@chaindaddy/js 0.1.0 → 0.3.0

package/dist/verify.js

@@ -0,0 +1,342 @@
+// src/checkouts.json
+var checkouts_default = {
+  generatedBy: "js/scripts/gen-checkouts.mjs from deployments/*.json; do not edit by hand. Regenerate whenever a checkout is deployed.",
+  checkouts: {
+    "eip155:1": [
+      "0x1825e21c72ebd14a683d56200ee834a371313bf1",
+      "0x7a5f3e0b9cf37cc6757216f843a9f9f9b4324d17",
+      "0x3e79d8041f578b2721c03cb8c086798d76ea7709",
+      "0x2428edd69cdc837d77bec390ec6359b7fac430a1"
+    ],
+    "eip155:56": [
+      "0x2921755ce671b98e06f78389e20d6f971af5c77a",
+      "0x1840851a5931e43f4fd73096987025be00e6a1b6",
+      "0x7a5f3e0b9cf37cc6757216f843a9f9f9b4324d17",
+      "0x1825e21c72ebd14a683d56200ee834a371313bf1"
+    ],
+    "eip155:97": [
+      "0xe29e6bb43f3d5074f2e54a4524635d7d96708577",
+      "0x0e7f3f99d23e8c950b0ed9885a008ff371ce34cd",
+      "0x24d60fc4c0e40e0665a00767a857669e25b8ebf2",
+      "0x54be2770892c2e73d47ad854365c346bf63d5ba7"
+    ],
+    "eip155:100": [
+      "0x44a14d4da51af4e7caad01aaadc6afe731f7d316",
+      "0x90fa09304ac71d16a7928ff5a6cd73cd5eafb207"
+    ],
+    "eip155:137": [
+      "0x8d06e5e72510b9e30689e0fad7d8df7fc3a03907",
+      "0x169f7562decb2999af40ac7079022afcc131c3bc",
+      "0x7225ffab009292d5b46da31ca0f030fae5ce36eb",
+      "0x0dcd5004bd92c745b21dd64b02d0db219163dbbd"
+    ],
+    "eip155:4663": [
+      "0xaff354c143227347b3e3a108eb7e13565c04ff6e",
+      "0x2abc5bcb3a2595bc3bfd643be823b548277aa658",
+      "0x639c756ffce88288db3e0cd58b0228632455e842",
+      "0x1840851a5931e43f4fd73096987025be00e6a1b6"
+    ],
+    "eip155:8453": [
+      "0x3e79d8041f578b2721c03cb8c086798d76ea7709",
+      "0x1825e21c72ebd14a683d56200ee834a371313bf1",
+      "0x70c172a82dd320ac8711b9645f3875db830fe563",
+      "0x81087101ae075020ccc4595b099cbfb2a752b6d1"
+    ],
+    "eip155:10200": [
+      "0xbd0f5bc1d248759696d5cb66e4190fd505e3a76c",
+      "0xe484e68bd019902de5050c8cf7f3379528f672d3",
+      "0xdc2e5ce751f45ebed24df7766b7ab0ab1b03c37b",
+      "0xcfa4a619e0cb26956a88224aea680100fc7689e3"
+    ],
+    "eip155:42161": [
+      "0xfb821475b97a95a54d09016a62f490e0f2bd2c2f",
+      "0x0cbf237af2c3fb2442628c12a10d022ba452a49f",
+      "0x4258da759dd30f56f019f4020969c228c58cfca8",
+      "0x377e606ce0522f91a32095c97c52e4ef4a33f8e6"
+    ],
+    "eip155:43113": [
+      "0x5d9cb9a21cc455767792b64c7a5153255d915048",
+      "0x4b4c4c900135131db09c6d7a6432a1339e1e4508",
+      "0xd9fc410766df9149bb39091512d68702dd81da1d",
+      "0xe13528d58e35f3b4451dd44a6733f63192d966d2"
+    ],
+    "eip155:43114": [
+      "0x2921755ce671b98e06f78389e20d6f971af5c77a",
+      "0x1840851a5931e43f4fd73096987025be00e6a1b6"
+    ],
+    "eip155:46630": [
+      "0x468ac90058cb9344542c5f9c21f014cc60365f40",
+      "0x476895a3fe92d8ec9fd70b2a243d60bf4949c829",
+      "0xe59faf03129588161de83525e23a8c9a85cc57f4",
+      "0x10cc44c747add456a022486897757bcce815c425"
+    ],
+    "eip155:80002": [
+      "0xabe26c6a59ff8a07a57d310150bbbd7dc5b60960",
+      "0x4e017dafff03ee85b78c0fcac1f38249ac7bf730",
+      "0x4a81e9cfbfda56d6c5c840a4c8d2e7c7f5e520b7",
+      "0xfc75c3cab2aa4fa471afffe44ef7fdc79443115d"
+    ],
+    "eip155:84532": [
+      "0xa733934c37a10fbfd574a986ec6b78082f444a1c",
+      "0x5fc22e707d5583d729c9477244a12f994289396c",
+      "0x423b5426b002e7a5840c325db63ade3e8933a3cb",
+      "0x129a328e7cd88a4c25dc6aeeab72995f06cff7ad"
+    ],
+    "eip155:421614": [
+      "0xb92f6f2d1e0301c5870cb0c1437c94068851b180",
+      "0x1cf15debaa2d68a12822a8bc6e3fbc5c24f345c8",
+      "0xfa4f1753ec974b609ac2755357474952740098ed",
+      "0x6f517ca1e1aadd9cb02d1a826927d42ac1ccf7a9"
+    ],
+    "eip155:11155111": [
+      "0xe97aaadd52bf3a16f012898656c16f81a921965b",
+      "0x997832bde33b0c7b5af50545807cd07ac36dc4b4",
+      "0x4501836080b3c6936ea4796542dcbb344d843c6c",
+      "0xf1d53237940f1c48f4b305d8b14a9b03d8252dcc"
+    ]
+  }
+};
+
+// src/confirmations.json
+var confirmations_default = {
+  generatedBy: "go test ./pkg/iap -run TestJSConfirmationFloorsMatchTheServer (UPDATE_VERIFY_VECTORS=1 rewrites this file); do not edit by hand",
+  confirmations: {
+    "eip155:1": 12,
+    "eip155:100": 10,
+    "eip155:10200": 2,
+    "eip155:11155111": 2,
+    "eip155:137": 64,
+    "eip155:42161": 20,
+    "eip155:421614": 2,
+    "eip155:43113": 2,
+    "eip155:43114": 2,
+    "eip155:4663": 20,
+    "eip155:46630": 2,
+    "eip155:56": 15,
+    "eip155:80002": 2,
+    "eip155:8453": 5,
+    "eip155:84532": 2,
+    "eip155:97": 2
+  }
+};
+
+// src/verify.ts
+function frozen(table, each) {
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const key of Object.keys(table)) out[key] = each(table[key]);
+  return Object.freeze(out);
+}
+var CHECKOUTS = frozen(checkouts_default.checkouts, (a) => Object.freeze([...a]));
+var MIN_CONFIRMATIONS = frozen(confirmations_default.confirmations, (n) => n);
+var DEFAULT_MIN_CONFIRMATIONS = 12;
+var NATIVE_TOKEN = "0x0000000000000000000000000000000000000000";
+var HASH_ORDER = "9ba31b09";
+var PAID_BY = "b2b9adc2";
+var MAX_UINT256 = (1n << 256n) - 1n;
+var MAX_PAYEES = 32;
+var VerifyError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "VerifyError";
+    this.code = code;
+  }
+};
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function address(v, what, code) {
+  if (typeof v !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(v)) throw new VerifyError(code, `${what} is not an address`);
+  return v.toLowerCase();
+}
+function bytes32(v, what, code) {
+  if (typeof v !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(v)) throw new VerifyError(code, `${what} is not 32 bytes of hex`);
+  return v.toLowerCase();
+}
+function uint256(v, what, code, allowNumber = false) {
+  let n;
+  if (typeof v === "bigint") n = v;
+  else if (typeof v === "string" && /^[0-9]{1,78}$/.test(v)) n = BigInt(v);
+  else if (allowNumber && typeof v === "number" && Number.isSafeInteger(v)) n = BigInt(v);
+  else throw new VerifyError(code, `${what} must be ${allowNumber ? "a whole number" : "a bigint or a decimal string, never a number"}`);
+  if (n < 0n || n > MAX_UINT256) throw new VerifyError(code, `${what} does not fit in a uint256`);
+  return n;
+}
+function chain(v, what, code) {
+  if (typeof v === "number" && Number.isSafeInteger(v) && v > 0) return `eip155:${v}`;
+  if (typeof v === "string") {
+    const m = /^(?:eip155:)?([1-9][0-9]{0,15})$/.exec(v);
+    if (m) return `eip155:${m[1]}`;
+  }
+  throw new VerifyError(code, `${what} is not an EVM chain id ("eip155:8453" or 8453)`);
+}
+function parseOrder(v, code) {
+  if (!isObject(v)) throw new VerifyError(code, "order is missing");
+  const { payees, amounts } = v;
+  if (!Array.isArray(payees) || !Array.isArray(amounts) || payees.length < 1 || payees.length > MAX_PAYEES || payees.length !== amounts.length) {
+    throw new VerifyError(code, "order.payees and order.amounts must be lists of the same length, one entry or more");
+  }
+  return {
+    orderId: bytes32(v.orderId, "order.orderId", code),
+    token: address(v.token, "order.token", code),
+    // Array.from, not map: map skips the holes of a sparse array, and the two lists would then disagree with their lengths.
+    payees: Array.from(payees, (p, i) => address(p, `order.payees[${i}]`, code)),
+    // The wire prints amounts as decimal strings. A JSON number may already have lost precision, so it is refused.
+    amounts: Array.from(amounts, (a, i) => uint256(a, `order.amounts[${i}]`, code)),
+    deadline: uint256(v.deadline, "order.deadline", code, true)
+  };
+}
+var word = (n) => n.toString(16).padStart(64, "0");
+var addressWord = (a) => a.slice(2).padStart(64, "0");
+function encodeParsedOrder(o) {
+  const n = BigInt(o.payees.length);
+  return "0x" + HASH_ORDER + word(32n) + // where the tuple starts
+  o.orderId.slice(2) + addressWord(o.token) + word(160n) + // where payees starts, from the tuple: after its five head words
+  word(160n + 32n * (n + 1n)) + // where amounts starts: after payees' length and entries
+  word(o.deadline) + word(n) + o.payees.map(addressWord).join("") + word(n) + o.amounts.map(word).join("");
+}
+function encodeHashOrder(order) {
+  return encodeParsedOrder(parseOrder(order, "bad_verification"));
+}
+function encodePaidBy(orderHash) {
+  return "0x" + PAID_BY + bytes32(orderHash, "orderHash", "bad_verification").slice(2);
+}
+function checkoutsOn(chainId) {
+  return CHECKOUTS[chainId] ?? [];
+}
+function isKnownCheckout(chainId, checkout) {
+  try {
+    return checkoutsOn(chain(chainId, "chainId", "bad_options")).includes(address(checkout, "checkout", "bad_options"));
+  } catch {
+    return false;
+  }
+}
+function transport(o) {
+  if (typeof o.request === "function" && o.rpcUrl === void 0) {
+    const request = o.request;
+    return async (method, params) => {
+      try {
+        return await request({ method, params });
+      } catch (e) {
+        throw new VerifyError("rpc_error", `${method} failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    };
+  }
+  if (typeof o.rpcUrl !== "string" || o.rpcUrl === "" || o.request !== void 0) {
+    throw new VerifyError("bad_options", "pass rpcUrl (your JSON-RPC endpoint) or request, one of the two");
+  }
+  const url = o.rpcUrl;
+  const doFetch = o.fetch ?? globalThis.fetch;
+  if (typeof doFetch !== "function") throw new VerifyError("bad_options", "no fetch here: pass options.fetch");
+  let next = 1;
+  return async (method, params) => {
+    const id = next++;
+    let body;
+    try {
+      const res = await doFetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ jsonrpc: "2.0", id, method, params }),
+        signal: o.signal
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      body = await res.json();
+    } catch (e) {
+      throw new VerifyError("rpc_error", `${method} failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!isObject(body)) throw new VerifyError("rpc_error", `${method}: the answer is not a JSON-RPC response`);
+    if (body.error !== void 0 && body.error !== null) {
+      const message = isObject(body.error) && typeof body.error.message === "string" ? body.error.message : JSON.stringify(body.error);
+      throw new VerifyError("rpc_error", `${method} failed: ${String(message).slice(0, 200)}`);
+    }
+    if (body.id !== id || !Object.prototype.hasOwnProperty.call(body, "result")) {
+      throw new VerifyError("rpc_error", `${method}: the answer is not a JSON-RPC response to this request`);
+    }
+    return body.result;
+  };
+}
+function quantity(v, method) {
+  if (typeof v !== "string" || !/^0x[0-9a-fA-F]{1,14}$/.test(v)) throw new VerifyError("rpc_error", `${method} did not answer a number`);
+  const n = BigInt(v);
+  if (n > BigInt(Number.MAX_SAFE_INTEGER)) throw new VerifyError("rpc_error", `${method} did not answer a number`);
+  return n;
+}
+function oneWord(v, what) {
+  if (typeof v !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(v)) {
+    throw new VerifyError("rpc_error", `${what} did not answer one 32-byte word (is the contract there at that block?)`);
+  }
+  return v.toLowerCase();
+}
+function parseExpectation(v) {
+  if (!isObject(v)) {
+    throw new VerifyError("bad_options", "options.expect is required: the order id, chain, asset, payout address and amount you sold for");
+  }
+  const e = {
+    orderId: bytes32(v.orderId, "expect.orderId", "bad_options"),
+    chainId: chain(v.chainId, "expect.chainId", "bad_options"),
+    token: address(v.token, "expect.token", "bad_options"),
+    payee: address(v.payee, "expect.payee", "bad_options"),
+    amount: uint256(v.amount, "expect.amount", "bad_options")
+  };
+  if (e.payee === NATIVE_TOKEN) throw new VerifyError("bad_options", "expect.payee is the zero address");
+  if (e.amount === 0n) throw new VerifyError("bad_options", "expect.amount is zero: pass what your payout address must receive");
+  return e;
+}
+function wholeNumber(v, what, code) {
+  if (typeof v !== "number" || !Number.isSafeInteger(v) || v < 1) throw new VerifyError(code, `${what} must be a whole number, 1 or more`);
+  return BigInt(v);
+}
+async function verifyPayment(verification, options) {
+  if (!isObject(options)) throw new VerifyError("bad_options", "options are required: expect, and rpcUrl or request");
+  const expect = parseExpectation(options.expect);
+  const floor = options.confirmations === void 0 ? 0n : wholeNumber(options.confirmations, "options.confirmations", "bad_options");
+  const rpc = transport(options);
+  const v = verification;
+  if (!isObject(v)) throw new VerifyError("bad_verification", "the verification block is missing (a test order has none)");
+  if (v.kind === "solana") {
+    throw new VerifyError("unsupported", "Solana orders are not supported yet: follow https://docs.chaindaddy.io/developer/verify-a-payment#solana-find-the-transfer");
+  }
+  if (v.kind !== "evm") throw new VerifyError("bad_verification", 'verification.kind is not "evm"');
+  if (typeof v.chainId !== "string" || !v.chainId.startsWith("eip155:")) throw new VerifyError("bad_verification", "verification.chainId is not an EVM chain id");
+  const chainId = chain(v.chainId, "verification.chainId", "bad_verification");
+  const checkout = address(v.checkout, "verification.checkout", "bad_verification");
+  const order = parseOrder(v.order, "bad_verification");
+  const asked = wholeNumber(v.confirmations, "verification.confirmations", "bad_verification");
+  let depth = BigInt(MIN_CONFIRMATIONS[chainId] ?? DEFAULT_MIN_CONFIRMATIONS);
+  if (asked > depth) depth = asked;
+  if (floor > depth) depth = floor;
+  if (chainId !== expect.chainId) throw new VerifyError("wrong_chain", `the order is on ${chainId}, not on ${expect.chainId}`);
+  if (!checkoutsOn(chainId).includes(checkout)) {
+    throw new VerifyError("unknown_checkout", `${checkout} is not a Chain Daddy checkout on ${chainId} that this version of @chaindaddy/js knows`);
+  }
+  if (order.orderId !== expect.orderId) throw new VerifyError("expectation_mismatch", `the block is for order ${order.orderId}, not ${expect.orderId}`);
+  if (order.token !== expect.token) throw new VerifyError("expectation_mismatch", `the order is paid in ${order.token}, not ${expect.token}`);
+  let toPayee = 0n;
+  for (let i = 0; i < order.payees.length; i++) {
+    if (order.payees[i] === expect.payee) toPayee += order.amounts[i];
+  }
+  if (toPayee < expect.amount) {
+    throw new VerifyError("expectation_mismatch", `the order sends ${expect.payee} ${toPayee}, less than the ${expect.amount} expected`);
+  }
+  const rpcChain = quantity(await rpc("eth_chainId", []), "eth_chainId");
+  if (`eip155:${rpcChain}` !== chainId) throw new VerifyError("wrong_chain", `the RPC endpoint is on eip155:${rpcChain}, the order on ${chainId}`);
+  const orderHash = oneWord(await rpc("eth_call", [{ to: checkout, data: encodeParsedOrder(order) }, "latest"]), "hashOrder");
+  const head = quantity(await rpc("eth_blockNumber", []), "eth_blockNumber");
+  const at = head - depth + 1n;
+  const result = { depth: Number(depth), checkout, orderHash, chainId };
+  if (at < 0n) return { paid: false, payer: null, blockNumber: 0, ...result };
+  const answer = oneWord(await rpc("eth_call", [{ to: checkout, data: encodePaidBy(orderHash) }, "0x" + at.toString(16)]), "paidBy");
+  if (!/^0x0{24}/.test(answer)) throw new VerifyError("rpc_error", "paidBy did not answer an address");
+  const payer = "0x" + answer.slice(26);
+  const paid = payer !== NATIVE_TOKEN;
+  return { paid, payer: paid ? payer : null, blockNumber: Number(at), ...result };
+}
+export {
+  CHECKOUTS,
+  MIN_CONFIRMATIONS,
+  NATIVE_TOKEN,
+  VerifyError,
+  encodeHashOrder,
+  encodePaidBy,
+  isKnownCheckout,
+  verifyPayment
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chaindaddy/js",
-  "version": "0.1.0",
-  "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), with embeds and checkout to follow",
+  "version": "0.3.0",
+  "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), a coin's apps on its own site (<cd-app>), checkout for a coin's store in a popup, and a server-side check that a store order was paid on chain",
   "homepage": "https://docs.chaindaddy.io/developer/javascript-sdk",
   "repository": {
     "type": "git",
@@ -18,9 +18,25 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./api": {
+      "types": "./dist/api.d.ts",
+      "default": "./dist/api.js"
+    },
     "./signin": {
       "types": "./dist/signin.d.ts",
       "default": "./dist/signin.js"
+    },
+    "./embed": {
+      "types": "./dist/embed.d.ts",
+      "default": "./dist/embed.js"
+    },
+    "./checkout": {
+      "types": "./dist/checkout.d.ts",
+      "default": "./dist/checkout.js"
+    },
+    "./verify": {
+      "types": "./dist/verify.d.ts",
+      "default": "./dist/verify.js"
     }
   },
   "files": [
@@ -30,6 +46,7 @@
   "sideEffects": false,
   "scripts": {
     "build": "node scripts/build.mjs",
+    "gen:checkouts": "node scripts/gen-checkouts.mjs",
     "test": "vitest run"
   },
   "keywords": [