@strimz/shared-types 0.1.0 → 0.2.0

package/dist/payment-sessions.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 
 /**
- * Payment session — a one-shot checkout intent.
+ * Payment session. A one-shot checkout intent.
  *
  * State machine:
  *   created → awaiting_payment → submitted → confirmed
@@ -13,6 +13,22 @@ import { z } from 'zod';
 
 declare const paymentSessionStatusSchema: z.ZodEnum<["created", "awaiting_payment", "submitted", "confirmed", "failed", "expired", "cancelled"]>;
 type PaymentSessionStatus = z.infer<typeof paymentSessionStatusSchema>;
+/**
+ * Merchant-supplied callback URL. The hosted checkout dispatches with
+ * `window.location.href = redirectUrl` on completion / cancellation,
+ * so we MUST reject anything other than `http://` and `https://`.
+ *
+ * Why this is a real risk: Zod's `.url()` validates RFC syntax, which
+ * accepts `javascript:`, `data:`, `vbscript:`, `file:`, blob:`, etc.
+ * A compromised merchant integration or an XSS upstream could ship a
+ * session whose redirect URL executes script (or exfiltrates session
+ * tokens) on every payer's browser. The damage is per-payer, but the
+ * blast radius is "every checkout the merchant runs."
+ *
+ * Mailto / tel and other handler protocols are also rejected — there
+ * is no legitimate flow on a payment checkout that would benefit.
+ */
+declare const callbackUrlSchema: z.ZodEffects<z.ZodString, string, string>;
 declare const paymentSessionSchema: z.ZodObject<{
     id: z.ZodString;
     merchantId: z.ZodString;
@@ -42,8 +58,8 @@ declare const paymentSessionSchema: z.ZodObject<{
     description: z.ZodNullable<z.ZodString>;
     payerWalletAddress: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
     payerEmail: z.ZodNullable<z.ZodString>;
-    successUrl: z.ZodNullable<z.ZodString>;
-    cancelUrl: z.ZodNullable<z.ZodString>;
+    successUrl: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    cancelUrl: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
     sourceChain: z.ZodNullable<z.ZodEnum<["arc", "ethereum", "base", "polygon", "arbitrum", "optimism", "avalanche", "solana"]>>;
     bridgeTxHash: z.ZodNullable<z.ZodString>;
     onchainTxHash: z.ZodNullable<z.ZodString>;
@@ -177,4 +193,4 @@ declare const submitPaymentSessionInputSchema: z.ZodObject<{
 }>;
 type SubmitPaymentSessionInput = z.infer<typeof submitPaymentSessionInputSchema>;
 
-export { type CreatePaymentSessionInput, type PaymentSession, type PaymentSessionStatus, type SubmitPaymentSessionInput, createPaymentSessionInputSchema, paymentSessionSchema, paymentSessionStatusSchema, submitPaymentSessionInputSchema };
+export { type CreatePaymentSessionInput, type PaymentSession, type PaymentSessionStatus, type SubmitPaymentSessionInput, callbackUrlSchema, createPaymentSessionInputSchema, paymentSessionSchema, paymentSessionStatusSchema, submitPaymentSessionInputSchema };

package/dist/payment-sessions.js

@@ -37,6 +37,9 @@ var paymentSessionStatusSchema = z.enum([
   "expired",
   "cancelled"
 ]);
+var callbackUrlSchema = z.string().url().refine((v) => v.startsWith("https://") || v.startsWith("http://"), {
+  message: "must be an http:// or https:// URL"
+});
 var paymentSessionSchema = z.object({
   id: idSchema,
   merchantId: idSchema,
@@ -66,8 +69,8 @@ var paymentSessionSchema = z.object({
   description: z.string().max(500).nullable(),
   payerWalletAddress: evmAddressSchema.nullable(),
   payerEmail: z.string().email().nullable(),
-  successUrl: z.string().url().nullable(),
-  cancelUrl: z.string().url().nullable(),
+  successUrl: callbackUrlSchema.nullable(),
+  cancelUrl: callbackUrlSchema.nullable(),
   sourceChain: z.enum(["arc", "ethereum", "base", "polygon", "arbitrum", "optimism", "avalanche", "solana"]).nullable(),
   bridgeTxHash: evmTxHashSchema.nullable(),
   onchainTxHash: evmTxHashSchema.nullable(),
@@ -115,6 +118,6 @@ var submitPaymentSessionInputSchema = z.object({
   payerWalletAddress: evmAddressSchema
 });
 
-export { createPaymentSessionInputSchema, paymentSessionSchema, paymentSessionStatusSchema, submitPaymentSessionInputSchema };
+export { callbackUrlSchema, createPaymentSessionInputSchema, paymentSessionSchema, paymentSessionStatusSchema, submitPaymentSessionInputSchema };
 //# sourceMappingURL=payment-sessions.js.map
 //# sourceMappingURL=payment-sessions.js.map

package/dist/payment-sessions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common.ts","../src/payment-sessions.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkB,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlE,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5C,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoB,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAYM,IAAM,iBAAiB,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE,CAAA;AAGa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9B,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;AClF1D,IAAM,0BAAA,GAA6BA,EAAE,IAAA,CAAK;AAAA,EAC/C,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAA,GAAuBA,EAAE,MAAA,CAAO;AAAA,EAC3C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,eAAA,EAAiBA,EACd,MAAA,EAAO,CACP,MAAM,WAAA,EAAa,+CAA+C,EAClE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQZ,YAAA,EAAc,iBAAiB,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY,SAAS,QAAA,EAAS;AAAA,EAC9B,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,kBAAA,EAAoB,iBAAiB,QAAA,EAAS;AAAA,EAC9C,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACxC,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,WAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACrC,WAAA,EAAaA,CAAAA,CACV,IAAA,CAAK,CAAC,OAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC,EAC1F,QAAA,EAAS;AAAA,EACZ,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,aAAA,EAAe,gBAAgB,QAAA,EAAS;AAAA,EACxC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,EAC5B,QAAA,EAAU,cAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAKM,IAAM,+BAAA,GAAkCA,EAAE,MAAA,CAAO;AAAA,EACtD,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,QAAA,EAAUA,EACP,MAAA,CAAO;AAAA,IACN,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA,IACzC,OAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,IACnC,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAAS,GAC3C,EACA,QAAA,EAAS;AAAA,EACZ,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,WAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA;AAAA,EAErC,gBAAA,EAAkBA,CAAAA,CACf,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAA,GAAK,EAAE,CAAA,CACX,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKb,uBAAuBA,CAAAA,CACpB,KAAA;AAAA,IACCA,CAAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC;AAAA,IAE7F,QAAA,EAAS;AAAA,EACZ,QAAA,EAAU,eAAe,QAAA;AAC3B,CAAC;AAGM,IAAM,+BAAA,GAAkCA,EAAE,MAAA,CAAO;AAAA,EACtD,WAAA,EAAaA,EAAE,IAAA,CAAK;AAAA,IAClB,KAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AAAA,EACD,aAAA,EAAe,eAAA;AAAA,EACf,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,kBAAA,EAAoB;AACtB,CAAC","file":"payment-sessions.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum — mirrors `@strimz/shared-config`. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum — mirrors `@strimz/shared-config`. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Payment session — a one-shot checkout intent.\n *\n * State machine:\n *   created → awaiting_payment → submitted → confirmed\n *                                       \\\n *                                        → failed\n *                               → expired\n *                               → cancelled\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  metadataSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const paymentSessionStatusSchema = z.enum([\n  'created',\n  'awaiting_payment',\n  'submitted',\n  'confirmed',\n  'failed',\n  'expired',\n  'cancelled',\n])\nexport type PaymentSessionStatus = z.infer<typeof paymentSessionStatusSchema>\n\nexport const paymentSessionSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  /**\n   * On-chain StrimzRegistry merchant id (uint96) as a decimal string.\n   * Set when the merchant has been registered on-chain; null when the\n   * merchant exists in our DB but the registry transaction hasn't\n   * been broadcast yet. Hosted checkout uses this to populate the\n   * meta-tx calldata; if null, the checkout refuses to accept\n   * payments.\n   */\n  chainMerchantId: z\n    .string()\n    .regex(/^[0-9]+$/u, 'must be a non-negative decimal integer string')\n    .nullable(),\n  /**\n   * ERC-20 token contract address resolved from `currency` on the\n   * active chain (Arc Testnet / Mainnet). Used as the `verifyingContract`\n   * in the EIP-712 domain for both EIP-3009 and EIP-2612 signing.\n   * Null on the (vanishingly unlikely) path where the API has no\n   * configured address for the session's currency.\n   */\n  tokenAddress: evmAddressSchema.nullable(),\n  customerId: idSchema.nullable(),\n  status: paymentSessionStatusSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  feeAmount: tokenAmountSchema,\n  netAmount: tokenAmountSchema,\n  description: z.string().max(500).nullable(),\n  payerWalletAddress: evmAddressSchema.nullable(),\n  payerEmail: z.string().email().nullable(),\n  successUrl: z.string().url().nullable(),\n  cancelUrl: z.string().url().nullable(),\n  sourceChain: z\n    .enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana'])\n    .nullable(),\n  bridgeTxHash: evmTxHashSchema.nullable(),\n  onchainTxHash: evmTxHashSchema.nullable(),\n  checkoutUrl: z.string().url(),\n  metadata: metadataSchema,\n  expiresAt: isoTimestampSchema,\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type PaymentSession = z.infer<typeof paymentSessionSchema>\n\n// ---------- DTOs ----------\n\nexport const createPaymentSessionInputSchema = z.object({\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  description: z.string().max(500).optional(),\n  customer: z\n    .object({\n      walletAddress: evmAddressSchema.optional(),\n      email: z.string().email().optional(),\n      externalRef: z.string().max(120).optional(),\n    })\n    .optional(),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n  /** Minutes until the session expires. Default 30, max 60*24 (one day). */\n  expiresInMinutes: z\n    .number()\n    .int()\n    .min(1)\n    .max(60 * 24)\n    .default(30),\n  /**\n   * Allowed source chains a payer can bridge USDC from via CCTP. Omit to\n   * accept every CCTP-supported chain.\n   */\n  supportedSourceChains: z\n    .array(\n      z.enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana']),\n    )\n    .optional(),\n  metadata: metadataSchema.optional(),\n})\nexport type CreatePaymentSessionInput = z.infer<typeof createPaymentSessionInputSchema>\n\nexport const submitPaymentSessionInputSchema = z.object({\n  sourceChain: z.enum([\n    'arc',\n    'ethereum',\n    'base',\n    'polygon',\n    'arbitrum',\n    'optimism',\n    'avalanche',\n    'solana',\n  ]),\n  onchainTxHash: evmTxHashSchema,\n  bridgeTxHash: evmTxHashSchema.optional(),\n  payerWalletAddress: evmAddressSchema,\n})\nexport type SubmitPaymentSessionInput = z.infer<typeof submitPaymentSessionInputSchema>\n"]}
+{"version":3,"sources":["../src/common.ts","../src/payment-sessions.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkB,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlE,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5C,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoB,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAYM,IAAM,iBAAiB,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE,CAAA;AAGa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9B,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;AClF1D,IAAM,0BAAA,GAA6BA,EAAE,IAAA,CAAK;AAAA,EAC/C,SAAA;AAAA,EACA,kBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAC;AAkBM,IAAM,oBAAoBA,CAAAA,CAC9B,MAAA,EAAO,CACP,GAAA,GACA,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,UAAU,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,SAAS,CAAA,EAAG;AAAA,EAClE,OAAA,EAAS;AACX,CAAC;AAEI,IAAM,oBAAA,GAAuBA,EAAE,MAAA,CAAO;AAAA,EAC3C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,eAAA,EAAiBA,EACd,MAAA,EAAO,CACP,MAAM,WAAA,EAAa,+CAA+C,EAClE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQZ,YAAA,EAAc,iBAAiB,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY,SAAS,QAAA,EAAS;AAAA,EAC9B,MAAA,EAAQ,0BAAA;AAAA,EACR,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,SAAA,EAAW,iBAAA;AAAA,EACX,SAAA,EAAW,iBAAA;AAAA,EACX,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,kBAAA,EAAoB,iBAAiB,QAAA,EAAS;AAAA,EAC9C,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY,kBAAkB,QAAA,EAAS;AAAA,EACvC,SAAA,EAAW,kBAAkB,QAAA,EAAS;AAAA,EACtC,WAAA,EAAaA,CAAAA,CACV,IAAA,CAAK,CAAC,OAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC,EAC1F,QAAA,EAAS;AAAA,EACZ,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,aAAA,EAAe,gBAAgB,QAAA,EAAS;AAAA,EACxC,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,EAC5B,QAAA,EAAU,cAAA;AAAA,EACV,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAKM,IAAM,+BAAA,GAAkCA,EAAE,MAAA,CAAO;AAAA,EACtD,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,QAAA,EAAUA,EACP,MAAA,CAAO;AAAA,IACN,aAAA,EAAe,iBAAiB,QAAA,EAAS;AAAA,IACzC,OAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,IACnC,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAAS,GAC3C,EACA,QAAA,EAAS;AAAA,EACZ,YAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,WAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA;AAAA,EAErC,gBAAA,EAAkBA,CAAAA,CACf,MAAA,EAAO,CACP,KAAI,CACJ,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAA,GAAK,EAAE,CAAA,CACX,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKb,uBAAuBA,CAAAA,CACpB,KAAA;AAAA,IACCA,CAAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,SAAA,EAAW,UAAA,EAAY,UAAA,EAAY,WAAA,EAAa,QAAQ,CAAC;AAAA,IAE7F,QAAA,EAAS;AAAA,EACZ,QAAA,EAAU,eAAe,QAAA;AAC3B,CAAC;AAGM,IAAM,+BAAA,GAAkCA,EAAE,MAAA,CAAO;AAAA,EACtD,WAAA,EAAaA,EAAE,IAAA,CAAK;AAAA,IAClB,KAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AAAA,EACD,aAAA,EAAe,eAAA;AAAA,EACf,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,kBAAA,EAAoB;AACtB,CAAC","file":"payment-sessions.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Payment session. A one-shot checkout intent.\n *\n * State machine:\n *   created → awaiting_payment → submitted → confirmed\n *                                       \\\n *                                        → failed\n *                               → expired\n *                               → cancelled\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  metadataSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const paymentSessionStatusSchema = z.enum([\n  'created',\n  'awaiting_payment',\n  'submitted',\n  'confirmed',\n  'failed',\n  'expired',\n  'cancelled',\n])\nexport type PaymentSessionStatus = z.infer<typeof paymentSessionStatusSchema>\n\n/**\n * Merchant-supplied callback URL. The hosted checkout dispatches with\n * `window.location.href = redirectUrl` on completion / cancellation,\n * so we MUST reject anything other than `http://` and `https://`.\n *\n * Why this is a real risk: Zod's `.url()` validates RFC syntax, which\n * accepts `javascript:`, `data:`, `vbscript:`, `file:`, blob:`, etc.\n * A compromised merchant integration or an XSS upstream could ship a\n * session whose redirect URL executes script (or exfiltrates session\n * tokens) on every payer's browser. The damage is per-payer, but the\n * blast radius is \"every checkout the merchant runs.\"\n *\n * Mailto / tel and other handler protocols are also rejected — there\n * is no legitimate flow on a payment checkout that would benefit.\n */\nexport const callbackUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://') || v.startsWith('http://'), {\n    message: 'must be an http:// or https:// URL',\n  })\n\nexport const paymentSessionSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  /**\n   * On-chain StrimzRegistry merchant id (uint96) as a decimal string.\n   * Set when the merchant has been registered on-chain; null when the\n   * merchant exists in our DB but the registry transaction hasn't\n   * been broadcast yet. Hosted checkout uses this to populate the\n   * meta-tx calldata; if null, the checkout refuses to accept\n   * payments.\n   */\n  chainMerchantId: z\n    .string()\n    .regex(/^[0-9]+$/u, 'must be a non-negative decimal integer string')\n    .nullable(),\n  /**\n   * ERC-20 token contract address resolved from `currency` on the\n   * active chain (Arc Testnet / Mainnet). Used as the `verifyingContract`\n   * in the EIP-712 domain for both EIP-3009 and EIP-2612 signing.\n   * Null on the (vanishingly unlikely) path where the API has no\n   * configured address for the session's currency.\n   */\n  tokenAddress: evmAddressSchema.nullable(),\n  customerId: idSchema.nullable(),\n  status: paymentSessionStatusSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  feeAmount: tokenAmountSchema,\n  netAmount: tokenAmountSchema,\n  description: z.string().max(500).nullable(),\n  payerWalletAddress: evmAddressSchema.nullable(),\n  payerEmail: z.string().email().nullable(),\n  successUrl: callbackUrlSchema.nullable(),\n  cancelUrl: callbackUrlSchema.nullable(),\n  sourceChain: z\n    .enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana'])\n    .nullable(),\n  bridgeTxHash: evmTxHashSchema.nullable(),\n  onchainTxHash: evmTxHashSchema.nullable(),\n  checkoutUrl: z.string().url(),\n  metadata: metadataSchema,\n  expiresAt: isoTimestampSchema,\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type PaymentSession = z.infer<typeof paymentSessionSchema>\n\n// ---------- DTOs ----------\n\nexport const createPaymentSessionInputSchema = z.object({\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  description: z.string().max(500).optional(),\n  customer: z\n    .object({\n      walletAddress: evmAddressSchema.optional(),\n      email: z.string().email().optional(),\n      externalRef: z.string().max(120).optional(),\n    })\n    .optional(),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n  /** Minutes until the session expires. Default 30, max 60*24 (one day). */\n  expiresInMinutes: z\n    .number()\n    .int()\n    .min(1)\n    .max(60 * 24)\n    .default(30),\n  /**\n   * Allowed source chains a payer can bridge USDC from via CCTP. Omit to\n   * accept every CCTP-supported chain.\n   */\n  supportedSourceChains: z\n    .array(\n      z.enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana']),\n    )\n    .optional(),\n  metadata: metadataSchema.optional(),\n})\nexport type CreatePaymentSessionInput = z.infer<typeof createPaymentSessionInputSchema>\n\nexport const submitPaymentSessionInputSchema = z.object({\n  sourceChain: z.enum([\n    'arc',\n    'ethereum',\n    'base',\n    'polygon',\n    'arbitrum',\n    'optimism',\n    'avalanche',\n    'solana',\n  ]),\n  onchainTxHash: evmTxHashSchema,\n  bridgeTxHash: evmTxHashSchema.optional(),\n  payerWalletAddress: evmAddressSchema,\n})\nexport type SubmitPaymentSessionInput = z.infer<typeof submitPaymentSessionInputSchema>\n"]}

package/dist/refunds.cjs

@@ -71,10 +71,22 @@ var submitRefundSignatureInputSchema = zod.z.object({
   id: idSchema,
   refundTxHash: evmTxHashSchema
 });
+var refundSigningInstructionsSchema = zod.z.object({
+  token: evmAddressSchema,
+  to: evmAddressSchema,
+  amount: tokenAmountSchema,
+  note: zod.z.string()
+});
+var refundCreateOutputSchema = zod.z.object({
+  refund: refundSchema,
+  signingInstructions: refundSigningInstructionsSchema
+});
 
 exports.createRefundInputSchema = createRefundInputSchema;
+exports.refundCreateOutputSchema = refundCreateOutputSchema;
 exports.refundReasonSchema = refundReasonSchema;
 exports.refundSchema = refundSchema;
+exports.refundSigningInstructionsSchema = refundSigningInstructionsSchema;
 exports.refundStatusSchema = refundStatusSchema;
 exports.submitRefundSignatureInputSchema = submitRefundSignatureInputSchema;
 //# sourceMappingURL=refunds.cjs.map

package/dist/refunds.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common.ts","../src/refunds.ts"],"names":["z"],"mappings":";;;;;AAQO,IAAM,QAAA,GAAWA,KAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmBA,KAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkBA,KAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlEA,KAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5CA,KAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0BA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoBA,KAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtBA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqBA,KAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrCA,MAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5BA,MAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6BA,KAAA,CAC3B,MAAA;AAAA,EACCA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxBA,MAAE,KAAA,CAAM,CAACA,MAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAGA,KAAA,CAAE,MAAA,IAAUA,KAAA,CAAE,OAAA,IAAWA,KAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGaA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwBA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3BA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9BA,MAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjDA,KAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACtF1D,IAAM,kBAAA,GAAqBA,MAAE,IAAA,CAAK;AAAA,EACvC,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kBAAA,GAAqBA,MAAE,IAAA,CAAK;AAAA,EACvC,SAAA;AAAA,EACA,oBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EACnC,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EACnC,MAAA,EAAQ,kBAAA;AAAA,EACR,YAAA,EAAc,gBAAA;AAAA,EACd,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,eAAeA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC5C,WAAA,EAAa,QAAA;AAAA,EACb,SAAA,EAAW,kBAAA;AAAA,EACX,WAAA,EAAa,mBAAmB,QAAA;AAClC,CAAC;AAGM,IAAM,uBAAA,GAA0BA,MAAE,MAAA,CAAO;AAAA,EAC9C,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAC5B,CAAC;AAGM,IAAM,gCAAA,GAAmCA,MAAE,MAAA,CAAO;AAAA,EACvD,EAAA,EAAI,QAAA;AAAA,EACJ,YAAA,EAAc;AAChB,CAAC","file":"refunds.cjs","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum — mirrors `@strimz/shared-config`. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum — mirrors `@strimz/shared-config`. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Refund — a merchant-initiated return of funds to a payer.\n *\n * Refunds are executed off-chain (from the merchant's wallet to the payer's\n * wallet). Strimz records the intent, validates constraints, and reconciles\n * via the merchant-signed on-chain transfer.\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const refundReasonSchema = z.enum([\n  'customer_request',\n  'product_issue',\n  'duplicate_charge',\n  'fraudulent',\n  'other',\n])\nexport type RefundReason = z.infer<typeof refundReasonSchema>\n\nexport const refundStatusSchema = z.enum([\n  'pending',\n  'awaiting_signature',\n  'submitted',\n  'completed',\n  'failed',\n  'cancelled',\n])\nexport type RefundStatus = z.infer<typeof refundStatusSchema>\n\nexport const refundSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).nullable(),\n  status: refundStatusSchema,\n  payerAddress: evmAddressSchema,\n  refundTxHash: evmTxHashSchema.nullable(),\n  failureReason: z.string().max(500).nullable(),\n  initiatedBy: idSchema,\n  createdAt: isoTimestampSchema,\n  completedAt: isoTimestampSchema.nullable(),\n})\nexport type Refund = z.infer<typeof refundSchema>\n\nexport const createRefundInputSchema = z.object({\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).optional(),\n})\nexport type CreateRefundInput = z.infer<typeof createRefundInputSchema>\n\nexport const submitRefundSignatureInputSchema = z.object({\n  id: idSchema,\n  refundTxHash: evmTxHashSchema,\n})\nexport type SubmitRefundSignatureInput = z.infer<typeof submitRefundSignatureInputSchema>\n"]}
+{"version":3,"sources":["../src/common.ts","../src/refunds.ts"],"names":["z"],"mappings":";;;;;AAQO,IAAM,QAAA,GAAWA,KAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmBA,KAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkBA,KAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlEA,KAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5CA,KAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0BA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoBA,KAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtBA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqBA,KAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrCA,MAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5BA,MAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6BA,KAAA,CAC3B,MAAA;AAAA,EACCA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxBA,MAAE,KAAA,CAAM,CAACA,MAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAGA,KAAA,CAAE,MAAA,IAAUA,KAAA,CAAE,OAAA,IAAWA,KAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGaA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwBA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3BA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9BA,MAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjDA,KAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACtF1D,IAAM,kBAAA,GAAqBA,MAAE,IAAA,CAAK;AAAA,EACvC,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kBAAA,GAAqBA,MAAE,IAAA,CAAK;AAAA,EACvC,SAAA;AAAA,EACA,oBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,YAAA,GAAeA,MAAE,MAAA,CAAO;AAAA,EACnC,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EACnC,MAAA,EAAQ,kBAAA;AAAA,EACR,YAAA,EAAc,gBAAA;AAAA,EACd,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,eAAeA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC5C,WAAA,EAAa,QAAA;AAAA,EACb,SAAA,EAAW,kBAAA;AAAA,EACX,WAAA,EAAa,mBAAmB,QAAA;AAClC,CAAC;AAGM,IAAM,uBAAA,GAA0BA,MAAE,MAAA,CAAO;AAAA,EAC9C,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAC5B,CAAC;AAGM,IAAM,gCAAA,GAAmCA,MAAE,MAAA,CAAO;AAAA,EACvD,EAAA,EAAI,QAAA;AAAA,EACJ,YAAA,EAAc;AAChB,CAAC;AAQM,IAAM,+BAAA,GAAkCA,MAAE,MAAA,CAAO;AAAA,EACtD,KAAA,EAAO,gBAAA;AAAA,EACP,EAAA,EAAI,gBAAA;AAAA,EACJ,MAAA,EAAQ,iBAAA;AAAA,EACR,IAAA,EAAMA,MAAE,MAAA;AACV,CAAC;AAGM,IAAM,wBAAA,GAA2BA,MAAE,MAAA,CAAO;AAAA,EAC/C,MAAA,EAAQ,YAAA;AAAA,EACR,mBAAA,EAAqB;AACvB,CAAC","file":"refunds.cjs","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Refund. A merchant-initiated return of funds to a payer.\n *\n * Refunds are executed off-chain (from the merchant's wallet to the payer's\n * wallet). Strimz records the intent, validates constraints, and reconciles\n * via the merchant-signed on-chain transfer.\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const refundReasonSchema = z.enum([\n  'customer_request',\n  'product_issue',\n  'duplicate_charge',\n  'fraudulent',\n  'other',\n])\nexport type RefundReason = z.infer<typeof refundReasonSchema>\n\nexport const refundStatusSchema = z.enum([\n  'pending',\n  'awaiting_signature',\n  'submitted',\n  'completed',\n  'failed',\n  'cancelled',\n])\nexport type RefundStatus = z.infer<typeof refundStatusSchema>\n\nexport const refundSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).nullable(),\n  status: refundStatusSchema,\n  payerAddress: evmAddressSchema,\n  refundTxHash: evmTxHashSchema.nullable(),\n  failureReason: z.string().max(500).nullable(),\n  initiatedBy: idSchema,\n  createdAt: isoTimestampSchema,\n  completedAt: isoTimestampSchema.nullable(),\n})\nexport type Refund = z.infer<typeof refundSchema>\n\nexport const createRefundInputSchema = z.object({\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).optional(),\n})\nexport type CreateRefundInput = z.infer<typeof createRefundInputSchema>\n\nexport const submitRefundSignatureInputSchema = z.object({\n  id: idSchema,\n  refundTxHash: evmTxHashSchema,\n})\nexport type SubmitRefundSignatureInput = z.infer<typeof submitRefundSignatureInputSchema>\n\n/**\n * Response envelope for `POST /v1/refunds`. The API returns the newly\n * created refund plus the concrete ERC-20 transfer the merchant now\n * has to sign from their payout wallet.\n */\nexport const refundSigningInstructionsSchema = z.object({\n  token: evmAddressSchema,\n  to: evmAddressSchema,\n  amount: tokenAmountSchema,\n  note: z.string(),\n})\nexport type RefundSigningInstructions = z.infer<typeof refundSigningInstructionsSchema>\n\nexport const refundCreateOutputSchema = z.object({\n  refund: refundSchema,\n  signingInstructions: refundSigningInstructionsSchema,\n})\nexport type RefundCreateOutput = z.infer<typeof refundCreateOutputSchema>\n"]}

package/dist/refunds.d.cts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 
 /**
- * Refund — a merchant-initiated return of funds to a payer.
+ * Refund. A merchant-initiated return of funds to a payer.
  *
  * Refunds are executed off-chain (from the merchant's wallet to the payer's
  * wallet). Strimz records the intent, validates constraints, and reconciles
@@ -87,5 +87,138 @@ declare const submitRefundSignatureInputSchema: z.ZodObject<{
     refundTxHash: string;
 }>;
 type SubmitRefundSignatureInput = z.infer<typeof submitRefundSignatureInputSchema>;
+/**
+ * Response envelope for `POST /v1/refunds`. The API returns the newly
+ * created refund plus the concrete ERC-20 transfer the merchant now
+ * has to sign from their payout wallet.
+ */
+declare const refundSigningInstructionsSchema: z.ZodObject<{
+    token: z.ZodEffects<z.ZodString, string, string>;
+    to: z.ZodEffects<z.ZodString, string, string>;
+    amount: z.ZodEffects<z.ZodString, string, string>;
+    note: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    amount: string;
+    note: string;
+    token: string;
+    to: string;
+}, {
+    amount: string;
+    note: string;
+    token: string;
+    to: string;
+}>;
+type RefundSigningInstructions = z.infer<typeof refundSigningInstructionsSchema>;
+declare const refundCreateOutputSchema: z.ZodObject<{
+    refund: z.ZodObject<{
+        id: z.ZodString;
+        merchantId: z.ZodString;
+        transactionId: z.ZodString;
+        amount: z.ZodEffects<z.ZodString, string, string>;
+        currency: z.ZodEnum<["USDC", "EURC"]>;
+        reason: z.ZodEnum<["customer_request", "product_issue", "duplicate_charge", "fraudulent", "other"]>;
+        note: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<["pending", "awaiting_signature", "submitted", "completed", "failed", "cancelled"]>;
+        payerAddress: z.ZodEffects<z.ZodString, string, string>;
+        refundTxHash: z.ZodNullable<z.ZodString>;
+        failureReason: z.ZodNullable<z.ZodString>;
+        initiatedBy: z.ZodString;
+        createdAt: z.ZodString;
+        completedAt: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    }, {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    }>;
+    signingInstructions: z.ZodObject<{
+        token: z.ZodEffects<z.ZodString, string, string>;
+        to: z.ZodEffects<z.ZodString, string, string>;
+        amount: z.ZodEffects<z.ZodString, string, string>;
+        note: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    }, {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    refund: {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    };
+    signingInstructions: {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    };
+}, {
+    refund: {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    };
+    signingInstructions: {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    };
+}>;
+type RefundCreateOutput = z.infer<typeof refundCreateOutputSchema>;
 
-export { type CreateRefundInput, type Refund, type RefundReason, type RefundStatus, type SubmitRefundSignatureInput, createRefundInputSchema, refundReasonSchema, refundSchema, refundStatusSchema, submitRefundSignatureInputSchema };
+export { type CreateRefundInput, type Refund, type RefundCreateOutput, type RefundReason, type RefundSigningInstructions, type RefundStatus, type SubmitRefundSignatureInput, createRefundInputSchema, refundCreateOutputSchema, refundReasonSchema, refundSchema, refundSigningInstructionsSchema, refundStatusSchema, submitRefundSignatureInputSchema };

package/dist/refunds.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 
 /**
- * Refund — a merchant-initiated return of funds to a payer.
+ * Refund. A merchant-initiated return of funds to a payer.
  *
  * Refunds are executed off-chain (from the merchant's wallet to the payer's
  * wallet). Strimz records the intent, validates constraints, and reconciles
@@ -87,5 +87,138 @@ declare const submitRefundSignatureInputSchema: z.ZodObject<{
     refundTxHash: string;
 }>;
 type SubmitRefundSignatureInput = z.infer<typeof submitRefundSignatureInputSchema>;
+/**
+ * Response envelope for `POST /v1/refunds`. The API returns the newly
+ * created refund plus the concrete ERC-20 transfer the merchant now
+ * has to sign from their payout wallet.
+ */
+declare const refundSigningInstructionsSchema: z.ZodObject<{
+    token: z.ZodEffects<z.ZodString, string, string>;
+    to: z.ZodEffects<z.ZodString, string, string>;
+    amount: z.ZodEffects<z.ZodString, string, string>;
+    note: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    amount: string;
+    note: string;
+    token: string;
+    to: string;
+}, {
+    amount: string;
+    note: string;
+    token: string;
+    to: string;
+}>;
+type RefundSigningInstructions = z.infer<typeof refundSigningInstructionsSchema>;
+declare const refundCreateOutputSchema: z.ZodObject<{
+    refund: z.ZodObject<{
+        id: z.ZodString;
+        merchantId: z.ZodString;
+        transactionId: z.ZodString;
+        amount: z.ZodEffects<z.ZodString, string, string>;
+        currency: z.ZodEnum<["USDC", "EURC"]>;
+        reason: z.ZodEnum<["customer_request", "product_issue", "duplicate_charge", "fraudulent", "other"]>;
+        note: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<["pending", "awaiting_signature", "submitted", "completed", "failed", "cancelled"]>;
+        payerAddress: z.ZodEffects<z.ZodString, string, string>;
+        refundTxHash: z.ZodNullable<z.ZodString>;
+        failureReason: z.ZodNullable<z.ZodString>;
+        initiatedBy: z.ZodString;
+        createdAt: z.ZodString;
+        completedAt: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    }, {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    }>;
+    signingInstructions: z.ZodObject<{
+        token: z.ZodEffects<z.ZodString, string, string>;
+        to: z.ZodEffects<z.ZodString, string, string>;
+        amount: z.ZodEffects<z.ZodString, string, string>;
+        note: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    }, {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    refund: {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    };
+    signingInstructions: {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    };
+}, {
+    refund: {
+        status: "submitted" | "failed" | "cancelled" | "pending" | "awaiting_signature" | "completed";
+        id: string;
+        merchantId: string;
+        createdAt: string;
+        amount: string;
+        currency: "USDC" | "EURC";
+        payerAddress: string;
+        reason: "customer_request" | "product_issue" | "duplicate_charge" | "fraudulent" | "other";
+        failureReason: string | null;
+        transactionId: string;
+        note: string | null;
+        refundTxHash: string | null;
+        initiatedBy: string;
+        completedAt: string | null;
+    };
+    signingInstructions: {
+        amount: string;
+        note: string;
+        token: string;
+        to: string;
+    };
+}>;
+type RefundCreateOutput = z.infer<typeof refundCreateOutputSchema>;
 
-export { type CreateRefundInput, type Refund, type RefundReason, type RefundStatus, type SubmitRefundSignatureInput, createRefundInputSchema, refundReasonSchema, refundSchema, refundStatusSchema, submitRefundSignatureInputSchema };
+export { type CreateRefundInput, type Refund, type RefundCreateOutput, type RefundReason, type RefundSigningInstructions, type RefundStatus, type SubmitRefundSignatureInput, createRefundInputSchema, refundCreateOutputSchema, refundReasonSchema, refundSchema, refundSigningInstructionsSchema, refundStatusSchema, submitRefundSignatureInputSchema };

package/dist/refunds.js

@@ -69,7 +69,17 @@ var submitRefundSignatureInputSchema = z.object({
   id: idSchema,
   refundTxHash: evmTxHashSchema
 });
+var refundSigningInstructionsSchema = z.object({
+  token: evmAddressSchema,
+  to: evmAddressSchema,
+  amount: tokenAmountSchema,
+  note: z.string()
+});
+var refundCreateOutputSchema = z.object({
+  refund: refundSchema,
+  signingInstructions: refundSigningInstructionsSchema
+});
 
-export { createRefundInputSchema, refundReasonSchema, refundSchema, refundStatusSchema, submitRefundSignatureInputSchema };
+export { createRefundInputSchema, refundCreateOutputSchema, refundReasonSchema, refundSchema, refundSigningInstructionsSchema, refundStatusSchema, submitRefundSignatureInputSchema };
 //# sourceMappingURL=refunds.js.map
 //# sourceMappingURL=refunds.js.map

package/dist/refunds.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common.ts","../src/refunds.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkB,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlE,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5C,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoB,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6B,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9B,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACtF1D,IAAM,kBAAA,GAAqBA,EAAE,IAAA,CAAK;AAAA,EACvC,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kBAAA,GAAqBA,EAAE,IAAA,CAAK;AAAA,EACvC,SAAA;AAAA,EACA,oBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,YAAA,GAAeA,EAAE,MAAA,CAAO;AAAA,EACnC,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EACnC,MAAA,EAAQ,kBAAA;AAAA,EACR,YAAA,EAAc,gBAAA;AAAA,EACd,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,eAAeA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC5C,WAAA,EAAa,QAAA;AAAA,EACb,SAAA,EAAW,kBAAA;AAAA,EACX,WAAA,EAAa,mBAAmB,QAAA;AAClC,CAAC;AAGM,IAAM,uBAAA,GAA0BA,EAAE,MAAA,CAAO;AAAA,EAC9C,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAC5B,CAAC;AAGM,IAAM,gCAAA,GAAmCA,EAAE,MAAA,CAAO;AAAA,EACvD,EAAA,EAAI,QAAA;AAAA,EACJ,YAAA,EAAc;AAChB,CAAC","file":"refunds.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum — mirrors `@strimz/shared-config`. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum — mirrors `@strimz/shared-config`. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Refund — a merchant-initiated return of funds to a payer.\n *\n * Refunds are executed off-chain (from the merchant's wallet to the payer's\n * wallet). Strimz records the intent, validates constraints, and reconciles\n * via the merchant-signed on-chain transfer.\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const refundReasonSchema = z.enum([\n  'customer_request',\n  'product_issue',\n  'duplicate_charge',\n  'fraudulent',\n  'other',\n])\nexport type RefundReason = z.infer<typeof refundReasonSchema>\n\nexport const refundStatusSchema = z.enum([\n  'pending',\n  'awaiting_signature',\n  'submitted',\n  'completed',\n  'failed',\n  'cancelled',\n])\nexport type RefundStatus = z.infer<typeof refundStatusSchema>\n\nexport const refundSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).nullable(),\n  status: refundStatusSchema,\n  payerAddress: evmAddressSchema,\n  refundTxHash: evmTxHashSchema.nullable(),\n  failureReason: z.string().max(500).nullable(),\n  initiatedBy: idSchema,\n  createdAt: isoTimestampSchema,\n  completedAt: isoTimestampSchema.nullable(),\n})\nexport type Refund = z.infer<typeof refundSchema>\n\nexport const createRefundInputSchema = z.object({\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).optional(),\n})\nexport type CreateRefundInput = z.infer<typeof createRefundInputSchema>\n\nexport const submitRefundSignatureInputSchema = z.object({\n  id: idSchema,\n  refundTxHash: evmTxHashSchema,\n})\nexport type SubmitRefundSignatureInput = z.infer<typeof submitRefundSignatureInputSchema>\n"]}
+{"version":3,"sources":["../src/common.ts","../src/refunds.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAG3C,IAAM,gBAAA,GAAmB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA;AAG5B,IAAM,kBAAkB,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D,CAAA;AAGlE,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAG5C,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOjC,IAAM,iBAAA,GAAoB,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc,CAAA;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6B,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI1C,IAAM,wBAAwB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9B,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACtF1D,IAAM,kBAAA,GAAqBA,EAAE,IAAA,CAAK;AAAA,EACvC,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kBAAA,GAAqBA,EAAE,IAAA,CAAK;AAAA,EACvC,SAAA;AAAA,EACA,oBAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,YAAA,GAAeA,EAAE,MAAA,CAAO;AAAA,EACnC,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,QAAA,EAAU,qBAAA;AAAA,EACV,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EACnC,MAAA,EAAQ,kBAAA;AAAA,EACR,YAAA,EAAc,gBAAA;AAAA,EACd,YAAA,EAAc,gBAAgB,QAAA,EAAS;AAAA,EACvC,eAAeA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC5C,WAAA,EAAa,QAAA;AAAA,EACb,SAAA,EAAW,kBAAA;AAAA,EACX,WAAA,EAAa,mBAAmB,QAAA;AAClC,CAAC;AAGM,IAAM,uBAAA,GAA0BA,EAAE,MAAA,CAAO;AAAA,EAC9C,aAAA,EAAe,QAAA;AAAA,EACf,MAAA,EAAQ,iBAAA;AAAA,EACR,MAAA,EAAQ,kBAAA;AAAA,EACR,MAAMA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAC5B,CAAC;AAGM,IAAM,gCAAA,GAAmCA,EAAE,MAAA,CAAO;AAAA,EACvD,EAAA,EAAI,QAAA;AAAA,EACJ,YAAA,EAAc;AAChB,CAAC;AAQM,IAAM,+BAAA,GAAkCA,EAAE,MAAA,CAAO;AAAA,EACtD,KAAA,EAAO,gBAAA;AAAA,EACP,EAAA,EAAI,gBAAA;AAAA,EACJ,MAAA,EAAQ,iBAAA;AAAA,EACR,IAAA,EAAMA,EAAE,MAAA;AACV,CAAC;AAGM,IAAM,wBAAA,GAA2BA,EAAE,MAAA,CAAO;AAAA,EAC/C,MAAA,EAAQ,YAAA;AAAA,EACR,mBAAA,EAAqB;AACvB,CAAC","file":"refunds.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Refund. A merchant-initiated return of funds to a payer.\n *\n * Refunds are executed off-chain (from the merchant's wallet to the payer's\n * wallet). Strimz records the intent, validates constraints, and reconciles\n * via the merchant-signed on-chain transfer.\n */\n\nimport { z } from 'zod'\nimport {\n  evmAddressSchema,\n  evmTxHashSchema,\n  idSchema,\n  isoTimestampSchema,\n  paymentCurrencySchema,\n  tokenAmountSchema,\n} from './common.js'\n\nexport const refundReasonSchema = z.enum([\n  'customer_request',\n  'product_issue',\n  'duplicate_charge',\n  'fraudulent',\n  'other',\n])\nexport type RefundReason = z.infer<typeof refundReasonSchema>\n\nexport const refundStatusSchema = z.enum([\n  'pending',\n  'awaiting_signature',\n  'submitted',\n  'completed',\n  'failed',\n  'cancelled',\n])\nexport type RefundStatus = z.infer<typeof refundStatusSchema>\n\nexport const refundSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  currency: paymentCurrencySchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).nullable(),\n  status: refundStatusSchema,\n  payerAddress: evmAddressSchema,\n  refundTxHash: evmTxHashSchema.nullable(),\n  failureReason: z.string().max(500).nullable(),\n  initiatedBy: idSchema,\n  createdAt: isoTimestampSchema,\n  completedAt: isoTimestampSchema.nullable(),\n})\nexport type Refund = z.infer<typeof refundSchema>\n\nexport const createRefundInputSchema = z.object({\n  transactionId: idSchema,\n  amount: tokenAmountSchema,\n  reason: refundReasonSchema,\n  note: z.string().max(500).optional(),\n})\nexport type CreateRefundInput = z.infer<typeof createRefundInputSchema>\n\nexport const submitRefundSignatureInputSchema = z.object({\n  id: idSchema,\n  refundTxHash: evmTxHashSchema,\n})\nexport type SubmitRefundSignatureInput = z.infer<typeof submitRefundSignatureInputSchema>\n\n/**\n * Response envelope for `POST /v1/refunds`. The API returns the newly\n * created refund plus the concrete ERC-20 transfer the merchant now\n * has to sign from their payout wallet.\n */\nexport const refundSigningInstructionsSchema = z.object({\n  token: evmAddressSchema,\n  to: evmAddressSchema,\n  amount: tokenAmountSchema,\n  note: z.string(),\n})\nexport type RefundSigningInstructions = z.infer<typeof refundSigningInstructionsSchema>\n\nexport const refundCreateOutputSchema = z.object({\n  refund: refundSchema,\n  signingInstructions: refundSigningInstructionsSchema,\n})\nexport type RefundCreateOutput = z.infer<typeof refundCreateOutputSchema>\n"]}

package/dist/storefronts.cjs

@@ -42,12 +42,12 @@ zod.z.object({
   /**
    * On-chain StrimzRegistry merchant id (uint96) as a decimal string.
    * See `paymentSessionSchema.chainMerchantId`. Null when the merchant
-   * hasn't been registered on-chain yet — the hosted enrolment page
+   * hasn't been registered on-chain yet. The hosted enrolment page
    * refuses to take signatures in that state.
    */
   chainMerchantId: zod.z.string().regex(/^[0-9]+$/u, "must be a non-negative decimal integer string").nullable(),
   /**
-   * ERC-20 token contract address resolved from `currency` — the
+   * ERC-20 token contract address resolved from `currency`. This is the
    * EIP-2612 `verifyingContract` the wallet signs over.
    */
   tokenAddress: evmAddressSchema.nullable(),
@@ -212,9 +212,23 @@ var createStorefrontProductInputSchema = storefrontProductSchema.omit({
 }).extend({
   imageUrl: httpsUrlSchema.optional()
 });
+var storefrontCheckoutInputSchema = zod.z.object({
+  customerEmail: zod.z.string().email().optional(),
+  returnPath: zod.z.string().max(200).optional()
+});
+var storefrontCheckoutResponseSchema = zod.z.object({
+  /** Fully-qualified checkout URL — payer redirects here to sign. */
+  checkoutUrl: zod.z.string().url(),
+  /** Payment-session id (one-time) or plan id (subscription). */
+  ref: idSchema,
+  /** Which downstream checkout the URL points at. */
+  kind: zod.z.enum(["payment_session", "subscription_plan"])
+});
 
 exports.createStorefrontInputSchema = createStorefrontInputSchema;
 exports.createStorefrontProductInputSchema = createStorefrontProductInputSchema;
+exports.storefrontCheckoutInputSchema = storefrontCheckoutInputSchema;
+exports.storefrontCheckoutResponseSchema = storefrontCheckoutResponseSchema;
 exports.storefrontProductSchema = storefrontProductSchema;
 exports.storefrontProductTypeSchema = storefrontProductTypeSchema;
 exports.storefrontSchema = storefrontSchema;