@myzonerocks/pact 0.1.0

package/src/adapters/stripe.ts

@@ -0,0 +1,478 @@
+// Stripe leg for the PACT protocol. It runs server-side only: it holds the Stripe
+// secret and webhook signing keys, creates and captures PaymentIntents, and
+// normalizes Stripe webhooks into protocol events. Stripe serves the pay-in side
+// of a corridor: it charges the payer's card and captures the funds to the
+// account the corridor delivers to, be that the recipient directly or a bridge
+// escrow. Card and wallet collection happens client-side against the
+// PaymentIntent this leg creates; the leg never sees raw card data.
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { Money } from "../money.js";
+import { State } from "../state.js";
+import type { Quote, Authorization, Settlement } from "../message.js";
+import { RefundKind, type AdapterEvent } from "../adapter.js";
+import type { PayInLeg, PayInCapabilities, CollectResult } from "../leg.js";
+
+// The public base of the Stripe REST API. It is the same for every integration
+// and carries no secret; tests point the leg at a local server instead.
+const defaultBaseURL = "https://api.stripe.com";
+
+// The Stripe API version this leg is written against. Pinning it keeps response
+// shapes stable across Stripe's own releases.
+const apiVersion = "2026-04-22.dahlia";
+
+// The pact intent id travels on the PaymentIntent metadata under this key so a
+// webhook can be tied back to the intent it settles.
+const metadataIntentKey = "pact_intent_id";
+
+// defaultToleranceSeconds is how far a webhook timestamp may drift from now
+// before it is rejected as a possible replay.
+const defaultToleranceSeconds = 300;
+
+// The protocol identifier used to bind an idempotency key to one protocol step.
+const idPrefix = "pact";
+
+// PaymentIntent is the subset of Stripe's PaymentIntent this leg reads.
+export interface PaymentIntent {
+  id: string;
+  status: string;
+  amount: number;
+  currency: string;
+  latestCharge: string;
+  metadata: Record<string, string>;
+  created: number;
+}
+
+// Refund is the subset of Stripe's Refund this leg reads.
+export interface Refund {
+  id: string;
+  status: string;
+  amount: number;
+}
+
+// CreateIntentParams describes a PaymentIntent to create. destination is the
+// account the captured funds settle to: the recipient's connected account for a
+// direct corridor, the escrow account for a bridged one. An empty destination
+// leaves the funds on the platform account.
+export interface CreateIntentParams {
+  amount: number;
+  currency: string;
+  destination: string;
+  metadata: Record<string, string>;
+}
+
+// CreateRefundParams describes a refund to create against a PaymentIntent. A zero
+// amount refunds the full captured amount.
+export interface CreateRefundParams {
+  paymentIntentId: string;
+  amount: number;
+  reason: string;
+}
+
+// StripeApi is the surface of Stripe this leg depends on. Depending on an
+// interface keeps the leg unit-testable without a network and without
+// credentials.
+export interface StripeApi {
+  createPaymentIntent(params: CreateIntentParams, idempotencyKey: string): Promise<PaymentIntent>;
+  capturePaymentIntent(id: string, idempotencyKey: string): Promise<PaymentIntent>;
+  // findPaymentIntent resolves the PaymentIntent carrying a given pact intent id
+  // in its metadata. Stripe is queried by metadata because the leg holds no
+  // mapping of its own; all durable state lives in the ledger.
+  findPaymentIntent(pactIntentId: string): Promise<PaymentIntent>;
+  createRefund(params: CreateRefundParams, idempotencyKey: string): Promise<Refund>;
+}
+
+export interface StripeConfig {
+  id?: string;
+  currencies: string[];
+  api: StripeApi;
+  webhookKey: string;
+  // clock returns the current time in Unix seconds, for webhook timestamp
+  // checks. When absent, timestamps are checked against zero.
+  clock?: () => number;
+  // tolerance is the webhook timestamp tolerance in seconds; defaults to 300.
+  tolerance?: number;
+  ids: () => string;
+}
+
+// StripeLeg collects card payments through Stripe. It exposes the wallets that
+// ride on the card rail as funding methods, and answers a refund with a full or
+// partial reversal.
+export class StripeLeg implements PayInLeg {
+  readonly id: string;
+  private readonly currencies: string[];
+  private readonly api: StripeApi;
+  private readonly webhookKey: string;
+  private readonly clock: () => number;
+  private readonly tolerance: number;
+  private readonly ids: () => string;
+
+  constructor(cfg: StripeConfig) {
+    if (!cfg.webhookKey) {
+      throw new Error("stripe: config requires a webhook signing key");
+    }
+    this.id = cfg.id ?? "stripe";
+    this.currencies = cfg.currencies;
+    this.api = cfg.api;
+    this.webhookKey = cfg.webhookKey;
+    this.clock = cfg.clock ?? (() => 0);
+    this.tolerance = cfg.tolerance ?? defaultToleranceSeconds;
+    this.ids = cfg.ids;
+  }
+
+  // payInCapabilities advertises the card rail and the wallets that fund through
+  // it. The methods are informational; the corridor routes on the rail.
+  payInCapabilities(): PayInCapabilities {
+    return {
+      rails: ["card"],
+      currencies: this.currencies,
+      methods: ["card", "cashapp", "apple_pay", "google_pay", "amazon_pay", "link"],
+      refunds: RefundKind.Partial,
+    };
+  }
+
+  // collect charges the payer and captures the funds to deliverTo — the recipient
+  // for a direct corridor, the bridge escrow for a bridged one. It creates the
+  // PaymentIntent and captures it in one step, each call keyed to this intent so a
+  // retry reuses the original charge rather than opening a second. received is the
+  // net a bridge would convert: what the payer paid less the corridor fees.
+  async collect(intentId: string, quote: Quote, _auth: Authorization, deliverTo: string): Promise<CollectResult> {
+    const amount = minorToInteger(quote.srcAmount);
+    const pi = await this.api.createPaymentIntent(
+      {
+        amount,
+        currency: quote.srcAmount.currency,
+        destination: deliverTo,
+        metadata: { [metadataIntentKey]: intentId },
+      },
+      idempotencyKey(intentId, "collect"),
+    );
+    const captured = await this.api.capturePaymentIntent(pi.id, idempotencyKey(intentId, "capture"));
+    return { providerRef: captured.id, received: quote.srcAmount.sub(quote.fees) };
+  }
+
+  // refundIn reverses a captured payment, in full or in part. Stripe supports
+  // both, so the leg accepts the full and partial refund kinds and rejects a
+  // counter-transfer it cannot express.
+  async refundIn(intentId: string, kind: RefundKind, reason: string): Promise<Settlement> {
+    if (kind !== RefundKind.Full && kind !== RefundKind.Partial) {
+      throw new Error(`stripe: cannot perform refund kind ${kind}`);
+    }
+    const pi = await this.api.findPaymentIntent(intentId);
+    const refund = await this.api.createRefund(
+      { paymentIntentId: pi.id, amount: 0, reason },
+      idempotencyKey(intentId, "refund"),
+    );
+    return {
+      intentId,
+      state: State.Refunded,
+      adapterId: this.id,
+      providerTxRef: refund.id,
+      onchainTxHash: "",
+      receiptHash: new Uint8Array(0),
+      reason,
+      settledAt: 0,
+    };
+  }
+
+  // parseWebhook verifies a Stripe webhook and normalizes it into protocol
+  // events. It reads the signature from the Stripe-Signature header and rejects
+  // any payload whose signature or timestamp does not check out. The timestamp is
+  // checked against the injected clock so the result is deterministic.
+  parseWebhook(raw: Uint8Array, headers: Record<string, string[]>): AdapterEvent[] {
+    return parseEvent(raw, signatureHeader(headers), this.webhookKey, this.clock(), this.tolerance);
+  }
+}
+
+// signatureHeader pulls the Stripe signature out of the request headers, matching
+// the header name case-insensitively so it works regardless of how the host's
+// HTTP layer canonicalizes keys.
+function signatureHeader(headers: Record<string, string[]>): string {
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === "stripe-signature") {
+      const values = headers[key];
+      if (values && values.length > 0) {
+        return values[0]!;
+      }
+    }
+  }
+  return "";
+}
+
+// idempotencyKey binds a Stripe mutation to one protocol step so a retry reuses
+// the original result instead of acting twice.
+function idempotencyKey(ref: string, step: string): string {
+  return `${idPrefix}:${ref}:${step}`;
+}
+
+// minorToInteger narrows a Money amount to the safe integer Stripe expects,
+// refusing anything that would overflow. Fiat amounts fit comfortably; the guard
+// exists so a token amount can never be sent to a card rail by mistake.
+function minorToInteger(m: Money): number {
+  const amount = m.value();
+  if (amount > BigInt(Number.MAX_SAFE_INTEGER) || amount < 0n) {
+    throw new Error(`stripe: amount ${m.minor()} exceeds the card-rail range`);
+  }
+  return Number(amount);
+}
+
+// ErrNoSignature reports a webhook that arrived without a usable Stripe signature
+// header.
+export const ErrNoSignature = "stripe: missing signature header";
+// ErrSignatureMismatch reports a webhook whose signature does not verify.
+export const ErrSignatureMismatch = "stripe: signature does not verify";
+// ErrTimestampOutOfTolerance reports a webhook whose timestamp is too old or too
+// far in the future to trust.
+export const ErrTimestampOutOfTolerance = "stripe: webhook timestamp outside tolerance";
+
+// verifySignature checks a Stripe-Signature header against the raw payload and
+// the webhook signing secret: sign "{t}.{payload}" with HMAC-SHA256 and compare
+// in constant time. now and tolerance are injected so the check is deterministic
+// in tests.
+function verifySignature(payload: Uint8Array, header: string, secret: string, now: number, tolerance: number): void {
+  if (!header) {
+    throw new Error(ErrNoSignature);
+  }
+  let timestamp = "";
+  const signatures: string[] = [];
+  for (const part of header.split(",")) {
+    const kv = part.trim();
+    const eq = kv.indexOf("=");
+    if (eq < 0) {
+      continue;
+    }
+    const name = kv.slice(0, eq);
+    const value = kv.slice(eq + 1);
+    if (name === "t") {
+      timestamp = value;
+    } else if (name === "v1") {
+      signatures.push(value);
+    }
+  }
+  if (!timestamp || signatures.length === 0) {
+    throw new Error(ErrNoSignature);
+  }
+  const ts = Number(timestamp);
+  if (!Number.isInteger(ts)) {
+    throw new Error(ErrNoSignature);
+  }
+  const diff = now - ts;
+  if (diff > tolerance || diff < -tolerance) {
+    throw new Error(ErrTimestampOutOfTolerance);
+  }
+
+  const mac = createHmac("sha256", secret);
+  mac.update(timestamp);
+  mac.update(".");
+  mac.update(payload);
+  const expected = mac.digest();
+
+  for (const sig of signatures) {
+    let got: Buffer;
+    try {
+      got = Buffer.from(sig, "hex");
+    } catch {
+      continue;
+    }
+    if (got.length === expected.length && timingSafeEqual(got, expected)) {
+      return;
+    }
+  }
+  throw new Error(ErrSignatureMismatch);
+}
+
+// stripeEvent is the envelope Stripe wraps every webhook in.
+interface StripeEvent {
+  type: string;
+  data: { object: unknown };
+}
+
+// parseEvent verifies the signature and maps a Stripe event onto the protocol.
+// Events this leg does not act on yield no protocol event rather than an error.
+function parseEvent(
+  payload: Uint8Array,
+  header: string,
+  secret: string,
+  now: number,
+  tolerance: number,
+): AdapterEvent[] {
+  verifySignature(payload, header, secret, now, tolerance);
+  const event = JSON.parse(new TextDecoder().decode(payload)) as StripeEvent;
+
+  switch (event.type) {
+    case "payment_intent.succeeded":
+      return oneEvent(decodePaymentIntent(event.data.object), State.Settled, "");
+    case "payment_intent.payment_failed":
+      return oneEvent(decodePaymentIntent(event.data.object), State.Failed, "payment failed");
+    case "charge.refunded":
+      return oneEvent(decodeRefundedIntent(event.data.object), State.Refunded, "refunded");
+    default:
+      return [];
+  }
+}
+
+interface WebhookIntent {
+  id: string;
+  metadata: Record<string, string>;
+  created: number;
+}
+
+function decodePaymentIntent(raw: unknown): WebhookIntent {
+  const obj = raw as { id?: string; metadata?: Record<string, string>; created?: number };
+  return { id: obj.id ?? "", metadata: obj.metadata ?? {}, created: obj.created ?? 0 };
+}
+
+// decodeRefundedIntent reads the pact intent id off a refunded charge. A charge
+// carries the originating PaymentIntent id and copies its metadata.
+function decodeRefundedIntent(raw: unknown): WebhookIntent {
+  const charge = raw as { payment_intent?: string; metadata?: Record<string, string>; created?: number };
+  return { id: charge.payment_intent ?? "", metadata: charge.metadata ?? {}, created: charge.created ?? 0 };
+}
+
+function oneEvent(pi: WebhookIntent, state: State, reason: string): AdapterEvent[] {
+  return [
+    {
+      intentId: pi.metadata[metadataIntentKey] ?? "",
+      state,
+      providerTxRef: pi.id,
+      onchainTxHash: "",
+      reason,
+      settledAt: pi.created * 1000,
+    },
+  ];
+}
+
+// httpStripeApi is the live Stripe REST client. The secret key is injected by the
+// host from its own secrets store and never originates in this code.
+class HttpStripeApi implements StripeApi {
+  private readonly secretKey: string;
+  private readonly baseURL: string;
+
+  constructor(secretKey: string, baseURL: string) {
+    this.secretKey = secretKey;
+    this.baseURL = baseURL || defaultBaseURL;
+  }
+
+  async createPaymentIntent(params: CreateIntentParams, idempotencyKey: string): Promise<PaymentIntent> {
+    const form = new URLSearchParams();
+    form.set("amount", String(params.amount));
+    form.set("currency", params.currency.toLowerCase());
+    form.set("capture_method", "manual");
+    form.set("automatic_payment_methods[enabled]", "true");
+    if (params.destination) {
+      form.set("transfer_data[destination]", params.destination);
+    }
+    for (const [k, v] of Object.entries(params.metadata)) {
+      form.set(`metadata[${k}]`, v);
+    }
+    const pi = await this.post<StripePaymentIntentWire>("/v1/payment_intents", form, idempotencyKey);
+    return normalizeIntent(pi);
+  }
+
+  async capturePaymentIntent(id: string, idempotencyKey: string): Promise<PaymentIntent> {
+    const pi = await this.post<StripePaymentIntentWire>(
+      `/v1/payment_intents/${encodeURIComponent(id)}/capture`,
+      new URLSearchParams(),
+      idempotencyKey,
+    );
+    return normalizeIntent(pi);
+  }
+
+  async findPaymentIntent(pactIntentId: string): Promise<PaymentIntent> {
+    const query = new URLSearchParams();
+    query.set("query", `metadata["${metadataIntentKey}"]:"${pactIntentId}"`);
+    const result = await this.get<{ data: StripePaymentIntentWire[] }>(`/v1/payment_intents/search?${query.toString()}`);
+    const first = result.data[0];
+    if (!first) {
+      throw new Error(`stripe: no payment intent for ${pactIntentId}`);
+    }
+    return normalizeIntent(first);
+  }
+
+  async createRefund(params: CreateRefundParams, idempotencyKey: string): Promise<Refund> {
+    const form = new URLSearchParams();
+    form.set("payment_intent", params.paymentIntentId);
+    if (params.amount > 0) {
+      form.set("amount", String(params.amount));
+    }
+    if (params.reason) {
+      form.set("metadata[reason]", params.reason);
+    }
+    const r = await this.post<StripeRefundWire>("/v1/refunds", form, idempotencyKey);
+    return { id: r.id ?? "", status: r.status ?? "", amount: r.amount ?? 0 };
+  }
+
+  private async post<T>(path: string, form: URLSearchParams, idempotencyKey: string): Promise<T> {
+    const headers: Record<string, string> = { "Content-Type": "application/x-www-form-urlencoded" };
+    if (idempotencyKey) {
+      headers["Idempotency-Key"] = idempotencyKey;
+    }
+    return this.send<T>(path, { method: "POST", headers, body: form.toString() });
+  }
+
+  private async get<T>(path: string): Promise<T> {
+    return this.send<T>(path, { method: "GET" });
+  }
+
+  private async send<T>(path: string, init: RequestInit): Promise<T> {
+    const headers: Record<string, string> = {
+      ...((init.headers as Record<string, string>) ?? {}),
+      Authorization: `Bearer ${this.secretKey}`,
+      "Stripe-Version": apiVersion,
+    };
+    const resp = await fetch(this.baseURL + path, { ...init, headers });
+    const body = await resp.text();
+    if (resp.status >= 300) {
+      throw new Error(`stripe: ${path} returned ${resp.status}: ${stripeErrorMessage(body)}`);
+    }
+    return JSON.parse(body) as T;
+  }
+}
+
+// stripeErrorMessage lifts Stripe's error message out of a response body without
+// echoing anything that could carry a key.
+function stripeErrorMessage(body: string): string {
+  try {
+    const envelope = JSON.parse(body) as { error?: { message?: string; code?: string } };
+    const message = envelope.error?.message;
+    if (!message) {
+      return "unknown error";
+    }
+    return envelope.error?.code ? `${message} (${envelope.error.code})` : message;
+  } catch {
+    return "unknown error";
+  }
+}
+
+interface StripePaymentIntentWire {
+  id?: string;
+  status?: string;
+  amount?: number;
+  currency?: string;
+  latest_charge?: string;
+  metadata?: Record<string, string>;
+  created?: number;
+}
+
+interface StripeRefundWire {
+  id?: string;
+  status?: string;
+  amount?: number;
+}
+
+function normalizeIntent(p: StripePaymentIntentWire): PaymentIntent {
+  return {
+    id: p.id ?? "",
+    status: p.status ?? "",
+    amount: p.amount ?? 0,
+    currency: (p.currency ?? "").toUpperCase(),
+    latestCharge: p.latest_charge ?? "",
+    metadata: p.metadata ?? {},
+    created: p.created ?? 0,
+  };
+}
+
+// newHttpStripeApi builds a live Stripe client. baseURL is optional and defaults
+// to the public Stripe API; it exists so tests can substitute a local server.
+export function newHttpStripeApi(secretKey: string, baseURL = ""): StripeApi {
+  return new HttpStripeApi(secretKey, baseURL);
+}

package/src/bridge.ts

@@ -0,0 +1,148 @@
+import { Money } from "./money.js";
+import { BRIDGE_PASSTHROUGH } from "./message.js";
+
+// The USDC bridge identifier. A stable wire value carried in a corridor quote.
+export const BRIDGE_USDC = "usdc";
+
+// BridgeQuote plans a conversion toward a target destination amount: how much the
+// payer must supply in the source currency, at what rate, plus the bridge's fee.
+// Planning is destination-denominated because a payment is requested in what the
+// recipient should receive; execution runs the conversion forward.
+export interface BridgeQuote {
+  srcAmount: Money; // what the payer must supply, in X, to deliver the target dst
+  fxRate: string; // Y per X, decimal ASCII
+  fee: Money; // the bridge's own fee, in X
+}
+
+// ConvertResult is the outcome of moving held value through a bridge.
+export interface ConvertResult {
+  delivered: Money;
+  receiptRef: string;
+}
+
+// Bridge holds value between the pay-in and pay-out legs and converts the payer's
+// currency to the recipient's. The kernel never sources the rate or the
+// liquidity; a bridge is handed both through injected seams. quote plans toward a
+// target destination amount (how much source is needed); convert executes the
+// conversion forward on the value actually held.
+export interface Bridge {
+  id: string;
+  quote(dstTarget: Money, srcCurrency: string, srcExponent: number): Promise<BridgeQuote>;
+  convert(intentId: string, held: Money, dstCurrency: string, dstExponent: number): Promise<ConvertResult>;
+}
+
+// RateSource yields the exchange rate to apply, expressed as destination units
+// per source unit in decimal ASCII. An adopter wires it to a price feed.
+export interface RateSource {
+  rate(from: string, to: string): Promise<string>;
+}
+
+// EscrowVault holds converted value between the legs. For the USDC bridge this is
+// the token custody; an adopter supplies the implementation and, with it, the
+// liquidity. The kernel only coordinates.
+export interface EscrowVault {
+  hold(intentId: string, amount: Money): Promise<string>;
+  release(intentId: string): Promise<void>;
+}
+
+// PassThroughBridge is the direct-corridor bridge: it moves value unchanged when
+// the payer and recipient are already in the same currency.
+export class PassThroughBridge implements Bridge {
+  readonly id = BRIDGE_PASSTHROUGH;
+
+  async quote(dstTarget: Money, srcCurrency: string, srcExponent: number): Promise<BridgeQuote> {
+    if (dstTarget.currency !== srcCurrency || dstTarget.exponent !== srcExponent) {
+      throw new Error(`pact: pass-through bridge cannot convert ${srcCurrency} to ${dstTarget.currency}`);
+    }
+    return { srcAmount: dstTarget, fxRate: "1", fee: Money.create(srcCurrency, srcExponent, 0n) };
+  }
+
+  async convert(_intentId: string, held: Money, dstCurrency: string, dstExponent: number): Promise<ConvertResult> {
+    if (held.currency !== dstCurrency || held.exponent !== dstExponent) {
+      throw new Error("pact: pass-through bridge cannot convert across currencies");
+    }
+    return { delivered: held, receiptRef: "" };
+  }
+}
+
+// UsdcBridge converts the payer's currency to the recipient's through a USDC
+// escrow. It applies a quoted rate from the injected RateSource, charges a fee in
+// basis points, and parks the value in the injected EscrowVault between legs.
+export class UsdcBridge implements Bridge {
+  readonly id = BRIDGE_USDC;
+
+  constructor(
+    private readonly rates: RateSource,
+    private readonly vault: EscrowVault,
+    private readonly feeBps: bigint,
+  ) {}
+
+  async quote(dstTarget: Money, srcCurrency: string, srcExponent: number): Promise<BridgeQuote> {
+    const rate = await this.rates.rate(srcCurrency, dstTarget.currency);
+    // Plan backwards: the source needed to deliver the target is the target at
+    // the inverse rate, rounded up so a rounding remainder never short-changes
+    // the recipient.
+    const src = applyInverseRate(dstTarget, rate, srcCurrency, srcExponent);
+    const feeMinor = (src.value() * this.feeBps) / 10_000n;
+    return { srcAmount: src, fxRate: rate, fee: Money.create(srcCurrency, srcExponent, feeMinor) };
+  }
+
+  async convert(intentId: string, held: Money, dstCurrency: string, dstExponent: number): Promise<ConvertResult> {
+    const ref = await this.vault.hold(intentId, held);
+    const rate = await this.rates.rate(held.currency, dstCurrency);
+    const delivered = applyRate(held, rate, dstCurrency, dstExponent);
+    await this.vault.release(intentId);
+    return { delivered, receiptRef: ref };
+  }
+}
+
+// applyRate converts a source amount to a destination currency at a decimal rate.
+// The rate is Y per X given as an integer or a fixed-point decimal; the result is
+// floored to the destination currency's minor unit. Rounding down is deliberate:
+// the recipient is never credited more than the rate permits.
+export function applyRate(src: Money, rate: string, dstCurrency: string, dstExponent: number): Money {
+  const [num, den] = parseRate(rate);
+  // dstMinor = srcMinor * rate * 10^(dstExponent - srcExponent)
+  let value = src.value() * num;
+  let denom = den;
+  if (dstExponent >= src.exponent) {
+    value = value * pow10(dstExponent - src.exponent);
+  } else {
+    denom = denom * pow10(src.exponent - dstExponent);
+  }
+  return Money.create(dstCurrency, dstExponent, value / denom);
+}
+
+// applyInverseRate is the planning direction: given a target destination amount
+// and a rate of Y per X, it returns the source amount needed. It rounds up so a
+// rounding remainder is covered by the payer, never taken from the recipient.
+export function applyInverseRate(dst: Money, rate: string, srcCurrency: string, srcExponent: number): Money {
+  const [num, den] = parseRate(rate);
+  // srcMinor = ceil( dstMinor * den * 10^srcExp / (num * 10^dstExp) )
+  const numerator = dst.value() * den * pow10(srcExponent);
+  const denominator = num * pow10(dst.exponent);
+  let value = numerator / denominator;
+  if (numerator % denominator !== 0n) {
+    value = value + 1n;
+  }
+  return Money.create(srcCurrency, srcExponent, value);
+}
+
+// parseRate reads a decimal rate like "129.45" into a numerator and denominator,
+// so the conversion stays exact integer arithmetic with no floating point.
+export function parseRate(rate: string): [bigint, bigint] {
+  const dot = rate.indexOf(".");
+  const whole = dot < 0 ? rate : rate.slice(0, dot);
+  const frac = dot < 0 ? "" : rate.slice(dot + 1);
+  const digits = whole + frac;
+  if (!/^\d+$/.test(digits)) {
+    throw new Error(`pact: ${JSON.stringify(rate)} is not a decimal rate`);
+  }
+  const num = BigInt(digits);
+  const den = frac.length > 0 ? pow10(frac.length) : 1n;
+  return [num, den];
+}
+
+function pow10(n: number): bigint {
+  return 10n ** BigInt(n);
+}