@phala/pay 0.1.1 → 0.2.0

package/dist/server/webhook.js

@@ -0,0 +1,148 @@
+/**
+ * Standard Webhooks `v1a` verification of Phala Pay deliveries (design D11): an ed25519 signature
+ * over `{webhook-id}.{webhook-timestamp}.{body}` by your account's webhook key in the endpoint's
+ * mode, pinned from `GET /v1/attestation`. Uses WebCrypto, so it runs on Node 20+, Deno, Bun, and
+ * edge runtimes.
+ */
+/** A delivery that did not verify: answer `400` and do nothing. */
+export class WebhookSignatureError extends Error {
+    name = "WebhookSignatureError";
+}
+/**
+ * Verifies a delivery and returns its event, as Stripe's `constructEvent` does, failing closed
+ * unless a `v1a` signature verifies with one of `publicKeys` (hex or base64 raw ed25519 keys; pass
+ * both while a rotation overlaps), the timestamp is within tolerance, the body's id is the
+ * `webhook-id`, and the event is `expectedAccount`'s in `expectedLivemode`.
+ *
+ * `payload` is the raw request body, before any JSON parsing.
+ */
+export async function constructEvent(payload, headers, publicKeys, options) {
+    if (options.expectedAccount === "") {
+        throw new TypeError("expectedAccount is required");
+    }
+    const body = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+    const id = header(headers, "webhook-id");
+    const timestamp = header(headers, "webhook-timestamp");
+    const signatures = header(headers, "webhook-signature");
+    if (id === undefined || timestamp === undefined || signatures === undefined) {
+        throw new WebhookSignatureError("webhook headers missing");
+    }
+    if (!/^\d+$/.test(timestamp)) {
+        throw new WebhookSignatureError("webhook timestamp malformed");
+    }
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - Number(timestamp)) > (options.tolerance ?? 300)) {
+        throw new WebhookSignatureError("webhook timestamp outside tolerance");
+    }
+    const signed = concat(new TextEncoder().encode(`${id}.${timestamp}.`), body);
+    const keys = await Promise.all((typeof publicKeys === "string" ? [publicKeys] : publicKeys).map(importKey));
+    if (keys.length === 0) {
+        throw new TypeError("no webhook public key pinned");
+    }
+    let verified = false;
+    for (const entry of signatures.split(" ")) {
+        const [version, encoded] = entry.split(",", 2);
+        const signature = version === "v1a" && encoded !== undefined ? base64(encoded) : undefined;
+        if (signature === undefined) {
+            continue;
+        }
+        for (const key of keys) {
+            if (await crypto.subtle.verify("Ed25519", key, signature, signed)) {
+                verified = true;
+            }
+        }
+    }
+    if (!verified) {
+        throw new WebhookSignatureError("no valid webhook signature");
+    }
+    let event;
+    try {
+        event = JSON.parse(new TextDecoder().decode(body));
+    }
+    catch {
+        throw new TypeError("webhook body is not an event");
+    }
+    if (typeof event !== "object" || event === null) {
+        throw new TypeError("webhook body is not an event");
+    }
+    const e = event;
+    const data = e["data"];
+    const object = typeof data === "object" && data !== null ? data["object"] : null;
+    const { id: eventId, type, account, livemode, created, actor } = e;
+    if (e["object"] !== "event" ||
+        typeof eventId !== "string" ||
+        typeof type !== "string" ||
+        typeof account !== "string" ||
+        typeof livemode !== "boolean" ||
+        typeof created !== "number" ||
+        !Number.isSafeInteger(created) ||
+        typeof object !== "object" ||
+        object === null ||
+        !(actor === undefined || typeof actor === "string")) {
+        throw new TypeError("webhook body is not an event");
+    }
+    if (eventId !== id) {
+        throw new WebhookSignatureError("webhook id does not match the event");
+    }
+    if (account !== options.expectedAccount) {
+        throw new WebhookSignatureError("webhook event is for another account");
+    }
+    if (livemode !== options.expectedLivemode) {
+        throw new WebhookSignatureError("webhook event is for the other mode");
+    }
+    const previous = data["previous_attributes"];
+    return {
+        id: eventId,
+        object: "event",
+        account,
+        livemode,
+        type,
+        created,
+        ...(actor === undefined ? {} : { actor }),
+        data: {
+            object: object,
+            ...(typeof previous === "object" && previous !== null
+                ? { previous_attributes: previous }
+                : {}),
+        },
+    };
+}
+function header(headers, name) {
+    if (headers instanceof Headers) {
+        return headers.get(name)?.trim() ?? undefined;
+    }
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === name) {
+            return (Array.isArray(value) ? value.join(" ") : value)?.trim();
+        }
+    }
+    return undefined;
+}
+async function importKey(encoded) {
+    const value = encoded.trim().replace(/^0x/, "");
+    const raw = /^[0-9a-fA-F]{64}$/.test(value) ? hex(value) : base64(value);
+    if (raw?.length !== 32) {
+        throw new TypeError("a webhook public key is 32 bytes of hex or base64");
+    }
+    return crypto.subtle.importKey("raw", raw, "Ed25519", false, ["verify"]);
+}
+function hex(value) {
+    const bytes = new Uint8Array(value.length / 2);
+    for (let index = 0; index < bytes.length; index += 1) {
+        bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}
+function base64(value) {
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(value) || value.length % 4 !== 0) {
+        return undefined;
+    }
+    return Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+}
+function concat(left, right) {
+    const joined = new Uint8Array(left.length + right.length);
+    joined.set(left);
+    joined.set(right, left.length);
+    return joined;
+}
+//# sourceMappingURL=webhook.js.map

package/dist/server/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/server/webhook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5B,IAAI,GAAG,uBAAuB,CAAC;CAClD;AAsCD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA4B,EAC5B,OAAgE,EAChE,UAAsC,EACtC,OAA8B;IAE9B,IAAI,OAAO,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACvF,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxD,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAC5E,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;gBAClE,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,IAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACnE,IACE,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO;QACvB,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,QAAQ,KAAK,SAAS;QAC7B,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,qBAAqB,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAI,IAAgC,CAAC,qBAAqB,CAAC,CAAC;IAC1E,OAAO;QACL,EAAE,EAAE,OAAO;QACX,MAAM,EAAE,OAAO;QACf,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,OAAO;QACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,IAAI,EAAE;YACJ,MAAM,EAAE,MAAiC;YACzC,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;gBACnD,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAmC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,OAAgE,EAChE,IAAY;IAEZ,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,GAAG,EAAE,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,MAAM,CAAC,IAAgB,EAAE,KAAiB;IACjD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/wallet.d.ts

@@ -1,4 +1,4 @@
-import { type Hash } from "viem";
+import { type Hash, type WalletClient } from "viem";
 import type { ClientQuote } from "./quote.js";
 /** EIP-6963 provider info. */
 export interface WalletInfo {
@@ -22,9 +22,9 @@ export interface Wallet {
 /** The legacy `window.ethereum` provider, offered when no wallet announces itself (EIP-6963). */
 export declare const INJECTED_WALLET_UUID = "injected";
 /**
- * Discovers browser wallets with EIP-6963, falling back to `window.ethereum`, and calls `onChange`
- * with the current list whenever a wallet announces itself. Returns the function that stops
- * listening.
+ * Discovers browser wallets with EIP-6963 (through mipd's store), falling back to
+ * `window.ethereum`, and calls `onChange` with the current list whenever a wallet announces
+ * itself. Returns the function that stops listening.
  */
 export declare function watchWallets(onChange: (wallets: Wallet[]) => void): () => void;
 export type WalletErrorCode = "rejected" | "no_account" | "wrong_chain" | "failed";
@@ -34,9 +34,11 @@ export declare class WalletError extends Error {
     constructor(code: WalletErrorCode, message: string, options?: ErrorOptions);
 }
 /**
- * Pays a quote from a browser wallet: connects, switches to (or adds) the quote's chain, and sends
- * the ERC-20 `transfer` that the quote's `payment_uri` states. Resolves with the transaction hash
- * once the wallet has broadcast it; the checkout's status follows the payment from there.
+ * Pays a quote from a wallet: a viem `WalletClient` (for example wagmi's `useWalletClient()`), or an
+ * EIP-1193 provider such as a discovered `Wallet`'s. Connects (unless the client already has an
+ * account), switches to (or adds) the quote's chain, and sends the ERC-20 `transfer` that the quote's
+ * `payment_uri` states. Resolves with the transaction hash once the wallet has broadcast it; the
+ * checkout's status follows the payment from there.
  */
-export declare function payWithWallet(provider: EthereumProvider, quote: ClientQuote): Promise<Hash>;
+export declare function payWithWallet(wallet: WalletClient | EthereumProvider, quote: ClientQuote): Promise<Hash>;
 //# sourceMappingURL=wallet.d.ts.map

package/dist/wallet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../src/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EAEV,MAAM,MAAM,CAAC;AAGd,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,iGAAiG;AACjG,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAM/C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,MAAM,IAAI,CA0C9E;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,qBAAa,WAAY,SAAQ,KAAK;IAIlC,QAAQ,CAAC,IAAI,EAAE,eAAe;IAHhC,SAAkB,IAAI,iBAAiB;gBAG5B,IAAI,EAAE,eAAe,EAC9B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BjG"}
+{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../src/wallet.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,IAAI,EACT,KAAK,YAAY,EAClB,MAAM,MAAM,CAAC;AAGd,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,iGAAiG;AACjG,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,MAAM,IAAI,CAa9E;AA8BD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,qBAAa,WAAY,SAAQ,KAAK;IAIlC,QAAQ,CAAC,IAAI,EAAE,eAAe;IAHhC,SAAkB,IAAI,iBAAiB;gBAG5B,IAAI,EAAE,eAAe,EAC9B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,YAAY,GAAG,gBAAgB,EACvC,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/wallet.js

@@ -1,53 +1,51 @@
-import { createWalletClient, custom, erc20Abi, } from "viem";
+import { createStore } from "mipd";
+import { BaseError, createWalletClient, custom, erc20Abi, SwitchChainError, UserRejectedRequestError, } from "viem";
 import { knownChain, networkName } from "./chains.js";
 import { quoteTransfer } from "./payment.js";
 /** The legacy `window.ethereum` provider, offered when no wallet announces itself (EIP-6963). */
 export const INJECTED_WALLET_UUID = "injected";
 /**
- * Discovers browser wallets with EIP-6963, falling back to `window.ethereum`, and calls `onChange`
- * with the current list whenever a wallet announces itself. Returns the function that stops
- * listening.
+ * Discovers browser wallets with EIP-6963 (through mipd's store), falling back to
+ * `window.ethereum`, and calls `onChange` with the current list whenever a wallet announces
+ * itself. Returns the function that stops listening.
  */
 export function watchWallets(onChange) {
     if (typeof window === "undefined") {
         onChange([]);
         return () => undefined;
     }
-    const announced = new Map();
-    const emit = () => {
-        const wallets = [...announced.values()];
-        const injected = window.ethereum;
-        if (wallets.length === 0 && injected !== undefined) {
-            wallets.push({
-                info: { uuid: INJECTED_WALLET_UUID, name: "Browser wallet", icon: "", rdns: "" },
-                provider: injected,
-            });
-        }
-        onChange(wallets);
+    const store = createStore();
+    const unsubscribe = store.subscribe((details) => onChange(walletsFrom(details)), {
+        emitImmediately: true,
+    });
+    return () => {
+        unsubscribe();
+        store.destroy();
     };
-    const onAnnounce = (event) => {
-        const detail = event.detail;
-        const info = detail?.info;
-        if (detail?.provider === undefined ||
-            typeof info?.uuid !== "string" ||
-            typeof info.name !== "string") {
-            return;
+}
+/** Announcements are untrusted page events: keep well-formed ones, and only data-URI icons. */
+function walletsFrom(announcements) {
+    const wallets = [];
+    for (const { info, provider } of announcements) {
+        if (!isProvider(provider) || typeof info?.uuid !== "string" || typeof info.name !== "string") {
+            continue;
         }
-        announced.set(info.uuid, {
-            info: {
-                uuid: info.uuid,
-                name: info.name,
-                icon: typeof info.icon === "string" && info.icon.startsWith("data:image/") ? info.icon : "",
-                rdns: typeof info.rdns === "string" ? info.rdns : "",
-            },
-            provider: detail.provider,
+        const icon = typeof info.icon === "string" && info.icon.startsWith("data:image/") ? info.icon : "";
+        const rdns = typeof info.rdns === "string" ? info.rdns : "";
+        wallets.push({ info: { uuid: info.uuid, name: info.name, icon, rdns }, provider });
+    }
+    // Wallets that predate EIP-6963, such as some in-app mobile browsers, only set `window.ethereum`.
+    const injected = window.ethereum;
+    if (wallets.length === 0 && injected !== undefined) {
+        wallets.push({
+            info: { uuid: INJECTED_WALLET_UUID, name: "Browser wallet", icon: "", rdns: "" },
+            provider: injected,
         });
-        emit();
-    };
-    window.addEventListener("eip6963:announceProvider", onAnnounce);
-    window.dispatchEvent(new Event("eip6963:requestProvider"));
-    emit();
-    return () => window.removeEventListener("eip6963:announceProvider", onAnnounce);
+    }
+    return wallets;
+}
+function isProvider(value) {
+    return typeof value?.request === "function";
 }
 export class WalletError extends Error {
     code;
@@ -58,20 +56,22 @@ export class WalletError extends Error {
     }
 }
 /**
- * Pays a quote from a browser wallet: connects, switches to (or adds) the quote's chain, and sends
- * the ERC-20 `transfer` that the quote's `payment_uri` states. Resolves with the transaction hash
- * once the wallet has broadcast it; the checkout's status follows the payment from there.
+ * Pays a quote from a wallet: a viem `WalletClient` (for example wagmi's `useWalletClient()`), or an
+ * EIP-1193 provider such as a discovered `Wallet`'s. Connects (unless the client already has an
+ * account), switches to (or adds) the quote's chain, and sends the ERC-20 `transfer` that the quote's
+ * `payment_uri` states. Resolves with the transaction hash once the wallet has broadcast it; the
+ * checkout's status follows the payment from there.
  */
-export async function payWithWallet(provider, quote) {
+export async function payWithWallet(wallet, quote) {
     const transfer = quoteTransfer(quote);
-    const wallet = createWalletClient({ transport: custom(provider) });
+    const client = isWalletClient(wallet) ? wallet : createWalletClient({ transport: custom(wallet) });
     try {
-        const [account] = await wallet.requestAddresses();
+        const account = client.account ?? (await client.requestAddresses())[0];
         if (account === undefined) {
             throw new WalletError("no_account", "The wallet shared no account");
         }
-        await ensureChain(wallet, transfer.chainId);
-        return await wallet.writeContract({
+        await ensureChain(client, transfer.chainId);
+        return await client.writeContract({
             account,
             chain: knownChain(transfer.chainId) ?? null,
             address: transfer.token,
@@ -84,12 +84,15 @@ export async function payWithWallet(provider, quote) {
         if (error instanceof WalletError) {
             throw error;
         }
-        if (hasCode(error, 4001)) {
+        if (isRejection(error)) {
             throw new WalletError("rejected", "The request was rejected in the wallet", { cause: error });
         }
         throw new WalletError("failed", "The wallet could not send the payment", { cause: error });
     }
 }
+function isWalletClient(wallet) {
+    return "writeContract" in wallet;
+}
 async function ensureChain(wallet, chainId) {
     if ((await wallet.getChainId()) === chainId) {
         return;
@@ -98,10 +101,9 @@ async function ensureChain(wallet, chainId) {
         await wallet.switchChain({ id: chainId });
     }
     catch (error) {
-        // 4902: the wallet does not know the chain yet.
         const chain = knownChain(chainId);
-        if (!hasCode(error, 4902) || chain === undefined) {
-            throw hasCode(error, 4001)
+        if (!isUnknownChain(error) || chain === undefined) {
+            throw isRejection(error)
                 ? error
                 : new WalletError("wrong_chain", `Switch your wallet to ${networkName(chainId)}`, {
                     cause: error,
@@ -116,20 +118,16 @@ async function ensureChain(wallet, chainId) {
         throw new WalletError("wrong_chain", `Switch your wallet to ${networkName(chainId)}`);
     }
 }
-/** Whether an error or any of its causes carries an EIP-1193 error code; some mobile wallets nest
- * the original error under `data.originalError`. */
-function hasCode(error, code) {
-    for (let current = error; typeof current === "object" && current !== null;) {
-        const value = current;
-        if (value.code === code) {
-            return true;
-        }
-        const nested = value.data?.originalError;
-        if (typeof nested === "object" && nested !== null && hasCode(nested, code)) {
-            return true;
-        }
-        current = value.cause;
-    }
-    return false;
+function isRejection(error) {
+    return error instanceof BaseError && error.walk((e) => e instanceof UserRejectedRequestError) !== null;
+}
+/** Whether the wallet does not know the chain (4902). MetaMask Mobile nests that code in an internal
+ * error's `data.originalError`, which wagmi's injected connector also unwraps. */
+function isUnknownChain(error) {
+    return (error instanceof BaseError &&
+        error.walk((e) => {
+            const nested = e?.data;
+            return e instanceof SwitchChainError || nested?.originalError?.code === SwitchChainError.code;
+        }) !== null);
 }
 //# sourceMappingURL=wallet.js.map

package/dist/wallet.js.map

@@ -1 +1 @@
-{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../src/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,MAAM,EACN,QAAQ,GAGT,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAsB7C,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAM/C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAqC;IAChE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAI,MAA0C,CAAC,QAAQ,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBAChF,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,KAAY,EAAE,EAAE;QAClC,MAAM,MAAM,GAAI,KAA+B,CAAC,MAAM,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;QAC1B,IACE,MAAM,EAAE,QAAQ,KAAK,SAAS;YAC9B,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;YAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAC7B,CAAC;YACD,OAAO;QACT,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3F,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;aACrD;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC;IACP,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;AAClF,CAAC;AAID,MAAM,OAAO,WAAY,SAAQ,KAAK;IAIzB;IAHO,IAAI,GAAG,aAAa,CAAC;IAEvC,YACW,IAAqB,EAC9B,OAAe,EACf,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAJf,SAAI,GAAJ,IAAI,CAAiB;IAKhC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAA0B,EAAE,KAAkB;IAChF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,MAAM,MAAM,CAAC,aAAa,CAAC;YAChC,OAAO;YACP,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;YAC3C,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CAAC,UAAU,EAAE,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAoB,EAAE,OAAe;IAC9D,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gDAAgD;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE,yBAAyB,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE;oBAC9E,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;QACT,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,yBAAyB,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED;oDACoD;AACpD,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,KAAK,IAAI,OAAO,GAAG,KAAK,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,GAAI,CAAC;QAC5E,MAAM,KAAK,GAAG,OAAkF,CAAC;QACjG,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../src/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,GAGzB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAsB7C,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAqC;IAChE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE;QAC/E,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;IACH,OAAO,GAAG,EAAE;QACV,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAID,+FAA+F;AAC/F,SAAS,WAAW,CAAC,aAAsC;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,kGAAkG;IAClG,MAAM,QAAQ,GAAI,MAA0C,CAAC,QAAQ,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAChF,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAQ,KAAsD,EAAE,OAAO,KAAK,UAAU,CAAC;AAChG,CAAC;AAID,MAAM,OAAO,WAAY,SAAQ,KAAK;IAIzB;IAHO,IAAI,GAAG,aAAa,CAAC;IAEvC,YACW,IAAqB,EAC9B,OAAe,EACf,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAJf,SAAI,GAAJ,IAAI,CAAiB;IAKhC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAuC,EACvC,KAAkB;IAElB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,MAAM,MAAM,CAAC,aAAa,CAAC;YAChC,OAAO;YACP,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;YAC3C,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC,UAAU,EAAE,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAuC;IAC7D,OAAO,eAAe,IAAI,MAAM,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAoB,EAAE,OAAe;IAC9D,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,WAAW,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE,yBAAyB,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE;oBAC9E,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;QACT,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,aAAa,EAAE,yBAAyB,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,wBAAwB,CAAC,KAAK,IAAI,CAAC;AACzG,CAAC;AAED;kFACkF;AAClF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,KAAK,YAAY,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACf,MAAM,MAAM,GAAI,CAA8D,EAAE,IAAI,CAAC;YACrF,OAAO,CAAC,YAAY,gBAAgB,IAAI,MAAM,EAAE,aAAa,EAAE,IAAI,KAAK,gBAAgB,CAAC,IAAI,CAAC;QAChG,CAAC,CAAC,KAAK,IAAI,CACZ,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phala/pay",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Phala Pay checkout: a framework-agnostic client and React bindings",
   "keywords": [
     "crypto",
@@ -32,6 +32,10 @@
     "./react": {
       "types": "./dist/react/index.d.ts",
       "default": "./dist/react/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
     }
   },
   "files": [
@@ -57,6 +61,7 @@
     "check": "pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build"
   },
   "dependencies": {
+    "mipd": "^0.0.7",
     "uqr": "^0.1.3"
   },
   "peerDependencies": {

package/src/checkout.ts

@@ -1,13 +1,18 @@
+import { getAddress, isAddress, isAddressEqual } from "viem";
 import { parseClientQuote, quoteIdFromClientSecret, type ClientQuote } from "./quote.js";
 
 /**
  * What the payer sees:
  * - `loading` until the quote is first read;
  * - `waiting` for a payment, until `expires_at`;
- * - `seen` once a transfer is in a block, `confirming` once it is final and being valued;
- * - `credited`, or `rejected` for a final payment that will not be credited;
+ * - `seen` once a transfer is in a block, `confirming` once it reaches the route's confirmation
+ *   (two blocks on Ethereum) and is being valued;
+ * - `credited` (about 30 seconds after paying), or `rejected` for a payment that will not be
+ *   credited;
+ * - `reversed` when a credited payment's transaction left the chain before finality;
  * - `expired` or `canceled` without a payment;
- * - `error` when the client secret is not valid.
+ * - `error` when the client secret is not valid, or the quote's address is not the one your
+ *   backend expects (`address_mismatch`): nothing is shown to pay.
  */
 export type CheckoutStatus =
   | "loading"
@@ -16,27 +21,72 @@ export type CheckoutStatus =
   | "confirming"
   | "credited"
   | "rejected"
+  | "reversed"
   | "expired"
   | "canceled"
   | "error";
 
 export type CheckoutErrorCode =
   | "invalid_client_secret"
+  | "address_mismatch"
   | "rate_limited"
   | "network_error"
   | "invalid_response"
   | "api_error";
 
+export interface CheckoutErrorOptions extends ErrorOptions {
+  /** The failed response's `Request-Id`, `req_…`, to quote to support. */
+  requestId?: string;
+  /** For `rate_limited`: the seconds the service asked to wait (`Retry-After`). */
+  retryAfter?: number;
+}
+
 export class CheckoutError extends Error {
   override readonly name = "CheckoutError";
+  /** The failed response's `Request-Id`, when the service answered. */
+  readonly requestId: string | undefined;
+  /** For `rate_limited`: the seconds to wait before the next read. */
+  readonly retryAfter: number | undefined;
 
   constructor(
     readonly code: CheckoutErrorCode,
     message: string,
-    options?: ErrorOptions,
+    options?: CheckoutErrorOptions,
   ) {
     super(message, options);
+    this.requestId = options?.requestId;
+    this.retryAfter = options?.retryAfter;
+  }
+}
+
+/**
+ * The error of a failed read of a public view, with the response's `Request-Id` and, on `429`,
+ * its `Retry-After`.
+ */
+export function responseError(response: Response, notFound: string): CheckoutError {
+  const header = response.headers.get("request-id");
+  const requestId = header === null ? {} : { requestId: header };
+  if (response.status === 404) {
+    return new CheckoutError("invalid_client_secret", notFound, requestId);
+  }
+  if (response.status === 429) {
+    const seconds = Number(response.headers.get("retry-after"));
+    return new CheckoutError("rate_limited", "too many status requests", {
+      ...requestId,
+      ...(Number.isFinite(seconds) && seconds > 0 ? { retryAfter: seconds } : {}),
+    });
   }
+  return new CheckoutError(
+    "api_error",
+    `the payment service answered ${response.status}`,
+    requestId,
+  );
+}
+
+/** The delay before the next read after `failures` failed ones, at least what `error` asks. */
+export function pollDelay(interval: number, failures: number, error: CheckoutError | null): number {
+  const backoff = failures === 0 ? interval : Math.min(interval * 2 ** failures, MAX_BACKOFF);
+  return Math.max(backoff, (error?.retryAfter ?? 0) * 1000);
 }
 
 export interface CheckoutState {
@@ -49,6 +99,12 @@ export interface CheckoutState {
 export interface CheckoutOptions {
   /** The quote's `client_secret`, from your backend's `POST /v1/quotes`. */
   clientSecret: string;
+  /**
+   * The quote's address as your backend's SDK recomputed it from the pinned forwarder. The
+   * checkout fails closed, showing nothing to pay, when the quote read from the service names
+   * another address.
+   */
+  expectedAddress: string;
   /** The service origin, for example `https://topup.example.com`. */
   apiBase: string;
   /** Milliseconds between status reads; default 3000. */
@@ -73,37 +129,50 @@ const MAX_BACKOFF = 30_000;
 
 export interface RetrieveQuoteOptions {
   clientSecret: string;
+  /** The address your backend recomputed; a quote naming another one is refused. */
+  expectedAddress: string;
   apiBase: string;
   fetch?: typeof globalThis.fetch;
 }
 
 /**
  * Reads a quote's public view once, as Stripe.js's `retrievePaymentIntent(clientSecret)` does.
- * Rejects with a `CheckoutError`: `invalid_client_secret` for an unknown quote or secret.
+ * Rejects with a `CheckoutError`: `invalid_client_secret` for an unknown quote or secret,
+ * `address_mismatch` for a quote whose address is not `expectedAddress`.
  */
 export async function retrieveQuote(options: RetrieveQuoteOptions): Promise<ClientQuote> {
   const quoteId = quoteIdFromClientSecret(options.clientSecret);
+  const expected = expectedAddress(options.expectedAddress);
   const base = options.apiBase.replace(/\/+$/, "");
   const url = `${base}/v1/quotes/${quoteId}?client_secret=${encodeURIComponent(options.clientSecret)}`;
   const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
   // A simple GET with no custom headers, so the browser sends no CORS preflight.
   const response = await fetchImpl(url, { cache: "no-store", credentials: "omit" });
-  if (response.status === 404) {
-    throw new CheckoutError("invalid_client_secret", "the quote or its client secret is unknown");
-  }
-  if (response.status === 429) {
-    throw new CheckoutError("rate_limited", "too many status requests");
-  }
   if (!response.ok) {
-    throw new CheckoutError("api_error", `the payment service answered ${response.status}`);
+    throw responseError(response, "the quote or its client secret is unknown");
   }
+  let quote: ClientQuote;
   try {
-    return parseClientQuote(await response.json());
+    quote = parseClientQuote(await response.json());
   } catch (cause) {
     throw new CheckoutError("invalid_response", "unexpected response from the payment service", {
       cause,
     });
   }
+  if (!isAddressEqual(getAddress(quote.address), expected)) {
+    throw new CheckoutError(
+      "address_mismatch",
+      "the quote's address is not the one the merchant expects",
+    );
+  }
+  return quote;
+}
+
+function expectedAddress(value: string): `0x${string}` {
+  if (!isAddress(value, { strict: false })) {
+    throw new TypeError("expectedAddress is not an address");
+  }
+  return getAddress(value);
 }
 
 /** The payer-facing status of a quote at `nowSeconds`. */
@@ -128,6 +197,7 @@ export function checkoutStatus(quote: ClientQuote, nowSeconds: number): Checkout
  */
 export function createCheckout(options: CheckoutOptions): CheckoutSession {
   quoteIdFromClientSecret(options.clientSecret);
+  expectedAddress(options.expectedAddress);
   const now = options.now ?? Date.now;
   const interval = options.pollInterval ?? DEFAULT_POLL_INTERVAL;
   const listeners = new Set<(state: CheckoutState) => void>();
@@ -159,6 +229,7 @@ export function createCheckout(options: CheckoutOptions): CheckoutSession {
       status === "error" ||
       status === "credited" ||
       status === "rejected" ||
+      status === "reversed" ||
       status === "canceled" ||
       (status === "expired" && quote?.status === "expired")
     );
@@ -176,7 +247,10 @@ export function createCheckout(options: CheckoutOptions): CheckoutSession {
           : new CheckoutError("network_error", "could not reach the payment service", { cause });
       failures += 1;
       const quote = state.quote;
-      if (error.code === "invalid_client_secret") {
+      if (error.code === "address_mismatch") {
+        // Fail closed: forget the quote, so nothing about its address is shown.
+        setState({ status: "error", quote: null, error });
+      } else if (error.code === "invalid_client_secret") {
         setState({ status: "error", quote, error });
       } else {
         setState({
@@ -199,7 +273,7 @@ export function createCheckout(options: CheckoutOptions): CheckoutSession {
     if (finished()) {
       return;
     }
-    const delay = failures === 0 ? interval : Math.min(interval * 2 ** failures, MAX_BACKOFF);
+    const delay = pollDelay(interval, failures, state.error);
     timer = setTimeout(() => {
       void refresh().then(schedule);
     }, delay);