@strimz/shared-types 0.1.0 → 0.2.0

package/dist/merchants.d.ts

@@ -20,6 +20,8 @@ declare const merchantSchema: z.ZodObject<{
     tier: z.ZodEnum<["free", "growth", "business", "enterprise"]>;
     status: z.ZodEnum<["active", "suspended", "closed"]>;
     payoutAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    walletAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    onboardingCompleted: z.ZodBoolean;
     defaultCurrency: z.ZodEnum<["USDC", "EURC"]>;
     countryCode: z.ZodNullable<z.ZodString>;
     websiteUrl: z.ZodNullable<z.ZodString>;
@@ -32,6 +34,7 @@ declare const merchantSchema: z.ZodObject<{
     status: "active" | "suspended" | "closed";
     id: string;
     createdAt: string;
+    walletAddress: string | null;
     email: string;
     metadata: Record<string, string | number | boolean | null>;
     updatedAt: string;
@@ -39,6 +42,7 @@ declare const merchantSchema: z.ZodObject<{
     businessName: string;
     tier: "free" | "growth" | "business" | "enterprise";
     payoutAddress: string | null;
+    onboardingCompleted: boolean;
     defaultCurrency: "USDC" | "EURC";
     countryCode: string | null;
     websiteUrl: string | null;
@@ -48,12 +52,14 @@ declare const merchantSchema: z.ZodObject<{
     status: "active" | "suspended" | "closed";
     id: string;
     createdAt: string;
+    walletAddress: string | null;
     email: string;
     updatedAt: string;
     onchainMerchantId: number | null;
     businessName: string;
     tier: "free" | "growth" | "business" | "enterprise";
     payoutAddress: string | null;
+    onboardingCompleted: boolean;
     defaultCurrency: "USDC" | "EURC";
     countryCode: string | null;
     websiteUrl: string | null;
@@ -82,6 +88,24 @@ declare const createMerchantInputSchema: z.ZodObject<{
     websiteUrl?: string | undefined;
 }>;
 type CreateMerchantInput = z.infer<typeof createMerchantInputSchema>;
+/**
+ * Merchant email opt-outs, persisted at `Merchant.metadata.emailPrefs`.
+ * Both default to true. Welcome, refunds, and admin broadcasts always send.
+ */
+declare const merchantEmailPrefsSchema: z.ZodObject<{
+    /** "You received X USDC" one-off payment notifications. */
+    paymentReceived: z.ZodBoolean;
+    /** "You were paid X for subscription Y" per-charge notifications. */
+    subscriptionCharged: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    paymentReceived: boolean;
+    subscriptionCharged: boolean;
+}, {
+    paymentReceived: boolean;
+    subscriptionCharged: boolean;
+}>;
+type MerchantEmailPrefs = z.infer<typeof merchantEmailPrefsSchema>;
+declare const DEFAULT_MERCHANT_EMAIL_PREFS: MerchantEmailPrefs;
 declare const updateMerchantInputSchema: z.ZodObject<{
     businessName: z.ZodOptional<z.ZodString>;
     payoutAddress: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
@@ -90,6 +114,16 @@ declare const updateMerchantInputSchema: z.ZodObject<{
     logoUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     countryCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     metadata: z.ZodOptional<z.ZodDefault<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>, Record<string, string | number | boolean | null>, Record<string, string | number | boolean | null>>>>;
+    emailPrefs: z.ZodOptional<z.ZodObject<{
+        paymentReceived: z.ZodOptional<z.ZodBoolean>;
+        subscriptionCharged: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        paymentReceived?: boolean | undefined;
+        subscriptionCharged?: boolean | undefined;
+    }, {
+        paymentReceived?: boolean | undefined;
+        subscriptionCharged?: boolean | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     metadata?: Record<string, string | number | boolean | null> | undefined;
     businessName?: string | undefined;
@@ -98,6 +132,10 @@ declare const updateMerchantInputSchema: z.ZodObject<{
     countryCode?: string | null | undefined;
     websiteUrl?: string | null | undefined;
     logoUrl?: string | null | undefined;
+    emailPrefs?: {
+        paymentReceived?: boolean | undefined;
+        subscriptionCharged?: boolean | undefined;
+    } | undefined;
 }, {
     metadata?: Record<string, string | number | boolean | null> | undefined;
     businessName?: string | undefined;
@@ -106,6 +144,10 @@ declare const updateMerchantInputSchema: z.ZodObject<{
     countryCode?: string | null | undefined;
     websiteUrl?: string | null | undefined;
     logoUrl?: string | null | undefined;
+    emailPrefs?: {
+        paymentReceived?: boolean | undefined;
+        subscriptionCharged?: boolean | undefined;
+    } | undefined;
 }>;
 type UpdateMerchantInput = z.infer<typeof updateMerchantInputSchema>;
 declare const changeTierInputSchema: z.ZodObject<{
@@ -116,6 +158,124 @@ declare const changeTierInputSchema: z.ZodObject<{
     tier: "free" | "growth" | "business" | "enterprise";
 }>;
 type ChangeTierInput = z.infer<typeof changeTierInputSchema>;
+/**
+ * Self-attested onboarding form the dashboard collects after a
+ * merchant first logs in via Privy. On success the API stamps
+ * `onboardingCompleted: true` on the row, and the dashboard exits
+ * the wizard. Shared here so the API's DTO and the web client's
+ * hook can enforce the same shape.
+ */
+declare const onboardMerchantInputSchema: z.ZodObject<{
+    businessName: z.ZodString;
+    businessSector: z.ZodString;
+    countryCode: z.ZodString;
+    websiteUrl: z.ZodOptional<z.ZodString>;
+    logoUrl: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodString>;
+    payoutAddress: z.ZodEffects<z.ZodString, string, string>;
+    defaultCurrency: z.ZodOptional<z.ZodEnum<["USDC", "EURC"]>>;
+}, "strip", z.ZodTypeAny, {
+    businessName: string;
+    payoutAddress: string;
+    countryCode: string;
+    businessSector: string;
+    defaultCurrency?: "USDC" | "EURC" | undefined;
+    websiteUrl?: string | undefined;
+    logoUrl?: string | undefined;
+    phone?: string | undefined;
+}, {
+    businessName: string;
+    payoutAddress: string;
+    countryCode: string;
+    businessSector: string;
+    defaultCurrency?: "USDC" | "EURC" | undefined;
+    websiteUrl?: string | undefined;
+    logoUrl?: string | undefined;
+    phone?: string | undefined;
+}>;
+type OnboardMerchantInput = z.infer<typeof onboardMerchantInputSchema>;
+declare const merchantPublicBrandSchema: z.ZodObject<{
+    id: z.ZodString;
+    businessName: z.ZodString;
+    logoUrl: z.ZodNullable<z.ZodString>;
+    walletAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    walletAddress: string | null;
+    businessName: string;
+    logoUrl: string | null;
+}, {
+    id: string;
+    walletAddress: string | null;
+    businessName: string;
+    logoUrl: string | null;
+}>;
+type MerchantPublicBrand = z.infer<typeof merchantPublicBrandSchema>;
+/**
+ * On-chain balance view for the withdraw page. Strimz is
+ * non-custodial: payments settle directly into the merchant's
+ * `payoutAddress`, and "withdrawal" means the merchant transferring
+ * out with their own wallet. This shape reports current on-chain
+ * state so the dashboard renders live balances + decides whether to
+ * offer the signing UI.
+ */
+declare const merchantBalanceSchema: z.ZodObject<{
+    /** Payout wallet, checksummed; null when the merchant hasn't set one. */
+    payoutAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    /** Privy embedded wallet, checksummed if resolvable. */
+    walletAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    /**
+     * True when `payoutAddress === walletAddress`, i.e. the merchant
+     * can sign a transfer from the dashboard via Privy. False for
+     * merchants using an external wallet as payout — the UI falls back
+     * to "copy the address, transfer with your wallet."
+     */
+    canSignFromDashboard: z.ZodBoolean;
+    balances: z.ZodArray<z.ZodObject<{
+        currency: z.ZodEnum<["USDC", "EURC"]>;
+        contractAddress: z.ZodEffects<z.ZodString, string, string>;
+        /** Base-6 integer as string. */
+        raw: z.ZodString;
+        /** Human-formatted, e.g. `1234.56`. */
+        formatted: z.ZodString;
+        decimals: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        currency: "USDC" | "EURC";
+        contractAddress: string;
+        raw: string;
+        formatted: string;
+        decimals: number;
+    }, {
+        currency: "USDC" | "EURC";
+        contractAddress: string;
+        raw: string;
+        formatted: string;
+        decimals: number;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    walletAddress: string | null;
+    payoutAddress: string | null;
+    canSignFromDashboard: boolean;
+    balances: {
+        currency: "USDC" | "EURC";
+        contractAddress: string;
+        raw: string;
+        formatted: string;
+        decimals: number;
+    }[];
+}, {
+    walletAddress: string | null;
+    payoutAddress: string | null;
+    canSignFromDashboard: boolean;
+    balances: {
+        currency: "USDC" | "EURC";
+        contractAddress: string;
+        raw: string;
+        formatted: string;
+        decimals: number;
+    }[];
+}>;
+type MerchantBalanceView = z.infer<typeof merchantBalanceSchema>;
 declare const merchantMemberSchema: z.ZodObject<{
     id: z.ZodString;
     merchantId: z.ZodString;
@@ -172,6 +332,8 @@ declare const loginOutputSchema: z.ZodObject<{
         tier: z.ZodEnum<["free", "growth", "business", "enterprise"]>;
         status: z.ZodEnum<["active", "suspended", "closed"]>;
         payoutAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+        walletAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+        onboardingCompleted: z.ZodBoolean;
         defaultCurrency: z.ZodEnum<["USDC", "EURC"]>;
         countryCode: z.ZodNullable<z.ZodString>;
         websiteUrl: z.ZodNullable<z.ZodString>;
@@ -184,6 +346,7 @@ declare const loginOutputSchema: z.ZodObject<{
         status: "active" | "suspended" | "closed";
         id: string;
         createdAt: string;
+        walletAddress: string | null;
         email: string;
         metadata: Record<string, string | number | boolean | null>;
         updatedAt: string;
@@ -191,6 +354,7 @@ declare const loginOutputSchema: z.ZodObject<{
         businessName: string;
         tier: "free" | "growth" | "business" | "enterprise";
         payoutAddress: string | null;
+        onboardingCompleted: boolean;
         defaultCurrency: "USDC" | "EURC";
         countryCode: string | null;
         websiteUrl: string | null;
@@ -200,12 +364,14 @@ declare const loginOutputSchema: z.ZodObject<{
         status: "active" | "suspended" | "closed";
         id: string;
         createdAt: string;
+        walletAddress: string | null;
         email: string;
         updatedAt: string;
         onchainMerchantId: number | null;
         businessName: string;
         tier: "free" | "growth" | "business" | "enterprise";
         payoutAddress: string | null;
+        onboardingCompleted: boolean;
         defaultCurrency: "USDC" | "EURC";
         countryCode: string | null;
         websiteUrl: string | null;
@@ -220,6 +386,7 @@ declare const loginOutputSchema: z.ZodObject<{
         status: "active" | "suspended" | "closed";
         id: string;
         createdAt: string;
+        walletAddress: string | null;
         email: string;
         metadata: Record<string, string | number | boolean | null>;
         updatedAt: string;
@@ -227,6 +394,7 @@ declare const loginOutputSchema: z.ZodObject<{
         businessName: string;
         tier: "free" | "growth" | "business" | "enterprise";
         payoutAddress: string | null;
+        onboardingCompleted: boolean;
         defaultCurrency: "USDC" | "EURC";
         countryCode: string | null;
         websiteUrl: string | null;
@@ -240,12 +408,14 @@ declare const loginOutputSchema: z.ZodObject<{
         status: "active" | "suspended" | "closed";
         id: string;
         createdAt: string;
+        walletAddress: string | null;
         email: string;
         updatedAt: string;
         onchainMerchantId: number | null;
         businessName: string;
         tier: "free" | "growth" | "business" | "enterprise";
         payoutAddress: string | null;
+        onboardingCompleted: boolean;
         defaultCurrency: "USDC" | "EURC";
         countryCode: string | null;
         websiteUrl: string | null;
@@ -256,4 +426,4 @@ declare const loginOutputSchema: z.ZodObject<{
 }>;
 type LoginOutput = z.infer<typeof loginOutputSchema>;
 
-export { type ChangeTierInput, type CreateMerchantInput, type InviteMemberInput, type LoginInput, type LoginOutput, type Merchant, type MerchantMember, type MerchantRole, type MerchantStatus, type UpdateMerchantInput, changeTierInputSchema, createMerchantInputSchema, inviteMemberInputSchema, loginInputSchema, loginOutputSchema, merchantMemberSchema, merchantRoleSchema, merchantSchema, merchantStatusSchema, updateMerchantInputSchema };
+export { type ChangeTierInput, type CreateMerchantInput, DEFAULT_MERCHANT_EMAIL_PREFS, type InviteMemberInput, type LoginInput, type LoginOutput, type Merchant, type MerchantBalanceView, type MerchantEmailPrefs, type MerchantMember, type MerchantPublicBrand, type MerchantRole, type MerchantStatus, type OnboardMerchantInput, type UpdateMerchantInput, changeTierInputSchema, createMerchantInputSchema, inviteMemberInputSchema, loginInputSchema, loginOutputSchema, merchantBalanceSchema, merchantEmailPrefsSchema, merchantMemberSchema, merchantPublicBrandSchema, merchantRoleSchema, merchantSchema, merchantStatusSchema, onboardMerchantInputSchema, updateMerchantInputSchema };

package/dist/merchants.js

@@ -38,6 +38,8 @@ var merchantSchema = z.object({
   tier: merchantTierSchema,
   status: merchantStatusSchema,
   payoutAddress: evmAddressSchema.nullable(),
+  walletAddress: evmAddressSchema.nullable(),
+  onboardingCompleted: z.boolean(),
   defaultCurrency: z.enum(["USDC", "EURC"]),
   countryCode: z.string().length(2).nullable(),
   websiteUrl: z.string().url().nullable(),
@@ -54,6 +56,16 @@ var createMerchantInputSchema = z.object({
   countryCode: z.string().length(2).optional(),
   websiteUrl: z.string().url().optional()
 });
+var merchantEmailPrefsSchema = z.object({
+  /** "You received X USDC" one-off payment notifications. */
+  paymentReceived: z.boolean(),
+  /** "You were paid X for subscription Y" per-charge notifications. */
+  subscriptionCharged: z.boolean()
+});
+var DEFAULT_MERCHANT_EMAIL_PREFS = {
+  paymentReceived: true,
+  subscriptionCharged: true
+};
 var updateMerchantInputSchema = z.object({
   businessName: z.string().min(2).max(120),
   payoutAddress: evmAddressSchema,
@@ -61,11 +73,52 @@ var updateMerchantInputSchema = z.object({
   websiteUrl: z.string().url().nullable(),
   logoUrl: z.string().url().nullable(),
   countryCode: z.string().length(2).nullable(),
-  metadata: metadataSchema
+  metadata: metadataSchema,
+  emailPrefs: merchantEmailPrefsSchema.partial()
 }).partial();
 var changeTierInputSchema = z.object({
   tier: merchantTierSchema
 });
+var onboardMerchantInputSchema = z.object({
+  businessName: z.string().min(2).max(120),
+  businessSector: z.string().min(2).max(80),
+  countryCode: z.string().length(2).regex(/^[A-Z]{2}$/, "must be a 2-letter ISO country code"),
+  websiteUrl: z.string().url().optional(),
+  logoUrl: z.string().url().optional(),
+  phone: z.string().min(6).max(20).optional(),
+  payoutAddress: evmAddressSchema,
+  defaultCurrency: z.enum(["USDC", "EURC"]).optional()
+});
+var merchantPublicBrandSchema = z.object({
+  id: idSchema,
+  businessName: z.string().min(2).max(120),
+  logoUrl: z.string().url().nullable(),
+  walletAddress: evmAddressSchema.nullable()
+});
+var merchantBalanceSchema = z.object({
+  /** Payout wallet, checksummed; null when the merchant hasn't set one. */
+  payoutAddress: evmAddressSchema.nullable(),
+  /** Privy embedded wallet, checksummed if resolvable. */
+  walletAddress: evmAddressSchema.nullable(),
+  /**
+   * True when `payoutAddress === walletAddress`, i.e. the merchant
+   * can sign a transfer from the dashboard via Privy. False for
+   * merchants using an external wallet as payout — the UI falls back
+   * to "copy the address, transfer with your wallet."
+   */
+  canSignFromDashboard: z.boolean(),
+  balances: z.array(
+    z.object({
+      currency: z.enum(["USDC", "EURC"]),
+      contractAddress: evmAddressSchema,
+      /** Base-6 integer as string. */
+      raw: z.string(),
+      /** Human-formatted, e.g. `1234.56`. */
+      formatted: z.string(),
+      decimals: z.number().int().min(0).max(30)
+    })
+  )
+});
 var merchantMemberSchema = z.object({
   id: idSchema,
   merchantId: idSchema,
@@ -88,6 +141,6 @@ var loginOutputSchema = z.object({
   merchant: merchantSchema
 });
 
-export { changeTierInputSchema, createMerchantInputSchema, inviteMemberInputSchema, loginInputSchema, loginOutputSchema, merchantMemberSchema, merchantRoleSchema, merchantSchema, merchantStatusSchema, updateMerchantInputSchema };
+export { DEFAULT_MERCHANT_EMAIL_PREFS, changeTierInputSchema, createMerchantInputSchema, inviteMemberInputSchema, loginInputSchema, loginOutputSchema, merchantBalanceSchema, merchantEmailPrefsSchema, merchantMemberSchema, merchantPublicBrandSchema, merchantRoleSchema, merchantSchema, merchantStatusSchema, onboardMerchantInputSchema, updateMerchantInputSchema };
 //# sourceMappingURL=merchants.js.map
 //# sourceMappingURL=merchants.js.map

package/dist/merchants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common.ts","../src/merchants.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAGJ,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D;AAGtF,IAAM,WAAA,GAAc,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG,CAAA;AAG5C,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOP,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAYM,IAAM,iBAAiB,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE,CAAA;AAGa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAIZ,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAIzD,IAAM,kBAAA,GAAqB,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC,CAAA;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACtF1D,IAAM,uBAAuBA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,WAAA,EAAa,QAAQ,CAAC;AAGrE,IAAM,kBAAA,GAAqBA,EAAE,IAAA,CAAK,CAAC,SAAS,OAAA,EAAS,WAAA,EAAa,WAAW,CAAC;AAG9E,IAAM,cAAA,GAAiBA,EAAE,MAAA,CAAO;AAAA,EACrC,EAAA,EAAI,QAAA;AAAA,EACJ,iBAAA,EAAmBA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,QAAA,EAAS;AAAA,EAC3D,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,KAAA,EAAO,WAAA;AAAA,EACP,IAAA,EAAM,kBAAA;AAAA,EACN,MAAA,EAAQ,oBAAA;AAAA,EACR,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA,EACzC,iBAAiBA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACxC,aAAaA,CAAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAC,EAAE,QAAA,EAAS;AAAA,EAC3C,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACnC,iBAAA,EAAmBA,EAAE,OAAA,EAAQ;AAAA,EAC7B,QAAA,EAAU,cAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAKM,IAAM,yBAAA,GAA4BA,EAAE,MAAA,CAAO;AAAA,EAChD,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,KAAA,EAAO,WAAA;AAAA,EACP,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,IAAI,EAAE,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACpC,aAAaA,CAAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAC,EAAE,QAAA,EAAS;AAAA,EAC3C,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA;AAC/B,CAAC;AAGM,IAAM,yBAAA,GAA4BA,EACtC,MAAA,CAAO;AAAA,EACN,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,aAAA,EAAe,gBAAA;AAAA,EACf,iBAAiBA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACxC,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACnC,aAAaA,CAAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAC,EAAE,QAAA,EAAS;AAAA,EAC3C,QAAA,EAAU;AACZ,CAAC,EACA,OAAA;AAGI,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAM;AACR,CAAC;AAKM,IAAM,oBAAA,GAAuBA,EAAE,MAAA,CAAO;AAAA,EAC3C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,KAAA,EAAO,WAAA;AAAA,EACP,IAAA,EAAM,kBAAA;AAAA,EACN,SAAA,EAAW,kBAAA;AAAA,EACX,UAAA,EAAY,mBAAmB,QAAA;AACjC,CAAC;AAGM,IAAM,uBAAA,GAA0BA,EAAE,MAAA,CAAO;AAAA,EAC9C,KAAA,EAAO,WAAA;AAAA,EACP,IAAA,EAAM;AACR,CAAC;AAKM,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EACvC,KAAA,EAAO,WAAA;AAAA,EACP,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG;AACrC,CAAC;AAGM,IAAM,iBAAA,GAAoBA,EAAE,MAAA,CAAO;AAAA,EACxC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,EACtB,YAAA,EAAcA,EAAE,MAAA,EAAO;AAAA,EACvB,QAAA,EAAU;AACZ,CAAC","file":"merchants.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum — mirrors `@strimz/shared-config`. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum — mirrors `@strimz/shared-config`. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Merchant entity and lifecycle DTOs.\n *\n * A merchant is the platform's first-class tenant. Merchants have a tier,\n * a payout wallet address, and an on-chain merchantId registered in the\n * StrimzRegistry contract.\n */\n\nimport { z } from 'zod'\nimport {\n  emailSchema,\n  evmAddressSchema,\n  idSchema,\n  isoTimestampSchema,\n  merchantTierSchema,\n  metadataSchema,\n} from './common.js'\n\nexport const merchantStatusSchema = z.enum(['active', 'suspended', 'closed'])\nexport type MerchantStatus = z.infer<typeof merchantStatusSchema>\n\nexport const merchantRoleSchema = z.enum(['owner', 'admin', 'developer', 'read_only'])\nexport type MerchantRole = z.infer<typeof merchantRoleSchema>\n\nexport const merchantSchema = z.object({\n  id: idSchema,\n  onchainMerchantId: z.number().int().nonnegative().nullable(),\n  businessName: z.string().min(2).max(120),\n  email: emailSchema,\n  tier: merchantTierSchema,\n  status: merchantStatusSchema,\n  payoutAddress: evmAddressSchema.nullable(),\n  defaultCurrency: z.enum(['USDC', 'EURC']),\n  countryCode: z.string().length(2).nullable(),\n  websiteUrl: z.string().url().nullable(),\n  logoUrl: z.string().url().nullable(),\n  whitelabelEnabled: z.boolean(),\n  metadata: metadataSchema,\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type Merchant = z.infer<typeof merchantSchema>\n\n// ---------- DTOs ----------\n\nexport const createMerchantInputSchema = z.object({\n  businessName: z.string().min(2).max(120),\n  email: emailSchema,\n  password: z.string().min(12).max(128),\n  countryCode: z.string().length(2).optional(),\n  websiteUrl: z.string().url().optional(),\n})\nexport type CreateMerchantInput = z.infer<typeof createMerchantInputSchema>\n\nexport const updateMerchantInputSchema = z\n  .object({\n    businessName: z.string().min(2).max(120),\n    payoutAddress: evmAddressSchema,\n    defaultCurrency: z.enum(['USDC', 'EURC']),\n    websiteUrl: z.string().url().nullable(),\n    logoUrl: z.string().url().nullable(),\n    countryCode: z.string().length(2).nullable(),\n    metadata: metadataSchema,\n  })\n  .partial()\nexport type UpdateMerchantInput = z.infer<typeof updateMerchantInputSchema>\n\nexport const changeTierInputSchema = z.object({\n  tier: merchantTierSchema,\n})\nexport type ChangeTierInput = z.infer<typeof changeTierInputSchema>\n\n// ---------- Team members ----------\n\nexport const merchantMemberSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  email: emailSchema,\n  role: merchantRoleSchema,\n  invitedAt: isoTimestampSchema,\n  acceptedAt: isoTimestampSchema.nullable(),\n})\nexport type MerchantMember = z.infer<typeof merchantMemberSchema>\n\nexport const inviteMemberInputSchema = z.object({\n  email: emailSchema,\n  role: merchantRoleSchema,\n})\nexport type InviteMemberInput = z.infer<typeof inviteMemberInputSchema>\n\n// ---------- Auth ----------\n\nexport const loginInputSchema = z.object({\n  email: emailSchema,\n  password: z.string().min(1).max(128),\n})\nexport type LoginInput = z.infer<typeof loginInputSchema>\n\nexport const loginOutputSchema = z.object({\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  merchant: merchantSchema,\n})\nexport type LoginOutput = z.infer<typeof loginOutputSchema>\n"]}
+{"version":3,"sources":["../src/common.ts","../src/merchants.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAGJ,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D;AAGtF,IAAM,WAAA,GAAc,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG,CAAA;AAG5C,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOP,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAYM,IAAM,iBAAiB,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE,CAAA;AAGa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAIZ,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAIzD,IAAM,kBAAA,GAAqB,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC,CAAA;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACtF1D,IAAM,uBAAuBA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,WAAA,EAAa,QAAQ,CAAC;AAGrE,IAAM,kBAAA,GAAqBA,EAAE,IAAA,CAAK,CAAC,SAAS,OAAA,EAAS,WAAA,EAAa,WAAW,CAAC;AAG9E,IAAM,cAAA,GAAiBA,EAAE,MAAA,CAAO;AAAA,EACrC,EAAA,EAAI,QAAA;AAAA,EACJ,iBAAA,EAAmBA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,QAAA,EAAS;AAAA,EAC3D,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,KAAA,EAAO,WAAA;AAAA,EACP,IAAA,EAAM,kBAAA;AAAA,EACN,MAAA,EAAQ,oBAAA;AAAA,EACR,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA,EACzC,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA,EACzC,mBAAA,EAAqBA,EAAE,OAAA,EAAQ;AAAA,EAC/B,iBAAiBA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACxC,aAAaA,CAAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAC,EAAE,QAAA,EAAS;AAAA,EAC3C,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACnC,iBAAA,EAAmBA,EAAE,OAAA,EAAQ;AAAA,EAC7B,QAAA,EAAU,cAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAKM,IAAM,yBAAA,GAA4BA,EAAE,MAAA,CAAO;AAAA,EAChD,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,KAAA,EAAO,WAAA;AAAA,EACP,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,IAAI,EAAE,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACpC,aAAaA,CAAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAC,EAAE,QAAA,EAAS;AAAA,EAC3C,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA;AAC/B,CAAC;AAOM,IAAM,wBAAA,GAA2BA,EAAE,MAAA,CAAO;AAAA;AAAA,EAE/C,eAAA,EAAiBA,EAAE,OAAA,EAAQ;AAAA;AAAA,EAE3B,mBAAA,EAAqBA,EAAE,OAAA;AACzB,CAAC;AAGM,IAAM,4BAAA,GAAmD;AAAA,EAC9D,eAAA,EAAiB,IAAA;AAAA,EACjB,mBAAA,EAAqB;AACvB;AAEO,IAAM,yBAAA,GAA4BA,EACtC,MAAA,CAAO;AAAA,EACN,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,aAAA,EAAe,gBAAA;AAAA,EACf,iBAAiBA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,EACxC,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACnC,aAAaA,CAAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAC,EAAE,QAAA,EAAS;AAAA,EAC3C,QAAA,EAAU,cAAA;AAAA,EACV,UAAA,EAAY,yBAAyB,OAAA;AACvC,CAAC,EACA,OAAA;AAGI,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAM;AACR,CAAC;AAUM,IAAM,0BAAA,GAA6BA,EAAE,MAAA,CAAO;AAAA,EACjD,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,cAAA,EAAgBA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxC,WAAA,EAAaA,EACV,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,qCAAqC,CAAA;AAAA,EAC5D,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACnC,KAAA,EAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,EAAE,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1C,aAAA,EAAe,gBAAA;AAAA,EACf,eAAA,EAAiBA,EAAE,IAAA,CAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAA;AAC5C,CAAC;AAGM,IAAM,yBAAA,GAA4BA,EAAE,MAAA,CAAO;AAAA,EAChD,EAAA,EAAI,QAAA;AAAA,EACJ,YAAA,EAAcA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,EACvC,SAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACnC,aAAA,EAAe,iBAAiB,QAAA;AAClC,CAAC;AAWM,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA;AAAA,EAE5C,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA;AAAA,EAEzC,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzC,oBAAA,EAAsBA,EAAE,OAAA,EAAQ;AAAA,EAChC,UAAUA,CAAAA,CAAE,KAAA;AAAA,IACVA,EAAE,MAAA,CAAO;AAAA,MACP,UAAUA,CAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,MACjC,eAAA,EAAiB,gBAAA;AAAA;AAAA,MAEjB,GAAA,EAAKA,EAAE,MAAA,EAAO;AAAA;AAAA,MAEd,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,MACpB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,EAAE;AAAA,KACzC;AAAA;AAEL,CAAC;AAKM,IAAM,oBAAA,GAAuBA,EAAE,MAAA,CAAO;AAAA,EAC3C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,KAAA,EAAO,WAAA;AAAA,EACP,IAAA,EAAM,kBAAA;AAAA,EACN,SAAA,EAAW,kBAAA;AAAA,EACX,UAAA,EAAY,mBAAmB,QAAA;AACjC,CAAC;AAGM,IAAM,uBAAA,GAA0BA,EAAE,MAAA,CAAO;AAAA,EAC9C,KAAA,EAAO,WAAA;AAAA,EACP,IAAA,EAAM;AACR,CAAC;AAKM,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EACvC,KAAA,EAAO,WAAA;AAAA,EACP,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG;AACrC,CAAC;AAGM,IAAM,iBAAA,GAAoBA,EAAE,MAAA,CAAO;AAAA,EACxC,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,EACtB,YAAA,EAAcA,EAAE,MAAA,EAAO;AAAA,EACvB,QAAA,EAAU;AACZ,CAAC","file":"merchants.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Merchant entity and lifecycle DTOs.\n *\n * A merchant is the platform's first-class tenant. Merchants have a tier,\n * a payout wallet address, and an on-chain merchantId registered in the\n * StrimzRegistry contract.\n */\n\nimport { z } from 'zod'\nimport {\n  emailSchema,\n  evmAddressSchema,\n  idSchema,\n  isoTimestampSchema,\n  merchantTierSchema,\n  metadataSchema,\n} from './common.js'\n\nexport const merchantStatusSchema = z.enum(['active', 'suspended', 'closed'])\nexport type MerchantStatus = z.infer<typeof merchantStatusSchema>\n\nexport const merchantRoleSchema = z.enum(['owner', 'admin', 'developer', 'read_only'])\nexport type MerchantRole = z.infer<typeof merchantRoleSchema>\n\nexport const merchantSchema = z.object({\n  id: idSchema,\n  onchainMerchantId: z.number().int().nonnegative().nullable(),\n  businessName: z.string().min(2).max(120),\n  email: emailSchema,\n  tier: merchantTierSchema,\n  status: merchantStatusSchema,\n  payoutAddress: evmAddressSchema.nullable(),\n  walletAddress: evmAddressSchema.nullable(),\n  onboardingCompleted: z.boolean(),\n  defaultCurrency: z.enum(['USDC', 'EURC']),\n  countryCode: z.string().length(2).nullable(),\n  websiteUrl: z.string().url().nullable(),\n  logoUrl: z.string().url().nullable(),\n  whitelabelEnabled: z.boolean(),\n  metadata: metadataSchema,\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type Merchant = z.infer<typeof merchantSchema>\n\n// ---------- DTOs ----------\n\nexport const createMerchantInputSchema = z.object({\n  businessName: z.string().min(2).max(120),\n  email: emailSchema,\n  password: z.string().min(12).max(128),\n  countryCode: z.string().length(2).optional(),\n  websiteUrl: z.string().url().optional(),\n})\nexport type CreateMerchantInput = z.infer<typeof createMerchantInputSchema>\n\n/**\n * Merchant email opt-outs, persisted at `Merchant.metadata.emailPrefs`.\n * Both default to true. Welcome, refunds, and admin broadcasts always send.\n */\nexport const merchantEmailPrefsSchema = z.object({\n  /** \"You received X USDC\" one-off payment notifications. */\n  paymentReceived: z.boolean(),\n  /** \"You were paid X for subscription Y\" per-charge notifications. */\n  subscriptionCharged: z.boolean(),\n})\nexport type MerchantEmailPrefs = z.infer<typeof merchantEmailPrefsSchema>\n\nexport const DEFAULT_MERCHANT_EMAIL_PREFS: MerchantEmailPrefs = {\n  paymentReceived: true,\n  subscriptionCharged: true,\n}\n\nexport const updateMerchantInputSchema = z\n  .object({\n    businessName: z.string().min(2).max(120),\n    payoutAddress: evmAddressSchema,\n    defaultCurrency: z.enum(['USDC', 'EURC']),\n    websiteUrl: z.string().url().nullable(),\n    logoUrl: z.string().url().nullable(),\n    countryCode: z.string().length(2).nullable(),\n    metadata: metadataSchema,\n    emailPrefs: merchantEmailPrefsSchema.partial(),\n  })\n  .partial()\nexport type UpdateMerchantInput = z.infer<typeof updateMerchantInputSchema>\n\nexport const changeTierInputSchema = z.object({\n  tier: merchantTierSchema,\n})\nexport type ChangeTierInput = z.infer<typeof changeTierInputSchema>\n\n/**\n * Self-attested onboarding form the dashboard collects after a\n * merchant first logs in via Privy. On success the API stamps\n * `onboardingCompleted: true` on the row, and the dashboard exits\n * the wizard. Shared here so the API's DTO and the web client's\n * hook can enforce the same shape.\n */\nexport const onboardMerchantInputSchema = z.object({\n  businessName: z.string().min(2).max(120),\n  businessSector: z.string().min(2).max(80),\n  countryCode: z\n    .string()\n    .length(2)\n    .regex(/^[A-Z]{2}$/, 'must be a 2-letter ISO country code'),\n  websiteUrl: z.string().url().optional(),\n  logoUrl: z.string().url().optional(),\n  phone: z.string().min(6).max(20).optional(),\n  payoutAddress: evmAddressSchema,\n  defaultCurrency: z.enum(['USDC', 'EURC']).optional(),\n})\nexport type OnboardMerchantInput = z.infer<typeof onboardMerchantInputSchema>\n\nexport const merchantPublicBrandSchema = z.object({\n  id: idSchema,\n  businessName: z.string().min(2).max(120),\n  logoUrl: z.string().url().nullable(),\n  walletAddress: evmAddressSchema.nullable(),\n})\nexport type MerchantPublicBrand = z.infer<typeof merchantPublicBrandSchema>\n\n/**\n * On-chain balance view for the withdraw page. Strimz is\n * non-custodial: payments settle directly into the merchant's\n * `payoutAddress`, and \"withdrawal\" means the merchant transferring\n * out with their own wallet. This shape reports current on-chain\n * state so the dashboard renders live balances + decides whether to\n * offer the signing UI.\n */\nexport const merchantBalanceSchema = z.object({\n  /** Payout wallet, checksummed; null when the merchant hasn't set one. */\n  payoutAddress: evmAddressSchema.nullable(),\n  /** Privy embedded wallet, checksummed if resolvable. */\n  walletAddress: evmAddressSchema.nullable(),\n  /**\n   * True when `payoutAddress === walletAddress`, i.e. the merchant\n   * can sign a transfer from the dashboard via Privy. False for\n   * merchants using an external wallet as payout — the UI falls back\n   * to \"copy the address, transfer with your wallet.\"\n   */\n  canSignFromDashboard: z.boolean(),\n  balances: z.array(\n    z.object({\n      currency: z.enum(['USDC', 'EURC']),\n      contractAddress: evmAddressSchema,\n      /** Base-6 integer as string. */\n      raw: z.string(),\n      /** Human-formatted, e.g. `1234.56`. */\n      formatted: z.string(),\n      decimals: z.number().int().min(0).max(30),\n    }),\n  ),\n})\nexport type MerchantBalanceView = z.infer<typeof merchantBalanceSchema>\n\n// ---------- Team members ----------\n\nexport const merchantMemberSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  email: emailSchema,\n  role: merchantRoleSchema,\n  invitedAt: isoTimestampSchema,\n  acceptedAt: isoTimestampSchema.nullable(),\n})\nexport type MerchantMember = z.infer<typeof merchantMemberSchema>\n\nexport const inviteMemberInputSchema = z.object({\n  email: emailSchema,\n  role: merchantRoleSchema,\n})\nexport type InviteMemberInput = z.infer<typeof inviteMemberInputSchema>\n\n// ---------- Auth ----------\n\nexport const loginInputSchema = z.object({\n  email: emailSchema,\n  password: z.string().min(1).max(128),\n})\nexport type LoginInput = z.infer<typeof loginInputSchema>\n\nexport const loginOutputSchema = z.object({\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  merchant: merchantSchema,\n})\nexport type LoginOutput = z.infer<typeof loginOutputSchema>\n"]}

package/dist/payment-sessions.cjs

@@ -39,6 +39,9 @@ var paymentSessionStatusSchema = zod.z.enum([
   "expired",
   "cancelled"
 ]);
+var callbackUrlSchema = zod.z.string().url().refine((v) => v.startsWith("https://") || v.startsWith("http://"), {
+  message: "must be an http:// or https:// URL"
+});
 var paymentSessionSchema = zod.z.object({
   id: idSchema,
   merchantId: idSchema,
@@ -68,8 +71,8 @@ var paymentSessionSchema = zod.z.object({
   description: zod.z.string().max(500).nullable(),
   payerWalletAddress: evmAddressSchema.nullable(),
   payerEmail: zod.z.string().email().nullable(),
-  successUrl: zod.z.string().url().nullable(),
-  cancelUrl: zod.z.string().url().nullable(),
+  successUrl: callbackUrlSchema.nullable(),
+  cancelUrl: callbackUrlSchema.nullable(),
   sourceChain: zod.z.enum(["arc", "ethereum", "base", "polygon", "arbitrum", "optimism", "avalanche", "solana"]).nullable(),
   bridgeTxHash: evmTxHashSchema.nullable(),
   onchainTxHash: evmTxHashSchema.nullable(),
@@ -117,6 +120,7 @@ var submitPaymentSessionInputSchema = zod.z.object({
   payerWalletAddress: evmAddressSchema
 });
 
+exports.callbackUrlSchema = callbackUrlSchema;
 exports.createPaymentSessionInputSchema = createPaymentSessionInputSchema;
 exports.paymentSessionSchema = paymentSessionSchema;
 exports.paymentSessionStatusSchema = paymentSessionStatusSchema;

package/dist/payment-sessions.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common.ts","../src/payment-sessions.ts"],"names":["z"],"mappings":";;;;;AAQO,IAAM,QAAA,GAAWA,KAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmBA,KAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkBA,KAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlEA,KAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5CA,KAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0BA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoBA,KAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtBA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqBA,KAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrCA,MAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5BA,MAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAYM,IAAM,iBAAiBA,KAAA,CAC3B,MAAA;AAAA,EACCA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxBA,MAAE,KAAA,CAAM,CAACA,MAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAGA,KAAA,CAAE,MAAA,IAAUA,KAAA,CAAE,OAAA,IAAWA,KAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE,CAAA;AAGaA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwBA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3BA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9BA,MAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjDA,KAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;AClF1D,IAAM,0BAAA,GAA6BA,MAAE,IAAA,CAAK;AAAA,EAC/C,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EAC3C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,eAAA,EAAiBA,MACd,MAAA,EAAO,CACP,MAAM,WAAA,EAAa,+CAA+C,EAClE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQZ,YAAA,EAAc,iBAAiB,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY,SAAS,QAAA,EAAS;AAAA,EAC9B,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,kBAAA,EAAoB,iBAAiB,QAAA,EAAS;AAAA,EAC9C,YAAYA,KAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACxC,YAAYA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,WAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACrC,WAAA,EAAaA,KAAAA,CACV,IAAA,CAAK,CAAC,OAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC,EAC1F,QAAA,EAAS;AAAA,EACZ,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,aAAA,EAAe,gBAAgB,QAAA,EAAS;AAAA,EACxC,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,EAC5B,QAAA,EAAU,cAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAKM,IAAM,+BAAA,GAAkCA,MAAE,MAAA,CAAO;AAAA,EACtD,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,QAAA,EAAUA,MACP,MAAA,CAAO;AAAA,IACN,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA,IACzC,OAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,IACnC,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAAS,GAC3C,EACA,QAAA,EAAS;AAAA,EACZ,YAAYA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,WAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA;AAAA,EAErC,gBAAA,EAAkBA,KAAAA,CACf,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAA,GAAK,EAAE,CAAA,CACX,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKb,uBAAuBA,KAAAA,CACpB,KAAA;AAAA,IACCA,KAAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC;AAAA,IAE7F,QAAA,EAAS;AAAA,EACZ,QAAA,EAAU,eAAe,QAAA;AAC3B,CAAC;AAGM,IAAM,+BAAA,GAAkCA,MAAE,MAAA,CAAO;AAAA,EACtD,WAAA,EAAaA,MAAE,IAAA,CAAK;AAAA,IAClB,KAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AAAA,EACD,aAAA,EAAe,eAAA;AAAA,EACf,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,kBAAA,EAAoB;AACtB,CAAC","file":"payment-sessions.cjs","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum — mirrors `@strimz/shared-config`. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum — mirrors `@strimz/shared-config`. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Payment session — a one-shot checkout intent.\n *\n * State machine:\n *   created → awaiting_payment → submitted → confirmed\n *                                       \\\n *                                        → failed\n *                               → expired\n *                               → cancelled\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  metadataSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const paymentSessionStatusSchema = z.enum([\n  'created',\n  'awaiting_payment',\n  'submitted',\n  'confirmed',\n  'failed',\n  'expired',\n  'cancelled',\n])\nexport type PaymentSessionStatus = z.infer<typeof paymentSessionStatusSchema>\n\nexport const paymentSessionSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  /**\n   * On-chain StrimzRegistry merchant id (uint96) as a decimal string.\n   * Set when the merchant has been registered on-chain; null when the\n   * merchant exists in our DB but the registry transaction hasn't\n   * been broadcast yet. Hosted checkout uses this to populate the\n   * meta-tx calldata; if null, the checkout refuses to accept\n   * payments.\n   */\n  chainMerchantId: z\n    .string()\n    .regex(/^[0-9]+$/u, 'must be a non-negative decimal integer string')\n    .nullable(),\n  /**\n   * ERC-20 token contract address resolved from `currency` on the\n   * active chain (Arc Testnet / Mainnet). Used as the `verifyingContract`\n   * in the EIP-712 domain for both EIP-3009 and EIP-2612 signing.\n   * Null on the (vanishingly unlikely) path where the API has no\n   * configured address for the session's currency.\n   */\n  tokenAddress: evmAddressSchema.nullable(),\n  customerId: idSchema.nullable(),\n  status: paymentSessionStatusSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  feeAmount: tokenAmountSchema,\n  netAmount: tokenAmountSchema,\n  description: z.string().max(500).nullable(),\n  payerWalletAddress: evmAddressSchema.nullable(),\n  payerEmail: z.string().email().nullable(),\n  successUrl: z.string().url().nullable(),\n  cancelUrl: z.string().url().nullable(),\n  sourceChain: z\n    .enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana'])\n    .nullable(),\n  bridgeTxHash: evmTxHashSchema.nullable(),\n  onchainTxHash: evmTxHashSchema.nullable(),\n  checkoutUrl: z.string().url(),\n  metadata: metadataSchema,\n  expiresAt: isoTimestampSchema,\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type PaymentSession = z.infer<typeof paymentSessionSchema>\n\n// ---------- DTOs ----------\n\nexport const createPaymentSessionInputSchema = z.object({\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  description: z.string().max(500).optional(),\n  customer: z\n    .object({\n      walletAddress: evmAddressSchema.optional(),\n      email: z.string().email().optional(),\n      externalRef: z.string().max(120).optional(),\n    })\n    .optional(),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n  /** Minutes until the session expires. Default 30, max 60*24 (one day). */\n  expiresInMinutes: z\n    .number()\n    .int()\n    .min(1)\n    .max(60 * 24)\n    .default(30),\n  /**\n   * Allowed source chains a payer can bridge USDC from via CCTP. Omit to\n   * accept every CCTP-supported chain.\n   */\n  supportedSourceChains: z\n    .array(\n      z.enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana']),\n    )\n    .optional(),\n  metadata: metadataSchema.optional(),\n})\nexport type CreatePaymentSessionInput = z.infer<typeof createPaymentSessionInputSchema>\n\nexport const submitPaymentSessionInputSchema = z.object({\n  sourceChain: z.enum([\n    'arc',\n    'ethereum',\n    'base',\n    'polygon',\n    'arbitrum',\n    'optimism',\n    'avalanche',\n    'solana',\n  ]),\n  onchainTxHash: evmTxHashSchema,\n  bridgeTxHash: evmTxHashSchema.optional(),\n  payerWalletAddress: evmAddressSchema,\n})\nexport type SubmitPaymentSessionInput = z.infer<typeof submitPaymentSessionInputSchema>\n"]}
+{"version":3,"sources":["../src/common.ts","../src/payment-sessions.ts"],"names":["z"],"mappings":";;;;;AAQO,IAAM,QAAA,GAAWA,KAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmBA,KAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkBA,KAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlEA,KAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5CA,KAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0BA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoBA,KAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtBA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqBA,KAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrCA,MAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5BA,MAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAYM,IAAM,iBAAiBA,KAAA,CAC3B,MAAA;AAAA,EACCA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxBA,MAAE,KAAA,CAAM,CAACA,MAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAGA,KAAA,CAAE,MAAA,IAAUA,KAAA,CAAE,OAAA,IAAWA,KAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE,CAAA;AAGaA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwBA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3BA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9BA,MAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjDA,KAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;AClF1D,IAAM,0BAAA,GAA6BA,MAAE,IAAA,CAAK;AAAA,EAC/C,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAC;AAkBM,IAAM,oBAAoBA,KAAAA,CAC9B,MAAA,EAAO,CACP,GAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,UAAU,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,SAAS,CAAA,EAAG;AAAA,EAClE,OAAA,EAAS;AACX,CAAC;AAEI,IAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EAC3C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,eAAA,EAAiBA,MACd,MAAA,EAAO,CACP,MAAM,WAAA,EAAa,+CAA+C,EAClE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQZ,YAAA,EAAc,iBAAiB,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY,SAAS,QAAA,EAAS;AAAA,EAC9B,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,kBAAA,EAAoB,iBAAiB,QAAA,EAAS;AAAA,EAC9C,YAAYA,KAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY,kBAAkB,QAAA,EAAS;AAAA,EACvC,SAAA,EAAW,kBAAkB,QAAA,EAAS;AAAA,EACtC,WAAA,EAAaA,KAAAA,CACV,IAAA,CAAK,CAAC,OAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC,EAC1F,QAAA,EAAS;AAAA,EACZ,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,aAAA,EAAe,gBAAgB,QAAA,EAAS;AAAA,EACxC,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,EAC5B,QAAA,EAAU,cAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAKM,IAAM,+BAAA,GAAkCA,MAAE,MAAA,CAAO;AAAA,EACtD,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,QAAA,EAAUA,MACP,MAAA,CAAO;AAAA,IACN,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA,IACzC,OAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,IACnC,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAAS,GAC3C,EACA,QAAA,EAAS;AAAA,EACZ,YAAYA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,WAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA;AAAA,EAErC,gBAAA,EAAkBA,KAAAA,CACf,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAA,GAAK,EAAE,CAAA,CACX,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKb,uBAAuBA,KAAAA,CACpB,KAAA;AAAA,IACCA,KAAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC;AAAA,IAE7F,QAAA,EAAS;AAAA,EACZ,QAAA,EAAU,eAAe,QAAA;AAC3B,CAAC;AAGM,IAAM,+BAAA,GAAkCA,MAAE,MAAA,CAAO;AAAA,EACtD,WAAA,EAAaA,MAAE,IAAA,CAAK;AAAA,IAClB,KAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AAAA,EACD,aAAA,EAAe,eAAA;AAAA,EACf,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,kBAAA,EAAoB;AACtB,CAAC","file":"payment-sessions.cjs","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Payment session. A one-shot checkout intent.\n *\n * State machine:\n *   created → awaiting_payment → submitted → confirmed\n *                                       \\\n *                                        → failed\n *                               → expired\n *                               → cancelled\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  metadataSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const paymentSessionStatusSchema = z.enum([\n  'created',\n  'awaiting_payment',\n  'submitted',\n  'confirmed',\n  'failed',\n  'expired',\n  'cancelled',\n])\nexport type PaymentSessionStatus = z.infer<typeof paymentSessionStatusSchema>\n\n/**\n * Merchant-supplied callback URL. The hosted checkout dispatches with\n * `window.location.href = redirectUrl` on completion / cancellation,\n * so we MUST reject anything other than `http://` and `https://`.\n *\n * Why this is a real risk: Zod's `.url()` validates RFC syntax, which\n * accepts `javascript:`, `data:`, `vbscript:`, `file:`, blob:`, etc.\n * A compromised merchant integration or an XSS upstream could ship a\n * session whose redirect URL executes script (or exfiltrates session\n * tokens) on every payer's browser. The damage is per-payer, but the\n * blast radius is \"every checkout the merchant runs.\"\n *\n * Mailto / tel and other handler protocols are also rejected — there\n * is no legitimate flow on a payment checkout that would benefit.\n */\nexport const callbackUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://') || v.startsWith('http://'), {\n    message: 'must be an http:// or https:// URL',\n  })\n\nexport const paymentSessionSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  /**\n   * On-chain StrimzRegistry merchant id (uint96) as a decimal string.\n   * Set when the merchant has been registered on-chain; null when the\n   * merchant exists in our DB but the registry transaction hasn't\n   * been broadcast yet. Hosted checkout uses this to populate the\n   * meta-tx calldata; if null, the checkout refuses to accept\n   * payments.\n   */\n  chainMerchantId: z\n    .string()\n    .regex(/^[0-9]+$/u, 'must be a non-negative decimal integer string')\n    .nullable(),\n  /**\n   * ERC-20 token contract address resolved from `currency` on the\n   * active chain (Arc Testnet / Mainnet). Used as the `verifyingContract`\n   * in the EIP-712 domain for both EIP-3009 and EIP-2612 signing.\n   * Null on the (vanishingly unlikely) path where the API has no\n   * configured address for the session's currency.\n   */\n  tokenAddress: evmAddressSchema.nullable(),\n  customerId: idSchema.nullable(),\n  status: paymentSessionStatusSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  feeAmount: tokenAmountSchema,\n  netAmount: tokenAmountSchema,\n  description: z.string().max(500).nullable(),\n  payerWalletAddress: evmAddressSchema.nullable(),\n  payerEmail: z.string().email().nullable(),\n  successUrl: callbackUrlSchema.nullable(),\n  cancelUrl: callbackUrlSchema.nullable(),\n  sourceChain: z\n    .enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana'])\n    .nullable(),\n  bridgeTxHash: evmTxHashSchema.nullable(),\n  onchainTxHash: evmTxHashSchema.nullable(),\n  checkoutUrl: z.string().url(),\n  metadata: metadataSchema,\n  expiresAt: isoTimestampSchema,\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type PaymentSession = z.infer<typeof paymentSessionSchema>\n\n// ---------- DTOs ----------\n\nexport const createPaymentSessionInputSchema = z.object({\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  description: z.string().max(500).optional(),\n  customer: z\n    .object({\n      walletAddress: evmAddressSchema.optional(),\n      email: z.string().email().optional(),\n      externalRef: z.string().max(120).optional(),\n    })\n    .optional(),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n  /** Minutes until the session expires. Default 30, max 60*24 (one day). */\n  expiresInMinutes: z\n    .number()\n    .int()\n    .min(1)\n    .max(60 * 24)\n    .default(30),\n  /**\n   * Allowed source chains a payer can bridge USDC from via CCTP. Omit to\n   * accept every CCTP-supported chain.\n   */\n  supportedSourceChains: z\n    .array(\n      z.enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana']),\n    )\n    .optional(),\n  metadata: metadataSchema.optional(),\n})\nexport type CreatePaymentSessionInput = z.infer<typeof createPaymentSessionInputSchema>\n\nexport const submitPaymentSessionInputSchema = z.object({\n  sourceChain: z.enum([\n    'arc',\n    'ethereum',\n    'base',\n    'polygon',\n    'arbitrum',\n    'optimism',\n    'avalanche',\n    'solana',\n  ]),\n  onchainTxHash: evmTxHashSchema,\n  bridgeTxHash: evmTxHashSchema.optional(),\n  payerWalletAddress: evmAddressSchema,\n})\nexport type SubmitPaymentSessionInput = z.infer<typeof submitPaymentSessionInputSchema>\n"]}

package/dist/payment-sessions.d.cts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 
 /**
- * Payment session — a one-shot checkout intent.
+ * Payment session. A one-shot checkout intent.
  *
  * State machine:
  *   created → awaiting_payment → submitted → confirmed
@@ -13,6 +13,22 @@ import { z } from 'zod';
 
 declare const paymentSessionStatusSchema: z.ZodEnum<["created", "awaiting_payment", "submitted", "confirmed", "failed", "expired", "cancelled"]>;
 type PaymentSessionStatus = z.infer<typeof paymentSessionStatusSchema>;
+/**
+ * Merchant-supplied callback URL. The hosted checkout dispatches with
+ * `window.location.href = redirectUrl` on completion / cancellation,
+ * so we MUST reject anything other than `http://` and `https://`.
+ *
+ * Why this is a real risk: Zod's `.url()` validates RFC syntax, which
+ * accepts `javascript:`, `data:`, `vbscript:`, `file:`, blob:`, etc.
+ * A compromised merchant integration or an XSS upstream could ship a
+ * session whose redirect URL executes script (or exfiltrates session
+ * tokens) on every payer's browser. The damage is per-payer, but the
+ * blast radius is "every checkout the merchant runs."
+ *
+ * Mailto / tel and other handler protocols are also rejected — there
+ * is no legitimate flow on a payment checkout that would benefit.
+ */
+declare const callbackUrlSchema: z.ZodEffects<z.ZodString, string, string>;
 declare const paymentSessionSchema: z.ZodObject<{
     id: z.ZodString;
     merchantId: z.ZodString;
@@ -42,8 +58,8 @@ declare const paymentSessionSchema: z.ZodObject<{
     description: z.ZodNullable<z.ZodString>;
     payerWalletAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
     payerEmail: z.ZodNullable<z.ZodString>;
-    successUrl: z.ZodNullable<z.ZodString>;
-    cancelUrl: z.ZodNullable<z.ZodString>;
+    successUrl: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    cancelUrl: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
     sourceChain: z.ZodNullable<z.ZodEnum<["arc", "ethereum", "base", "polygon", "arbitrum", "optimism", "avalanche", "solana"]>>;
     bridgeTxHash: z.ZodNullable<z.ZodString>;
     onchainTxHash: z.ZodNullable<z.ZodString>;
@@ -177,4 +193,4 @@ declare const submitPaymentSessionInputSchema: z.ZodObject<{
 }>;
 type SubmitPaymentSessionInput = z.infer<typeof submitPaymentSessionInputSchema>;
 
-export { type CreatePaymentSessionInput, type PaymentSession, type PaymentSessionStatus, type SubmitPaymentSessionInput, createPaymentSessionInputSchema, paymentSessionSchema, paymentSessionStatusSchema, submitPaymentSessionInputSchema };
+export { type CreatePaymentSessionInput, type PaymentSession, type PaymentSessionStatus, type SubmitPaymentSessionInput, callbackUrlSchema, createPaymentSessionInputSchema, paymentSessionSchema, paymentSessionStatusSchema, submitPaymentSessionInputSchema };