moltspay 1.6.0 → 2.0.0

package/dist/facilitators/index.js

@@ -30,6 +30,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/facilitators/index.ts
 var facilitators_exports = {};
 __export(facilitators_exports, {
+  ALIPAY_GATEWAY_PROD: () => ALIPAY_GATEWAY_PROD,
+  ALIPAY_GATEWAY_SANDBOX: () => ALIPAY_GATEWAY_SANDBOX,
+  ALIPAY_NETWORK: () => ALIPAY_NETWORK,
+  ALIPAY_SCHEME: () => ALIPAY_SCHEME,
+  AlipayFacilitator: () => AlipayFacilitator,
   BNBFacilitator: () => BNBFacilitator,
   BaseFacilitator: () => BaseFacilitator,
   CDPFacilitator: () => CDPFacilitator,
@@ -1253,6 +1258,365 @@ async function createSolanaPaymentTransaction(senderPubkey, recipientPubkey, amo
   return transaction;
 }
 
+// src/facilitators/alipay.ts
+var import_node_crypto2 = __toESM(require("crypto"));
+
+// src/facilitators/alipay/rsa2.ts
+var import_node_crypto = __toESM(require("crypto"));
+function rsa2Sign(data, privateKeyPem) {
+  const signer = import_node_crypto.default.createSign("RSA-SHA256");
+  signer.update(data, "utf-8");
+  signer.end();
+  return signer.sign(privateKeyPem, "base64");
+}
+
+// src/facilitators/alipay/encoding.ts
+function base64url(input) {
+  return Buffer.from(input, "utf-8").toString("base64url");
+}
+function decodeBase64UrlWithPadFix(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+  return Buffer.from(padded, "base64").toString("utf-8");
+}
+
+// src/facilitators/alipay/openapi.ts
+function formatAlipayTimestamp(d = /* @__PURE__ */ new Date()) {
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+}
+function buildSigningString(params) {
+  return Object.keys(params).sort().map((k) => `${k}=${params[k]}`).join("&");
+}
+function responseWrapperKey(method) {
+  return `${method.replace(/\./g, "_")}_response`;
+}
+async function alipayOpenApiCall(method, bizContent, config) {
+  const publicParams = {
+    app_id: config.app_id,
+    method,
+    format: "JSON",
+    charset: "utf-8",
+    sign_type: config.sign_type ?? "RSA2",
+    timestamp: formatAlipayTimestamp(),
+    version: "1.0",
+    biz_content: JSON.stringify(bizContent)
+  };
+  const signingString = buildSigningString(publicParams);
+  const sign = rsa2Sign(signingString, config.private_key_pem);
+  const body = new URLSearchParams({ ...publicParams, sign }).toString();
+  const response = await fetch(config.gateway_url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded;charset=utf-8"
+    },
+    body
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "<unreadable>");
+    throw new Error(
+      `Alipay Open API HTTP ${response.status} for ${method}: ${text.slice(0, 500)}`
+    );
+  }
+  const json = await response.json();
+  const wrapperKey = responseWrapperKey(method);
+  const business = json[wrapperKey];
+  if (business === void 0 || business === null || typeof business !== "object") {
+    throw new Error(
+      `Alipay Open API response missing "${wrapperKey}" wrapper for ${method}: ${JSON.stringify(json).slice(0, 500)}`
+    );
+  }
+  return business;
+}
+
+// src/facilitators/alipay.ts
+var ALIPAY_NETWORK = "alipay";
+var ALIPAY_SCHEME = "alipay-aipay";
+var ALIPAY_GATEWAY_PROD = "https://openapi.alipay.com/gateway.do";
+var ALIPAY_GATEWAY_SANDBOX = "https://openapi.alipaydev.com/gateway.do";
+var ALIPAY_AMOUNT_REGEX = /^\d+(\.\d{1,2})?$/;
+var ALIPAY_PAY_BEFORE_MS = 30 * 60 * 1e3;
+var ALIPAY_SIGNING_FIELDS = [
+  "amount",
+  "currency",
+  "goods_name",
+  "out_trade_no",
+  "pay_before",
+  "resource_id",
+  "seller_id",
+  "service_id"
+];
+var AlipayFacilitator = class extends BaseFacilitator {
+  name = "alipay";
+  displayName = "Alipay AI \u6536";
+  supportedNetworks = [ALIPAY_NETWORK];
+  config;
+  constructor(config) {
+    super();
+    this.config = {
+      gateway_url: ALIPAY_GATEWAY_PROD,
+      sign_type: "RSA2",
+      ...config
+    };
+  }
+  /**
+   * Build the 402 challenge for a service: signs the 8-field payload with
+   * RSA2, packages the nested `{protocol, method}` JSON as Base64URL for
+   * `Payment-Needed`, and emits the parallel x402 `accepts[]` entry.
+   */
+  async createPaymentRequirements(opts) {
+    if (!ALIPAY_AMOUNT_REGEX.test(opts.priceCny)) {
+      throw new Error(
+        `AlipayFacilitator.createPaymentRequirements: priceCny "${opts.priceCny}" does not match /^\\d+(\\.\\d{1,2})?$/ (unit is \u5143, not \u5206; e.g. "1.00" not "100")`
+      );
+    }
+    const now = /* @__PURE__ */ new Date();
+    const outTradeNo = opts.outTradeNo ?? generateOutTradeNo();
+    const payBefore = formatPayBefore(now);
+    const signedFields = {
+      amount: opts.priceCny,
+      currency: "CNY",
+      goods_name: opts.goodsName,
+      out_trade_no: outTradeNo,
+      pay_before: payBefore,
+      resource_id: opts.resourceId,
+      seller_id: this.config.seller_id,
+      service_id: opts.serviceId
+    };
+    const signingString = ALIPAY_SIGNING_FIELDS.map((k) => `${k}=${signedFields[k]}`).join("&");
+    const seller_signature = rsa2Sign(signingString, this.config.private_key_pem);
+    const challenge = {
+      protocol: {
+        out_trade_no: outTradeNo,
+        amount: signedFields.amount,
+        currency: signedFields.currency,
+        resource_id: signedFields.resource_id,
+        pay_before: payBefore,
+        seller_signature,
+        seller_sign_type: this.config.sign_type ?? "RSA2",
+        seller_unique_id: this.config.seller_id
+      },
+      method: {
+        seller_name: this.config.seller_name,
+        seller_id: this.config.seller_id,
+        seller_app_id: this.config.app_id,
+        goods_name: signedFields.goods_name,
+        seller_unique_id_key: "seller_id",
+        service_id: signedFields.service_id
+      }
+    };
+    const paymentNeededHeader = base64url(JSON.stringify(challenge));
+    const x402Accepts = {
+      scheme: ALIPAY_SCHEME,
+      network: ALIPAY_NETWORK,
+      asset: "CNY",
+      amount: opts.priceCny,
+      payTo: this.config.seller_id,
+      maxTimeoutSeconds: ALIPAY_PAY_BEFORE_MS / 1e3,
+      extra: {
+        payment_needed_header: paymentNeededHeader,
+        out_trade_no: outTradeNo,
+        pay_before: payBefore,
+        service_id: signedFields.service_id
+      }
+    };
+    return { x402Accepts, paymentNeededHeader };
+  }
+  /**
+   * Verify a `Payment-Proof` by calling
+   * `alipay.aipay.agent.payment.verify` against the Alipay Open API.
+   *
+   * The proof is conveyed via `paymentPayload.payload`, which may be:
+   * - a raw Base64URL string (the `Payment-Proof` header value), or
+   * - an object `{ paymentProof: string }` / `{ proofHeader: string }`.
+   *
+   * All failure modes (malformed payload, network errors, Alipay
+   * `code != 10000`) return `{ valid: false, error }`. No exception
+   * escapes, regardless of client-supplied input.
+   */
+  async verify(paymentPayload, _requirements) {
+    try {
+      const proofHeader = extractProofHeader(paymentPayload.payload);
+      const decoded = decodeProof(proofHeader);
+      const response = await alipayOpenApiCall(
+        "alipay.aipay.agent.payment.verify",
+        {
+          payment_proof: decoded.protocol.payment_proof,
+          trade_no: decoded.protocol.trade_no,
+          client_session: decoded.method.client_session
+        },
+        this.getOpenApiConfig()
+      );
+      if (response.code !== "10000") {
+        return {
+          valid: false,
+          error: `alipay verify ${response.code}: ${response.sub_msg ?? response.msg ?? "unknown"}`,
+          details: {
+            code: response.code,
+            sub_code: response.sub_code,
+            sub_msg: response.sub_msg
+          }
+        };
+      }
+      return {
+        valid: true,
+        details: {
+          trade_no: response.trade_no ?? decoded.protocol.trade_no,
+          amount: response.amount,
+          out_trade_no: response.out_trade_no,
+          resource_id: response.resource_id,
+          active: response.active
+        }
+      };
+    } catch (e) {
+      return {
+        valid: false,
+        error: e instanceof Error ? e.message : String(e)
+      };
+    }
+  }
+  /**
+   * Settle by calling `alipay.aipay.agent.fulfillment.confirm` after the
+   * service resource has been returned to the buyer.
+   *
+   * Per the design (see ALIPAY-INTEGRATION-DESIGN.md §5.1, risk row
+   * "履约确认失败"), this is **fire-and-forget**: the caller (registry /
+   * server) is expected to log fulfillment failures but NOT roll back
+   * the already-delivered resource.
+   *
+   * Re-decodes `paymentPayload.payload` to extract `trade_no` (verify
+   * does the same; the redundant Base64URL decode is negligible).
+   */
+  async settle(paymentPayload, _requirements) {
+    try {
+      const proofHeader = extractProofHeader(paymentPayload.payload);
+      const decoded = decodeProof(proofHeader);
+      const tradeNo = decoded.protocol.trade_no;
+      const response = await alipayOpenApiCall(
+        "alipay.aipay.agent.fulfillment.confirm",
+        { trade_no: tradeNo },
+        this.getOpenApiConfig()
+      );
+      if (response.code !== "10000") {
+        return {
+          success: false,
+          transaction: tradeNo,
+          error: `alipay fulfillment ${response.code}: ${response.sub_msg ?? response.msg ?? "unknown"}`,
+          status: "fulfillment_failed"
+        };
+      }
+      return {
+        success: true,
+        transaction: tradeNo,
+        status: "fulfilled"
+      };
+    } catch (e) {
+      return {
+        success: false,
+        error: e instanceof Error ? e.message : String(e)
+      };
+    }
+  }
+  /**
+   * Validate that the configured RSA keys parse and that the Open API
+   * gateway is reachable. Does NOT make a real business API call (would
+   * burn quota and could appear as a legitimate verify attempt in logs).
+   */
+  async healthCheck() {
+    const start = Date.now();
+    try {
+      import_node_crypto2.default.createPrivateKey(this.config.private_key_pem);
+    } catch (e) {
+      return {
+        healthy: false,
+        error: `merchant private_key_pem parse failed: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+    try {
+      import_node_crypto2.default.createPublicKey(this.config.alipay_public_key_pem);
+    } catch (e) {
+      return {
+        healthy: false,
+        error: `alipay_public_key_pem parse failed: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+    const gatewayUrl = this.config.gateway_url ?? ALIPAY_GATEWAY_PROD;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5e3);
+    const response = await fetch(gatewayUrl, {
+      method: "HEAD",
+      signal: controller.signal
+    }).catch(() => null);
+    clearTimeout(timeout);
+    const latencyMs = Date.now() - start;
+    if (!response) {
+      return { healthy: false, error: `gateway unreachable: ${gatewayUrl}`, latencyMs };
+    }
+    return { healthy: true, latencyMs };
+  }
+  /** Bundle the facilitator config into the shape openapi.ts wants. */
+  getOpenApiConfig() {
+    return {
+      gateway_url: this.config.gateway_url ?? ALIPAY_GATEWAY_PROD,
+      app_id: this.config.app_id,
+      private_key_pem: this.config.private_key_pem,
+      alipay_public_key_pem: this.config.alipay_public_key_pem,
+      sign_type: this.config.sign_type
+    };
+  }
+};
+function generateOutTradeNo() {
+  return "VID" + import_node_crypto2.default.randomBytes(22).toString("base64url").slice(0, 29);
+}
+function formatPayBefore(now) {
+  const expiry = new Date(now.getTime() + ALIPAY_PAY_BEFORE_MS);
+  return expiry.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function extractProofHeader(payload) {
+  if (typeof payload === "string") {
+    if (payload.length === 0) {
+      throw new Error("alipay Payment-Proof is empty");
+    }
+    return payload;
+  }
+  if (payload !== null && typeof payload === "object") {
+    const obj = payload;
+    const candidate = obj.paymentProof ?? obj.proofHeader;
+    if (typeof candidate === "string" && candidate.length > 0) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    "alipay payment payload must be a Base64URL string or {paymentProof: string} / {proofHeader: string}"
+  );
+}
+function decodeProof(proofHeader) {
+  let parsed;
+  try {
+    parsed = JSON.parse(decodeBase64UrlWithPadFix(proofHeader));
+  } catch (e) {
+    throw new Error(
+      `failed to decode Payment-Proof: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    throw new Error("decoded Payment-Proof is not an object");
+  }
+  const obj = parsed;
+  const protocol = obj.protocol;
+  const method = obj.method;
+  if (!protocol || typeof protocol.payment_proof !== "string") {
+    throw new Error("decoded Payment-Proof missing protocol.payment_proof");
+  }
+  if (typeof protocol.trade_no !== "string") {
+    throw new Error("decoded Payment-Proof missing protocol.trade_no");
+  }
+  if (!method || typeof method.client_session !== "string") {
+    throw new Error("decoded Payment-Proof missing method.client_session");
+  }
+  return parsed;
+}
+
 // src/facilitators/registry.ts
 var import_web33 = require("@solana/web3.js");
 var import_bs58 = __toESM(require("bs58"));
@@ -1277,6 +1641,7 @@ var FacilitatorRegistry = class {
       }
       return new SolanaFacilitator({ feePayerKeypair });
     });
+    this.registerFactory("alipay", (config) => new AlipayFacilitator(config));
     this.selection = selection || { primary: "cdp", fallback: ["tempo", "bnb", "solana"], strategy: "failover" };
   }
   /**
@@ -1504,6 +1869,11 @@ function createRegistry(selection) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ALIPAY_GATEWAY_PROD,
+  ALIPAY_GATEWAY_SANDBOX,
+  ALIPAY_NETWORK,
+  ALIPAY_SCHEME,
+  AlipayFacilitator,
   BNBFacilitator,
   BaseFacilitator,
   CDPFacilitator,