payweave 0.0.0

package/dist/chunk-CGQ73I4I.js

@@ -0,0 +1,568 @@
+import { advance } from './chunk-4R5OGOCC.js';
+import { toUnifiedEventType, toUnifiedStatus } from './chunk-67NRYGRC.js';
+import { PayweaveConfigError, PayweaveValidationError, PayweaveWebhookVerificationError, PayweaveProviderError } from './chunk-HTRGMZFH.js';
+import { createHmac, timingSafeEqual, createHash } from 'crypto';
+
+// src/products/subscribe.ts
+var BILLING_CAPABLE_PROVIDERS = ["stripe", "paystack"];
+function isBillingCapableProvider(provider) {
+  return BILLING_CAPABLE_PROVIDERS.includes(provider);
+}
+function resolvePlanGroup(plan) {
+  return plan.group ?? plan.id;
+}
+function nominalPeriod(interval, now) {
+  const startMs = now.getTime();
+  return { start: new Date(startMs), end: new Date(advance(startMs, interval ?? "month", 1)) };
+}
+function findPlan(products, planId) {
+  return products?.find((p) => p.id === planId);
+}
+function groupExclusivityError(group) {
+  return new PayweaveValidationError(`customer already has an active plan in group '${group}'`);
+}
+async function ensureProviderCustomer(ctx, database, provider, customerRow, externalId) {
+  const existing = customerRow.providerIds[provider];
+  if (existing !== void 0) return existing;
+  if (provider === "stripe") {
+    if (!ctx.stripe) throw new PayweaveConfigError("stripe is not configured on this client.");
+    const created2 = await ctx.stripe.customers.create({
+      ...customerRow.email !== null ? { email: customerRow.email } : {},
+      metadata: { pwv_reference: customerRow.id }
+    });
+    await database.customers.linkProviderRef(externalId, "stripe", created2.id);
+    return created2.id;
+  }
+  if (!ctx.paystack) throw new PayweaveConfigError("paystack is not configured on this client.");
+  if (customerRow.email === null) {
+    throw new PayweaveValidationError(
+      "paystack billing requires a customer email, but this customer has none on file \u2014 call `database.customers.upsert({ externalId, email })` against your own adapter reference before subscribing (`subscribe()`'s input doesn't carry an email, and Paystack's customer/transaction APIs require one)."
+    );
+  }
+  const created = await ctx.paystack.customers.create({
+    email: customerRow.email,
+    metadata: { pwv_reference: customerRow.id }
+  });
+  const customerCode = created.data.customer_code;
+  if (customerCode === void 0) {
+    throw new PayweaveProviderError("paystack created a customer without a customer_code", {
+      provider: "paystack"
+    });
+  }
+  await database.customers.linkProviderRef(externalId, "paystack", customerCode);
+  return customerCode;
+}
+async function createStripeCheckout(ctx, database, plan, providerRefs, customerRow, incompleteRow, input) {
+  const priceId = providerRefs.priceId;
+  if (priceId === void 0) {
+    throw new PayweaveValidationError(
+      `plan "${plan.id}" has no pushed stripe price \u2014 run \`payweave push\`.`
+    );
+  }
+  if (!ctx.stripe) throw new PayweaveConfigError("stripe is not configured on this client.");
+  const providerCustomerId = await ensureProviderCustomer(
+    ctx,
+    database,
+    "stripe",
+    customerRow,
+    input.customerId
+  );
+  const session = await ctx.stripe.checkout.sessions.create({
+    mode: "subscription",
+    customer: providerCustomerId,
+    line_items: [{ price: priceId, quantity: 1 }],
+    // Correlates the resulting `checkout.session.completed` event back to
+    // this local row (see the module doc comment's "seams for the webhook
+    // handler" note).
+    client_reference_id: incompleteRow.id,
+    metadata: { pwv_reference: incompleteRow.id, pwv_plan: plan.id, pwv_customer: customerRow.id },
+    ...input.successUrl !== void 0 ? { success_url: input.successUrl } : {},
+    ...input.cancelUrl !== void 0 ? { cancel_url: input.cancelUrl } : {}
+  });
+  if (!session.url) {
+    throw new PayweaveProviderError("stripe created a checkout session without a hosted URL", {
+      provider: "stripe",
+      raw: session
+    });
+  }
+  return { status: "checkout", checkoutUrl: session.url, reference: session.id };
+}
+async function createPaystackCheckout(ctx, database, plan, providerRefs, customerRow, incompleteRow, input) {
+  const planCode = providerRefs.planCode;
+  if (planCode === void 0) {
+    throw new PayweaveValidationError(
+      `plan "${plan.id}" has no pushed paystack plan code \u2014 run \`payweave push\`.`
+    );
+  }
+  if (!ctx.paystack) throw new PayweaveConfigError("paystack is not configured on this client.");
+  await ensureProviderCustomer(ctx, database, "paystack", customerRow, input.customerId);
+  if (customerRow.email === null) {
+    throw new PayweaveValidationError(
+      "paystack billing requires a customer email, but this customer has none on file \u2014 call `database.customers.upsert({ externalId, email })` against your own adapter reference before subscribing (`subscribe()`'s input doesn't carry an email, and Paystack's customer/transaction APIs require one)."
+    );
+  }
+  const amountMinor = plan.price?.amount;
+  if (amountMinor === void 0) {
+    throw new PayweaveValidationError(`plan "${plan.id}" has no price to charge.`);
+  }
+  const res = await ctx.paystack.transactions.initialize({
+    email: customerRow.email,
+    amount: amountMinor,
+    plan: planCode,
+    // Our OWN reference — Paystack echoes it back on every subsequent
+    // event/verify call, so it doubles as the local row's stable correlation
+    // key for the webhook handler (see the module doc comment).
+    reference: incompleteRow.id,
+    metadata: { pwv_reference: incompleteRow.id, pwv_plan: plan.id, pwv_customer: customerRow.id }
+  });
+  return { status: "checkout", checkoutUrl: res.data.authorization_url, reference: res.data.reference };
+}
+async function subscribe(ctx, input) {
+  const database = ctx.database;
+  if (!database) {
+    throw new PayweaveConfigError(
+      "payweave.subscribe() needs a database \u2014 pass a payweave/db/* adapter to createPayweave()."
+    );
+  }
+  const plan = findPlan(ctx.products, input.planId);
+  if (!plan) {
+    throw new PayweaveValidationError(
+      `unknown plan "${input.planId}" \u2014 configure it in \`products\` and run \`payweave push\`.`
+    );
+  }
+  const provider = input.provider ?? ctx.defaultProvider;
+  if (!ctx.providers.includes(provider)) {
+    throw new PayweaveConfigError(
+      `provider "${provider}" is not configured on this client \u2014 configured: ${ctx.providers.join(", ")}.`
+    );
+  }
+  if (!isBillingCapableProvider(provider)) {
+    throw new PayweaveConfigError(
+      `provider "${provider}" does not support billing (subscribe) \u2014 billing-capable providers: ${BILLING_CAPABLE_PROVIDERS.join(", ")}.`
+    );
+  }
+  const group = resolvePlanGroup(plan);
+  const customerRow = await database.customers.upsert({ externalId: input.customerId });
+  const existingActive = await database.subscriptions.getActive(customerRow.id, group);
+  if (plan.default) {
+    if (existingActive) throw groupExclusivityError(group);
+    return { status: "active", planId: plan.id, subscription: null };
+  }
+  if (existingActive) throw groupExclusivityError(group);
+  const pushedVersion = await database.plans.getActiveVersion(plan.id);
+  if (!pushedVersion) {
+    throw new PayweaveValidationError(
+      `plan "${plan.id}" has no pushed version \u2014 run \`payweave push\` to sync your products.`
+    );
+  }
+  const now = /* @__PURE__ */ new Date();
+  if (plan.price === void 0) {
+    const period2 = nominalPeriod(void 0, now);
+    const row = await database.subscriptions.create({
+      customerId: customerRow.id,
+      planId: plan.id,
+      planVersion: pushedVersion.version,
+      group,
+      status: "active",
+      provider: null,
+      providerSubscriptionRef: null,
+      currentPeriodStart: period2.start,
+      currentPeriodEnd: period2.end,
+      cancelAtPeriodEnd: false
+    });
+    return { status: "active", planId: plan.id, subscription: row };
+  }
+  const providerRefs = pushedVersion.providerRefs[provider];
+  if (!providerRefs) {
+    throw new PayweaveValidationError(
+      `plan "${plan.id}" has no pushed ${provider} provider refs \u2014 run \`payweave push\`.`
+    );
+  }
+  const period = nominalPeriod(plan.price.interval, now);
+  const incompleteRow = await database.subscriptions.create({
+    customerId: customerRow.id,
+    planId: plan.id,
+    planVersion: pushedVersion.version,
+    group,
+    status: "incomplete",
+    provider,
+    providerSubscriptionRef: null,
+    currentPeriodStart: period.start,
+    currentPeriodEnd: period.end,
+    cancelAtPeriodEnd: false
+  });
+  if (provider === "stripe") {
+    return createStripeCheckout(ctx, database, plan, providerRefs, customerRow, incompleteRow, input);
+  }
+  return createPaystackCheckout(ctx, database, plan, providerRefs, customerRow, incompleteRow, input);
+}
+
+// src/products/apply.ts
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function stringField(obj, key) {
+  const v = obj?.[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function numberField(obj, key) {
+  const v = obj?.[key];
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function boolField(obj, key) {
+  const v = obj?.[key];
+  return typeof v === "boolean" ? v : void 0;
+}
+function stripeObject(event) {
+  if (event.provider !== "stripe") return void 0;
+  return asRecord(asRecord(event.data)?.object);
+}
+function flatData(event) {
+  return event.provider === "stripe" ? void 0 : asRecord(event.data);
+}
+function resolveCorrelation(event) {
+  if (event.provider === "stripe") {
+    const obj = stripeObject(event);
+    const meta2 = asRecord(obj?.metadata);
+    const rowId = stringField(obj, "client_reference_id") ?? stringField(meta2, "pwv_reference");
+    const providerSubscriptionRef = stringField(obj, "subscription") ?? (stringField(obj, "object") === "subscription" ? stringField(obj, "id") : void 0);
+    return {
+      rowId,
+      customerId: stringField(meta2, "pwv_customer"),
+      planId: stringField(meta2, "pwv_plan"),
+      providerSubscriptionRef
+    };
+  }
+  const data = flatData(event);
+  const meta = asRecord(data?.metadata);
+  return {
+    rowId: stringField(data, "reference") ?? stringField(meta, "pwv_reference"),
+    customerId: stringField(meta, "pwv_customer"),
+    planId: stringField(meta, "pwv_plan"),
+    providerSubscriptionRef: stringField(data, "subscription_code")
+  };
+}
+function resolveGroupForPlanId(ctx, planId) {
+  return ctx.products?.find((p) => p.id === planId);
+}
+async function findActiveRow(tx, ctx, correlation) {
+  if (!correlation.customerId || !correlation.planId) return null;
+  const plan = resolveGroupForPlanId(ctx, correlation.planId);
+  if (!plan) return null;
+  return tx.subscriptions.getActive(correlation.customerId, resolvePlanGroup(plan));
+}
+function firstListItem(container, key) {
+  const wrapper = asRecord(container?.[key]);
+  const list = wrapper?.data;
+  return Array.isArray(list) && list.length > 0 ? asRecord(list[0]) : void 0;
+}
+function periodFromUnixSeconds(start, end) {
+  if (end === void 0) return void 0;
+  return { start: start !== void 0 ? new Date(start * 1e3) : void 0, end: new Date(end * 1e3) };
+}
+function extractPeriod(event) {
+  if (event.provider === "stripe") {
+    const obj = stripeObject(event);
+    const item = firstListItem(obj, "items");
+    if (item) {
+      const period = periodFromUnixSeconds(
+        numberField(item, "current_period_start"),
+        numberField(item, "current_period_end")
+      );
+      if (period) return period;
+    }
+    const line = firstListItem(obj, "lines");
+    if (line) {
+      const period = asRecord(line.period);
+      const derived = periodFromUnixSeconds(numberField(period, "start"), numberField(period, "end"));
+      if (derived) return derived;
+    }
+    return void 0;
+  }
+  const data = flatData(event);
+  const nextPaymentDate = stringField(data, "next_payment_date");
+  if (!nextPaymentDate) return void 0;
+  const end = new Date(nextPaymentDate);
+  if (Number.isNaN(end.getTime())) return void 0;
+  return { start: void 0, end };
+}
+function resolvePeriodStart(period, currentRow, now) {
+  if (period.start) return period.start;
+  if (currentRow && currentRow.currentPeriodEnd.getTime() <= period.end.getTime()) {
+    return currentRow.currentPeriodEnd;
+  }
+  return now;
+}
+function isStalePeriod(period, currentRow) {
+  return period !== void 0 && period.end.getTime() < currentRow.currentPeriodEnd.getTime();
+}
+var STRIPE_SUBSCRIPTION_STATUS_MAP = {
+  active: "active",
+  trialing: "trialing",
+  past_due: "past_due",
+  canceled: "canceled",
+  unpaid: "past_due",
+  paused: "past_due",
+  incomplete: "incomplete",
+  incomplete_expired: "canceled"
+};
+var PAYSTACK_SUBSCRIPTION_STATUS_MAP = {
+  active: "active",
+  "non-renewing": "active",
+  attention: "past_due",
+  completed: "canceled",
+  cancelled: "canceled"
+};
+function mapNativeStatus(event) {
+  if (event.provider === "stripe") {
+    return STRIPE_SUBSCRIPTION_STATUS_MAP[stringField(stripeObject(event), "status") ?? ""];
+  }
+  if (event.provider === "paystack") {
+    return PAYSTACK_SUBSCRIPTION_STATUS_MAP[stringField(flatData(event), "status") ?? ""];
+  }
+  return void 0;
+}
+function extractCancelAtPeriodEnd(event) {
+  if (event.provider === "stripe") return boolField(stripeObject(event), "cancel_at_period_end");
+  if (event.provider === "paystack" && event.type === "subscription.not_renew") return true;
+  return void 0;
+}
+async function resetBalancesForPlanChange(database, params) {
+  for (const inclusion of params.plan.includes) {
+    if (inclusion.type !== "metered") continue;
+    const init = {
+      limit: inclusion.limit,
+      resetInterval: inclusion.reset,
+      anchor: params.anchor,
+      planId: params.plan.id,
+      planVersion: params.planVersion
+    };
+    await database.balances.resetTo(params.customerId, inclusion.featureId, params.group, init);
+  }
+}
+async function applyActivation(tx, ctx, event, now) {
+  const correlation = resolveCorrelation(event);
+  const period = extractPeriod(event);
+  const activeRow = await findActiveRow(tx, ctx, correlation);
+  if (activeRow) {
+    if (isStalePeriod(period, activeRow)) return { applied: false, skipped: "stale" };
+    const patch2 = { status: "active" };
+    if (correlation.providerSubscriptionRef) patch2.providerSubscriptionRef = correlation.providerSubscriptionRef;
+    if (period) {
+      patch2.currentPeriodStart = resolvePeriodStart(period, activeRow, now);
+      patch2.currentPeriodEnd = period.end;
+    }
+    const updated2 = await tx.subscriptions.update(activeRow.id, patch2);
+    return { applied: true, subscription: updated2 };
+  }
+  if (!correlation.rowId) return { applied: false, skipped: "unresolved" };
+  const patch = { status: "active" };
+  if (correlation.providerSubscriptionRef) patch.providerSubscriptionRef = correlation.providerSubscriptionRef;
+  if (period) {
+    patch.currentPeriodStart = period.start ?? now;
+    patch.currentPeriodEnd = period.end;
+  }
+  const updated = await tx.subscriptions.update(correlation.rowId, patch);
+  return { applied: true, subscription: updated };
+}
+async function applyLifecycleUpdate(tx, ctx, event, now, forcedStatus, allowPlanChange, logger) {
+  const correlation = resolveCorrelation(event);
+  const row = await findActiveRow(tx, ctx, correlation);
+  if (!row) {
+    logger?.({
+      type: "schema_drift",
+      message: "billing apply: could not correlate a subscription lifecycle event to a local row \u2014 safe no-op.",
+      provider: event.provider,
+      nativeType: event.type,
+      unifiedType: event.unifiedType
+    });
+    return { applied: false, skipped: "unresolved" };
+  }
+  const period = extractPeriod(event);
+  if (isStalePeriod(period, row)) return { applied: false, skipped: "stale" };
+  const patch = {};
+  const status = forcedStatus ?? mapNativeStatus(event);
+  if (status) patch.status = status;
+  if (period) {
+    patch.currentPeriodStart = resolvePeriodStart(period, row, now);
+    patch.currentPeriodEnd = period.end;
+  }
+  const cancelAtPeriodEnd = extractCancelAtPeriodEnd(event);
+  if (cancelAtPeriodEnd !== void 0) patch.cancelAtPeriodEnd = cancelAtPeriodEnd;
+  if (allowPlanChange && correlation.planId && correlation.planId !== row.planId) {
+    const newPlan = resolveGroupForPlanId(ctx, correlation.planId);
+    if (newPlan) {
+      const pushed = await tx.plans.getActiveVersion(newPlan.id);
+      const planVersion = pushed?.version ?? row.planVersion;
+      patch.planId = newPlan.id;
+      patch.planVersion = planVersion;
+      await resetBalancesForPlanChange(tx, {
+        customerId: row.customerId,
+        group: row.group,
+        plan: newPlan,
+        planVersion,
+        anchor: patch.currentPeriodStart ?? row.currentPeriodStart
+      });
+    }
+  }
+  if (Object.keys(patch).length === 0) return { applied: false, skipped: "unmapped" };
+  const updated = await tx.subscriptions.update(row.id, patch);
+  return { applied: true, subscription: updated };
+}
+async function applyWebhookEvent(ctx, event, options = {}) {
+  const database = ctx.database;
+  if (!database) {
+    throw new PayweaveConfigError(
+      "event.apply() needs a database \u2014 pass a payweave/db/* adapter to createPayweave()."
+    );
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const logger = options.logger;
+  return database.transaction(async (tx) => {
+    const claimed = await tx.webhookEvents.claim(event.dedupeKey, {
+      provider: event.provider,
+      type: event.type,
+      now
+    });
+    if (!claimed) return { applied: false, skipped: "already-applied" };
+    let result;
+    switch (event.unifiedType) {
+      case "payment.succeeded":
+      case "invoice.paid":
+        result = await applyActivation(tx, ctx, event, now);
+        break;
+      case "subscription.created":
+      case "subscription.updated":
+        result = await applyLifecycleUpdate(tx, ctx, event, now, void 0, true, logger);
+        break;
+      case "subscription.canceled":
+        result = await applyLifecycleUpdate(tx, ctx, event, now, "canceled", false, logger);
+        break;
+      case "invoice.payment_failed":
+        result = await applyLifecycleUpdate(tx, ctx, event, now, "past_due", false, logger);
+        break;
+      default:
+        result = { applied: false, skipped: "unmapped" };
+    }
+    if (result.skipped !== "unresolved") {
+      await tx.webhookEvents.markApplied(event.dedupeKey);
+    }
+    return result;
+  });
+}
+var DEFAULT_TOLERANCE_SEC = 300;
+function matchesExpected(expected, candidate) {
+  const received = Buffer.from(candidate, "utf8");
+  return expected.length === received.length && timingSafeEqual(expected, received);
+}
+function verifyStripe(rawBody, signatureHeader, webhookSecret, options) {
+  if (typeof webhookSecret !== "string" || webhookSecret.length === 0) return false;
+  if (typeof signatureHeader !== "string" || signatureHeader.length === 0) return false;
+  if (typeof rawBody !== "string" && !(rawBody instanceof Uint8Array)) return false;
+  let timestampRaw;
+  const candidates = [];
+  for (const rawItem of signatureHeader.split(",")) {
+    const item = rawItem.trim();
+    const eq = item.indexOf("=");
+    if (eq === -1) return false;
+    const scheme = item.slice(0, eq);
+    const value = item.slice(eq + 1);
+    if (scheme === "t") {
+      if (timestampRaw !== void 0) return false;
+      timestampRaw = value;
+    } else if (scheme === "v1") {
+      candidates.push(value);
+    }
+  }
+  if (timestampRaw === void 0 || !/^\d+$/.test(timestampRaw)) return false;
+  if (candidates.length === 0) return false;
+  const timestamp = Number(timestampRaw);
+  const nowSec = options?.now !== void 0 ? options.now() : Math.floor(Date.now() / 1e3);
+  const toleranceSec = options?.toleranceSec ?? DEFAULT_TOLERANCE_SEC;
+  const withinTolerance = Math.abs(nowSec - timestamp) <= toleranceSec;
+  const hmac = createHmac("sha256", webhookSecret);
+  hmac.update(`${timestampRaw}.`);
+  hmac.update(rawBody);
+  const expected = Buffer.from(hmac.digest("hex"), "utf8");
+  let matched = false;
+  for (const candidate of candidates) {
+    matched = matchesExpected(expected, candidate) || matched;
+  }
+  return withinTolerance && matched;
+}
+
+// src/webhooks/index.ts
+var NO_DATABASE_CONTEXT = { database: void 0, products: void 0 };
+function decodeBody(rawBody) {
+  return typeof rawBody === "string" ? rawBody : new TextDecoder().decode(rawBody);
+}
+function asRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function extractNativeType(root, provider) {
+  const candidate = provider === "flutterwave" ? root.type ?? root.event : provider === "stripe" ? root.type : root.event;
+  return typeof candidate === "string" ? candidate : "unknown";
+}
+function extractWebhookId(root) {
+  return typeof root.id === "string" && root.id.length > 0 ? root.id : void 0;
+}
+function computeDedupeKey(provider, nativeType, data, webhookId) {
+  const idCandidate = data?.id ?? data?.reference ?? data?.transfer_code ?? data?.subscription_code ?? data?.customer_code;
+  const dataId = idCandidate !== void 0 && idCandidate !== null ? String(idCandidate) : "";
+  const status = typeof data?.status === "string" ? data.status : "";
+  if (provider === "flutterwave") {
+    if (webhookId !== void 0) return webhookId;
+    return `${dataId}:${status}`;
+  }
+  if (provider === "stripe" && webhookId !== void 0) return webhookId;
+  return createHash("sha256").update(`${nativeType}:${dataId}:${status}`).digest("hex");
+}
+function constructEvent(params) {
+  const { rawBody, headers, provider, version, verify, logger, billing } = params;
+  if (!verify({ rawBody, headers })) {
+    throw new PayweaveWebhookVerificationError("Webhook signature verification failed.", {
+      provider,
+      isRetryable: false
+    });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(decodeBody(rawBody));
+  } catch (cause) {
+    throw new PayweaveWebhookVerificationError("Webhook body is not valid JSON.", {
+      provider,
+      isRetryable: false,
+      cause
+    });
+  }
+  const root = asRecord2(parsed) ?? {};
+  const data = root.data;
+  const nativeType = extractNativeType(root, provider);
+  const unifiedType = toUnifiedEventType(provider, version, nativeType, data);
+  const dataRecord = asRecord2(data);
+  if (provider !== "stripe" && typeof dataRecord?.status === "string") {
+    toUnifiedStatus(provider, version, dataRecord.status, logger);
+  }
+  const webhookId = provider === "flutterwave" || provider === "stripe" ? extractWebhookId(root) : void 0;
+  const dedupeKey = computeDedupeKey(provider, nativeType, dataRecord, webhookId);
+  const base = {
+    provider,
+    type: nativeType,
+    unifiedType,
+    data,
+    raw: parsed,
+    dedupeKey,
+    ...webhookId !== void 0 ? { id: webhookId } : {}
+  };
+  return {
+    ...base,
+    // always present (see the `WebhookEvent.apply` doc comment);
+    // `billing` is `undefined` for a database-less client, in which case
+    // `applyWebhookEvent` itself throws `PayweaveConfigError` when called.
+    apply: (options) => applyWebhookEvent(billing ?? NO_DATABASE_CONTEXT, base, { logger, ...options })
+  };
+}
+
+export { BILLING_CAPABLE_PROVIDERS, constructEvent, resolvePlanGroup, subscribe, verifyStripe };
+//# sourceMappingURL=chunk-CGQ73I4I.js.map
+//# sourceMappingURL=chunk-CGQ73I4I.js.map