@h-ai/payment 0.1.0-alpha.67 → 0.1.0-alpha.69

package/dist/client/index.js

@@ -1,87 +1,88 @@
-import { HaiPaymentError, paymentM } from '../chunk-4IUARFWH.js';
-import { err, ok } from '@h-ai/core';
+import { HaiPaymentError, paymentM } from '../chunk-YQD4KPT5.js';
+import { ok, err } from '@h-ai/core';
 
+function requireStrings(params, fields) {
+  if (fields.some((field) => typeof params[field] !== "string" || !params[field].trim()))
+    throw new Error("Invalid payment client parameters");
+}
 function invokeWechatJsapi(clientParams) {
+  requireStrings(clientParams, ["appId", "timeStamp", "nonceStr", "package", "signType", "paySign"]);
+  if (clientParams.signType !== "RSA" || !/^prepay_id=.+$/.test(String(clientParams.package)) || !/^\d+$/.test(String(clientParams.timeStamp))) {
+    throw new Error("Invalid Wechat JSAPI parameters");
+  }
+  const bridge = window.WeixinJSBridge;
+  if (typeof bridge?.invoke !== "function")
+    return Promise.resolve({ invoked: false, message: paymentM("payment_wechatBridgeUnavailable") });
   return new Promise((resolve) => {
-    const WeixinJSBridge = window.WeixinJSBridge;
-    if (!WeixinJSBridge) {
-      resolve({ invoked: false, message: "WeixinJSBridge not available" });
-      return;
-    }
-    WeixinJSBridge.invoke("getBrandWCPayRequest", clientParams, (res) => {
-      resolve({
-        invoked: true,
-        message: res.err_msg
-      });
+    bridge.invoke("getBrandWCPayRequest", clientParams, (response) => {
+      resolve({ invoked: true, message: response.err_msg });
     });
   });
 }
-function invokeWechatH5(clientParams) {
-  const h5Url = clientParams.h5Url;
-  if (h5Url) {
-    window.location.href = h5Url;
-    return { invoked: true };
-  }
-  return { invoked: false, message: "Missing h5Url" };
-}
 function invokeAlipayH5(clientParams) {
-  const formHtml = clientParams.form;
-  const payUrl = clientParams.pay_url;
-  if (formHtml) {
-    const parser = new DOMParser();
-    const doc = parser.parseFromString(formHtml, "text/html");
-    const form = doc.querySelector("form");
-    if (form) {
-      document.body.appendChild(document.adoptNode(form));
-      form.submit();
-      return { invoked: true };
-    }
-    return { invoked: false, message: "No form element found in response" };
+  const { gateway, fields } = clientParams;
+  if (gateway !== "https://openapi.alipay.com/gateway.do" && gateway !== "https://openapi-sandbox.dl.alipaydev.com/gateway.do" || Object.keys(clientParams).some((key) => key !== "gateway" && key !== "fields") || typeof fields !== "object" || fields === null || Array.isArray(fields)) {
+    throw new Error("Invalid Alipay page parameters");
   }
-  if (payUrl) {
-    window.location.href = payUrl;
+  const required = ["app_id", "method", "format", "charset", "sign_type", "timestamp", "version", "notify_url", "return_url", "biz_content", "sign"];
+  const entries = [];
+  for (const [key, value] of Object.entries(fields)) {
+    if (!required.includes(key) || typeof value !== "string" || !value.trim())
+      throw new Error("Invalid Alipay form fields");
+    entries.push([key, value]);
+  }
+  if (entries.length !== required.length)
+    throw new Error("Invalid Alipay form fields");
+  const params = Object.fromEntries(entries);
+  if (params.method !== "alipay.trade.wap.pay" || params.format !== "JSON" || params.charset !== "utf-8" || params.version !== "1.0" || params.sign_type !== "RSA2" && params.sign_type !== "RSA") {
+    throw new Error("Invalid Alipay form method");
+  }
+  const form = document.createElement("form");
+  form.action = gateway;
+  form.method = "POST";
+  form.acceptCharset = "utf-8";
+  for (const [key, value] of entries) {
+    const input = document.createElement("input");
+    input.type = "hidden";
+    input.name = key;
+    input.value = value;
+    form.appendChild(input);
+  }
+  document.body.appendChild(form);
+  try {
+    form.submit();
     return { invoked: true };
+  } finally {
+    form.remove();
   }
-  return { invoked: false, message: "Missing alipay form or pay_url" };
 }
 function invokeStripeCheckout(clientParams) {
-  const checkoutUrl = clientParams.checkoutUrl;
-  if (checkoutUrl) {
-    window.location.href = checkoutUrl;
-    return { invoked: true };
-  }
-  return { invoked: false, message: "Missing checkoutUrl" };
+  requireStrings(clientParams, ["checkoutUrl"]);
+  const checkoutUrl = new URL(String(clientParams.checkoutUrl));
+  if (checkoutUrl.protocol !== "https:" || checkoutUrl.username || checkoutUrl.password)
+    throw new Error("Invalid Stripe Checkout URL");
+  window.location.href = checkoutUrl.href;
+  return { invoked: true };
 }
 async function invokePayment(order) {
   try {
-    let result;
     switch (order.provider) {
       case "wechat":
-        if (order.tradeType === "jsapi") {
-          result = await invokeWechatJsapi(order.clientParams);
-        } else {
-          result = invokeWechatH5(order.clientParams);
-        }
+        if (order.tradeType === "jsapi")
+          return ok(await invokeWechatJsapi(order.clientParams));
         break;
       case "alipay":
-        result = invokeAlipayH5(order.clientParams);
+        if (order.tradeType === "h5")
+          return ok(invokeAlipayH5(order.clientParams));
         break;
       case "stripe":
-        result = invokeStripeCheckout(order.clientParams);
+        if (order.tradeType === "h5")
+          return ok(invokeStripeCheckout(order.clientParams));
         break;
-      default:
-        return err(
-          HaiPaymentError.INVOKE_WEB_FAILED,
-          paymentM("payment_invokeWebFailed")
-        );
     }
-    return ok(result);
+    return err(HaiPaymentError.UNSUPPORTED_TRADE_TYPE, paymentM("payment_unsupportedTradeType"));
   } catch (cause) {
-    return err(
-      HaiPaymentError.INVOKE_WEB_FAILED,
-      paymentM("payment_invokeWebFailed"),
-      cause
-    );
+    return err(HaiPaymentError.INVOKE_WEB_FAILED, paymentM("payment_invokeWebFailed"), cause);
   }
 }
 

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/payment-client-web.ts"],"names":[],"mappings":";;;AAmBA,SAAS,kBAAkB,YAAA,EAAqE;AAC9F,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,MAAM,iBAAkB,MAAA,CAA8C,cAAA;AAItE,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,OAAA,CAAQ,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,gCAAgC,CAAA;AACnE,MAAA;AAAA,IACF;AAEA,IAAA,cAAA,CAAe,MAAA,CAAO,sBAAA,EAAwB,YAAA,EAAc,CAAC,GAAA,KAAQ;AACnE,MAAA,OAAA,CAAQ;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,SAAS,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAOA,SAAS,eAAe,YAAA,EAA4D;AAClF,EAAA,MAAM,QAAQ,YAAA,CAAa,KAAA;AAC3B,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAA,CAAO,SAAS,IAAA,GAAO,KAAA;AACvB,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,eAAA,EAAgB;AACpD;AAKA,SAAS,eAAe,YAAA,EAA4D;AAClF,EAAA,MAAM,WAAW,YAAA,CAAa,IAAA;AAC9B,EAAA,MAAM,SAAS,YAAA,CAAa,OAAA;AAE5B,EAAA,IAAI,QAAA,EAAU;AAEZ,IAAA,MAAM,MAAA,GAAS,IAAI,SAAA,EAAU;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,eAAA,CAAgB,QAAA,EAAU,WAAW,CAAA;AACxD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,aAAA,CAAc,MAAM,CAAA;AACrC,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,QAAA,CAAS,IAAA,CAAK,WAAA,CAAY,QAAA,CAAS,SAAA,CAAU,IAAI,CAAC,CAAA;AAClD,MAAA,IAAA,CAAK,MAAA,EAAO;AACZ,MAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,IACzB;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,mCAAA,EAAoC;AAAA,EACxE;AAEA,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAA,CAAO,SAAS,IAAA,GAAO,MAAA;AACvB,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,gCAAA,EAAiC;AACrE;AAKA,SAAS,qBAAqB,YAAA,EAA4D;AACxF,EAAA,MAAM,cAAc,YAAA,CAAa,WAAA;AACjC,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAA,CAAO,SAAS,IAAA,GAAO,WAAA;AACvB,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,OAAA,EAAS,qBAAA,EAAsB;AAC1D;AAoBA,eAAsB,cAAc,KAAA,EAA8D;AAChG,EAAA,IAAI;AACF,IAAA,IAAI,MAAA;AAEJ,IAAA,QAAQ,MAAM,QAAA;AAAU,MACtB,KAAK,QAAA;AACH,QAAA,IAAI,KAAA,CAAM,cAAc,OAAA,EAAS;AAC/B,UAAA,MAAA,GAAS,MAAM,iBAAA,CAAkB,KAAA,CAAM,YAAY,CAAA;AAAA,QACrD,CAAA,MACK;AACH,UAAA,MAAA,GAAS,cAAA,CAAe,MAAM,YAAY,CAAA;AAAA,QAC5C;AACA,QAAA;AAAA,MACF,KAAK,QAAA;AACH,QAAA,MAAA,GAAS,cAAA,CAAe,MAAM,YAAY,CAAA;AAC1C,QAAA;AAAA,MACF,KAAK,QAAA;AACH,QAAA,MAAA,GAAS,oBAAA,CAAqB,MAAM,YAAY,CAAA;AAChD,QAAA;AAAA,MACF;AACE,QAAA,OAAO,GAAA;AAAA,UACL,eAAA,CAAgB,iBAAA;AAAA,UAChB,SAAS,yBAAyB;AAAA,SACpC;AAAA;AAGJ,IAAA,OAAO,GAAG,MAAM,CAAA;AAAA,EAClB,SACO,KAAA,EAAO;AACZ,IAAA,OAAO,GAAA;AAAA,MACL,eAAA,CAAgB,iBAAA;AAAA,MAChB,SAAS,yBAAyB,CAAA;AAAA,MAClC;AAAA,KACF;AAAA,EACF;AACF","file":"index.js","sourcesContent":["/**\n * @h-ai/payment/client — Web/H5 支付调起\n *\n * 在浏览器或 H5 环境中调起微信/支付宝支付。\n * @module payment-client-web\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { PaymentOrder } from '../payment-types.js'\nimport type { InvokePaymentResult } from './payment-client-types.js'\nimport { err, ok } from '@h-ai/core'\nimport { paymentM } from '../payment-i18n.js'\nimport { HaiPaymentError } from '../payment-types.js'\n\n/**\n * Web/H5 环境调起微信支付（JSAPI）\n *\n * 需要在微信内置浏览器中使用，依赖 WeixinJSBridge。\n */\nfunction invokeWechatJsapi(clientParams: Record<string, unknown>): Promise<InvokePaymentResult> {\n  return new Promise((resolve) => {\n    const WeixinJSBridge = (window as unknown as Record<string, unknown>).WeixinJSBridge as {\n      invoke: (api: string, params: unknown, callback: (res: { err_msg: string }) => void) => void\n    } | undefined\n\n    if (!WeixinJSBridge) {\n      resolve({ invoked: false, message: 'WeixinJSBridge not available' })\n      return\n    }\n\n    WeixinJSBridge.invoke('getBrandWCPayRequest', clientParams, (res) => {\n      resolve({\n        invoked: true,\n        message: res.err_msg,\n      })\n    })\n  })\n}\n\n/**\n * Web/H5 环境调起微信 H5 支付\n *\n * 通过跳转 URL 唤起微信客户端支付。\n */\nfunction invokeWechatH5(clientParams: Record<string, unknown>): InvokePaymentResult {\n  const h5Url = clientParams.h5Url as string | undefined\n  if (h5Url) {\n    window.location.href = h5Url\n    return { invoked: true }\n  }\n  return { invoked: false, message: 'Missing h5Url' }\n}\n\n/**\n * Web 环境调起支付宝（H5 跳转）\n */\nfunction invokeAlipayH5(clientParams: Record<string, unknown>): InvokePaymentResult {\n  const formHtml = clientParams.form as string | undefined\n  const payUrl = clientParams.pay_url as string | undefined\n\n  if (formHtml) {\n    // 支付宝返回的 HTML form，使用 DOMParser 安全解析后提交\n    const parser = new DOMParser()\n    const doc = parser.parseFromString(formHtml, 'text/html')\n    const form = doc.querySelector('form')\n    if (form) {\n      document.body.appendChild(document.adoptNode(form))\n      form.submit()\n      return { invoked: true }\n    }\n    return { invoked: false, message: 'No form element found in response' }\n  }\n\n  if (payUrl) {\n    window.location.href = payUrl\n    return { invoked: true }\n  }\n\n  return { invoked: false, message: 'Missing alipay form or pay_url' }\n}\n\n/**\n * Web 环境调起 Stripe Checkout\n */\nfunction invokeStripeCheckout(clientParams: Record<string, unknown>): InvokePaymentResult {\n  const checkoutUrl = clientParams.checkoutUrl as string | undefined\n  if (checkoutUrl) {\n    window.location.href = checkoutUrl\n    return { invoked: true }\n  }\n  return { invoked: false, message: 'Missing checkoutUrl' }\n}\n\n/**\n * 调起支付（Web / H5 通用入口）\n *\n * 根据 PaymentOrder 中的 provider 和 tradeType 自动选择调起方式。\n *\n * @param order - 后端返回的支付订单\n * @returns 调起结果\n *\n * @example\n * ```ts\n * import { invokePayment } from '@h-ai/payment/client'\n *\n * const orderResult = await api.payment.orders.create({ ... })\n * if (orderResult.success) {\n *   const result = await invokePayment(orderResult.data)\n * }\n * ```\n */\nexport async function invokePayment(order: PaymentOrder): Promise<HaiResult<InvokePaymentResult>> {\n  try {\n    let result: InvokePaymentResult\n\n    switch (order.provider) {\n      case 'wechat':\n        if (order.tradeType === 'jsapi') {\n          result = await invokeWechatJsapi(order.clientParams)\n        }\n        else {\n          result = invokeWechatH5(order.clientParams)\n        }\n        break\n      case 'alipay':\n        result = invokeAlipayH5(order.clientParams)\n        break\n      case 'stripe':\n        result = invokeStripeCheckout(order.clientParams)\n        break\n      default:\n        return err(\n          HaiPaymentError.INVOKE_WEB_FAILED,\n          paymentM('payment_invokeWebFailed'),\n        )\n    }\n\n    return ok(result)\n  }\n  catch (cause) {\n    return err(\n      HaiPaymentError.INVOKE_WEB_FAILED,\n      paymentM('payment_invokeWebFailed'),\n      cause,\n    )\n  }\n}\n"]}
+{"version":3,"sources":["../../src/client/payment-client-web.ts"],"names":[],"mappings":";;;AA+BA,SAAS,cAAA,CAAe,QAAiC,MAAA,EAAiC;AACxF,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,CAAA,KAAA,KAAS,OAAO,MAAA,CAAO,KAAK,CAAA,KAAM,QAAA,IAAY,CAAC,MAAA,CAAO,KAAK,CAAA,CAAE,MAAM,CAAA;AACjF,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACvD;AAGA,SAAS,kBAAkB,YAAA,EAAqE;AAC9F,EAAA,cAAA,CAAe,YAAA,EAAc,CAAC,OAAA,EAAS,WAAA,EAAa,YAAY,SAAA,EAAW,UAAA,EAAY,SAAS,CAAC,CAAA;AACjG,EAAA,IAAI,aAAa,QAAA,KAAa,KAAA,IAAS,CAAC,gBAAA,CAAiB,IAAA,CAAK,OAAO,YAAA,CAAa,OAAO,CAAC,CAAA,IACrF,CAAC,OAAA,CAAQ,IAAA,CAAK,OAAO,YAAA,CAAa,SAAS,CAAC,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AACA,EAAA,MAAM,SAAU,MAAA,CAA6D,cAAA;AAC7E,EAAA,IAAI,OAAO,QAAQ,MAAA,KAAW,UAAA;AAC5B,IAAA,OAAO,OAAA,CAAQ,QAAQ,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,QAAA,CAAS,iCAAiC,CAAA,EAAG,CAAA;AACjG,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,sBAAA,EAAwB,YAAA,EAAc,CAAC,QAAA,KAAa;AAChE,MAAA,OAAA,CAAQ,EAAE,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,QAAA,CAAS,SAAS,CAAA;AAAA,IACtD,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAGA,SAAS,eAAe,YAAA,EAA4D;AAClF,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAO,GAAI,YAAA;AAC5B,EAAA,IAAK,OAAA,KAAY,2CACZ,OAAA,KAAY,qDAAA,IACd,OAAO,IAAA,CAAK,YAAY,CAAA,CAAE,IAAA,CAAK,CAAA,GAAA,KAAO,GAAA,KAAQ,aAAa,GAAA,KAAQ,QAAQ,CAAA,IAC3E,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,IAAA,IAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzE,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,QAAA,GAAW,CAAC,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,SAAA,EAAW,WAAA,EAAa,WAAA,EAAa,SAAA,EAAW,YAAA,EAAc,YAAA,EAAc,aAAA,EAAe,MAAM,CAAA;AACjJ,EAAA,MAAM,UAAmC,EAAC;AAC1C,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAA+B;AAC7E,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,IAAK,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,EAAK;AACtE,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAC9C,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,GAAA,EAAK,KAAK,CAAC,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,OAAA,CAAQ,WAAW,QAAA,CAAS,MAAA;AAC9B,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAC9C,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,WAAA,CAAY,OAAO,CAAA;AACzC,EAAA,IAAI,OAAO,MAAA,KAAW,sBAAA,IAA0B,MAAA,CAAO,MAAA,KAAW,UAAU,MAAA,CAAO,OAAA,KAAY,OAAA,IAAW,MAAA,CAAO,YAAY,KAAA,IACvH,MAAA,CAAO,cAAc,MAAA,IAAU,MAAA,CAAO,cAAc,KAAA,EAAQ;AAChE,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,aAAA,CAAc,MAAM,CAAA;AAC1C,EAAA,IAAA,CAAK,MAAA,GAAS,OAAA;AACd,EAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,EAAA,IAAA,CAAK,aAAA,GAAgB,OAAA;AACrB,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,OAAA,EAAS;AAClC,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,aAAA,CAAc,OAAO,CAAA;AAC5C,IAAA,KAAA,CAAM,IAAA,GAAO,QAAA;AACb,IAAA,KAAA,CAAM,IAAA,GAAO,GAAA;AACb,IAAA,KAAA,CAAM,KAAA,GAAQ,KAAA;AACd,IAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AAAA,EACxB;AACA,EAAA,QAAA,CAAS,IAAA,CAAK,YAAY,IAAI,CAAA;AAC9B,EAAA,IAAI;AACF,IAAA,IAAA,CAAK,MAAA,EAAO;AACZ,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB,CAAA,SACA;AACE,IAAA,IAAA,CAAK,MAAA,EAAO;AAAA,EACd;AACF;AAGA,SAAS,qBAAqB,YAAA,EAA4D;AACxF,EAAA,cAAA,CAAe,YAAA,EAAc,CAAC,aAAa,CAAC,CAAA;AAC5C,EAAA,MAAM,cAAc,IAAI,GAAA,CAAI,MAAA,CAAO,YAAA,CAAa,WAAW,CAAC,CAAA;AAC5D,EAAA,IAAI,WAAA,CAAY,QAAA,KAAa,QAAA,IAAY,WAAA,CAAY,YAAY,WAAA,CAAY,QAAA;AAC3E,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAC/C,EAAA,MAAA,CAAO,QAAA,CAAS,OAAO,WAAA,CAAY,IAAA;AACnC,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAsBA,eAAsB,cAAc,KAAA,EAA8D;AAChG,EAAA,IAAI;AACF,IAAA,QAAQ,MAAM,QAAA;AAAU,MACtB,KAAK,QAAA;AACH,QAAA,IAAI,MAAM,SAAA,KAAc,OAAA;AACtB,UAAA,OAAO,EAAA,CAAG,MAAM,iBAAA,CAAkB,KAAA,CAAM,YAAY,CAAC,CAAA;AACvD,QAAA;AAAA,MACF,KAAK,QAAA;AACH,QAAA,IAAI,MAAM,SAAA,KAAc,IAAA;AACtB,UAAA,OAAO,EAAA,CAAG,cAAA,CAAe,KAAA,CAAM,YAAY,CAAC,CAAA;AAC9C,QAAA;AAAA,MACF,KAAK,QAAA;AACH,QAAA,IAAI,MAAM,SAAA,KAAc,IAAA;AACtB,UAAA,OAAO,EAAA,CAAG,oBAAA,CAAqB,KAAA,CAAM,YAAY,CAAC,CAAA;AACpD,QAAA;AAAA;AAEJ,IAAA,OAAO,GAAA,CAAI,eAAA,CAAgB,sBAAA,EAAwB,QAAA,CAAS,8BAA8B,CAAC,CAAA;AAAA,EAC7F,SACO,KAAA,EAAO;AACZ,IAAA,OAAO,IAAI,eAAA,CAAgB,iBAAA,EAAmB,QAAA,CAAS,yBAAyB,GAAG,KAAK,CAAA;AAAA,EAC1F;AACF","file":"index.js","sourcesContent":["/**\n * @h-ai/payment/client — 浏览器支付调起\n *\n * 微信 JSAPI、支付宝 WAP 表单与 Stripe 托管页面使用各自完整的客户端协议。\n * @module payment-client-web\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { PaymentOrder } from '../payment-types.js'\nimport type { InvokePaymentResult } from './payment-client-types.js'\nimport { err, ok } from '@h-ai/core'\nimport { paymentM } from '../payment-i18n.js'\nimport { HaiPaymentError } from '../payment-types.js'\n\n/**\n * 微信内置浏览器注入的公众号支付桥接对象。\n * @internal\n * @example 模块内部上下文\n * ```ts\n * function submit(bridge: WechatPaymentBridge, params: Record<string, unknown>) {\n *   bridge.invoke('getBrandWCPayRequest', params, response => {\n *     const clientMessage = response.err_msg // 仅用于客户端反馈，不能触发发货。\n *   })\n * }\n * ```\n */\ninterface WechatPaymentBridge {\n  invoke: (api: string, params: Record<string, unknown>, callback: (response: { err_msg: string }) => void) => void\n}\n\n/** 验证必填的字符串字段，拒绝空参数被浏览器当作已成功调起。 */\nfunction requireStrings(params: Record<string, unknown>, fields: readonly string[]): void {\n  if (fields.some(field => typeof params[field] !== 'string' || !params[field].trim()))\n    throw new Error('Invalid payment client parameters')\n}\n\n/** 微信 JSAPI 只在桥接对象已就绪时调起；回调仅表示客户端响应，不能证明已付款。 */\nfunction invokeWechatJsapi(clientParams: Record<string, unknown>): Promise<InvokePaymentResult> {\n  requireStrings(clientParams, ['appId', 'timeStamp', 'nonceStr', 'package', 'signType', 'paySign'])\n  if (clientParams.signType !== 'RSA' || !/^prepay_id=.+$/.test(String(clientParams.package))\n    || !/^\\d+$/.test(String(clientParams.timeStamp))) {\n    throw new Error('Invalid Wechat JSAPI parameters')\n  }\n  const bridge = (window as Window & { WeixinJSBridge?: WechatPaymentBridge }).WeixinJSBridge\n  if (typeof bridge?.invoke !== 'function')\n    return Promise.resolve({ invoked: false, message: paymentM('payment_wechatBridgeUnavailable') })\n  return new Promise((resolve) => {\n    bridge.invoke('getBrandWCPayRequest', clientParams, (response) => {\n      resolve({ invoked: true, message: response.err_msg })\n    })\n  })\n}\n\n/** 支付宝 WAP 仅向固定网关 POST 签名字段；不解析 HTML，也不将业务数据放进 URL。 */\nfunction invokeAlipayH5(clientParams: Record<string, unknown>): InvokePaymentResult {\n  const { gateway, fields } = clientParams\n  if ((gateway !== 'https://openapi.alipay.com/gateway.do'\n    && gateway !== 'https://openapi-sandbox.dl.alipaydev.com/gateway.do')\n  || Object.keys(clientParams).some(key => key !== 'gateway' && key !== 'fields')\n  || typeof fields !== 'object' || fields === null || Array.isArray(fields)) {\n    throw new Error('Invalid Alipay page parameters')\n  }\n  const required = ['app_id', 'method', 'format', 'charset', 'sign_type', 'timestamp', 'version', 'notify_url', 'return_url', 'biz_content', 'sign']\n  const entries: Array<[string, string]> = []\n  for (const [key, value] of Object.entries(fields) as Array<[string, unknown]>) {\n    if (!required.includes(key) || typeof value !== 'string' || !value.trim())\n      throw new Error('Invalid Alipay form fields')\n    entries.push([key, value])\n  }\n  if (entries.length !== required.length)\n    throw new Error('Invalid Alipay form fields')\n  const params = Object.fromEntries(entries)\n  if (params.method !== 'alipay.trade.wap.pay' || params.format !== 'JSON' || params.charset !== 'utf-8' || params.version !== '1.0'\n    || (params.sign_type !== 'RSA2' && params.sign_type !== 'RSA')) {\n    throw new Error('Invalid Alipay form method')\n  }\n  // 逐个构造 input，字段值中的引号、尖括号和脚本始终只是文本。\n  const form = document.createElement('form')\n  form.action = gateway\n  form.method = 'POST'\n  form.acceptCharset = 'utf-8'\n  for (const [key, value] of entries) {\n    const input = document.createElement('input')\n    input.type = 'hidden'\n    input.name = key\n    input.value = value\n    form.appendChild(input)\n  }\n  document.body.appendChild(form)\n  try {\n    form.submit()\n    return { invoked: true }\n  }\n  finally {\n    form.remove()\n  }\n}\n\n/** Stripe 托管页使用 HTTPS 跳转，禁止 javascript/file 等可执行或本地协议。 */\nfunction invokeStripeCheckout(clientParams: Record<string, unknown>): InvokePaymentResult {\n  requireStrings(clientParams, ['checkoutUrl'])\n  const checkoutUrl = new URL(String(clientParams.checkoutUrl))\n  if (checkoutUrl.protocol !== 'https:' || checkoutUrl.username || checkoutUrl.password)\n    throw new Error('Invalid Stripe Checkout URL')\n  window.location.href = checkoutUrl.href\n  return { invoked: true }\n}\n\n/**\n * 按服务端返回的渠道与场景调起支付；不支持的组合直接返回错误。\n *\n * 调用前等待微信 WeixinJSBridgeReady；invoked 只表示已提交调起，付款状态由服务端确认。\n *\n * @param order - 服务端创建的支付订单\n * @returns 调起结果；失败时应向用户提示并允许重试。\n * @example\n * ```ts\n * import { invokePayment } from '@h-ai/payment/client'\n * import type { PaymentOrder } from '@h-ai/payment'\n * async function pay(orderFromServer: PaymentOrder) {\n *   // 浏览器环境；微信先等待 WeixinJSBridgeReady。参数来自受信服务端创建订单接口。\n *   const result = await invokePayment(orderFromServer)\n *   if (!result.success) throw new Error(result.error.message)\n *   if (!result.data.invoked) throw new Error(result.data.message)\n *   // 继续等待服务端查询/通知确认，不能依据 invoked、页面跳转或用户返回就发货。\n * }\n * ```\n */\nexport async function invokePayment(order: PaymentOrder): Promise<HaiResult<InvokePaymentResult>> {\n  try {\n    switch (order.provider) {\n      case 'wechat':\n        if (order.tradeType === 'jsapi')\n          return ok(await invokeWechatJsapi(order.clientParams))\n        break\n      case 'alipay':\n        if (order.tradeType === 'h5')\n          return ok(invokeAlipayH5(order.clientParams))\n        break\n      case 'stripe':\n        if (order.tradeType === 'h5')\n          return ok(invokeStripeCheckout(order.clientParams))\n        break\n    }\n    return err(HaiPaymentError.UNSUPPORTED_TRADE_TYPE, paymentM('payment_unsupportedTradeType'))\n  }\n  catch (cause) {\n    return err(HaiPaymentError.INVOKE_WEB_FAILED, paymentM('payment_invokeWebFailed'), cause)\n  }\n}\n"]}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { a as PaymentFunctions } from './payment-types-Cf3kF6Tn.js';
-export { A as AlipayConfig, b as AlipayConfigSchema, C as CreateOrderInput, H as HaiPaymentError, O as OrderStatus, c as OrderStatusValue, d as PaymentConfig, e as PaymentConfigInput, f as PaymentConfigSchema, g as PaymentNotifyRequest, h as PaymentNotifyResult, P as PaymentOrder, i as PaymentProvider, R as RefundInput, j as RefundResult, S as StripeConfig, k as StripeConfigSchema, T as TradeType, W as WechatPayConfig, l as WechatPayConfigSchema } from './payment-types-Cf3kF6Tn.js';
+import { a as PaymentFunctions } from './payment-types-D02t-Pc9.js';
+export { A as AlipayConfig, b as AlipayConfigSchema, C as CreateOrderInput, H as HaiPaymentError, O as OrderStatus, c as OrderStatusValue, d as PaymentConfig, e as PaymentConfigInput, f as PaymentConfigSchema, g as PaymentNotifyRequest, h as PaymentNotifyResult, P as PaymentOrder, i as PaymentProvider, R as RefundInput, j as RefundResult, S as StripeConfig, k as StripeConfigSchema, T as TradeType, W as WechatPayConfig, l as WechatPayConfigSchema } from './payment-types-D02t-Pc9.js';
 import '@h-ai/core';
 import 'zod';
 
@@ -13,25 +13,23 @@ import 'zod';
  */
 
 /**
- * 支付模块服务对象
- *
+ * 支付生命周期与统一渠道操作入口；初始化失败必须停止依赖该模块的业务。
  * @example
  * ```ts
- * import { payment } from '@h-ai/payment'
- *
- * await payment.init({
- *   wechat: { mchId: '...', apiV3Key: '...', ... },
- *   alipay: { appId: '...', privateKey: '...' , ... },
- * })
- *
- * const result = await payment.createOrder('wechat', {
- *   orderNo: 'ORD001',
- *   amount: 100,
- *   description: '测试商品',
- *   tradeType: 'jsapi',
- *   userId: 'openid-xxx',
- *   notifyUrl: 'https://api.example.com/payment/notify/wechat',
- * })
+ * import { payment, type PaymentConfigInput } from '@h-ai/payment'
+ * async function run(config: PaymentConfigInput) {
+ *   // 使用 Stripe 时，宿主已先初始化同一共享 reldb；payment.close 不关闭它。
+ *   const initialized = await payment.init(config)
+ *   if (!initialized.success) throw new Error(initialized.error.message)
+ *   try {
+ *     const order = await payment.queryOrder('stripe', 'ORDER_1')
+ *     if (!order.success) throw new Error(order.error.message)
+ *     return order.data
+ *   }
+ *   finally {
+ *     await payment.close()
+ *   }
+ * }
  * ```
  */
 declare const payment: PaymentFunctions;