@strimz/sdk 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +109 -23
- package/dist/{browser-client-DlZg0Aae.d.cts → browser-client-D6VUs85b.d.cts} +24 -25
- package/dist/{browser-client-DlZg0Aae.d.ts → browser-client-D6VUs85b.d.ts} +24 -25
- package/dist/browser-client.cjs +6 -6
- package/dist/browser-client.cjs.map +1 -1
- package/dist/browser-client.d.cts +1 -1
- package/dist/browser-client.d.ts +1 -1
- package/dist/browser-client.js +6 -6
- package/dist/browser-client.js.map +1 -1
- package/dist/eip712.cjs.map +1 -1
- package/dist/eip712.d.cts +19 -18
- package/dist/eip712.d.ts +19 -18
- package/dist/eip712.js.map +1 -1
- package/dist/errors.cjs.map +1 -1
- package/dist/errors.d.cts +4 -3
- package/dist/errors.d.ts +4 -3
- package/dist/errors.js.map +1 -1
- package/dist/index.cjs +7 -7
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +8 -9
- package/dist/index.d.ts +8 -9
- package/dist/index.js +7 -7
- package/dist/index.js.map +1 -1
- package/dist/webhooks.cjs.map +1 -1
- package/dist/webhooks.d.cts +3 -3
- package/dist/webhooks.d.ts +3 -3
- package/dist/webhooks.js.map +1 -1
- package/package.json +4 -4
- package/src/browser-client.ts +11 -11
- package/src/client.ts +4 -4
- package/src/eip712/index.ts +2 -2
- package/src/eip712/permit.ts +8 -8
- package/src/eip712/receive-with-authorization.ts +6 -6
- package/src/eip712/types.ts +5 -4
- package/src/errors.ts +4 -3
- package/src/http/fetcher.ts +3 -3
- package/src/http/headers.ts +4 -4
- package/src/idempotency.ts +2 -3
- package/src/resources/checkout.ts +3 -3
- package/src/resources/tokens.ts +10 -11
- package/src/webhooks.ts +3 -3
package/src/eip712/permit.ts
CHANGED
|
@@ -5,22 +5,22 @@ import type { Eip712TypedData } from './types.js'
|
|
|
5
5
|
*
|
|
6
6
|
* - `chainId`, `token`, `tokenName`, `tokenVersion` form the EIP-712
|
|
7
7
|
* domain (same shape as the EIP-3009 builder).
|
|
8
|
-
* - `owner` is the token holder authorising the allowance
|
|
8
|
+
* - `owner` is the token holder authorising the allowance. Must match
|
|
9
9
|
* the signing wallet.
|
|
10
|
-
* - `spender` is the contract that will pull funds
|
|
10
|
+
* - `spender` is the contract that will pull funds. For Strimz
|
|
11
11
|
* subscriptions this is the StrimzSubscriptions contract.
|
|
12
12
|
* - `value` is the allowance to grant in token base units.
|
|
13
13
|
* `type(uint256).max` produces an unlimited allowance and is the
|
|
14
14
|
* common case for subscription enrolment.
|
|
15
15
|
* - `nonce` is the owner's *current* `nonces(owner)` reading from the
|
|
16
|
-
* token contract. The SDK does not fetch this
|
|
16
|
+
* token contract. The SDK does not fetch this. The caller is
|
|
17
17
|
* expected to have just queried it. Race-free: the token rejects
|
|
18
|
-
* stale nonces, so a concurrent permit on the same owner
|
|
19
|
-
*
|
|
18
|
+
* stale nonces, so a concurrent permit on the same owner causes one
|
|
19
|
+
* to fail predictably.
|
|
20
20
|
* - `deadline` is the unix-second timestamp after which the permit
|
|
21
|
-
* expires. Strimz default for subscription enrolment is 24h
|
|
22
|
-
*
|
|
23
|
-
*
|
|
21
|
+
* expires. Strimz default for subscription enrolment is 24h. Enough
|
|
22
|
+
* headroom for a slow merchant submit pipeline without leaving an
|
|
23
|
+
* indefinite signature window.
|
|
24
24
|
*/
|
|
25
25
|
export interface PermitParams {
|
|
26
26
|
chainId: number
|
|
@@ -5,16 +5,16 @@ import type { Eip712TypedData } from './types.js'
|
|
|
5
5
|
*
|
|
6
6
|
* - `chainId` is the EVM chain id (Arc Testnet = 5042002).
|
|
7
7
|
* - `token` is the ERC-20 contract whose `receiveWithAuthorization` is
|
|
8
|
-
* being invoked
|
|
8
|
+
* being invoked. Usually USDC at `0x36...` on Arc.
|
|
9
9
|
* - `tokenName` and `tokenVersion` form the EIP-712 domain. Real USDC
|
|
10
10
|
* on most chains uses `name="USD Coin"` and `version="2"`; tests
|
|
11
11
|
* use whatever the mock token reports. Always read these from the
|
|
12
12
|
* token contract at runtime to avoid drift.
|
|
13
|
-
* - `from` is the payer
|
|
13
|
+
* - `from` is the payer. The wallet that produces the signature must
|
|
14
14
|
* match this address.
|
|
15
|
-
* - `to` is the recipient of the funds
|
|
15
|
+
* - `to` is the recipient of the funds. For Strimz this is the
|
|
16
16
|
* StrimzPayments contract address (the contract pulls funds into
|
|
17
|
-
* itself, then forwards the fee
|
|
17
|
+
* itself, then forwards the fee and net split).
|
|
18
18
|
* - `value` is the gross amount in token base units.
|
|
19
19
|
* - `validAfter` / `validBefore` are unix-second timestamps bounding
|
|
20
20
|
* the signature's validity. Strimz's default checkout window is
|
|
@@ -37,7 +37,7 @@ export interface ReceiveWithAuthorizationParams {
|
|
|
37
37
|
}
|
|
38
38
|
|
|
39
39
|
/**
|
|
40
|
-
* EIP-712 type definition for `ReceiveWithAuthorization`. Stable
|
|
40
|
+
* EIP-712 type definition for `ReceiveWithAuthorization`. Stable, and
|
|
41
41
|
* shared by every EIP-3009 implementation (USDC, EURC, etc.).
|
|
42
42
|
*
|
|
43
43
|
* Exported so consumers can introspect or extend with sibling
|
|
@@ -61,7 +61,7 @@ export const RECEIVE_WITH_AUTHORIZATION_TYPES = {
|
|
|
61
61
|
* compatible with viem, ethers, Privy, and Reown.
|
|
62
62
|
*
|
|
63
63
|
* Pass the result to `walletClient.signTypedData(typedData)` (viem)
|
|
64
|
-
* or `signer._signTypedData(domain, types, message)` (ethers)
|
|
64
|
+
* or `signer._signTypedData(domain, types, message)` (ethers). The
|
|
65
65
|
* SDK does not bind to a specific signer.
|
|
66
66
|
*/
|
|
67
67
|
export function buildReceiveWithAuthorizationTypedData(
|
package/src/eip712/types.ts
CHANGED
|
@@ -1,13 +1,14 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Canonical EIP-712 typed-data shape.
|
|
3
3
|
*
|
|
4
|
-
* Matches the structure every major wallet library accepts
|
|
4
|
+
* Matches the structure every major wallet library accepts:
|
|
5
5
|
* viem's `signTypedData`
|
|
6
6
|
* ethers' `signer._signTypedData`
|
|
7
7
|
* Privy's `signTypedData`
|
|
8
8
|
* Reown AppKit's typed-data RPC
|
|
9
|
-
*
|
|
10
|
-
*
|
|
9
|
+
*
|
|
10
|
+
* The SDK can produce typed-data without binding to a specific wallet
|
|
11
|
+
* client. Consumers pipe the result into whichever signer they
|
|
11
12
|
* already use.
|
|
12
13
|
*
|
|
13
14
|
* No viem/ethers dependency on purpose: the SDK stays minimal, and
|
|
@@ -34,7 +35,7 @@ export type Eip712Types = Record<string, readonly Eip712Field[]>
|
|
|
34
35
|
* gets hashed at the top level (the `types` object usually contains
|
|
35
36
|
* additional referenced sub-structs).
|
|
36
37
|
*
|
|
37
|
-
* `bigint` is used for uint values
|
|
38
|
+
* `bigint` is used for uint values. Wallet libs handle the conversion
|
|
38
39
|
* to hex/decimal at signing time. If a consumer needs to JSON-serialise
|
|
39
40
|
* this object, convert bigints to strings at that boundary.
|
|
40
41
|
*/
|
package/src/errors.ts
CHANGED
|
@@ -1,9 +1,10 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Error hierarchy for the Strimz SDK.
|
|
3
3
|
*
|
|
4
|
-
* Every error thrown by the SDK extends `StrimzError`. The SDK
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* Every error thrown by the SDK extends `StrimzError`. The SDK throws
|
|
5
|
+
* on failure rather than resolving to `{ ok: false }` so call sites
|
|
6
|
+
* stay linear and consumers can narrow with `instanceof` on the
|
|
7
|
+
* exported subclasses.
|
|
7
8
|
*/
|
|
8
9
|
|
|
9
10
|
export type StrimzErrorCode =
|
package/src/http/fetcher.ts
CHANGED
|
@@ -38,7 +38,7 @@ export interface FetcherOptions {
|
|
|
38
38
|
ms: number
|
|
39
39
|
attempt: number
|
|
40
40
|
}) => void
|
|
41
|
-
/** Override the global fetch (for tests
|
|
41
|
+
/** Override the global fetch (for tests or Edge polyfills). */
|
|
42
42
|
fetch?: typeof globalThis.fetch
|
|
43
43
|
}
|
|
44
44
|
|
|
@@ -110,13 +110,13 @@ export class Fetcher {
|
|
|
110
110
|
const errorBody = await parseErrorBody(res)
|
|
111
111
|
const retryAfterMs = parseRetryAfter(res)
|
|
112
112
|
|
|
113
|
-
// 429
|
|
113
|
+
// 429. Back off and retry up to maxRetries.
|
|
114
114
|
if (res.status === 429 && attempt < this.maxRetries) {
|
|
115
115
|
await delay(retryAfterMs ?? this.backoffFor(attempt))
|
|
116
116
|
attempt++
|
|
117
117
|
continue
|
|
118
118
|
}
|
|
119
|
-
// 5xx
|
|
119
|
+
// 5xx. Retry only if idempotent.
|
|
120
120
|
if (res.status >= 500 && idempotent && attempt < this.maxRetries) {
|
|
121
121
|
await delay(this.backoffFor(attempt))
|
|
122
122
|
attempt++
|
package/src/http/headers.ts
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Strimz HTTP header conventions.
|
|
3
3
|
*
|
|
4
|
-
* `Authorization: Bearer <secret_key
|
|
5
|
-
* `X-Strimz-Idempotency-Key
|
|
6
|
-
* `X-Strimz-Sdk
|
|
7
|
-
* `X-Strimz-Sdk-Version
|
|
4
|
+
* `Authorization: Bearer <secret_key>`: primary auth.
|
|
5
|
+
* `X-Strimz-Idempotency-Key`: mutating calls.
|
|
6
|
+
* `X-Strimz-Sdk`: telemetry.
|
|
7
|
+
* `X-Strimz-Sdk-Version`: telemetry.
|
|
8
8
|
*/
|
|
9
9
|
|
|
10
10
|
export const HEADERS = {
|
package/src/idempotency.ts
CHANGED
|
@@ -1,9 +1,8 @@
|
|
|
1
1
|
import { uuid } from '@strimz/shared-crypto'
|
|
2
2
|
|
|
3
3
|
/**
|
|
4
|
-
* Generate an idempotency key for a mutating SDK call.
|
|
5
|
-
*
|
|
6
|
-
* can grep for in logs.
|
|
4
|
+
* Generate an idempotency key for a mutating SDK call. The key is a
|
|
5
|
+
* UUID with a stable `strimz_` prefix so it stays greppable in logs.
|
|
7
6
|
*/
|
|
8
7
|
export function generateIdempotencyKey(): string {
|
|
9
8
|
return `strimz_${uuid()}`
|
|
@@ -10,7 +10,7 @@ import { BaseResource } from './base-resource.js'
|
|
|
10
10
|
* Public hosted-checkout reads.
|
|
11
11
|
*
|
|
12
12
|
* Backed by the `/v1/checkout/*` namespace on the Strimz API, which
|
|
13
|
-
* is intentionally unauthenticated
|
|
13
|
+
* is intentionally unauthenticated. Session and plan records are
|
|
14
14
|
* what a merchant offers to payers, so a payer landing on a checkout
|
|
15
15
|
* URL must be able to load the terms without holding any API key.
|
|
16
16
|
*
|
|
@@ -20,12 +20,12 @@ import { BaseResource } from './base-resource.js'
|
|
|
20
20
|
* code with a secret key.
|
|
21
21
|
*/
|
|
22
22
|
export class CheckoutResource extends BaseResource {
|
|
23
|
-
/** Load a payment session by id (public
|
|
23
|
+
/** Load a payment session by id (public, no merchant scoping). */
|
|
24
24
|
session(id: string): Promise<PaymentSession> {
|
|
25
25
|
return this.get(`/v1/checkout/sessions/${encodeURIComponent(id)}`, paymentSessionSchema)
|
|
26
26
|
}
|
|
27
27
|
|
|
28
|
-
/** Load a subscription plan by id (public
|
|
28
|
+
/** Load a subscription plan by id (public, no merchant scoping). */
|
|
29
29
|
plan(id: string): Promise<SubscriptionPlan> {
|
|
30
30
|
return this.get(`/v1/checkout/plans/${encodeURIComponent(id)}`, subscriptionPlanSchema)
|
|
31
31
|
}
|
package/src/resources/tokens.ts
CHANGED
|
@@ -7,9 +7,9 @@ import {
|
|
|
7
7
|
import { BaseResource } from './base-resource.js'
|
|
8
8
|
|
|
9
9
|
/**
|
|
10
|
-
* Token metadata
|
|
10
|
+
* Token metadata and capability lookup.
|
|
11
11
|
*
|
|
12
|
-
* The two endpoints are public on the API (no key required)
|
|
12
|
+
* The two endpoints are public on the API (no key required). Token
|
|
13
13
|
* metadata is purely chain-derived, has no PII, and is what the
|
|
14
14
|
* browser SDK consults to pick which meta-tx path to take for a
|
|
15
15
|
* given token. Bundled here so consumers don't have to write the HTTP
|
|
@@ -18,7 +18,7 @@ import { BaseResource } from './base-resource.js'
|
|
|
18
18
|
export class TokensResource extends BaseResource {
|
|
19
19
|
/**
|
|
20
20
|
* Fetch full metadata for a token. Throws via the underlying fetcher
|
|
21
|
-
* (404
|
|
21
|
+
* (404 maps to `StrimzNotFoundError`) if the token isn't whitelisted.
|
|
22
22
|
*/
|
|
23
23
|
retrieve(address: string): Promise<TokenMetadata> {
|
|
24
24
|
return this.get(`/v1/tokens/${encodeURIComponent(address.toLowerCase())}`, tokenMetadataSchema)
|
|
@@ -26,7 +26,7 @@ export class TokensResource extends BaseResource {
|
|
|
26
26
|
|
|
27
27
|
/**
|
|
28
28
|
* Read an owner's current EIP-2612 permit nonce. Call this
|
|
29
|
-
* immediately before signing a Permit
|
|
29
|
+
* immediately before signing a Permit. The token contract rejects
|
|
30
30
|
* stale nonces, and the value advances on every successful permit.
|
|
31
31
|
*/
|
|
32
32
|
permitNonce(address: string, owner: string): Promise<TokenPermitNonce> {
|
|
@@ -39,16 +39,15 @@ export class TokensResource extends BaseResource {
|
|
|
39
39
|
}
|
|
40
40
|
|
|
41
41
|
/**
|
|
42
|
-
* Path selector
|
|
42
|
+
* Path selector. Decides which meta-tx flow to take given a token's
|
|
43
43
|
* capabilities and the action a merchant wants to perform.
|
|
44
44
|
*
|
|
45
45
|
* The choice is unambiguous in 99% of cases:
|
|
46
|
-
* - One-shot pay
|
|
47
|
-
*
|
|
48
|
-
* - Subscription enrol
|
|
49
|
-
*
|
|
50
|
-
*
|
|
51
|
-
* use the classic approve+create flow.
|
|
46
|
+
* - One-shot pay. Prefers EIP-3009. Falls back to approve+pay if the
|
|
47
|
+
* token has neither.
|
|
48
|
+
* - Subscription enrol. Prefers EIP-2612 (the only meta-tx path that
|
|
49
|
+
* grants the recurring allowance subscribers need). If unavailable,
|
|
50
|
+
* the merchant must use the classic approve+create flow.
|
|
52
51
|
*
|
|
53
52
|
* Returned `path` values are strings (not enums) so future schemes
|
|
54
53
|
* can extend the union without breaking existing call sites.
|
package/src/webhooks.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Webhook utilities
|
|
3
|
-
*
|
|
2
|
+
* Webhook utilities. Re-exports the verified Web Crypto primitives from
|
|
3
|
+
* `@strimz/shared-crypto` and the typed event union from
|
|
4
4
|
* `@strimz/shared-types`. Consumers should import from here, not directly
|
|
5
5
|
* from the shared packages.
|
|
6
6
|
*/
|
|
@@ -57,7 +57,7 @@ import { webhookEventSchema, type StrimzWebhookEvent } from '@strimz/shared-type
|
|
|
57
57
|
|
|
58
58
|
/**
|
|
59
59
|
* Parse a webhook payload into a typed `StrimzWebhookEvent`.
|
|
60
|
-
* Use after `verifyWebhookSignature` succeeds
|
|
60
|
+
* Use after `verifyWebhookSignature` succeeds. Never trust raw payloads.
|
|
61
61
|
*/
|
|
62
62
|
export function parseWebhookEvent(rawJson: string): StrimzWebhookEvent {
|
|
63
63
|
return webhookEventSchema.parse(JSON.parse(rawJson))
|