@bitpal/checkout 0.3.0 → 0.6.0

package/dist/index.js

@@ -1,15 +1,114 @@
+// src/catalog.ts
+function toQuery(params) {
+  if (!params) return "";
+  const entries = Object.entries(params).filter(([, v]) => v !== void 0);
+  if (entries.length === 0) return "";
+  const qs = new URLSearchParams(entries.map(([k, v]) => [k, String(v)]));
+  return `?${qs.toString()}`;
+}
+var ProductsResource = class {
+  constructor(request) {
+    this.request = request;
+  }
+  request;
+  /** POST /v1/checkout/products */
+  create(params) {
+    return this.request("POST", "/v1/checkout/products", params);
+  }
+  /** GET /v1/checkout/products */
+  list(params) {
+    return this.request("GET", `/v1/checkout/products${toQuery(params)}`);
+  }
+  /** GET /v1/checkout/products/:id */
+  retrieve(productId) {
+    return this.request("GET", `/v1/checkout/products/${encodeURIComponent(productId)}`);
+  }
+  /** PATCH /v1/checkout/products/:id */
+  update(productId, params) {
+    return this.request("PATCH", `/v1/checkout/products/${encodeURIComponent(productId)}`, params);
+  }
+};
+var PricesResource = class {
+  constructor(request) {
+    this.request = request;
+  }
+  request;
+  /** POST /v1/checkout/products/:id/prices */
+  create(productId, params) {
+    return this.request("POST", `/v1/checkout/products/${encodeURIComponent(productId)}/prices`, params);
+  }
+  /** GET /v1/checkout/products/:id/prices */
+  list(productId, params) {
+    return this.request("GET", `/v1/checkout/products/${encodeURIComponent(productId)}/prices${toQuery(params)}`);
+  }
+  /** GET /v1/checkout/prices/:id */
+  retrieve(priceId) {
+    return this.request("GET", `/v1/checkout/prices/${encodeURIComponent(priceId)}`);
+  }
+  /**
+   * PATCH /v1/checkout/prices/:id — nickname(표시 메타)만.
+   * 금액류 필드(amount_atomic 등)는 immutable — 서버가 PRICE_IMMUTABLE_FIELD로 거부한다.
+   * 가격 변경은 `prices.create()`로 새 price를 만들 것. "그만 팔기"는 해당 Price 를 쓰는
+   * Payment Link 를 inactive 로 한다(Price 자체에는 active/inactive 개념이 없다).
+   */
+  update(priceId, params) {
+    return this.request("PATCH", `/v1/checkout/prices/${encodeURIComponent(priceId)}`, params);
+  }
+};
+var PaymentLinksResource = class {
+  constructor(request) {
+    this.request = request;
+  }
+  request;
+  /** POST /v1/checkout/payment-links */
+  create(params) {
+    return this.request("POST", "/v1/checkout/payment-links", params);
+  }
+  /** GET /v1/checkout/payment-links */
+  list(params) {
+    return this.request("GET", `/v1/checkout/payment-links${toQuery(params)}`);
+  }
+  /** GET /v1/checkout/payment-links/:id */
+  retrieve(linkId) {
+    return this.request("GET", `/v1/checkout/payment-links/${encodeURIComponent(linkId)}`);
+  }
+  /** PATCH /v1/checkout/payment-links/:id */
+  update(linkId, params) {
+    return this.request("PATCH", `/v1/checkout/payment-links/${encodeURIComponent(linkId)}`, params);
+  }
+};
+
 // src/client.ts
+function validateLineItem(li) {
+  if ("price_id" in li) return li;
+  const hasHuman = li.amount != null;
+  const hasAtomic = li.amount_atomic != null;
+  if (hasHuman === hasAtomic) {
+    throw new Error('[BitPal] line item requires exactly one of `amount` (USD number, e.g. "29") or `amount_atomic` (raw \u03BCUSD integer, e.g. "29000000").');
+  }
+  return li;
+}
 var DEFAULT_BASE_URL = "https://api.bitpal.io";
 var DEFAULT_TIMEOUT = 3e4;
 var BitPalCheckoutClient = class {
+  /** 서버 메서드용 secret 키. 공개(buyer-facing) 메서드는 없이도 동작. */
   apiKey;
   baseUrl;
   timeout;
+  /** PROD-LINK-3a-SDK: Product 카탈로그 관리 (server-side 전용) */
+  products;
+  /** PROD-LINK-3a-SDK: immutable Price 관리 — 가격 변경은 비활성화 + 새 price 생성 */
+  prices;
+  /** PROD-LINK-4-SDK: Payment Link 관리 — 대시보드 없이 코드로 결제 링크 생성 (server-side 전용) */
+  paymentLinks;
   constructor(config) {
-    if (!config.apiKey) throw new Error("apiKey is required");
     this.apiKey = config.apiKey;
     this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
     this.timeout = config.timeout ?? DEFAULT_TIMEOUT;
+    const requester = (method, path, body) => this.request(method, path, body);
+    this.products = new ProductsResource(requester);
+    this.prices = new PricesResource(requester);
+    this.paymentLinks = new PaymentLinksResource(requester);
   }
   /* ─── 내부 HTTP ─── */
   async request(method, path, body, extraHeaders) {
@@ -21,7 +120,8 @@ var BitPalCheckoutClient = class {
         method,
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${this.apiKey}`,
+          // 공개 메서드(session_token 기반)는 apiKey 없이 호출 가능 — 있을 때만 Authorization 첨부.
+          ...this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {},
           ...extraHeaders ?? {}
         },
         body: body ? JSON.stringify(body) : void 0,
@@ -41,22 +141,35 @@ var BitPalCheckoutClient = class {
   /**
    * 체크아웃 세션 생성.
    *
-   * 모든 `line_items[].amount`는 atomic μUSDC 정수 문자열이어야 한다 ($1 = "1000000").
-   * decimal 표기는 거부된다 — `toAtomicUSDC()` 헬퍼 사용 권장.
+   * `line_items[].amount` 는 사람 표기 USD 문자열("29", "0.5") — decimal 계산 불필요.
+   * 이미 raw μUSD 정수라면 `amount_atomic`("29000000") 사용(고급). 둘은 상호 배타.
    *
    * @example
-   * import { BitPal, toAtomicUSDC } from '@bitpal/checkout';
+   * import { BitPal } from '@bitpal/checkout';
    * const bp = new BitPal('bp_test_...');
    * const { data } = await bp.checkout.createSession({
-   *   line_items: [{ name: 'Pro', amount: toAtomicUSDC('29.00'), currency: 'USDC' }],
+   *   // amount: 사람 표기 USD("29", "0.5"). 금액은 USD 가격이라 체인/토큰 decimal 무관.
+   *   line_items: [{ name: 'Pro', amount: '29', currency: 'USDC' }],
    * });
    * console.log(data.url); // → buyer를 redirect할 결제 페이지
+   *
+   * // 멀티체인 허용 — 구매자가 Base/Optimism 중 선택(하나뿐이면 자동 선택):
+   * //   어떤 체인·토큰이든 amount 그대로 — 서버가 발급 시 토큰 decimals 로 재스케일.
+   * await bp.checkout.createSession({
+   *   line_items: [{ name: 'Pro', amount: '29', currency: 'USDC' }],
+   *   allowed_pay_chains: ['eip155:84532', 'eip155:11155420'],
+   * });
+   * // 단일 체인 고정은 pay_chain 사용(둘은 상호 배타).
    */
   async createSession(params) {
+    if (params.pay_chain && params.allowed_pay_chains && params.allowed_pay_chains.length > 0) {
+      throw new Error("[BitPal] pay_chain and allowed_pay_chains are mutually exclusive \u2014 use only one.");
+    }
+    const body = { ...params, line_items: params.line_items.map(validateLineItem) };
     const res = await this.request(
       "POST",
       "/v1/checkout/sessions",
-      params
+      body
     );
     if (res.data) {
       if (res.data.checkout_url) {
@@ -86,148 +199,56 @@ var BitPalCheckoutClient = class {
       `/v1/checkout/sessions${query ? `?${query}` : ""}`
     );
   }
-  /* ─── Refunds ─── */
-  /**
-   * Auto refund — escrow 보관 중일 때 컨트랙트가 buyer에게 직접 transfer.
-   *
-   * `params.amount` 미지정 시 backend가 잔액 전액(`type: 'full'`). 명시 시 `type: 'partial'`.
-   * **Idempotency-Key 권장** — 같은 키로 재시도 시 backend가 같은 결과 반환.
-   *
-   * 머천트가 `frozen` 상태면 환불은 허용되지만, `suspended` 상태에서는 차단된다.
-   *
-   * @example
-   * ```ts
-   * import { randomUUID } from 'node:crypto';
-   * const { data } = await bitpal.checkout.refundSession(
-   *   sessionId,
-   *   { amount: toAtomicUSDC('5.00'), reason: 'customer_requested' },
-   *   { idempotencyKey: randomUUID() },
-   * );
-   * console.log(data.txHash);  // on-chain tx hash (또는 simulation 환경에서 sim_xxx)
-   * ```
-   */
-  async refundSession(sessionId, params = {}, opts) {
-    return this.request(
-      "POST",
-      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/refund`,
-      params,
-      opts?.idempotencyKey ? { "Idempotency-Key": opts.idempotencyKey } : void 0
-    );
-  }
+  /* ─── 안2 비수탁 결제 (deposit-address) ─── */
   /**
-   * Record refund — `status='settled'` 후 머천트가 외부 지갑에서 직접 송금하고 tx_hash를 입력.
-   * 컨트랙트 호출 없음 (DB-only).
+   * 공개 세션 조회 (`GET /v1/checkout/sessions/:id/public`) — 인증 불요.
    *
-   * **Idempotency-Key 권장**.
-   *
-   * @example
-   * ```ts
-   * await bitpal.checkout.recordRefund(
-   *   sessionId,
-   *   {
-   *     refund_amount: toAtomicUSDC('5.00'),
-   *     tx_hash: '0xabc...',
-   *     reason: 'manual_offchain_refund',
-   *   },
-   *   { idempotencyKey: randomUUID() },
-   * );
-   * ```
+   * buyer-facing 결제 페이지가 표시/자산선택에 쓰는 서버 권위 뷰. `payment_options` 로
+   * 구매자 선택 가능한 chain×token 을 얻고, 발급 후에는 `deposit_address` 가 채워진다.
    */
-  async recordRefund(sessionId, params, opts) {
-    return this.request(
-      "POST",
-      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/record-refund`,
-      params,
-      opts?.idempotencyKey ? { "Idempotency-Key": opts.idempotencyKey } : void 0
-    );
-  }
-  /** 세션별 환불 내역 (auto + record 통합) */
-  async listRefunds(sessionId) {
+  async getPublicSession(sessionId) {
     return this.request(
       "GET",
-      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/refunds`
+      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/public`
     );
   }
-  /* ─── External On-chain Payments ─── */
   /**
-   * CheckoutEscrow에 직접 입금한 외부 결제를 BitPal에 제출·검증.
+   * 주문별 비수탁 입금주소 발급 (`POST /v1/checkout/sessions/:id/deposit-address`).
    *
-   * Buyer가 merchant UI/SDK에서 `CheckoutEscrow.deposit*()` 함수를 직접 호출한 뒤
-   * 결과 tx_hash를 이 메서드로 제출한다. BitPal은 receipt를 fetch하여
-   * `PaymentDeposited` 이벤트를 검증하고 세션 상태를 갱신한다.
+   * 안2 결제 진입점. 구매자가 자산(멀티옵션이면 chain/token)과 환불 주소를 확정하면 서버가
+   * 그 주문 전용 CREATE2 forwarder 주소를 돌려준다. 구매자는 아무 지갑/거래소에서 **정확한 금액**을
+   * 그 주소로 일반 송금하면 된다(서명·연결 불필요). watcher 가 감지 → keeper 가 정산.
    *
-   * **인증 방식:**
-   * - Merchant server (API key): `Authorization: Bearer bp_test_*` 헤더 자동 첨부
-   * - Buyer 측 (session_token): `params.session_token` 전달
+   * refundAddress 는 입금주소에 커밋되어 발급 후 변경 불가. session_token 은 createSession 응답값.
    *
    * @example
    * ```ts
-   * // Merchant server — API key 인증
-   * const { data } = await bitpal.checkout.submitExternalPayment(sessionId, {
-   *   tx_hash: '0xabc...',
-   *   chain: 'base',
+   * const { data } = await bitpal.checkout.issueDepositAddress(sessionId, {
+   *   session_token: session.session_token!,
+   *   refundAddress: '0xBuyerWallet...',
+   *   chain: 'eip155:8453', // 멀티옵션 세션만 필요
+   *   token: 'USDC',
    * });
-   * console.log(data.validation_status); // 'valid' | 'underpaid' | 'overpaid' | ...
-   * console.log(data.session_status);    // 'paid' | 'unresolved_underpaid' | ...
+   * console.log(data.depositAddress, data.expectedAmount); // 이 주소로 정확 금액 송금
    * ```
    */
-  async submitExternalPayment(sessionId, params, opts) {
+  async issueDepositAddress(sessionId, params) {
     return this.request(
       "POST",
-      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/submit-external-payment`,
-      params,
-      opts?.idempotencyKey ? { "Idempotency-Key": opts.idempotencyKey } : void 0
-    );
-  }
-  /**
-   * Gasless checkout payment through the BitPal API relayer.
-   *
-   * The buyer signs **two** EIP-712 typed-data structures and the API calls
-   * `CheckoutEscrow.depositWithAuthorization()` with the platform relayer:
-   *
-   * 1. **EIP-3009 USDC TransferWithAuthorization** (`params.authorization`) —
-   *    authorizes USDC transfer from buyer to escrow.
-   * 2. **PaymentAuthorization** (`params.payment_auth`, since SDK v0.2.0) —
-   *    binds the entire payment intent (paymentId, merchant, amount, fee,
-   *    reserve, duration) to the buyer's signature. Without this, a compromised
-   *    gateway key could redirect funds to an attacker-controlled merchant.
-   *
-   * Build the PaymentAuthorization typed-data with `buildPaymentAuthTypedData()`.
-   * The PaymentAuthorization nonce comes from `CheckoutEscrow.paymentAuthNonce(payer)`.
-   *
-   * Use the returned session/order state only as immediate UX feedback; the
-   * merchant backend should finalize fulfillment from signed webhooks.
-   *
-   * @breaking-change v0.2.0 — `payment_auth` field is now required. v0.1.x clients
-   *                          must upgrade their signing flow. See MIGRATION_v0.2.md.
-   */
-  async payWithAuthorization(sessionId, params, opts) {
-    return this.request(
-      "POST",
-      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/submit-payment`,
-      params,
-      opts?.idempotencyKey ? { "Idempotency-Key": opts.idempotencyKey } : void 0
+      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/deposit-address`,
+      params
     );
   }
   /**
-   * 세션의 external on-chain 결제 검증 기록 목록 조회.
-   *
-   * `getSession()`의 `payment_observations` 필드와 동일한 데이터를 반환하지만
-   * 검증 기록만 명시적으로 조회할 때 사용한다.
+   * 경량 상태 폴링 (`GET /v1/checkout/sessions/:id/status`) — 인증 불요.
    *
-   * @example
-   * ```ts
-   * const { data } = await bitpal.checkout.getExternalPaymentStatus(sessionId);
-   * const latest = data[0];
-   * if (latest?.finality_status === 'final_confirmed') {
-   *   // 12 confirmations 완료 — 결제 확정
-   * }
-   * ```
+   * status: awaiting_deposit → deposit_detected → paid_confirmed/swept. 확정/정산은 webhook 으로도
+   * 통지되므로, 서버 사이드 확정은 webhook 을 신뢰(폴링은 buyer UX 용).
    */
-  async getExternalPaymentStatus(sessionId) {
+  async getStatus(sessionId) {
     return this.request(
       "GET",
-      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/payment-observations`
+      `/v1/checkout/sessions/${encodeURIComponent(sessionId)}/status`
     );
   }
   /* ─── Fees ─── */
@@ -251,17 +272,12 @@ var BitPalError = class extends Error {
 // src/webhook.ts
 var CHECKOUT_WEBHOOK_EVENTS = [
   "checkout.session.created",
+  "checkout.session.deposit_detected",
   "checkout.session.paid",
   "checkout.session.settled",
   "checkout.session.expired",
   "checkout.session.unresolved",
-  "checkout.session.release_deferred",
-  "checkout.payment.failed",
-  "checkout.payment.finalized",
-  "checkout.payment.revoked",
-  "checkout.refund.recorded",
-  "checkout.refund.completed",
-  "checkout.refund.partial"
+  "checkout.refund.recorded"
 ];
 var WEBHOOK_HEADERS = {
   signature: "X-Webhook-Signature-256",
@@ -271,14 +287,21 @@ var WEBHOOK_HEADERS = {
   deliveryId: "X-Webhook-Delivery-Id"
 };
 var SIGNATURE_PREFIX = "sha256=";
-async function verifyWebhookSignature(payload, signature, secret) {
+async function verifyWebhookSignature(payload, signature, secret, opts) {
   if (!payload || !signature || !secret) return false;
   if (!signature.startsWith(SIGNATURE_PREFIX)) return false;
+  const timestamp = opts?.timestamp;
+  if (!timestamp) return false;
+  const parsedMs = Date.parse(timestamp);
+  if (!Number.isFinite(parsedMs)) return false;
+  if (new Date(parsedMs).toISOString() !== timestamp) return false;
+  const toleranceMs = (opts?.toleranceSec ?? 300) * 1e3;
+  if (Math.abs(Date.now() - parsedMs) > toleranceMs) return false;
   const sigHex = signature.slice(SIGNATURE_PREFIX.length);
-  if (!/^[0-9a-f]+$/.test(sigHex)) return false;
+  if (!/^[0-9a-f]{64}$/.test(sigHex)) return false;
   try {
     const crypto = await import("crypto");
-    const expectedHex = crypto.createHmac("sha256", secret).update(payload, "utf8").digest("hex");
+    const expectedHex = crypto.createHmac("sha256", secret).update(`${timestamp}.${payload}`, "utf8").digest("hex");
     if (sigHex.length !== expectedHex.length) return false;
     return crypto.timingSafeEqual(
       Buffer.from(sigHex, "hex"),
@@ -297,93 +320,39 @@ function parseWebhookEvent(body) {
 }
 
 // src/amount.ts
-var USDC_DECIMALS = 6n;
-var USDC_SCALE = 10n ** USDC_DECIMALS;
-function toAtomicUSDC(decimal) {
-  if (typeof decimal !== "string" || !/^\d+(\.\d{1,6})?$/.test(decimal)) {
-    throw new Error(`toAtomicUSDC: invalid decimal '${decimal}' (max 6 fractional digits, no negatives)`);
+function toAtomic(decimal, decimals) {
+  if (!Number.isInteger(decimals) || decimals < 0 || decimals > 36) {
+    throw new Error(`toAtomic: invalid decimals '${decimals}'`);
   }
-  const [whole, frac = ""] = decimal.split(".");
-  const fracPadded = frac.padEnd(Number(USDC_DECIMALS), "0");
-  return (BigInt(whole) * USDC_SCALE + BigInt(fracPadded || "0")).toString();
+  const fracPattern = decimals > 0 ? `(\\.\\d{1,${decimals}})?` : "";
+  if (typeof decimal !== "string" || !new RegExp(`^\\d+${fracPattern}$`).test(decimal)) {
+    throw new Error(`toAtomic: invalid decimal '${decimal}' (max ${decimals} fractional digits, no negatives)`);
+  }
+  const scale = 10n ** BigInt(decimals);
+  const [whole = "0", frac = ""] = decimal.split(".");
+  const fracPadded = frac.padEnd(decimals, "0");
+  return (BigInt(whole) * scale + BigInt(fracPadded || "0")).toString();
 }
-function fromAtomicUSDC(atomic) {
+function fromAtomic(atomic, decimals) {
+  if (!Number.isInteger(decimals) || decimals < 0 || decimals > 36) {
+    throw new Error(`fromAtomic: invalid decimals '${decimals}'`);
+  }
   if (typeof atomic !== "string" || !/^\d+$/.test(atomic)) {
-    throw new Error(`fromAtomicUSDC: invalid atomic '${atomic}' (must be non-negative integer string)`);
+    throw new Error(`fromAtomic: invalid atomic '${atomic}' (must be non-negative integer string)`);
   }
+  const scale = 10n ** BigInt(decimals);
   const big = BigInt(atomic);
-  const whole = big / USDC_SCALE;
-  const frac = big % USDC_SCALE;
-  const fracStr = frac.toString().padStart(Number(USDC_DECIMALS), "0").replace(/0+$/, "");
+  const whole = big / scale;
+  const frac = big % scale;
+  if (decimals === 0) return `${whole}`;
+  const fracStr = frac.toString().padStart(decimals, "0").replace(/0+$/, "");
   return fracStr.length > 0 ? `${whole}.${fracStr.padEnd(2, "0")}` : `${whole}.00`;
 }
-
-// src/typed-data.ts
-function buildPaymentAuthTypedData(args) {
-  return {
-    domain: {
-      name: "CheckoutEscrow",
-      version: "1",
-      chainId: args.chainId,
-      verifyingContract: args.escrowAddress
-    },
-    types: {
-      PaymentAuthorization: [
-        { name: "paymentId", type: "bytes32" },
-        { name: "payer", type: "address" },
-        { name: "merchant", type: "address" },
-        { name: "token", type: "address" },
-        { name: "amount", type: "uint256" },
-        { name: "feeAmount", type: "uint256" },
-        { name: "reserveAmount", type: "uint256" },
-        { name: "duration", type: "uint256" },
-        { name: "deadline", type: "uint256" },
-        { name: "nonce", type: "uint256" }
-      ]
-    },
-    primaryType: "PaymentAuthorization",
-    message: {
-      paymentId: args.paymentId,
-      payer: args.payer,
-      merchant: args.merchant,
-      token: args.token,
-      amount: BigInt(args.amount),
-      feeAmount: BigInt(args.feeAmount),
-      reserveAmount: BigInt(args.reserveAmount),
-      duration: BigInt(args.duration),
-      deadline: BigInt(args.deadline),
-      nonce: BigInt(args.nonce)
-    }
-  };
-}
-function buildConfirmReceiptTypedData(args) {
-  return {
-    domain: {
-      name: "CheckoutEscrow",
-      version: "1",
-      chainId: args.chainId,
-      verifyingContract: args.escrowAddress
-    },
-    types: {
-      ConfirmReceipt: [
-        { name: "paymentId", type: "bytes32" },
-        { name: "payer", type: "address" },
-        { name: "deadline", type: "uint256" },
-        { name: "nonce", type: "uint256" }
-      ]
-    },
-    primaryType: "ConfirmReceipt",
-    message: {
-      paymentId: args.paymentId,
-      payer: args.payer,
-      deadline: BigInt(args.deadline),
-      nonce: BigInt(args.nonce)
-    }
-  };
+function toAtomicUSDC(decimal) {
+  return toAtomic(decimal, 6);
 }
-function sessionIdToPaymentId(sessionId) {
-  const hex = Array.from(new TextEncoder().encode(sessionId)).map((b) => b.toString(16).padStart(2, "0")).join("").padEnd(64, "0");
-  return `0x${hex}`;
+function fromAtomicUSDC(atomic) {
+  return fromAtomic(atomic, 6);
 }
 
 // src/index.ts
@@ -399,12 +368,14 @@ export {
   BitPalCheckoutClient,
   BitPalError,
   CHECKOUT_WEBHOOK_EVENTS,
+  PaymentLinksResource,
+  PricesResource,
+  ProductsResource,
   WEBHOOK_HEADERS,
-  buildConfirmReceiptTypedData,
-  buildPaymentAuthTypedData,
+  fromAtomic,
   fromAtomicUSDC,
   parseWebhookEvent,
-  sessionIdToPaymentId,
+  toAtomic,
   toAtomicUSDC,
   verifyWebhookSignature
 };

package/package.json

@@ -1,21 +1,35 @@
 {
   "name": "@bitpal/checkout",
-  "version": "0.3.0",
-  "description": "BitPal Checkout SDK — crypto payment sessions, external on-chain payment verification, gasless checkout (with PaymentAuthorization double-defense), refunds, fee preview.",
-  "license": "UNLICENSED",
+  "version": "0.6.0",
+  "description": "BitPal Checkout SDK — non-custodial crypto checkout: create sessions, issue per-order deposit addresses, poll status, verify signed webhooks.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/superlabs-x/bitpal-checkout-sdk.git"
+  },
+  "homepage": "https://github.com/superlabs-x/bitpal-checkout-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/superlabs-x/bitpal-checkout-sdk/issues"
+  },
   "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     }
   },
   "files": [
     "dist",
-    "README.md",
-    "MIGRATION_v0.2.md"
+    "README.md"
   ],
   "keywords": [
     "bitpal",
@@ -27,7 +41,7 @@
     "evm",
     "base",
     "stablecoin",
-    "escrow"
+    "non-custodial"
   ],
   "publishConfig": {
     "access": "public"
@@ -35,15 +49,17 @@
   "engines": {
     "node": ">=18"
   },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "lint": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm test && npm run build",
+    "release": "npm publish --access public"
+  },
   "devDependencies": {
+    "@types/node": "^20.11.0",
     "tsup": "^8.5.1",
     "typescript": "^5.5.0",
     "vitest": "^2.1.9"
-  },
-  "scripts": {
-    "build": "tsup src/index.ts --format esm --dts --clean",
-    "lint": "tsc --noEmit",
-    "test": "vitest run",
-    "release": "pnpm publish --access public --no-git-checks"
   }
-}
+}