@vobs/payment 0.3.0 → 1.2.1

package/dist/manager.d.ts

@@ -1,67 +0,0 @@
-/** @license MIT
- * Copyright (c) 2026 vobsjs
- * @vobs/payment
- */
-/**
- * PaymentManager — payment core service layer (framework-agnostic, pure logic).
- *
- * Security baseline coverage (design doc §3/§5):
- *  - Server-side pricing (amount comes from the business's getOrderAmount; the frontend amount is only a consistency check)
- *  - MAX_AMOUNT per-order limit (over-limit rejected, avoids channel errors/risk control)
- *  - Order idempotency (idempotencyKey) + duplicate-order guard for the same business order (duplicateOrderStrategy)
- *  - Callback verification + time window + nonce anti-replay + callback idempotency (persist before responding)
- *  - Conflict freeze / paid-after-close freeze / large-amount manual review (AUDIT_THRESHOLD + confirm)
- *  - Operation audit (order/callback-book/freeze/confirm all logged)
- *  - onVerified business hook (must be idempotent) / onAlert alert hook
- */
-import type { AuditEntry, CallbackResult, CreateOrderRequest, CreateOrderResult, GetOrderAmount, OrderState, OrderStatus, PaymentAlert, PaymentConfig, PaymentDriver, PaymentScene, VerifiedResult } from './types.js';
-import { type PaymentStore } from './store.js';
-export type OrderErrorCode = 'order_not_found' | 'amount_mismatch' | 'amount_exceeds_limit' | 'order_conflict' | 'channel_unavailable' | 'bad_request';
-export type OrderError = {
-    readonly error: OrderErrorCode;
-    readonly message?: string;
-    readonly expected?: number;
-    readonly max?: number;
-};
-export type CreateOrderOutcome = CreateOrderResult | OrderError;
-export interface PaymentManagerOptions {
-    readonly config?: PaymentConfig;
-    /** Defaults to an in-memory store. */
-    readonly store?: PaymentStore;
-    /** Callback signature key (HMAC-SHA256). Inject via KMS/env in production. */
-    readonly apiKey?: string;
-    /** Server-owned callback URL, or a resolver for channel-specific callback URLs. */
-    readonly notifyUrl?: string | ((driverName: string) => string);
-    /** Server-pricing hook (business: orderId → amount in fen; undefined = order not found). */
-    readonly getOrderAmount?: GetOrderAmount;
-    /** Business action after booking (deliver/activate) — must be idempotent; on failure the business must retry or compensate manually. */
-    readonly onVerified?: (result: VerifiedResult) => void | Promise<void>;
-    /** Alerts (frozen/conflict/large-amount/signature-failure). */
-    readonly onAlert?: (alert: PaymentAlert) => void;
-}
-export interface PaymentManager {
-    registerDriver(driver: PaymentDriver): void;
-    available(): readonly {
-        readonly name: string;
-        readonly scenes: readonly PaymentScene[];
-    }[];
-    createOrder(req: CreateOrderRequest): Promise<CreateOrderOutcome>;
-    getStatus(orderId: string): OrderStatus | undefined;
-    close(orderId: string): OrderStatus | undefined;
-    confirm(orderId: string): OrderStatus | undefined;
-    /** Active reconciliation (compensates lost callbacks): query channel status → sync locally (channel paid & local created → migrate via state machine, incl. large-amount audit). */
-    syncOrderStatus(orderId: string): Promise<OrderStatus | undefined>;
-    /** Expiry scan: created & past ttlMs → closed; returns closed orders. Call from a scheduled task. */
-    scanExpiredOrders(ttlMs: number): readonly {
-        readonly orderId: string;
-        readonly state: OrderState;
-    }[];
-    /** Retries a persisted pending business delivery. Returns undefined when the order is missing. */
-    retryDelivery(orderId: string): Promise<boolean | undefined>;
-    handleCallback(driverName: string, ctx: {
-        readonly headers: Readonly<Record<string, string | undefined>>;
-        readonly body: string;
-    }): Promise<CallbackResult>;
-    auditLog(): readonly AuditEntry[];
-}
-export declare function createPaymentManager(options?: PaymentManagerOptions): PaymentManager;

package/dist/manager.js

@@ -1,538 +0,0 @@
-/** @license MIT
- * Copyright (c) 2026 vobsjs
- * @vobs/payment
- */
-/**
- * PaymentManager — payment core service layer (framework-agnostic, pure logic).
- *
- * Security baseline coverage (design doc §3/§5):
- *  - Server-side pricing (amount comes from the business's getOrderAmount; the frontend amount is only a consistency check)
- *  - MAX_AMOUNT per-order limit (over-limit rejected, avoids channel errors/risk control)
- *  - Order idempotency (idempotencyKey) + duplicate-order guard for the same business order (duplicateOrderStrategy)
- *  - Callback verification + time window + nonce anti-replay + callback idempotency (persist before responding)
- *  - Conflict freeze / paid-after-close freeze / large-amount manual review (AUDIT_THRESHOLD + confirm)
- *  - Operation audit (order/callback-book/freeze/confirm all logged)
- *  - onVerified business hook (must be idempotent) / onAlert alert hook
- */
-import { applyClose, applyConfirm, applyPaidCallback } from './state-machine.js';
-import { createMemoryStore } from './store.js';
-import { verifySignedCallback } from './verify.js';
-function isValidAmount(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
-}
-function isValidCreateOrderRequest(req) {
-    if (typeof req !== 'object' || req === null || Array.isArray(req))
-        return false;
-    const value = req;
-    return (typeof value.orderId === 'string' &&
-        value.orderId.trim().length > 0 &&
-        typeof value.subject === 'string' &&
-        value.subject.trim().length > 0 &&
-        isValidAmount(value.amount) &&
-        (value.idempotencyKey === undefined ||
-            (typeof value.idempotencyKey === 'string' && value.idempotencyKey.length > 0)));
-}
-export function createPaymentManager(options = {}) {
-    const config = options.config ?? {};
-    const store = options.store ??
-        createMemoryStore({
-            ...(config.idempotencyTtlMs === undefined ? {} : { retentionMs: config.idempotencyTtlMs }),
-        });
-    const apiKey = options.apiKey;
-    const configuredNotifyUrl = options.notifyUrl;
-    const getOrderAmount = options.getOrderAmount;
-    const drivers = new Map();
-    const pendingOrderCreates = new Map();
-    const pendingIdempotencyCreates = new Map();
-    const pendingDeliveries = new Map();
-    const notifyVerified = options.onVerified;
-    const notifyAlert = options.onAlert;
-    const notifyUrlFor = (driverName) => {
-        const value = typeof configuredNotifyUrl === 'function'
-            ? configuredNotifyUrl(driverName)
-            : configuredNotifyUrl;
-        return typeof value === 'string' ? value : '';
-    };
-    const audit = (entry) => {
-        store.appendAudit(entry);
-    };
-    const alert = (alert) => {
-        notifyAlert?.(alert);
-    };
-    const verifiedResultFor = (order) => ({
-        orderId: order.orderId,
-        state: 'paid',
-        ...(order.paidAt ? { paidAt: order.paidAt } : {}),
-        ...(order.channelTxnId ? { channelTxnId: order.channelTxnId } : {}),
-    });
-    async function deliverVerified(order) {
-        if (notifyVerified === undefined || order.deliveryState === 'delivered')
-            return true;
-        order.deliveryState = 'pending';
-        delete order.deliveryError;
-        store.saveOrder(order);
-        try {
-            await notifyVerified(verifiedResultFor(order));
-            order.deliveryState = 'delivered';
-            store.saveOrder(order);
-            audit({ operation: 'delivery', orderId: order.orderId, reason: 'delivered', at: Date.now() });
-            return true;
-        }
-        catch (error) {
-            order.deliveryState = 'pending';
-            order.deliveryError = String(error);
-            store.saveOrder(order);
-            audit({ operation: 'delivery', orderId: order.orderId, reason: 'failed', at: Date.now() });
-            alert({
-                level: 'error',
-                code: 'delivery_failed',
-                message: String(error),
-                orderId: order.orderId,
-            });
-            return false;
-        }
-    }
-    function scheduleDelivery(order) {
-        const pending = pendingDeliveries.get(order.orderId);
-        if (pending !== undefined)
-            return pending;
-        const delivery = deliverVerified(order)
-            .catch((error) => {
-            alert({
-                level: 'error',
-                code: 'delivery_failed',
-                message: String(error),
-                orderId: order.orderId,
-            });
-            return false;
-        })
-            .finally(() => {
-            if (pendingDeliveries.get(order.orderId) === delivery) {
-                pendingDeliveries.delete(order.orderId);
-            }
-        });
-        pendingDeliveries.set(order.orderId, delivery);
-        return delivery;
-    }
-    function driverOf(name) {
-        const driver = drivers.get(name);
-        if (!driver)
-            throw new Error(`driver_not_found: ${name}`);
-        return driver;
-    }
-    /** Create an order record (zero-amount orders skip the channel and have no init). */
-    function newOrder(input, driver, state) {
-        return {
-            orderId: input.orderId,
-            amount: input.amount,
-            subject: input.subject,
-            scene: input.scene,
-            driver: driver.name,
-            state,
-            createdAt: Date.now(),
-        };
-    }
-    function createOrder(req) {
-        if (!isValidCreateOrderRequest(req)) {
-            return Promise.resolve({ error: 'bad_request', message: 'Invalid payment order request' });
-        }
-        const pendingByKey = req.idempotencyKey === undefined
-            ? undefined
-            : pendingIdempotencyCreates.get(req.idempotencyKey);
-        if (pendingByKey !== undefined)
-            return pendingByKey;
-        const pendingByOrder = pendingOrderCreates.get(req.orderId);
-        if (pendingByOrder !== undefined)
-            return pendingByOrder;
-        const operation = createOrderInternal(req);
-        pendingOrderCreates.set(req.orderId, operation);
-        if (req.idempotencyKey !== undefined) {
-            pendingIdempotencyCreates.set(req.idempotencyKey, operation);
-        }
-        const releasePending = () => {
-            if (pendingOrderCreates.get(req.orderId) === operation) {
-                pendingOrderCreates.delete(req.orderId);
-            }
-            if (req.idempotencyKey !== undefined &&
-                pendingIdempotencyCreates.get(req.idempotencyKey) === operation) {
-                pendingIdempotencyCreates.delete(req.idempotencyKey);
-            }
-        };
-        void operation.then(releasePending, releasePending);
-        return operation;
-    }
-    async function createOrderInternal(req) {
-        const orderId = req.orderId;
-        if (getOrderAmount === undefined) {
-            return { error: 'bad_request', message: 'Server-side order pricing is required' };
-        }
-        // ① idempotency: same idempotencyKey returns the same order
-        if (req.idempotencyKey) {
-            const existingId = store.getOrderByIdempotencyKey(req.idempotencyKey);
-            if (existingId) {
-                const existing = store.getOrder(existingId);
-                if (existing) {
-                    return {
-                        kind: 'ok',
-                        driver: existing.driver,
-                        orderId: existing.orderId,
-                        state: existing.state,
-                        ...(existing.init ? { init: existing.init } : {}),
-                    };
-                }
-            }
-        }
-        const existingOrder = store.getOrder(orderId);
-        const reserved = existingOrder === undefined && store.reserveOrder(orderId);
-        if (existingOrder === undefined && !reserved) {
-            return { error: 'order_conflict', message: `order is being created for ${orderId}` };
-        }
-        try {
-            // ② server-side pricing: amount from business (security red line — never trust the client amount)
-            const expected = await getOrderAmount(orderId);
-            if (expected === undefined)
-                return { error: 'order_not_found' };
-            if (!isValidAmount(expected)) {
-                return { error: 'bad_request', message: 'Invalid server-side order amount' };
-            }
-            if (req.amount !== expected)
-                return { error: 'amount_mismatch', expected };
-            // ③ per-order limit: reject over-limit (avoids channel errors/risk control)
-            if (config.maxAmount !== undefined && expected > config.maxAmount) {
-                return { error: 'amount_exceeds_limit', max: config.maxAmount };
-            }
-            // ④ duplicate guard: an unpaid order already exists
-            if (existingOrder && existingOrder.state === 'created') {
-                const strategy = req.duplicateStrategy ?? config.duplicateOrderStrategy ?? 'ask';
-                if (strategy === 'ask') {
-                    return {
-                        kind: 'duplicate',
-                        existingOrderId: existingOrder.orderId,
-                        existingAmount: existingOrder.amount,
-                    };
-                }
-                if (strategy === 'reuse') {
-                    return {
-                        kind: 'ok',
-                        driver: existingOrder.driver,
-                        orderId: existingOrder.orderId,
-                        state: existingOrder.state,
-                        ...(existingOrder.init ? { init: existingOrder.init } : {}),
-                    };
-                }
-                if (strategy === 'reject') {
-                    return { error: 'order_conflict', message: `active order exists for ${orderId}` };
-                }
-                existingOrder.state = 'closed';
-                store.saveOrder(existingOrder);
-                audit({
-                    operation: 'close',
-                    orderId,
-                    from: 'created',
-                    to: 'closed',
-                    reason: 'duplicate_replace',
-                    at: Date.now(),
-                });
-            }
-            // ⑤ zero-amount: skip the channel, mark paid directly
-            if (expected === 0) {
-                const driver = driverOf(req.driver ?? availableDrivers()[0]?.name ?? '');
-                const record = newOrder({ orderId, amount: 0, subject: req.subject, scene: req.scene ?? 'pc', notifyUrl: '' }, driver, 'paid');
-                record.paidAt = new Date().toISOString();
-                store.saveOrder(record);
-                if (req.idempotencyKey)
-                    store.setIdempotencyKey(req.idempotencyKey, orderId);
-                audit({ operation: 'create', orderId, to: 'paid', reason: 'zero_amount', at: Date.now() });
-                void scheduleDelivery(record);
-                return { kind: 'ok', driver: driver.name, orderId, state: 'paid' };
-            }
-            // ⑥ place the order via the channel
-            const driver = driverOf(req.driver ?? availableDrivers()[0]?.name ?? '');
-            const notifyUrl = notifyUrlFor(driver.name);
-            if (driver.callbackVerification === 'driver' && notifyUrl.length === 0) {
-                return {
-                    error: 'bad_request',
-                    message: 'A server-owned notifyUrl is required for driver-verified callbacks',
-                };
-            }
-            let init;
-            try {
-                init = await driver.createOrder({
-                    orderId,
-                    amount: expected,
-                    subject: req.subject,
-                    scene: req.scene ?? 'pc',
-                    notifyUrl,
-                });
-            }
-            catch (error) {
-                alert({
-                    level: 'error',
-                    code: 'channel_error',
-                    message: String(error),
-                    driver: driver.name,
-                });
-                return { error: 'channel_unavailable', message: String(error) };
-            }
-            const record = newOrder({
-                orderId,
-                amount: expected,
-                subject: req.subject,
-                scene: req.scene ?? 'pc',
-                notifyUrl,
-            }, driver, 'created');
-            record.init = init;
-            store.saveOrder(record);
-            if (req.idempotencyKey)
-                store.setIdempotencyKey(req.idempotencyKey, orderId);
-            audit({ operation: 'create', orderId, to: 'created', at: Date.now() });
-            return {
-                kind: 'ok',
-                driver: driver.name,
-                orderId,
-                state: 'created',
-                ...(init ? { init } : {}),
-            };
-        }
-        finally {
-            if (reserved)
-                store.releaseOrderReservation(orderId);
-        }
-    }
-    function availableDrivers() {
-        return Array.from(drivers.values()).map((d) => ({ name: d.name, scenes: d.scenes }));
-    }
-    function getStatus(orderId) {
-        const order = store.getOrder(orderId);
-        if (!order)
-            return undefined;
-        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
-    }
-    function close(orderId) {
-        const order = store.getOrder(orderId);
-        if (!order)
-            return undefined;
-        const before = order.state;
-        const { state, ok } = applyClose(order.state);
-        if (ok) {
-            order.state = state;
-            store.saveOrder(order);
-            audit({ operation: 'close', orderId, from: before, to: state, at: Date.now() });
-        }
-        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
-    }
-    function confirm(orderId) {
-        const order = store.getOrder(orderId);
-        if (!order)
-            return undefined;
-        const before = order.state;
-        const { state, ok } = applyConfirm(order.state);
-        if (ok) {
-            order.state = state;
-            order.paidAt = new Date().toISOString();
-            store.saveOrder(order);
-            audit({ operation: 'confirm', orderId, from: before, to: state, at: Date.now() });
-            void scheduleDelivery(order);
-        }
-        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
-    }
-    async function syncOrderStatus(orderId) {
-        const order = store.getOrder(orderId);
-        if (!order)
-            return undefined;
-        const driver = drivers.get(order.driver);
-        if (!driver)
-            return undefined;
-        const status = await driver.queryOrder(orderId);
-        // reconciliation: channel paid & local unpaid → migrate via state machine (amount from order; large-amount audit also applies)
-        if (status.state === 'paid' && order.state === 'created') {
-            const before = order.state;
-            const transition = applyPaidCallback(order.state, order.amount, order.amount, config.auditThreshold);
-            if (transition.state !== before) {
-                order.state = transition.state;
-                if (transition.state === 'paid') {
-                    order.paidAt = new Date().toISOString();
-                }
-                store.saveOrder(order);
-                audit({
-                    operation: 'callback',
-                    orderId,
-                    from: before,
-                    to: transition.state,
-                    reason: transition.reason ?? 'sync',
-                    at: Date.now(),
-                });
-                if (transition.state === 'paid') {
-                    void scheduleDelivery(order);
-                }
-            }
-        }
-        return { state: order.state, ...(order.paidAt ? { paidAt: order.paidAt } : {}) };
-    }
-    function scanExpiredOrders(ttlMs) {
-        const now = Date.now();
-        const closed = [];
-        for (const order of store.allOrders()) {
-            if (order.state === 'created' && now - order.createdAt >= ttlMs) {
-                const before = order.state;
-                const { state, ok } = applyClose(order.state);
-                if (ok) {
-                    order.state = state;
-                    store.saveOrder(order);
-                    audit({
-                        operation: 'close',
-                        orderId: order.orderId,
-                        from: before,
-                        to: state,
-                        reason: 'expired',
-                        at: now,
-                    });
-                    closed.push({ orderId: order.orderId, state });
-                }
-            }
-        }
-        return closed;
-    }
-    async function handleCallback(driverName, ctx) {
-        const driver = drivers.get(driverName);
-        if (!driver) {
-            return { ok: false, status: 404, body: { ok: false, error: 'driver_not_found' } };
-        }
-        const timestamp = ctx.headers['x-timestamp'];
-        const nonce = ctx.headers['x-nonce'];
-        const signature = ctx.headers['x-signature'];
-        const isGenericProtocol = driver.callbackVerification !== 'driver';
-        if (isGenericProtocol) {
-            if (apiKey === undefined || apiKey.length === 0) {
-                return { ok: false, status: 500, body: { ok: false, error: 'server_configuration' } };
-            }
-            // generic verification protocol (X-* headers + HMAC-SHA256): for mock/self-built backends
-            const verified = await verifySignedCallback({
-                apiKey,
-                timestamp: timestamp,
-                nonce: nonce,
-                signature: signature,
-                body: ctx.body,
-                ...(config.timeWindowSec !== undefined ? { timeWindowSec: config.timeWindowSec } : {}),
-            });
-            if (!verified.ok) {
-                alert({
-                    level: 'warn',
-                    code: 'verify_failed',
-                    message: verified.reason,
-                    driver: driverName,
-                });
-                return { ok: false, status: 401, body: { ok: false, error: verified.reason } };
-            }
-            // nonce anti-replay (idempotency stops double-booking; nonce stops forged replays)
-            if (!store.addNonce(nonce)) {
-                return { ok: false, status: 401, body: { ok: false, error: 'nonce_reused' } };
-            }
-        }
-        // otherwise: channel self-verification path — real channels (WeChat/Alipay) use their own verification protocol (platform cert/RSA2),
-        // handled internally by driver.verifyCallback (verify/decrypt/anti-replay; the driver holds the store for nonce dedup).
-        // Parse payload:
-        //  - generic protocol path: try JSON.parse (mock path; payload is an object)
-        //  - channel self-verify path: raw body (WeChat callback is outer JSON; Alipay notify is form-encoded),
-        //    parsed + verified (platform cert/RSA2) + anti-replay inside driver.verifyCallback
-        let payload;
-        if (isGenericProtocol) {
-            try {
-                payload = JSON.parse(ctx.body);
-            }
-            catch {
-                payload = ctx.body;
-            }
-        }
-        else {
-            payload = ctx.body;
-        }
-        const callback = driver.verifyCallback(payload, ctx.headers);
-        if (!callback.ok || !callback.orderId || callback.paidAmount === undefined) {
-            return {
-                ok: false,
-                status: 400,
-                body: { ok: false, error: callback.reason ?? 'bad_callback' },
-            };
-        }
-        const order = store.getOrder(callback.orderId);
-        if (!order) {
-            return { ok: false, status: 404, body: { ok: false, error: 'order_not_found' } };
-        }
-        // state machine (amount match / idempotency / closed→frozen / large-amount pending / paid)
-        const before = order.state;
-        const transition = applyPaidCallback(order.state, order.amount, callback.paidAmount, config.auditThreshold);
-        // persist first, then respond (callback response protocol)
-        if (transition.state !== order.state) {
-            order.state = transition.state;
-            if (transition.state === 'paid') {
-                order.paidAt = new Date().toISOString();
-                if (callback.channelTxnId)
-                    order.channelTxnId = callback.channelTxnId;
-            }
-            if (transition.state === 'pending' && transition.reason) {
-                order.auditReason = transition.reason;
-            }
-            audit({
-                operation: transition.state === 'frozen' ? 'freeze' : 'callback',
-                orderId: order.orderId,
-                from: before,
-                to: transition.state,
-                ...(transition.reason ? { reason: transition.reason } : {}),
-                at: Date.now(),
-            });
-            store.saveOrder(order);
-        }
-        if (order.state === 'paid' && order.deliveryState !== 'delivered') {
-            void scheduleDelivery(order);
-        }
-        if (transition.state === 'frozen') {
-            alert({
-                level: 'error',
-                code: 'order_frozen',
-                message: transition.reason ?? 'frozen',
-                orderId: order.orderId,
-            });
-        }
-        if (transition.state === 'pending') {
-            alert({
-                level: 'warn',
-                code: 'audit_required',
-                message: 'large amount pending review',
-                orderId: order.orderId,
-            });
-        }
-        const body = { ok: true, orderId: order.orderId, state: order.state };
-        if (transition.reason)
-            body['reason'] = transition.reason;
-        return {
-            ok: true,
-            status: 200,
-            body,
-            orderId: order.orderId,
-            state: order.state,
-            ...(transition.reason ? { reason: transition.reason } : {}),
-            ...(driver.successResponseText ? { text: driver.successResponseText } : {}),
-        };
-    }
-    return {
-        registerDriver(driver) {
-            drivers.set(driver.name, driver);
-        },
-        available: availableDrivers,
-        createOrder,
-        getStatus,
-        close,
-        confirm,
-        syncOrderStatus,
-        scanExpiredOrders,
-        async retryDelivery(orderId) {
-            const order = store.getOrder(orderId);
-            if (order === undefined)
-                return undefined;
-            return scheduleDelivery(order);
-        },
-        handleCallback,
-        auditLog: () => store.auditLog(),
-    };
-}

package/dist/mock-driver.d.ts

@@ -1,22 +0,0 @@
-/** @license MIT
- * Copyright (c) 2026 vobsjs
- * @vobs/payment
- */
-/**
- * Mock payment driver — for P0 end-to-end demos and integration.
- *
- * - `createOrder`: doesn't call a real channel; returns one-time QR pay params (simulated qrUrl).
- * - `verifyCallback`: package-level verification is done by PaymentManager (generic HMAC protocol);
- *   the mock driver's verifyCallback only does **normalization parsing** (body → VerifiedCallback).
- * - `queryOrder`: reads the store (no real channel state).
- *
- * Real channels (wechat_official / alipay_official) are implemented in P1, replacing this with real signing/messages.
- */
-import type { PaymentDriver } from './types.js';
-import type { PaymentStore } from './store.js';
-export interface MockDriverOptions {
-    readonly name?: string;
-    /** Simulates a channel that always succeeds (default true); set false to demo channel failure. */
-    readonly alwaysSucceed?: boolean;
-}
-export declare function createMockDriver(store: PaymentStore, options?: MockDriverOptions): PaymentDriver;

package/dist/mock-driver.js

@@ -1,59 +0,0 @@
-/** @license MIT
- * Copyright (c) 2026 vobsjs
- * @vobs/payment
- */
-/**
- * Mock payment driver — for P0 end-to-end demos and integration.
- *
- * - `createOrder`: doesn't call a real channel; returns one-time QR pay params (simulated qrUrl).
- * - `verifyCallback`: package-level verification is done by PaymentManager (generic HMAC protocol);
- *   the mock driver's verifyCallback only does **normalization parsing** (body → VerifiedCallback).
- * - `queryOrder`: reads the store (no real channel state).
- *
- * Real channels (wechat_official / alipay_official) are implemented in P1, replacing this with real signing/messages.
- */
-export function createMockDriver(store, options) {
-    const name = options?.name ?? 'mock';
-    const alwaysSucceed = options?.alwaysSucceed ?? true;
-    return {
-        name,
-        scenes: ['pc', 'h5'],
-        callbackVerification: 'manager-hmac',
-        createOrder(input) {
-            if (!alwaysSucceed) {
-                return Promise.reject(new Error('channel_unavailable'));
-            }
-            // mock channel: scan scenes return qr; real channels return jsapi/qr/redirect per scene
-            return Promise.resolve({
-                kind: 'qr',
-                qrUrl: `https://pay.example.com/qr/${input.orderId}`,
-                expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString(),
-            });
-        },
-        verifyCallback(payload, _headers) {
-            // mock normalization: parse the unified callback body (real channels verify signatures + map fields in their own drivers)
-            const body = payload;
-            const orderId = body['orderId'];
-            const paidAmount = body['paidAmount'];
-            if (typeof orderId !== 'string' || typeof paidAmount !== 'number') {
-                return { ok: false, reason: 'bad_payload' };
-            }
-            return {
-                ok: true,
-                orderId,
-                paidAmount,
-                ...(typeof body['channelTxnId'] === 'string' ? { channelTxnId: body['channelTxnId'] } : {}),
-            };
-        },
-        queryOrder(orderId) {
-            const order = store.getOrder(orderId);
-            if (!order) {
-                return Promise.resolve({ state: 'unknown', raw: { error: 'order_not_found' } });
-            }
-            return Promise.resolve({
-                state: order.state,
-                ...(order.paidAt ? { paidAt: order.paidAt } : {}),
-            });
-        },
-    };
-}