@murai-wallet/gateway-stripe 1.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 murai contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,39 @@
+# @murai-wallet/gateway-stripe
+
+Stripe Checkout payment gateway adapter for [Murai](https://github.com/ebuntario/murai).
+
+Supports global card payments, Apple Pay, and Google Pay via Stripe Checkout.
+
+## Install
+
+```bash
+npm install @murai-wallet/gateway-stripe @murai-wallet/core stripe
+```
+
+## Usage
+
+```typescript
+import { createStripeGateway } from '@murai-wallet/gateway-stripe';
+
+const gateway = createStripeGateway({
+  secretKey: process.env.STRIPE_SECRET_KEY,
+  webhookSecret: process.env.STRIPE_WEBHOOK_SECRET,
+});
+
+// Use with createCheckoutManager from @murai-wallet/core
+```
+
+## Features
+
+- Stripe Checkout Session integration
+- Webhook signature verification via Stripe SDK
+- Payment status polling
+- Supports all Stripe-enabled payment methods
+
+## Documentation
+
+Full docs: [ebuntario.github.io/murai](https://ebuntario.github.io/murai)
+
+## License
+
+[MIT](../../LICENSE)

package/dist/index.cjs

@@ -0,0 +1,153 @@
+'use strict';
+
+var crypto = require('crypto');
+var core = require('@murai-wallet/core');
+
+// src/index.ts
+var STRIPE_TIMESTAMP_TOLERANCE_SECONDS = 300;
+function parseStripeSignature(header) {
+  const parts = header.split(",");
+  let timestamp = "";
+  const signatures = [];
+  for (const part of parts) {
+    const [key, value] = part.split("=");
+    if (!key || !value) return null;
+    if (key === "t") {
+      timestamp = value;
+    } else if (key === "v1") {
+      signatures.push(value);
+    }
+  }
+  if (!timestamp || signatures.length === 0) return null;
+  return { timestamp, signatures };
+}
+var statusMap = {
+  paid: "success",
+  no_payment_required: "success",
+  unpaid: "pending"
+};
+function createStripeGateway(config) {
+  const timeoutMs = config.timeoutMs ?? 3e4;
+  const authHeader = `Bearer ${config.secretKey}`;
+  async function createCheckout(params) {
+    const orderId = `${params.userId}-${crypto.randomUUID()}`;
+    const body = new URLSearchParams({
+      mode: "payment",
+      success_url: params.successRedirectUrl,
+      cancel_url: params.failureRedirectUrl,
+      "line_items[0][price_data][currency]": "usd",
+      "line_items[0][price_data][unit_amount]": String(params.amount),
+      "line_items[0][price_data][product_data][name]": "Token Top-Up",
+      "line_items[0][quantity]": "1",
+      "metadata[order_id]": orderId
+    });
+    const res = await fetch("https://api.stripe.com/v1/checkout/sessions", {
+      method: "POST",
+      headers: {
+        Authorization: authHeader,
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Idempotency-Key": orderId
+      },
+      body: body.toString(),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) {
+      throw new core.GatewayError("stripe", res.status, await res.text());
+    }
+    const data = await res.json();
+    return {
+      id: orderId,
+      userId: params.userId,
+      amount: params.amount,
+      redirectUrl: data.url,
+      status: "pending",
+      createdAt: /* @__PURE__ */ new Date()
+    };
+  }
+  async function verifyWebhook(_payload, signature, rawBody) {
+    if (!rawBody) {
+      throw new core.GatewayError(
+        "stripe",
+        void 0,
+        "rawBody is required for Stripe webhook verification"
+      );
+    }
+    const parsed = parseStripeSignature(signature);
+    if (!parsed) return false;
+    const timestampSeconds = Number(parsed.timestamp);
+    if (!Number.isFinite(timestampSeconds)) return false;
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    if (Math.abs(nowSeconds - timestampSeconds) > STRIPE_TIMESTAMP_TOLERANCE_SECONDS) {
+      return false;
+    }
+    const signedPayload = `${parsed.timestamp}.${typeof rawBody === "string" ? rawBody : rawBody.toString("utf8")}`;
+    const expectedSig = crypto.createHmac("sha256", config.webhookSecret).update(signedPayload).digest("hex");
+    const expectedBuf = Buffer.from(expectedSig, "hex");
+    for (const sig of parsed.signatures) {
+      try {
+        const sigBuf = Buffer.from(sig, "hex");
+        if (sigBuf.length !== expectedBuf.length) continue;
+        if (crypto.timingSafeEqual(sigBuf, expectedBuf)) return true;
+      } catch {
+      }
+    }
+    return false;
+  }
+  function parseWebhookPayload(payload) {
+    if (typeof payload !== "object" || payload === null) return null;
+    const event = payload;
+    if (typeof event.type !== "string") return null;
+    if (event.type === "checkout.session.completed") {
+      const data = event.data;
+      if (!data || typeof data.object !== "object" || data.object === null) return null;
+      const session = data.object;
+      const metadata = session.metadata;
+      if (!metadata || typeof metadata.order_id !== "string") return null;
+      const amountTotal = session.amount_total;
+      if (typeof amountTotal !== "number" || !Number.isFinite(amountTotal)) return null;
+      return {
+        orderId: metadata.order_id,
+        status: "success",
+        grossAmount: amountTotal
+      };
+    }
+    if (event.type === "checkout.session.expired") {
+      const data = event.data;
+      if (!data || typeof data.object !== "object" || data.object === null) return null;
+      const session = data.object;
+      const metadata = session.metadata;
+      if (!metadata || typeof metadata.order_id !== "string") return null;
+      const amountTotal = session.amount_total;
+      if (typeof amountTotal !== "number" || !Number.isFinite(amountTotal)) return null;
+      return {
+        orderId: metadata.order_id,
+        status: "expired",
+        grossAmount: amountTotal
+      };
+    }
+    return null;
+  }
+  async function getPaymentStatus(sessionId) {
+    const res = await fetch(
+      `https://api.stripe.com/v1/checkout/sessions/${encodeURIComponent(sessionId)}`,
+      {
+        headers: {
+          Authorization: authHeader,
+          Accept: "application/json"
+        },
+        signal: AbortSignal.timeout(timeoutMs)
+      }
+    );
+    if (!res.ok) {
+      throw new core.GatewayError("stripe", res.status, await res.text());
+    }
+    const data = await res.json();
+    const status = statusMap[data.payment_status];
+    return status ?? "failed";
+  }
+  return { createCheckout, verifyWebhook, parseWebhookPayload, getPaymentStatus };
+}
+
+exports.createStripeGateway = createStripeGateway;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["randomUUID","GatewayError","createHmac","timingSafeEqual"],"mappings":";;;;;;AAoBA,IAAM,kCAAA,GAAqC,GAAA;AAE3C,SAAS,qBAAqB,MAAA,EAA6C;AAC1E,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AAC9B,EAAA,IAAI,SAAA,GAAY,EAAA;AAChB,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,IAAA,MAAM,CAAC,GAAA,EAAK,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACnC,IAAA,IAAI,CAAC,GAAA,IAAO,CAAC,KAAA,EAAO,OAAO,IAAA;AAC3B,IAAA,IAAI,QAAQ,GAAA,EAAK;AAChB,MAAA,SAAA,GAAY,KAAA;AAAA,IACb,CAAA,MAAA,IAAW,QAAQ,IAAA,EAAM;AACxB,MAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,IACtB;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,SAAA,IAAa,UAAA,CAAW,MAAA,KAAW,GAAG,OAAO,IAAA;AAClD,EAAA,OAAO,EAAE,WAAW,UAAA,EAAW;AAChC;AAEA,IAAM,SAAA,GAA2C;AAAA,EAChD,IAAA,EAAM,SAAA;AAAA,EACN,mBAAA,EAAqB,SAAA;AAAA,EACrB,MAAA,EAAQ;AACT,CAAA;AAEO,SAAS,oBAAoB,MAAA,EAElC;AACD,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACtC,EAAA,MAAM,UAAA,GAAa,CAAA,OAAA,EAAU,MAAA,CAAO,SAAS,CAAA,CAAA;AAE7C,EAAA,eAAe,eAAe,MAAA,EAKD;AAC5B,IAAA,MAAM,UAAU,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,CAAA,EAAIA,mBAAY,CAAA,CAAA;AAEhD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAChC,IAAA,EAAM,SAAA;AAAA,MACN,aAAa,MAAA,CAAO,kBAAA;AAAA,MACpB,YAAY,MAAA,CAAO,kBAAA;AAAA,MACnB,qCAAA,EAAuC,KAAA;AAAA,MACvC,wCAAA,EAA0C,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAAA,MAC9D,+CAAA,EAAiD,cAAA;AAAA,MACjD,yBAAA,EAA2B,GAAA;AAAA,MAC3B,oBAAA,EAAsB;AAAA,KACtB,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,6CAAA,EAA+C;AAAA,MACtE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,aAAA,EAAe,UAAA;AAAA,QACf,cAAA,EAAgB,mCAAA;AAAA,QAChB,iBAAA,EAAmB;AAAA,OACpB;AAAA,MACA,IAAA,EAAM,KAAK,QAAA,EAAS;AAAA,MACpB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS;AAAA,KACrC,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACZ,MAAA,MAAM,IAAIC,kBAAa,QAAA,EAAU,GAAA,CAAI,QAAQ,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAE7B,IAAA,OAAO;AAAA,MACN,EAAA,EAAI,OAAA;AAAA,MACJ,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,aAAa,IAAA,CAAK,GAAA;AAAA,MAClB,MAAA,EAAQ,SAAA;AAAA,MACR,SAAA,sBAAe,IAAA;AAAK,KACrB;AAAA,EACD;AAEA,EAAA,eAAe,aAAA,CACd,QAAA,EACA,SAAA,EACA,OAAA,EACmB;AACnB,IAAA,IAAI,CAAC,OAAA,EAAS;AACb,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACT,QAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,MAAA,GAAS,qBAAqB,SAAS,CAAA;AAC7C,IAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAGpB,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,gBAAgB,GAAG,OAAO,KAAA;AAE/C,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,UAAA,GAAa,gBAAgB,IAAI,kCAAA,EAAoC;AACjF,MAAA,OAAO,KAAA;AAAA,IACR;AAGA,IAAA,MAAM,aAAA,GAAgB,CAAA,EAAG,MAAA,CAAO,SAAS,CAAA,CAAA,EAAI,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAC,CAAA,CAAA;AAC7G,IAAA,MAAM,WAAA,GAAcC,iBAAA,CAAW,QAAA,EAAU,MAAA,CAAO,aAAa,EAC3D,MAAA,CAAO,aAAa,CAAA,CACpB,MAAA,CAAO,KAAK,CAAA;AAGd,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,KAAK,CAAA;AAClD,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,UAAA,EAAY;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA;AACrC,QAAA,IAAI,MAAA,CAAO,MAAA,KAAW,WAAA,CAAY,MAAA,EAAQ;AAC1C,QAAA,IAAIC,sBAAA,CAAgB,MAAA,EAAQ,WAAW,CAAA,EAAG,OAAO,IAAA;AAAA,MAClD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAEA,EAAA,SAAS,oBACR,OAAA,EACyE;AACzE,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,MAAM,OAAO,IAAA;AAE5D,IAAA,MAAM,KAAA,GAAQ,OAAA;AAId,IAAA,IAAI,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AAE3C,IAAA,IAAI,KAAA,CAAM,SAAS,4BAAA,EAA8B;AAChD,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,MAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,CAAK,WAAW,QAAA,IAAY,IAAA,CAAK,MAAA,KAAW,IAAA,EAAM,OAAO,IAAA;AAE7E,MAAA,MAAM,UAAU,IAAA,CAAK,MAAA;AAKrB,MAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AACzB,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,QAAA,KAAa,UAAU,OAAO,IAAA;AAE/D,MAAA,MAAM,cAAc,OAAA,CAAQ,YAAA;AAC5B,MAAA,IAAI,OAAO,gBAAgB,QAAA,IAAY,CAAC,OAAO,QAAA,CAAS,WAAW,GAAG,OAAO,IAAA;AAE7E,MAAA,OAAO;AAAA,QACN,SAAS,QAAA,CAAS,QAAA;AAAA,QAClB,MAAA,EAAQ,SAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACd;AAAA,IACD;AAEA,IAAA,IAAI,KAAA,CAAM,SAAS,0BAAA,EAA4B;AAC9C,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,MAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,CAAK,WAAW,QAAA,IAAY,IAAA,CAAK,MAAA,KAAW,IAAA,EAAM,OAAO,IAAA;AAE7E,MAAA,MAAM,UAAU,IAAA,CAAK,MAAA;AAKrB,MAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AACzB,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,QAAA,KAAa,UAAU,OAAO,IAAA;AAE/D,MAAA,MAAM,cAAc,OAAA,CAAQ,YAAA;AAC5B,MAAA,IAAI,OAAO,gBAAgB,QAAA,IAAY,CAAC,OAAO,QAAA,CAAS,WAAW,GAAG,OAAO,IAAA;AAE7E,MAAA,OAAO;AAAA,QACN,SAAS,QAAA,CAAS,QAAA;AAAA,QAClB,MAAA,EAAQ,SAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACd;AAAA,IACD;AAGA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,eAAe,iBAAiB,SAAA,EAA2C;AAC1E,IAAA,MAAM,MAAM,MAAM,KAAA;AAAA,MACjB,CAAA,4CAAA,EAA+C,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,MAC5E;AAAA,QACC,OAAA,EAAS;AAAA,UACR,aAAA,EAAe,UAAA;AAAA,UACf,MAAA,EAAQ;AAAA,SACT;AAAA,QACA,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS;AAAA;AACtC,KACD;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACZ,MAAA,MAAM,IAAIF,kBAAa,QAAA,EAAU,GAAA,CAAI,QAAQ,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,IAAA,CAAK,cAAc,CAAA;AAC5C,IAAA,OAAO,MAAA,IAAU,QAAA;AAAA,EAClB;AAEA,EAAA,OAAO,EAAE,cAAA,EAAgB,aAAA,EAAe,mBAAA,EAAqB,gBAAA,EAAiB;AAC/E","file":"index.cjs","sourcesContent":["// @murai-wallet/gateway-stripe\n// Stripe Checkout payment gateway adapter\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\nimport { randomUUID } from 'node:crypto';\nimport { GatewayError } from '@murai-wallet/core';\nimport type { CheckoutSession, PaymentGatewayAdapter, WebhookStatus } from '@murai-wallet/core';\n\nexport interface StripeConfig {\n\tsecretKey: string;\n\twebhookSecret: string;\n\t/** Fetch timeout in ms — defaults to 30000 */\n\ttimeoutMs?: number;\n}\n\ninterface StripeSignatureParts {\n\ttimestamp: string;\n\tsignatures: string[];\n}\n\nconst STRIPE_TIMESTAMP_TOLERANCE_SECONDS = 300; // 5 minutes\n\nfunction parseStripeSignature(header: string): StripeSignatureParts | null {\n\tconst parts = header.split(',');\n\tlet timestamp = '';\n\tconst signatures: string[] = [];\n\n\tfor (const part of parts) {\n\t\tconst [key, value] = part.split('=');\n\t\tif (!key || !value) return null;\n\t\tif (key === 't') {\n\t\t\ttimestamp = value;\n\t\t} else if (key === 'v1') {\n\t\t\tsignatures.push(value);\n\t\t}\n\t}\n\n\tif (!timestamp || signatures.length === 0) return null;\n\treturn { timestamp, signatures };\n}\n\nconst statusMap: Record<string, WebhookStatus> = {\n\tpaid: 'success',\n\tno_payment_required: 'success',\n\tunpaid: 'pending',\n};\n\nexport function createStripeGateway(config: StripeConfig): PaymentGatewayAdapter & {\n\tgetPaymentStatus(sessionId: string): Promise<WebhookStatus>;\n} {\n\tconst timeoutMs = config.timeoutMs ?? 30000;\n\tconst authHeader = `Bearer ${config.secretKey}`;\n\n\tasync function createCheckout(params: {\n\t\tuserId: string;\n\t\tamount: number;\n\t\tsuccessRedirectUrl: string;\n\t\tfailureRedirectUrl: string;\n\t}): Promise<CheckoutSession> {\n\t\tconst orderId = `${params.userId}-${randomUUID()}`;\n\n\t\tconst body = new URLSearchParams({\n\t\t\tmode: 'payment',\n\t\t\tsuccess_url: params.successRedirectUrl,\n\t\t\tcancel_url: params.failureRedirectUrl,\n\t\t\t'line_items[0][price_data][currency]': 'usd',\n\t\t\t'line_items[0][price_data][unit_amount]': String(params.amount),\n\t\t\t'line_items[0][price_data][product_data][name]': 'Token Top-Up',\n\t\t\t'line_items[0][quantity]': '1',\n\t\t\t'metadata[order_id]': orderId,\n\t\t});\n\n\t\tconst res = await fetch('https://api.stripe.com/v1/checkout/sessions', {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\tAuthorization: authHeader,\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t\t'Idempotency-Key': orderId,\n\t\t\t},\n\t\t\tbody: body.toString(),\n\t\t\tsignal: AbortSignal.timeout(timeoutMs),\n\t\t});\n\n\t\tif (!res.ok) {\n\t\t\tthrow new GatewayError('stripe', res.status, await res.text());\n\t\t}\n\n\t\tconst data = (await res.json()) as { url: string };\n\n\t\treturn {\n\t\t\tid: orderId,\n\t\t\tuserId: params.userId,\n\t\t\tamount: params.amount,\n\t\t\tredirectUrl: data.url,\n\t\t\tstatus: 'pending',\n\t\t\tcreatedAt: new Date(),\n\t\t};\n\t}\n\n\tasync function verifyWebhook(\n\t\t_payload: unknown,\n\t\tsignature: string,\n\t\trawBody?: string | Buffer,\n\t): Promise<boolean> {\n\t\tif (!rawBody) {\n\t\t\tthrow new GatewayError(\n\t\t\t\t'stripe',\n\t\t\t\tundefined,\n\t\t\t\t'rawBody is required for Stripe webhook verification',\n\t\t\t);\n\t\t}\n\n\t\tconst parsed = parseStripeSignature(signature);\n\t\tif (!parsed) return false;\n\n\t\t// Check timestamp tolerance\n\t\tconst timestampSeconds = Number(parsed.timestamp);\n\t\tif (!Number.isFinite(timestampSeconds)) return false;\n\n\t\tconst nowSeconds = Math.floor(Date.now() / 1000);\n\t\tif (Math.abs(nowSeconds - timestampSeconds) > STRIPE_TIMESTAMP_TOLERANCE_SECONDS) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// Compute expected signature\n\t\tconst signedPayload = `${parsed.timestamp}.${typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8')}`;\n\t\tconst expectedSig = createHmac('sha256', config.webhookSecret)\n\t\t\t.update(signedPayload)\n\t\t\t.digest('hex');\n\n\t\t// Timing-safe compare against any v1 signature\n\t\tconst expectedBuf = Buffer.from(expectedSig, 'hex');\n\t\tfor (const sig of parsed.signatures) {\n\t\t\ttry {\n\t\t\t\tconst sigBuf = Buffer.from(sig, 'hex');\n\t\t\t\tif (sigBuf.length !== expectedBuf.length) continue;\n\t\t\t\tif (timingSafeEqual(sigBuf, expectedBuf)) return true;\n\t\t\t} catch {\n\t\t\t\t// invalid hex — skip\n\t\t\t}\n\t\t}\n\n\t\treturn false;\n\t}\n\n\tfunction parseWebhookPayload(\n\t\tpayload: unknown,\n\t): { orderId: string; status: WebhookStatus; grossAmount: number } | null {\n\t\tif (typeof payload !== 'object' || payload === null) return null;\n\n\t\tconst event = payload as {\n\t\t\ttype: unknown;\n\t\t\tdata: unknown;\n\t\t};\n\t\tif (typeof event.type !== 'string') return null;\n\n\t\tif (event.type === 'checkout.session.completed') {\n\t\t\tconst data = event.data as { object: unknown } | undefined;\n\t\t\tif (!data || typeof data.object !== 'object' || data.object === null) return null;\n\n\t\t\tconst session = data.object as {\n\t\t\t\tmetadata: unknown;\n\t\t\t\tamount_total: unknown;\n\t\t\t};\n\n\t\t\tconst metadata = session.metadata as { order_id: unknown } | undefined;\n\t\t\tif (!metadata || typeof metadata.order_id !== 'string') return null;\n\n\t\t\tconst amountTotal = session.amount_total;\n\t\t\tif (typeof amountTotal !== 'number' || !Number.isFinite(amountTotal)) return null;\n\n\t\t\treturn {\n\t\t\t\torderId: metadata.order_id,\n\t\t\t\tstatus: 'success',\n\t\t\t\tgrossAmount: amountTotal,\n\t\t\t};\n\t\t}\n\n\t\tif (event.type === 'checkout.session.expired') {\n\t\t\tconst data = event.data as { object: unknown } | undefined;\n\t\t\tif (!data || typeof data.object !== 'object' || data.object === null) return null;\n\n\t\t\tconst session = data.object as {\n\t\t\t\tmetadata: unknown;\n\t\t\t\tamount_total: unknown;\n\t\t\t};\n\n\t\t\tconst metadata = session.metadata as { order_id: unknown } | undefined;\n\t\t\tif (!metadata || typeof metadata.order_id !== 'string') return null;\n\n\t\t\tconst amountTotal = session.amount_total;\n\t\t\tif (typeof amountTotal !== 'number' || !Number.isFinite(amountTotal)) return null;\n\n\t\t\treturn {\n\t\t\t\torderId: metadata.order_id,\n\t\t\t\tstatus: 'expired',\n\t\t\t\tgrossAmount: amountTotal,\n\t\t\t};\n\t\t}\n\n\t\t// Unrecognized event type\n\t\treturn null;\n\t}\n\n\tasync function getPaymentStatus(sessionId: string): Promise<WebhookStatus> {\n\t\tconst res = await fetch(\n\t\t\t`https://api.stripe.com/v1/checkout/sessions/${encodeURIComponent(sessionId)}`,\n\t\t\t{\n\t\t\t\theaders: {\n\t\t\t\t\tAuthorization: authHeader,\n\t\t\t\t\tAccept: 'application/json',\n\t\t\t\t},\n\t\t\t\tsignal: AbortSignal.timeout(timeoutMs),\n\t\t\t},\n\t\t);\n\n\t\tif (!res.ok) {\n\t\t\tthrow new GatewayError('stripe', res.status, await res.text());\n\t\t}\n\n\t\tconst data = (await res.json()) as { payment_status: string };\n\t\tconst status = statusMap[data.payment_status];\n\t\treturn status ?? 'failed';\n\t}\n\n\treturn { createCheckout, verifyWebhook, parseWebhookPayload, getPaymentStatus };\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,13 @@
+import { PaymentGatewayAdapter, WebhookStatus } from '@murai-wallet/core';
+
+interface StripeConfig {
+    secretKey: string;
+    webhookSecret: string;
+    /** Fetch timeout in ms — defaults to 30000 */
+    timeoutMs?: number;
+}
+declare function createStripeGateway(config: StripeConfig): PaymentGatewayAdapter & {
+    getPaymentStatus(sessionId: string): Promise<WebhookStatus>;
+};
+
+export { type StripeConfig, createStripeGateway };

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+import { PaymentGatewayAdapter, WebhookStatus } from '@murai-wallet/core';
+
+interface StripeConfig {
+    secretKey: string;
+    webhookSecret: string;
+    /** Fetch timeout in ms — defaults to 30000 */
+    timeoutMs?: number;
+}
+declare function createStripeGateway(config: StripeConfig): PaymentGatewayAdapter & {
+    getPaymentStatus(sessionId: string): Promise<WebhookStatus>;
+};
+
+export { type StripeConfig, createStripeGateway };

package/dist/index.js

@@ -0,0 +1,151 @@
+import { randomUUID, createHmac, timingSafeEqual } from 'crypto';
+import { GatewayError } from '@murai-wallet/core';
+
+// src/index.ts
+var STRIPE_TIMESTAMP_TOLERANCE_SECONDS = 300;
+function parseStripeSignature(header) {
+  const parts = header.split(",");
+  let timestamp = "";
+  const signatures = [];
+  for (const part of parts) {
+    const [key, value] = part.split("=");
+    if (!key || !value) return null;
+    if (key === "t") {
+      timestamp = value;
+    } else if (key === "v1") {
+      signatures.push(value);
+    }
+  }
+  if (!timestamp || signatures.length === 0) return null;
+  return { timestamp, signatures };
+}
+var statusMap = {
+  paid: "success",
+  no_payment_required: "success",
+  unpaid: "pending"
+};
+function createStripeGateway(config) {
+  const timeoutMs = config.timeoutMs ?? 3e4;
+  const authHeader = `Bearer ${config.secretKey}`;
+  async function createCheckout(params) {
+    const orderId = `${params.userId}-${randomUUID()}`;
+    const body = new URLSearchParams({
+      mode: "payment",
+      success_url: params.successRedirectUrl,
+      cancel_url: params.failureRedirectUrl,
+      "line_items[0][price_data][currency]": "usd",
+      "line_items[0][price_data][unit_amount]": String(params.amount),
+      "line_items[0][price_data][product_data][name]": "Token Top-Up",
+      "line_items[0][quantity]": "1",
+      "metadata[order_id]": orderId
+    });
+    const res = await fetch("https://api.stripe.com/v1/checkout/sessions", {
+      method: "POST",
+      headers: {
+        Authorization: authHeader,
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Idempotency-Key": orderId
+      },
+      body: body.toString(),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) {
+      throw new GatewayError("stripe", res.status, await res.text());
+    }
+    const data = await res.json();
+    return {
+      id: orderId,
+      userId: params.userId,
+      amount: params.amount,
+      redirectUrl: data.url,
+      status: "pending",
+      createdAt: /* @__PURE__ */ new Date()
+    };
+  }
+  async function verifyWebhook(_payload, signature, rawBody) {
+    if (!rawBody) {
+      throw new GatewayError(
+        "stripe",
+        void 0,
+        "rawBody is required for Stripe webhook verification"
+      );
+    }
+    const parsed = parseStripeSignature(signature);
+    if (!parsed) return false;
+    const timestampSeconds = Number(parsed.timestamp);
+    if (!Number.isFinite(timestampSeconds)) return false;
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    if (Math.abs(nowSeconds - timestampSeconds) > STRIPE_TIMESTAMP_TOLERANCE_SECONDS) {
+      return false;
+    }
+    const signedPayload = `${parsed.timestamp}.${typeof rawBody === "string" ? rawBody : rawBody.toString("utf8")}`;
+    const expectedSig = createHmac("sha256", config.webhookSecret).update(signedPayload).digest("hex");
+    const expectedBuf = Buffer.from(expectedSig, "hex");
+    for (const sig of parsed.signatures) {
+      try {
+        const sigBuf = Buffer.from(sig, "hex");
+        if (sigBuf.length !== expectedBuf.length) continue;
+        if (timingSafeEqual(sigBuf, expectedBuf)) return true;
+      } catch {
+      }
+    }
+    return false;
+  }
+  function parseWebhookPayload(payload) {
+    if (typeof payload !== "object" || payload === null) return null;
+    const event = payload;
+    if (typeof event.type !== "string") return null;
+    if (event.type === "checkout.session.completed") {
+      const data = event.data;
+      if (!data || typeof data.object !== "object" || data.object === null) return null;
+      const session = data.object;
+      const metadata = session.metadata;
+      if (!metadata || typeof metadata.order_id !== "string") return null;
+      const amountTotal = session.amount_total;
+      if (typeof amountTotal !== "number" || !Number.isFinite(amountTotal)) return null;
+      return {
+        orderId: metadata.order_id,
+        status: "success",
+        grossAmount: amountTotal
+      };
+    }
+    if (event.type === "checkout.session.expired") {
+      const data = event.data;
+      if (!data || typeof data.object !== "object" || data.object === null) return null;
+      const session = data.object;
+      const metadata = session.metadata;
+      if (!metadata || typeof metadata.order_id !== "string") return null;
+      const amountTotal = session.amount_total;
+      if (typeof amountTotal !== "number" || !Number.isFinite(amountTotal)) return null;
+      return {
+        orderId: metadata.order_id,
+        status: "expired",
+        grossAmount: amountTotal
+      };
+    }
+    return null;
+  }
+  async function getPaymentStatus(sessionId) {
+    const res = await fetch(
+      `https://api.stripe.com/v1/checkout/sessions/${encodeURIComponent(sessionId)}`,
+      {
+        headers: {
+          Authorization: authHeader,
+          Accept: "application/json"
+        },
+        signal: AbortSignal.timeout(timeoutMs)
+      }
+    );
+    if (!res.ok) {
+      throw new GatewayError("stripe", res.status, await res.text());
+    }
+    const data = await res.json();
+    const status = statusMap[data.payment_status];
+    return status ?? "failed";
+  }
+  return { createCheckout, verifyWebhook, parseWebhookPayload, getPaymentStatus };
+}
+
+export { createStripeGateway };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;AAoBA,IAAM,kCAAA,GAAqC,GAAA;AAE3C,SAAS,qBAAqB,MAAA,EAA6C;AAC1E,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA;AAC9B,EAAA,IAAI,SAAA,GAAY,EAAA;AAChB,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,IAAA,MAAM,CAAC,GAAA,EAAK,KAAK,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AACnC,IAAA,IAAI,CAAC,GAAA,IAAO,CAAC,KAAA,EAAO,OAAO,IAAA;AAC3B,IAAA,IAAI,QAAQ,GAAA,EAAK;AAChB,MAAA,SAAA,GAAY,KAAA;AAAA,IACb,CAAA,MAAA,IAAW,QAAQ,IAAA,EAAM;AACxB,MAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,IACtB;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,SAAA,IAAa,UAAA,CAAW,MAAA,KAAW,GAAG,OAAO,IAAA;AAClD,EAAA,OAAO,EAAE,WAAW,UAAA,EAAW;AAChC;AAEA,IAAM,SAAA,GAA2C;AAAA,EAChD,IAAA,EAAM,SAAA;AAAA,EACN,mBAAA,EAAqB,SAAA;AAAA,EACrB,MAAA,EAAQ;AACT,CAAA;AAEO,SAAS,oBAAoB,MAAA,EAElC;AACD,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACtC,EAAA,MAAM,UAAA,GAAa,CAAA,OAAA,EAAU,MAAA,CAAO,SAAS,CAAA,CAAA;AAE7C,EAAA,eAAe,eAAe,MAAA,EAKD;AAC5B,IAAA,MAAM,UAAU,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA;AAEhD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAChC,IAAA,EAAM,SAAA;AAAA,MACN,aAAa,MAAA,CAAO,kBAAA;AAAA,MACpB,YAAY,MAAA,CAAO,kBAAA;AAAA,MACnB,qCAAA,EAAuC,KAAA;AAAA,MACvC,wCAAA,EAA0C,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAAA,MAC9D,+CAAA,EAAiD,cAAA;AAAA,MACjD,yBAAA,EAA2B,GAAA;AAAA,MAC3B,oBAAA,EAAsB;AAAA,KACtB,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,6CAAA,EAA+C;AAAA,MACtE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,aAAA,EAAe,UAAA;AAAA,QACf,cAAA,EAAgB,mCAAA;AAAA,QAChB,iBAAA,EAAmB;AAAA,OACpB;AAAA,MACA,IAAA,EAAM,KAAK,QAAA,EAAS;AAAA,MACpB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS;AAAA,KACrC,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACZ,MAAA,MAAM,IAAI,aAAa,QAAA,EAAU,GAAA,CAAI,QAAQ,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAE7B,IAAA,OAAO;AAAA,MACN,EAAA,EAAI,OAAA;AAAA,MACJ,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,aAAa,IAAA,CAAK,GAAA;AAAA,MAClB,MAAA,EAAQ,SAAA;AAAA,MACR,SAAA,sBAAe,IAAA;AAAK,KACrB;AAAA,EACD;AAEA,EAAA,eAAe,aAAA,CACd,QAAA,EACA,SAAA,EACA,OAAA,EACmB;AACnB,IAAA,IAAI,CAAC,OAAA,EAAS;AACb,MAAA,MAAM,IAAI,YAAA;AAAA,QACT,QAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,MAAA,GAAS,qBAAqB,SAAS,CAAA;AAC7C,IAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AAGpB,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,gBAAgB,GAAG,OAAO,KAAA;AAE/C,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,UAAA,GAAa,gBAAgB,IAAI,kCAAA,EAAoC;AACjF,MAAA,OAAO,KAAA;AAAA,IACR;AAGA,IAAA,MAAM,aAAA,GAAgB,CAAA,EAAG,MAAA,CAAO,SAAS,CAAA,CAAA,EAAI,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAC,CAAA,CAAA;AAC7G,IAAA,MAAM,WAAA,GAAc,UAAA,CAAW,QAAA,EAAU,MAAA,CAAO,aAAa,EAC3D,MAAA,CAAO,aAAa,CAAA,CACpB,MAAA,CAAO,KAAK,CAAA;AAGd,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,KAAK,CAAA;AAClD,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,UAAA,EAAY;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA;AACrC,QAAA,IAAI,MAAA,CAAO,MAAA,KAAW,WAAA,CAAY,MAAA,EAAQ;AAC1C,QAAA,IAAI,eAAA,CAAgB,MAAA,EAAQ,WAAW,CAAA,EAAG,OAAO,IAAA;AAAA,MAClD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAEA,EAAA,SAAS,oBACR,OAAA,EACyE;AACzE,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,MAAM,OAAO,IAAA;AAE5D,IAAA,MAAM,KAAA,GAAQ,OAAA;AAId,IAAA,IAAI,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AAE3C,IAAA,IAAI,KAAA,CAAM,SAAS,4BAAA,EAA8B;AAChD,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,MAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,CAAK,WAAW,QAAA,IAAY,IAAA,CAAK,MAAA,KAAW,IAAA,EAAM,OAAO,IAAA;AAE7E,MAAA,MAAM,UAAU,IAAA,CAAK,MAAA;AAKrB,MAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AACzB,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,QAAA,KAAa,UAAU,OAAO,IAAA;AAE/D,MAAA,MAAM,cAAc,OAAA,CAAQ,YAAA;AAC5B,MAAA,IAAI,OAAO,gBAAgB,QAAA,IAAY,CAAC,OAAO,QAAA,CAAS,WAAW,GAAG,OAAO,IAAA;AAE7E,MAAA,OAAO;AAAA,QACN,SAAS,QAAA,CAAS,QAAA;AAAA,QAClB,MAAA,EAAQ,SAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACd;AAAA,IACD;AAEA,IAAA,IAAI,KAAA,CAAM,SAAS,0BAAA,EAA4B;AAC9C,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,MAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,CAAK,WAAW,QAAA,IAAY,IAAA,CAAK,MAAA,KAAW,IAAA,EAAM,OAAO,IAAA;AAE7E,MAAA,MAAM,UAAU,IAAA,CAAK,MAAA;AAKrB,MAAA,MAAM,WAAW,OAAA,CAAQ,QAAA;AACzB,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,QAAA,KAAa,UAAU,OAAO,IAAA;AAE/D,MAAA,MAAM,cAAc,OAAA,CAAQ,YAAA;AAC5B,MAAA,IAAI,OAAO,gBAAgB,QAAA,IAAY,CAAC,OAAO,QAAA,CAAS,WAAW,GAAG,OAAO,IAAA;AAE7E,MAAA,OAAO;AAAA,QACN,SAAS,QAAA,CAAS,QAAA;AAAA,QAClB,MAAA,EAAQ,SAAA;AAAA,QACR,WAAA,EAAa;AAAA,OACd;AAAA,IACD;AAGA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,eAAe,iBAAiB,SAAA,EAA2C;AAC1E,IAAA,MAAM,MAAM,MAAM,KAAA;AAAA,MACjB,CAAA,4CAAA,EAA+C,kBAAA,CAAmB,SAAS,CAAC,CAAA,CAAA;AAAA,MAC5E;AAAA,QACC,OAAA,EAAS;AAAA,UACR,aAAA,EAAe,UAAA;AAAA,UACf,MAAA,EAAQ;AAAA,SACT;AAAA,QACA,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS;AAAA;AACtC,KACD;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACZ,MAAA,MAAM,IAAI,aAAa,QAAA,EAAU,GAAA,CAAI,QAAQ,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,IAAA,CAAK,cAAc,CAAA;AAC5C,IAAA,OAAO,MAAA,IAAU,QAAA;AAAA,EAClB;AAEA,EAAA,OAAO,EAAE,cAAA,EAAgB,aAAA,EAAe,mBAAA,EAAqB,gBAAA,EAAiB;AAC/E","file":"index.js","sourcesContent":["// @murai-wallet/gateway-stripe\n// Stripe Checkout payment gateway adapter\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\nimport { randomUUID } from 'node:crypto';\nimport { GatewayError } from '@murai-wallet/core';\nimport type { CheckoutSession, PaymentGatewayAdapter, WebhookStatus } from '@murai-wallet/core';\n\nexport interface StripeConfig {\n\tsecretKey: string;\n\twebhookSecret: string;\n\t/** Fetch timeout in ms — defaults to 30000 */\n\ttimeoutMs?: number;\n}\n\ninterface StripeSignatureParts {\n\ttimestamp: string;\n\tsignatures: string[];\n}\n\nconst STRIPE_TIMESTAMP_TOLERANCE_SECONDS = 300; // 5 minutes\n\nfunction parseStripeSignature(header: string): StripeSignatureParts | null {\n\tconst parts = header.split(',');\n\tlet timestamp = '';\n\tconst signatures: string[] = [];\n\n\tfor (const part of parts) {\n\t\tconst [key, value] = part.split('=');\n\t\tif (!key || !value) return null;\n\t\tif (key === 't') {\n\t\t\ttimestamp = value;\n\t\t} else if (key === 'v1') {\n\t\t\tsignatures.push(value);\n\t\t}\n\t}\n\n\tif (!timestamp || signatures.length === 0) return null;\n\treturn { timestamp, signatures };\n}\n\nconst statusMap: Record<string, WebhookStatus> = {\n\tpaid: 'success',\n\tno_payment_required: 'success',\n\tunpaid: 'pending',\n};\n\nexport function createStripeGateway(config: StripeConfig): PaymentGatewayAdapter & {\n\tgetPaymentStatus(sessionId: string): Promise<WebhookStatus>;\n} {\n\tconst timeoutMs = config.timeoutMs ?? 30000;\n\tconst authHeader = `Bearer ${config.secretKey}`;\n\n\tasync function createCheckout(params: {\n\t\tuserId: string;\n\t\tamount: number;\n\t\tsuccessRedirectUrl: string;\n\t\tfailureRedirectUrl: string;\n\t}): Promise<CheckoutSession> {\n\t\tconst orderId = `${params.userId}-${randomUUID()}`;\n\n\t\tconst body = new URLSearchParams({\n\t\t\tmode: 'payment',\n\t\t\tsuccess_url: params.successRedirectUrl,\n\t\t\tcancel_url: params.failureRedirectUrl,\n\t\t\t'line_items[0][price_data][currency]': 'usd',\n\t\t\t'line_items[0][price_data][unit_amount]': String(params.amount),\n\t\t\t'line_items[0][price_data][product_data][name]': 'Token Top-Up',\n\t\t\t'line_items[0][quantity]': '1',\n\t\t\t'metadata[order_id]': orderId,\n\t\t});\n\n\t\tconst res = await fetch('https://api.stripe.com/v1/checkout/sessions', {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\tAuthorization: authHeader,\n\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n\t\t\t\t'Idempotency-Key': orderId,\n\t\t\t},\n\t\t\tbody: body.toString(),\n\t\t\tsignal: AbortSignal.timeout(timeoutMs),\n\t\t});\n\n\t\tif (!res.ok) {\n\t\t\tthrow new GatewayError('stripe', res.status, await res.text());\n\t\t}\n\n\t\tconst data = (await res.json()) as { url: string };\n\n\t\treturn {\n\t\t\tid: orderId,\n\t\t\tuserId: params.userId,\n\t\t\tamount: params.amount,\n\t\t\tredirectUrl: data.url,\n\t\t\tstatus: 'pending',\n\t\t\tcreatedAt: new Date(),\n\t\t};\n\t}\n\n\tasync function verifyWebhook(\n\t\t_payload: unknown,\n\t\tsignature: string,\n\t\trawBody?: string | Buffer,\n\t): Promise<boolean> {\n\t\tif (!rawBody) {\n\t\t\tthrow new GatewayError(\n\t\t\t\t'stripe',\n\t\t\t\tundefined,\n\t\t\t\t'rawBody is required for Stripe webhook verification',\n\t\t\t);\n\t\t}\n\n\t\tconst parsed = parseStripeSignature(signature);\n\t\tif (!parsed) return false;\n\n\t\t// Check timestamp tolerance\n\t\tconst timestampSeconds = Number(parsed.timestamp);\n\t\tif (!Number.isFinite(timestampSeconds)) return false;\n\n\t\tconst nowSeconds = Math.floor(Date.now() / 1000);\n\t\tif (Math.abs(nowSeconds - timestampSeconds) > STRIPE_TIMESTAMP_TOLERANCE_SECONDS) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// Compute expected signature\n\t\tconst signedPayload = `${parsed.timestamp}.${typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8')}`;\n\t\tconst expectedSig = createHmac('sha256', config.webhookSecret)\n\t\t\t.update(signedPayload)\n\t\t\t.digest('hex');\n\n\t\t// Timing-safe compare against any v1 signature\n\t\tconst expectedBuf = Buffer.from(expectedSig, 'hex');\n\t\tfor (const sig of parsed.signatures) {\n\t\t\ttry {\n\t\t\t\tconst sigBuf = Buffer.from(sig, 'hex');\n\t\t\t\tif (sigBuf.length !== expectedBuf.length) continue;\n\t\t\t\tif (timingSafeEqual(sigBuf, expectedBuf)) return true;\n\t\t\t} catch {\n\t\t\t\t// invalid hex — skip\n\t\t\t}\n\t\t}\n\n\t\treturn false;\n\t}\n\n\tfunction parseWebhookPayload(\n\t\tpayload: unknown,\n\t): { orderId: string; status: WebhookStatus; grossAmount: number } | null {\n\t\tif (typeof payload !== 'object' || payload === null) return null;\n\n\t\tconst event = payload as {\n\t\t\ttype: unknown;\n\t\t\tdata: unknown;\n\t\t};\n\t\tif (typeof event.type !== 'string') return null;\n\n\t\tif (event.type === 'checkout.session.completed') {\n\t\t\tconst data = event.data as { object: unknown } | undefined;\n\t\t\tif (!data || typeof data.object !== 'object' || data.object === null) return null;\n\n\t\t\tconst session = data.object as {\n\t\t\t\tmetadata: unknown;\n\t\t\t\tamount_total: unknown;\n\t\t\t};\n\n\t\t\tconst metadata = session.metadata as { order_id: unknown } | undefined;\n\t\t\tif (!metadata || typeof metadata.order_id !== 'string') return null;\n\n\t\t\tconst amountTotal = session.amount_total;\n\t\t\tif (typeof amountTotal !== 'number' || !Number.isFinite(amountTotal)) return null;\n\n\t\t\treturn {\n\t\t\t\torderId: metadata.order_id,\n\t\t\t\tstatus: 'success',\n\t\t\t\tgrossAmount: amountTotal,\n\t\t\t};\n\t\t}\n\n\t\tif (event.type === 'checkout.session.expired') {\n\t\t\tconst data = event.data as { object: unknown } | undefined;\n\t\t\tif (!data || typeof data.object !== 'object' || data.object === null) return null;\n\n\t\t\tconst session = data.object as {\n\t\t\t\tmetadata: unknown;\n\t\t\t\tamount_total: unknown;\n\t\t\t};\n\n\t\t\tconst metadata = session.metadata as { order_id: unknown } | undefined;\n\t\t\tif (!metadata || typeof metadata.order_id !== 'string') return null;\n\n\t\t\tconst amountTotal = session.amount_total;\n\t\t\tif (typeof amountTotal !== 'number' || !Number.isFinite(amountTotal)) return null;\n\n\t\t\treturn {\n\t\t\t\torderId: metadata.order_id,\n\t\t\t\tstatus: 'expired',\n\t\t\t\tgrossAmount: amountTotal,\n\t\t\t};\n\t\t}\n\n\t\t// Unrecognized event type\n\t\treturn null;\n\t}\n\n\tasync function getPaymentStatus(sessionId: string): Promise<WebhookStatus> {\n\t\tconst res = await fetch(\n\t\t\t`https://api.stripe.com/v1/checkout/sessions/${encodeURIComponent(sessionId)}`,\n\t\t\t{\n\t\t\t\theaders: {\n\t\t\t\t\tAuthorization: authHeader,\n\t\t\t\t\tAccept: 'application/json',\n\t\t\t\t},\n\t\t\t\tsignal: AbortSignal.timeout(timeoutMs),\n\t\t\t},\n\t\t);\n\n\t\tif (!res.ok) {\n\t\t\tthrow new GatewayError('stripe', res.status, await res.text());\n\t\t}\n\n\t\tconst data = (await res.json()) as { payment_status: string };\n\t\tconst status = statusMap[data.payment_status];\n\t\treturn status ?? 'failed';\n\t}\n\n\treturn { createCheckout, verifyWebhook, parseWebhookPayload, getPaymentStatus };\n}\n"]}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@murai-wallet/gateway-stripe",
+  "version": "1.0.2",
+  "type": "module",
+  "description": "Stripe Checkout payment gateway adapter for murai",
+  "license": "MIT",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ebuntario/murai.git",
+    "directory": "packages/gateway-stripe"
+  },
+  "homepage": "https://ebuntario.github.io/murai",
+  "bugs": "https://github.com/ebuntario/murai/issues",
+  "keywords": [
+    "stripe",
+    "payment",
+    "gateway",
+    "checkout"
+  ],
+  "dependencies": {
+    "@murai-wallet/core": "1.0.2"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "clean": "rm -rf dist"
+  }
+}