@phala/pay 0.8.2 → 0.9.0

package/dist/request.js

@@ -3,4 +3,11 @@ export function requestSignal(options) {
     const deadline = AbortSignal.timeout(options.requestTimeout ?? 10_000);
     return options.signal === undefined ? deadline : AbortSignal.any([options.signal, deadline]);
 }
+/** `apiBase` without trailing slashes, in linear time (a `/\/+$/` regex is quadratic). */
+export function trimTrailingSlashes(apiBase) {
+    let end = apiBase.length;
+    while (end > 0 && apiBase[end - 1] === "/")
+        end -= 1;
+    return apiBase.slice(0, end);
+}
 //# sourceMappingURL=request.js.map

package/dist/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,OAG7B;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,OAG7B;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC"}

package/dist/shared/checkout-params.d.ts

@@ -0,0 +1,7 @@
+/** The only server-to-browser checkout handoff; contains no merchant credentials or pins. */
+export interface CheckoutParams {
+    clientSecret: string;
+    expectedAddress: string;
+    apiBase: string;
+}
+//# sourceMappingURL=checkout-params.d.ts.map

package/dist/shared/checkout-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-params.d.ts","sourceRoot":"","sources":["../../src/shared/checkout-params.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/dist/shared/checkout-params.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=checkout-params.js.map

package/dist/shared/checkout-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-params.js","sourceRoot":"","sources":["../../src/shared/checkout-params.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@phala/pay",
-  "version": "0.8.2",
-  "description": "Phala Pay checkout: a framework-agnostic client and React bindings",
+  "version": "0.9.0",
+  "description": "Phala Pay framework-free browser client",
   "keywords": [
     "crypto",
     "checkout",
@@ -9,7 +9,6 @@
     "erc20",
     "eip-681",
     "eip-6963",
-    "react",
     "viem"
   ],
   "license": "Apache-2.0",
@@ -30,20 +29,12 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
-    },
-    "./react": {
-      "types": "./dist/react/index.d.ts",
-      "default": "./dist/react/index.js"
-    },
-    "./server": {
-      "types": "./dist/server/index.d.ts",
-      "default": "./dist/server/index.js"
-    },
-    "./styles.css": "./src/styles.css"
+    }
   },
   "files": [
     "dist",
-    "src"
+    "src",
+    "THIRD_PARTY_NOTICES"
   ],
   "publishConfig": {
     "access": "public"
@@ -54,48 +45,44 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
+    "icons:generate": "node scripts/generate-icons.mjs",
     "prepare": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "test": "vitest run",
     "e2e": "playwright test",
     "e2e:docker": "e2e/docker.sh",
-    "check": "pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build"
+    "check": "pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build && pnpm run check-generated",
+    "generate:types": "openapi-typescript ../../crates/topup/openapi.json -o src/generated/openapi.d.ts --immutable",
+    "check-generated": "bash ../scripts/check-generated-js.sh",
+    "test:fixtures": "pnpm --filter @phala/pay-server run test -- --run test/shared-fixtures.test.ts test/merchant-pins-ledger.test.ts test/merchant-transport.test.ts"
   },
   "dependencies": {
-    "mipd": "^0.0.7",
-    "uqr": "^0.1.3"
+    "mipd": "^0.0.7"
   },
   "peerDependencies": {
-    "react": "^18.2.0 || ^19.0.0",
     "viem": "^2.21.0"
   },
-  "peerDependenciesMeta": {
-    "react": {
-      "optional": true
-    }
-  },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@playwright/test": "1.63.0",
     "@testing-library/dom": "^10.4.2",
-    "@testing-library/react": "^16.3.3",
-    "@testing-library/user-event": "^14.6.7",
     "@types/node": "^26.6.3",
-    "@types/react": "^19.3.0",
-    "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
     "axe-core": "^4.13.0",
     "eslint": "^10.11.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "jsdom": "^30.1.1",
     "jsqr": "^1.4.0",
-    "react": "^19.3.0",
-    "react-dom": "^19.3.0",
     "typescript": "~6.0.3",
     "typescript-eslint": "^8.70.1",
     "viem": "^2.56.9",
     "vite": "^8.3.1",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.2",
+    "openapi-typescript": "7.13.0",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.1",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0"
   }
 }

package/src/chains.ts

@@ -2,10 +2,20 @@ import type { Chain } from "viem";
 import { base, baseSepolia, mainnet, sepolia } from "viem/chains";
 
 /** Chains a wallet can be asked to add; any other chain must already be in the wallet. */
-const CHAINS: readonly Chain[] = [mainnet, sepolia, base, baseSepolia];
+const CHAINS: readonly { chain: Chain; icon: "ethereum" | "base" }[] = [
+  { chain: mainnet, icon: "ethereum" },
+  { chain: sepolia, icon: "ethereum" },
+  { chain: base, icon: "base" },
+  { chain: baseSepolia, icon: "base" },
+];
+
+/** Icon family stored with the chain registry, including testnets. */
+export function networkIconName(chainId: number): "ethereum" | "base" | undefined {
+  return CHAINS.find(({ chain }) => chain.id === chainId)?.icon;
+}
 
 export function knownChain(chainId: number): Chain | undefined {
-  return CHAINS.find((chain) => chain.id === chainId);
+  return CHAINS.find(({ chain }) => chain.id === chainId)?.chain;
 }
 
 /** A human name for the network, for example `Sepolia`. */

package/src/checkout.ts

@@ -1,4 +1,4 @@
-import { requestSignal } from "./request.js";
+import { requestSignal, trimTrailingSlashes } from "./request.js";
 import { getAddress, isAddress, isAddressEqual } from "viem";
 import { parseClientQuote, quoteIdFromClientSecret, type ClientQuote } from "./quote.js";
 
@@ -32,6 +32,7 @@ export type CheckoutErrorCode =
   | "address_mismatch"
   | "rate_limited"
   | "network_error"
+  | "service_unavailable"
   | "invalid_response"
   | "api_error";
 
@@ -70,6 +71,13 @@ export function responseError(response: Response, notFound: string): CheckoutErr
   if (response.status === 404) {
     return new CheckoutError("invalid_client_secret", notFound, requestId);
   }
+  if (response.status >= 500) {
+    const seconds = Number(response.headers.get("retry-after"));
+    return new CheckoutError("service_unavailable", "the payment service is temporarily unavailable", {
+      ...requestId,
+      ...(Number.isFinite(seconds) && seconds > 0 ? { retryAfter: seconds } : {}),
+    });
+  }
   if (response.status === 429) {
     const seconds = Number(response.headers.get("retry-after"));
     return new CheckoutError("rate_limited", "too many status requests", {
@@ -92,8 +100,10 @@ export function pollDelay(interval: number, failures: number, error: CheckoutErr
 
 export interface CheckoutState {
   status: CheckoutStatus;
+  /** The last known view is retained while polling reconnects after a temporary outage. */
+  reconnecting?: boolean;
   quote: ClientQuote | null;
-  /** The last failed refresh; polling continues after every error but `invalid_client_secret`. */
+  /** Permanent/validation failure details; temporary outages use `reconnecting` instead. */
   error: CheckoutError | null;
 }
 
@@ -152,7 +162,7 @@ export interface RetrieveQuoteOptions {
 export async function retrieveQuote(options: RetrieveQuoteOptions): Promise<ClientQuote> {
   const quoteId = quoteIdFromClientSecret(options.clientSecret);
   const expected = expectedAddress(options.expectedAddress);
-  const base = options.apiBase.replace(/\/+$/, "");
+  const base = trimTrailingSlashes(options.apiBase);
   const url = `${base}/v1/quotes/${quoteId}?client_secret=${encodeURIComponent(options.clientSecret)}`;
   const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
   // A simple GET with no custom headers, so the browser sends no CORS preflight.
@@ -223,12 +233,14 @@ export function createCheckout(options: CheckoutOptions): CheckoutSession {
   let state: CheckoutState = { status: "loading", quote: null, error: null };
   let timer: ReturnType<typeof setTimeout> | undefined;
   let failures = 0;
+  let lastFailure: CheckoutError | null = null;
   let destroyed = false;
   let inFlight: Promise<void> | undefined;
 
   function setState(next: CheckoutState): void {
     if (
       next.status === state.status &&
+      next.reconnecting === state.reconnecting &&
       next.error === state.error &&
       JSON.stringify(next.quote) === JSON.stringify(state.quote)
     ) {
@@ -261,6 +273,7 @@ export function createCheckout(options: CheckoutOptions): CheckoutSession {
         return;
       }
       failures = 0;
+      lastFailure = null;
       setState({ status: checkoutStatus(quote, now() / 1000), quote, error: null });
     } catch (cause) {
       if (destroyed || signal.aborted) {
@@ -271,12 +284,16 @@ export function createCheckout(options: CheckoutOptions): CheckoutSession {
           ? cause
           : new CheckoutError("network_error", "could not reach the payment service", { cause });
       failures += 1;
+      lastFailure = error;
       const quote = state.quote;
       if (error.code === "address_mismatch") {
         // Fail closed: forget the quote, so nothing about its address is shown.
         setState({ status: "error", quote: null, error });
       } else if (error.code === "invalid_client_secret") {
         setState({ status: "error", quote, error });
+      } else if (error.code === "network_error" || error.code === "service_unavailable") {
+        // Do not infer expiry or discard the payer's view while chain progress is unknown.
+        setState({ status: state.status, quote, error: null, reconnecting: true });
       } else {
         setState({
           status: quote === null ? state.status : checkoutStatus(quote, now() / 1000),
@@ -301,7 +318,7 @@ export function createCheckout(options: CheckoutOptions): CheckoutSession {
     if (finished()) {
       return;
     }
-    const delay = pollDelay(interval, failures, state.error);
+    const delay = pollDelay(interval, failures, lastFailure);
     timer = setTimeout(() => {
       void refresh().then(schedule);
     }, delay);

package/src/deposit-address.ts

@@ -1,4 +1,4 @@
-import { requestSignal } from "./request.js";
+import { requestSignal, trimTrailingSlashes } from "./request.js";
 import { CheckoutError, responseError } from "./checkout.js";
 
 /** A payment to a deposit address as the customer's page sees it. Display only. */
@@ -77,7 +77,7 @@ export async function retrieveDepositAddress(
   options: RetrieveDepositAddressOptions,
 ): Promise<ClientDepositAddress> {
   const id = depositAddressIdFromClientSecret(options.clientSecret);
-  const base = options.apiBase.replace(/\/+$/, "");
+  const base = trimTrailingSlashes(options.apiBase);
   const url = `${base}/v1/deposit_addresses/${id}?client_secret=${encodeURIComponent(options.clientSecret)}`;
   const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
   // A simple GET with no custom headers, so the browser sends no CORS preflight.