@myzonerocks/pact 0.1.0

package/dist/src/adapters/paypal.js

@@ -0,0 +1,279 @@
+// PayPal leg for the PACT protocol. It runs server-side: it holds the PayPal
+// client credentials and webhook id, creates and captures Orders on the pay-in
+// side, sends Payouts on the pay-out side, and verifies inbound webhooks through
+// PayPal's own verification call. The payer approves the order in the PayPal or
+// Venmo flow client-side; this package never sees card data. A captured payment
+// can be refunded in full, but a delivered payout cannot be pulled back.
+import { State } from "../state.js";
+import { RefundKind } from "../adapter.js";
+// The public base of the PayPal REST API. It is the same for every live
+// integration and carries no secret; the sandbox host or a local test server is
+// injected instead.
+const defaultBaseURL = "https://api-m.paypal.com";
+// The pact intent id travels on the order and payout reference so a webhook can
+// be tied back to the intent it settles.
+const referencePrefix = "pact:";
+// ErrSignatureMismatch reports a webhook PayPal could not authenticate.
+export const ErrSignatureMismatch = "paypal: webhook signature does not verify";
+// PaypalLeg moves money over PayPal, serving both sides of a corridor.
+export class PaypalLeg {
+    id;
+    currencies;
+    api;
+    ids;
+    captures = new Map();
+    constructor(cfg) {
+        this.id = cfg.id ?? "paypal";
+        this.currencies = cfg.currencies;
+        this.api = cfg.api;
+        this.ids = cfg.ids;
+    }
+    payInCapabilities() {
+        return {
+            rails: ["paypal"],
+            currencies: this.currencies,
+            methods: ["paypal", "venmo", "card"],
+            refunds: RefundKind.Full,
+        };
+    }
+    payOutCapabilities() {
+        return { rails: ["paypal"], currencies: this.currencies, reversible: false };
+    }
+    // collect creates and captures an order to deliverTo — the recipient's payee for
+    // a direct corridor, the escrow payee for a bridged one — and returns the
+    // capture id. received is the net a bridge would convert.
+    async collect(intentId, quote, _auth, deliverTo) {
+        const capture = await this.api.createAndCaptureOrder({
+            value: majorAmount(quote.srcAmount.minor(), quote.srcAmount.exponent),
+            currencyCode: quote.srcAmount.currency,
+            payee: deliverTo,
+            referenceId: referencePrefix + intentId,
+        });
+        this.captures.set(intentId, capture.captureId);
+        return { providerRef: capture.captureId, received: quote.srcAmount.sub(quote.fees) };
+    }
+    // disburse sends a payout of the recipient's amount to recipientRef and returns
+    // the batch id.
+    async disburse(intentId, quote, recipientRef) {
+        const payout = await this.api.sendPayout({
+            value: majorAmount(quote.dstAmount.minor(), quote.dstAmount.exponent),
+            currencyCode: quote.dstAmount.currency,
+            receiver: recipientRef,
+            referenceId: referencePrefix + intentId,
+        });
+        return { providerRef: payout.batchId };
+    }
+    // refundIn reverses a captured payment in full. PayPal captures the order id in
+    // the capture id it returned from collect, so the refund binds to that
+    // reference.
+    async refundIn(intentId, kind, reason) {
+        if (kind !== RefundKind.Full) {
+            throw new Error(`paypal: cannot perform refund kind ${kind}`);
+        }
+        const captureId = this.captures.get(intentId);
+        if (!captureId) {
+            throw new Error(`paypal: no capture for intent ${intentId}`);
+        }
+        const refund = await this.api.refundCapture({ captureId, reason });
+        return {
+            intentId,
+            state: State.Refunded,
+            adapterId: this.id,
+            providerTxRef: refund.id,
+            onchainTxHash: "",
+            receiptHash: new Uint8Array(0),
+            reason,
+            settledAt: 0,
+        };
+    }
+    // reverseOut reports the truth of the rail: a delivered payout cannot be pulled
+    // back, so a pay-out reversal is refused rather than faked.
+    async reverseOut(_intentId, _reason) {
+        throw new Error("paypal: a delivered payout cannot be reversed");
+    }
+    // parseWebhook authenticates an inbound webhook through PayPal's own
+    // verification call, then maps the event onto the protocol. A payload that does
+    // not verify is rejected; an event the leg does not act on yields no protocol
+    // event.
+    async parseWebhook(raw, headers) {
+        if (!(await this.api.verifyWebhook(headers, raw))) {
+            throw new Error(ErrSignatureMismatch);
+        }
+        const event = JSON.parse(new TextDecoder().decode(raw));
+        const resource = event.resource ?? {};
+        const intentId = intentFromReference(resource.custom_id ?? "", resource.invoice_id ?? "");
+        const providerRef = resource.id ?? "";
+        switch (event.event_type) {
+            case "PAYMENT.CAPTURE.COMPLETED":
+                return [oneEvent(intentId, State.Settled, providerRef, "")];
+            case "PAYMENT.CAPTURE.DENIED":
+                return [oneEvent(intentId, State.Failed, providerRef, "capture denied")];
+            case "PAYMENT.CAPTURE.REFUNDED":
+                return [oneEvent(intentId, State.Refunded, providerRef, "refunded")];
+            default:
+                return [];
+        }
+    }
+}
+function oneEvent(intentId, state, providerRef, reason) {
+    return { intentId, state, providerTxRef: providerRef, onchainTxHash: "", reason, settledAt: 0 };
+}
+// intentFromReference strips the reference prefix off whichever field carried it.
+function intentFromReference(...refs) {
+    for (const ref of refs) {
+        if (ref.length > referencePrefix.length && ref.startsWith(referencePrefix)) {
+            return ref.slice(referencePrefix.length);
+        }
+    }
+    return "";
+}
+// majorAmount renders whole-and-fraction minor units as the decimal-major string
+// PayPal expects, e.g. 1500 minor at exponent 2 becomes "15.00".
+export function majorAmount(minor, exponent) {
+    if (exponent === 0) {
+        return minor;
+    }
+    const neg = minor.startsWith("-");
+    let digits = neg ? minor.slice(1) : minor;
+    while (digits.length <= exponent) {
+        digits = "0" + digits;
+    }
+    const split = digits.length - exponent;
+    const value = digits.slice(0, split) + "." + digits.slice(split);
+    return neg ? "-" + value : value;
+}
+// httpPaypalApi is the live PayPal REST client. It fetches a client-credentials
+// access token, reuses it until it nears expiry, and presents it as a Bearer on
+// each call.
+class HttpPaypalApi {
+    creds;
+    baseURL;
+    now;
+    token = "";
+    tokenExpiryMs = 0;
+    constructor(creds, now) {
+        this.creds = creds;
+        this.baseURL = creds.baseURL || defaultBaseURL;
+        this.now = now;
+    }
+    // accessToken returns a cached client-credentials token, refreshing it when it
+    // is missing or within a minute of expiry.
+    async accessToken() {
+        if (this.token && this.now() < this.tokenExpiryMs - 60_000) {
+            return this.token;
+        }
+        const basic = Buffer.from(`${this.creds.clientId}:${this.creds.clientSecret}`).toString("base64");
+        const resp = await fetch(`${this.baseURL}/v1/oauth2/token`, {
+            method: "POST",
+            headers: { Authorization: `Basic ${basic}`, "Content-Type": "application/x-www-form-urlencoded" },
+            body: "grant_type=client_credentials",
+        });
+        if (resp.status >= 300) {
+            throw new Error(`paypal: /v1/oauth2/token returned ${resp.status}`);
+        }
+        const out = (await resp.json());
+        this.token = out.access_token ?? "";
+        this.tokenExpiryMs = this.now() + (out.expires_in ?? 0) * 1000;
+        return this.token;
+    }
+    async createAndCaptureOrder(params) {
+        const unit = {
+            reference_id: params.referenceId,
+            amount: { currency_code: params.currencyCode, value: params.value },
+        };
+        if (params.payee) {
+            unit.payee = { email_address: params.payee };
+        }
+        const created = await this.postJSON("/v2/checkout/orders", {
+            intent: "CAPTURE",
+            purchase_units: [unit],
+        });
+        const existing = firstCapture(created);
+        if (existing) {
+            return { orderId: created.id ?? "", captureId: existing.id ?? "", status: existing.status ?? "" };
+        }
+        const captured = await this.postJSON(`/v2/checkout/orders/${encodeURIComponent(created.id ?? "")}/capture`, {});
+        const capture = firstCapture(captured);
+        if (!capture) {
+            throw new Error(`paypal: order ${created.id} captured without a capture id`);
+        }
+        return { orderId: captured.id ?? "", captureId: capture.id ?? "", status: capture.status ?? "" };
+    }
+    async sendPayout(params) {
+        const out = await this.postJSON("/v1/payments/payouts", {
+            sender_batch_header: { sender_batch_id: params.referenceId },
+            items: [
+                {
+                    recipient_type: "EMAIL",
+                    amount: { currency: params.currencyCode, value: params.value },
+                    receiver: params.receiver,
+                    sender_item_id: params.referenceId,
+                },
+            ],
+        });
+        return { batchId: out.batch_header?.payout_batch_id ?? "", status: out.batch_header?.batch_status ?? "" };
+    }
+    async refundCapture(params) {
+        const body = {};
+        if (params.reason) {
+            body.note_to_payer = params.reason;
+        }
+        const out = await this.postJSON(`/v2/payments/captures/${encodeURIComponent(params.captureId)}/refund`, body);
+        return { id: out.id ?? "", status: out.status ?? "" };
+    }
+    // verifyWebhook forwards the signature headers and the raw body to PayPal's
+    // verify-webhook-signature endpoint. The webhook id is the shared reference that
+    // binds a payload to this integration; PayPal reports whether the signature is
+    // authentic.
+    async verifyWebhook(headers, body) {
+        const out = await this.postJSON("/v1/notifications/verify-webhook-signature", {
+            webhook_id: this.creds.webhookId,
+            transmission_id: header(headers, "PayPal-Transmission-Id"),
+            transmission_time: header(headers, "PayPal-Transmission-Time"),
+            transmission_sig: header(headers, "PayPal-Transmission-Sig"),
+            cert_url: header(headers, "PayPal-Cert-Url"),
+            auth_algo: header(headers, "PayPal-Auth-Algo"),
+            webhook_event: JSON.parse(new TextDecoder().decode(body)),
+        });
+        return out.verification_status === "SUCCESS";
+    }
+    async postJSON(path, body) {
+        const token = await this.accessToken();
+        const resp = await fetch(this.baseURL + path, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+            body: JSON.stringify(body),
+        });
+        if (resp.status >= 300) {
+            throw new Error(`paypal: ${path} returned ${resp.status}`);
+        }
+        const text = await resp.text();
+        return (text ? JSON.parse(text) : {});
+    }
+}
+function firstCapture(order) {
+    for (const unit of order.purchase_units ?? []) {
+        const captures = unit.payments?.captures ?? [];
+        if (captures.length > 0) {
+            return captures[0];
+        }
+    }
+    return undefined;
+}
+// header reads a single request header case-insensitively.
+function header(headers, name) {
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === name.toLowerCase()) {
+            const values = headers[key];
+            if (values && values.length > 0) {
+                return values[0];
+            }
+        }
+    }
+    return "";
+}
+// newHttpPaypalApi builds a live PayPal client. now is injectable so token expiry
+// is deterministic in tests.
+export function newHttpPaypalApi(creds, now = () => Date.now()) {
+    return new HttpPaypalApi(creds, now);
+}

package/dist/src/adapters/stripe.d.ts

@@ -0,0 +1,61 @@
+import type { Quote, Authorization, Settlement } from "../message.js";
+import { RefundKind, type AdapterEvent } from "../adapter.js";
+import type { PayInLeg, PayInCapabilities, CollectResult } from "../leg.js";
+export interface PaymentIntent {
+    id: string;
+    status: string;
+    amount: number;
+    currency: string;
+    latestCharge: string;
+    metadata: Record<string, string>;
+    created: number;
+}
+export interface Refund {
+    id: string;
+    status: string;
+    amount: number;
+}
+export interface CreateIntentParams {
+    amount: number;
+    currency: string;
+    destination: string;
+    metadata: Record<string, string>;
+}
+export interface CreateRefundParams {
+    paymentIntentId: string;
+    amount: number;
+    reason: string;
+}
+export interface StripeApi {
+    createPaymentIntent(params: CreateIntentParams, idempotencyKey: string): Promise<PaymentIntent>;
+    capturePaymentIntent(id: string, idempotencyKey: string): Promise<PaymentIntent>;
+    findPaymentIntent(pactIntentId: string): Promise<PaymentIntent>;
+    createRefund(params: CreateRefundParams, idempotencyKey: string): Promise<Refund>;
+}
+export interface StripeConfig {
+    id?: string;
+    currencies: string[];
+    api: StripeApi;
+    webhookKey: string;
+    clock?: () => number;
+    tolerance?: number;
+    ids: () => string;
+}
+export declare class StripeLeg implements PayInLeg {
+    readonly id: string;
+    private readonly currencies;
+    private readonly api;
+    private readonly webhookKey;
+    private readonly clock;
+    private readonly tolerance;
+    private readonly ids;
+    constructor(cfg: StripeConfig);
+    payInCapabilities(): PayInCapabilities;
+    collect(intentId: string, quote: Quote, _auth: Authorization, deliverTo: string): Promise<CollectResult>;
+    refundIn(intentId: string, kind: RefundKind, reason: string): Promise<Settlement>;
+    parseWebhook(raw: Uint8Array, headers: Record<string, string[]>): AdapterEvent[];
+}
+export declare const ErrNoSignature = "stripe: missing signature header";
+export declare const ErrSignatureMismatch = "stripe: signature does not verify";
+export declare const ErrTimestampOutOfTolerance = "stripe: webhook timestamp outside tolerance";
+export declare function newHttpStripeApi(secretKey: string, baseURL?: string): StripeApi;

package/dist/src/adapters/stripe.js

@@ -0,0 +1,336 @@
+// Stripe leg for the PACT protocol. It runs server-side only: it holds the Stripe
+// secret and webhook signing keys, creates and captures PaymentIntents, and
+// normalizes Stripe webhooks into protocol events. Stripe serves the pay-in side
+// of a corridor: it charges the payer's card and captures the funds to the
+// account the corridor delivers to, be that the recipient directly or a bridge
+// escrow. Card and wallet collection happens client-side against the
+// PaymentIntent this leg creates; the leg never sees raw card data.
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { State } from "../state.js";
+import { RefundKind } from "../adapter.js";
+// The public base of the Stripe REST API. It is the same for every integration
+// and carries no secret; tests point the leg at a local server instead.
+const defaultBaseURL = "https://api.stripe.com";
+// The Stripe API version this leg is written against. Pinning it keeps response
+// shapes stable across Stripe's own releases.
+const apiVersion = "2026-04-22.dahlia";
+// The pact intent id travels on the PaymentIntent metadata under this key so a
+// webhook can be tied back to the intent it settles.
+const metadataIntentKey = "pact_intent_id";
+// defaultToleranceSeconds is how far a webhook timestamp may drift from now
+// before it is rejected as a possible replay.
+const defaultToleranceSeconds = 300;
+// The protocol identifier used to bind an idempotency key to one protocol step.
+const idPrefix = "pact";
+// StripeLeg collects card payments through Stripe. It exposes the wallets that
+// ride on the card rail as funding methods, and answers a refund with a full or
+// partial reversal.
+export class StripeLeg {
+    id;
+    currencies;
+    api;
+    webhookKey;
+    clock;
+    tolerance;
+    ids;
+    constructor(cfg) {
+        if (!cfg.webhookKey) {
+            throw new Error("stripe: config requires a webhook signing key");
+        }
+        this.id = cfg.id ?? "stripe";
+        this.currencies = cfg.currencies;
+        this.api = cfg.api;
+        this.webhookKey = cfg.webhookKey;
+        this.clock = cfg.clock ?? (() => 0);
+        this.tolerance = cfg.tolerance ?? defaultToleranceSeconds;
+        this.ids = cfg.ids;
+    }
+    // payInCapabilities advertises the card rail and the wallets that fund through
+    // it. The methods are informational; the corridor routes on the rail.
+    payInCapabilities() {
+        return {
+            rails: ["card"],
+            currencies: this.currencies,
+            methods: ["card", "cashapp", "apple_pay", "google_pay", "amazon_pay", "link"],
+            refunds: RefundKind.Partial,
+        };
+    }
+    // collect charges the payer and captures the funds to deliverTo — the recipient
+    // for a direct corridor, the bridge escrow for a bridged one. It creates the
+    // PaymentIntent and captures it in one step, each call keyed to this intent so a
+    // retry reuses the original charge rather than opening a second. received is the
+    // net a bridge would convert: what the payer paid less the corridor fees.
+    async collect(intentId, quote, _auth, deliverTo) {
+        const amount = minorToInteger(quote.srcAmount);
+        const pi = await this.api.createPaymentIntent({
+            amount,
+            currency: quote.srcAmount.currency,
+            destination: deliverTo,
+            metadata: { [metadataIntentKey]: intentId },
+        }, idempotencyKey(intentId, "collect"));
+        const captured = await this.api.capturePaymentIntent(pi.id, idempotencyKey(intentId, "capture"));
+        return { providerRef: captured.id, received: quote.srcAmount.sub(quote.fees) };
+    }
+    // refundIn reverses a captured payment, in full or in part. Stripe supports
+    // both, so the leg accepts the full and partial refund kinds and rejects a
+    // counter-transfer it cannot express.
+    async refundIn(intentId, kind, reason) {
+        if (kind !== RefundKind.Full && kind !== RefundKind.Partial) {
+            throw new Error(`stripe: cannot perform refund kind ${kind}`);
+        }
+        const pi = await this.api.findPaymentIntent(intentId);
+        const refund = await this.api.createRefund({ paymentIntentId: pi.id, amount: 0, reason }, idempotencyKey(intentId, "refund"));
+        return {
+            intentId,
+            state: State.Refunded,
+            adapterId: this.id,
+            providerTxRef: refund.id,
+            onchainTxHash: "",
+            receiptHash: new Uint8Array(0),
+            reason,
+            settledAt: 0,
+        };
+    }
+    // parseWebhook verifies a Stripe webhook and normalizes it into protocol
+    // events. It reads the signature from the Stripe-Signature header and rejects
+    // any payload whose signature or timestamp does not check out. The timestamp is
+    // checked against the injected clock so the result is deterministic.
+    parseWebhook(raw, headers) {
+        return parseEvent(raw, signatureHeader(headers), this.webhookKey, this.clock(), this.tolerance);
+    }
+}
+// signatureHeader pulls the Stripe signature out of the request headers, matching
+// the header name case-insensitively so it works regardless of how the host's
+// HTTP layer canonicalizes keys.
+function signatureHeader(headers) {
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === "stripe-signature") {
+            const values = headers[key];
+            if (values && values.length > 0) {
+                return values[0];
+            }
+        }
+    }
+    return "";
+}
+// idempotencyKey binds a Stripe mutation to one protocol step so a retry reuses
+// the original result instead of acting twice.
+function idempotencyKey(ref, step) {
+    return `${idPrefix}:${ref}:${step}`;
+}
+// minorToInteger narrows a Money amount to the safe integer Stripe expects,
+// refusing anything that would overflow. Fiat amounts fit comfortably; the guard
+// exists so a token amount can never be sent to a card rail by mistake.
+function minorToInteger(m) {
+    const amount = m.value();
+    if (amount > BigInt(Number.MAX_SAFE_INTEGER) || amount < 0n) {
+        throw new Error(`stripe: amount ${m.minor()} exceeds the card-rail range`);
+    }
+    return Number(amount);
+}
+// ErrNoSignature reports a webhook that arrived without a usable Stripe signature
+// header.
+export const ErrNoSignature = "stripe: missing signature header";
+// ErrSignatureMismatch reports a webhook whose signature does not verify.
+export const ErrSignatureMismatch = "stripe: signature does not verify";
+// ErrTimestampOutOfTolerance reports a webhook whose timestamp is too old or too
+// far in the future to trust.
+export const ErrTimestampOutOfTolerance = "stripe: webhook timestamp outside tolerance";
+// verifySignature checks a Stripe-Signature header against the raw payload and
+// the webhook signing secret: sign "{t}.{payload}" with HMAC-SHA256 and compare
+// in constant time. now and tolerance are injected so the check is deterministic
+// in tests.
+function verifySignature(payload, header, secret, now, tolerance) {
+    if (!header) {
+        throw new Error(ErrNoSignature);
+    }
+    let timestamp = "";
+    const signatures = [];
+    for (const part of header.split(",")) {
+        const kv = part.trim();
+        const eq = kv.indexOf("=");
+        if (eq < 0) {
+            continue;
+        }
+        const name = kv.slice(0, eq);
+        const value = kv.slice(eq + 1);
+        if (name === "t") {
+            timestamp = value;
+        }
+        else if (name === "v1") {
+            signatures.push(value);
+        }
+    }
+    if (!timestamp || signatures.length === 0) {
+        throw new Error(ErrNoSignature);
+    }
+    const ts = Number(timestamp);
+    if (!Number.isInteger(ts)) {
+        throw new Error(ErrNoSignature);
+    }
+    const diff = now - ts;
+    if (diff > tolerance || diff < -tolerance) {
+        throw new Error(ErrTimestampOutOfTolerance);
+    }
+    const mac = createHmac("sha256", secret);
+    mac.update(timestamp);
+    mac.update(".");
+    mac.update(payload);
+    const expected = mac.digest();
+    for (const sig of signatures) {
+        let got;
+        try {
+            got = Buffer.from(sig, "hex");
+        }
+        catch {
+            continue;
+        }
+        if (got.length === expected.length && timingSafeEqual(got, expected)) {
+            return;
+        }
+    }
+    throw new Error(ErrSignatureMismatch);
+}
+// parseEvent verifies the signature and maps a Stripe event onto the protocol.
+// Events this leg does not act on yield no protocol event rather than an error.
+function parseEvent(payload, header, secret, now, tolerance) {
+    verifySignature(payload, header, secret, now, tolerance);
+    const event = JSON.parse(new TextDecoder().decode(payload));
+    switch (event.type) {
+        case "payment_intent.succeeded":
+            return oneEvent(decodePaymentIntent(event.data.object), State.Settled, "");
+        case "payment_intent.payment_failed":
+            return oneEvent(decodePaymentIntent(event.data.object), State.Failed, "payment failed");
+        case "charge.refunded":
+            return oneEvent(decodeRefundedIntent(event.data.object), State.Refunded, "refunded");
+        default:
+            return [];
+    }
+}
+function decodePaymentIntent(raw) {
+    const obj = raw;
+    return { id: obj.id ?? "", metadata: obj.metadata ?? {}, created: obj.created ?? 0 };
+}
+// decodeRefundedIntent reads the pact intent id off a refunded charge. A charge
+// carries the originating PaymentIntent id and copies its metadata.
+function decodeRefundedIntent(raw) {
+    const charge = raw;
+    return { id: charge.payment_intent ?? "", metadata: charge.metadata ?? {}, created: charge.created ?? 0 };
+}
+function oneEvent(pi, state, reason) {
+    return [
+        {
+            intentId: pi.metadata[metadataIntentKey] ?? "",
+            state,
+            providerTxRef: pi.id,
+            onchainTxHash: "",
+            reason,
+            settledAt: pi.created * 1000,
+        },
+    ];
+}
+// httpStripeApi is the live Stripe REST client. The secret key is injected by the
+// host from its own secrets store and never originates in this code.
+class HttpStripeApi {
+    secretKey;
+    baseURL;
+    constructor(secretKey, baseURL) {
+        this.secretKey = secretKey;
+        this.baseURL = baseURL || defaultBaseURL;
+    }
+    async createPaymentIntent(params, idempotencyKey) {
+        const form = new URLSearchParams();
+        form.set("amount", String(params.amount));
+        form.set("currency", params.currency.toLowerCase());
+        form.set("capture_method", "manual");
+        form.set("automatic_payment_methods[enabled]", "true");
+        if (params.destination) {
+            form.set("transfer_data[destination]", params.destination);
+        }
+        for (const [k, v] of Object.entries(params.metadata)) {
+            form.set(`metadata[${k}]`, v);
+        }
+        const pi = await this.post("/v1/payment_intents", form, idempotencyKey);
+        return normalizeIntent(pi);
+    }
+    async capturePaymentIntent(id, idempotencyKey) {
+        const pi = await this.post(`/v1/payment_intents/${encodeURIComponent(id)}/capture`, new URLSearchParams(), idempotencyKey);
+        return normalizeIntent(pi);
+    }
+    async findPaymentIntent(pactIntentId) {
+        const query = new URLSearchParams();
+        query.set("query", `metadata["${metadataIntentKey}"]:"${pactIntentId}"`);
+        const result = await this.get(`/v1/payment_intents/search?${query.toString()}`);
+        const first = result.data[0];
+        if (!first) {
+            throw new Error(`stripe: no payment intent for ${pactIntentId}`);
+        }
+        return normalizeIntent(first);
+    }
+    async createRefund(params, idempotencyKey) {
+        const form = new URLSearchParams();
+        form.set("payment_intent", params.paymentIntentId);
+        if (params.amount > 0) {
+            form.set("amount", String(params.amount));
+        }
+        if (params.reason) {
+            form.set("metadata[reason]", params.reason);
+        }
+        const r = await this.post("/v1/refunds", form, idempotencyKey);
+        return { id: r.id ?? "", status: r.status ?? "", amount: r.amount ?? 0 };
+    }
+    async post(path, form, idempotencyKey) {
+        const headers = { "Content-Type": "application/x-www-form-urlencoded" };
+        if (idempotencyKey) {
+            headers["Idempotency-Key"] = idempotencyKey;
+        }
+        return this.send(path, { method: "POST", headers, body: form.toString() });
+    }
+    async get(path) {
+        return this.send(path, { method: "GET" });
+    }
+    async send(path, init) {
+        const headers = {
+            ...(init.headers ?? {}),
+            Authorization: `Bearer ${this.secretKey}`,
+            "Stripe-Version": apiVersion,
+        };
+        const resp = await fetch(this.baseURL + path, { ...init, headers });
+        const body = await resp.text();
+        if (resp.status >= 300) {
+            throw new Error(`stripe: ${path} returned ${resp.status}: ${stripeErrorMessage(body)}`);
+        }
+        return JSON.parse(body);
+    }
+}
+// stripeErrorMessage lifts Stripe's error message out of a response body without
+// echoing anything that could carry a key.
+function stripeErrorMessage(body) {
+    try {
+        const envelope = JSON.parse(body);
+        const message = envelope.error?.message;
+        if (!message) {
+            return "unknown error";
+        }
+        return envelope.error?.code ? `${message} (${envelope.error.code})` : message;
+    }
+    catch {
+        return "unknown error";
+    }
+}
+function normalizeIntent(p) {
+    return {
+        id: p.id ?? "",
+        status: p.status ?? "",
+        amount: p.amount ?? 0,
+        currency: (p.currency ?? "").toUpperCase(),
+        latestCharge: p.latest_charge ?? "",
+        metadata: p.metadata ?? {},
+        created: p.created ?? 0,
+    };
+}
+// newHttpStripeApi builds a live Stripe client. baseURL is optional and defaults
+// to the public Stripe API; it exists so tests can substitute a local server.
+export function newHttpStripeApi(secretKey, baseURL = "") {
+    return new HttpStripeApi(secretKey, baseURL);
+}