@strimz/sdk 0.1.1 → 0.2.1

package/src/eip712/subscription-intent.ts

@@ -0,0 +1,59 @@
+import type { Eip712TypedData } from './types.js'
+
+/**
+ * Inputs for the Strimz SubscriptionIntent. Payer signs this
+ * alongside the ERC-2612 permit. Without it, a valid permit can be
+ * used to enrol the payer in a plan they never picked.
+ *
+ * `permitDeadline` ties this intent to the accompanying permit —
+ * they expire together.
+ */
+export interface SubscriptionIntentParams {
+  chainId: number
+  verifyingContract: `0x${string}`
+  merchantId: bigint
+  token: `0x${string}`
+  amount: bigint
+  interval: number
+  startAt: bigint
+  endAt: bigint
+  permitDeadline: bigint
+}
+
+/** Field order matches `SUBSCRIPTION_INTENT_TYPEHASH` in the contract. */
+export const SUBSCRIPTION_INTENT_TYPES = {
+  SubscriptionIntent: [
+    { name: 'merchantId', type: 'uint256' },
+    { name: 'token', type: 'address' },
+    { name: 'amount', type: 'uint256' },
+    { name: 'interval', type: 'uint32' },
+    { name: 'startAt', type: 'uint64' },
+    { name: 'endAt', type: 'uint64' },
+    { name: 'permitDeadline', type: 'uint256' },
+  ],
+} as const
+
+/** Domain mirrors `EIP712("StrimzSubscriptions", "1")`. */
+export function buildSubscriptionIntentTypedData(
+  params: SubscriptionIntentParams,
+): Eip712TypedData<'SubscriptionIntent'> {
+  return {
+    domain: {
+      name: 'StrimzSubscriptions',
+      version: '1',
+      chainId: params.chainId,
+      verifyingContract: params.verifyingContract,
+    },
+    types: SUBSCRIPTION_INTENT_TYPES,
+    primaryType: 'SubscriptionIntent',
+    message: {
+      merchantId: params.merchantId,
+      token: params.token,
+      amount: params.amount,
+      interval: params.interval,
+      startAt: params.startAt,
+      endAt: params.endAt,
+      permitDeadline: params.permitDeadline,
+    },
+  }
+}

package/src/http/fetcher.ts

@@ -171,11 +171,22 @@ export class Fetcher {
 
   private backoffFor(attempt: number): number {
     const expo = this.initialBackoffMs * Math.pow(2, attempt)
-    const jitter = Math.random() * this.initialBackoffMs
-    return Math.min(expo + jitter, 8_000)
+    return Math.min(expo + cryptoJitter(this.initialBackoffMs), 8_000)
   }
 }
 
+// Uses crypto so retry timing does not seed off Math.random in
+// environments where that's been monkey-patched.
+function cryptoJitter(maxMs: number): number {
+  const g = globalThis as { crypto?: { getRandomValues?: (a: Uint32Array) => Uint32Array } }
+  if (g.crypto?.getRandomValues) {
+    const buf = new Uint32Array(1)
+    g.crypto.getRandomValues(buf)
+    return ((buf[0] ?? 0) / 0xffff_ffff) * maxMs
+  }
+  return Math.random() * maxMs
+}
+
 function isIdempotent(spec: RequestSpec): boolean {
   if (spec.method === 'GET' || spec.method === 'DELETE') return true
   return spec.idempotencyKey != null
@@ -183,12 +194,13 @@ function isIdempotent(spec: RequestSpec): boolean {
 
 async function parseErrorBody(res: Response): Promise<StrimzErrorBody> {
   try {
-    const json = (await res.json()) as { error?: StrimzErrorBody } | StrimzErrorBody
-    if (typeof json === 'object' && json !== null && 'error' in json && json.error) {
-      return json.error
-    }
-    if (typeof json === 'object' && json !== null && 'code' in json && 'message' in json) {
-      return json as StrimzErrorBody
+    const json = (await res.json()) as unknown
+    const raw =
+      typeof json === 'object' && json !== null && 'error' in json
+        ? (json as { error: unknown }).error
+        : json
+    if (typeof raw === 'object' && raw !== null && 'code' in raw && 'message' in raw) {
+      return sanitiseErrorBody(raw as Record<string, unknown>)
     }
   } catch {
     // fall through
@@ -196,6 +208,29 @@ async function parseErrorBody(res: Response): Promise<StrimzErrorBody> {
   return { code: 'api_error', message: `HTTP ${res.status}` }
 }
 
+// Whitelist server-provided fields. A bugged endpoint that dumps stack
+// traces or internal metadata into the error payload never reaches SDK
+// consumers.
+const ALLOWED_DETAIL_KEYS = new Set(['issues', 'field', 'reason', 'chargeAttemptId'])
+
+function sanitiseErrorBody(raw: Record<string, unknown>): StrimzErrorBody {
+  const details =
+    typeof raw.details === 'object' && raw.details !== null
+      ? Object.fromEntries(
+          Object.entries(raw.details as Record<string, unknown>).filter(([k]) =>
+            ALLOWED_DETAIL_KEYS.has(k),
+          ),
+        )
+      : undefined
+  return {
+    code: typeof raw.code === 'string' ? (raw.code as StrimzErrorBody['code']) : 'api_error',
+    message: typeof raw.message === 'string' ? raw.message : 'Request failed',
+    param: typeof raw.param === 'string' ? raw.param : undefined,
+    requestId: typeof raw.requestId === 'string' ? raw.requestId : undefined,
+    details: details && Object.keys(details).length > 0 ? details : undefined,
+  }
+}
+
 function parseRetryAfter(res: Response): number | undefined {
   const v = res.headers.get('Retry-After')
   if (!v) return undefined

package/src/resources/checkout.ts

@@ -1,6 +1,8 @@
 import {
+  merchantPublicBrandSchema,
   paymentSessionSchema,
   subscriptionPlanSchema,
+  type MerchantPublicBrand,
   type PaymentSession,
   type SubscriptionPlan,
 } from '@strimz/shared-types'
@@ -29,4 +31,9 @@ export class CheckoutResource extends BaseResource {
   plan(id: string): Promise<SubscriptionPlan> {
     return this.get(`/v1/checkout/plans/${encodeURIComponent(id)}`, subscriptionPlanSchema)
   }
+
+  /** Load the merchant's public brand card by id. */
+  merchant(id: string): Promise<MerchantPublicBrand> {
+    return this.get(`/v1/checkout/merchants/${encodeURIComponent(id)}`, merchantPublicBrandSchema)
+  }
 }