@atmosphere-money/app-node 0.0.0-beta.0

package/dist/index.js

@@ -0,0 +1,618 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Server-side helpers for apps integrating with Atmosphere Money.
+ *
+ * Keep this package on your backend. Do not build `atm.checkout.v1:`
+ * envelopes in browser code because they may contain private checkout/session
+ * context, app order ids, buyer assertions, or return/cancel URLs.
+ */
+export const ATM_CHECKOUT_PRODUCT_PREFIX = "atm.checkout.v1:";
+export const DEFAULT_ATM_BROKER_URL = "https://checkout.atmosphere.money";
+export const DEFAULT_ATM_APPVIEW_URL = "https://appview.atmosphere.money";
+export const ATM_BROKER_DID = "did:plc:a54sdlhmv7xklga67xamqfyq";
+export const ATM_BROKER_SERVICE_AUDIENCE = `${ATM_BROKER_DID}#AttestedNetwork`;
+export const DEFAULT_ATM_WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
+export const ATM_EVENT_RECEIVE_NSID = "money.atmosphere.event.receive";
+export const DEFAULT_ATM_XRPC_RECEIVER_SERVICE = "#AtmEventReceiver";
+export const ATM_XRPC_METHODS = {
+    actor: {
+        getPayoutStatus: "money.atmosphere.actor.getPayoutStatus",
+        getProfile: "money.atmosphere.actor.getProfile",
+    },
+    payment: {
+        initiate: "network.attested.payment.initiate",
+        status: "network.attested.payment.status",
+    },
+    event: {
+        receive: "money.atmosphere.event.receive",
+    },
+    tickets: {
+        archiveTicketTier: "tickets.atmosphere.archiveTicketTier",
+        checkInTicket: "tickets.atmosphere.checkInTicket",
+        claimFreeTicket: "tickets.atmosphere.claimFreeTicket",
+        createCapacityGroup: "tickets.atmosphere.createCapacityGroup",
+        createTicketHold: "tickets.atmosphere.createTicketHold",
+        createTicketTier: "tickets.atmosphere.createTicketTier",
+        getTicketAvailability: "tickets.atmosphere.getTicketAvailability",
+        listBuyerTickets: "tickets.atmosphere.listBuyerTickets",
+        listOrganizerTickets: "tickets.atmosphere.listOrganizerTickets",
+        releaseTicketHold: "tickets.atmosphere.releaseTicketHold",
+        updateCapacityGroup: "tickets.atmosphere.updateCapacityGroup",
+        updateTicketTier: "tickets.atmosphere.updateTicketTier",
+        verifyTicket: "tickets.atmosphere.verifyTicket",
+    },
+};
+export function createAtmCheckoutProduct(input) {
+    assertDid(input.recipient, "recipient");
+    if (input.amount === "" || input.amount === null || input.amount === undefined) {
+        throw new Error("amount is required");
+    }
+    const payload = pruneUndefined(input);
+    return `${ATM_CHECKOUT_PRODUCT_PREFIX}${base64UrlEncode(JSON.stringify(payload))}`;
+}
+export function createPaymentInitiateBody(input) {
+    return { product: createAtmCheckoutProduct(input) };
+}
+export function signAtmWebhookPayload(opts) {
+    const timestamp = opts.timestamp ?? Math.floor(Date.now() / 1000);
+    const signedPayload = `${timestamp}.${opts.deliveryId}.${opts.rawBody}`;
+    const digest = createHmac("sha256", opts.secret)
+        .update(signedPayload)
+        .digest("hex");
+    return `t=${timestamp},v1=${digest}`;
+}
+export function verifyAtmWebhookSignature(opts) {
+    const parsed = parseAtmSignatureHeader(opts.signature);
+    if (!parsed)
+        return false;
+    const tolerance = opts.toleranceSeconds ?? DEFAULT_ATM_WEBHOOK_TOLERANCE_SECONDS;
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - parsed.timestamp) > tolerance)
+        return false;
+    const signedPayload = `${parsed.timestamp}.${opts.deliveryId}.${opts.rawBody}`;
+    const secrets = normalizeSecrets(opts.secret);
+    if (secrets.length === 0)
+        return false;
+    return secrets.some((secret) => {
+        const expected = createHmac("sha256", secret)
+            .update(signedPayload)
+            .digest("hex");
+        const expectedBuffer = Uint8Array.from(Buffer.from(expected, "hex"));
+        return parsed.signatures.some((candidate) => {
+            if (!/^[0-9a-fA-F]{64}$/.test(candidate))
+                return false;
+            const candidateBuffer = Uint8Array.from(Buffer.from(candidate, "hex"));
+            return timingSafeEqual(expectedBuffer, candidateBuffer);
+        });
+    });
+}
+export function constructAtmWebhookEvent(opts) {
+    const signature = opts.headers.signature;
+    const deliveryId = opts.headers.deliveryId;
+    if (!signature) {
+        throw new AtmWebhookSignatureError("Missing Atm-Signature header");
+    }
+    if (!deliveryId) {
+        throw new AtmWebhookSignatureError("Missing Atm-Delivery-Id header");
+    }
+    const ok = verifyAtmWebhookSignature({
+        rawBody: opts.rawBody,
+        signature,
+        deliveryId,
+        secret: opts.secret,
+        toleranceSeconds: opts.toleranceSeconds,
+        now: opts.now,
+    });
+    if (!ok) {
+        throw new AtmWebhookSignatureError("ATM webhook signature is invalid");
+    }
+    const parsed = safeJsonParse(opts.rawBody);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new AtmWebhookSignatureError("ATM webhook body is not a JSON object");
+    }
+    const event = parsed;
+    if (event.id !== deliveryId) {
+        throw new AtmWebhookSignatureError("ATM webhook delivery id does not match the signed body");
+    }
+    if (opts.headers.event && event.type !== opts.headers.event) {
+        throw new AtmWebhookSignatureError("ATM webhook event type does not match the signed body");
+    }
+    if (opts.headers.apiVersion && event.apiVersion !== opts.headers.apiVersion) {
+        throw new AtmWebhookSignatureError("ATM webhook API version does not match the signed body");
+    }
+    if (opts.headers.environment && event.environment !== opts.headers.environment) {
+        throw new AtmWebhookSignatureError("ATM webhook environment does not match the signed body");
+    }
+    return event;
+}
+export function constructTypedAtmWebhookEvent(opts) {
+    const event = constructAtmWebhookEvent({
+        ...opts,
+        headers: {
+            ...opts.headers,
+            event: opts.headers.event ?? opts.expectedType,
+        },
+    });
+    if (event.type !== opts.expectedType) {
+        throw new AtmWebhookSignatureError(`ATM webhook event type does not match expected ${opts.expectedType}`);
+    }
+    return event;
+}
+export function createNodeWebhookHandler(options) {
+    return async function handleAtmWebhook(request) {
+        try {
+            const rawBody = await request.text();
+            const event = constructWebhookHandlerEvent(rawBody, requestHeaders(request), options);
+            if (options.insertDeliveryIdOnce) {
+                const inserted = await options.insertDeliveryIdOnce(event.id, event);
+                if (!inserted) {
+                    return jsonResponse(200, { ok: true, duplicate: true, deliveryId: event.id });
+                }
+            }
+            return normalizeWebhookHandlerResult(await options.onEvent(event, { rawBody, request }));
+        }
+        catch (error) {
+            if (options.onError) {
+                return normalizeWebhookHandlerResult(await options.onError(error));
+            }
+            return defaultWebhookErrorResponse(error);
+        }
+    };
+}
+export const createNextWebhookRoute = createNodeWebhookHandler;
+export function createExpressWebhookHandler(options) {
+    return async function handleAtmExpressWebhook(request, response, next) {
+        try {
+            const raw = options.getRawBody
+                ? await options.getRawBody(request)
+                : defaultExpressRawBody(request);
+            const rawBody = Buffer.isBuffer(raw) ? raw.toString("utf8") : raw;
+            const event = constructWebhookHandlerEvent(rawBody, expressHeaders(request.headers), options);
+            if (options.insertDeliveryIdOnce) {
+                const inserted = await options.insertDeliveryIdOnce(event.id, event);
+                if (!inserted) {
+                    sendExpressJson(response, 200, {
+                        ok: true,
+                        duplicate: true,
+                        deliveryId: event.id,
+                    });
+                    return;
+                }
+            }
+            const result = await options.onEvent(event, { rawBody });
+            const normalized = normalizePlainWebhookHandlerResult(result);
+            sendExpressJson(response, normalized.status, normalized.body, normalized.headers);
+        }
+        catch (error) {
+            if (options.onError) {
+                const normalized = normalizePlainWebhookHandlerResult(await options.onError(error));
+                sendExpressJson(response, normalized.status, normalized.body, normalized.headers);
+                return;
+            }
+            if (next) {
+                next(error);
+                return;
+            }
+            const normalized = defaultPlainWebhookError(error);
+            sendExpressJson(response, normalized.status, normalized.body, normalized.headers);
+        }
+    };
+}
+export async function constructAtmXrpcReceiverEvent(opts) {
+    assertDid(opts.appDid, "appDid");
+    const expectedAud = receiverAudience(opts.appDid, opts.serviceRef ?? DEFAULT_ATM_XRPC_RECEIVER_SERVICE);
+    const expectedIssuerDid = opts.expectedIssuerDid ?? ATM_BROKER_DID;
+    const expectedLxm = opts.expectedLxm ?? ATM_EVENT_RECEIVE_NSID;
+    const token = bearerToken(opts.headers.authorization);
+    if (!token) {
+        throw new AtmXrpcReceiverAuthError("Missing XRPC receiver Authorization bearer token");
+    }
+    const claims = await opts.verifyServiceAuthJwt({
+        token,
+        expectedIss: expectedIssuerDid,
+        expectedAud,
+        expectedLxm,
+    });
+    verifyAtmReceiverServiceAuthClaims({
+        claims,
+        expectedIss: expectedIssuerDid,
+        expectedAud,
+        expectedLxm,
+    });
+    const event = parseAtmEventEnvelope(opts.rawBody);
+    assertOptionalEventHeaders(event, {
+        deliveryId: opts.headers.deliveryId,
+        event: opts.headers.event,
+        apiVersion: opts.headers.apiVersion,
+        environment: opts.headers.environment,
+    });
+    return event;
+}
+export async function constructTypedAtmXrpcReceiverEvent(opts) {
+    const event = await constructAtmXrpcReceiverEvent({
+        ...opts,
+        headers: {
+            ...opts.headers,
+            event: opts.headers.event ?? opts.expectedType,
+        },
+    });
+    if (event.type !== opts.expectedType) {
+        throw new AtmXrpcReceiverAuthError(`ATM XRPC receiver event type does not match expected ${opts.expectedType}`);
+    }
+    return event;
+}
+export function verifyAtmReceiverServiceAuthClaims(opts) {
+    if (opts.claims.iss !== opts.expectedIss) {
+        throw new AtmXrpcReceiverAuthError(`ATM receiver JWT iss mismatch: expected ${opts.expectedIss}`);
+    }
+    if (opts.claims.aud !== opts.expectedAud) {
+        throw new AtmXrpcReceiverAuthError(`ATM receiver JWT aud mismatch: expected ${opts.expectedAud}`);
+    }
+    if (opts.claims.lxm !== opts.expectedLxm) {
+        throw new AtmXrpcReceiverAuthError(`ATM receiver JWT lxm mismatch: expected ${opts.expectedLxm}`);
+    }
+}
+export function createAtmXrpcReceiverAudience(appDid, serviceRef = DEFAULT_ATM_XRPC_RECEIVER_SERVICE) {
+    assertDid(appDid, "appDid");
+    return receiverAudience(appDid, serviceRef);
+}
+export function createAtmAppClient(options) {
+    const brokerUrl = normalizeBaseUrl(options.brokerUrl ?? DEFAULT_ATM_BROKER_URL);
+    const appViewUrl = normalizeBaseUrl(options.appViewUrl ?? DEFAULT_ATM_APPVIEW_URL);
+    const audience = options.serviceAudience ?? ATM_BROKER_SERVICE_AUDIENCE;
+    async function callJson(baseUrl, method, nsid, body) {
+        const token = await options.getServiceAuthToken({ lxm: nsid, aud: audience });
+        const res = await fetch(`${baseUrl}/xrpc/${nsid}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                ...(body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        return readAtmJson(res);
+    }
+    async function callQuery(baseUrl, nsid, params) {
+        const token = await options.getServiceAuthToken({ lxm: nsid, aud: audience });
+        const url = new URL(`${baseUrl}/xrpc/${nsid}`);
+        for (const [key, value] of Object.entries(params)) {
+            if (value !== undefined)
+                url.searchParams.set(key, String(value));
+        }
+        const res = await fetch(url, {
+            headers: { authorization: `Bearer ${token}` },
+        });
+        return readAtmJson(res);
+    }
+    return {
+        createCheckoutProduct: createAtmCheckoutProduct,
+        createPaymentInitiateBody,
+        getPayoutStatus(actor) {
+            return callQuery(brokerUrl, ATM_XRPC_METHODS.actor.getPayoutStatus, { actor });
+        },
+        initiatePayment(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.payment.initiate, createPaymentInitiateBody(input));
+        },
+        getPaymentStatus(token) {
+            return callQuery(brokerUrl, ATM_XRPC_METHODS.payment.status, { token });
+        },
+        createTicketTier(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.createTicketTier, input);
+        },
+        updateTicketTier(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.updateTicketTier, input);
+        },
+        archiveTicketTier(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.archiveTicketTier, input);
+        },
+        createCapacityGroup(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.createCapacityGroup, input);
+        },
+        updateCapacityGroup(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.updateCapacityGroup, input);
+        },
+        getTicketAvailability(input) {
+            return callQuery(brokerUrl, ATM_XRPC_METHODS.tickets.getTicketAvailability, {
+                environment: input.environment,
+                eventId: input.eventId,
+                eventUri: input.eventUri,
+            });
+        },
+        createTicketHold(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.createTicketHold, input);
+        },
+        releaseTicketHold(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.releaseTicketHold, input);
+        },
+        claimFreeTicket(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.claimFreeTicket, input);
+        },
+        listBuyerTickets(input) {
+            return callQuery(brokerUrl, ATM_XRPC_METHODS.tickets.listBuyerTickets, input);
+        },
+        listOrganizerTickets(input) {
+            return callQuery(brokerUrl, ATM_XRPC_METHODS.tickets.listOrganizerTickets, input);
+        },
+        verifyTicket(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.verifyTicket, input);
+        },
+        checkInTicket(input) {
+            return callJson(brokerUrl, "POST", ATM_XRPC_METHODS.tickets.checkInTicket, input);
+        },
+        getProfile(actor) {
+            return callQuery(appViewUrl, ATM_XRPC_METHODS.actor.getProfile, { actor });
+        },
+    };
+}
+async function readAtmJson(res) {
+    const text = await res.text();
+    const json = text ? safeJsonParse(text) : null;
+    if (!res.ok) {
+        const message = json && typeof json === "object" && "message" in json
+            ? String(json.message)
+            : `ATM request failed with ${res.status}`;
+        const error = json && typeof json === "object" && "error" in json
+            ? String(json.error)
+            : "AtmRequestFailed";
+        throw new AtmApiError(error, message, res.status, json);
+    }
+    return json;
+}
+function constructWebhookHandlerEvent(rawBody, headers, options) {
+    if (options.expectedType) {
+        return constructTypedAtmWebhookEvent({
+            rawBody,
+            headers,
+            secret: options.secret,
+            toleranceSeconds: options.toleranceSeconds,
+            now: options.now,
+            expectedType: options.expectedType,
+        });
+    }
+    return constructAtmWebhookEvent({
+        rawBody,
+        headers,
+        secret: options.secret,
+        toleranceSeconds: options.toleranceSeconds,
+        now: options.now,
+    });
+}
+function requestHeaders(request) {
+    return {
+        signature: request.headers.get("atm-signature"),
+        deliveryId: request.headers.get("atm-delivery-id"),
+        event: request.headers.get("atm-event"),
+        apiVersion: request.headers.get("atm-api-version"),
+        environment: request.headers.get("atm-environment"),
+    };
+}
+function expressHeaders(headers) {
+    return {
+        signature: singleHeader(headers["atm-signature"]),
+        deliveryId: singleHeader(headers["atm-delivery-id"]),
+        event: singleHeader(headers["atm-event"]),
+        apiVersion: singleHeader(headers["atm-api-version"]),
+        environment: singleHeader(headers["atm-environment"]),
+    };
+}
+function singleHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function defaultExpressRawBody(request) {
+    if (typeof request.rawBody === "string" || Buffer.isBuffer(request.rawBody)) {
+        return request.rawBody;
+    }
+    if (typeof request.body === "string" || Buffer.isBuffer(request.body)) {
+        return request.body;
+    }
+    throw new AtmWebhookSignatureError("Express webhook handler requires rawBody, string body, or getRawBody");
+}
+function normalizeWebhookHandlerResult(result) {
+    if (result instanceof Response)
+        return result;
+    const normalized = normalizePlainWebhookHandlerResult(result);
+    return jsonResponse(normalized.status, normalized.body, normalized.headers);
+}
+function normalizePlainWebhookHandlerResult(result) {
+    if (!result)
+        return { status: 200, body: { ok: true } };
+    if (result instanceof Response) {
+        const headers = {};
+        result.headers.forEach((value, name) => {
+            headers[name] = value;
+        });
+        return {
+            status: result.status,
+            body: { ok: result.ok },
+            headers,
+        };
+    }
+    return {
+        status: result.status ?? 200,
+        body: result.body ?? { ok: true },
+        headers: result.headers,
+    };
+}
+function jsonResponse(status, body, headers) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "content-type": "application/json",
+            ...headers,
+        },
+    });
+}
+function sendExpressJson(response, status, body, headers) {
+    for (const [name, value] of Object.entries(headers ?? {})) {
+        response.setHeader?.(name, value);
+    }
+    response.status(status).json(body);
+}
+function defaultWebhookErrorResponse(error) {
+    const normalized = defaultPlainWebhookError(error);
+    return jsonResponse(normalized.status, normalized.body, normalized.headers);
+}
+function defaultPlainWebhookError(error) {
+    if (error instanceof AtmWebhookSignatureError) {
+        return {
+            status: 400,
+            body: { error: "AtmWebhookVerificationFailed", message: error.message },
+        };
+    }
+    return {
+        status: 500,
+        body: { error: "AtmWebhookHandlerFailed", message: "Webhook handler failed" },
+    };
+}
+export class AtmApiError extends Error {
+    code;
+    status;
+    body;
+    constructor(code, message, status, body) {
+        super(message);
+        this.name = "AtmApiError";
+        this.code = code;
+        this.status = status;
+        this.body = body;
+    }
+}
+export class AtmWebhookSignatureError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AtmWebhookSignatureError";
+    }
+}
+export class AtmXrpcReceiverAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AtmXrpcReceiverAuthError";
+    }
+}
+function safeJsonParse(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function parseAtmSignatureHeader(signature) {
+    const fields = new Map();
+    for (const piece of signature.split(/[,\s]+/)) {
+        const trimmed = piece.trim();
+        if (!trimmed)
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq < 0)
+            return null;
+        const key = trimmed.slice(0, eq).toLowerCase();
+        const value = trimmed.slice(eq + 1);
+        const values = fields.get(key) ?? [];
+        values.push(value);
+        fields.set(key, values);
+    }
+    const timestampRaw = fields.get("t")?.[0];
+    const signatures = fields.get("v1") ?? [];
+    if (!timestampRaw || signatures.length === 0)
+        return null;
+    const timestamp = Number.parseInt(timestampRaw, 10);
+    if (!Number.isFinite(timestamp))
+        return null;
+    return { timestamp, signatures };
+}
+function parseAtmEventEnvelope(rawBody) {
+    const parsed = safeJsonParse(rawBody);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver body is not a JSON object");
+    }
+    const event = parsed;
+    if (typeof event.id !== "string" || !event.id) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver body is missing id");
+    }
+    if (typeof event.type !== "string" || !event.type) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver body is missing type");
+    }
+    if (typeof event.apiVersion !== "string" || !event.apiVersion) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver body is missing apiVersion");
+    }
+    if (event.environment !== "test" && event.environment !== "live") {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver body has invalid environment");
+    }
+    if (!event.data || typeof event.data !== "object" || Array.isArray(event.data)) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver body is missing data");
+    }
+    return event;
+}
+function assertOptionalEventHeaders(event, headers) {
+    if (headers.deliveryId && event.id !== headers.deliveryId) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver delivery id does not match the body");
+    }
+    if (headers.event && event.type !== headers.event) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver type does not match the body");
+    }
+    if (headers.apiVersion && event.apiVersion !== headers.apiVersion) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver API version does not match the body");
+    }
+    if (headers.environment && event.environment !== headers.environment) {
+        throw new AtmXrpcReceiverAuthError("ATM event receiver environment does not match the body");
+    }
+}
+function bearerToken(authorization) {
+    const match = authorization?.match(/^Bearer\s+(.+)$/i);
+    return match?.[1]?.trim() || null;
+}
+function receiverAudience(appDid, serviceRef) {
+    const normalized = normalizeReceiverServiceRef(appDid, serviceRef);
+    return `${appDid}${normalized}`;
+}
+function normalizeReceiverServiceRef(appDid, serviceRef) {
+    const trimmed = serviceRef.trim();
+    if (!trimmed) {
+        throw new AtmXrpcReceiverAuthError("XRPC receiver serviceRef is required");
+    }
+    if (trimmed.startsWith(`${appDid}#`)) {
+        const fragment = trimmed.slice(appDid.length);
+        if (fragment.length <= 1) {
+            throw new AtmXrpcReceiverAuthError("XRPC receiver serviceRef is invalid");
+        }
+        return fragment;
+    }
+    if (trimmed.startsWith("#")) {
+        if (trimmed.length === 1) {
+            throw new AtmXrpcReceiverAuthError("XRPC receiver serviceRef is invalid");
+        }
+        return trimmed;
+    }
+    if (trimmed.startsWith("did:")) {
+        throw new AtmXrpcReceiverAuthError("XRPC receiver serviceRef must belong to appDid");
+    }
+    return `#${trimmed}`;
+}
+function assertDid(value, field) {
+    if (!value.startsWith("did:")) {
+        throw new Error(`${field} must be a DID`);
+    }
+}
+function normalizeBaseUrl(value) {
+    return value.replace(/\/+$/, "");
+}
+function normalizeSecrets(value) {
+    return (Array.isArray(value) ? value : [value]).filter(Boolean);
+}
+function base64UrlEncode(value) {
+    return Buffer.from(value, "utf8").toString("base64url");
+}
+function pruneUndefined(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => pruneUndefined(item));
+    }
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            if (inner !== undefined)
+                out[key] = pruneUndefined(inner);
+        }
+        return out;
+    }
+    return value;
+}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@atmosphere-money/app-node",
+  "version": "0.0.0-beta.0",
+  "description": "Server-side helpers for apps integrating with Atmosphere Money.",
+  "license": "MIT",
+  "type": "module",
+  "private": false,
+  "sideEffects": false,
+  "homepage": "https://atmosphere.money/docs/sdk-examples",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Atmosphere-Money/ATM.git",
+    "directory": "packages/app-node"
+  },
+  "bugs": {
+    "url": "https://github.com/Atmosphere-Money/ATM/issues"
+  },
+  "keywords": [
+    "atmosphere-money",
+    "at-protocol",
+    "atproto",
+    "payments",
+    "checkout",
+    "webhooks",
+    "tickets"
+  ],
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "main": "./dist/index.js",
+    "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsx test/index.test.ts",
+    "api:snapshot": "node ../../scripts/check-sdk-api-snapshot.mjs packages/app-node --write",
+    "api:check": "node ../../scripts/check-sdk-api-snapshot.mjs packages/app-node",
+    "check": "npm run build && npm run api:check && npm run test && npm run release:check && npm run pack:dry-run",
+    "release:check": "node scripts/check-release.mjs",
+    "publish:check": "ATM_SDK_PUBLISH=1 node scripts/check-release.mjs && npm run pack:dry-run",
+    "pack:dry-run": "npm pack --dry-run",
+    "prepare": "npm run build",
+    "prepack": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsx": "^4.22.3",
+    "typescript": "^5.7.2"
+  }
+}