@strimz/shared-types 0.1.1 → 0.2.0

package/dist/webhooks.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common.ts","../src/webhooks.ts"],"names":["z"],"mappings":";;;;;AAQO,IAAM,QAAA,GAAWA,KAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAGlBA,KAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa;AAGJA,KAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D;AAGlEA,KAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAGnE,IAAM,cAAA,GAAiBA,KAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC,CAAA;AAG0BA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOPA,KAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc;AAGtBA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqBA,KAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrCA,MAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5BA,MAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6BA,KAAA,CAC3B,MAAA;AAAA,EACCA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxBA,MAAE,KAAA,CAAM,CAACA,MAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAGA,KAAA,CAAE,MAAA,IAAUA,KAAA,CAAE,OAAA,IAAWA,KAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGN,IAAM,aAAaA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAIZA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI3BA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9BA,MAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjDA,KAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACvF1D,IAAM,sBAAA,GAAyBA,MAAE,IAAA,CAAK;AAAA,EAC3C,iBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,sBAAA;AAAA,EACA,sBAAA;AAAA,EACA,4BAAA;AAAA,EACA,+BAAA;AAAA,EACA,+BAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,iBAAA;AAAA,EACA,uBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,8BAA8BA,KAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,UAAU,CAAC;AAGjE,IAAM,qBAAA,GAAwBA,MAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,IAAA,EAAM,UAAA;AAAA,EACN,GAAA,EAAK,cAAA;AAAA,EACL,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,MAAA,EAAQ,2BAAA;AAAA,EACR,mBAAA,EAAqBA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EAC7C,eAAA,EAAiB,mBAAmB,QAAA,EAAS;AAAA,EAC7C,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAGM,IAAM,gCAAA,GAAmCA,MAAE,MAAA,CAAO;AAAA,EACvD,GAAA,EAAK,cAAA;AAAA,EACL,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,IAAA,EAAM;AACR,CAAC;AAGM,IAAM,iCAAA,GAAoCA,MAAE,MAAA,CAAO;AAAA,EACxD,QAAA,EAAU,qBAAA;AAAA;AAAA,EAEV,aAAA,EAAeA,MAAE,MAAA;AACnB,CAAC;AAKM,IAAM,2BAAA,GAA8BA,MAAE,IAAA,CAAK;AAAA,EAChD,SAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAA,GAAwBA,MAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,UAAA,EAAY,QAAA;AAAA,EACZ,OAAA,EAAS,QAAA;AAAA,EACT,SAAA,EAAW,sBAAA;AAAA,EACX,MAAA,EAAQ,2BAAA;AAAA,EACR,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtC,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,UAAA,EAAYA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC7C,WAAWA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAI,EAAE,QAAA,EAAS;AAAA,EACzC,aAAA,EAAe,mBAAmB,QAAA,EAAS;AAAA,EAC3C,WAAA,EAAa,mBAAmB,QAAA,EAAS;AAAA,EACzC,SAAA,EAAW;AACb,CAAC;AAGM,IAAM,yBAAA,GAA4BA,MAAE,MAAA,CAAO;AAAA,EAChD,EAAA,EAAI;AACN,CAAC","file":"webhooks.cjs","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Webhook endpoints and deliveries.\n *\n * Endpoint = the URL the merchant registered.\n * Event    = the thing that happened.\n * Delivery = one attempt to POST a specific event to a specific endpoint.\n */\n\nimport { z } from 'zod'\nimport { httpsUrlSchema, idSchema, isoTimestampSchema, modeSchema } from './common.js'\n\n// ---------- Event name ----------\n\n/**\n * Every webhook event name in the system. Listed inline so Zod can\n * produce a concrete string union.\n */\nexport const webhookEventNameSchema = z.enum([\n  'payment.created',\n  'payment.completed',\n  'payment.failed',\n  'subscription.created',\n  'subscription.charged',\n  'subscription.charge_failed',\n  'subscription.recovery_attempt',\n  'subscription.recovery_outcome',\n  'subscription.cancelled',\n  'subscription.lapsed',\n  'refund.created',\n  'refund.completed',\n  'refund.failed',\n  'invoice.created',\n  'invoice.paid',\n  'invoice.overdue',\n  'agent.action_executed',\n  'agent.job_proposed',\n  'agent.job_completed',\n  'agent.job_disputed',\n  'compliance.wallet_flagged',\n  'compliance.wallet_blocked',\n])\nexport type WebhookEventName = z.infer<typeof webhookEventNameSchema>\n\n// ---------- Endpoints ----------\n\nexport const webhookEndpointStatusSchema = z.enum(['active', 'disabled'])\nexport type WebhookEndpointStatus = z.infer<typeof webhookEndpointStatusSchema>\n\nexport const webhookEndpointSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  mode: modeSchema,\n  url: httpsUrlSchema,\n  description: z.string().max(200).nullable(),\n  events: z.array(webhookEventNameSchema).nonempty(),\n  status: webhookEndpointStatusSchema,\n  signingSecretPrefix: z.string().min(4).max(12),\n  lastDeliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type WebhookEndpoint = z.infer<typeof webhookEndpointSchema>\n\nexport const createWebhookEndpointInputSchema = z.object({\n  url: httpsUrlSchema,\n  events: z.array(webhookEventNameSchema).nonempty(),\n  description: z.string().max(200).optional(),\n  mode: modeSchema,\n})\nexport type CreateWebhookEndpointInput = z.infer<typeof createWebhookEndpointInputSchema>\n\nexport const createWebhookEndpointOutputSchema = z.object({\n  endpoint: webhookEndpointSchema,\n  /** Full signing secret. Shown exactly once. */\n  signingSecret: z.string(),\n})\nexport type CreateWebhookEndpointOutput = z.infer<typeof createWebhookEndpointOutputSchema>\n\n// ---------- Deliveries ----------\n\nexport const webhookDeliveryStatusSchema = z.enum([\n  'pending',\n  'delivered',\n  'retrying',\n  'permanently_failed',\n])\nexport type WebhookDeliveryStatus = z.infer<typeof webhookDeliveryStatusSchema>\n\nexport const webhookDeliverySchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  endpointId: idSchema,\n  eventId: idSchema,\n  eventName: webhookEventNameSchema,\n  status: webhookDeliveryStatusSchema,\n  attempt: z.number().int().min(1).max(6),\n  responseCode: z.number().int().min(100).max(599).nullable(),\n  responseMs: z.number().int().min(0).nullable(),\n  lastError: z.string().max(1000).nullable(),\n  nextAttemptAt: isoTimestampSchema.nullable(),\n  deliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n})\nexport type WebhookDelivery = z.infer<typeof webhookDeliverySchema>\n\nexport const replayDeliveryInputSchema = z.object({\n  id: idSchema,\n})\nexport type ReplayDeliveryInput = z.infer<typeof replayDeliveryInputSchema>\n"]}
+{"version":3,"sources":["../src/common.ts","../src/webhooks.ts"],"names":["z"],"mappings":";;;;;AAQO,IAAM,QAAA,GAAWA,KAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAGlBA,KAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa;AAGJA,KAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D;AAGlEA,KAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAGnE,IAAM,cAAA,GAAiBA,KAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC,CAAA;AAG0BA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOPA,KAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc;AAGtBA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqBA,KAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrCA,MAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5BA,MAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6BA,KAAA,CAC3B,MAAA;AAAA,EACCA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxBA,MAAE,KAAA,CAAM,CAACA,MAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAGA,KAAA,CAAE,MAAA,IAAUA,KAAA,CAAE,OAAA,IAAWA,KAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGN,IAAM,aAAaA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAIZA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI3BA,KAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9BA,MAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjDA,KAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACvF1D,IAAM,sBAAA,GAAyBA,MAAE,IAAA,CAAK;AAAA,EAC3C,iBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,sBAAA;AAAA,EACA,sBAAA;AAAA,EACA,4BAAA;AAAA,EACA,+BAAA;AAAA,EACA,+BAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,iBAAA;AAAA,EACA,uBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,8BAA8BA,KAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,UAAU,CAAC;AAGjE,IAAM,qBAAA,GAAwBA,MAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,IAAA,EAAM,UAAA;AAAA,EACN,GAAA,EAAK,cAAA;AAAA,EACL,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,MAAA,EAAQ,2BAAA;AAAA,EACR,mBAAA,EAAqBA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EAC7C,eAAA,EAAiB,mBAAmB,QAAA,EAAS;AAAA,EAC7C,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAGM,IAAM,gCAAA,GAAmCA,MAAE,MAAA,CAAO;AAAA,EACvD,GAAA,EAAK,cAAA;AAAA,EACL,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,aAAaA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,IAAA,EAAM;AACR,CAAC;AAGM,IAAM,iCAAA,GAAoCA,MAAE,MAAA,CAAO;AAAA,EACxD,QAAA,EAAU,qBAAA;AAAA;AAAA,EAEV,aAAA,EAAeA,MAAE,MAAA;AACnB,CAAC;AAKM,IAAM,2BAAA,GAA8BA,MAAE,IAAA,CAAK;AAAA,EAChD,SAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAA,GAAwBA,MAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,UAAA,EAAY,QAAA;AAAA,EACZ,OAAA,EAAS,QAAA;AAAA,EACT,SAAA,EAAW,sBAAA;AAAA,EACX,MAAA,EAAQ,2BAAA;AAAA,EACR,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtC,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,UAAA,EAAYA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC7C,WAAWA,KAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAI,EAAE,QAAA,EAAS;AAAA,EACzC,aAAA,EAAe,mBAAmB,QAAA,EAAS;AAAA,EAC3C,WAAA,EAAa,mBAAmB,QAAA,EAAS;AAAA,EACzC,SAAA,EAAW;AACb,CAAC;AAQM,IAAM,2BAAA,GAA8B,sBAAsB,MAAA,CAAO;AAAA,EACtE,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,cAAA,EAAgBA,MAAE,MAAA,CAAOA,KAAAA,CAAE,QAAO,EAAGA,KAAAA,CAAE,SAAS;AAClD,CAAC;AAGM,IAAM,yBAAA,GAA4BA,MAAE,MAAA,CAAO;AAAA,EAChD,EAAA,EAAI;AACN,CAAC","file":"webhooks.cjs","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Webhook endpoints and deliveries.\n *\n * Endpoint = the URL the merchant registered.\n * Event    = the thing that happened.\n * Delivery = one attempt to POST a specific event to a specific endpoint.\n */\n\nimport { z } from 'zod'\nimport { httpsUrlSchema, idSchema, isoTimestampSchema, modeSchema } from './common.js'\n\n// ---------- Event name ----------\n\n/**\n * Every webhook event name in the system. Listed inline so Zod can\n * produce a concrete string union.\n */\nexport const webhookEventNameSchema = z.enum([\n  'payment.created',\n  'payment.completed',\n  'payment.failed',\n  'subscription.created',\n  'subscription.charged',\n  'subscription.charge_failed',\n  'subscription.recovery_attempt',\n  'subscription.recovery_outcome',\n  'subscription.cancelled',\n  'subscription.lapsed',\n  'refund.created',\n  'refund.completed',\n  'refund.failed',\n  'invoice.created',\n  'invoice.paid',\n  'invoice.overdue',\n  'agent.action_executed',\n  'agent.job_proposed',\n  'agent.job_completed',\n  'agent.job_disputed',\n  'compliance.wallet_flagged',\n  'compliance.wallet_blocked',\n])\nexport type WebhookEventName = z.infer<typeof webhookEventNameSchema>\n\n// ---------- Endpoints ----------\n\nexport const webhookEndpointStatusSchema = z.enum(['active', 'disabled'])\nexport type WebhookEndpointStatus = z.infer<typeof webhookEndpointStatusSchema>\n\nexport const webhookEndpointSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  mode: modeSchema,\n  url: httpsUrlSchema,\n  description: z.string().max(200).nullable(),\n  events: z.array(webhookEventNameSchema).nonempty(),\n  status: webhookEndpointStatusSchema,\n  signingSecretPrefix: z.string().min(4).max(12),\n  lastDeliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type WebhookEndpoint = z.infer<typeof webhookEndpointSchema>\n\nexport const createWebhookEndpointInputSchema = z.object({\n  url: httpsUrlSchema,\n  events: z.array(webhookEventNameSchema).nonempty(),\n  description: z.string().max(200).optional(),\n  mode: modeSchema,\n})\nexport type CreateWebhookEndpointInput = z.infer<typeof createWebhookEndpointInputSchema>\n\nexport const createWebhookEndpointOutputSchema = z.object({\n  endpoint: webhookEndpointSchema,\n  /** Full signing secret. Shown exactly once. */\n  signingSecret: z.string(),\n})\nexport type CreateWebhookEndpointOutput = z.infer<typeof createWebhookEndpointOutputSchema>\n\n// ---------- Deliveries ----------\n\nexport const webhookDeliveryStatusSchema = z.enum([\n  'pending',\n  'delivered',\n  'retrying',\n  'permanently_failed',\n])\nexport type WebhookDeliveryStatus = z.infer<typeof webhookDeliveryStatusSchema>\n\nexport const webhookDeliverySchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  endpointId: idSchema,\n  eventId: idSchema,\n  eventName: webhookEventNameSchema,\n  status: webhookDeliveryStatusSchema,\n  attempt: z.number().int().min(1).max(6),\n  responseCode: z.number().int().min(100).max(599).nullable(),\n  responseMs: z.number().int().min(0).nullable(),\n  lastError: z.string().max(1000).nullable(),\n  nextAttemptAt: isoTimestampSchema.nullable(),\n  deliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n})\nexport type WebhookDelivery = z.infer<typeof webhookDeliverySchema>\n\n/**\n * Detail projection returned by GET /v1/webhook-deliveries/:id.\n * Carries the payload envelope, response body, and the deliveryId\n * header the receiver saw. Kept separate so list responses stay slim.\n */\nexport const webhookDeliveryDetailSchema = webhookDeliverySchema.extend({\n  deliveryId: z.string(),\n  responseBody: z.string().nullable(),\n  requestPayload: z.record(z.string(), z.unknown()),\n})\nexport type WebhookDeliveryDetail = z.infer<typeof webhookDeliveryDetailSchema>\n\nexport const replayDeliveryInputSchema = z.object({\n  id: idSchema,\n})\nexport type ReplayDeliveryInput = z.infer<typeof replayDeliveryInputSchema>\n"]}

package/dist/webhooks.d.cts

@@ -189,6 +189,65 @@ declare const webhookDeliverySchema: z.ZodObject<{
     deliveredAt: string | null;
 }>;
 type WebhookDelivery = z.infer<typeof webhookDeliverySchema>;
+/**
+ * Detail projection returned by GET /v1/webhook-deliveries/:id.
+ * Carries the payload envelope, response body, and the deliveryId
+ * header the receiver saw. Kept separate so list responses stay slim.
+ */
+declare const webhookDeliveryDetailSchema: z.ZodObject<{
+    id: z.ZodString;
+    merchantId: z.ZodString;
+    endpointId: z.ZodString;
+    eventId: z.ZodString;
+    eventName: z.ZodEnum<["payment.created", "payment.completed", "payment.failed", "subscription.created", "subscription.charged", "subscription.charge_failed", "subscription.recovery_attempt", "subscription.recovery_outcome", "subscription.cancelled", "subscription.lapsed", "refund.created", "refund.completed", "refund.failed", "invoice.created", "invoice.paid", "invoice.overdue", "agent.action_executed", "agent.job_proposed", "agent.job_completed", "agent.job_disputed", "compliance.wallet_flagged", "compliance.wallet_blocked"]>;
+    status: z.ZodEnum<["pending", "delivered", "retrying", "permanently_failed"]>;
+    attempt: z.ZodNumber;
+    responseCode: z.ZodNullable<z.ZodNumber>;
+    responseMs: z.ZodNullable<z.ZodNumber>;
+    lastError: z.ZodNullable<z.ZodString>;
+    nextAttemptAt: z.ZodNullable<z.ZodString>;
+    deliveredAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+} & {
+    deliveryId: z.ZodString;
+    responseBody: z.ZodNullable<z.ZodString>;
+    requestPayload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    status: "pending" | "retrying" | "delivered" | "permanently_failed";
+    id: string;
+    merchantId: string;
+    createdAt: string;
+    endpointId: string;
+    eventId: string;
+    eventName: "payment.created" | "payment.completed" | "payment.failed" | "subscription.created" | "subscription.charged" | "subscription.charge_failed" | "subscription.recovery_attempt" | "subscription.recovery_outcome" | "subscription.cancelled" | "subscription.lapsed" | "refund.created" | "refund.completed" | "refund.failed" | "invoice.created" | "invoice.paid" | "invoice.overdue" | "agent.action_executed" | "agent.job_proposed" | "agent.job_completed" | "agent.job_disputed" | "compliance.wallet_flagged" | "compliance.wallet_blocked";
+    attempt: number;
+    responseCode: number | null;
+    responseMs: number | null;
+    lastError: string | null;
+    nextAttemptAt: string | null;
+    deliveredAt: string | null;
+    deliveryId: string;
+    responseBody: string | null;
+    requestPayload: Record<string, unknown>;
+}, {
+    status: "pending" | "retrying" | "delivered" | "permanently_failed";
+    id: string;
+    merchantId: string;
+    createdAt: string;
+    endpointId: string;
+    eventId: string;
+    eventName: "payment.created" | "payment.completed" | "payment.failed" | "subscription.created" | "subscription.charged" | "subscription.charge_failed" | "subscription.recovery_attempt" | "subscription.recovery_outcome" | "subscription.cancelled" | "subscription.lapsed" | "refund.created" | "refund.completed" | "refund.failed" | "invoice.created" | "invoice.paid" | "invoice.overdue" | "agent.action_executed" | "agent.job_proposed" | "agent.job_completed" | "agent.job_disputed" | "compliance.wallet_flagged" | "compliance.wallet_blocked";
+    attempt: number;
+    responseCode: number | null;
+    responseMs: number | null;
+    lastError: string | null;
+    nextAttemptAt: string | null;
+    deliveredAt: string | null;
+    deliveryId: string;
+    responseBody: string | null;
+    requestPayload: Record<string, unknown>;
+}>;
+type WebhookDeliveryDetail = z.infer<typeof webhookDeliveryDetailSchema>;
 declare const replayDeliveryInputSchema: z.ZodObject<{
     id: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -198,4 +257,4 @@ declare const replayDeliveryInputSchema: z.ZodObject<{
 }>;
 type ReplayDeliveryInput = z.infer<typeof replayDeliveryInputSchema>;
 
-export { type CreateWebhookEndpointInput, type CreateWebhookEndpointOutput, type ReplayDeliveryInput, type WebhookDelivery, type WebhookDeliveryStatus, type WebhookEndpoint, type WebhookEndpointStatus, type WebhookEventName, createWebhookEndpointInputSchema, createWebhookEndpointOutputSchema, replayDeliveryInputSchema, webhookDeliverySchema, webhookDeliveryStatusSchema, webhookEndpointSchema, webhookEndpointStatusSchema, webhookEventNameSchema };
+export { type CreateWebhookEndpointInput, type CreateWebhookEndpointOutput, type ReplayDeliveryInput, type WebhookDelivery, type WebhookDeliveryDetail, type WebhookDeliveryStatus, type WebhookEndpoint, type WebhookEndpointStatus, type WebhookEventName, createWebhookEndpointInputSchema, createWebhookEndpointOutputSchema, replayDeliveryInputSchema, webhookDeliveryDetailSchema, webhookDeliverySchema, webhookDeliveryStatusSchema, webhookEndpointSchema, webhookEndpointStatusSchema, webhookEventNameSchema };

package/dist/webhooks.d.ts

@@ -189,6 +189,65 @@ declare const webhookDeliverySchema: z.ZodObject<{
     deliveredAt: string | null;
 }>;
 type WebhookDelivery = z.infer<typeof webhookDeliverySchema>;
+/**
+ * Detail projection returned by GET /v1/webhook-deliveries/:id.
+ * Carries the payload envelope, response body, and the deliveryId
+ * header the receiver saw. Kept separate so list responses stay slim.
+ */
+declare const webhookDeliveryDetailSchema: z.ZodObject<{
+    id: z.ZodString;
+    merchantId: z.ZodString;
+    endpointId: z.ZodString;
+    eventId: z.ZodString;
+    eventName: z.ZodEnum<["payment.created", "payment.completed", "payment.failed", "subscription.created", "subscription.charged", "subscription.charge_failed", "subscription.recovery_attempt", "subscription.recovery_outcome", "subscription.cancelled", "subscription.lapsed", "refund.created", "refund.completed", "refund.failed", "invoice.created", "invoice.paid", "invoice.overdue", "agent.action_executed", "agent.job_proposed", "agent.job_completed", "agent.job_disputed", "compliance.wallet_flagged", "compliance.wallet_blocked"]>;
+    status: z.ZodEnum<["pending", "delivered", "retrying", "permanently_failed"]>;
+    attempt: z.ZodNumber;
+    responseCode: z.ZodNullable<z.ZodNumber>;
+    responseMs: z.ZodNullable<z.ZodNumber>;
+    lastError: z.ZodNullable<z.ZodString>;
+    nextAttemptAt: z.ZodNullable<z.ZodString>;
+    deliveredAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+} & {
+    deliveryId: z.ZodString;
+    responseBody: z.ZodNullable<z.ZodString>;
+    requestPayload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    status: "pending" | "retrying" | "delivered" | "permanently_failed";
+    id: string;
+    merchantId: string;
+    createdAt: string;
+    endpointId: string;
+    eventId: string;
+    eventName: "payment.created" | "payment.completed" | "payment.failed" | "subscription.created" | "subscription.charged" | "subscription.charge_failed" | "subscription.recovery_attempt" | "subscription.recovery_outcome" | "subscription.cancelled" | "subscription.lapsed" | "refund.created" | "refund.completed" | "refund.failed" | "invoice.created" | "invoice.paid" | "invoice.overdue" | "agent.action_executed" | "agent.job_proposed" | "agent.job_completed" | "agent.job_disputed" | "compliance.wallet_flagged" | "compliance.wallet_blocked";
+    attempt: number;
+    responseCode: number | null;
+    responseMs: number | null;
+    lastError: string | null;
+    nextAttemptAt: string | null;
+    deliveredAt: string | null;
+    deliveryId: string;
+    responseBody: string | null;
+    requestPayload: Record<string, unknown>;
+}, {
+    status: "pending" | "retrying" | "delivered" | "permanently_failed";
+    id: string;
+    merchantId: string;
+    createdAt: string;
+    endpointId: string;
+    eventId: string;
+    eventName: "payment.created" | "payment.completed" | "payment.failed" | "subscription.created" | "subscription.charged" | "subscription.charge_failed" | "subscription.recovery_attempt" | "subscription.recovery_outcome" | "subscription.cancelled" | "subscription.lapsed" | "refund.created" | "refund.completed" | "refund.failed" | "invoice.created" | "invoice.paid" | "invoice.overdue" | "agent.action_executed" | "agent.job_proposed" | "agent.job_completed" | "agent.job_disputed" | "compliance.wallet_flagged" | "compliance.wallet_blocked";
+    attempt: number;
+    responseCode: number | null;
+    responseMs: number | null;
+    lastError: string | null;
+    nextAttemptAt: string | null;
+    deliveredAt: string | null;
+    deliveryId: string;
+    responseBody: string | null;
+    requestPayload: Record<string, unknown>;
+}>;
+type WebhookDeliveryDetail = z.infer<typeof webhookDeliveryDetailSchema>;
 declare const replayDeliveryInputSchema: z.ZodObject<{
     id: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -198,4 +257,4 @@ declare const replayDeliveryInputSchema: z.ZodObject<{
 }>;
 type ReplayDeliveryInput = z.infer<typeof replayDeliveryInputSchema>;
 
-export { type CreateWebhookEndpointInput, type CreateWebhookEndpointOutput, type ReplayDeliveryInput, type WebhookDelivery, type WebhookDeliveryStatus, type WebhookEndpoint, type WebhookEndpointStatus, type WebhookEventName, createWebhookEndpointInputSchema, createWebhookEndpointOutputSchema, replayDeliveryInputSchema, webhookDeliverySchema, webhookDeliveryStatusSchema, webhookEndpointSchema, webhookEndpointStatusSchema, webhookEventNameSchema };
+export { type CreateWebhookEndpointInput, type CreateWebhookEndpointOutput, type ReplayDeliveryInput, type WebhookDelivery, type WebhookDeliveryDetail, type WebhookDeliveryStatus, type WebhookEndpoint, type WebhookEndpointStatus, type WebhookEventName, createWebhookEndpointInputSchema, createWebhookEndpointOutputSchema, replayDeliveryInputSchema, webhookDeliveryDetailSchema, webhookDeliverySchema, webhookDeliveryStatusSchema, webhookEndpointSchema, webhookEndpointStatusSchema, webhookEventNameSchema };

package/dist/webhooks.js

@@ -98,10 +98,15 @@ var webhookDeliverySchema = z.object({
   deliveredAt: isoTimestampSchema.nullable(),
   createdAt: isoTimestampSchema
 });
+var webhookDeliveryDetailSchema = webhookDeliverySchema.extend({
+  deliveryId: z.string(),
+  responseBody: z.string().nullable(),
+  requestPayload: z.record(z.string(), z.unknown())
+});
 var replayDeliveryInputSchema = z.object({
   id: idSchema
 });
 
-export { createWebhookEndpointInputSchema, createWebhookEndpointOutputSchema, replayDeliveryInputSchema, webhookDeliverySchema, webhookDeliveryStatusSchema, webhookEndpointSchema, webhookEndpointStatusSchema, webhookEventNameSchema };
+export { createWebhookEndpointInputSchema, createWebhookEndpointOutputSchema, replayDeliveryInputSchema, webhookDeliveryDetailSchema, webhookDeliverySchema, webhookDeliveryStatusSchema, webhookEndpointSchema, webhookEndpointStatusSchema, webhookEventNameSchema };
 //# sourceMappingURL=webhooks.js.map
 //# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common.ts","../src/webhooks.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAGlB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa;AAGJ,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D;AAGlE,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAGnE,IAAM,cAAA,GAAiB,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC,CAAA;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOP,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6B,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGN,IAAM,aAAa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAIZ,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9B,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACvF1D,IAAM,sBAAA,GAAyBA,EAAE,IAAA,CAAK;AAAA,EAC3C,iBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,sBAAA;AAAA,EACA,sBAAA;AAAA,EACA,4BAAA;AAAA,EACA,+BAAA;AAAA,EACA,+BAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,iBAAA;AAAA,EACA,uBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,8BAA8BA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,UAAU,CAAC;AAGjE,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,IAAA,EAAM,UAAA;AAAA,EACN,GAAA,EAAK,cAAA;AAAA,EACL,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,MAAA,EAAQA,CAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,MAAA,EAAQ,2BAAA;AAAA,EACR,mBAAA,EAAqBA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EAC7C,eAAA,EAAiB,mBAAmB,QAAA,EAAS;AAAA,EAC7C,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAGM,IAAM,gCAAA,GAAmCA,EAAE,MAAA,CAAO;AAAA,EACvD,GAAA,EAAK,cAAA;AAAA,EACL,MAAA,EAAQA,CAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,IAAA,EAAM;AACR,CAAC;AAGM,IAAM,iCAAA,GAAoCA,EAAE,MAAA,CAAO;AAAA,EACxD,QAAA,EAAU,qBAAA;AAAA;AAAA,EAEV,aAAA,EAAeA,EAAE,MAAA;AACnB,CAAC;AAKM,IAAM,2BAAA,GAA8BA,EAAE,IAAA,CAAK;AAAA,EAChD,SAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,UAAA,EAAY,QAAA;AAAA,EACZ,OAAA,EAAS,QAAA;AAAA,EACT,SAAA,EAAW,sBAAA;AAAA,EACX,MAAA,EAAQ,2BAAA;AAAA,EACR,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtC,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,UAAA,EAAYA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC7C,WAAWA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAI,EAAE,QAAA,EAAS;AAAA,EACzC,aAAA,EAAe,mBAAmB,QAAA,EAAS;AAAA,EAC3C,WAAA,EAAa,mBAAmB,QAAA,EAAS;AAAA,EACzC,SAAA,EAAW;AACb,CAAC;AAGM,IAAM,yBAAA,GAA4BA,EAAE,MAAA,CAAO;AAAA,EAChD,EAAA,EAAI;AACN,CAAC","file":"webhooks.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Webhook endpoints and deliveries.\n *\n * Endpoint = the URL the merchant registered.\n * Event    = the thing that happened.\n * Delivery = one attempt to POST a specific event to a specific endpoint.\n */\n\nimport { z } from 'zod'\nimport { httpsUrlSchema, idSchema, isoTimestampSchema, modeSchema } from './common.js'\n\n// ---------- Event name ----------\n\n/**\n * Every webhook event name in the system. Listed inline so Zod can\n * produce a concrete string union.\n */\nexport const webhookEventNameSchema = z.enum([\n  'payment.created',\n  'payment.completed',\n  'payment.failed',\n  'subscription.created',\n  'subscription.charged',\n  'subscription.charge_failed',\n  'subscription.recovery_attempt',\n  'subscription.recovery_outcome',\n  'subscription.cancelled',\n  'subscription.lapsed',\n  'refund.created',\n  'refund.completed',\n  'refund.failed',\n  'invoice.created',\n  'invoice.paid',\n  'invoice.overdue',\n  'agent.action_executed',\n  'agent.job_proposed',\n  'agent.job_completed',\n  'agent.job_disputed',\n  'compliance.wallet_flagged',\n  'compliance.wallet_blocked',\n])\nexport type WebhookEventName = z.infer<typeof webhookEventNameSchema>\n\n// ---------- Endpoints ----------\n\nexport const webhookEndpointStatusSchema = z.enum(['active', 'disabled'])\nexport type WebhookEndpointStatus = z.infer<typeof webhookEndpointStatusSchema>\n\nexport const webhookEndpointSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  mode: modeSchema,\n  url: httpsUrlSchema,\n  description: z.string().max(200).nullable(),\n  events: z.array(webhookEventNameSchema).nonempty(),\n  status: webhookEndpointStatusSchema,\n  signingSecretPrefix: z.string().min(4).max(12),\n  lastDeliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type WebhookEndpoint = z.infer<typeof webhookEndpointSchema>\n\nexport const createWebhookEndpointInputSchema = z.object({\n  url: httpsUrlSchema,\n  events: z.array(webhookEventNameSchema).nonempty(),\n  description: z.string().max(200).optional(),\n  mode: modeSchema,\n})\nexport type CreateWebhookEndpointInput = z.infer<typeof createWebhookEndpointInputSchema>\n\nexport const createWebhookEndpointOutputSchema = z.object({\n  endpoint: webhookEndpointSchema,\n  /** Full signing secret. Shown exactly once. */\n  signingSecret: z.string(),\n})\nexport type CreateWebhookEndpointOutput = z.infer<typeof createWebhookEndpointOutputSchema>\n\n// ---------- Deliveries ----------\n\nexport const webhookDeliveryStatusSchema = z.enum([\n  'pending',\n  'delivered',\n  'retrying',\n  'permanently_failed',\n])\nexport type WebhookDeliveryStatus = z.infer<typeof webhookDeliveryStatusSchema>\n\nexport const webhookDeliverySchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  endpointId: idSchema,\n  eventId: idSchema,\n  eventName: webhookEventNameSchema,\n  status: webhookDeliveryStatusSchema,\n  attempt: z.number().int().min(1).max(6),\n  responseCode: z.number().int().min(100).max(599).nullable(),\n  responseMs: z.number().int().min(0).nullable(),\n  lastError: z.string().max(1000).nullable(),\n  nextAttemptAt: isoTimestampSchema.nullable(),\n  deliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n})\nexport type WebhookDelivery = z.infer<typeof webhookDeliverySchema>\n\nexport const replayDeliveryInputSchema = z.object({\n  id: idSchema,\n})\nexport type ReplayDeliveryInput = z.infer<typeof replayDeliveryInputSchema>\n"]}
+{"version":3,"sources":["../src/common.ts","../src/webhooks.ts"],"names":["z"],"mappings":";;;AAQO,IAAM,QAAA,GAAW,CAAA,CACrB,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,GAAA,CAAI,EAAE,CAAA,CACN,KAAA,CAAM,kBAAA,EAAoB,qBAAqB,CAAA;AAGlB,CAAA,CAC7B,MAAA,EAAO,CACP,KAAA,CAAM,qBAAA,EAAuB,oDAAoD,CAAA,CACjF,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa;AAGJ,CAAA,CAC5B,MAAA,EAAO,CACP,KAAA,CAAM,uBAAuB,6DAA6D;AAGlE,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,GAAA,CAAI,GAAG;AAGnE,IAAM,cAAA,GAAiB,CAAA,CAC3B,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,CAAA,EAAG;AAAA,EACvC,OAAA,EAAS;AACX,CAAC,CAAA;AAG0B,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAOP,CAAA,CAC9B,MAAA,EAAO,CACP,MAAM,UAAA,EAAY,iDAAiD,CAAA,CACnE,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAA,IAAK,IAAI,cAAc;AAGtB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB;AAGtE,IAAM,kBAAA,GAAqB,CAAA,CAC/B,MAAA,EAAO,CACP,QAAA,CAAS,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,+BAAA,EAAiC,CAAA;AAGrC,EAC9B,MAAA,EAAO,CACP,OAAO,CAAC,CAAA,CACR,KAAA,CAAM,YAAA,EAAc,0CAA0C;AAG5B,EAAE,MAAA,CAAO;AAAA,EAC5C,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA,EAClD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA;AACrC,CAAC;AAY6B,CAAA,CAC3B,MAAA;AAAA,EACC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EACxB,EAAE,KAAA,CAAM,CAAC,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,EAAG,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,IAAW,CAAA,CAAE,IAAA,EAAM,CAAC;AAClE,CAAA,CACC,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,CAAE,MAAA,IAAU,EAAA,EAAI,0BAA0B,CAAA,CACrE,OAAA,CAAQ,EAAE;AAGN,IAAM,aAAa,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AAIZ,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAM,CAAC;AAI3B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM,CAAC;AAI9B,EAAE,IAAA,CAAK,CAAC,QAAQ,QAAA,EAAU,UAAA,EAAY,YAAY,CAAC;AAIjD,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;;;ACvF1D,IAAM,sBAAA,GAAyBA,EAAE,IAAA,CAAK;AAAA,EAC3C,iBAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,sBAAA;AAAA,EACA,sBAAA;AAAA,EACA,4BAAA;AAAA,EACA,+BAAA;AAAA,EACA,+BAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,iBAAA;AAAA,EACA,uBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,8BAA8BA,CAAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,UAAU,CAAC;AAGjE,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,IAAA,EAAM,UAAA;AAAA,EACN,GAAA,EAAK,cAAA;AAAA,EACL,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,MAAA,EAAQA,CAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,MAAA,EAAQ,2BAAA;AAAA,EACR,mBAAA,EAAqBA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EAC7C,eAAA,EAAiB,mBAAmB,QAAA,EAAS;AAAA,EAC7C,SAAA,EAAW,kBAAA;AAAA,EACX,SAAA,EAAW;AACb,CAAC;AAGM,IAAM,gCAAA,GAAmCA,EAAE,MAAA,CAAO;AAAA,EACvD,GAAA,EAAK,cAAA;AAAA,EACL,MAAA,EAAQA,CAAAA,CAAE,KAAA,CAAM,sBAAsB,EAAE,QAAA,EAAS;AAAA,EACjD,aAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EAC1C,IAAA,EAAM;AACR,CAAC;AAGM,IAAM,iCAAA,GAAoCA,EAAE,MAAA,CAAO;AAAA,EACxD,QAAA,EAAU,qBAAA;AAAA;AAAA,EAEV,aAAA,EAAeA,EAAE,MAAA;AACnB,CAAC;AAKM,IAAM,2BAAA,GAA8BA,EAAE,IAAA,CAAK;AAAA,EAChD,SAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAA,GAAwBA,EAAE,MAAA,CAAO;AAAA,EAC5C,EAAA,EAAI,QAAA;AAAA,EACJ,UAAA,EAAY,QAAA;AAAA,EACZ,UAAA,EAAY,QAAA;AAAA,EACZ,OAAA,EAAS,QAAA;AAAA,EACT,SAAA,EAAW,sBAAA;AAAA,EACX,MAAA,EAAQ,2BAAA;AAAA,EACR,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACtC,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS;AAAA,EAC1D,UAAA,EAAYA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAC7C,WAAWA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAI,EAAE,QAAA,EAAS;AAAA,EACzC,aAAA,EAAe,mBAAmB,QAAA,EAAS;AAAA,EAC3C,WAAA,EAAa,mBAAmB,QAAA,EAAS;AAAA,EACzC,SAAA,EAAW;AACb,CAAC;AAQM,IAAM,2BAAA,GAA8B,sBAAsB,MAAA,CAAO;AAAA,EACtE,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,cAAA,EAAgBA,EAAE,MAAA,CAAOA,CAAAA,CAAE,QAAO,EAAGA,CAAAA,CAAE,SAAS;AAClD,CAAC;AAGM,IAAM,yBAAA,GAA4BA,EAAE,MAAA,CAAO;AAAA,EAChD,EAAA,EAAI;AACN,CAAC","file":"webhooks.js","sourcesContent":["/**\n * Primitive schemas shared across every entity.\n * Every higher-level schema builds on these so validation is consistent.\n */\n\nimport { z } from 'zod'\n\n/** CUID2 or UUID-style opaque identifier. */\nexport const idSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(/^[a-zA-Z0-9_-]+$/, 'id must be URL-safe')\n\n/** EVM address. Hex-encoded, 0x-prefixed, 20 bytes. Normalised to lowercase. */\nexport const evmAddressSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{40}$/, 'must be a 0x-prefixed 40-character hex EVM address')\n  .transform((v) => v.toLowerCase())\n\n/** EVM transaction hash. 32-byte hex. */\nexport const evmTxHashSchema = z\n  .string()\n  .regex(/^0x[a-fA-F0-9]{64}$/, 'must be a 0x-prefixed 64-character hex EVM transaction hash')\n\n/** Email address, trimmed and lower-cased. */\nexport const emailSchema = z.string().email().trim().toLowerCase().max(320)\n\n/** HTTPS URL. No http:// allowed outside dev. */\nexport const httpsUrlSchema = z\n  .string()\n  .url()\n  .refine((v) => v.startsWith('https://'), {\n    message: 'must be an https:// URL',\n  })\n\n/** URL permitting http and https (dev + prod). */\nexport const httpUrlSchema = z.string().url()\n\n/**\n * Amount expressed in the token's smallest unit, serialised as a string to\n * preserve precision beyond `Number.MAX_SAFE_INTEGER`. For USDC (6 decimals),\n * 1 USDC is the string \"1000000\".\n */\nexport const tokenAmountSchema = z\n  .string()\n  .regex(/^[0-9]+$/, 'must be a non-negative integer string (base-10)')\n  .refine((v) => BigInt(v) >= 0n, 'must be >= 0')\n\n/** Unsigned integer up to 2^53 - 1; validated and returned as number. */\nexport const uintSchema = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)\n\n/** ISO-8601 timestamp string (`.toISOString()`-compatible). */\nexport const isoTimestampSchema = z\n  .string()\n  .datetime({ offset: true, message: 'must be an ISO-8601 timestamp' })\n\n/** Two-letter ISO-3166 country code. */\nexport const countryCodeSchema = z\n  .string()\n  .length(2)\n  .regex(/^[A-Z]{2}$/, 'must be an ISO-3166 alpha-2 country code')\n\n/** Pagination inputs used by every list endpoint. */\nexport const paginationInputSchema = z.object({\n  limit: z.number().int().min(1).max(100).default(25),\n  cursor: z.string().min(1).max(200).nullish(),\n})\nexport type PaginationInput = z.infer<typeof paginationInputSchema>\n\n/** Pagination envelope used by every list response. */\nexport const makePaginatedSchema = <T extends z.ZodTypeAny>(item: T) =>\n  z.object({\n    data: z.array(item),\n    nextCursor: z.string().nullable(),\n    hasMore: z.boolean(),\n  })\n\n/** Free-form metadata bag the API round-trips for merchants. */\nexport const metadataSchema = z\n  .record(\n    z.string().min(1).max(40),\n    z.union([z.string().max(500), z.number(), z.boolean(), z.null()]),\n  )\n  .refine((m) => Object.keys(m).length <= 50, 'at most 50 metadata keys')\n  .default({})\n\n/** Environment mode carried on every mode-scoped resource. */\nexport const modeSchema = z.enum(['test', 'live'])\nexport type Mode = z.infer<typeof modeSchema>\n\n/** Payment token enum. */\nexport const paymentCurrencySchema = z.enum(['USDC', 'EURC'])\nexport type PaymentCurrency = z.infer<typeof paymentCurrencySchema>\n\n/** Every display-level currency (payment + treasury). */\nexport const tokenSymbolSchema = z.enum(['USDC', 'EURC', 'USYC'])\nexport type TokenSymbol = z.infer<typeof tokenSymbolSchema>\n\n/** Merchant tier enum. */\nexport const merchantTierSchema = z.enum(['free', 'growth', 'business', 'enterprise'])\nexport type MerchantTier = z.infer<typeof merchantTierSchema>\n\n/** Arc environment enum. */\nexport const arcEnvironmentSchema = z.enum(['testnet', 'mainnet'])\nexport type ArcEnvironment = z.infer<typeof arcEnvironmentSchema>\n\nexport type Id = z.infer<typeof idSchema>\nexport type EvmAddress = z.infer<typeof evmAddressSchema>\nexport type EvmTxHash = z.infer<typeof evmTxHashSchema>\nexport type TokenAmount = z.infer<typeof tokenAmountSchema>\nexport type IsoTimestamp = z.infer<typeof isoTimestampSchema>\nexport type Metadata = z.infer<typeof metadataSchema>\n","/**\n * Webhook endpoints and deliveries.\n *\n * Endpoint = the URL the merchant registered.\n * Event    = the thing that happened.\n * Delivery = one attempt to POST a specific event to a specific endpoint.\n */\n\nimport { z } from 'zod'\nimport { httpsUrlSchema, idSchema, isoTimestampSchema, modeSchema } from './common.js'\n\n// ---------- Event name ----------\n\n/**\n * Every webhook event name in the system. Listed inline so Zod can\n * produce a concrete string union.\n */\nexport const webhookEventNameSchema = z.enum([\n  'payment.created',\n  'payment.completed',\n  'payment.failed',\n  'subscription.created',\n  'subscription.charged',\n  'subscription.charge_failed',\n  'subscription.recovery_attempt',\n  'subscription.recovery_outcome',\n  'subscription.cancelled',\n  'subscription.lapsed',\n  'refund.created',\n  'refund.completed',\n  'refund.failed',\n  'invoice.created',\n  'invoice.paid',\n  'invoice.overdue',\n  'agent.action_executed',\n  'agent.job_proposed',\n  'agent.job_completed',\n  'agent.job_disputed',\n  'compliance.wallet_flagged',\n  'compliance.wallet_blocked',\n])\nexport type WebhookEventName = z.infer<typeof webhookEventNameSchema>\n\n// ---------- Endpoints ----------\n\nexport const webhookEndpointStatusSchema = z.enum(['active', 'disabled'])\nexport type WebhookEndpointStatus = z.infer<typeof webhookEndpointStatusSchema>\n\nexport const webhookEndpointSchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  mode: modeSchema,\n  url: httpsUrlSchema,\n  description: z.string().max(200).nullable(),\n  events: z.array(webhookEventNameSchema).nonempty(),\n  status: webhookEndpointStatusSchema,\n  signingSecretPrefix: z.string().min(4).max(12),\n  lastDeliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n  updatedAt: isoTimestampSchema,\n})\nexport type WebhookEndpoint = z.infer<typeof webhookEndpointSchema>\n\nexport const createWebhookEndpointInputSchema = z.object({\n  url: httpsUrlSchema,\n  events: z.array(webhookEventNameSchema).nonempty(),\n  description: z.string().max(200).optional(),\n  mode: modeSchema,\n})\nexport type CreateWebhookEndpointInput = z.infer<typeof createWebhookEndpointInputSchema>\n\nexport const createWebhookEndpointOutputSchema = z.object({\n  endpoint: webhookEndpointSchema,\n  /** Full signing secret. Shown exactly once. */\n  signingSecret: z.string(),\n})\nexport type CreateWebhookEndpointOutput = z.infer<typeof createWebhookEndpointOutputSchema>\n\n// ---------- Deliveries ----------\n\nexport const webhookDeliveryStatusSchema = z.enum([\n  'pending',\n  'delivered',\n  'retrying',\n  'permanently_failed',\n])\nexport type WebhookDeliveryStatus = z.infer<typeof webhookDeliveryStatusSchema>\n\nexport const webhookDeliverySchema = z.object({\n  id: idSchema,\n  merchantId: idSchema,\n  endpointId: idSchema,\n  eventId: idSchema,\n  eventName: webhookEventNameSchema,\n  status: webhookDeliveryStatusSchema,\n  attempt: z.number().int().min(1).max(6),\n  responseCode: z.number().int().min(100).max(599).nullable(),\n  responseMs: z.number().int().min(0).nullable(),\n  lastError: z.string().max(1000).nullable(),\n  nextAttemptAt: isoTimestampSchema.nullable(),\n  deliveredAt: isoTimestampSchema.nullable(),\n  createdAt: isoTimestampSchema,\n})\nexport type WebhookDelivery = z.infer<typeof webhookDeliverySchema>\n\n/**\n * Detail projection returned by GET /v1/webhook-deliveries/:id.\n * Carries the payload envelope, response body, and the deliveryId\n * header the receiver saw. Kept separate so list responses stay slim.\n */\nexport const webhookDeliveryDetailSchema = webhookDeliverySchema.extend({\n  deliveryId: z.string(),\n  responseBody: z.string().nullable(),\n  requestPayload: z.record(z.string(), z.unknown()),\n})\nexport type WebhookDeliveryDetail = z.infer<typeof webhookDeliveryDetailSchema>\n\nexport const replayDeliveryInputSchema = z.object({\n  id: idSchema,\n})\nexport type ReplayDeliveryInput = z.infer<typeof replayDeliveryInputSchema>\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strimz/shared-types",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Zod schemas and inferred TypeScript types for every Strimz platform entity, API input, and webhook event.",
   "license": "MIT",
   "author": "Strimz <hello@strimz.finance>",

package/src/api-keys.ts

@@ -36,6 +36,11 @@ export const apiKeyScopeSchema = z.enum([
   // hosted checkout and merchants embedding the SDK.
   'relay_read',
   'relay_write',
+  // Self-service key management from an API key holder. Rarely used
+  // day-to-day; needed for partner onboarding flows that mint scoped
+  // keys per sub-tenant.
+  'api_keys_read',
+  'api_keys_write',
 ])
 export type ApiKeyScope = z.infer<typeof apiKeyScopeSchema>
 

package/src/contact.ts

@@ -0,0 +1,26 @@
+/**
+ * Public marketing contact form. Not an authenticated API resource —
+ * routed straight to a support inbox by the contact module in
+ * `apps/api`. Kept shape-compatible with what the marketing form on
+ * the Strimz landing page already validates client-side.
+ */
+
+import { z } from 'zod'
+import { emailSchema } from './common.js'
+
+export const contactTopicSchema = z.enum(['sales', 'support', 'partnership', 'security', 'other'])
+export type ContactTopic = z.infer<typeof contactTopicSchema>
+
+export const contactRequestInputSchema = z.object({
+  name: z.string().min(2).max(120),
+  email: emailSchema,
+  company: z.string().min(1).max(120).optional(),
+  topic: contactTopicSchema,
+  message: z.string().min(20).max(4000),
+})
+export type ContactRequestInput = z.infer<typeof contactRequestInputSchema>
+
+export const contactRequestOutputSchema = z.object({
+  ok: z.literal(true),
+})
+export type ContactRequestOutput = z.infer<typeof contactRequestOutputSchema>

package/src/index.ts

@@ -21,3 +21,5 @@ export * from './storefronts.js'
 export * from './invoices.js'
 export * from './events.js'
 export * from './tokens.js'
+export * from './contact.js'
+export * from './notifications.js'

package/src/merchants.ts

@@ -30,6 +30,8 @@ export const merchantSchema = z.object({
   tier: merchantTierSchema,
   status: merchantStatusSchema,
   payoutAddress: evmAddressSchema.nullable(),
+  walletAddress: evmAddressSchema.nullable(),
+  onboardingCompleted: z.boolean(),
   defaultCurrency: z.enum(['USDC', 'EURC']),
   countryCode: z.string().length(2).nullable(),
   websiteUrl: z.string().url().nullable(),
@@ -52,6 +54,23 @@ export const createMerchantInputSchema = z.object({
 })
 export type CreateMerchantInput = z.infer<typeof createMerchantInputSchema>
 
+/**
+ * Merchant email opt-outs, persisted at `Merchant.metadata.emailPrefs`.
+ * Both default to true. Welcome, refunds, and admin broadcasts always send.
+ */
+export const merchantEmailPrefsSchema = z.object({
+  /** "You received X USDC" one-off payment notifications. */
+  paymentReceived: z.boolean(),
+  /** "You were paid X for subscription Y" per-charge notifications. */
+  subscriptionCharged: z.boolean(),
+})
+export type MerchantEmailPrefs = z.infer<typeof merchantEmailPrefsSchema>
+
+export const DEFAULT_MERCHANT_EMAIL_PREFS: MerchantEmailPrefs = {
+  paymentReceived: true,
+  subscriptionCharged: true,
+}
+
 export const updateMerchantInputSchema = z
   .object({
     businessName: z.string().min(2).max(120),
@@ -61,6 +80,7 @@ export const updateMerchantInputSchema = z
     logoUrl: z.string().url().nullable(),
     countryCode: z.string().length(2).nullable(),
     metadata: metadataSchema,
+    emailPrefs: merchantEmailPrefsSchema.partial(),
   })
   .partial()
 export type UpdateMerchantInput = z.infer<typeof updateMerchantInputSchema>
@@ -70,6 +90,70 @@ export const changeTierInputSchema = z.object({
 })
 export type ChangeTierInput = z.infer<typeof changeTierInputSchema>
 
+/**
+ * Self-attested onboarding form the dashboard collects after a
+ * merchant first logs in via Privy. On success the API stamps
+ * `onboardingCompleted: true` on the row, and the dashboard exits
+ * the wizard. Shared here so the API's DTO and the web client's
+ * hook can enforce the same shape.
+ */
+export const onboardMerchantInputSchema = z.object({
+  businessName: z.string().min(2).max(120),
+  businessSector: z.string().min(2).max(80),
+  countryCode: z
+    .string()
+    .length(2)
+    .regex(/^[A-Z]{2}$/, 'must be a 2-letter ISO country code'),
+  websiteUrl: z.string().url().optional(),
+  logoUrl: z.string().url().optional(),
+  phone: z.string().min(6).max(20).optional(),
+  payoutAddress: evmAddressSchema,
+  defaultCurrency: z.enum(['USDC', 'EURC']).optional(),
+})
+export type OnboardMerchantInput = z.infer<typeof onboardMerchantInputSchema>
+
+export const merchantPublicBrandSchema = z.object({
+  id: idSchema,
+  businessName: z.string().min(2).max(120),
+  logoUrl: z.string().url().nullable(),
+  walletAddress: evmAddressSchema.nullable(),
+})
+export type MerchantPublicBrand = z.infer<typeof merchantPublicBrandSchema>
+
+/**
+ * On-chain balance view for the withdraw page. Strimz is
+ * non-custodial: payments settle directly into the merchant's
+ * `payoutAddress`, and "withdrawal" means the merchant transferring
+ * out with their own wallet. This shape reports current on-chain
+ * state so the dashboard renders live balances + decides whether to
+ * offer the signing UI.
+ */
+export const merchantBalanceSchema = z.object({
+  /** Payout wallet, checksummed; null when the merchant hasn't set one. */
+  payoutAddress: evmAddressSchema.nullable(),
+  /** Privy embedded wallet, checksummed if resolvable. */
+  walletAddress: evmAddressSchema.nullable(),
+  /**
+   * True when `payoutAddress === walletAddress`, i.e. the merchant
+   * can sign a transfer from the dashboard via Privy. False for
+   * merchants using an external wallet as payout — the UI falls back
+   * to "copy the address, transfer with your wallet."
+   */
+  canSignFromDashboard: z.boolean(),
+  balances: z.array(
+    z.object({
+      currency: z.enum(['USDC', 'EURC']),
+      contractAddress: evmAddressSchema,
+      /** Base-6 integer as string. */
+      raw: z.string(),
+      /** Human-formatted, e.g. `1234.56`. */
+      formatted: z.string(),
+      decimals: z.number().int().min(0).max(30),
+    }),
+  ),
+})
+export type MerchantBalanceView = z.infer<typeof merchantBalanceSchema>
+
 // ---------- Team members ----------
 
 export const merchantMemberSchema = z.object({

package/src/notifications.ts

@@ -0,0 +1,88 @@
+/**
+ * Dashboard notifications. Derived server-side from recent activity
+ * (confirmed payment sessions, new subscribers, processed refunds).
+ * Read state is tracked on the merchant record via
+ * `notificationsLastReadAt` — `event.createdAt <= that timestamp` is
+ * "read", anything newer is "unread". No dedicated notifications
+ * table because the source rows already exist; a separate table would
+ * just be a denormalised copy.
+ */
+
+import { z } from 'zod'
+import { idSchema, isoTimestampSchema } from './common.js'
+
+export const notificationKindSchema = z.enum([
+  'payment_received',
+  'subscription_started',
+  'refund_processed',
+  /** Message an admin broadcast to this merchant (or all merchants). */
+  'admin_broadcast',
+])
+export type NotificationKind = z.infer<typeof notificationKindSchema>
+
+// ---------- Admin broadcasts ----------
+
+export const broadcastAudienceSchema = z.enum(['all', 'merchant'])
+export type BroadcastAudience = z.infer<typeof broadcastAudienceSchema>
+
+export const createBroadcastInputSchema = z
+  .object({
+    title: z.string().min(4).max(160),
+    body: z.string().min(4).max(4000),
+    audience: broadcastAudienceSchema.default('all'),
+    /** Required when `audience === 'merchant'`; ignored otherwise. */
+    merchantId: z.string().optional(),
+  })
+  .refine((v) => v.audience !== 'merchant' || !!v.merchantId, {
+    message: 'merchantId is required when audience is merchant',
+    path: ['merchantId'],
+  })
+export type CreateBroadcastInput = z.infer<typeof createBroadcastInputSchema>
+
+export const broadcastSchema = z.object({
+  id: idSchema,
+  title: z.string(),
+  body: z.string(),
+  audience: broadcastAudienceSchema,
+  merchantId: idSchema.nullable(),
+  merchantEmail: z.string().nullable(),
+  senderId: idSchema,
+  senderEmail: z.string(),
+  emailedAt: isoTimestampSchema.nullable(),
+  createdAt: isoTimestampSchema,
+})
+export type Broadcast = z.infer<typeof broadcastSchema>
+
+export const broadcastListResponseSchema = z.object({
+  data: z.array(broadcastSchema),
+})
+export type BroadcastListResponse = z.infer<typeof broadcastListResponseSchema>
+
+export const notificationSchema = z.object({
+  /** Deterministic client id — `{kind}:{sourceId}`. Safe for React keys. */
+  id: z.string().min(1),
+  kind: notificationKindSchema,
+  title: z.string().min(1),
+  detail: z.string(),
+  /** Dashboard route the tray links to. */
+  href: z.string().min(1),
+  /** ISO timestamp of the source event; drives sort + read comparison. */
+  createdAt: isoTimestampSchema,
+  /** Server-derived from the merchant's `notificationsLastReadAt`. */
+  read: z.boolean(),
+  /** Optional foreign key back to the source row (for deep-linking). */
+  sourceId: idSchema.optional(),
+})
+export type NotificationView = z.infer<typeof notificationSchema>
+
+export const notificationListResponseSchema = z.object({
+  data: z.array(notificationSchema),
+  unreadCount: z.number().int().min(0),
+  lastReadAt: isoTimestampSchema.nullable(),
+})
+export type NotificationListResponse = z.infer<typeof notificationListResponseSchema>
+
+export const markNotificationsReadResponseSchema = z.object({
+  lastReadAt: isoTimestampSchema,
+})
+export type MarkNotificationsReadResponse = z.infer<typeof markNotificationsReadResponseSchema>

package/src/payment-sessions.ts

@@ -31,6 +31,28 @@ export const paymentSessionStatusSchema = z.enum([
 ])
 export type PaymentSessionStatus = z.infer<typeof paymentSessionStatusSchema>
 
+/**
+ * Merchant-supplied callback URL. The hosted checkout dispatches with
+ * `window.location.href = redirectUrl` on completion / cancellation,
+ * so we MUST reject anything other than `http://` and `https://`.
+ *
+ * Why this is a real risk: Zod's `.url()` validates RFC syntax, which
+ * accepts `javascript:`, `data:`, `vbscript:`, `file:`, blob:`, etc.
+ * A compromised merchant integration or an XSS upstream could ship a
+ * session whose redirect URL executes script (or exfiltrates session
+ * tokens) on every payer's browser. The damage is per-payer, but the
+ * blast radius is "every checkout the merchant runs."
+ *
+ * Mailto / tel and other handler protocols are also rejected — there
+ * is no legitimate flow on a payment checkout that would benefit.
+ */
+export const callbackUrlSchema = z
+  .string()
+  .url()
+  .refine((v) => v.startsWith('https://') || v.startsWith('http://'), {
+    message: 'must be an http:// or https:// URL',
+  })
+
 export const paymentSessionSchema = z.object({
   id: idSchema,
   merchantId: idSchema,
@@ -63,8 +85,8 @@ export const paymentSessionSchema = z.object({
   description: z.string().max(500).nullable(),
   payerWalletAddress: evmAddressSchema.nullable(),
   payerEmail: z.string().email().nullable(),
-  successUrl: z.string().url().nullable(),
-  cancelUrl: z.string().url().nullable(),
+  successUrl: callbackUrlSchema.nullable(),
+  cancelUrl: callbackUrlSchema.nullable(),
   sourceChain: z
     .enum(['arc', 'ethereum', 'base', 'polygon', 'arbitrum', 'optimism', 'avalanche', 'solana'])
     .nullable(),

package/src/refunds.ts

@@ -66,3 +66,22 @@ export const submitRefundSignatureInputSchema = z.object({
   refundTxHash: evmTxHashSchema,
 })
 export type SubmitRefundSignatureInput = z.infer<typeof submitRefundSignatureInputSchema>
+
+/**
+ * Response envelope for `POST /v1/refunds`. The API returns the newly
+ * created refund plus the concrete ERC-20 transfer the merchant now
+ * has to sign from their payout wallet.
+ */
+export const refundSigningInstructionsSchema = z.object({
+  token: evmAddressSchema,
+  to: evmAddressSchema,
+  amount: tokenAmountSchema,
+  note: z.string(),
+})
+export type RefundSigningInstructions = z.infer<typeof refundSigningInstructionsSchema>
+
+export const refundCreateOutputSchema = z.object({
+  refund: refundSchema,
+  signingInstructions: refundSigningInstructionsSchema,
+})
+export type RefundCreateOutput = z.infer<typeof refundCreateOutputSchema>

package/src/storefronts.ts

@@ -87,3 +87,27 @@ export const createStorefrontProductInputSchema = storefrontProductSchema
     imageUrl: httpsUrlSchema.optional(),
   })
 export type CreateStorefrontProductInput = z.infer<typeof createStorefrontProductInputSchema>
+
+/**
+ * Payload for the public `/store/:slug/products/:id/checkout` endpoint.
+ * Optional customer email flows through into the payment session so
+ * the receipt lands in the buyer's inbox after the tx confirms.
+ * `returnPath` is used to synthesise the success + cancel URLs when
+ * the merchant hasn't wired their own.
+ */
+export const storefrontCheckoutInputSchema = z.object({
+  customerEmail: z.string().email().optional(),
+  returnPath: z.string().max(200).optional(),
+})
+export type StorefrontCheckoutInput = z.infer<typeof storefrontCheckoutInputSchema>
+
+/** Response shape from the public product-checkout endpoint. */
+export const storefrontCheckoutResponseSchema = z.object({
+  /** Fully-qualified checkout URL — payer redirects here to sign. */
+  checkoutUrl: z.string().url(),
+  /** Payment-session id (one-time) or plan id (subscription). */
+  ref: idSchema,
+  /** Which downstream checkout the URL points at. */
+  kind: z.enum(['payment_session', 'subscription_plan']),
+})
+export type StorefrontCheckoutResponse = z.infer<typeof storefrontCheckoutResponseSchema>