@lacspace/fonepay 1.0.0

package/LICENSE

@@ -0,0 +1,51 @@
+Lacspace Free Licence
+Version 1.0, August 2026
+
+Copyright (c) 2026 Lacspace
+
+PREAMBLE
+
+This software is published by Lacspace under the Lacspace Free Licence — a free,
+permissive licence that lets you use this software for any purpose, including in
+commercial products and services, at no cost. It grants the same freedoms as
+common permissive open-source licences; the only condition is that this notice
+travels with the software. The canonical, always-current text of this licence is
+maintained at https://lacspace.com/licenses/lacspace-free-1.0
+
+GRANT OF RIGHTS
+
+Permission is hereby granted, free of charge, to any person or organisation
+obtaining a copy of this software and its associated documentation and data files
+(the "Software"), to deal in the Software without restriction, including without
+limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the conditions below. These rights are
+granted for any purpose, personal or commercial, and are perpetual, worldwide,
+non-exclusive, and royalty-free.
+
+CONDITIONS
+
+The above copyright notice, this permission notice, and the name of this licence
+("Lacspace Free Licence") shall be included in all copies or substantial portions
+of the Software.
+
+TRADEMARKS
+
+This licence does not grant permission to use the trade names, trademarks, service
+marks, logos, or product names of Lacspace, except as required to reproduce the
+notice above or to describe the origin of the Software in a truthful manner.
+
+DISCLAIMER OF WARRANTY AND LIMITATION OF LIABILITY
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN
+AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---
+
+The Lacspace Free Licence is a source-available, permissive licence and is not (as
+of this version) an OSI-approved licence. In substance it grants the same freedoms
+as the MIT Licence. Learn more at https://lacspace.com/licenses

package/README.md

@@ -0,0 +1,104 @@
+<div align="center">
+
+# @lacspace/fonepay
+
+**Fonepay (Nepal) merchant redirect / Request-To-Pay over Web Crypto — HMAC-SHA512 request signing + response verification.**
+
+[![npm version](https://img.shields.io/npm/v/@lacspace/fonepay?color=%2316a34a&label=npm)](https://www.npmjs.com/package/@lacspace/fonepay)
+[![install size](https://packagephobia.com/badge?p=@lacspace/fonepay)](https://packagephobia.com/result?p=@lacspace/fonepay)
+[![minzipped](https://img.shields.io/bundlephobia/minzip/@lacspace/fonepay?label=minzip)](https://bundlephobia.com/package/@lacspace/fonepay)
+[![types](https://img.shields.io/badge/types-included-blue)](https://www.npmjs.com/package/@lacspace/fonepay)
+[![license](https://img.shields.io/npm/l/@lacspace/fonepay?color=green)](https://github.com/lacspace/npm-packages/blob/main/LICENSE)
+
+</div>
+
+> [Fonepay](https://fonepay.com/) merchant redirect ("Request-To-Pay") signs the request with an **HMAC-SHA512** data-validation field (`DV`) over the request values in an exact order, and returns a `DV` on the response you must verify the same way. This package computes both — correctly, in a few bytes.
+
+- 🔐 **HMAC-SHA512** (lowercase hex) over the fields in Fonepay's exact order
+- 🔁 `buildRedirect()` assembles the full urlencoded gateway URL (incl. `DV`)
+- ✅ `verifyResponse()` recomputes the response `DV` with a **constant-time** compare
+- 🛡️ Built on **Web Crypto** (`globalThis.crypto.subtle`) — never hand-rolled cryptography
+- ⚡ Isomorphic — Node 20+, edge runtimes & browsers · 📦 ESM + CJS · fully typed · **zero dependencies**
+
+## Install
+
+```bash
+npm install @lacspace/fonepay      # or pnpm add / yarn add / bun add
+```
+
+## Redirect the payer
+
+```ts
+import { buildRedirect } from "@lacspace/fonepay";
+
+const { url } = await buildRedirect(
+  {
+    PID: "MERCHANT",         // merchant code
+    PRN: "prn-0001",         // unique product/reference number
+    AMT: 1000,               // amount
+    DT: "09/05/2026",        // date
+    R1: "order note",
+    R2: "buyer ref",
+    RU: "https://shop.me/fonepay/return", // return URL
+    // MD defaults to "P", CRN defaults to "NPR"
+  },
+  { secret: process.env.FONEPAY_SECRET!, env: "prod" },
+);
+
+return Response.redirect(url, 302);
+```
+
+The signed message is HMAC-SHA512 over `PID,MD,PRN,AMT,CRN,DT,R1,R2,RU` (joined by `,`), emitted as lowercase hex — the `DV` param.
+
+## Verify the response
+
+```ts
+import { verifyResponse } from "@lacspace/fonepay";
+
+// query = the params Fonepay sent back to your return URL
+const { valid } = await verifyResponse(
+  {
+    PRN: query.PRN, PID: query.PID, PS: query.PS, RC: query.RC,
+    UID: query.UID, BC: query.BC, INI: query.INI,
+    P_AMT: query.P_AMT, R_AMT: query.R_AMT, DV: query.DV,
+  },
+  process.env.FONEPAY_SECRET!,
+);
+
+if (!valid) return new Response("Invalid Fonepay response", { status: 400 });
+```
+
+The response `DV` is HMAC-SHA512 over `PRN,PID,PS,RC,UID,BC,INI,P_AMT,R_AMT` — recomputed and compared in constant time.
+
+## Just the signature
+
+```ts
+import { signRequest } from "@lacspace/fonepay";
+
+const dv = await signRequest(params, secret); // 128-char lowercase hex
+```
+
+## API
+
+| Export | Description |
+| --- | --- |
+| `signRequest(params, secret)` | HMAC-SHA512 (hex) request `DV`. `MD` → `"P"`, `CRN` → `"NPR"` by default. |
+| `buildRedirect(params, { secret, env? })` | `{ url, params, dv }` — the full gateway URL with all fields + `DV`. |
+| `verifyResponse(resp, secret)` | `{ valid }` — constant-time verify of the response `DV`. |
+| `GATEWAY_URL` | `{ test, prod }` endpoint map. |
+
+`env` defaults to `"test"` (dev gateway). Keep your Fonepay **secret** on the server only.
+
+---
+
+## The Lacspace Developer Platform
+
+`@lacspace/fonepay` is part of **63+ zero-dependency, isomorphic TypeScript packages**. Explore the ecosystem:
+
+- 🗂️ **All packages** — https://developer.lacspace.com/packages
+- 🧭 **Developer handbook** — https://developer.lacspace.com/handbook
+- 🧪 **Live playground** — https://developer.lacspace.com/playground
+- 🖥️ **Finished app templates** — https://templates.lacspace.com
+- 🚀 **Scaffold a full app** — `npm create lacspace-app@latest`
+
+Free under the **[Lacspace Free Licence](https://lacspace.com/licenses/lacspace-free-1.0)** — a permissive, free-to-use licence.

package/dist/index.cjs

@@ -0,0 +1,88 @@
+'use strict';
+
+// src/index.ts
+var GATEWAY_URL = {
+  test: "https://dev-clientapi.fonepay.com/api/merchantRequest",
+  prod: "https://clientapi.fonepay.com/api/merchantRequest"
+};
+var enc = new TextEncoder();
+function toHex(bytes) {
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) hex += bytes[i].toString(16).padStart(2, "0");
+  return hex;
+}
+async function hmacHex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-512" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(message));
+  return toHex(new Uint8Array(sig));
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function resolveRequest(p) {
+  return {
+    PID: String(p.PID),
+    MD: String(p.MD ?? "P"),
+    PRN: String(p.PRN),
+    AMT: String(p.AMT),
+    CRN: String(p.CRN ?? "NPR"),
+    DT: String(p.DT),
+    R1: String(p.R1),
+    R2: String(p.R2),
+    RU: String(p.RU)
+  };
+}
+async function signRequest(params, secret) {
+  const r = resolveRequest(params);
+  const message = [r.PID, r.MD, r.PRN, r.AMT, r.CRN, r.DT, r.R1, r.R2, r.RU].join(",");
+  return hmacHex(secret, message);
+}
+async function buildRedirect(params, opts) {
+  const r = resolveRequest(params);
+  const dv = await signRequest(params, opts.secret);
+  const fields = {
+    PID: r.PID,
+    MD: r.MD,
+    PRN: r.PRN,
+    AMT: r.AMT,
+    CRN: r.CRN,
+    DT: r.DT,
+    R1: r.R1,
+    R2: r.R2,
+    RU: r.RU,
+    DV: dv
+  };
+  const qs = new URLSearchParams(fields).toString();
+  return { url: `${GATEWAY_URL[opts.env ?? "test"]}?${qs}`, params: fields, dv };
+}
+async function verifyResponse(resp, secret) {
+  const message = [
+    String(resp.PRN),
+    String(resp.PID),
+    String(resp.PS),
+    String(resp.RC),
+    String(resp.UID),
+    String(resp.BC),
+    String(resp.INI),
+    String(resp.P_AMT),
+    String(resp.R_AMT)
+  ].join(",");
+  const expected = await hmacHex(secret, message);
+  return { valid: timingSafeEqual(expected, String(resp.DV).toLowerCase()) };
+}
+
+exports.GATEWAY_URL = GATEWAY_URL;
+exports.buildRedirect = buildRedirect;
+exports.signRequest = signRequest;
+exports.verifyResponse = verifyResponse;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AA0BO,IAAM,WAAA,GAAmC;AAAA,EAC9C,IAAA,EAAM,uDAAA;AAAA,EACN,IAAA,EAAM;AACR;AAMA,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAE5B,SAAS,MAAM,KAAA,EAA2B;AACxC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,GAAA,IAAO,KAAA,CAAM,CAAC,EAAG,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AACpF,EAAA,OAAO,GAAA;AACT;AAGA,eAAe,OAAA,CAAQ,QAAgB,OAAA,EAAkC;AACvE,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,GAAA,CAAI,OAAO,MAAM,CAAA;AAAA,IACjB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,GAAA,CAAI,MAAA,CAAO,OAAO,CAAC,CAAA;AACrE,EAAA,OAAO,KAAA,CAAM,IAAI,UAAA,CAAW,GAAG,CAAC,CAAA;AAClC;AAGA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAQ,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAC3E,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAuCA,SAAS,eAAe,CAAA,EAAmC;AACzD,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAG,CAAA;AAAA,IACjB,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,GAAG,CAAA;AAAA,IACtB,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAG,CAAA;AAAA,IACjB,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAG,CAAA;AAAA,IACjB,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAA,IAAO,KAAK,CAAA;AAAA,IAC1B,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA;AAAA,IACf,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA;AAAA,IACf,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA;AAAA,IACf,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE;AAAA,GACjB;AACF;AAcA,eAAsB,WAAA,CAAY,QAAuB,MAAA,EAAiC;AACxF,EAAA,MAAM,CAAA,GAAI,eAAe,MAAM,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,CAAE,GAAA,EAAK,EAAE,EAAA,EAAI,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,KAAK,CAAA,CAAE,EAAA,EAAI,EAAE,EAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,EAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACnF,EAAA,OAAO,OAAA,CAAQ,QAAQ,OAAO,CAAA;AAChC;AA6BA,eAAsB,aAAA,CAAc,QAAuB,IAAA,EAA+C;AACxG,EAAA,MAAM,CAAA,GAAI,eAAe,MAAM,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAM,WAAA,CAAY,MAAA,EAAQ,KAAK,MAAM,CAAA;AAChD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,EAAA,EAAI;AAAA,GACN;AACA,EAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAChD,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,WAAA,CAAY,IAAA,CAAK,GAAA,IAAO,MAAM,CAAC,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,EAAI,MAAA,EAAQ,QAAQ,EAAA,EAAG;AAC/E;AA6BA,eAAsB,cAAA,CAAe,MAAsB,MAAA,EAA6C;AACtG,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACd,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACd,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACd,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACjB,MAAA,CAAO,KAAK,KAAK;AAAA,GACnB,CAAE,KAAK,GAAG,CAAA;AACV,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AAC9C,EAAA,OAAO,EAAE,KAAA,EAAO,eAAA,CAAgB,QAAA,EAAU,MAAA,CAAO,KAAK,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA,EAAE;AAC3E","file":"index.cjs","sourcesContent":["/**\n * @lacspace/fonepay\n *\n * Fonepay (Nepal) merchant redirect — \"Request-To-Pay\" — over Web Crypto.\n * The merchant redirects the payer to Fonepay with an HMAC-SHA512-signed set\n * of request parameters (the `DV` data-validation field), and verifies the\n * `DV` on the response the same way.\n *\n * This package builds both signatures correctly:\n *\n *   1. Request DV — HMAC-SHA512 over the request fields joined by \",\" in the\n *      exact Fonepay order, lowercase hex.\n *   2. Response DV — HMAC-SHA512 over the response fields, constant-time\n *      compared to the returned `DV`.\n *\n * Zero dependencies. Isomorphic: Node 20+, edge runtimes and browsers — all\n * cryptography goes through `globalThis.crypto.subtle`, never hand-rolled.\n */\n\n/* ------------------------------------------------------------------ *\n * Endpoints\n * ------------------------------------------------------------------ */\n\nexport type Env = \"test\" | \"prod\";\n\n/** Fonepay merchant-request gateway URLs, by environment. */\nexport const GATEWAY_URL: Record<Env, string> = {\n  test: \"https://dev-clientapi.fonepay.com/api/merchantRequest\",\n  prod: \"https://clientapi.fonepay.com/api/merchantRequest\",\n};\n\n/* ------------------------------------------------------------------ *\n * HMAC-SHA512 (hex) helpers — isomorphic, zero-dep\n * ------------------------------------------------------------------ */\n\nconst enc = new TextEncoder();\n\nfunction toHex(bytes: Uint8Array): string {\n  let hex = \"\";\n  for (let i = 0; i < bytes.length; i++) hex += bytes[i]!.toString(16).padStart(2, \"0\");\n  return hex;\n}\n\n/** HMAC-SHA512 of `message` under `secret`, lowercase hex. */\nasync function hmacHex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-512\" },\n    false,\n    [\"sign\"],\n  );\n  const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(message));\n  return toHex(new Uint8Array(sig));\n}\n\n/** Constant-time comparison of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  return diff === 0;\n}\n\n/* ------------------------------------------------------------------ *\n * Request signing\n * ------------------------------------------------------------------ */\n\nexport interface RequestParams {\n  /** Merchant code (PID). */\n  PID: string;\n  /** Method / mode. Default \"P\". */\n  MD?: string;\n  /** Product / reference number — unique per transaction. */\n  PRN: string;\n  /** Amount. */\n  AMT: string | number;\n  /** Currency. Default \"NPR\". */\n  CRN?: string;\n  /** Date (as required by Fonepay). */\n  DT: string;\n  /** Free field R1. */\n  R1: string;\n  /** Free field R2. */\n  R2: string;\n  /** Return URL. */\n  RU: string;\n}\n\ninterface ResolvedRequest {\n  PID: string;\n  MD: string;\n  PRN: string;\n  AMT: string;\n  CRN: string;\n  DT: string;\n  R1: string;\n  R2: string;\n  RU: string;\n}\n\nfunction resolveRequest(p: RequestParams): ResolvedRequest {\n  return {\n    PID: String(p.PID),\n    MD: String(p.MD ?? \"P\"),\n    PRN: String(p.PRN),\n    AMT: String(p.AMT),\n    CRN: String(p.CRN ?? \"NPR\"),\n    DT: String(p.DT),\n    R1: String(p.R1),\n    R2: String(p.R2),\n    RU: String(p.RU),\n  };\n}\n\n/**\n * Sign a Fonepay Request-To-Pay: HMAC-SHA512 over the request values joined by\n * \",\" in the exact order `PID,MD,PRN,AMT,CRN,DT,R1,R2,RU`. Returns lowercase\n * hex — this is the `DV` field. `MD` defaults to `\"P\"`, `CRN` to `\"NPR\"`.\n *\n * @example\n * const dv = await signRequest(\n *   { PID: \"MERCHANT\", PRN: \"prn-1\", AMT: 1000, DT: \"09/05/2026\",\n *     R1: \"test\", R2: \"test\", RU: \"https://shop.me/return\" },\n *   process.env.FONEPAY_SECRET!,\n * );\n */\nexport async function signRequest(params: RequestParams, secret: string): Promise<string> {\n  const r = resolveRequest(params);\n  const message = [r.PID, r.MD, r.PRN, r.AMT, r.CRN, r.DT, r.R1, r.R2, r.RU].join(\",\");\n  return hmacHex(secret, message);\n}\n\n/* ------------------------------------------------------------------ *\n * Redirect builder\n * ------------------------------------------------------------------ */\n\nexport interface BuildRedirectOptions {\n  secret: string;\n  /** Which gateway to target. Default \"test\" (dev). */\n  env?: Env;\n}\n\nexport interface Redirect {\n  /** The full redirect URL (gateway + urlencoded params, including `DV`). */\n  url: string;\n  /** All request params plus the computed `DV`. */\n  params: Record<string, string>;\n  /** The request signature. */\n  dv: string;\n}\n\n/**\n * Build the full Fonepay redirect: signs the request, assembles all params\n * (including `DV`) and produces the gateway URL with everything urlencoded.\n *\n * @example\n * const { url } = await buildRedirect(params, { secret, env: \"prod\" });\n * return Response.redirect(url, 302);\n */\nexport async function buildRedirect(params: RequestParams, opts: BuildRedirectOptions): Promise<Redirect> {\n  const r = resolveRequest(params);\n  const dv = await signRequest(params, opts.secret);\n  const fields: Record<string, string> = {\n    PID: r.PID,\n    MD: r.MD,\n    PRN: r.PRN,\n    AMT: r.AMT,\n    CRN: r.CRN,\n    DT: r.DT,\n    R1: r.R1,\n    R2: r.R2,\n    RU: r.RU,\n    DV: dv,\n  };\n  const qs = new URLSearchParams(fields).toString();\n  return { url: `${GATEWAY_URL[opts.env ?? \"test\"]}?${qs}`, params: fields, dv };\n}\n\n/* ------------------------------------------------------------------ *\n * Response verification\n * ------------------------------------------------------------------ */\n\nexport interface ResponseParams {\n  PRN: string;\n  PID: string;\n  PS: string;\n  RC: string;\n  UID: string;\n  BC: string;\n  INI: string;\n  P_AMT: string | number;\n  R_AMT: string | number;\n  /** The DV returned by Fonepay to verify. */\n  DV: string;\n}\n\n/**\n * Verify a Fonepay response: recompute HMAC-SHA512 over the response fields\n * joined by \",\" in the order `PRN,PID,PS,RC,UID,BC,INI,P_AMT,R_AMT`, then\n * constant-time compare it to the returned `DV`.\n *\n * @example\n * const { valid } = await verifyResponse(query, process.env.FONEPAY_SECRET!);\n * if (!valid) return new Response(\"Invalid Fonepay response\", { status: 400 });\n */\nexport async function verifyResponse(resp: ResponseParams, secret: string): Promise<{ valid: boolean }> {\n  const message = [\n    String(resp.PRN),\n    String(resp.PID),\n    String(resp.PS),\n    String(resp.RC),\n    String(resp.UID),\n    String(resp.BC),\n    String(resp.INI),\n    String(resp.P_AMT),\n    String(resp.R_AMT),\n  ].join(\",\");\n  const expected = await hmacHex(secret, message);\n  return { valid: timingSafeEqual(expected, String(resp.DV).toLowerCase()) };\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,103 @@
+/**
+ * @lacspace/fonepay
+ *
+ * Fonepay (Nepal) merchant redirect — "Request-To-Pay" — over Web Crypto.
+ * The merchant redirects the payer to Fonepay with an HMAC-SHA512-signed set
+ * of request parameters (the `DV` data-validation field), and verifies the
+ * `DV` on the response the same way.
+ *
+ * This package builds both signatures correctly:
+ *
+ *   1. Request DV — HMAC-SHA512 over the request fields joined by "," in the
+ *      exact Fonepay order, lowercase hex.
+ *   2. Response DV — HMAC-SHA512 over the response fields, constant-time
+ *      compared to the returned `DV`.
+ *
+ * Zero dependencies. Isomorphic: Node 20+, edge runtimes and browsers — all
+ * cryptography goes through `globalThis.crypto.subtle`, never hand-rolled.
+ */
+type Env = "test" | "prod";
+/** Fonepay merchant-request gateway URLs, by environment. */
+declare const GATEWAY_URL: Record<Env, string>;
+interface RequestParams {
+    /** Merchant code (PID). */
+    PID: string;
+    /** Method / mode. Default "P". */
+    MD?: string;
+    /** Product / reference number — unique per transaction. */
+    PRN: string;
+    /** Amount. */
+    AMT: string | number;
+    /** Currency. Default "NPR". */
+    CRN?: string;
+    /** Date (as required by Fonepay). */
+    DT: string;
+    /** Free field R1. */
+    R1: string;
+    /** Free field R2. */
+    R2: string;
+    /** Return URL. */
+    RU: string;
+}
+/**
+ * Sign a Fonepay Request-To-Pay: HMAC-SHA512 over the request values joined by
+ * "," in the exact order `PID,MD,PRN,AMT,CRN,DT,R1,R2,RU`. Returns lowercase
+ * hex — this is the `DV` field. `MD` defaults to `"P"`, `CRN` to `"NPR"`.
+ *
+ * @example
+ * const dv = await signRequest(
+ *   { PID: "MERCHANT", PRN: "prn-1", AMT: 1000, DT: "09/05/2026",
+ *     R1: "test", R2: "test", RU: "https://shop.me/return" },
+ *   process.env.FONEPAY_SECRET!,
+ * );
+ */
+declare function signRequest(params: RequestParams, secret: string): Promise<string>;
+interface BuildRedirectOptions {
+    secret: string;
+    /** Which gateway to target. Default "test" (dev). */
+    env?: Env;
+}
+interface Redirect {
+    /** The full redirect URL (gateway + urlencoded params, including `DV`). */
+    url: string;
+    /** All request params plus the computed `DV`. */
+    params: Record<string, string>;
+    /** The request signature. */
+    dv: string;
+}
+/**
+ * Build the full Fonepay redirect: signs the request, assembles all params
+ * (including `DV`) and produces the gateway URL with everything urlencoded.
+ *
+ * @example
+ * const { url } = await buildRedirect(params, { secret, env: "prod" });
+ * return Response.redirect(url, 302);
+ */
+declare function buildRedirect(params: RequestParams, opts: BuildRedirectOptions): Promise<Redirect>;
+interface ResponseParams {
+    PRN: string;
+    PID: string;
+    PS: string;
+    RC: string;
+    UID: string;
+    BC: string;
+    INI: string;
+    P_AMT: string | number;
+    R_AMT: string | number;
+    /** The DV returned by Fonepay to verify. */
+    DV: string;
+}
+/**
+ * Verify a Fonepay response: recompute HMAC-SHA512 over the response fields
+ * joined by "," in the order `PRN,PID,PS,RC,UID,BC,INI,P_AMT,R_AMT`, then
+ * constant-time compare it to the returned `DV`.
+ *
+ * @example
+ * const { valid } = await verifyResponse(query, process.env.FONEPAY_SECRET!);
+ * if (!valid) return new Response("Invalid Fonepay response", { status: 400 });
+ */
+declare function verifyResponse(resp: ResponseParams, secret: string): Promise<{
+    valid: boolean;
+}>;
+
+export { type BuildRedirectOptions, type Env, GATEWAY_URL, type Redirect, type RequestParams, type ResponseParams, buildRedirect, signRequest, verifyResponse };

package/dist/index.d.ts

@@ -0,0 +1,103 @@
+/**
+ * @lacspace/fonepay
+ *
+ * Fonepay (Nepal) merchant redirect — "Request-To-Pay" — over Web Crypto.
+ * The merchant redirects the payer to Fonepay with an HMAC-SHA512-signed set
+ * of request parameters (the `DV` data-validation field), and verifies the
+ * `DV` on the response the same way.
+ *
+ * This package builds both signatures correctly:
+ *
+ *   1. Request DV — HMAC-SHA512 over the request fields joined by "," in the
+ *      exact Fonepay order, lowercase hex.
+ *   2. Response DV — HMAC-SHA512 over the response fields, constant-time
+ *      compared to the returned `DV`.
+ *
+ * Zero dependencies. Isomorphic: Node 20+, edge runtimes and browsers — all
+ * cryptography goes through `globalThis.crypto.subtle`, never hand-rolled.
+ */
+type Env = "test" | "prod";
+/** Fonepay merchant-request gateway URLs, by environment. */
+declare const GATEWAY_URL: Record<Env, string>;
+interface RequestParams {
+    /** Merchant code (PID). */
+    PID: string;
+    /** Method / mode. Default "P". */
+    MD?: string;
+    /** Product / reference number — unique per transaction. */
+    PRN: string;
+    /** Amount. */
+    AMT: string | number;
+    /** Currency. Default "NPR". */
+    CRN?: string;
+    /** Date (as required by Fonepay). */
+    DT: string;
+    /** Free field R1. */
+    R1: string;
+    /** Free field R2. */
+    R2: string;
+    /** Return URL. */
+    RU: string;
+}
+/**
+ * Sign a Fonepay Request-To-Pay: HMAC-SHA512 over the request values joined by
+ * "," in the exact order `PID,MD,PRN,AMT,CRN,DT,R1,R2,RU`. Returns lowercase
+ * hex — this is the `DV` field. `MD` defaults to `"P"`, `CRN` to `"NPR"`.
+ *
+ * @example
+ * const dv = await signRequest(
+ *   { PID: "MERCHANT", PRN: "prn-1", AMT: 1000, DT: "09/05/2026",
+ *     R1: "test", R2: "test", RU: "https://shop.me/return" },
+ *   process.env.FONEPAY_SECRET!,
+ * );
+ */
+declare function signRequest(params: RequestParams, secret: string): Promise<string>;
+interface BuildRedirectOptions {
+    secret: string;
+    /** Which gateway to target. Default "test" (dev). */
+    env?: Env;
+}
+interface Redirect {
+    /** The full redirect URL (gateway + urlencoded params, including `DV`). */
+    url: string;
+    /** All request params plus the computed `DV`. */
+    params: Record<string, string>;
+    /** The request signature. */
+    dv: string;
+}
+/**
+ * Build the full Fonepay redirect: signs the request, assembles all params
+ * (including `DV`) and produces the gateway URL with everything urlencoded.
+ *
+ * @example
+ * const { url } = await buildRedirect(params, { secret, env: "prod" });
+ * return Response.redirect(url, 302);
+ */
+declare function buildRedirect(params: RequestParams, opts: BuildRedirectOptions): Promise<Redirect>;
+interface ResponseParams {
+    PRN: string;
+    PID: string;
+    PS: string;
+    RC: string;
+    UID: string;
+    BC: string;
+    INI: string;
+    P_AMT: string | number;
+    R_AMT: string | number;
+    /** The DV returned by Fonepay to verify. */
+    DV: string;
+}
+/**
+ * Verify a Fonepay response: recompute HMAC-SHA512 over the response fields
+ * joined by "," in the order `PRN,PID,PS,RC,UID,BC,INI,P_AMT,R_AMT`, then
+ * constant-time compare it to the returned `DV`.
+ *
+ * @example
+ * const { valid } = await verifyResponse(query, process.env.FONEPAY_SECRET!);
+ * if (!valid) return new Response("Invalid Fonepay response", { status: 400 });
+ */
+declare function verifyResponse(resp: ResponseParams, secret: string): Promise<{
+    valid: boolean;
+}>;
+
+export { type BuildRedirectOptions, type Env, GATEWAY_URL, type Redirect, type RequestParams, type ResponseParams, buildRedirect, signRequest, verifyResponse };

package/dist/index.js

@@ -0,0 +1,83 @@
+// src/index.ts
+var GATEWAY_URL = {
+  test: "https://dev-clientapi.fonepay.com/api/merchantRequest",
+  prod: "https://clientapi.fonepay.com/api/merchantRequest"
+};
+var enc = new TextEncoder();
+function toHex(bytes) {
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) hex += bytes[i].toString(16).padStart(2, "0");
+  return hex;
+}
+async function hmacHex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-512" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(message));
+  return toHex(new Uint8Array(sig));
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function resolveRequest(p) {
+  return {
+    PID: String(p.PID),
+    MD: String(p.MD ?? "P"),
+    PRN: String(p.PRN),
+    AMT: String(p.AMT),
+    CRN: String(p.CRN ?? "NPR"),
+    DT: String(p.DT),
+    R1: String(p.R1),
+    R2: String(p.R2),
+    RU: String(p.RU)
+  };
+}
+async function signRequest(params, secret) {
+  const r = resolveRequest(params);
+  const message = [r.PID, r.MD, r.PRN, r.AMT, r.CRN, r.DT, r.R1, r.R2, r.RU].join(",");
+  return hmacHex(secret, message);
+}
+async function buildRedirect(params, opts) {
+  const r = resolveRequest(params);
+  const dv = await signRequest(params, opts.secret);
+  const fields = {
+    PID: r.PID,
+    MD: r.MD,
+    PRN: r.PRN,
+    AMT: r.AMT,
+    CRN: r.CRN,
+    DT: r.DT,
+    R1: r.R1,
+    R2: r.R2,
+    RU: r.RU,
+    DV: dv
+  };
+  const qs = new URLSearchParams(fields).toString();
+  return { url: `${GATEWAY_URL[opts.env ?? "test"]}?${qs}`, params: fields, dv };
+}
+async function verifyResponse(resp, secret) {
+  const message = [
+    String(resp.PRN),
+    String(resp.PID),
+    String(resp.PS),
+    String(resp.RC),
+    String(resp.UID),
+    String(resp.BC),
+    String(resp.INI),
+    String(resp.P_AMT),
+    String(resp.R_AMT)
+  ].join(",");
+  const expected = await hmacHex(secret, message);
+  return { valid: timingSafeEqual(expected, String(resp.DV).toLowerCase()) };
+}
+
+export { GATEWAY_URL, buildRedirect, signRequest, verifyResponse };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";AA0BO,IAAM,WAAA,GAAmC;AAAA,EAC9C,IAAA,EAAM,uDAAA;AAAA,EACN,IAAA,EAAM;AACR;AAMA,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAE5B,SAAS,MAAM,KAAA,EAA2B;AACxC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,GAAA,IAAO,KAAA,CAAM,CAAC,EAAG,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AACpF,EAAA,OAAO,GAAA;AACT;AAGA,eAAe,OAAA,CAAQ,QAAgB,OAAA,EAAkC;AACvE,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,GAAA,CAAI,OAAO,MAAM,CAAA;AAAA,IACjB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,GAAA,CAAI,MAAA,CAAO,OAAO,CAAC,CAAA;AACrE,EAAA,OAAO,KAAA,CAAM,IAAI,UAAA,CAAW,GAAG,CAAC,CAAA;AAClC;AAGA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAQ,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAC3E,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAuCA,SAAS,eAAe,CAAA,EAAmC;AACzD,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAG,CAAA;AAAA,IACjB,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,GAAG,CAAA;AAAA,IACtB,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAG,CAAA;AAAA,IACjB,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAG,CAAA;AAAA,IACjB,GAAA,EAAK,MAAA,CAAO,CAAA,CAAE,GAAA,IAAO,KAAK,CAAA;AAAA,IAC1B,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA;AAAA,IACf,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA;AAAA,IACf,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA;AAAA,IACf,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE;AAAA,GACjB;AACF;AAcA,eAAsB,WAAA,CAAY,QAAuB,MAAA,EAAiC;AACxF,EAAA,MAAM,CAAA,GAAI,eAAe,MAAM,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,CAAC,CAAA,CAAE,GAAA,EAAK,EAAE,EAAA,EAAI,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,CAAA,CAAE,KAAK,CAAA,CAAE,EAAA,EAAI,EAAE,EAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAE,EAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACnF,EAAA,OAAO,OAAA,CAAQ,QAAQ,OAAO,CAAA;AAChC;AA6BA,eAAsB,aAAA,CAAc,QAAuB,IAAA,EAA+C;AACxG,EAAA,MAAM,CAAA,GAAI,eAAe,MAAM,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAM,WAAA,CAAY,MAAA,EAAQ,KAAK,MAAM,CAAA;AAChD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,EAAA,EAAI;AAAA,GACN;AACA,EAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAChD,EAAA,OAAO,EAAE,GAAA,EAAK,CAAA,EAAG,WAAA,CAAY,IAAA,CAAK,GAAA,IAAO,MAAM,CAAC,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,EAAI,MAAA,EAAQ,QAAQ,EAAA,EAAG;AAC/E;AA6BA,eAAsB,cAAA,CAAe,MAAsB,MAAA,EAA6C;AACtG,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACd,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACd,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,EAAE,CAAA;AAAA,IACd,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,IACf,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACjB,MAAA,CAAO,KAAK,KAAK;AAAA,GACnB,CAAE,KAAK,GAAG,CAAA;AACV,EAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AAC9C,EAAA,OAAO,EAAE,KAAA,EAAO,eAAA,CAAgB,QAAA,EAAU,MAAA,CAAO,KAAK,EAAE,CAAA,CAAE,WAAA,EAAa,CAAA,EAAE;AAC3E","file":"index.js","sourcesContent":["/**\n * @lacspace/fonepay\n *\n * Fonepay (Nepal) merchant redirect — \"Request-To-Pay\" — over Web Crypto.\n * The merchant redirects the payer to Fonepay with an HMAC-SHA512-signed set\n * of request parameters (the `DV` data-validation field), and verifies the\n * `DV` on the response the same way.\n *\n * This package builds both signatures correctly:\n *\n *   1. Request DV — HMAC-SHA512 over the request fields joined by \",\" in the\n *      exact Fonepay order, lowercase hex.\n *   2. Response DV — HMAC-SHA512 over the response fields, constant-time\n *      compared to the returned `DV`.\n *\n * Zero dependencies. Isomorphic: Node 20+, edge runtimes and browsers — all\n * cryptography goes through `globalThis.crypto.subtle`, never hand-rolled.\n */\n\n/* ------------------------------------------------------------------ *\n * Endpoints\n * ------------------------------------------------------------------ */\n\nexport type Env = \"test\" | \"prod\";\n\n/** Fonepay merchant-request gateway URLs, by environment. */\nexport const GATEWAY_URL: Record<Env, string> = {\n  test: \"https://dev-clientapi.fonepay.com/api/merchantRequest\",\n  prod: \"https://clientapi.fonepay.com/api/merchantRequest\",\n};\n\n/* ------------------------------------------------------------------ *\n * HMAC-SHA512 (hex) helpers — isomorphic, zero-dep\n * ------------------------------------------------------------------ */\n\nconst enc = new TextEncoder();\n\nfunction toHex(bytes: Uint8Array): string {\n  let hex = \"\";\n  for (let i = 0; i < bytes.length; i++) hex += bytes[i]!.toString(16).padStart(2, \"0\");\n  return hex;\n}\n\n/** HMAC-SHA512 of `message` under `secret`, lowercase hex. */\nasync function hmacHex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    enc.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-512\" },\n    false,\n    [\"sign\"],\n  );\n  const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(message));\n  return toHex(new Uint8Array(sig));\n}\n\n/** Constant-time comparison of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  return diff === 0;\n}\n\n/* ------------------------------------------------------------------ *\n * Request signing\n * ------------------------------------------------------------------ */\n\nexport interface RequestParams {\n  /** Merchant code (PID). */\n  PID: string;\n  /** Method / mode. Default \"P\". */\n  MD?: string;\n  /** Product / reference number — unique per transaction. */\n  PRN: string;\n  /** Amount. */\n  AMT: string | number;\n  /** Currency. Default \"NPR\". */\n  CRN?: string;\n  /** Date (as required by Fonepay). */\n  DT: string;\n  /** Free field R1. */\n  R1: string;\n  /** Free field R2. */\n  R2: string;\n  /** Return URL. */\n  RU: string;\n}\n\ninterface ResolvedRequest {\n  PID: string;\n  MD: string;\n  PRN: string;\n  AMT: string;\n  CRN: string;\n  DT: string;\n  R1: string;\n  R2: string;\n  RU: string;\n}\n\nfunction resolveRequest(p: RequestParams): ResolvedRequest {\n  return {\n    PID: String(p.PID),\n    MD: String(p.MD ?? \"P\"),\n    PRN: String(p.PRN),\n    AMT: String(p.AMT),\n    CRN: String(p.CRN ?? \"NPR\"),\n    DT: String(p.DT),\n    R1: String(p.R1),\n    R2: String(p.R2),\n    RU: String(p.RU),\n  };\n}\n\n/**\n * Sign a Fonepay Request-To-Pay: HMAC-SHA512 over the request values joined by\n * \",\" in the exact order `PID,MD,PRN,AMT,CRN,DT,R1,R2,RU`. Returns lowercase\n * hex — this is the `DV` field. `MD` defaults to `\"P\"`, `CRN` to `\"NPR\"`.\n *\n * @example\n * const dv = await signRequest(\n *   { PID: \"MERCHANT\", PRN: \"prn-1\", AMT: 1000, DT: \"09/05/2026\",\n *     R1: \"test\", R2: \"test\", RU: \"https://shop.me/return\" },\n *   process.env.FONEPAY_SECRET!,\n * );\n */\nexport async function signRequest(params: RequestParams, secret: string): Promise<string> {\n  const r = resolveRequest(params);\n  const message = [r.PID, r.MD, r.PRN, r.AMT, r.CRN, r.DT, r.R1, r.R2, r.RU].join(\",\");\n  return hmacHex(secret, message);\n}\n\n/* ------------------------------------------------------------------ *\n * Redirect builder\n * ------------------------------------------------------------------ */\n\nexport interface BuildRedirectOptions {\n  secret: string;\n  /** Which gateway to target. Default \"test\" (dev). */\n  env?: Env;\n}\n\nexport interface Redirect {\n  /** The full redirect URL (gateway + urlencoded params, including `DV`). */\n  url: string;\n  /** All request params plus the computed `DV`. */\n  params: Record<string, string>;\n  /** The request signature. */\n  dv: string;\n}\n\n/**\n * Build the full Fonepay redirect: signs the request, assembles all params\n * (including `DV`) and produces the gateway URL with everything urlencoded.\n *\n * @example\n * const { url } = await buildRedirect(params, { secret, env: \"prod\" });\n * return Response.redirect(url, 302);\n */\nexport async function buildRedirect(params: RequestParams, opts: BuildRedirectOptions): Promise<Redirect> {\n  const r = resolveRequest(params);\n  const dv = await signRequest(params, opts.secret);\n  const fields: Record<string, string> = {\n    PID: r.PID,\n    MD: r.MD,\n    PRN: r.PRN,\n    AMT: r.AMT,\n    CRN: r.CRN,\n    DT: r.DT,\n    R1: r.R1,\n    R2: r.R2,\n    RU: r.RU,\n    DV: dv,\n  };\n  const qs = new URLSearchParams(fields).toString();\n  return { url: `${GATEWAY_URL[opts.env ?? \"test\"]}?${qs}`, params: fields, dv };\n}\n\n/* ------------------------------------------------------------------ *\n * Response verification\n * ------------------------------------------------------------------ */\n\nexport interface ResponseParams {\n  PRN: string;\n  PID: string;\n  PS: string;\n  RC: string;\n  UID: string;\n  BC: string;\n  INI: string;\n  P_AMT: string | number;\n  R_AMT: string | number;\n  /** The DV returned by Fonepay to verify. */\n  DV: string;\n}\n\n/**\n * Verify a Fonepay response: recompute HMAC-SHA512 over the response fields\n * joined by \",\" in the order `PRN,PID,PS,RC,UID,BC,INI,P_AMT,R_AMT`, then\n * constant-time compare it to the returned `DV`.\n *\n * @example\n * const { valid } = await verifyResponse(query, process.env.FONEPAY_SECRET!);\n * if (!valid) return new Response(\"Invalid Fonepay response\", { status: 400 });\n */\nexport async function verifyResponse(resp: ResponseParams, secret: string): Promise<{ valid: boolean }> {\n  const message = [\n    String(resp.PRN),\n    String(resp.PID),\n    String(resp.PS),\n    String(resp.RC),\n    String(resp.UID),\n    String(resp.BC),\n    String(resp.INI),\n    String(resp.P_AMT),\n    String(resp.R_AMT),\n  ].join(\",\");\n  const expected = await hmacHex(secret, message);\n  return { valid: timingSafeEqual(expected, String(resp.DV).toLowerCase()) };\n}\n"]}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@lacspace/fonepay",
+  "version": "1.0.0",
+  "description": "Fonepay (Nepal) merchant redirect / Request-To-Pay over Web Crypto — HMAC-SHA512 sign the request DV and verify the response DV. Zero-dep, isomorphic (Node, edge, browser).",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "fonepay",
+    "nepal",
+    "payment",
+    "payment-gateway",
+    "request-to-pay",
+    "hmac",
+    "hmac-sha512",
+    "web-crypto",
+    "isomorphic",
+    "edge",
+    "typescript"
+  ],
+  "author": "Lacspace <contact@lacspace.com>",
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://developer.lacspace.com/packages/fonepay",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lacspace/npm-packages.git",
+    "directory": "fonepay"
+  },
+  "bugs": {
+    "url": "https://github.com/lacspace/npm-packages/issues"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {},
+  "publishConfig": {
+    "access": "public"
+  }
+}