@fragmentpay/server 0.3.0

package/dist/index.js

@@ -0,0 +1,476 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  Frag: () => Frag,
+  FragError: () => FragError,
+  FragValidationError: () => FragValidationError,
+  FragmentPay: () => FragmentPay,
+  verifyWebhook: () => verifyWebhook
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/validate.ts
+var FragValidationError = class extends Error {
+  path;
+  constructor(path, message) {
+    super(`[frag] ${path}: ${message}`);
+    this.name = "FragValidationError";
+    this.path = path;
+  }
+};
+var fail = (path, msg) => {
+  throw new FragValidationError(path, msg);
+};
+var v = {
+  str(path, val, opts = {}) {
+    if (typeof val !== "string") return fail(path, `expected string, got ${typeof val}`);
+    if (opts.min != null && val.length < opts.min) fail(path, `min length ${opts.min}`);
+    if (opts.max != null && val.length > opts.max) fail(path, `max length ${opts.max}`);
+    if (opts.pattern && !opts.pattern.test(val)) fail(path, `does not match ${opts.pattern}`);
+    return val;
+  },
+  optStr(path, val, opts) {
+    if (val === void 0 || val === null) return void 0;
+    return v.str(path, val, opts);
+  },
+  num(path, val, opts = {}) {
+    const n = typeof val === "string" ? Number(val) : val;
+    if (typeof n !== "number" || !Number.isFinite(n)) return fail(path, `expected finite number, got ${JSON.stringify(val)}`);
+    if (opts.int && !Number.isInteger(n)) fail(path, "expected integer");
+    if (opts.min != null && n < opts.min) fail(path, `min ${opts.min}`);
+    if (opts.max != null && n > opts.max) fail(path, `max ${opts.max}`);
+    return n;
+  },
+  optNum(path, val, opts) {
+    if (val === void 0 || val === null) return void 0;
+    return v.num(path, val, opts);
+  },
+  enum(path, val, allowed) {
+    if (typeof val !== "string" || !allowed.includes(val)) {
+      return fail(path, `expected one of ${allowed.join("|")}`);
+    }
+    return val;
+  },
+  optEnum(path, val, allowed) {
+    if (val === void 0 || val === null) return void 0;
+    return v.enum(path, val, allowed);
+  },
+  obj(path, val) {
+    if (!val || typeof val !== "object" || Array.isArray(val)) return fail(path, "expected object");
+    return val;
+  },
+  id(path, val) {
+    return v.str(path, val, { min: 3, max: 128, pattern: /^[A-Za-z0-9_-]+$/ });
+  },
+  url(path, val) {
+    const s = v.str(path, val, { min: 1, max: 2048 });
+    try {
+      new URL(s);
+    } catch {
+      fail(path, "must be an absolute URL");
+    }
+    return s;
+  },
+  email(path, val) {
+    return v.str(path, val, { max: 254, pattern: /^[^\s@]+@[^\s@]+\.[^\s@]+$/ });
+  }
+};
+var CHAINS = ["solana", "ethereum", "base", "arbitrum", "optimism", "polygon", "bnb"];
+var INTENT_STATUSES = [
+  "created",
+  "requires_payment",
+  "quoted",
+  "awaiting_signature",
+  "executing",
+  "partially_filled",
+  "settled",
+  "failed",
+  "expired",
+  "cancelled",
+  "refunded"
+];
+var PAYOUT_STATUSES = ["queued", "pending", "paid", "failed", "paused"];
+var WEBHOOK_EVENTS = [
+  "payment_intent.created",
+  "payment_intent.quoted",
+  "payment_intent.executing",
+  "payment_intent.executed",
+  "payment_intent.settled",
+  "payment_intent.failed",
+  "payment_intent.expired",
+  "payment_intent.cancelled",
+  "payment_intent.refunded",
+  "quote.created",
+  "settlement.confirmed",
+  "payout.pending",
+  "payout.paid",
+  "payout.failed",
+  "refund.pending",
+  "refund.paid",
+  "refund.failed"
+];
+
+// src/index.ts
+var FragError = class extends Error {
+  status;
+  code;
+  requestId;
+  raw;
+  constructor(status, code, message, raw, requestId) {
+    super(message);
+    this.name = "FragError";
+    this.status = status;
+    this.code = code;
+    this.raw = raw;
+    this.requestId = requestId;
+  }
+};
+var FragmentPay = class {
+  paymentIntents;
+  refunds;
+  payouts;
+  webhookEndpoints;
+  webhooks;
+  tokens;
+  #opts;
+  constructor(opts) {
+    if (!opts || typeof opts !== "object") {
+      throw new FragValidationError("options", "expected FragOptions object");
+    }
+    if (typeof opts.apiKey !== "string" || !/^sk_(test|live)_[A-Za-z0-9_-]{8,}$/.test(opts.apiKey)) {
+      throw new FragValidationError("options.apiKey", "must match sk_test_\u2026 or sk_live_\u2026 (min 8 chars after prefix)");
+    }
+    if (opts.baseUrl !== void 0) v.url("options.baseUrl", opts.baseUrl);
+    if (opts.timeout !== void 0) v.num("options.timeout", opts.timeout, { min: 0, max: 6e5, int: true });
+    if (opts.retries !== void 0) v.num("options.retries", opts.retries, { min: 0, max: 10, int: true });
+    this.#opts = {
+      apiKey: opts.apiKey,
+      baseUrl: (opts.baseUrl ?? "https://api.frag.dev").replace(/\/$/, ""),
+      fetch: opts.fetch ?? globalThis.fetch.bind(globalThis),
+      timeout: opts.timeout ?? 3e4,
+      retries: opts.retries ?? 2,
+      debug: opts.debug ?? false
+    };
+    const req = ((path, init) => this.#req(path, init));
+    this.paymentIntents = new PaymentIntentResource(req);
+    this.refunds = new RefundResource(req);
+    this.payouts = new PayoutResource(req);
+    this.webhookEndpoints = new WebhookEndpointResource(req);
+    this.tokens = new TokenResource(req);
+    this.webhooks = new WebhookHelpers();
+  }
+  setDebug(on) {
+    this.#opts.debug = on;
+  }
+  async #req(path, init = {}) {
+    const query = init.query ? "?" + new URLSearchParams(
+      Object.entries(init.query).filter(([, v2]) => v2 !== void 0 && v2 !== null && v2 !== "").map(([k, v2]) => [k, String(v2)])
+    ).toString() : "";
+    const url = `${this.#opts.baseUrl}${path}${query}`;
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${this.#opts.apiKey}`);
+    if (init.body && !headers.has("content-type")) headers.set("content-type", "application/json");
+    if (init.idempotencyKey) headers.set("idempotency-key", init.idempotencyKey);
+    const maxAttempts = Math.max(1, this.#opts.retries + 1);
+    let lastErr;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      const ctrl = this.#opts.timeout ? new AbortController() : null;
+      const to = ctrl ? setTimeout(() => ctrl.abort(), this.#opts.timeout) : null;
+      try {
+        if (this.#opts.debug) {
+          console.debug(`[frag] ${init.method ?? "GET"} ${url} attempt=${attempt}`);
+        }
+        const res = await this.#opts.fetch(url, {
+          ...init,
+          headers,
+          signal: ctrl?.signal ?? init.signal
+        });
+        const text = await res.text();
+        let body = null;
+        try {
+          body = text ? JSON.parse(text) : null;
+        } catch {
+          body = text;
+        }
+        if (res.ok) return body;
+        const retryable = res.status === 429 || res.status >= 500;
+        if (retryable && attempt < maxAttempts) {
+          const retryAfter = Number(res.headers.get("retry-after"));
+          const backoff = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1e3 : Math.min(2e3 * 2 ** (attempt - 1), 1e4) + Math.random() * 250;
+          await sleep(backoff);
+          continue;
+        }
+        const b = body ?? {};
+        throw new FragError(
+          res.status,
+          b.code ?? `http_${res.status}`,
+          b.error ?? res.statusText,
+          body,
+          res.headers.get("x-request-id") ?? void 0
+        );
+      } catch (e) {
+        lastErr = e;
+        if (e instanceof FragError) throw e;
+        if (attempt < maxAttempts) {
+          await sleep(500 * attempt + Math.random() * 200);
+          continue;
+        }
+        throw e;
+      } finally {
+        if (to) clearTimeout(to);
+      }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error("frag request failed");
+  }
+};
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+var PaymentIntentResource = class {
+  constructor(req) {
+    this.req = req;
+  }
+  req;
+  create(input) {
+    if (!input || typeof input !== "object") throw new FragValidationError("createIntent", "expected object");
+    const amount = v.num("createIntent.amount", input.amount, { min: 0.01, max: 1e7 });
+    const currency = v.optStr("createIntent.currency", input.currency, { min: 3, max: 8, pattern: /^[A-Z]{3,8}$/ }) ?? "USD";
+    if (input.settlement !== void 0) v.obj("createIntent.settlement", input.settlement);
+    const settlementChain = input.settlement?.chain ? v.enum("createIntent.settlement.chain", input.settlement.chain, CHAINS) : void 0;
+    const settlementToken = v.optStr("createIntent.settlement.token", input.settlement?.token, { min: 1, max: 64 });
+    const settlementAddress = v.optStr("createIntent.settlement.address", input.settlement?.address, { min: 26, max: 128 });
+    const customerEmail = input.customerEmail !== void 0 ? v.email("createIntent.customerEmail", input.customerEmail) : void 0;
+    const expiresInSeconds = v.optNum("createIntent.expiresInSeconds", input.expiresInSeconds, { min: 60, max: 86400, int: true });
+    const idempotencyKey = v.optStr("createIntent.idempotencyKey", input.idempotencyKey, { min: 8, max: 128 });
+    const successUrl = input.successUrl !== void 0 ? v.url("createIntent.successUrl", input.successUrl) : void 0;
+    const cancelUrl = input.cancelUrl !== void 0 ? v.url("createIntent.cancelUrl", input.cancelUrl) : void 0;
+    if (input.metadata !== void 0) v.obj("createIntent.metadata", input.metadata);
+    return this.req("/api/public/v1/payment-intents", {
+      method: "POST",
+      body: JSON.stringify({
+        amount,
+        currency,
+        settlement_chain: settlementChain,
+        settlement_token: settlementToken,
+        settlement_address: settlementAddress,
+        customer_email: customerEmail,
+        expires_in_seconds: expiresInSeconds,
+        metadata: {
+          ...input.metadata ?? {},
+          ...successUrl ? { success_url: successUrl } : {},
+          ...cancelUrl ? { cancel_url: cancelUrl } : {}
+        }
+      }),
+      idempotencyKey
+    });
+  }
+  retrieve(id) {
+    v.id("paymentIntents.retrieve.id", id);
+    return this.req(`/api/public/v1/payment-intents/${encodeURIComponent(id)}`);
+  }
+  list(params = {}) {
+    const limit = v.optNum("list.limit", params.limit, { min: 1, max: 100, int: true });
+    const status = v.optEnum("list.status", params.status, INTENT_STATUSES);
+    return this.req(`/api/public/v1/payment-intents`, { query: { limit, status } });
+  }
+  cancel(id) {
+    v.id("paymentIntents.cancel.id", id);
+    return this.req(`/api/public/v1/payment-intents/${encodeURIComponent(id)}/cancel`, { method: "POST" });
+  }
+  transactions(id) {
+    v.id("paymentIntents.transactions.id", id);
+    return this.req(`/api/public/v1/payment-intents/${encodeURIComponent(id)}/transactions`);
+  }
+  route(id) {
+    v.id("paymentIntents.route.id", id);
+    return this.req(`/api/public/v1/payment-intents/${encodeURIComponent(id)}/route`);
+  }
+};
+var RefundResource = class {
+  constructor(req) {
+    this.req = req;
+  }
+  req;
+  create(input) {
+    if (!input || typeof input !== "object") throw new FragValidationError("refunds.create", "expected object");
+    v.id("refunds.create.paymentIntentId", input.paymentIntentId);
+    v.num("refunds.create.amountUsd", input.amountUsd, { min: 0.01, max: 1e7 });
+    v.str("refunds.create.destination", input.destination, { min: 26, max: 128 });
+    v.optStr("refunds.create.reason", input.reason, { max: 500 });
+    v.optStr("refunds.create.idempotencyKey", input.idempotencyKey, { min: 8, max: 128 });
+    return this.req("/api/public/v1/refunds", {
+      method: "POST",
+      body: JSON.stringify({
+        intent_id: input.paymentIntentId,
+        amount_usd: input.amountUsd,
+        destination: input.destination,
+        reason: input.reason
+      }),
+      idempotencyKey: input.idempotencyKey
+    });
+  }
+  retrieve(id) {
+    v.id("refunds.retrieve.id", id);
+    return this.req(`/api/public/v1/refunds/${encodeURIComponent(id)}`);
+  }
+  list(params = {}) {
+    if (params.paymentIntentId !== void 0) v.id("refunds.list.paymentIntentId", params.paymentIntentId);
+    v.optNum("refunds.list.limit", params.limit, { min: 1, max: 100, int: true });
+    return this.req(`/api/public/v1/refunds`, {
+      query: { payment_intent_id: params.paymentIntentId, limit: params.limit }
+    });
+  }
+};
+var PayoutResource = class {
+  constructor(req) {
+    this.req = req;
+  }
+  req;
+  retrieve(id) {
+    v.id("payouts.retrieve.id", id);
+    return this.req(`/api/public/v1/payouts/${encodeURIComponent(id)}`);
+  }
+  list(params = {}) {
+    v.optEnum("payouts.list.status", params.status, PAYOUT_STATUSES);
+    if (params.paymentIntentId !== void 0) v.id("payouts.list.paymentIntentId", params.paymentIntentId);
+    v.optNum("payouts.list.limit", params.limit, { min: 1, max: 100, int: true });
+    return this.req(`/api/public/v1/payouts`, {
+      query: { status: params.status, payment_intent_id: params.paymentIntentId, limit: params.limit }
+    });
+  }
+  replay(id) {
+    v.id("payouts.replay.id", id);
+    return this.req(`/api/public/v1/payouts/${encodeURIComponent(id)}/replay`, { method: "POST" });
+  }
+};
+var WebhookEndpointResource = class {
+  constructor(req) {
+    this.req = req;
+  }
+  req;
+  create(input) {
+    if (!input || typeof input !== "object") throw new FragValidationError("webhookEndpoints.create", "expected object");
+    v.url("webhookEndpoints.create.url", input.url);
+    if (!Array.isArray(input.events) || input.events.length === 0) {
+      throw new FragValidationError("webhookEndpoints.create.events", "at least one event required");
+    }
+    input.events.forEach((e, i) => v.enum(`webhookEndpoints.create.events[${i}]`, e, WEBHOOK_EVENTS));
+    return this.req("/api/public/v1/webhook-endpoints", {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  list() {
+    return this.req(`/api/public/v1/webhook-endpoints`);
+  }
+  retrieve(id) {
+    v.id("webhookEndpoints.retrieve.id", id);
+    return this.req(`/api/public/v1/webhook-endpoints/${encodeURIComponent(id)}`);
+  }
+  update(id, patch) {
+    v.id("webhookEndpoints.update.id", id);
+    if (patch.url !== void 0) v.url("webhookEndpoints.update.url", patch.url);
+    if (patch.events !== void 0) {
+      if (!Array.isArray(patch.events)) throw new FragValidationError("webhookEndpoints.update.events", "expected array");
+      patch.events.forEach((e, i) => v.enum(`webhookEndpoints.update.events[${i}]`, e, WEBHOOK_EVENTS));
+    }
+    return this.req(`/api/public/v1/webhook-endpoints/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: JSON.stringify(patch)
+    });
+  }
+  delete(id) {
+    v.id("webhookEndpoints.delete.id", id);
+    return this.req(`/api/public/v1/webhook-endpoints/${encodeURIComponent(id)}`, { method: "DELETE" });
+  }
+  rotateSecret(id) {
+    v.id("webhookEndpoints.rotateSecret.id", id);
+    return this.req(`/api/public/v1/webhook-endpoints/${encodeURIComponent(id)}/rotate-secret`, { method: "POST" });
+  }
+};
+var TokenResource = class {
+  constructor(req) {
+    this.req = req;
+  }
+  req;
+  list(params = {}) {
+    if (params.chain !== void 0) v.enum("tokens.list.chain", params.chain, CHAINS);
+    return this.req(`/api/public/v1/tokens`, { query: { chain: params.chain } });
+  }
+};
+var WebhookHelpers = class {
+  async verify(payload, header, secret, tolerance = 300) {
+    if (!header) return false;
+    const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
+    const t = Number(parts.t);
+    const sig = parts.v1;
+    if (!t || !sig) return false;
+    const skew = Math.abs(Math.floor(Date.now() / 1e3) - t);
+    if (skew > tolerance) return false;
+    const expected = await hmacHex(secret, `${t}.${payload}`);
+    return timingSafeEqualHex(expected, sig);
+  }
+  parse(payload) {
+    return JSON.parse(payload);
+  }
+};
+async function verifyWebhook(input) {
+  if (!input || typeof input !== "object") throw new FragValidationError("verifyWebhook", "expected object");
+  v.str("verifyWebhook.payload", input.payload, { min: 1 });
+  v.str("verifyWebhook.secret", input.secret, { min: 8 });
+  if (input.tolerance !== void 0) v.num("verifyWebhook.tolerance", input.tolerance, { min: 0, max: 3600, int: true });
+  const helper = new WebhookHelpers();
+  const ok = await helper.verify(input.payload, input.signature ?? null, input.secret, input.tolerance);
+  if (!ok) throw new FragError(401, "invalid_signature", "webhook signature verification failed", null);
+  return helper.parse(input.payload);
+}
+var Frag = class extends FragmentPay {
+  constructor(opts) {
+    const apiKey = "secretKey" in opts ? opts.secretKey : opts.apiKey;
+    super({ apiKey, baseUrl: opts.baseUrl, fetch: opts.fetch, timeout: opts.timeout, retries: opts.retries, debug: opts.debug });
+  }
+};
+async function hmacHex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return mismatch === 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Frag,
+  FragError,
+  FragValidationError,
+  FragmentPay,
+  verifyWebhook
+});