@fanth/payment-router-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Fanth
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,201 @@
+# @fanth/payment-router-sdk
+
+TypeScript SDK for **payment-router** - the URL shortener for payment gateway webhooks.
+
+Both ends of the trip, off one object - `PaymentRouterClient`:
+
+- **creating a route** registers your real webhook URL and hands back the UUID you give the gateway
+  as its external payment id.
+- **verifying a callback** proves the request the router forwarded back really came from the router,
+  and that its body was not touched on the way.
+
+Runs anywhere with `fetch` and WebCrypto: Node 18+, Cloudflare Workers, Deno, Bun, Vercel Edge.
+ESM and CJS builds, types included, one dependency (`jose`).
+
+```bash
+npm install @fanth/payment-router-sdk
+```
+
+## Creating a route
+
+```ts
+import { PaymentRouterClient } from "@fanth/payment-router-sdk";
+
+const router = new PaymentRouterClient(); // https://payment-r.fanth.pl
+
+const route = await router.createRoute({
+    webhookUrl: "https://shop.example.com/webhooks/payu",
+    externalId: "order-42", // your own id, echoed back on the callback
+    expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000), // optional
+});
+
+// route.id              -> send as the gateway's external payment id (PayU: extOrderId)
+// route.callbackUrls    -> { payu: "https://payment-r.fanth.pl/webhooks/payu" }
+```
+
+Every call defaults to the hosted router at `https://payment-r.fanth.pl` (exported as
+`DEFAULT_BASE_URL`). Running your own worker? Pass `baseUrl` - the verifier's expected `iss` follows
+it, so one option covers both ends.
+
+Then create the payment at the gateway with `route.id` as its external order id, and point the
+gateway's single webhook URL at `route.callbackUrls.payu`. That URL never changes, so it can just as
+well be read straight off the client without creating a route:
+
+```ts
+router.callbackUrl("payu"); // https://payment-r.fanth.pl/webhooks/payu
+```
+
+### Options
+
+| Option         | Default            | What it does                                                 |
+| -------------- | ------------------ | ------------------------------------------------------------ |
+| `baseUrl`      | `DEFAULT_BASE_URL` | The router's public origin.                                  |
+| `fetch`        | global `fetch`     | Custom fetch, for proxies, instrumentation or tests.         |
+| `timeoutMs`    | `10000`            | Per-attempt timeout.                                         |
+| `maxRetries`   | `2`                | Retries on network errors and 429/502/503/504, with backoff. |
+| `retryDelayMs` | `200`              | Base backoff, doubled per attempt.                           |
+| `headers`      | -                  | Extra headers on every request.                              |
+| `verifier`     | -                  | Overrides for the built-in verifier (see below).             |
+
+Route creation is not idempotent: if a create succeeded but its response was lost on the way back,
+the retry creates a second route and the first is orphaned. That is harmless - an unused route is a
+row nobody ever calls back on - but set `maxRetries: 0` if you would rather see the failure.
+
+## Verifying a callback
+
+The router signs every forwarded callback with an EdDSA (Ed25519) JWT in the
+`X-Payment-Router-Signature` header, and publishes the public keys as a JWKS. The client checks both
+the signature **and** `body_sha256`, so the signature covers the payload and not just its
+provenance. Key rotation on the router is transparent - the key set is fetched by `kid` and cached.
+
+Verification needs the **raw bytes** as they arrived. Re-serialized JSON changes the hash, and the
+callback will be rejected.
+
+The same client does it - three methods, same checks, different shape of input. The key set is
+cached per client, so keep one around instead of building one per request. A service that only
+receives callbacks and never creates routes builds the client just the same.
+
+### Express, Fastify, Koa, anything else
+
+`verifyWebhook(headers, rawBody)` takes the headers and the raw body and gives the same raw body
+back - or throws. No middleware, no framework types.
+
+```ts
+import express from "express";
+import { PaymentRouterClient } from "@fanth/payment-router-sdk";
+
+const router = new PaymentRouterClient(); // or { baseUrl } for your own worker
+
+// express.json() throws the raw bytes away, so parse them yourself after verifying
+app.post("/webhooks/payu", express.raw({ type: "*/*" }), async (req, res) => {
+    let rawBody: string;
+    try {
+        rawBody = await router.verifyWebhook(req.headers, req.body);
+    } catch {
+        return res.sendStatus(401);
+    }
+
+    await markPaid(JSON.parse(rawBody));
+    res.sendStatus(200);
+});
+```
+
+Both header shapes work: Node's plain object and fetch's `Headers`.
+
+### Fetch-API handlers (Workers, Hono, Next.js, Deno, Bun)
+
+`verifyRequest(request)` reads the header and the body off a `Request` for you, and returns the
+claims alongside the body:
+
+```ts
+export async function POST(request: Request) {
+    try {
+        const { claims, rawBody } = await router.verifyRequest(request);
+        const notification = JSON.parse(rawBody);
+        // claims.routeId / claims.externalId say which of your payments this is
+        await markPaid(claims.externalId, notification);
+        return new Response("OK");
+    } catch (error) {
+        return new Response("unauthorized", { status: 401 });
+    }
+}
+```
+
+### Anything the other two do not fit
+
+`verifyCallback()` takes the two things that actually matter and returns the claims:
+
+```ts
+const { claims, rawBody } = await router.verifyCallback({
+    token: req.headers["x-payment-router-signature"],
+    rawBody, // string or Uint8Array, exactly as received
+});
+```
+
+`readRawBody(req)` drains a plain `http.IncomingMessage` when there is no body parser at all.
+
+### Options
+
+Verifier settings go under the client's `verifier` option:
+
+```ts
+const router = new PaymentRouterClient({ verifier: { maxAgeSeconds: 60 } });
+```
+
+| Option                  | Default              | What it does                                                  |
+| ----------------------- | -------------------- | ------------------------------------------------------------- |
+| `issuer`                | the client's baseUrl | Override when it differs from the router's `PUBLIC_BASE_URL`. |
+| `jwksUrl`               | baseUrl + JWKS path  | Override the key set location.                                |
+| `maxAgeSeconds`         | `300`                | Reject tokens older than this - the router's own TTL.         |
+| `clockToleranceSeconds` | `5`                  | Leeway for clock skew.                                        |
+| `fetch`                 | the client's fetch   | Custom fetch for the JWKS request.                            |
+| `keyStore`              | remote JWKS          | Swap the key source, e.g. jose's `createLocalJWKSet`.         |
+
+`baseUrl` is inherited from the client, so one origin covers route creation and verification alike.
+
+### Verified claims
+
+```ts
+type CallbackClaims = {
+    routeId: string; // the id you gave the gateway
+    gateway: string; // "payu"
+    externalId: string | null; // your own id, if you set one
+    bodySha256: string; // already checked against the body
+    issuer: string;
+    issuedAt: Date;
+    expiresAt: Date;
+    raw: JWTPayload;
+};
+```
+
+The router also copies `routeId`, `gateway` and `externalId` into `X-Payment-Router-*` headers
+(exported as `ROUTE_ID_HEADER` & co). They are convenience only - anyone who can reach your webhook
+can set them. Log them, decide on the claims.
+
+If the router runs without `WEBHOOK_SIGNING_PRIVATE_KEY` there is no signature to verify and the
+JWKS endpoint 404s: every callback then fails with `missing_signature`, which is the honest answer.
+
+## Errors
+
+Everything thrown extends `PaymentRouterError`.
+
+| Error                          | When                                                          |
+| ------------------------------ | ------------------------------------------------------------- |
+| `PaymentRouterValidationError` | Bad input, caught client-side before anything was sent.       |
+| `InvalidWebhookUrlError`       | `422` - the router refused the URL (not https, private host). |
+| `RateLimitedError`             | `429` - the router's per-IP limit on route creation.          |
+| `PaymentRouterApiError`        | Any other non-2xx; carries `status`, `code`, `body`.          |
+| `PaymentRouterNetworkError`    | No response at all: DNS, TCP, TLS, timeout.                   |
+| `CallbackVerificationError`    | A callback that cannot be trusted; `reason` says why.         |
+
+`CallbackVerificationError.reason` is one of `missing_signature`, `invalid_signature`,
+`body_mismatch`, `malformed_claims`, `body_already_consumed`.
+
+## Development
+
+```bash
+pnpm install
+pnpm test          # vitest, signs real Ed25519 tokens against a fake JWKS
+pnpm run type-check
+pnpm run build     # tsup -> dist/ (esm + cjs + d.ts)
+```

package/dist/index.cjs

@@ -0,0 +1,448 @@
+'use strict';
+
+var jose = require('jose');
+
+// src/defaults.ts
+var DEFAULT_BASE_URL = "https://payment-r.fanth.pl";
+
+// src/errors.ts
+var PaymentRouterError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+  }
+};
+var PaymentRouterApiError = class extends PaymentRouterError {
+  status;
+  /** The `error` field of the response body, when the router sent one. */
+  code;
+  /** The parsed (or raw string) response body, for anything the typed fields do not cover. */
+  body;
+  constructor(message, status, code, body) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.body = body;
+  }
+};
+var RateLimitedError = class extends PaymentRouterApiError {
+};
+var InvalidWebhookUrlError = class extends PaymentRouterApiError {
+  /** The router's human-readable reason, e.g. "webhookUrl must use https". */
+  get reason() {
+    return this.code ?? this.message;
+  }
+};
+var PaymentRouterNetworkError = class extends PaymentRouterError {
+};
+var PaymentRouterValidationError = class extends PaymentRouterError {
+};
+var CallbackVerificationError = class extends PaymentRouterError {
+  /** Machine-readable failure reason, for logging and metrics. */
+  reason;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+  }
+};
+
+// src/http.ts
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
+async function requestJson(options, path, init) {
+  const url = new URL(path, ensureTrailingSlash(options.baseUrl)).toString();
+  let lastError;
+  for (let attempt = 0; attempt <= options.maxRetries; attempt++) {
+    if (attempt > 0) {
+      await sleep(options.retryDelayMs * 2 ** (attempt - 1));
+    }
+    let response;
+    try {
+      response = await options.fetch(url, {
+        ...init,
+        headers: { ...options.headers, ...init.headers },
+        signal: init.signal ?? AbortSignal.timeout(options.timeoutMs)
+      });
+    } catch (error2) {
+      lastError = new PaymentRouterNetworkError(`request to ${url} failed: ${describe(error2)}`, { cause: error2 });
+      continue;
+    }
+    if (response.ok) {
+      return await response.json();
+    }
+    const error = await toApiError(response);
+    if (!RETRYABLE_STATUSES.has(response.status)) {
+      throw error;
+    }
+    lastError = error;
+  }
+  throw lastError ?? new PaymentRouterNetworkError(`request to ${url} failed for an unknown reason`);
+}
+async function toApiError(response) {
+  const body = await readBody(response);
+  const code = extractCode(body);
+  const message = `payment-router responded ${response.status}${code ? `: ${code}` : ""}`;
+  if (response.status === 429) return new RateLimitedError(message, response.status, code, body);
+  if (response.status === 422) return new InvalidWebhookUrlError(message, response.status, code, body);
+  return new PaymentRouterApiError(message, response.status, code, body);
+}
+async function readBody(response) {
+  const text = await response.text().catch(() => "");
+  if (text.length === 0) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function extractCode(body) {
+  if (typeof body !== "object" || body === null) return null;
+  const error = body.error;
+  if (typeof error === "string") return error;
+  const issues = error?.issues;
+  const first = issues?.[0]?.message;
+  return typeof first === "string" ? first : null;
+}
+function describe(error) {
+  if (error instanceof Error) return `${error.name}: ${error.message}`;
+  return "unknown error";
+}
+function ensureTrailingSlash(url) {
+  return url.endsWith("/") ? url : `${url}/`;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/headers.ts
+var SIGNATURE_HEADER = "x-payment-router-signature";
+var ROUTE_ID_HEADER = "x-payment-router-id";
+var GATEWAY_HEADER = "x-payment-router-gateway";
+var EXTERNAL_ID_HEADER = "x-payment-router-external-id";
+var FORWARDED_HOST_HEADER = "x-forwarded-host";
+
+// src/verify.ts
+var DEFAULT_MAX_AGE_SECONDS = 300;
+var CallbackVerifier = class {
+  issuer;
+  maxAgeSeconds;
+  clockToleranceSeconds;
+  getKey;
+  constructor(options = {}) {
+    const baseUrl = stripTrailingSlash(options.baseUrl ?? DEFAULT_BASE_URL);
+    this.issuer = options.issuer ?? baseUrl;
+    this.maxAgeSeconds = options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+    this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
+    this.getKey = options.keyStore ?? jose.createRemoteJWKSet(new URL(options.jwksUrl ?? jwksUrlFor(baseUrl)), {
+      ...options.fetch ? { [jose.customFetch]: options.fetch } : {}
+    });
+  }
+  /**
+   * Verify a token against the body it is supposed to cover.
+   *
+   * @throws {CallbackVerificationError} always, when the callback cannot be trusted.
+   */
+  async verify(input) {
+    const token = input.token?.trim();
+    if (!token) {
+      throw new CallbackVerificationError("missing_signature", `no ${SIGNATURE_HEADER} header on the callback`);
+    }
+    let payload;
+    try {
+      ({ payload } = await jose.jwtVerify(token, this.getKey, {
+        issuer: this.issuer,
+        algorithms: ["EdDSA"],
+        maxTokenAge: this.maxAgeSeconds,
+        clockTolerance: this.clockToleranceSeconds
+      }));
+    } catch (error) {
+      throw new CallbackVerificationError("invalid_signature", `callback signature is not valid: ${describe2(error)}`, {
+        cause: error
+      });
+    }
+    const claims = toClaims(payload);
+    const actual = await sha256Hex(input.rawBody);
+    if (!timingSafeEqual(actual, claims.bodySha256)) {
+      throw new CallbackVerificationError(
+        "body_mismatch",
+        "callback body does not match the body_sha256 claim - pass the raw bytes you received, not re-serialized JSON"
+      );
+    }
+    return { claims, rawBody: toText(input.rawBody) };
+  }
+  /**
+   * Verify a fetch-API `Request` (Workers, Hono, Next.js route handlers, Deno, Bun).
+   *
+   * The body is read here, so do not read it yourself first - clone the request if you need it.
+   */
+  async verifyRequest(request) {
+    if (request.bodyUsed) {
+      throw new CallbackVerificationError(
+        "body_already_consumed",
+        "request body was already read - pass a request.clone() or use verify({ token, rawBody })"
+      );
+    }
+    return this.verify({ token: request.headers.get(SIGNATURE_HEADER), rawBody: await request.text() });
+  }
+  /**
+   * The plain version, for any framework: headers and the raw body in, the same raw body back out,
+   * or it throws. Handy when all you want is a guard at the top of a webhook handler.
+   *
+   * The body must be the raw bytes as they arrived - a parsed-and-re-serialized JSON body hashes
+   * differently and will be rejected. Use {@link verify} when you also want the claims.
+   */
+  async verifyWebhook(headers, rawBody) {
+    const { rawBody: body } = await this.verify({ token: readHeader(headers, SIGNATURE_HEADER), rawBody });
+    return body;
+  }
+};
+function jwksUrlFor(baseUrl) {
+  return new URL("/.well-known/jwks.json", baseUrl).toString();
+}
+function readHeader(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  const bag = headers;
+  const value = bag[name] ?? bag[name.toLowerCase()] ?? bag[name.toUpperCase()];
+  if (Array.isArray(value)) return value[0] ?? null;
+  return value ?? null;
+}
+function toClaims(payload) {
+  const routeId = payload.route_id;
+  const gateway = payload.gateway;
+  const bodySha256 = payload.body_sha256;
+  const externalId = payload.external_id;
+  if (typeof routeId !== "string" || typeof gateway !== "string" || typeof bodySha256 !== "string") {
+    throw new CallbackVerificationError("malformed_claims", "callback token is missing route_id, gateway or body_sha256");
+  }
+  if (typeof payload.iat !== "number" || typeof payload.exp !== "number") {
+    throw new CallbackVerificationError("malformed_claims", "callback token is missing iat or exp");
+  }
+  return {
+    routeId,
+    gateway,
+    externalId: typeof externalId === "string" ? externalId : null,
+    bodySha256,
+    issuer: payload.iss ?? "",
+    issuedAt: new Date(payload.iat * 1e3),
+    expiresAt: new Date(payload.exp * 1e3),
+    raw: payload
+  };
+}
+async function sha256Hex(data) {
+  const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new PaymentRouterValidationError("WebCrypto is unavailable - Node 18+, Workers, Deno and Bun all provide it");
+  }
+  const digest = await subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+function toText(body) {
+  return typeof body === "string" ? body : new TextDecoder().decode(body);
+}
+function describe2(error) {
+  if (error instanceof Error) return error.message;
+  return "unknown error";
+}
+function stripTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+
+// src/client.ts
+var DEFAULTS = {
+  timeoutMs: 1e4,
+  maxRetries: 2,
+  retryDelayMs: 200
+};
+var PaymentRouterClient = class {
+  baseUrl;
+  http;
+  verifierOptions;
+  cachedVerifier = null;
+  constructor(options = {}) {
+    this.baseUrl = stripTrailingSlash2(assertAbsoluteUrl(options.baseUrl ?? DEFAULT_BASE_URL, "baseUrl"));
+    this.verifierOptions = {
+      // The client's own fetch carries whatever a proxy in front of the router needs, and the
+      // JWKS lives on that same origin - so it fits the key fetch too, unless overridden.
+      ...options.fetch ? { fetch: options.fetch } : {},
+      ...options.verifier
+    };
+    this.http = {
+      baseUrl: this.baseUrl,
+      fetch: options.fetch ?? defaultFetch(),
+      timeoutMs: options.timeoutMs ?? DEFAULTS.timeoutMs,
+      maxRetries: options.maxRetries ?? DEFAULTS.maxRetries,
+      retryDelayMs: options.retryDelayMs ?? DEFAULTS.retryDelayMs,
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        ...options.headers
+      }
+    };
+  }
+  /**
+   * Register a webhook URL and get back the route whose `id` you send to the gateway as its
+   * external payment id.
+   *
+   * @throws {InvalidWebhookUrlError} the router refused the URL (not https, or a private host).
+   * @throws {RateLimitedError} the router's per-IP limit on route creation was hit.
+   */
+  async createRoute(input) {
+    const payload = {
+      webhookUrl: assertAbsoluteUrl(input.webhookUrl, "webhookUrl"),
+      ...input.externalId !== void 0 ? { externalId: assertExternalId(input.externalId) } : {},
+      ...input.expiresAt !== void 0 ? { expiresAt: toIsoString(input.expiresAt) } : {}
+    };
+    const route = await requestJson(this.http, "v1/routes", {
+      method: "POST",
+      body: JSON.stringify(payload)
+    });
+    return parseRoute(route);
+  }
+  /**
+   * The URL to paste into a gateway's dashboard as its single webhook URL. The same for every
+   * route, so it can be read off the client without creating one.
+   */
+  callbackUrl(gateway) {
+    return new URL(`webhooks/${encodeURIComponent(gateway)}`, `${this.baseUrl}/`).toString();
+  }
+  /** Where the router publishes the public keys that verify forwarded callbacks. */
+  get jwksUrl() {
+    return jwksUrlFor(this.baseUrl);
+  }
+  /**
+   * Headers and the raw body in, the same raw body back out - or it throws. The short way to guard
+   * a webhook handler: verifies the router's EdDSA JWT against its published keys, and checks that
+   * the body still hashes to what the token claims.
+   *
+   * The body must be the raw bytes as they arrived - parsed-and-re-serialized JSON hashes
+   * differently and will be rejected. Use {@link verifyCallback} when you also want the claims.
+   *
+   * @throws {CallbackVerificationError} when the callback cannot be trusted.
+   */
+  async verifyWebhook(headers, rawBody) {
+    return this.verifier().verifyWebhook(headers, rawBody);
+  }
+  /**
+   * Verify a fetch-API `Request` (Workers, Hono, Next.js, Deno, Bun) and get its claims back.
+   *
+   * The body is read here, so do not read it yourself first - clone the request if you need it.
+   */
+  async verifyRequest(request) {
+    return this.verifier().verifyRequest(request);
+  }
+  /** Verify a token against the body it covers, and get the claims back. */
+  async verifyCallback(input) {
+    return this.verifier().verify(input);
+  }
+  /**
+   * Built on first use and kept around: the verifier caches the router's key set, so reusing one
+   * client saves a JWKS fetch per callback.
+   */
+  verifier() {
+    this.cachedVerifier ??= new CallbackVerifier({ baseUrl: this.baseUrl, ...this.verifierOptions });
+    return this.cachedVerifier;
+  }
+};
+function parseRoute(raw) {
+  return {
+    id: raw.id,
+    webhookUrl: raw.webhookUrl,
+    externalId: raw.externalId ?? null,
+    expiresAt: raw.expiresAt ? new Date(raw.expiresAt) : null,
+    createdAt: new Date(raw.createdAt),
+    callbackUrls: raw.callbackUrls ?? null
+  };
+}
+function isRouteExpired(route, now = /* @__PURE__ */ new Date()) {
+  return route.expiresAt !== null && route.expiresAt.getTime() < now.getTime();
+}
+function callbackUrlFor(route, gateway) {
+  return route.callbackUrls?.[gateway] ?? null;
+}
+function assertAbsoluteUrl(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new PaymentRouterValidationError(`${field} must be an absolute URL, got "${value}"`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new PaymentRouterValidationError(`${field} must use http or https, got "${url.protocol}"`);
+  }
+  return value;
+}
+function assertExternalId(value) {
+  if (value.length === 0 || value.length > 256) {
+    throw new PaymentRouterValidationError("externalId must be between 1 and 256 characters");
+  }
+  return value;
+}
+function toIsoString(value) {
+  const date = value instanceof Date ? value : new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new PaymentRouterValidationError(`expiresAt is not a valid date: ${String(value)}`);
+  }
+  return date.toISOString();
+}
+function defaultFetch() {
+  if (typeof globalThis.fetch !== "function") {
+    throw new PaymentRouterValidationError(
+      "no global fetch available - pass one via the `fetch` option (Node 18+ has it built in)"
+    );
+  }
+  return globalThis.fetch.bind(globalThis);
+}
+function stripTrailingSlash2(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+
+// src/node.ts
+async function readRawBody(request) {
+  const chunks = [];
+  const encoder = new TextEncoder();
+  for await (const chunk of request) {
+    chunks.push(typeof chunk === "string" ? encoder.encode(chunk) : chunk);
+  }
+  const total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(body);
+}
+
+exports.CallbackVerificationError = CallbackVerificationError;
+exports.DEFAULT_BASE_URL = DEFAULT_BASE_URL;
+exports.EXTERNAL_ID_HEADER = EXTERNAL_ID_HEADER;
+exports.FORWARDED_HOST_HEADER = FORWARDED_HOST_HEADER;
+exports.GATEWAY_HEADER = GATEWAY_HEADER;
+exports.InvalidWebhookUrlError = InvalidWebhookUrlError;
+exports.PaymentRouterApiError = PaymentRouterApiError;
+exports.PaymentRouterClient = PaymentRouterClient;
+exports.PaymentRouterError = PaymentRouterError;
+exports.PaymentRouterNetworkError = PaymentRouterNetworkError;
+exports.PaymentRouterValidationError = PaymentRouterValidationError;
+exports.ROUTE_ID_HEADER = ROUTE_ID_HEADER;
+exports.RateLimitedError = RateLimitedError;
+exports.SIGNATURE_HEADER = SIGNATURE_HEADER;
+exports.callbackUrlFor = callbackUrlFor;
+exports.isRouteExpired = isRouteExpired;
+exports.jwksUrlFor = jwksUrlFor;
+exports.parseRoute = parseRoute;
+exports.readHeader = readHeader;
+exports.readRawBody = readRawBody;
+exports.sha256Hex = sha256Hex;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map