@mandateops/audit 0.0.0-stage → 0.1.0

package/dist/providers/crypto.js

@@ -0,0 +1,188 @@
+import { undocumented } from "./common.js";
+/** Rails on which a destination is an EVM address. */
+const BRIDGE_EVM_RAILS = [
+    "arbitrum",
+    "avalanche_c_chain",
+    "base",
+    "celo",
+    "ethereum",
+    "linea",
+    "optimism",
+    "polygon",
+    "tempo",
+    "xdc",
+];
+/** Bridge's crypto rails; which of them carry USDC is unverified. */
+const BRIDGE_RAILS = [...BRIDGE_EVM_RAILS, "solana", "stellar", "tron"];
+/**
+ * Circle's native USDC contract on each EVM rail, from
+ * https://developers.circle.com/stablecoins/usdc-contract-addresses.
+ */
+const USDC_CONTRACTS = {
+    "usdc@arbitrum": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
+    "usdc@avalanche_c_chain": "0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E",
+    "usdc@base": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    "usdc@celo": "0xcebA9300f2b948710d2653dD7B07f33A8B32118C",
+    "usdc@ethereum": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
+    "usdc@linea": "0x176211869cA2b568f2A7D4EE941E073a821EE1ff",
+    "usdc@optimism": "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85",
+    "usdc@polygon": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
+};
+/**
+ * `POST /v0/transfers`, USDC out on the rail the request names. `amount` is in
+ * the source currency if fiat, else the fiat it pegs, so a USDC source reads at
+ * USD scale while staying its own term; `destination.amount` is in the destination currency, with the term
+ * written `usdc-from-eur` so what funds it stays bound, and giving both is
+ * refused. The source currencies listed are unverified. A new transfer
+ * starts `awaiting_funds`; later states are not imitated. Bridge replays the
+ * original for a key for 24 hours and errors on a changed body; that error's
+ * status and body are unverified, and 400 is the listed status that fits.
+ * `client_reference_id` is optional, so the payment then takes the key.
+ */
+export const bridge = (terms) => ({
+    path: "/v0/transfers",
+    credential: { header: "api-key", prefix: "" },
+    key: { header: "idempotency-key" },
+    fields: {
+        payment: "client_reference_id",
+        account: "on_behalf_of",
+        amount: "amount",
+        currency: "source.currency",
+        asset: "destination.currency",
+        network: "destination.payment_rail",
+        destination: "destination.to_address",
+    },
+    alternateAmount: {
+        path: "destination.amount",
+        currency: "destination.currency",
+    },
+    pegged: { currency: { usdc: "usd" } },
+    fixed: terms,
+    amount: {
+        scaleTerm: "currency",
+        scales: { usd: 2, eur: 2, gbp: 2, mxn: 2, usdc: 6 },
+        networks: { usdc: BRIDGE_RAILS },
+        contracts: USDC_CONTRACTS,
+        evmNetworks: BRIDGE_EVM_RAILS,
+    },
+    replies: {
+        paid: {
+            status: 201,
+            body: {
+                id: "{{effectId}}",
+                client_reference_id: "{{payment}}",
+                amount: "{{amountMajor}}",
+                state: "awaiting_funds",
+                destination: {
+                    currency: "{{asset}}",
+                    payment_rail: "{{network}}",
+                    to_address: "{{destination}}",
+                },
+            },
+        },
+        declined: undocumented(400),
+        conflict: undocumented(400),
+    },
+});
+/**
+ * `POST /v1/businessAccount/transfers`, USDC only, written as currency `USD`.
+ * The destination is a registered address id, whose chain Circle looks up, so
+ * asset and network are declared. `source.id` names the paying wallet;
+ * `account` is what its absence means. The reply's `{ data }` wrapper is
+ * documented, and a failure is a 201 with `status: failed`. The key must be a
+ * UUID v4. The repeat-key reply, behaviour on a changed body and the scale of
+ * six are unverified.
+ */
+export const circleMint = ({ account, ...terms }) => ({
+    path: "/v1/businessAccount/transfers",
+    key: { field: "idempotencyKey", shape: "uuid_v4" },
+    fields: {
+        account: "source.id",
+        amount: "amount.amount",
+        currency: "amount.currency",
+        destination: "destination.addressId",
+    },
+    defaults: { account },
+    fixed: terms,
+    amount: { scaleTerm: "currency", scales: { USD: 6 } },
+    replies: {
+        paid: {
+            status: 201,
+            body: {
+                data: {
+                    id: "{{effectId}}",
+                    status: "pending",
+                    amount: { amount: "{{amountMajor}}", currency: "{{currency}}" },
+                },
+            },
+        },
+        declined: {
+            status: 201,
+            body: {
+                data: {
+                    id: "{{payment}}",
+                    status: "failed",
+                    errorCode: "insufficient_funds",
+                    amount: { amount: "{{amountMajor}}", currency: "{{currency}}" },
+                },
+            },
+        },
+        conflict: undocumented(409),
+    },
+});
+/** The lab's own code for a reused id; Fireblocks' is unverified. */
+const DUPLICATE_ID_CODE = 1438;
+/** Lab ids for the two assets, each on the network it implies. */
+const FIREBLOCKS_NETWORKS = { USDC: ["ethereum"], ETH: ["ethereum"] };
+/**
+ * `POST /v1/transactions`, USDC and ETH to a one-time address from a vault,
+ * signed per request. Fireblocks keys transactions on `externalTxId` and
+ * refuses a reused one with 400, so a retrying client must read that as already
+ * sent. A refused id stays refused. The network is declared and must be the one
+ * the asset implies; only the assets listed are supported. A
+ * reply of `SUBMITTED` is not completion. A create answers 200. Failure bodies
+ * follow the documented `{ message, code }`; their messages are unverified.
+ * Sources disagree on whether `externalTxId` is mandatory: the official SDK
+ * marks it optional, so a call without one has no idempotency and is its own
+ * payment. It is at most 255 characters.
+ */
+export const fireblocks = (terms) => {
+    const duplicate = {
+        status: 400,
+        body: { message: "External tx id already used", code: DUPLICATE_ID_CODE },
+    };
+    return {
+        path: "/v1/transactions",
+        credential: { signedJwt: true },
+        key: { field: "externalTxId", optional: true, maxLength: 255 },
+        fields: {
+            account: "source.id",
+            amount: "amount",
+            currency: "assetId",
+            asset: "assetId",
+            destination: "destination.oneTimeAddress.address",
+        },
+        fixed: terms,
+        amount: {
+            scaleTerm: "asset",
+            scales: { USDC: 6, ETH: 18 },
+            networks: FIREBLOCKS_NETWORKS,
+            contracts: { "USDC@ethereum": USDC_CONTRACTS["usdc@ethereum"] },
+            evmNetworks: ["ethereum"],
+        },
+        replay: "duplicate_reply",
+        refusals: "final",
+        replies: {
+            paid: {
+                status: 200,
+                body: { id: "{{effectId}}", status: "SUBMITTED", systemMessages: [] },
+            },
+            declined: {
+                status: 400,
+                body: { message: "Transaction refused", code: 0 },
+            },
+            conflict: duplicate,
+            duplicate,
+        },
+    };
+};

package/dist/providers/fiat.d.ts

@@ -0,0 +1,106 @@
+import type { CheckoutTerms, LedgerTerms, MollieTerms, ProviderWire, SourcedTerms, StagedWire, TermDefaults, WiseRoutes, WiseTerms } from "./types.js";
+/**
+ * `POST /transfer`, from Paystack's published OpenAPI description. The amount
+ * is in kobo or pesewas, and a reference is lowercase alphanumeric with `-` and
+ * `_`. Reuse of a reference is unverified: its docs both reject one and advise
+ * retrying with it. `currency` is optional there, defaulting to NGN.
+ */
+export declare const paystack: (terms: LedgerTerms) => ProviderWire;
+/** `POST /v1/payouts`. A request without `destination` is refused here. */
+export declare const stripePayouts: (terms: LedgerTerms) => ProviderWire;
+/** `POST /v1/transfers`, to a connected account. */
+export declare const stripeTransfers: (terms: LedgerTerms) => ProviderWire;
+/**
+ * `POST /v3/transfers`. Keyed on the unique `reference`, as v3 coverage of
+ * `X-Idempotency-Key` and v3 reference reuse are unverified. The amount is a
+ * required integer whose unit is not stated, though samples look major; it is
+ * read as given. A synchronous refusal is unverified. The destination is
+ * `bank_account`, so a run authorises the two joined.
+ */
+export declare const flutterwave: (terms: LedgerTerms) => ProviderWire;
+/**
+ * `POST /transfers` of the Transfers API, to a transfer instrument. A refusal
+ * is a 202, as the published specification shows, and 422 is its validation
+ * status. A processed retry gets the first response; a reused key with a
+ * different body is unverified.
+ */
+export declare const adyen: (terms: SourcedTerms) => ProviderWire;
+/**
+ * `POST /transfers` between entities; the sample names no currency. Idempotency
+ * is documented for this route: only 2xx replies are cached, and a concurrent
+ * repeat gets 409. The field names come from non-canonical sources, and the
+ * amount's unit, the credential scheme and all failures are unverified.
+ */
+export declare const checkout: (terms: CheckoutTerms) => ProviderWire;
+/**
+ * `POST /v1/payments/payouts`, one item per batch. An email receiver is not an
+ * identifier the lab can hold. A repeated batch id is rejected with a link to
+ * the original batch, within 30 days; that status is unverified. Insufficient
+ * funds is documented per item, so a synchronous refusal is unverified.
+ */
+export declare const paypal: (terms: LedgerTerms) => ProviderWire;
+/**
+ * `POST /v1/payouts`. A repeated key returns the first response; a changed body
+ * is unverified. Low balance is a payout state, so a refusal is a reply whose
+ * status says so, and every HTTP status here is unverified.
+ */
+export declare const razorpayx: (terms: SourcedTerms) => ProviderWire;
+/**
+ * `POST /v2/payouts`, to the balance's configured bank account. `balanceId` is
+ * optional; `account` is what its absence means. Omitting `amount` pays out the
+ * whole balance, which the suite states as `wholeBalance`. The reply's
+ * `statusReason` is left out, as its codes are unverified.
+ */
+export declare const molliePayouts: ({ account, wholeBalance, ...terms }: MollieTerms) => ProviderWire;
+/**
+ * `POST /api/merchants/{merchantId}/payouts`, one payout per request. Failures
+ * are documented as `{ title, message, code }`; which code fits each refusal is
+ * unverified, so their bodies stay empty. The merchant is the account, and the
+ * destination is `branchCode--accountNumber`. A payout without `payoutId` has no
+ * idempotency, so each such request is its own payment.
+ */
+export declare const peach: (terms: SourcedTerms) => ProviderWire;
+/**
+ * `POST /v2/disbursements`, ZAR only. The amount is read as decimal, and a
+ * repeated nonce gets 409. Insufficient funds is documented as a later `error`
+ * status, so a refusal is a reply in that status. The destination is
+ * `bankId--accountNumber`.
+ */
+export declare const stitch: (terms: LedgerTerms) => ProviderWire;
+/**
+ * `POST /pay`, from `account_id` to a counterparty's account, per Revolut's
+ * OpenAPI description. A reused `request_id` makes no second transaction and
+ * answers the documented 400 for two weeks. The id is at most 40 characters.
+ */
+export declare const revolut: (terms: SourcedTerms) => ProviderWire;
+/**
+ * `POST /api/payment_orders`. A key is at most 180 characters, and only
+ * successes are cached, with a concurrent repeat getting 409. The reply holds a
+ * few of the object's fields; its status, a changed body and the failures are
+ * unverified. `currency` is optional
+ * there, taken from the originating account, so pass it in `defaults`.
+ */
+export declare const modernTreasury: (terms: SourcedTerms, defaults?: TermDefaults) => ProviderWire;
+/**
+ * `POST /api/v1/transfers/create`. The amount is a string in the schema and a
+ * number in the example; either is read, as decimal, which is unverified, as
+ * is the `transfer_amount` name. Both failure codes are from Airwallex's
+ * transfer error list.
+ */
+export declare const airwallex: (terms: LedgerTerms) => ProviderWire;
+/**
+ * `POST /transfers`, answered by a `Location`, relative so a client following
+ * it stays in the lab. A repeated key gets 201 with the same `Location`; a 409
+ * there means the original is still processing, so it is not used for a changed
+ * body, whose status is unverified, as are failure bodies.
+ */
+export declare const dwolla: (terms: SourcedTerms) => ProviderWire;
+/**
+ * Quote, transfer, then fund, from Wise's API reference. Only the fund call
+ * moves money. The account is the quote's profile, the currency its source and
+ * the asset its target; `customerTransactionId` is the key, and a repeat makes
+ * no duplicate, though its reply body and quote reuse are unverified. Wise also
+ * serves dated bases such as `/2026Q4`, so a client may override the routes.
+ * Recipient creation is not imitated.
+ */
+export declare const wise: (terms: WiseTerms, routes?: WiseRoutes) => StagedWire;