better-auth-mercadopago 0.1.8 → 0.2.0

package/dist/index.mjs

@@ -1,1620 +0,0 @@
-// index.ts
-import { generateId } from "better-auth";
-import { APIError as APIError2, createAuthEndpoint } from "better-auth/api";
-import {
-  Customer,
-  MercadoPagoConfig,
-  Payment,
-  PreApproval,
-  PreApprovalPlan,
-  Preference
-} from "mercadopago";
-import { z } from "zod";
-
-// security.ts
-import crypto from "crypto";
-import { APIError } from "better-auth/api";
-function verifyWebhookSignature(params) {
-  const { xSignature, xRequestId, dataId, secret } = params;
-  if (!xSignature || !xRequestId) {
-    return false;
-  }
-  const parts = xSignature.split(",");
-  const ts = parts.find((p) => p.startsWith("ts="))?.split("=")[1];
-  const hash = parts.find((p) => p.startsWith("v1="))?.split("=")[1];
-  if (!ts || !hash) {
-    return false;
-  }
-  const manifest = `id:${dataId};request-id:${xRequestId};ts:${ts};`;
-  const hmac = crypto.createHmac("sha256", secret);
-  hmac.update(manifest);
-  const expectedHash = hmac.digest("hex");
-  return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(expectedHash));
-}
-var RateLimiter = class {
-  constructor() {
-    this.attempts = /* @__PURE__ */ new Map();
-  }
-  check(key, maxAttempts, windowMs) {
-    const now = Date.now();
-    const record = this.attempts.get(key);
-    if (!record || now > record.resetAt) {
-      this.attempts.set(key, {
-        count: 1,
-        resetAt: now + windowMs
-      });
-      return true;
-    }
-    if (record.count >= maxAttempts) {
-      return false;
-    }
-    record.count++;
-    return true;
-  }
-  cleanup() {
-    const now = Date.now();
-    for (const [key, record] of this.attempts.entries()) {
-      if (now > record.resetAt) {
-        this.attempts.delete(key);
-      }
-    }
-  }
-};
-var rateLimiter = new RateLimiter();
-setInterval(() => rateLimiter.cleanup(), 5 * 60 * 1e3);
-function validatePaymentAmount(requestedAmount, mpPaymentAmount, tolerance = 0.01) {
-  const diff = Math.abs(requestedAmount - mpPaymentAmount);
-  return diff <= tolerance;
-}
-function sanitizeMetadata(metadata) {
-  const sanitized = {};
-  for (const [key, value] of Object.entries(metadata)) {
-    if (key === "__proto__" || key === "constructor" || key === "prototype") {
-      continue;
-    }
-    if (typeof value === "string" && value.length > 5e3) {
-      sanitized[key] = value.substring(0, 5e3);
-    } else if (typeof value === "object" && value !== null) {
-      sanitized[key] = sanitizeMetadata(value);
-    } else {
-      sanitized[key] = value;
-    }
-  }
-  return sanitized;
-}
-function validateCallbackUrl(url, allowedDomains) {
-  try {
-    const parsed = new URL(url);
-    if (process.env.NODE_ENV === "production" && parsed.protocol !== "https:") {
-      return false;
-    }
-    const hostname = parsed.hostname;
-    return allowedDomains.some((domain) => {
-      if (domain.startsWith("*.")) {
-        const baseDomain = domain.substring(2);
-        return hostname.endsWith(baseDomain);
-      }
-      return hostname === domain;
-    });
-  } catch {
-    return false;
-  }
-}
-function validateIdempotencyKey(key) {
-  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-  const customRegex = /^[a-zA-Z0-9_-]{8,64}$/;
-  return uuidRegex.test(key) || customRegex.test(key);
-}
-var MercadoPagoError = class extends Error {
-  constructor(code, message, statusCode = 400, details) {
-    super(message);
-    this.code = code;
-    this.message = message;
-    this.statusCode = statusCode;
-    this.details = details;
-    this.name = "MercadoPagoError";
-  }
-  toAPIError() {
-    const errorMap = {
-      400: "BAD_REQUEST",
-      401: "UNAUTHORIZED",
-      403: "FORBIDDEN",
-      404: "NOT_FOUND",
-      429: "TOO_MANY_REQUESTS",
-      500: "INTERNAL_SERVER_ERROR"
-    };
-    const type = errorMap[this.statusCode] || "BAD_REQUEST";
-    return new APIError(type, {
-      message: this.message,
-      details: this.details
-    });
-  }
-};
-function handleMercadoPagoError(error) {
-  if (error.status) {
-    const mpError = new MercadoPagoError(
-      error.code || "unknown_error",
-      error.message || "An error occurred with Mercado Pago",
-      error.status,
-      error.cause
-    );
-    throw mpError.toAPIError();
-  }
-  throw new APIError("INTERNAL_SERVER_ERROR", {
-    message: "Failed to process Mercado Pago request"
-  });
-}
-var VALID_WEBHOOK_TOPICS = [
-  "payment",
-  "merchant_order",
-  "subscription_preapproval",
-  "subscription_preapproval_plan",
-  "subscription_authorized_payment",
-  "point_integration_wh",
-  "topic_claims_integration_wh",
-  "topic_merchant_order_wh",
-  "delivery_cancellation"
-];
-function isValidWebhookTopic(topic) {
-  return VALID_WEBHOOK_TOPICS.includes(topic);
-}
-var IdempotencyStore = class {
-  constructor() {
-    // biome-ignore lint/suspicious/noExplicitAny: <necessary>
-    this.store = /* @__PURE__ */ new Map();
-  }
-  // biome-ignore lint/suspicious/noExplicitAny: <necessary>
-  get(key) {
-    const record = this.store.get(key);
-    if (!record || Date.now() > record.expiresAt) {
-      this.store.delete(key);
-      return null;
-    }
-    return record.result;
-  }
-  // biome-ignore lint/suspicious/noExplicitAny: <necessary>
-  set(key, result, ttlMs = 24 * 60 * 60 * 1e3) {
-    this.store.set(key, {
-      result,
-      expiresAt: Date.now() + ttlMs
-    });
-  }
-  cleanup() {
-    const now = Date.now();
-    for (const [key, record] of this.store.entries()) {
-      if (now > record.expiresAt) {
-        this.store.delete(key);
-      }
-    }
-  }
-};
-var idempotencyStore = new IdempotencyStore();
-setInterval(() => idempotencyStore.cleanup(), 60 * 60 * 1e3);
-var ValidationRules = {
-  email: (email) => {
-    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-    return regex.test(email) && email.length <= 255;
-  },
-  amount: (amount) => {
-    return amount > 0 && amount <= 999999999 && !Number.isNaN(amount);
-  },
-  currency: (currency) => {
-    const validCurrencies = [
-      "ARS",
-      "BRL",
-      "CLP",
-      "MXN",
-      "COP",
-      "PEN",
-      "UYU",
-      "USD"
-    ];
-    return validCurrencies.includes(currency);
-  },
-  frequency: (frequency) => {
-    return frequency > 0 && frequency <= 365 && Number.isInteger(frequency);
-  },
-  userId: (userId) => {
-    return /^[a-zA-Z0-9_-]{1,100}$/.test(userId);
-  }
-};
-
-// client.ts
-var mercadoPagoClientPlugin = () => {
-  return {
-    id: "mercadopago",
-    $InferServerPlugin: {},
-    getActions: ($fetch) => ({
-      /**
-       * Get or create a Mercado Pago customer for the authenticated user
-       */
-      getOrCreateCustomer: async (data, fetchOptions) => {
-        return await $fetch("/mercado-pago/customer", {
-          method: "POST",
-          body: data || {},
-          ...fetchOptions
-        });
-      },
-      /**
-       * Create a payment and get checkout URL
-       *
-       * @example
-       * ```ts
-       * const { data } = await authClient.mercadoPago.createPayment({
-       *   items: [{
-       *     title: "Premium Plan",
-       *     quantity: 1,
-       *     unitPrice: 99.90,
-       *     currencyId: "ARS"
-       *   }]
-       * });
-       *
-       * // Redirect user to checkout
-       * window.location.href = data.checkoutUrl;
-       * ```
-       */
-      createPayment: async (data, fetchOptions) => {
-        return await $fetch("/mercado-pago/payment/create", {
-          method: "POST",
-          body: data,
-          ...fetchOptions
-        });
-      },
-      /**
-       * Create a marketplace payment with automatic split
-       *
-       * You need to have the seller's MP User ID (collector_id) which they get
-       * after authorizing your app via OAuth.
-       *
-       * @example
-       * ```ts
-       * const { data } = await authClient.mercadoPago.createPayment({
-       *   items: [{
-       *     title: "Product from Seller",
-       *     quantity: 1,
-       *     unitPrice: 100
-       *   }],
-       *   marketplace: {
-       *     collectorId: "123456789", // Seller's MP User ID
-       *     applicationFeePercentage: 10 // Platform keeps 10%
-       *   }
-       * });
-       * ```
-       */
-      createMarketplacePayment: async (data, fetchOptions) => {
-        return await $fetch("/mercado-pago/payment/create", {
-          method: "POST",
-          body: data,
-          ...fetchOptions
-        });
-      },
-      /**
-       * Create a subscription with recurring payments
-       *
-       * Supports two modes:
-       * 1. With preapproval plan (reusable): Pass preapprovalPlanId
-       * 2. Direct subscription (one-off): Pass reason + autoRecurring
-       *
-       * @example With plan
-       * ```ts
-       * const { data } = await authClient.mercadoPago.createSubscription({
-       *   preapprovalPlanId: "plan_abc123"
-       * });
-       * ```
-       *
-       * @example Direct (without plan)
-       * ```ts
-       * const { data } = await authClient.mercadoPago.createSubscription({
-       *   reason: "Premium Monthly Plan",
-       *   autoRecurring: {
-       *     frequency: 1,
-       *     frequencyType: "months",
-       *     transactionAmount: 99.90,
-       *     currencyId: "ARS"
-       *   }
-       * });
-       * ```
-       */
-      createSubscription: async (data, fetchOptions) => {
-        return await $fetch("/mercado-pago/subscription/create", {
-          method: "POST",
-          body: data,
-          ...fetchOptions
-        });
-      },
-      /**
-       * Cancel a subscription
-       *
-       * @example
-       * ```ts
-       * await authClient.mercadoPago.cancelSubscription({
-       *   subscriptionId: "sub_123"
-       * });
-       * ```
-       */
-      cancelSubscription: async (data, fetchOptions) => {
-        return await $fetch("/mercado-pago/subscription/cancel", {
-          method: "POST",
-          body: data,
-          ...fetchOptions
-        });
-      },
-      /**
-       * Create a reusable preapproval plan (subscription template)
-       *
-       * Plans can be reused for multiple subscriptions. Create once,
-       * use many times with createSubscription({ preapprovalPlanId })
-       *
-       * @example
-       * ```ts
-       * const { data } = await authClient.mercadoPago.createPreapprovalPlan({
-       *   reason: "Premium Monthly",
-       *   autoRecurring: {
-       *     frequency: 1,
-       *     frequencyType: "months",
-       *     transactionAmount: 99.90,
-       *     freeTrial: {
-       *       frequency: 7,
-       *       frequencyType: "days"
-       *     }
-       *   },
-       *   repetitions: 12 // 12 months, omit for infinite
-       * });
-       *
-       * // Use the plan
-       * const planId = data.plan.mercadoPagoPlanId;
-       * ```
-       */
-      createPreapprovalPlan: async (data, fetchOptions) => {
-        return await $fetch("/mercado-pago/plan/create", {
-          method: "POST",
-          body: data,
-          ...fetchOptions
-        });
-      },
-      /**
-       * List all preapproval plans
-       *
-       * @example
-       * ```ts
-       * const { data } = await authClient.mercadoPago.listPreapprovalPlans();
-       *
-       * data.plans.forEach(plan => {
-       *   console.log(plan.reason); // "Premium Monthly"
-       *   console.log(plan.transactionAmount); // 99.90
-       * });
-       * ```
-       */
-      listPreapprovalPlans: async (fetchOptions) => {
-        return await $fetch("/mercado-pago/plans", {
-          method: "GET",
-          ...fetchOptions
-        });
-      },
-      /**
-       * Get payment by ID
-       */
-      getPayment: async (paymentId, fetchOptions) => {
-        return await $fetch(`/mercado-pago/payment/${paymentId}`, {
-          method: "GET",
-          ...fetchOptions
-        });
-      },
-      /**
-       * List all payments for the authenticated user
-       *
-       * @example
-       * ```ts
-       * const { data } = await authClient.mercadoPago.listPayments({
-       *   limit: 20,
-       *   offset: 0
-       * });
-       * ```
-       */
-      listPayments: async (params, fetchOptions) => {
-        const query = new URLSearchParams();
-        if (params?.limit) query.set("limit", params.limit.toString());
-        if (params?.offset) query.set("offset", params.offset.toString());
-        return await $fetch(`/mercado-pago/payments?${query.toString()}`, {
-          method: "GET",
-          ...fetchOptions
-        });
-      },
-      /**
-       * List all subscriptions for the authenticated user
-       *
-       * @example
-       * ```ts
-       * const { data } = await authClient.mercadoPago.listSubscriptions();
-       * ```
-       */
-      listSubscriptions: async (fetchOptions) => {
-        return await $fetch(`/mercado-pago/subscriptions`, {
-          method: "GET",
-          ...fetchOptions
-        });
-      },
-      /**
-       * Get OAuth authorization URL for marketplace sellers
-       *
-       * This is Step 1 of OAuth flow. Redirect the seller to this URL so they
-       * can authorize your app to process payments on their behalf.
-       *
-       * @example
-       * ```ts
-       * const { data } = await authClient.mercadoPago.getOAuthUrl({
-       *   redirectUri: "https://myapp.com/oauth/callback"
-       * });
-       *
-       * // Redirect seller to authorize
-       * window.location.href = data.authUrl;
-       * ```
-       */
-      getOAuthUrl: async (params, fetchOptions) => {
-        const query = new URLSearchParams();
-        query.set("redirectUri", params.redirectUri);
-        return await $fetch(
-          `/mercado-pago/oauth/authorize?${query.toString()}`,
-          {
-            method: "GET",
-            ...fetchOptions
-          }
-        );
-      },
-      /**
-       * Exchange OAuth code for access token
-       *
-       * This is Step 2 of OAuth flow. After the seller authorizes and MP redirects
-       * them back with a code, exchange that code for an access token.
-       *
-       * @example
-       * ```ts
-       * // In your /oauth/callback page:
-       * const code = new URLSearchParams(window.location.search).get("code");
-       *
-       * const { data } = await authClient.mercadoPago.exchangeOAuthCode({
-       *   code,
-       *   redirectUri: "https://myapp.com/oauth/callback"
-       * });
-       *
-       * // Now you have the seller's MP User ID
-       * console.log(data.oauthToken.mercadoPagoUserId);
-       * ```
-       */
-      exchangeOAuthCode: async (data, fetchOptions) => {
-        return await $fetch("/mercado-pago/oauth/callback", {
-          method: "POST",
-          body: data,
-          ...fetchOptions
-        });
-      }
-    })
-  };
-};
-
-// index.ts
-var mercadoPagoPlugin = (options) => {
-  const client = new MercadoPagoConfig({
-    accessToken: options.accessToken
-  });
-  const preferenceClient = new Preference(client);
-  const paymentClient = new Payment(client);
-  const customerClient = new Customer(client);
-  const preApprovalClient = new PreApproval(client);
-  const preApprovalPlanClient = new PreApprovalPlan(client);
-  return {
-    id: "mercadopago",
-    schema: {
-      // Customer table - stores MP customer info
-      mercadoPagoCustomer: {
-        fields: {
-          id: { type: "string", required: true },
-          userId: {
-            type: "string",
-            required: true,
-            references: { model: "user", field: "id", onDelete: "cascade" }
-          },
-          mercadoPagoId: { type: "string", required: true, unique: true },
-          email: { type: "string", required: true },
-          createdAt: { type: "date", required: true },
-          updatedAt: { type: "date", required: true }
-        }
-      },
-      // Payment table - one-time payments
-      mercadoPagoPayment: {
-        fields: {
-          id: { type: "string", required: true },
-          userId: {
-            type: "string",
-            required: true,
-            references: { model: "user", field: "id", onDelete: "cascade" }
-          },
-          mercadoPagoPaymentId: {
-            type: "string",
-            required: true,
-            unique: true
-          },
-          preferenceId: { type: "string", required: true },
-          status: { type: "string", required: true },
-          // pending, approved, authorized, rejected, cancelled, refunded, charged_back
-          statusDetail: { type: "string" },
-          // accredited, pending_contingency, pending_review_manual, cc_rejected_*, etc
-          amount: { type: "number", required: true },
-          currency: { type: "string", required: true },
-          paymentMethodId: { type: "string" },
-          // visa, master, pix, etc
-          paymentTypeId: { type: "string" },
-          // credit_card, debit_card, ticket, etc
-          metadata: { type: "string" },
-          // JSON stringified
-          createdAt: { type: "date", required: true },
-          updatedAt: { type: "date", required: true }
-        }
-      },
-      // Subscription table
-      mercadoPagoSubscription: {
-        fields: {
-          id: { type: "string", required: true },
-          userId: {
-            type: "string",
-            required: true,
-            references: { model: "user", field: "id", onDelete: "cascade" }
-          },
-          mercadoPagoSubscriptionId: {
-            type: "string",
-            required: true,
-            unique: true
-          },
-          planId: { type: "string", required: true },
-          status: { type: "string", required: true },
-          // authorized, paused, cancelled, pending
-          reason: { type: "string" },
-          // Reason for status (e.g., payment_failed, user_cancelled)
-          nextPaymentDate: { type: "date" },
-          lastPaymentDate: { type: "date" },
-          summarized: { type: "string" },
-          // JSON with charges, charged_amount, pending_charge_amount
-          metadata: { type: "string" },
-          // JSON stringified
-          createdAt: { type: "date", required: true },
-          updatedAt: { type: "date", required: true }
-        }
-      },
-      // Preapproval Plan table (reusable subscription plans)
-      mercadoPagoPreapprovalPlan: {
-        fields: {
-          id: { type: "string", required: true },
-          mercadoPagoPlanId: { type: "string", required: true, unique: true },
-          reason: { type: "string", required: true },
-          // Plan description
-          frequency: { type: "number", required: true },
-          frequencyType: { type: "string", required: true },
-          // days, months
-          transactionAmount: { type: "number", required: true },
-          currencyId: { type: "string", required: true },
-          repetitions: { type: "number" },
-          // null = infinite
-          freeTrial: { type: "string" },
-          // JSON with frequency and frequency_type
-          metadata: { type: "string" },
-          // JSON stringified
-          createdAt: { type: "date", required: true },
-          updatedAt: { type: "date", required: true }
-        }
-      },
-      // Split payments table (for marketplace)
-      mercadoPagoMarketplaceSplit: {
-        fields: {
-          id: { type: "string", required: true },
-          paymentId: {
-            type: "string",
-            required: true,
-            references: {
-              model: "mercadoPagoPayment",
-              field: "id",
-              onDelete: "cascade"
-            }
-          },
-          // Changed naming to be more clear
-          collectorId: { type: "string", required: true },
-          // MP User ID who receives the money (seller)
-          collectorEmail: { type: "string", required: true },
-          // Email of who receives money
-          applicationFeeAmount: { type: "number" },
-          // Platform commission in absolute value
-          applicationFeePercentage: { type: "number" },
-          // Platform commission percentage
-          netAmount: { type: "number", required: true },
-          // Amount that goes to collector (seller)
-          metadata: { type: "string" },
-          createdAt: { type: "date", required: true }
-        }
-      },
-      // OAuth tokens for marketplace (to make payments on behalf of sellers)
-      mercadoPagoOAuthToken: {
-        fields: {
-          id: { type: "string", required: true },
-          userId: {
-            type: "string",
-            required: true,
-            references: { model: "user", field: "id", onDelete: "cascade" }
-          },
-          accessToken: { type: "string", required: true },
-          refreshToken: { type: "string", required: true },
-          publicKey: { type: "string", required: true },
-          mercadoPagoUserId: { type: "string", required: true, unique: true },
-          expiresAt: { type: "date", required: true },
-          createdAt: { type: "date", required: true },
-          updatedAt: { type: "date", required: true }
-        }
-      }
-    },
-    endpoints: {
-      // Get or create customer automatically
-      getOrCreateCustomer: createAuthEndpoint(
-        "/mercado-pago/customer",
-        {
-          method: "POST",
-          requireAuth: true,
-          body: z.object({
-            email: z.string().email().optional(),
-            firstName: z.string().optional(),
-            lastName: z.string().optional()
-          })
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED", {
-              message: "You must be logged in"
-            });
-          }
-          const { email, firstName, lastName } = ctx.body;
-          const userEmail = email || session.user.email;
-          const existingCustomer = await ctx.context.adapter.findOne({
-            model: "mercadoPagoCustomer",
-            where: [{ field: "userId", value: session.user.id }]
-          });
-          if (existingCustomer) {
-            return ctx.json({ customer: existingCustomer });
-          }
-          const mpCustomer = await customerClient.create({
-            body: {
-              email: userEmail,
-              first_name: firstName,
-              last_name: lastName
-            }
-          });
-          const customer = await ctx.context.adapter.create({
-            model: "mercadoPagoCustomer",
-            data: {
-              id: generateId(),
-              userId: session.user.id,
-              mercadoPagoId: mpCustomer.id,
-              email: userEmail,
-              createdAt: /* @__PURE__ */ new Date(),
-              updatedAt: /* @__PURE__ */ new Date()
-            }
-          });
-          return ctx.json({ customer });
-        }
-      ),
-      // OAuth: Get authorization URL for marketplace sellers
-      getOAuthUrl: createAuthEndpoint(
-        "/mercado-pago/oauth/authorize",
-        {
-          method: "GET",
-          requireAuth: true,
-          query: z.object({
-            redirectUri: z.string().url()
-          })
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          if (!options.appId) {
-            throw new APIError2("BAD_REQUEST", {
-              message: "OAuth not configured. Please provide appId in plugin options"
-            });
-          }
-          const { redirectUri } = ctx.query;
-          if (!ctx.context.isTrustedOrigin(redirectUri)) {
-            throw new APIError2("FORBIDDEN", {
-              message: "Redirect URI not in trusted origins"
-            });
-          }
-          const authUrl = `https://auth.mercadopago.com/authorization?client_id=${options.appId}&response_type=code&platform_id=mp&state=${session.user.id}&redirect_uri=${encodeURIComponent(redirectUri)}`;
-          return ctx.json({ authUrl });
-        }
-      ),
-      // OAuth: Exchange code for access token
-      exchangeOAuthCode: createAuthEndpoint(
-        "/mercado-pago/oauth/callback",
-        {
-          method: "POST",
-          requireAuth: true,
-          body: z.object({
-            code: z.string(),
-            redirectUri: z.string().url()
-          })
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          if (!options.appId || !options.appSecret) {
-            throw new APIError2("BAD_REQUEST", {
-              message: "OAuth not configured"
-            });
-          }
-          const { code, redirectUri } = ctx.body;
-          const tokenResponse = await fetch(
-            "https://api.mercadopago.com/oauth/token",
-            {
-              method: "POST",
-              headers: { "Content-Type": "application/json" },
-              body: JSON.stringify({
-                client_id: options.appId,
-                client_secret: options.appSecret,
-                grant_type: "authorization_code",
-                code,
-                redirect_uri: redirectUri
-              })
-            }
-          );
-          if (!tokenResponse.ok) {
-            throw new APIError2("BAD_REQUEST", {
-              message: "Failed to exchange OAuth code"
-            });
-          }
-          const tokenData = await tokenResponse.json();
-          const oauthToken = await ctx.context.adapter.create({
-            model: "mercadoPagoOAuthToken",
-            data: {
-              id: generateId(),
-              userId: session.user.id,
-              accessToken: tokenData.access_token,
-              refreshToken: tokenData.refresh_token,
-              publicKey: tokenData.public_key,
-              mercadoPagoUserId: tokenData.user_id.toString(),
-              expiresAt: new Date(Date.now() + tokenData.expires_in * 1e3),
-              createdAt: /* @__PURE__ */ new Date(),
-              updatedAt: /* @__PURE__ */ new Date()
-            }
-          });
-          return ctx.json({
-            success: true,
-            oauthToken: {
-              id: oauthToken.id,
-              mercadoPagoUserId: oauthToken.mercadoPagoUserId,
-              expiresAt: oauthToken.expiresAt
-            }
-          });
-        }
-      ),
-      // Create a reusable preapproval plan (subscription plan)
-      createPreapprovalPlan: createAuthEndpoint(
-        "/mercado-pago/plan/create",
-        {
-          method: "POST",
-          body: z.object({
-            reason: z.string(),
-            // Plan description (e.g., "Premium Monthly")
-            autoRecurring: z.object({
-              frequency: z.number(),
-              // 1, 7, 30, etc
-              frequencyType: z.enum(["days", "months"]),
-              transactionAmount: z.number(),
-              currencyId: z.string().default("ARS"),
-              freeTrial: z.object({
-                frequency: z.number(),
-                frequencyType: z.enum(["days", "months"])
-              }).optional()
-            }),
-            repetitions: z.number().optional(),
-            // null = infinite
-            backUrl: z.string().optional(),
-            metadata: z.record(z.any()).optional()
-          })
-        },
-        async (ctx) => {
-          const { reason, autoRecurring, repetitions, backUrl, metadata } = ctx.body;
-          const baseUrl = options.baseUrl || ctx.context.baseURL;
-          const planBody = {
-            reason,
-            auto_recurring: {
-              frequency: autoRecurring.frequency,
-              frequency_type: autoRecurring.frequencyType,
-              transaction_amount: autoRecurring.transactionAmount,
-              currency_id: autoRecurring.currencyId
-            },
-            back_url: backUrl || `${baseUrl}/plan/created`
-          };
-          if (repetitions && planBody.auto_recurring) {
-            planBody.auto_recurring.repetitions = repetitions;
-          }
-          if (autoRecurring.freeTrial && planBody.auto_recurring) {
-            planBody.auto_recurring.free_trial = {
-              frequency: autoRecurring.freeTrial.frequency,
-              frequency_type: autoRecurring.freeTrial.frequencyType
-            };
-          }
-          const mpPlan = await preApprovalPlanClient.create({ body: planBody });
-          const plan = await ctx.context.adapter.create({
-            model: "mercadoPagoPreapprovalPlan",
-            data: {
-              id: generateId(),
-              mercadoPagoPlanId: mpPlan.id,
-              reason,
-              frequency: autoRecurring.frequency,
-              frequencyType: autoRecurring.frequencyType,
-              transactionAmount: autoRecurring.transactionAmount,
-              currencyId: autoRecurring.currencyId,
-              repetitions: repetitions || null,
-              freeTrial: autoRecurring.freeTrial ? JSON.stringify(autoRecurring.freeTrial) : null,
-              metadata: JSON.stringify(metadata || {}),
-              createdAt: /* @__PURE__ */ new Date(),
-              updatedAt: /* @__PURE__ */ new Date()
-            }
-          });
-          return ctx.json({ plan });
-        }
-      ),
-      // List all preapproval plans
-      listPreapprovalPlans: createAuthEndpoint(
-        "/mercado-pago/plans",
-        {
-          method: "GET"
-        },
-        async (ctx) => {
-          const plans = await ctx.context.adapter.findMany({
-            model: "mercadoPagoPreapprovalPlan"
-          });
-          return ctx.json({ plans });
-        }
-      ),
-      // Create payment preference
-      createPayment: createAuthEndpoint(
-        "/mercado-pago/payment/create",
-        {
-          method: "POST",
-          requireAuth: true,
-          body: z.object({
-            items: z.array(
-              z.object({
-                id: z.string(),
-                title: z.string().min(1).max(256),
-                quantity: z.number().int().min(1).max(1e4),
-                unitPrice: z.number().positive().max(999999999),
-                currencyId: z.string().default("ARS")
-              })
-            ).min(1).max(100),
-            metadata: z.record(z.any()).optional(),
-            marketplace: z.object({
-              collectorId: z.string(),
-              applicationFee: z.number().positive().optional(),
-              applicationFeePercentage: z.number().min(0).max(100).optional()
-            }).optional(),
-            successUrl: z.string().url().optional(),
-            failureUrl: z.string().url().optional(),
-            pendingUrl: z.string().url().optional(),
-            idempotencyKey: z.string().optional()
-          })
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          const rateLimitKey = `payment:create:${session.user.id}`;
-          if (!rateLimiter.check(rateLimitKey, 10, 60 * 1e3)) {
-            throw new APIError2("TOO_MANY_REQUESTS", {
-              message: "Too many payment creation attempts. Please try again later."
-            });
-          }
-          const {
-            items,
-            metadata,
-            marketplace,
-            successUrl,
-            failureUrl,
-            pendingUrl,
-            idempotencyKey
-          } = ctx.body;
-          if (idempotencyKey) {
-            if (!validateIdempotencyKey(idempotencyKey)) {
-              throw new APIError2("BAD_REQUEST", {
-                message: "Invalid idempotency key format"
-              });
-            }
-            const cachedResult = idempotencyStore.get(idempotencyKey);
-            if (cachedResult) {
-              return ctx.json(cachedResult);
-            }
-          }
-          if (options.trustedOrigins) {
-            const urls = [successUrl, failureUrl, pendingUrl].filter(
-              Boolean
-            );
-            for (const url of urls) {
-              if (!validateCallbackUrl(url, options.trustedOrigins)) {
-                throw new APIError2("FORBIDDEN", {
-                  message: `URL ${url} is not in trusted origins`
-                });
-              }
-            }
-          }
-          if (items.some((item) => !ValidationRules.currency(item.currencyId))) {
-            throw new APIError2("BAD_REQUEST", {
-              message: "Invalid currency code"
-            });
-          }
-          const sanitizedMetadata = metadata ? sanitizeMetadata(metadata) : {};
-          let customer = await ctx.context.adapter.findOne({
-            model: "mercadoPagoCustomer",
-            where: [{ field: "userId", value: session.user.id }]
-          });
-          if (!customer) {
-            try {
-              const mpCustomer = await customerClient.create({
-                body: { email: session.user.email }
-              });
-              customer = await ctx.context.adapter.create({
-                model: "mercadoPagoCustomer",
-                data: {
-                  id: generateId(),
-                  userId: session.user.id,
-                  mercadoPagoId: mpCustomer.id,
-                  email: session.user.email,
-                  createdAt: /* @__PURE__ */ new Date(),
-                  updatedAt: /* @__PURE__ */ new Date()
-                }
-              });
-            } catch (error) {
-              handleMercadoPagoError(error);
-            }
-          }
-          const baseUrl = options.baseUrl || ctx.context.baseURL;
-          const totalAmount = items.reduce(
-            (sum, item) => sum + item.unitPrice * item.quantity,
-            0
-          );
-          if (!ValidationRules.amount(totalAmount)) {
-            throw new APIError2("BAD_REQUEST", {
-              message: "Invalid payment amount"
-            });
-          }
-          let applicationFeeAmount = 0;
-          if (marketplace) {
-            if (marketplace.applicationFee) {
-              applicationFeeAmount = marketplace.applicationFee;
-            } else if (marketplace.applicationFeePercentage) {
-              applicationFeeAmount = totalAmount * marketplace.applicationFeePercentage / 100;
-            }
-            if (applicationFeeAmount >= totalAmount) {
-              throw new APIError2("BAD_REQUEST", {
-                message: "Application fee cannot exceed total amount"
-              });
-            }
-          }
-          const preferenceBody = {
-            items: items.map((item) => ({
-              id: item.id,
-              title: item.title,
-              quantity: item.quantity,
-              unit_price: item.unitPrice,
-              currency_id: item.currencyId
-            })),
-            payer: {
-              email: session.user.email
-            },
-            back_urls: {
-              success: successUrl || `${baseUrl}/payment/success`,
-              failure: failureUrl || `${baseUrl}/payment/failure`,
-              pending: pendingUrl || `${baseUrl}/payment/pending`
-            },
-            notification_url: `${baseUrl}/api/auth/mercado-pago/webhook`,
-            metadata: {
-              ...sanitizedMetadata,
-              userId: session.user.id,
-              customerId: customer?.id
-            },
-            expires: true,
-            expiration_date_from: (/* @__PURE__ */ new Date()).toISOString(),
-            expiration_date_to: new Date(
-              Date.now() + 30 * 24 * 60 * 60 * 1e3
-            ).toISOString()
-            // 30 days
-          };
-          if (marketplace) {
-            preferenceBody.marketplace = marketplace.collectorId;
-            preferenceBody.marketplace_fee = applicationFeeAmount;
-          }
-          let preference;
-          try {
-            preference = await preferenceClient.create({
-              body: preferenceBody
-            });
-          } catch (error) {
-            handleMercadoPagoError(error);
-          }
-          const payment = await ctx.context.adapter.create({
-            model: "mercadoPagoPayment",
-            data: {
-              id: generateId(),
-              userId: session.user.id,
-              mercadoPagoPaymentId: preference.id,
-              preferenceId: preference.id,
-              status: "pending",
-              amount: totalAmount,
-              currency: items[0].currencyId,
-              metadata: JSON.stringify(sanitizedMetadata),
-              createdAt: /* @__PURE__ */ new Date(),
-              updatedAt: /* @__PURE__ */ new Date()
-            }
-          });
-          if (marketplace) {
-            await ctx.context.adapter.create({
-              model: "mercadoPagoMarketplaceSplit",
-              data: {
-                id: generateId(),
-                paymentId: payment.id,
-                collectorId: marketplace.collectorId,
-                collectorEmail: "",
-                // Will be updated via webhook
-                applicationFeeAmount,
-                applicationFeePercentage: marketplace.applicationFeePercentage,
-                netAmount: totalAmount - applicationFeeAmount,
-                metadata: JSON.stringify({}),
-                createdAt: /* @__PURE__ */ new Date()
-              }
-            });
-          }
-          const result = {
-            checkoutUrl: preference.init_point,
-            preferenceId: preference.id,
-            payment
-          };
-          if (idempotencyKey) {
-            idempotencyStore.set(idempotencyKey, result);
-          }
-          return ctx.json(result);
-        }
-      ),
-      // Create subscription (supports both with and without preapproval plan)
-      createSubscription: createAuthEndpoint(
-        "/mercado-pago/subscription/create",
-        {
-          method: "POST",
-          requireAuth: true,
-          body: z.object({
-            // Option 1: Use existing preapproval plan
-            preapprovalPlanId: z.string().optional(),
-            // Option 2: Create subscription directly without plan
-            reason: z.string().optional(),
-            // Description of subscription
-            autoRecurring: z.object({
-              frequency: z.number(),
-              // 1 for monthly
-              frequencyType: z.enum(["days", "months"]),
-              transactionAmount: z.number(),
-              currencyId: z.string().default("ARS"),
-              startDate: z.string().optional(),
-              // ISO date
-              endDate: z.string().optional(),
-              // ISO date
-              freeTrial: z.object({
-                frequency: z.number(),
-                frequencyType: z.enum(["days", "months"])
-              }).optional()
-            }).optional(),
-            backUrl: z.string().optional(),
-            metadata: z.record(z.any()).optional()
-          })
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          const {
-            preapprovalPlanId,
-            reason,
-            autoRecurring,
-            backUrl,
-            metadata
-          } = ctx.body;
-          if (!preapprovalPlanId) {
-            if (!reason || !autoRecurring) {
-              throw new APIError2("BAD_REQUEST", {
-                message: "Must provide either preapprovalPlanId or (reason + autoRecurring)"
-              });
-            }
-          }
-          let customer = await ctx.context.adapter.findOne({
-            model: "mercadoPagoCustomer",
-            where: [{ field: "userId", value: session.user.id }]
-          });
-          if (!customer) {
-            const mpCustomer = await customerClient.create({
-              body: { email: session.user.email }
-            });
-            customer = await ctx.context.adapter.create({
-              model: "mercadoPagoCustomer",
-              data: {
-                id: generateId(),
-                userId: session.user.id,
-                mercadoPagoId: mpCustomer.id,
-                email: session.user.email,
-                createdAt: /* @__PURE__ */ new Date(),
-                updatedAt: /* @__PURE__ */ new Date()
-              }
-            });
-          }
-          const baseUrl = options.baseUrl || ctx.context.baseURL;
-          const subscriptionId = generateId();
-          let preapproval;
-          if (preapprovalPlanId) {
-            preapproval = await preApprovalClient.create({
-              body: {
-                preapproval_plan_id: preapprovalPlanId,
-                payer_email: session.user.email,
-                card_token_id: void 0,
-                // Will be provided in checkout
-                back_url: backUrl || `${baseUrl}/subscription/success`,
-                status: "pending",
-                external_reference: subscriptionId
-              }
-            });
-          } else if (autoRecurring) {
-            const ar = autoRecurring;
-            const autoRecurringBody = {
-              frequency: ar.frequency,
-              frequency_type: ar.frequencyType,
-              transaction_amount: ar.transactionAmount,
-              currency_id: ar.currencyId
-            };
-            if (ar.startDate) {
-              autoRecurringBody.start_date = ar.startDate;
-            }
-            if (ar.endDate) {
-              autoRecurringBody.end_date = ar.endDate;
-            }
-            if (ar.freeTrial) {
-              autoRecurringBody.free_trial = {
-                frequency: ar.freeTrial.frequency,
-                frequency_type: ar.freeTrial.frequencyType
-              };
-            }
-            preapproval = await preApprovalClient.create({
-              body: {
-                reason,
-                auto_recurring: autoRecurringBody,
-                payer_email: session.user.email,
-                back_url: backUrl || `${baseUrl}/subscription/success`,
-                status: "pending",
-                external_reference: subscriptionId
-              }
-            });
-          }
-          if (!preapproval) {
-            throw new APIError2("BAD_REQUEST", {
-              message: "Failed to create subscription"
-            });
-          }
-          const subscription = await ctx.context.adapter.create({
-            model: "mercadoPagoSubscription",
-            data: {
-              id: subscriptionId,
-              userId: session.user.id,
-              mercadoPagoSubscriptionId: preapproval.id,
-              planId: preapprovalPlanId || reason || "direct",
-              status: "pending",
-              metadata: JSON.stringify(metadata || {}),
-              createdAt: /* @__PURE__ */ new Date(),
-              updatedAt: /* @__PURE__ */ new Date()
-            }
-          });
-          return ctx.json({
-            checkoutUrl: preapproval.init_point,
-            subscription
-          });
-        }
-      ),
-      // Cancel subscription
-      cancelSubscription: createAuthEndpoint(
-        "/mercado-pago/subscription/cancel",
-        {
-          method: "POST",
-          requireAuth: true,
-          body: z.object({
-            subscriptionId: z.string()
-          })
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          const { subscriptionId } = ctx.body;
-          const subscription = await ctx.context.adapter.findOne({
-            model: "mercadoPagoSubscription",
-            where: [
-              { field: "id", value: subscriptionId },
-              { field: "userId", value: session.user.id }
-            ]
-          });
-          if (!subscription) {
-            throw new APIError2("NOT_FOUND", {
-              message: "Subscription not found"
-            });
-          }
-          await preApprovalClient.update({
-            id: subscription.mercadoPagoSubscriptionId,
-            body: { status: "cancelled" }
-          });
-          await ctx.context.adapter.update({
-            model: "mercadoPagoSubscription",
-            where: [{ field: "id", value: subscriptionId }],
-            update: {
-              status: "cancelled",
-              updatedAt: /* @__PURE__ */ new Date()
-            }
-          });
-          return ctx.json({ success: true });
-        }
-      ),
-      // Get payment status
-      getPayment: createAuthEndpoint(
-        "/mercado-pago/payment/:id",
-        {
-          method: "GET",
-          requireAuth: true
-        },
-        async (ctx) => {
-          const paymentId = ctx.params.id;
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          const payment = await ctx.context.adapter.findOne({
-            model: "mercadoPagoPayment",
-            where: [
-              { field: "id", value: paymentId },
-              { field: "userId", value: session.user.id }
-            ]
-          });
-          if (!payment) {
-            throw new APIError2("NOT_FOUND", {
-              message: "Payment not found"
-            });
-          }
-          return ctx.json({ payment });
-        }
-      ),
-      // List user payments
-      listPayments: createAuthEndpoint(
-        "/mercado-pago/payments",
-        {
-          method: "GET",
-          requireAuth: true,
-          query: z.object({
-            limit: z.coerce.number().optional().default(10),
-            offset: z.coerce.number().optional().default(0)
-          })
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          const { limit, offset } = ctx.query;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          const payments = await ctx.context.adapter.findMany({
-            model: "mercadoPagoPayment",
-            where: [{ field: "userId", value: session.user.id }],
-            limit,
-            offset
-          });
-          return ctx.json({ payments });
-        }
-      ),
-      // List user subscriptions
-      listSubscriptions: createAuthEndpoint(
-        "/mercado-pago/subscriptions",
-        {
-          method: "GET",
-          requireAuth: true
-        },
-        async (ctx) => {
-          const session = ctx.context.session;
-          if (!session) {
-            throw new APIError2("UNAUTHORIZED");
-          }
-          const subscriptions = await ctx.context.adapter.findMany({
-            model: "mercadoPagoSubscription",
-            where: [{ field: "userId", value: session.user.id }]
-          });
-          return ctx.json({ subscriptions });
-        }
-      ),
-      // Webhook handler
-      webhook: createAuthEndpoint(
-        "/mercado-pago/webhook",
-        {
-          method: "POST"
-        },
-        async (ctx) => {
-          const webhookRateLimitKey = "webhook:global";
-          if (!rateLimiter.check(webhookRateLimitKey, 1e3, 60 * 1e3)) {
-            throw new APIError2("TOO_MANY_REQUESTS", {
-              message: "Webhook rate limit exceeded"
-            });
-          }
-          let notification;
-          try {
-            notification = ctx.body;
-          } catch {
-            throw new APIError2("BAD_REQUEST", {
-              message: "Invalid JSON payload"
-            });
-          }
-          if (!notification.type || !isValidWebhookTopic(notification.type) || !notification.data?.id) {
-            ctx.context.logger.warn("Invalid webhook topic received", {
-              type: notification.type
-            });
-            return ctx.json({ received: true });
-          }
-          if (!ctx.request) {
-            throw new APIError2("BAD_REQUEST", {
-              message: "Missing request"
-            });
-          }
-          if (options.webhookSecret) {
-            const xSignature = ctx.request.headers.get("x-signature");
-            const xRequestId = ctx.request.headers.get("x-request-id");
-            const dataId = notification.data?.id?.toString();
-            if (!dataId) {
-              throw new APIError2("BAD_REQUEST", {
-                message: "Missing data.id in webhook payload"
-              });
-            }
-            const isValid = verifyWebhookSignature({
-              xSignature,
-              xRequestId,
-              dataId,
-              secret: options.webhookSecret
-            });
-            if (!isValid) {
-              ctx.context.logger.error("Invalid webhook signature", {
-                xSignature,
-                xRequestId,
-                dataId
-              });
-              throw new APIError2("UNAUTHORIZED", {
-                message: "Invalid webhook signature"
-              });
-            }
-          }
-          const webhookId = `webhook:${notification.data?.id}:${notification.type}`;
-          const alreadyProcessed = idempotencyStore.get(webhookId);
-          if (alreadyProcessed) {
-            ctx.context.logger.info("Webhook already processed", { webhookId });
-            return ctx.json({ received: true });
-          }
-          idempotencyStore.set(webhookId, true, 24 * 60 * 60 * 1e3);
-          try {
-            if (notification.type === "payment") {
-              const paymentId = notification.data.id;
-              if (!paymentId) {
-                throw new APIError2("BAD_REQUEST", {
-                  message: "Missing payment ID"
-                });
-              }
-              let mpPayment;
-              try {
-                mpPayment = await paymentClient.get({
-                  id: paymentId
-                });
-              } catch (error) {
-                ctx.context.logger.error("Failed to fetch payment from MP", {
-                  paymentId,
-                  error
-                });
-                throw new APIError2("BAD_REQUEST", {
-                  message: "Failed to fetch payment details"
-                });
-              }
-              const existingPayment = await ctx.context.adapter.findOne({
-                model: "mercadoPagoPayment",
-                where: [
-                  {
-                    field: "mercadoPagoPaymentId",
-                    value: paymentId.toString()
-                  }
-                ]
-              });
-              if (existingPayment) {
-                if (!validatePaymentAmount(
-                  existingPayment.amount,
-                  mpPayment.transaction_amount || 0
-                )) {
-                  ctx.context.logger.error("Payment amount mismatch", {
-                    expected: existingPayment.amount,
-                    received: mpPayment.transaction_amount
-                  });
-                  throw new APIError2("BAD_REQUEST", {
-                    message: "Payment amount mismatch"
-                  });
-                }
-                await ctx.context.adapter.update({
-                  model: "mercadoPagoPayment",
-                  where: [{ field: "id", value: existingPayment.id }],
-                  update: {
-                    status: mpPayment.status,
-                    statusDetail: mpPayment.status_detail || void 0,
-                    paymentMethodId: mpPayment.payment_method_id || void 0,
-                    paymentTypeId: mpPayment.payment_type_id || void 0,
-                    updatedAt: /* @__PURE__ */ new Date()
-                  }
-                });
-                if (options.onPaymentUpdate) {
-                  try {
-                    await options.onPaymentUpdate({
-                      payment: existingPayment,
-                      status: mpPayment.status,
-                      statusDetail: mpPayment.status_detail || "",
-                      mpPayment
-                    });
-                  } catch (error) {
-                    ctx.context.logger.error(
-                      "Error in onPaymentUpdate callback",
-                      { error }
-                    );
-                  }
-                }
-              }
-            }
-            if (notification.type === "subscription_preapproval" || notification.type === "subscription_preapproval_plan") {
-              const preapprovalId = notification.data.id;
-              if (!preapprovalId) {
-                throw new APIError2("BAD_REQUEST", {
-                  message: "Missing preapproval ID"
-                });
-              }
-              let mpPreapproval;
-              try {
-                mpPreapproval = await preApprovalClient.get({
-                  id: preapprovalId
-                });
-              } catch (error) {
-                ctx.context.logger.error(
-                  "Failed to fetch preapproval from MP",
-                  { preapprovalId, error }
-                );
-                throw new APIError2("BAD_REQUEST", {
-                  message: "Failed to fetch subscription details"
-                });
-              }
-              const existingSubscription = await ctx.context.adapter.findOne({
-                model: "mercadoPagoSubscription",
-                where: [
-                  {
-                    field: "mercadoPagoSubscriptionId",
-                    value: preapprovalId
-                  }
-                ]
-              });
-              if (existingSubscription) {
-                await ctx.context.adapter.update({
-                  model: "mercadoPagoSubscription",
-                  where: [{ field: "id", value: existingSubscription.id }],
-                  update: {
-                    status: mpPreapproval.status,
-                    reason: mpPreapproval.reason || void 0,
-                    nextPaymentDate: mpPreapproval.next_payment_date ? new Date(mpPreapproval.next_payment_date) : void 0,
-                    lastPaymentDate: mpPreapproval.last_modified ? new Date(mpPreapproval.last_modified) : void 0,
-                    summarized: mpPreapproval.summarized ? JSON.stringify(mpPreapproval.summarized) : void 0,
-                    updatedAt: /* @__PURE__ */ new Date()
-                  }
-                });
-                if (options.onSubscriptionUpdate) {
-                  try {
-                    await options.onSubscriptionUpdate({
-                      subscription: existingSubscription,
-                      status: mpPreapproval.status,
-                      reason: mpPreapproval.reason || "",
-                      mpPreapproval
-                    });
-                  } catch (error) {
-                    ctx.context.logger.error(
-                      "Error in onSubscriptionUpdate callback",
-                      { error }
-                    );
-                  }
-                }
-              }
-            }
-            if (notification.type === "subscription_authorized_payment" || notification.type === "authorized_payment") {
-              const paymentId = notification.data.id;
-              if (!paymentId) {
-                throw new APIError2("BAD_REQUEST", {
-                  message: "Missing payment ID"
-                });
-              }
-              let mpPayment;
-              try {
-                mpPayment = await paymentClient.get({
-                  id: paymentId
-                });
-              } catch (error) {
-                ctx.context.logger.error(
-                  "Failed to fetch authorized payment from MP",
-                  { paymentId, error }
-                );
-                throw new APIError2("BAD_REQUEST", {
-                  message: "Failed to fetch payment details"
-                });
-              }
-              if (mpPayment.external_reference) {
-                const subscription = await ctx.context.adapter.findOne({
-                  model: "mercadoPagoSubscription",
-                  where: [
-                    {
-                      field: "id",
-                      // External reference holds the local subscription ID
-                      value: mpPayment.external_reference
-                    }
-                  ]
-                });
-                if (subscription) {
-                  if (options.onSubscriptionPayment) {
-                    try {
-                      await options.onSubscriptionPayment({
-                        subscription,
-                        // In a real app, we should map this properly or align types
-                        payment: mpPayment,
-                        status: mpPayment.status
-                      });
-                    } catch (error) {
-                      ctx.context.logger.error(
-                        "Error in onSubscriptionPayment callback",
-                        { error }
-                      );
-                    }
-                  }
-                } else {
-                  ctx.context.logger.warn(
-                    "Subscription not found for authorized payment",
-                    {
-                      paymentId,
-                      externalReference: mpPayment.external_reference
-                    }
-                  );
-                }
-              }
-            }
-          } catch (error) {
-            ctx.context.logger.error("Error processing webhook", {
-              error,
-              notification
-            });
-            if (error instanceof APIError2) {
-              throw error;
-            }
-          }
-          return ctx.json({ received: true });
-        }
-      )
-    },
-    // Add trusted origins from options
-    ...options.trustedOrigins && { trustedOrigins: options.trustedOrigins }
-  };
-};
-export {
-  mercadoPagoClientPlugin,
-  mercadoPagoPlugin
-};
-//# sourceMappingURL=index.mjs.map