Please try again later."
+            });
+          }
+          const {
+            items,
+            metadata,
+            marketplace,
+            successUrl,
+            failureUrl,
+            pendingUrl,
+            idempotencyKey
+          } = ctx.body;
+          if (idempotencyKey) {
+            if (!validateIdempotencyKey(idempotencyKey)) {
+              throw new APIError2("BAD_REQUEST", {
+                message: "Invalid idempotency key format"
+              });
+            }
+            const cachedResult = idempotencyStore.get(idempotencyKey);
+            if (cachedResult) {
+              return ctx.json(cachedResult);
+            }
+          }
+          if (options.trustedOrigins) {
+            const urls = [successUrl, failureUrl, pendingUrl].filter(
+              Boolean
+            );
+            for (const url of urls) {
+              if (!validateCallbackUrl(url, options.trustedOrigins)) {
+                throw new APIError2("FORBIDDEN", {
+                  message: `URL ${url} is not in trusted origins`
+                });
+              }
+            }
+          }
+          if (items.some((item) => !ValidationRules.currency(item.currencyId))) {
+            throw new APIError2("BAD_REQUEST", {
+              message: "Invalid currency code"
+            });
+          }
+          const sanitizedMetadata = metadata ? sanitizeMetadata(metadata) : {};
+          let customer = await ctx.context.adapter.findOne({
+            model: "mercadoPagoCustomer",
+            where: [{ field: "userId", value: session.user.id }]
+          });
+          if (!customer) {
+            try {
+              const mpCustomer = await customerClient.create({
+                body: { email: session.user.email }
+              });
+              customer = await ctx.context.adapter.create({
+                model: "mercadoPagoCustomer",
+                data: {
+                  id: generateId(),
+                  userId: session.user.id,
+                  mercadoPagoId: mpCustomer.id,
+                  email: session.user.email,
+                  createdAt: /* @__PURE__ */ new Date(),
+                  updatedAt: /* @__PURE__ */ new Date()
+                }
+              });
+            } catch (error) {
+              handleMercadoPagoError(error);
+            }
+          }
+          const baseUrl = options.baseUrl || ctx.context.baseURL;
+          const totalAmount = items.reduce(
+            (sum, item) => sum + item.unitPrice * item.quantity,
+            0
+          );
+          if (!ValidationRules.amount(totalAmount)) {
+            throw new APIError2("BAD_REQUEST", {
+              message: "Invalid payment amount"
+            });
+          }
+          let applicationFeeAmount = 0;
+          if (marketplace) {
+            if (marketplace.applicationFee) {
+              applicationFeeAmount = marketplace.applicationFee;
+            } else if (marketplace.applicationFeePercentage) {
+              applicationFeeAmount = totalAmount * marketplace.applicationFeePercentage / 100;
+            }
+            if (applicationFeeAmount >= totalAmount) {
+              throw new APIError2("BAD_REQUEST", {
+                message: "Application fee cannot exceed total amount"
+              });
+            }
+          }
+          const preferenceBody = {
+            items: items.map((item) => ({
+              id: item.id,
+              title: item.title,
+              quantity: item.quantity,
+              unit_price: item.unitPrice,
+              currency_id: item.currencyId
+            })),
+            payer: {
+              email: session.user.email
+            },
+            back_urls: {
+              success: successUrl || `${baseUrl}/payment/success`,
+              failure: failureUrl || `${baseUrl}/payment/failure`,
+              pending: pendingUrl || `${baseUrl}/payment/pending`
+            },
+            notification_url: `${baseUrl}/api/auth/mercado-pago/webhook`,
+            metadata: {
+              ...sanitizedMetadata,
+              userId: session.user.id,
+              customerId: customer?.id
+            },
+            expires: true,
+            expiration_date_from: (/* @__PURE__ */ new Date()).toISOString(),
+            expiration_date_to: new Date(
+              Date.now() + 30 * 24 * 60 * 60 * 1e3
+            ).toISOString()
+            // 30 days
+          };
+          if (marketplace) {
+            preferenceBody.marketplace = marketplace.collectorId;
+            preferenceBody.marketplace_fee = applicationFeeAmount;
+          }
+          let preference;
+          try {
+            preference = await preferenceClient.create({
+              body: preferenceBody
+            });
+          } catch (error) {
+            handleMercadoPagoError(error);
+          }
+          const payment = await ctx.context.adapter.create({
+            model: "mercadoPagoPayment",
+            data: {
+              id: generateId(),
+              userId: session.user.id,
+              mercadoPagoPaymentId: preference.id,
+              preferenceId: preference.id,
+              status: "pending",
+              amount: totalAmount,
+              currency: items[0].currencyId,
+              metadata: JSON.stringify(sanitizedMetadata),
+              createdAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date()
+            }
+          });
+          if (marketplace) {
+            await ctx.context.adapter.create({
+              model: "mercadoPagoMarketplaceSplit",
+              data: {
+                id: generateId(),
+                paymentId: payment.id,
+                collectorId: marketplace.collectorId,
+                collectorEmail: "",
+                // Will be updated via webhook
+                applicationFeeAmount,
+                applicationFeePercentage: marketplace.applicationFeePercentage,
+                netAmount: totalAmount - applicationFeeAmount,
+                metadata: JSON.stringify({}),
+                createdAt: /* @__PURE__ */ new Date()
+              }
+            });
+          }
+          const result = {
+            checkoutUrl: preference.init_point,
+            preferenceId: preference.id,
+            payment
+          };
+          if (idempotencyKey) {
+            idempotencyStore.set(idempotencyKey, result);
+          }
+          return ctx.json(result);
+        }
+      ),
+      // Create subscription (supports both with and without preapproval plan)
+      createSubscription: createAuthEndpoint(
+        "/mercado-pago/subscription/create",
+        {
+          method: "POST",
+          requireAuth: true,
+          body: z.object({
+            // Option 1: Use existing preapproval plan
+            preapprovalPlanId: z.string().optional(),
+            // Option 2: Create subscription directly without plan
+            reason: z.string().optional(),
+            // Description of subscription
+            autoRecurring: z.object({
+              frequency: z.number(),
+              // 1 for monthly
+              frequencyType: z.enum(["days", "months"]),
+              transactionAmount: z.number(),
+              currencyId: z.string().default("ARS"),
+              startDate: z.string().optional(),
+              // ISO date
+              endDate: z.string().optional(),
+              // ISO date
+              freeTrial: z.object({
+                frequency: z.number(),
+                frequencyType: z.enum(["days", "months"])
+              }).optional()
+            }).optional(),
+            backUrl: z.string().optional(),
+            metadata: z.record(z.any()).optional()
+          })
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          const {
+            preapprovalPlanId,
+            reason,
+            autoRecurring,
+            backUrl,
+            metadata
+          } = ctx.body;
+          if (!preapprovalPlanId) {
+            if (!reason || !autoRecurring) {
+              throw new APIError2("BAD_REQUEST", {
+                message: "Must provide either preapprovalPlanId or (reason + autoRecurring)"
+              });
+            }
+          }
+          let customer = await ctx.context.adapter.findOne({
+            model: "mercadoPagoCustomer",
+            where: [{ field: "userId", value: session.user.id }]
+          });
+          if (!customer) {
+            const mpCustomer = await customerClient.create({
+              body: { email: session.user.email }
+            });
+            customer = await ctx.context.adapter.create({
+              model: "mercadoPagoCustomer",
+              data: {
+                id: generateId(),
+                userId: session.user.id,
+                mercadoPagoId: mpCustomer.id,
+                email: session.user.email,
+                createdAt: /* @__PURE__ */ new Date(),
+                updatedAt: /* @__PURE__ */ new Date()
+              }
+            });
+          }
+          const baseUrl = options.baseUrl || ctx.context.baseURL;
+          const subscriptionId = generateId();
+          let preapproval;
+          if (preapprovalPlanId) {
+            preapproval = await preApprovalClient.create({
+              body: {
+                preapproval_plan_id: preapprovalPlanId,
+                payer_email: session.user.email,
+                card_token_id: void 0,
+                // Will be provided in checkout
+                back_url: backUrl || `${baseUrl}/subscription/success`,
+                status: "pending",
+                external_reference: subscriptionId
+              }
+            });
+          } else if (autoRecurring) {
+            const ar = autoRecurring;
+            const autoRecurringBody = {
+              frequency: ar.frequency,
+              frequency_type: ar.frequencyType,
+              transaction_amount: ar.transactionAmount,
+              currency_id: ar.currencyId
+            };
+            if (ar.startDate) {
+              autoRecurringBody.start_date = ar.startDate;
+            }
+            if (ar.endDate) {
+              autoRecurringBody.end_date = ar.endDate;
+            }
+            if (ar.freeTrial) {
+              autoRecurringBody.free_trial = {
+                frequency: ar.freeTrial.frequency,
+                frequency_type: ar.freeTrial.frequencyType
+              };
+            }
+            preapproval = await preApprovalClient.create({
+              body: {
+                reason,
+                auto_recurring: autoRecurringBody,
+                payer_email: session.user.email,
+                back_url: backUrl || `${baseUrl}/subscription/success`,
+                status: "pending",
+                external_reference: subscriptionId
+              }
+            });
+          }
+          if (!preapproval) {
+            throw new APIError2("BAD_REQUEST", {
+              message: "Failed to create subscription"
+            });
+          }
+          const subscription = await ctx.context.adapter.create({
+            model: "mercadoPagoSubscription",
+            data: {
+              id: subscriptionId,
+              userId: session.user.id,
+              mercadoPagoSubscriptionId: preapproval.id,
+              planId: preapprovalPlanId || reason || "direct",
+              status: "pending",
+              metadata: JSON.stringify(metadata || {}),
+              createdAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date()
+            }
+          });
+          return ctx.json({
+            checkoutUrl: preapproval.init_point,
+            subscription
+          });
+        }
+      ),
+      // Cancel subscription
+      cancelSubscription: createAuthEndpoint(
+        "/mercado-pago/subscription/cancel",
+        {
+          method: "POST",
+          requireAuth: true,
+          body: z.object({
+            subscriptionId: z.string()
+          })
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          const { subscriptionId } = ctx.body;
+          const subscription = await ctx.context.adapter.findOne({
+            model: "mercadoPagoSubscription",
+            where: [
+              { field: "id", value: subscriptionId },
+              { field: "userId", value: session.user.id }
+            ]
+          });
+          if (!subscription) {
+            throw new APIError2("NOT_FOUND", {
+              message: "Subscription not found"
+            });
+          }
+          await preApprovalClient.update({
+            id: subscription.mercadoPagoSubscriptionId,
+            body: { status: "cancelled" }
+          });
+          await ctx.context.adapter.update({
+            model: "mercadoPagoSubscription",
+            where: [{ field: "id", value: subscriptionId }],
+            update: {
+              status: "cancelled",
+              updatedAt: /* @__PURE__ */ new Date()
+            }
+          });
+          return ctx.json({ success: true });
+        }
+      ),
+      // Get payment status
+      getPayment: createAuthEndpoint(
+        "/mercado-pago/payment/:id",
+        {
+          method: "GET",
+          requireAuth: true
+        },
+        async (ctx) => {
+          const paymentId = ctx.params.id;
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          const payment = await ctx.context.adapter.findOne({
+            model: "mercadoPagoPayment",
+            where: [
+              { field: "id", value: paymentId },
+              { field: "userId", value: session.user.id }
+            ]
+          });
+          if (!payment) {
+            throw new APIError2("NOT_FOUND", {
+              message: "Payment not found"
+            });
+          }
+          return ctx.json({ payment });
+        }
+      ),
+      // List user payments
+      listPayments: createAuthEndpoint(
+        "/mercado-pago/payments",
+        {
+          method: "GET",
+          requireAuth: true,
+          query: z.object({
+            limit: z.coerce.number().optional().default(10),
+            offset: z.coerce.number().optional().default(0)
+          })
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          const { limit, offset } = ctx.query;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          const payments = await ctx.context.adapter.findMany({
+            model: "mercadoPagoPayment",
+            where: [{ field: "userId", value: session.user.id }],
+            limit,
+            offset
+          });
+          return ctx.json({ payments });
+        }
+      ),
+      // List user subscriptions
+      listSubscriptions: createAuthEndpoint(
+        "/mercado-pago/subscriptions",
+        {
+          method: "GET",
+          requireAuth: true
+        },
+        async (ctx) => {
+          const session = ctx.context.session;
+          if (!session) {
+            throw new APIError2("UNAUTHORIZED");
+          }
+          const subscriptions = await ctx.context.adapter.findMany({
+            model: "mercadoPagoSubscription",
+            where: [{ field: "userId", value: session.user.id }]
+          });
+          return ctx.json({ subscriptions });
+        }
+      ),
+      // Webhook handler
+      webhook: createAuthEndpoint(
+        "/mercado-pago/webhook",
+        {
+          method: "POST"
+        },
+        async (ctx) => {
+          const webhookRateLimitKey = "webhook:global";
+          if (!rateLimiter.check(webhookRateLimitKey, 1e3, 60 * 1e3)) {
+            throw new APIError2("TOO_MANY_REQUESTS", {
+              message: "Webhook rate limit exceeded"
+            });
+          }
+          let notification;
+          try {
+            notification = ctx.body;
+          } catch {
+            throw new APIError2("BAD_REQUEST", {
+              message: "Invalid JSON payload"
+            });
+          }
+          if (!notification.type || !isValidWebhookTopic(notification.type) || !notification.data?.id) {
+            ctx.context.logger.warn("Invalid webhook topic received", {
+              type: notification.type
+            });
+            return ctx.json({ received: true });
+          }
+          if (!ctx.request) {
+            throw new APIError2("BAD_REQUEST", {
+              message: "Missing request"
+            });
+          }
+          if (options.webhookSecret) {
+            const xSignature = ctx.request.headers.get("x-signature");
+            const xRequestId = ctx.request.headers.get("x-request-id");
+            const dataId = notification.data?.id?.toString();
+            if (!dataId) {
+              throw new APIError2("BAD_REQUEST", {
+                message: "Missing data.id in webhook payload"
+              });
+            }
+            const isValid = verifyWebhookSignature({
+              xSignature,
+              xRequestId,
+              dataId,
+              secret: options.webhookSecret
+            });
+            if (!isValid) {
+              ctx.context.logger.error("Invalid webhook signature", {
+                xSignature,
+                xRequestId,
+                dataId
+              });
+              throw new APIError2("UNAUTHORIZED", {
+                message: "Invalid webhook signature"
+              });
+            }
+          }
+          const webhookId = `webhook:${notification.data?.id}:${notification.type}`;
+          const alreadyProcessed = idempotencyStore.get(webhookId);
+          if (alreadyProcessed) {
+            ctx.context.logger.info("Webhook already processed", { webhookId });
+            return ctx.json({ received: true });
+          }
+          idempotencyStore.set(webhookId, true, 24 * 60 * 60 * 1e3);
+          try {
+            if (notification.type === "payment") {
+              const paymentId = notification.data.id;
+              if (!paymentId) {
+                throw new APIError2("BAD_REQUEST", {
+                  message: "Missing payment ID"
+                });
+              }
+              let mpPayment;
+              try {
+                mpPayment = await paymentClient.get({
+                  id: paymentId
+                });
+              } catch (error) {
+                ctx.context.logger.error("Failed to fetch payment from MP", {
+                  paymentId,
+                  error
+                });
+                throw new APIError2("BAD_REQUEST", {
+                  message: "Failed to fetch payment details"
+                });
+              }
+              const existingPayment = await ctx.context.adapter.findOne({
+                model: "mercadoPagoPayment",
+                where: [
+                  {
+                    field: "mercadoPagoPaymentId",
+                    value: paymentId.toString()
+                  }
+                ]
+              });
+              if (existingPayment) {
+                if (!validatePaymentAmount(
+                  existingPayment.amount,
+                  mpPayment.transaction_amount || 0
+                )) {
+                  ctx.context.logger.error("Payment amount mismatch", {
+                    expected: existingPayment.amount,
+                    received: mpPayment.transaction_amount
+                  });
+                  throw new APIError2("BAD_REQUEST", {
+                    message: "Payment amount mismatch"
+                  });
+                }
+                await ctx.context.adapter.update({
+                  model: "mercadoPagoPayment",
+                  where: [{ field: "id", value: existingPayment.id }],
+                  update: {
+                    status: mpPayment.status,
+                    statusDetail: mpPayment.status_detail || void 0,
+                    paymentMethodId: mpPayment.payment_method_id || void 0,
+                    paymentTypeId: mpPayment.payment_type_id || void 0,
+                    updatedAt: /* @__PURE__ */ new Date()
+                  }
+                });
+                if (options.onPaymentUpdate) {
+                  try {
+                    await options.onPaymentUpdate({
+                      payment: existingPayment,
+                      status: mpPayment.status,
+                      statusDetail: mpPayment.status_detail || "",
+                      mpPayment
+                    });
+                  } catch (error) {
+                    ctx.context.logger.error(
+                      "Error in onPaymentUpdate callback",
+                      { error }
+                    );
+                  }
+                }
+              }
+            }
+            if (notification.type === "subscription_preapproval" || notification.type === "subscription_preapproval_plan") {
+              const preapprovalId = notification.data.id;
+              if (!preapprovalId) {
+                throw new APIError2("BAD_REQUEST", {
+                  message: "Missing preapproval ID"
+                });
+              }
+              let mpPreapproval;
+              try {
+                mpPreapproval = await preApprovalClient.get({
+                  id: preapprovalId
+                });
+              } catch (error) {
+                ctx.context.logger.error(
+                  "Failed to fetch preapproval from MP",
+                  { preapprovalId, error }
+                );
+                throw new APIError2("BAD_REQUEST", {
+                  message: "Failed to fetch subscription details"
+                });
+              }
+              const existingSubscription = await ctx.context.adapter.findOne({
+                model: "mercadoPagoSubscription",
+                where: [
+                  {
+                    field: "mercadoPagoSubscriptionId",
+                    value: preapprovalId
+                  }
+                ]
+              });
+              if (existingSubscription) {
+                await ctx.context.adapter.update({
+                  model: "mercadoPagoSubscription",
+                  where: [{ field: "id", value: existingSubscription.id }],
+                  update: {
+                    status: mpPreapproval.status,
+                    reason: mpPreapproval.reason || void 0,
+                    nextPaymentDate: mpPreapproval.next_payment_date ? new Date(mpPreapproval.next_payment_date) : void 0,
+                    lastPaymentDate: mpPreapproval.last_modified ? new Date(mpPreapproval.last_modified) : void 0,
+                    summarized: mpPreapproval.summarized ? JSON.stringify(mpPreapproval.summarized) : void 0,
+                    updatedAt: /* @__PURE__ */ new Date()
+                  }
+                });
+                if (options.onSubscriptionUpdate) {
+                  try {
+                    await options.onSubscriptionUpdate({
+                      subscription: existingSubscription,
+                      status: mpPreapproval.status,
+                      reason: mpPreapproval.reason || "",
+                      mpPreapproval
+                    });
+                  } catch (error) {
+                    ctx.context.logger.error(
+                      "Error in onSubscriptionUpdate callback",
+                      { error }
+                    );
+                  }
+                }
+              }
+            }
+            if (notification.type === "subscription_authorized_payment" || notification.type === "authorized_payment") {
+              const paymentId = notification.data.id;
+              if (!paymentId) {
+                throw new APIError2("BAD_REQUEST", {
+                  message: "Missing payment ID"
+                });
+              }
+              let mpPayment;
+              try {
+                mpPayment = await paymentClient.get({
+                  id: paymentId
+                });
+              } catch (error) {
+                ctx.context.logger.error(
+                  "Failed to fetch authorized payment from MP",
+                  { paymentId, error }
+                );
+                throw new APIError2("BAD_REQUEST", {
+                  message: "Failed to fetch payment details"
+                });
+              }
+              if (mpPayment.external_reference) {
+                const subscription = await ctx.context.adapter.findOne({
+                  model: "mercadoPagoSubscription",
+                  where: [
+                    {
+                      field: "id",
+                      // External reference holds the local subscription ID
+                      value: mpPayment.external_reference
+                    }
+                  ]
+                });
+                if (subscription) {
+                  if (options.onSubscriptionPayment) {
+                    try {
+                      await options.onSubscriptionPayment({
+                        subscription,
+                        // In a real app, we should map this properly or align types
+                        payment: mpPayment,
+                        status: mpPayment.status
+                      });
+                    } catch (error) {
+                      ctx.context.logger.error(
+                        "Error in onSubscriptionPayment callback",
+                        { error }
+                      );
+                    }
+                  }
+                } else {
+                  ctx.context.logger.warn(
+                    "Subscription not found for authorized payment",
+                    {
+                      paymentId,
+                      externalReference: mpPayment.external_reference
+                    }
+                  );
+                }
+              }
+            }
+          } catch (error) {
+            ctx.context.logger.error("Error processing webhook", {
+              error,
+              notification
+            });
+            if (error instanceof APIError2) {
+              throw error;
+            }
+          }
+          return ctx.json({ received: true });
+        }
+      )
+    },
+    // Add trusted origins from options
+    ...options.trustedOrigins && { trustedOrigins: options.trustedOrigins }
+  };
+};
+export {
+  mercadoPagoClient,
+  mercadoPagoPlugin
+};
+//# sourceMappingURL=index.mjs.map