SDK : @payvault/protocol

import { generateKeyPair, exportPublicKey, toHex } from "@payvault/protocol";// Non-extractable ECDSA P-256 key. IndexedDB can store the CryptoKeyPair// object itself, so the raw private key never enters JavaScript memory.const keys = await generateKeyPair();               // extractable = falseawait kv.set("device-keys", keys);const publicKeyHex = toHex(await exportPublicKey(keys.publicKey));

import {  bundleToQr, canSpend, parseQr, signPayment, walletBalance,  type WalletState,} from "@payvault/protocol";let queue: Promise<unknown> = Promise.resolve();/** Serialise payments: two concurrent signs from the same state would fork. */export function pay(scannedText: string): Promise<string> {  const run = queue.then(async () => {    const scanned = parseQr(scannedText);    if (scanned.kind !== "request") throw new Error("Not a payment request");    const state = (await kv.get("wallet-state")) as WalletState;    const check = canSpend(state, scanned.request.amount, scanned.request.currency);    if (!check.ok) throw new Error(check.message);       // check.code: expired, over_cap, ...    const keys = (await kv.get("device-keys")) as CryptoKeyPair;    const { payment, state: next } = await signPayment(keys.privateKey, state, scanned.request);    await kv.set("wallet-state", next);                  // 1. persist the new state    return bundleToQr({ cert: next.cert, payment });     // 2. only then show it  });  queue = run.catch(() => undefined);  return run;}console.log(walletBalance(state)); // { cap, spent, remaining, fundedRemaining, creditRemaining, creditUsed, paymentsLeft }

import {  createRequest, decodePayment, encodeBundle, fromHex, importPublicKey,  parseQr, requestToQr, toBase64Url, verifyBundle,} from "@payvault/protocol";// 1. Refresh the cache whenever there is signal.export async function refreshNetwork() {  const net = await (await fetch("/api/network")).json();  await kv.set("network", { ...net, fetchedAt: Date.now() });}// 2. Build the verifier context from the cache and your own records.async function contextFor(request: PaymentRequest) {  const net = await kv.get("network");  const keyCache = new Map<number, CryptoKey>();  return {    issuerKey: async (kid: number) => {      if (!keyCache.has(kid)) {        const k = net.issuerKeys.find((x) => x.kid === kid);        if (!k) return undefined;        keyCache.set(kid, await importPublicKey(fromHex(k.publicKey)));      }      return keyCache.get(kid);    },    isRevoked: (id: string) => net.revocations.some((r) => r.allowanceId === id),    merchantId,    request,    isNonceUsed: (hex: string) => usedNonces.has(hex),    // seen: payments you already hold from the same allowance (from your outbox)  };}export async function charge(amountMinor: number) {  const request = createRequest(merchantId, amountMinor, "NGN", "Mama Ade Stores");  return { request, qr: requestToQr(request) };}export async function accept(scannedText: string, request: PaymentRequest) {  const scanned = parseQr(scannedText);  if (scanned.kind !== "bundle") throw new Error("Not a payment bundle");  const result = await verifyBundle(scanned.bundle, await contextFor(request));  if (!result.ok) return { accepted: false as const, code: result.code };  usedNonces.add(toHex(request.nonce));  await outbox.put(result.id, toBase64Url(encodeBundle(scanned.bundle))); // persist first  return { accepted: true as const, creditDrawn: result.creditDrawn };}

// Give verifyBundle the payments you already hold from the same allowance,// so it can catch duplicates, forks and impossible totals on the spot.const seen = (await outbox.byAllowance(allowanceHex)).map((b) => ({  id: b.id,  payment: decodeBundle(fromBase64Url(b.bundle)).payment,}));await verifyBundle(bundle, { ...ctx, seen });

import { encodeClose, signClose, toBase64Url } from "@payvault/protocol";const state = (await kv.get("wallet-state")) as WalletState;const statement = await signClose(keys.privateKey, state);// The device should stop spending this allowance from now on.await markClosed(allowanceHex);           // your own flag in app storage// Send this to your backend, which posts it to POST /api/v1/allowances/closeconst close = toBase64Url(encodeClose(statement));

import { ProtocolError } from "@payvault/protocol";try {  parseQr(text);} catch (e) {  if (e instanceof ProtocolError) {    // e.code: not_payvault | bad_base45 | bad_version | bad_type | truncated | trailing_bytes ...  }}