ERC-8214: Buy Now Pay Later (BNPL)

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";

/**
 * @title IPaymentAuth
 * @notice Pluggable interface for pulling ERC-20 tokens from a payer.
 * @dev Each implementation encapsulates one authorization model.
 *      The authData parameter carries strategy-specific data
 *      (signatures, proofs, empty bytes) and is opaque to IBNPL callers.
 *
 *      ERC-165 interface identifier (excludes supportsInterface per ERC-165 convention):
 *        pullPayment(address,address,address,uint256,bytes) = 0xc5ee2754
 *        authType()                                         = 0x05915147
 *        IPaymentAuth interfaceId                           = 0xc07f7613
 */
interface IPaymentAuth is IERC165 {

    /**
     * @notice Pull `amount` of `token` from `payer` to `recipient`.
     * @param payer      Address whose tokens are pulled.
     * @param recipient  Address that receives the tokens.
     * @param token      ERC-20 token address.
     * @param amount     Exact amount to pull in token base units.
     * @param authData   Strategy-specific authorization data.
     * @return success   True if tokens were transferred successfully.
     */
    function pullPayment(
        address payer,
        address recipient,
        address token,
        uint256 amount,
        bytes calldata authData
    ) external returns (bool success);

    /**
     * @notice Returns a unique identifier for this authorization strategy type.
     * @dev Allows callers to identify strategy type without inspecting authData.
     *      SHOULD return bytes4(keccak256("StrategyName")).
     */
    function authType() external pure returns (bytes4);
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";

/**
 * @title IOperatorManager
 * @notice Manages addresses authorized to trigger payment collection
 *         on behalf of a merchant.
 *
 *      ERC-165 interface identifier (excludes supportsInterface per ERC-165 convention):
 *        authorizeOperator(address)   = 0x959b8c3f
 *        revokeOperator(address)      = 0xfad8b32a
 *        isOperator(address,address)  = 0xb6363cf2
 *        IOperatorManager interfaceId = 0xd97503e7
 */
interface IOperatorManager is IERC165 {

    event OperatorAuthorized(
        address indexed operator,
        address indexed merchant
    );

    event OperatorRevoked(
        address indexed operator,
        address indexed merchant
    );

    /**
     * @notice Authorize an operator to collect on behalf of the caller.
     * @dev MUST revert if operator is the zero address.
     *      MUST revert if operator is already authorized.
     *      Caller becomes the merchant for this authorization.
     */
    function authorizeOperator(address operator) external;

    /**
     * @notice Revoke a previously authorized operator.
     * @dev MUST revert if operator is not currently authorized for the caller.
     */
    function revokeOperator(address operator) external;

    /**
     * @notice Check whether an address is an authorized operator for a merchant.
     * @param operator  The address to check.
     * @param merchant  The merchant whose operator set is checked.
     * @return True if operator is authorized for merchant.
     */
    function isOperator(
        address operator,
        address merchant
    ) external view returns (bool);
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
import {IPaymentAuth} from "./IPaymentAuth.sol";

/**
 * @title AllowanceAuth
 * @notice IPaymentAuth strategy using standard ERC-20 allowance.
 * @dev The payer must call token.approve(bnplContract, amount) before
 *      this strategy can pull. authData is unused and MUST be empty.
 *      Uses SafeERC20.safeTransferFrom to handle tokens that do not
 *      return a bool from transferFrom (e.g. USDT on Ethereum mainnet).
 */
contract AllowanceAuth is IPaymentAuth, ReentrancyGuard {
    using SafeERC20 for IERC20;

    bytes4 public constant AUTH_TYPE_ID =
        bytes4(keccak256("AllowanceAuth"));

    function authType() external pure override returns (bytes4) {
        return AUTH_TYPE_ID;
    }

    function pullPayment(
        address payer,
        address recipient,
        address token,
        uint256 amount,
        bytes calldata /* authData */
    ) external override nonReentrant returns (bool) {
        IERC20(token).safeTransferFrom(payer, recipient, amount);
        return true;
    }

    function supportsInterface(bytes4 interfaceId)
        external pure override returns (bool)
    {
        return interfaceId == type(IPaymentAuth).interfaceId
            || interfaceId == type(IERC165).interfaceId;
    }
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {IERC20Permit} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Permit.sol";
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
import {IPaymentAuth} from "./IPaymentAuth.sol";

/**
 * @title PermitAuth
 * @notice IPaymentAuth strategy using ERC-2612 permit signatures.
 * @dev authData MUST be abi.encode(uint256 deadline, uint8 v, bytes32 r, bytes32 s).
 *      The token MUST implement IERC20Permit. If permit() reverts (e.g. unsupported
 *      token, expired deadline, invalid signature), pullPayment reverts.
 *      Uses SafeERC20.safeTransferFrom to handle non-bool-returning tokens.
 */
contract PermitAuth is IPaymentAuth, ReentrancyGuard {
    using SafeERC20 for IERC20;

    bytes4 public constant AUTH_TYPE_ID =
        bytes4(keccak256("PermitAuth"));

    function authType() external pure override returns (bytes4) {
        return AUTH_TYPE_ID;
    }

    function pullPayment(
        address payer,
        address recipient,
        address token,
        uint256 amount,
        bytes calldata authData
    ) external override nonReentrant returns (bool) {
        (uint256 deadline, uint8 v, bytes32 r, bytes32 s) =
            abi.decode(authData, (uint256, uint8, bytes32, bytes32));

        IERC20Permit(token).permit(
            payer,
            address(this),
            amount,
            deadline,
            v, r, s
        );

        IERC20(token).safeTransferFrom(payer, recipient, amount);
        return true;
    }

    function supportsInterface(bytes4 interfaceId)
        external pure override returns (bool)
    {
        return interfaceId == type(IPaymentAuth).interfaceId
            || interfaceId == type(IERC165).interfaceId;
    }
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

import {ISignatureTransfer} from "permit2/src/interfaces/ISignatureTransfer.sol";
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
import {IPaymentAuth} from "./IPaymentAuth.sol";

/**
 * @title Permit2Auth
 * @notice IPaymentAuth strategy using Uniswap Permit2 SignatureTransfer.
 * @dev authData MUST be abi.encode(uint256 nonce, uint256 deadline, bytes signature).
 *      The payer must have approved the canonical Permit2 contract on the token.
 *      Each signature is single-use; nonce is consumed on first use.
 */
contract Permit2Auth is IPaymentAuth, ReentrancyGuard {

    bytes4 public constant AUTH_TYPE_ID =
        bytes4(keccak256("Permit2Auth"));

    /// @notice Canonical Permit2 deployment address.
    address public constant PERMIT2 =
        0x000000000022D473030F116dDEE9F6B43aC78BA3;

    function authType() external pure override returns (bytes4) {
        return AUTH_TYPE_ID;
    }

    function pullPayment(
        address payer,
        address recipient,
        address token,
        uint256 amount,
        bytes calldata authData
    ) external override nonReentrant returns (bool) {
        (uint256 nonce, uint256 deadline, bytes memory signature) =
            abi.decode(authData, (uint256, uint256, bytes));

        ISignatureTransfer(PERMIT2).permitTransferFrom(
            ISignatureTransfer.PermitTransferFrom({
                permitted: ISignatureTransfer.TokenPermissions({
                    token: token,
                    amount: amount
                }),
                nonce: nonce,
                deadline: deadline
            }),
            ISignatureTransfer.SignatureTransferDetails({
                to: recipient,
                requestedAmount: amount
            }),
            payer,
            signature
        );

        return true;
    }

    function supportsInterface(bytes4 interfaceId)
        external pure override returns (bool)
    {
        return interfaceId == type(IPaymentAuth).interfaceId
            || interfaceId == type(IERC165).interfaceId;
    }
}

bytes32 leaf = keccak256(abi.encode(
    uint256 installmentIndex,   // 0-indexed; makes every leaf unique even if amount and dueDate repeat
    uint256 amount,             // token base units
    uint256 dueDate             // unix timestamp; collectInstallment enforces block.timestamp >= dueDate
));

// Internal node hashing (sort children before hashing):
bytes32 node = keccak256(abi.encode(
    left < right ? left : right,
    left < right ? right : left
));

Leaf0 = keccak256(abi.encode(uint256(0), uint256(500000), uint256(1740000000)))
Leaf1 = keccak256(abi.encode(uint256(1), uint256(750000), uint256(1742592000)))
Root  = keccak256(abi.encode(min(Leaf0,Leaf1), max(Leaf0,Leaf1)))

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
import {MerkleProof} from "@openzeppelin/contracts/utils/cryptography/MerkleProof.sol";
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
import {IPaymentAuth} from "./IPaymentAuth.sol";

/**
 * @title MerkleScheduleAuth
 * @notice IPaymentAuth strategy for variable-amount installment schedules
 *         committed via a merkle root at order creation time.
 *
 * @dev Usage pattern:
 *   1. Merchant pre-computes orderId (deterministic from createOrder inputs).
 *   2. Merchant calls registerSchedule(orderId, merkleRoot, dataCID) to commit
 *      the schedule. This MUST happen in the same transaction as createOrder
 *      (use a multicall wrapper).
 *   3. For each installment, the caller provides authData encoding
 *      (installmentIndex, amount, dueDate, proof[]).
 *   4. pullPayment verifies the proof, enforces dueDate, marks the leaf
 *      consumed, and pulls the exact amount from the leaf.
 *
 * authData encoding: abi.encode(
 *     uint256 installmentIndex,
 *     uint256 amount,
 *     uint256 dueDate,
 *     bytes32[] proof
 * )
 *
 * Callers MUST pass the exact leaf amount as the `amount` parameter to pullPayment.
 * The strategy validates that amount == leafAmount from authData, reverting if they
 * differ. This is consistent with all other IPaymentAuth strategies where the
 * caller's amount parameter is authoritative.
 *
 * Uses SafeERC20.safeTransferFrom to handle non-bool-returning tokens.
 */
contract MerkleScheduleAuth is IPaymentAuth, ReentrancyGuard {
    using SafeERC20 for IERC20;

    bytes4 public constant AUTH_TYPE_ID =
        bytes4(keccak256("MerkleScheduleAuth"));

    // ============ Storage ============

    /// @notice Merkle root committed for each order.
    /// @dev orderId => merkleRoot. Zero value means no schedule registered.
    mapping(bytes32 => bytes32) public scheduleRoots;

    /// @notice Content-addressed reference to the full leaf set for each order.
    /// @dev orderId => CID bytes (e.g. IPFS CIDv1 in bytes). Data availability commitment.
    mapping(bytes32 => bytes) public scheduleDataCIDs;

    /// @notice Tracks consumed leaves to prevent replay.
    /// @dev orderId => leafHash => consumed.
    mapping(bytes32 => mapping(bytes32 => bool)) public consumed;

    // ============ Events ============

    /**
     * @notice Emitted when a merchant registers a payment schedule for an order.
     * @param orderId     The BNPL order this schedule applies to.
     * @param merkleRoot  Root of the merkle tree of (index, amount, dueDate) leaves.
     * @param dataCID     Content-addressed reference to the full leaf set.
     */
    event ScheduleRegistered(
        bytes32 indexed orderId,
        bytes32 merkleRoot,
        bytes   dataCID
    );

    /**
     * @notice Emitted when a leaf is consumed (installment collected).
     * @param orderId           The order.
     * @param installmentIndex  The 0-indexed installment.
     * @param leafHash          The consumed leaf hash.
     */
    event LeafConsumed(
        bytes32 indexed orderId,
        uint256 installmentIndex,
        bytes32 leafHash
    );

    // ============ Registration ============

    /**
     * @notice Register a variable payment schedule for an order.
     *
     * @dev MUST be called by the merchant in the same transaction as
     *      IBNPL.createOrder (via multicall). The orderId is deterministic
     *      and can be pre-computed before createOrder is submitted.
     *
     *      MUST revert if a schedule is already registered for this orderId
     *      (prevents a merchant from replacing a committed schedule after
     *      the customer has signed the OrderAuthorization).
     *
     *      MUST revert if merkleRoot is bytes32(0).
     *      MUST revert if dataCID is empty.
     *
     * @param orderId     The IBNPL order identifier (pre-computable).
     * @param merkleRoot  Root of the (installmentIndex, amount, dueDate) merkle tree.
     * @param dataCID     IPFS CID or other content-addressed reference to the full
     *                    leaf set. MUST be non-empty. Publishing the leaf set to the
     *                    referenced location is the merchant's responsibility.
     */
    function registerSchedule(
        bytes32 orderId,
        bytes32 merkleRoot,
        bytes calldata dataCID
    ) external {
        require(
            scheduleRoots[orderId] == bytes32(0),
            "MerkleScheduleAuth: schedule already registered"
        );
        require(merkleRoot != bytes32(0), "MerkleScheduleAuth: empty root");
        require(dataCID.length > 0,       "MerkleScheduleAuth: empty dataCID");

        scheduleRoots[orderId]    = merkleRoot;
        scheduleDataCIDs[orderId] = dataCID;

        emit ScheduleRegistered(orderId, merkleRoot, dataCID);
    }

    // ============ IPaymentAuth ============

    function authType() external pure override returns (bytes4) {
        return AUTH_TYPE_ID;
    }

    /**
     * @notice Pull an installment amount verified against the committed schedule.
     *
     * @dev The `amount` parameter supplied by the caller is validated against
     *      the leaf amount. Callers MUST pass the exact leaf amount as `amount`;
     *      the strategy validates amount == leafAmount and reverts if they differ.
     *
     *      authData MUST be abi.encode(
     *          uint256 installmentIndex,
     *          uint256 leafAmount,
     *          uint256 dueDate,
     *          bytes32[] proof
     *      )
     *
     *      The orderId is recovered from the payer and recipient context via
     *      msg.sender (the IBNPL contract), which MUST be the registered caller.
     *      The IBNPL contract MUST pass the orderId in a wrapper or the strategy
     *      MUST be called with orderId in the authData. This implementation
     *      includes orderId in authData for self-contained verification.
     *
     *      Full authData: abi.encode(
     *          bytes32 orderId,
     *          uint256 installmentIndex,
     *          uint256 leafAmount,
     *          uint256 dueDate,
     *          bytes32[] proof
     *      )
     *
     * @param payer      Customer address (tokens pulled from here).
     * @param recipient  Merchant address (tokens delivered here).
     * @param token      ERC-20 token address.
     * @param amount     MUST equal the leaf amount decoded from authData. Reverts otherwise.
     * @param authData   abi.encode(orderId, installmentIndex, leafAmount, dueDate, proof[]).
     * @return success   True if the pull succeeded.
     */
    function pullPayment(
        address payer,
        address recipient,
        address token,
        uint256 amount,
        bytes calldata authData
    ) external override nonReentrant returns (bool) {
        (
            bytes32 orderId,
            uint256 installmentIndex,
            uint256 leafAmount,
            uint256 dueDate,
            bytes32[] memory proof
        ) = abi.decode(authData, (bytes32, uint256, uint256, uint256, bytes32[]));

        // Caller must pass the exact leaf amount — consistent with all other strategies
        require(
            amount == leafAmount,
            "MerkleScheduleAuth: amount must equal leaf amount"
        );

        // Schedule must be registered for this order
        bytes32 root = scheduleRoots[orderId];
        require(root != bytes32(0), "MerkleScheduleAuth: no schedule registered");

        // Reconstruct and verify the leaf
        bytes32 leaf = keccak256(abi.encode(installmentIndex, leafAmount, dueDate));
        require(
            !consumed[orderId][leaf],
            "MerkleScheduleAuth: leaf already consumed"
        );
        require(
            MerkleProof.verify(proof, root, leaf),
            "MerkleScheduleAuth: invalid proof"
        );

        // Enforce due date
        require(
            block.timestamp >= dueDate,
            "MerkleScheduleAuth: payment not yet due"
        );

        // Mark consumed before transfer (checks-effects-interactions)
        consumed[orderId][leaf] = true;
        emit LeafConsumed(orderId, installmentIndex, leaf);

        // Pull tokens — SafeERC20 handles non-bool-returning tokens (e.g. USDT)
        IERC20(token).safeTransferFrom(payer, recipient, leafAmount);
        return true;
    }

    // ============ View Functions ============

    /**
     * @notice Check whether a specific leaf has been consumed.
     * @param orderId           The order identifier.
     * @param installmentIndex  0-indexed installment position.
     * @param leafAmount        Installment amount in token base units.
     * @param dueDate           Installment due date as unix timestamp.
     * @return True if this leaf has already been collected.
     */
    function isLeafConsumed(
        bytes32 orderId,
        uint256 installmentIndex,
        uint256 leafAmount,
        uint256 dueDate
    ) external view returns (bool) {
        bytes32 leaf = keccak256(abi.encode(installmentIndex, leafAmount, dueDate));
        return consumed[orderId][leaf];
    }

    /**
     * @notice Verify a proof without consuming the leaf.
     * @param orderId           The order identifier.
     * @param installmentIndex  0-indexed installment position.
     * @param leafAmount        Installment amount.
     * @param dueDate           Installment due date.
     * @param proof             Merkle proof.
     * @return valid            True if the proof is valid against the registered root.
     */
    function verifyInstallment(
        bytes32 orderId,
        uint256 installmentIndex,
        uint256 leafAmount,
        uint256 dueDate,
        bytes32[] calldata proof
    ) external view returns (bool valid) {
        bytes32 root = scheduleRoots[orderId];
        if (root == bytes32(0)) return false;
        bytes32 leaf = keccak256(abi.encode(installmentIndex, leafAmount, dueDate));
        return MerkleProof.verify(proof, root, leaf);
    }

    function supportsInterface(bytes4 interfaceId)
        external pure override returns (bool)
    {
        return interfaceId == type(IPaymentAuth).interfaceId
            || interfaceId == type(IERC165).interfaceId;
    }
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
import {IPaymentAuth} from "./IPaymentAuth.sol";

/**
 * @title IEIP3009 (minimal subset)
 * @dev Interface for tokens implementing ERC-3009 transferWithAuthorization.
 *      Primary implementation: USDC v2+.
 */
interface IEIP3009 {
    /**
     * @notice Execute a transfer with a signed authorization.
     * @dev receiveWithAuthorization enforces msg.sender == to, preventing
     *      front-running attacks where an attacker extracts the authorization
     *      from the mempool and redirects the transfer.
     *      Use this function (not transferWithAuthorization) when calling
     *      from a smart contract.
     */
    function receiveWithAuthorization(
        address from,
        address to,
        uint256 value,
        uint256 validAfter,
        uint256 validBefore,
        bytes32 nonce,
        bytes calldata signature
    ) external;

    /**
     * @notice Returns the state of an authorization nonce.
     * @param authorizer  The authorizer's address.
     * @param nonce       The nonce to check.
     * @return True if the nonce has been used.
     */
    function authorizationState(
        address authorizer,
        bytes32 nonce
    ) external view returns (bool);
}

/**
 * @title EIP3009Auth
 * @notice IPaymentAuth strategy using ERC-3009 receiveWithAuthorization.
 *
 * @dev Uses receiveWithAuthorization (not transferWithAuthorization) to
 *      prevent front-running. msg.sender must equal the `to` address in the
 *      authorization — this contract's address must be the recipient, so the
 *      BNPL contract must forward tokens via this strategy as the caller.
 *
 *      No allowance is created at any point. The token transfer is atomic
 *      with the authorization submission.
 *
 *      Token support: USDC v2+, EURC, and other ERC-3009 tokens.
 *      Not compatible with USDT, WETH, or tokens lacking transferWithAuthorization.
 *
 *      ERC-3009 remains in Draft status. Monitor for spec changes.
 *
 *      authData: abi.encode(
 *          uint256 validAfter,    // timestamp after which auth is valid (0 = immediately)
 *          uint256 validBefore,   // timestamp before which auth is valid (use deadline)
 *          bytes32 nonce,         // random 32-byte nonce, unique per authorization
 *          bytes   signature      // EIP-712 sig over ReceiveWithAuthorization struct
 *      )
 *
 * ReceiveWithAuthorization EIP-712 type string:
 *   "ReceiveWithAuthorization(address from,address to,uint256 value,
 *    uint256 validAfter,uint256 validBefore,bytes32 nonce)"
 *
 * Domain separator uses the token's own domain (name, version, chainId,
 * verifyingContract = token address) — NOT this contract's domain.
 * The customer must sign using the USDC token's EIP-712 domain.
 */
contract EIP3009Auth is IPaymentAuth, ReentrancyGuard {

    bytes4 public constant AUTH_TYPE_ID = bytes4(keccak256("EIP3009Auth"));

    // ============ IPaymentAuth ============

    function authType() external pure override returns (bytes4) {
        return AUTH_TYPE_ID;
    }

    /**
     * @notice Pull tokens using ERC-3009 receiveWithAuthorization.
     *
     * @dev The `to` field in the signed authorization MUST equal `recipient`
     *      (the merchant address). The authorization is verified and consumed
     *      atomically by the token contract. No transferFrom is called.
     *
     *      authData MUST be abi.encode(
     *          uint256 validAfter,
     *          uint256 validBefore,
     *          bytes32 nonce,
     *          bytes   signature
     *      )
     *
     * @param payer      Address that signed the authorization (the `from` field).
     * @param recipient  Address receiving tokens (the `to` field in the authorization).
     * @param token      ERC-3009 token address (e.g. USDC).
     * @param amount     Exact transfer amount — must match the `value` in the authorization.
     * @param authData   ABI-encoded (validAfter, validBefore, nonce, signature).
     */
    function pullPayment(
        address payer,
        address recipient,
        address token,
        uint256 amount,
        bytes calldata authData
    ) external override nonReentrant returns (bool) {
        (
            uint256 validAfter,
            uint256 validBefore,
            bytes32 nonce,
            bytes memory signature
        ) = abi.decode(authData, (uint256, uint256, bytes32, bytes));

        // receiveWithAuthorization requires msg.sender == to.
        // This contract calls the token; msg.sender from the token's
        // perspective is this contract. The `to` in the authorization
        // must equal `recipient` (the merchant). The BNPL contract must
        // ensure this contract is called such that recipient == to in sig.
        IEIP3009(token).receiveWithAuthorization(
            payer,
            recipient,
            amount,
            validAfter,
            validBefore,
            nonce,
            signature
        );

        return true;
    }

    // ============ View Functions ============

    /**
     * @notice Check whether an authorization nonce has been consumed.
     * @dev Delegates to the token contract's authorizationState.
     *      Use this to verify a nonce is still valid before attempting collection.
     */
    function isNonceUsed(
        address token,
        address authorizer,
        bytes32 nonce
    ) external view returns (bool) {
        return IEIP3009(token).authorizationState(authorizer, nonce);
    }

    // ============ ERC-165 ============

    function supportsInterface(bytes4 interfaceId)
        external pure override returns (bool)
    {
        return interfaceId == type(IPaymentAuth).interfaceId
            || interfaceId == type(IERC165).interfaceId;
    }
}

// EIP-712 type string (single line, no whitespace):
// "OrderAuthorization(address merchant,address token,uint256 totalAmount,
//  uint8 installments,uint256 downPaymentBps,uint256 installmentPeriod,
//  uint256 gracePeriod,uint256 lateFeeBps,address downPaymentAuthStrategy,
//  address installmentAuthStrategy,uint256 nonce,uint256 deadline)"

struct OrderAuthorization {
    address merchant;                // The merchant receiving payments
    address token;                   // ERC-20 token used for all payments
    uint256 totalAmount;             // Total order value in token base units
    uint8   installments;            // Post-down-payment installment count (2–12)
    uint256 downPaymentBps;          // Down payment as bps of totalAmount (1000–5000)
    uint256 installmentPeriod;       // Seconds between installments
    uint256 gracePeriod;             // Seconds after due date before default is possible
    uint256 lateFeeBps;              // Late fee as bps of installment amount (0–1500)
    address downPaymentAuthStrategy; // IPaymentAuth for the down payment
    address installmentAuthStrategy; // IPaymentAuth for installments
    uint256 nonce;                   // Per-customer nonce; prevents authorization replay
    uint256 deadline;                // Unix timestamp after which this authorization expires
}

bytes32 DOMAIN_SEPARATOR = keccak256(abi.encode(
    keccak256(
        "EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"
    ),
    keccak256(bytes("BNPL")),
    keccak256(bytes("1")),
    block.chainid,
    address(this)
));

// Precomputed: keccak256("OrderAuthorization(address merchant,address token,uint256 totalAmount,uint8 installments,uint256 downPaymentBps,uint256 installmentPeriod,uint256 gracePeriod,uint256 lateFeeBps,address downPaymentAuthStrategy,address installmentAuthStrategy,uint256 nonce,uint256 deadline)")
bytes32 constant ORDER_AUTHORIZATION_TYPEHASH = 0x68c5443e5040df5f1ed96a455ea7294876fb94e43e188f9c3a81b67c21a9be41;

bytes32 digest = keccak256(abi.encodePacked(
    "\x19\x01",
    DOMAIN_SEPARATOR,
    keccak256(abi.encode(
        ORDER_AUTHORIZATION_TYPEHASH,
        authorization.merchant,
        authorization.token,
        authorization.totalAmount,
        authorization.installments,
        authorization.downPaymentBps,
        authorization.installmentPeriod,
        authorization.gracePeriod,
        authorization.lateFeeBps,
        authorization.downPaymentAuthStrategy,
        authorization.installmentAuthStrategy,
        authorization.nonce,
        authorization.deadline
    ))
));

// For EOA wallets:
address recovered = ECDSA.recover(digest, customerSig);
require(recovered == customer, "BNPL: invalid signature");

// For smart contract wallets (ERC-1271):
if (customer.code.length > 0) {
    bytes4 result = IERC1271(customer).isValidSignature(digest, customerSig);
    require(result == 0x1626ba7e, "BNPL: invalid contract signature");
}

// SPDX-License-Identifier: CC0-1.0
pragma solidity ^0.8.28;

/**
 * @title IBNPL
 * @notice Standard interface for Buy Now Pay Later BNPL installment orders.
 *
 * @dev Flow overview:
 *
 *   1. At checkout, the merchant presents an OrderAuthorization EIP-712
 *      struct to the customer's wallet. The customer signs it.
 *
 *   2. The merchant calls createOrder(), providing the order parameters,
 *      the customer's signature (customerSig), and authData for the down
 *      payment (downPaymentAuthData). The contract verifies the signature,
 *      consumes the customer's nonce, and collects the down payment atomically.
 *
 *   3. Subsequent installments are collected by calling collectInstallment().
 *      This may be called by the merchant, customer, or any address the
 *      merchant has authorized via IOperatorManager. Collected tokens always
 *      flow customer → merchant; operators never receive funds.
 *
 *   4. When all installments are paid, status transitions to Completed.
 *      The customer may also pay off early via payOffEarly() at any time.
 *
 *   5. If a payment is not made within gracePeriod seconds of nextPaymentDue,
 *      the merchant or an operator may call markDefaulted(). The OrderDefaulted
 *      event carries the outstanding balance for off-chain recovery.
 */
interface IBNPL {

    // ============ Enums ============

    enum OrderStatus {
        Active,     // Order is open; installments are being collected
        Completed,  // All installments have been paid
        Defaulted,  // Customer failed to pay within the grace period
        Cancelled,  // Order was cancelled before completion
        Refunded    // Order was terminated by a merchant-issued refund.
                    // Distinct from Cancelled: signals the order ended due to
                    // a refund, not voluntary termination. paidAmount reflects
                    // the net amount retained by the merchant after the refund.
    }

    // ============ Structs ============

    /**
     * @notice Represents a BNPL installment order.
     *
     * @param customer                  The customer address (payer).
     * @param merchant                  The merchant address (payee).
     * @param token                     ERC-20 token used for all payments.
     * @param downPaymentAuthStrategy   IPaymentAuth used at createOrder for the down payment.
     * @param installmentAuthStrategy   IPaymentAuth used at each collectInstallment.
     * @param totalAmount               Current order value in token base units. Equal to the
     *                                  original order value at creation; reduced by processRefund
     *                                  when a partial refund is issued against an active order.
     * @param paidAmount                Total collected so far including down payment, net of
     *                                  any refunds issued. For a Refunded order, paidAmount
     *                                  reflects the net amount retained by the merchant.
     * @param refundedAmount            Cumulative amount refunded to the customer across all
     *                                  processRefund calls. Zero until a refund is issued.
     * @param downPaymentBps            Down payment as basis points of the original totalAmount.
     * @param installments              Total installment count excluding down payment.
     * @param paidInstallments          Installments successfully collected so far.
     * @param installmentPeriod         Seconds between successive installments.
     * @param nextPaymentDue            Timestamp when the next installment is collectible.
     * @param gracePeriod               Seconds after nextPaymentDue before default is possible.
     * @param lateFeeBps                Late fee basis points applied to the overdue installment
     *                                  if collected after nextPaymentDue but on or before
     *                                  nextPaymentDue + gracePeriod.
     * @param status                    Current order lifecycle state.
     */
    struct Order {
        address     customer;
        address     merchant;
        address     token;
        address     downPaymentAuthStrategy;
        address     installmentAuthStrategy;
        uint256     totalAmount;
        uint256     paidAmount;
        uint256     refundedAmount;
        uint256     downPaymentBps;
        uint8       installments;
        uint8       paidInstallments;
        uint256     installmentPeriod;
        uint256     nextPaymentDue;
        uint256     gracePeriod;
        uint256     lateFeeBps;
        OrderStatus status;
    }

    // ============ Events ============

    /**
     * @notice Emitted when a new order is created and down payment collected.
     */
    event OrderCreated(
        bytes32 indexed orderId,
        address indexed customer,
        address indexed merchant,
        address  token,
        uint256  totalAmount,
        uint8    installments,
        uint256  downPayment,
        address  downPaymentAuthStrategy,
        address  installmentAuthStrategy
    );

    /**
     * @notice Emitted when an installment is successfully collected.
     * @param installmentNumber  1-indexed. First installment after down payment = 1.
     * @param principal          Base installment amount collected.
     * @param lateFee            Late fee collected (0 if paid on or before nextPaymentDue).
     * @param collector          Address that called collectInstallment.
     */
    event InstallmentCollected(
        bytes32 indexed orderId,
        uint8   indexed installmentNumber,
        uint256 principal,
        uint256 lateFee,
        address collector
    );

    /**
     * @notice Emitted when all installments have been paid.
     */
    event OrderCompleted(bytes32 indexed orderId);

    /**
     * @notice Emitted when an order is marked defaulted.
     * @param outstandingAmount  totalAmount - paidAmount at time of default.
     */
    event OrderDefaulted(
        bytes32 indexed orderId,
        uint256 outstandingAmount
    );

    /**
     * @notice Emitted when an order is cancelled.
     * @param cancelledBy    Address that initiated cancellation.
     * @param refundAmount   Amount refunded to the customer in the same transaction.
     *                       MUST be 0 if no refund is made. MUST NOT be non-zero
     *                       unless the refund transfer has already executed.
     */
    event OrderCancelled(
        bytes32 indexed orderId,
        address cancelledBy,
        uint256 refundAmount
    );

    /**
     * @notice Emitted when a refund is processed against an active order.
     * @param orderId          The order identifier.
     * @param refundAmount     Amount transferred to the customer in this refund.
     * @param newTotalAmount   Updated totalAmount after adjustment. Zero if fully refunded.
     * @param fullyRefunded    True if refundAmount >= remaining balance, transitioning
     *                         the order to Refunded status. False for partial refunds
     *                         where the order remains Active with a reduced totalAmount.
     */
    event OrderRefunded(
        bytes32 indexed orderId,
        uint256 refundAmount,
        uint256 newTotalAmount,
        bool    fullyRefunded
    );

    /**
     * @notice Emitted when a customer's authorization nonce is consumed.
     */
    event AuthorizationNonceConsumed(
        address indexed customer,
        uint256 nonce
    );

    // ============ Core Functions ============

    /**
     * @notice Create a new BNPL order and collect the down payment atomically.
     *
     * @dev Called by the merchant. Execution order MUST be:
     *
     *   Step 1 — Validate parameters:
     *     MUST revert if installments < 2 or installments > 12
     *     MUST revert if downPaymentBps < 1000 or downPaymentBps > 5000
     *     MUST revert if lateFeeBps > 1500
     *     MUST revert if gracePeriod > 2592000
     *     MUST revert if totalAmount == 0
     *     MUST revert if block.timestamp > deadline
     *
     *   Step 2 — Validate auth strategy addresses via ERC-165:
     *     MUST revert if downPaymentAuthStrategy does not implement IPaymentAuth
     *     MUST revert if installmentAuthStrategy does not implement IPaymentAuth
     *
     *   Step 3 — Verify customer consent:
     *     MUST reconstruct the OrderAuthorization digest from parameters
     *     MUST verify authorization.nonce == authorizationNonce(customer)
     *     MUST verify customerSig against digest using ECDSA (EOA) or ERC-1271 (contract wallet)
     *     MUST revert if any verification fails
     *
     *   Step 4 — Effects (update state before any external calls):
     *     Increment authorizationNonce[customer]
     *     Generate and store orderId
     *     Store Order struct with status = Active, paidInstallments = 0
     *     Set nextPaymentDue = block.timestamp + installmentPeriod
     *     Emit AuthorizationNonceConsumed
     *
     *   Step 5 — Collect down payment:
     *     downPayment = totalAmount * downPaymentBps / 10000
     *     Call IPaymentAuth(downPaymentAuthStrategy).pullPayment(
     *         customer, merchant, token, downPayment, downPaymentAuthData)
     *     MUST revert if pullPayment returns false
     *     Set paidAmount = downPayment
     *
     *   Step 6 — Emit OrderCreated
     *
     * @param customer                  The customer address.
     * @param token                     ERC-20 token address.
     * @param totalAmount               Total order value in token base units.
     * @param installments              Number of post-down-payment installments (2–12).
     * @param downPaymentBps            Down payment basis points (1000–5000).
     * @param installmentPeriod         Seconds between installments.
     * @param gracePeriod               Grace period in seconds (max 2592000).
     * @param lateFeeBps                Late fee basis points (0–1500).
     * @param downPaymentAuthStrategy   IPaymentAuth for the down payment.
     * @param installmentAuthStrategy   IPaymentAuth for installment collection.
     * @param deadline                  Authorization expiry timestamp.
     * @param customerSig               Customer's EIP-712 signature over OrderAuthorization.
     * @param downPaymentAuthData       Forwarded to downPaymentAuthStrategy.pullPayment.
     * @return orderId                  Unique identifier for the created order.
     */
    function createOrder(
        address customer,
        address token,
        uint256 totalAmount,
        uint8   installments,
        uint256 downPaymentBps,
        uint256 installmentPeriod,
        uint256 gracePeriod,
        uint256 lateFeeBps,
        address downPaymentAuthStrategy,
        address installmentAuthStrategy,
        uint256 deadline,
        bytes   calldata customerSig,
        bytes   calldata downPaymentAuthData
    ) external returns (bytes32 orderId);

    /**
     * @notice Collect the next due installment for an order.
     *
     * @dev Caller MUST be the customer, merchant, or an authorized operator
     *      for the merchant (as determined by IOperatorManager). MUST revert
     *      for any other caller.
     *
     *      Execution order MUST be:
     *
     *   Step 1 — Validate:
     *     MUST revert if order.status != Active
     *     MUST revert if block.timestamp < order.nextPaymentDue
     *     MUST revert if caller is not customer, merchant, or authorized operator
     *
     *   Step 2 — Calculate amounts:
     *     remaining        = totalAmount - (totalAmount * downPaymentBps / 10000)
     *     installmentAmt   = remaining / installments
     *     dust             = remaining % installments
     *     If paidInstallments == installments - 1 (final installment):
     *       installmentAmt += dust
     *     lateFee = 0
     *     If block.timestamp > nextPaymentDue AND
     *        block.timestamp <= nextPaymentDue + gracePeriod:
     *       lateFee = installmentAmt * lateFeeBps / 10000
     *     totalDue = installmentAmt + lateFee
     *
     *   Step 3 — Effects:
     *     paidInstallments += 1
     *     paidAmount += totalDue
     *     nextPaymentDue += installmentPeriod
     *     If paidInstallments == installments: status = Completed
     *
     *   Step 4 — Collect:
     *     Call IPaymentAuth(installmentAuthStrategy).pullPayment(
     *         customer, merchant, token, totalDue, installmentAuthData)
     *     MUST revert if pullPayment returns false
     *
     *   Step 5 — Emit:
     *     Emit InstallmentCollected
     *     If status == Completed: emit OrderCompleted
     *
     * @param orderId               The order to collect an installment for.
     * @param installmentAuthData   Forwarded to installmentAuthStrategy.pullPayment.
     */
    function collectInstallment(
        bytes32 orderId,
        bytes calldata installmentAuthData
    ) external;

    /**
     * @notice Pay off all remaining installments early with no late fee.
     *
     * @dev MUST only be callable by the customer.
     *      MUST revert if order.status != Active.
     *      No late fee applies regardless of current timestamp.
     *      remaining = totalAmount - paidAmount
     *      Calls installmentAuthStrategy.pullPayment for remaining balance.
     *      Sets status = Completed. Emits OrderCompleted.
     *
     * @param orderId   The order to pay off.
     * @param authData  Forwarded to installmentAuthStrategy.pullPayment.
     */
    function payOffEarly(
        bytes32 orderId,
        bytes calldata authData
    ) external;

    /**
     * @notice Mark an active order as defaulted after the grace period has elapsed.
     *
     * @dev MUST only be callable by the merchant or an authorized operator.
     *      MUST revert if order.status != Active.
     *      MUST revert if block.timestamp <= order.nextPaymentDue + order.gracePeriod.
     *      Sets status = Defaulted.
     *      Emits OrderDefaulted(orderId, totalAmount - paidAmount).
     *
     * @param orderId   The order to mark as defaulted.
     */
    function markDefaulted(bytes32 orderId) external;

    /**
     * @notice Cancel an active order.
     *
     * @dev MUST only be callable by the merchant or customer.
     *      MUST revert if order.status != Active.
     *      Sets status = Cancelled.
     *      Emits OrderCancelled(orderId, cancelledBy, refundAmount).
     *
     *      RECOMMENDED refund behavior (implementations MAY deviate but MUST
     *      document their actual refund policy):
     *        Customer-initiated: down payment is forfeit; any installments
     *          collected beyond the down payment are refunded to the customer.
     *        Merchant-initiated: all collected amounts including down payment
     *          are refunded to the customer.
     *
     *      REQUIRED invariant: if OrderCancelled emits refundAmount > 0, the
     *      refund transfer MUST execute in the same transaction before the event
     *      is emitted. Emitting a non-zero refundAmount without executing the
     *      transfer is a violation of this specification.
     *
     * @param orderId   The order to cancel.
     */
    function cancelOrder(bytes32 orderId) external;

    /**
     * @notice Process a merchant-issued refund against an active order.
     *
     * @dev MUST only be callable by the merchant.
     *      MUST revert if order.status != Active.
     *      MUST revert if refundAmount == 0.
     *      MUST revert if refundAmount > paidAmount (cannot refund more than collected).
     *
     *      The merchant MUST hold sufficient token balance and allowance to
     *      execute the refund transfer to the customer. Implementations MUST
     *      use SafeERC20.safeTransferFrom(merchant, customer, refundAmount).
     *
     *      Execution order MUST be:
     *
     *   Step 1 — Validate:
     *     MUST revert if order.status != Active
     *     MUST revert if refundAmount == 0
     *     MUST revert if refundAmount > paidAmount
     *
     *   Step 2 — Determine refund type:
     *     remainingBalance = totalAmount - paidAmount
     *     isFullRefund = refundAmount >= paidAmount
     *       (full refund: customer gets back everything collected so far;
     *        order has nothing left to collect)
     *
     *   Step 3 — Effects:
     *     refundedAmount += refundAmount
     *     paidAmount     -= refundAmount
     *     If isFullRefund:
     *       totalAmount = 0
     *       status      = Refunded
     *     Else (partial refund):
     *       totalAmount -= refundAmount
     *       status remains Active
     *       Recalculate remaining installments from new totalAmount
     *         (implementations MUST document how partial refunds affect
     *          the installment schedule — RECOMMENDED: reduce remaining
     *          installments proportionally by reducing totalAmount only,
     *          keeping installmentPeriod and installments count unchanged,
     *          which results in smaller remaining installment amounts)
     *
     *   Step 4 — Transfer:
     *     SafeERC20.safeTransferFrom(merchant, customer, refundAmount)
     *
     *   Step 5 — Emit:
     *     Emit OrderRefunded(orderId, refundAmount, newTotalAmount, isFullRefund)
     *
     * @param orderId       The order to refund.
     * @param refundAmount  Amount to refund to the customer in token base units.
     */
    function processRefund(
        bytes32 orderId,
        uint256 refundAmount
    ) external;

    // ============ View Functions ============

    /**
     * @notice Retrieve full order data.
     * @dev MUST revert if orderId does not exist.
     */
    function getOrder(bytes32 orderId) external view returns (Order memory);

    /**
     * @notice Calculate amounts due for the next installment at current timestamp.
     *
     * @dev Uses the same calculation as collectInstallment (including dust on final
     *      installment) so that displayed amounts always match collected amounts.
     *
     *      lateFee is 0 if block.timestamp <= nextPaymentDue.
     *      lateFee is installmentAmt * lateFeeBps / 10000 if
     *        block.timestamp > nextPaymentDue AND
     *        block.timestamp <= nextPaymentDue + gracePeriod.
     *      If block.timestamp > nextPaymentDue + gracePeriod, returns the
     *      installment amount and full late fee — order is past default threshold
     *      but has not yet been marked defaulted.
     *
     *      MUST revert if order.status != Active.
     *
     * @return principal   Base installment amount (including dust on final installment).
     * @return lateFee     Late fee at current timestamp (0 if on time).
     */
    function getNextInstallment(bytes32 orderId)
        external view returns (uint256 principal, uint256 lateFee);

    /**
     * @notice Returns the remaining unpaid balance: totalAmount - paidAmount.
     * @dev Returns 0 for Completed and Refunded orders.
     */
    function getRemainingBalance(bytes32 orderId)
        external view returns (uint256);

    /**
     * @notice Check due/grace status at current timestamp.
     * @return pastDue    True if block.timestamp > order.nextPaymentDue.
     * @return pastGrace  True if block.timestamp > order.nextPaymentDue + order.gracePeriod.
     */
    function isOrderPastDue(bytes32 orderId)
        external view returns (bool pastDue, bool pastGrace);

    /**
     * @notice Returns the full installment schedule for an order as parallel arrays.
     *
     * @dev For uniform-schedule orders (all strategies except MerkleScheduleAuth),
     *      the contract derives amounts from the stored Order fields and returns
     *      complete arrays. The final installment includes dust.
     *
     *      For MerkleScheduleAuth installment orders, this function MUST return
     *      empty arrays (amounts.length == 0, dueDates.length == 0) because the
     *      schedule is committed off-chain. Callers SHOULD retrieve the schedule
     *      from the content-addressed store referenced by
     *      MerkleScheduleAuth.scheduleDataCIDs(orderId) in that case.
     *
     *      Index 0 is the first post-down-payment installment.
     *      Already-collected installments MUST still appear in the arrays
     *      so that the full schedule is always visible regardless of progress.
     *      Callers MAY use paidInstallments from getOrder() to determine
     *      which entries have already been collected.
     *
     *      MUST revert if orderId does not exist.
     *      Does NOT revert if order.status != Active — schedule is always readable.
     *
     * @return amounts    Token amounts due for each installment in order.
     *                    amounts[installments-1] includes dust.
     * @return dueDates   Unix timestamps when each installment becomes collectible.
     *                    dueDates[i] = order creation timestamp
     *                                  + installmentPeriod * (i + 1)
     *                    Returns empty array for MerkleScheduleAuth orders.
     */
    function getSchedule(bytes32 orderId)
        external view returns (uint256[] memory amounts, uint256[] memory dueDates);

    /**
     * @notice Returns the current authorization nonce for a customer.
     * @dev This value MUST be included in the OrderAuthorization the customer signs.
     *      Increments by 1 after each successful createOrder.
     */
    function authorizationNonce(address customer)
        external view returns (uint256);
}

createOrder(address,address,uint256,uint8,uint256,uint256,uint256,uint256,address,address,uint256,bytes,bytes) = 0x636122cc
collectInstallment(bytes32,bytes)  = 0x1278b53e
payOffEarly(bytes32,bytes)         = 0x8adb8505
markDefaulted(bytes32)             = 0xecb8bab3
cancelOrder(bytes32)               = 0x7489ec23
processRefund(bytes32,uint256)     = 0xbe0e01c1
getOrder(bytes32)                  = 0x5778472a
getNextInstallment(bytes32)        = 0x67391c52
getSchedule(bytes32)               = 0x3adc277a
getRemainingBalance(bytes32)       = 0x765c328b
isOrderPastDue(bytes32)            = 0x32089582
authorizationNonce(address)        = 0x06a82705

IBNPL interfaceId                  = 0x959cb9a8

bytes4 public constant IBNPL_INTERFACE_ID = 0x959cb9a8;

bytes32 orderId = keccak256(abi.encode(
    customer,
    merchant,
    token,
    totalAmount,
    installments,
    downPaymentBps,
    installmentPeriod,
    block.timestamp,
    authorizationNonce[customer]  // value before increment
));

uint256 downPayment      = totalAmount * downPaymentBps / 10000;
uint256 remaining        = totalAmount - downPayment;
uint256 installmentAmt   = remaining / installments;
uint256 dust             = remaining % installments;
// dust is added to the final installment only
uint256 lastInstallment  = installmentAmt + dust;