UPAY3FOODInstall
05-architecture/payments

Payments: Pix + Solana (shield live, settlement not live)

tags
#note#architecture
reading
1 min · 261 words
links
2 out · 2 in

Pix detection (implemented, read-only)

extractPixPayment reads what the payment screen shows, in order of preference:

  1. visible Pix Copia e Cola payload → parsed as EMV BR Code, CRC16 validated (packages/payments/src/pix), amount from tag 54;
  2. QR code presence (image/canvas/svg hinted as QR);
  3. visible Pix key.

Plus amount (payload or labelled value) and expiration ("Expira em 29:30"). No API interception, no network inspection, no token access.

Private funding (Cloak)

payments/cloak funds the route from the Cloak shielded USDC pool (@cloak.dev/sdk): shield ahead of time, then partialWithdraw to the off-ramp deposit address, so the deposit is not linked on-chain to the user's wallet. The router takes a FundingSource. publicWalletFunding is the default and cloakFundingSource the private one. Privacy scope and limits are in privacy-week.md. The first real browser-wallet shield of 1.000000 USDC was confirmed on Solana mainnet on 2026-10-05; see the canonical proof.

Route (interfaces + mocks)

wallet (USDC on Solana) → off-ramp (licensed partner) → Pix payout
  • solana/: USDC mint constants, WalletAdapter, bigint base units, BRL→USDC conversion with integer rates (rounded up). MockWallet.
  • offramp/: OfframpProvider (quote, payoutToPix). MockOfframp.
  • router/: PaymentRouter.plan() lists steps and blockers (invalid CRC, dynamic code without amount, insufficient balance); execute() requires an explicit authorization for the exact amount and refuses any non-simulated provider in this MVP.

No token is created and no smart contract is deployed (ADR-006). A real integration needs a licensed off-ramp partner, KYC/AML handled by that partner, and a security review before enabling real funds.

Linked mentions 2