@4mica/sdk 1.2.17 → 1.3.1

package/dist/models-B15ouNYG.d.ts

@@ -0,0 +1,386 @@
+/** Signing scheme used when producing a payment guarantee signature. */
+declare enum SigningScheme {
+    /** EIP-712 typed-data signing (default, preferred). */
+    EIP712 = "eip712",
+    /** EIP-191 personal_sign (for wallets that do not support typed data). */
+    EIP191 = "eip191"
+}
+/** ECDSA signature and the scheme used to produce it. */
+interface PaymentSignature {
+    /** 65-byte ECDSA signature as a `0x`-prefixed hex string. */
+    signature: string;
+    scheme: SigningScheme;
+}
+/**
+ * V1 payment guarantee request claims. Signed by the payer and submitted to the
+ * core RPC to obtain a BLS guarantee certificate.
+ *
+ * Build with the static {@link PaymentGuaranteeRequestClaims.new} factory which
+ * normalises addresses and parses `uint256` values.
+ */
+declare class PaymentGuaranteeRequestClaims {
+    userAddress: string;
+    recipientAddress: string;
+    reqId: bigint;
+    amount: bigint;
+    timestamp: number;
+    assetAddress: string;
+    constructor(init: {
+        userAddress: string;
+        recipientAddress: string;
+        reqId?: bigint;
+        amount: bigint;
+        timestamp: number;
+        assetAddress: string;
+    });
+    static new(userAddress: string, recipientAddress: string, amount: number | bigint | string, timestamp: number, erc20Token?: string | null, reqId?: number | bigint | string): PaymentGuaranteeRequestClaims;
+}
+/** On-chain validation policy fields carried in a V2 payment guarantee certificate. */
+interface PaymentGuaranteeValidationPolicyV2 {
+    validationRegistryAddress: string;
+    validationRequestHash: string;
+    validationChainId: number;
+    validatorAddress: string;
+    validatorAgentId: bigint;
+    minValidationScore: number;
+    validationSubjectHash: string;
+    jobHash: string;
+    requiredValidationTag: string;
+}
+/**
+ * V2 payment guarantee request claims — extends V1 with a full on-chain validation policy.
+ *
+ * Compute `validationSubjectHash` via `computeValidationSubjectHash(baseClaims)` and
+ * `validationRequestHash` via `computeValidationRequestHash(partialV2)` before constructing.
+ * The `jobHash` must be provided and included in the validation request hash.
+ *
+ * @throws {@link ValidationError} if `minValidationScore` is outside [1, 100].
+ */
+declare class PaymentGuaranteeRequestClaimsV2 extends PaymentGuaranteeRequestClaims {
+    validationRegistryAddress: string;
+    validationRequestHash: string;
+    validationChainId: number;
+    validatorAddress: string;
+    validatorAgentId: bigint;
+    minValidationScore: number;
+    validationSubjectHash: string;
+    jobHash: string;
+    requiredValidationTag: string;
+    constructor(init: {
+        userAddress: string;
+        recipientAddress: string;
+        reqId?: bigint;
+        amount: bigint;
+        timestamp: number;
+        assetAddress: string;
+        validationRegistryAddress: string;
+        validationRequestHash: string;
+        validationChainId: number;
+        validatorAddress: string;
+        validatorAgentId: bigint;
+        minValidationScore: number;
+        validationSubjectHash: string;
+        jobHash: string;
+        requiredValidationTag: string;
+    });
+}
+/**
+ * Decoded payment guarantee claims, as returned by `decodeGuaranteeClaims`.
+ * `version` is `1` for V1 certificates and `2` for V2 certificates.
+ * V2 certificates additionally carry a `validationPolicy`.
+ */
+interface PaymentGuaranteeClaims {
+    domain: Uint8Array;
+    userAddress: string;
+    recipientAddress: string;
+    cycleId: bigint;
+    reqId: bigint;
+    amount: bigint;
+    assetAddress: string;
+    timestamp: number;
+    version: number;
+    validationPolicy?: PaymentGuaranteeValidationPolicyV2;
+}
+/**
+ * BLS guarantee certificate returned by `issuePaymentGuarantee`.
+ * Both fields are `0x`-prefixed hex strings.
+ */
+interface BLSCert {
+    /** ABI-encoded `(uint64 version, bytes innerClaims)` envelope as a hex string. */
+    claims: string;
+    /** BLS12-381 G2 signature as a hex string. */
+    signature: string;
+}
+/** On-chain collateral position for a single asset, returned by `getUser`. */
+interface UserInfo {
+    /** Asset address (`0x000...` for ETH). */
+    asset: string;
+    /** Total deposited collateral available for payments (in token base units). */
+    collateral: bigint;
+    /** Amount of a pending withdrawal request (0 if none). */
+    withdrawalRequestAmount: bigint;
+    /** Unix timestamp when the withdrawal request was made (0 if none). */
+    withdrawalRequestTimestamp: number;
+}
+declare class UserSuspensionStatus {
+    userAddress: string;
+    suspended: boolean;
+    updatedAt: number;
+    constructor(userAddress: string, suspended: boolean, updatedAt: number);
+    static fromRpc(raw: Record<string, unknown>): UserSuspensionStatus;
+}
+declare class AdminApiKeyInfo {
+    id: string;
+    name: string;
+    scopes: string[];
+    createdAt: number;
+    revokedAt?: number | null | undefined;
+    constructor(id: string, name: string, scopes: string[], createdAt: number, revokedAt?: number | null | undefined);
+    static fromRpc(raw: Record<string, unknown>): AdminApiKeyInfo;
+}
+declare class AdminApiKeySecret {
+    id: string;
+    name: string;
+    scopes: string[];
+    createdAt: number;
+    apiKey: string;
+    constructor(id: string, name: string, scopes: string[], createdAt: number, apiKey: string);
+    static fromRpc(raw: Record<string, unknown>): AdminApiKeySecret;
+}
+/**
+ * Off-chain clearing settlement action a participant performs against the
+ * ClearingHouse contract for a given cycle.
+ */
+type ClearingSettlementActionKind = "pay_net_debit" | "claim_net_credit" | "mark_defaulted";
+/** Role a participant holds in a settlement cycle. */
+type ClearingParticipantRole = "NET_CREDITOR" | "NET_DEBTOR" | "BALANCED" | string;
+/**
+ * A participant's committed position in a settlement cycle, with the Merkle
+ * proof needed to settle on-chain. Returned by `getClearingParticipantProof`.
+ */
+declare class ClearingParticipantProof {
+    /** On-chain `bytes32` cycle identifier. */
+    cycleId: string;
+    /** Core database cycle identifier. */
+    cycleIdText: string;
+    assetAddress: string;
+    participant: string;
+    role: ClearingParticipantRole;
+    /** Amount used with the participant's role-specific ClearingHouse call. */
+    amount: bigint;
+    netDebit: bigint;
+    netCredit: bigint;
+    leaf: string;
+    merkleRoot: string;
+    proof: string[];
+    constructor(
+    /** On-chain `bytes32` cycle identifier. */
+    cycleId: string, 
+    /** Core database cycle identifier. */
+    cycleIdText: string, assetAddress: string, participant: string, role: ClearingParticipantRole, 
+    /** Amount used with the participant's role-specific ClearingHouse call. */
+    amount: bigint, netDebit: bigint, netCredit: bigint, leaf: string, merkleRoot: string, proof: string[]);
+    static fromRpc(raw: Record<string, unknown>): ClearingParticipantProof;
+}
+/**
+ * A prepared ClearingHouse contract call for a participant, including the amount
+ * and Merkle proof. Returned by `getClearingSettlementAction` and its helpers.
+ */
+declare class ClearingSettlementActionResponse {
+    /** ClearingHouse contract address. */
+    contractAddress: string;
+    /** Contract function to call (`payNetDebit`, `claimNetCredit`, `markDefaulted`). */
+    functionName: string;
+    action: ClearingSettlementActionKind;
+    /** On-chain `bytes32` cycle identifier. */
+    cycleId: string;
+    /** Core database cycle identifier. */
+    cycleIdText: string;
+    assetAddress: string;
+    /** Participant whose committed Merkle leaf is proven. */
+    participant: string;
+    /** Alias for `participant` when `action = mark_defaulted`. */
+    debtor: string | null;
+    /** Amount argument for the selected ClearingHouse function. */
+    amount: bigint;
+    /** Native value to attach — non-zero only for native-asset debtor payments. */
+    payableValue: bigint;
+    proof: string[];
+    constructor(
+    /** ClearingHouse contract address. */
+    contractAddress: string, 
+    /** Contract function to call (`payNetDebit`, `claimNetCredit`, `markDefaulted`). */
+    functionName: string, action: ClearingSettlementActionKind, 
+    /** On-chain `bytes32` cycle identifier. */
+    cycleId: string, 
+    /** Core database cycle identifier. */
+    cycleIdText: string, assetAddress: string, 
+    /** Participant whose committed Merkle leaf is proven. */
+    participant: string, 
+    /** Alias for `participant` when `action = mark_defaulted`. */
+    debtor: string | null, 
+    /** Amount argument for the selected ClearingHouse function. */
+    amount: bigint, 
+    /** Native value to attach — non-zero only for native-asset debtor payments. */
+    payableValue: bigint, proof: string[]);
+    static fromRpc(raw: Record<string, unknown>): ClearingSettlementActionResponse;
+}
+declare class AssetBalanceInfo {
+    userAddress: string;
+    assetAddress: string;
+    total: bigint;
+    locked: bigint;
+    version: number;
+    updatedAt: number;
+    constructor(userAddress: string, assetAddress: string, total: bigint, locked: bigint, version: number, updatedAt: number);
+    static fromRpc(raw: Record<string, unknown>): AssetBalanceInfo;
+}
+declare class RecipientPaymentInfo {
+    userAddress: string;
+    recipientAddress: string;
+    txHash: string;
+    amount: bigint;
+    verified: boolean;
+    finalized: boolean;
+    failed: boolean;
+    createdAt: number;
+    constructor(userAddress: string, recipientAddress: string, txHash: string, amount: bigint, verified: boolean, finalized: boolean, failed: boolean, createdAt: number);
+    static fromRpc(raw: Record<string, unknown>): RecipientPaymentInfo;
+}
+interface SupportedTokenInfo {
+    symbol: string;
+    address: string;
+    decimals?: number;
+}
+declare class SupportedTokensResponse {
+    chainId: number;
+    tokens: SupportedTokenInfo[];
+    constructor(chainId: number, tokens: SupportedTokenInfo[]);
+    static fromRpc(raw: Record<string, unknown>): SupportedTokensResponse;
+}
+declare class CorePublicParameters {
+    publicKey: Uint8Array;
+    contractAddress: string;
+    ethereumHttpRpcUrl: string;
+    eip712Name: string;
+    eip712Version: string;
+    chainId: number;
+    maxAcceptedGuaranteeVersion: number;
+    acceptedGuaranteeVersions: number[];
+    activeGuaranteeDomainSeparator: string;
+    /** Allowlist of trusted validation registry addresses configured in core (may be empty). */
+    trustedValidationRegistries: string[];
+    validationHashCanonicalizationVersion: string;
+    constructor(publicKey: Uint8Array, contractAddress: string, ethereumHttpRpcUrl: string, eip712Name: string, eip712Version: string, chainId: number, maxAcceptedGuaranteeVersion?: number, acceptedGuaranteeVersions?: number[], activeGuaranteeDomainSeparator?: string, 
+    /** Allowlist of trusted validation registry addresses configured in core (may be empty). */
+    trustedValidationRegistries?: string[], validationHashCanonicalizationVersion?: string);
+    static fromRpc(payload: Record<string, unknown>): CorePublicParameters;
+}
+
+interface PaymentPayloadClaimsBase {
+    user_address: string;
+    recipient_address: string;
+    req_id: string;
+    amount: string;
+    timestamp: number;
+    asset_address: string;
+}
+/** Wire-format representation of V1 payment guarantee claims sent to the core RPC. */
+interface PaymentPayloadClaims extends PaymentPayloadClaimsBase {
+    version: "v1";
+}
+/** Wire-format representation of V2 payment guarantee claims sent to the core RPC. */
+interface PaymentPayloadClaimsV2 extends PaymentPayloadClaimsBase {
+    version: "v2";
+    validation_registry_address: string;
+    validation_request_hash: string;
+    validation_chain_id: number;
+    validator_address: string;
+    validator_agent_id: string;
+    min_validation_score: number;
+    validation_subject_hash: string;
+    job_hash: string;
+    required_validation_tag: string;
+}
+/** Assembled payment payload ready to be submitted to the core RPC `issueGuarantee` endpoint. */
+interface PaymentPayload {
+    claims: PaymentPayloadClaims | PaymentPayloadClaimsV2;
+    /** 65-byte ECDSA signature as a `0x`-prefixed hex string. */
+    signature: string;
+    scheme: SigningScheme;
+}
+
+interface PaymentRequirementsV1 {
+    scheme: string;
+    network: string;
+    maxAmountRequired: string;
+    payTo: string;
+    asset: string;
+    resource?: string;
+    description?: string;
+    mimeType?: string;
+    outputSchema?: unknown;
+    maxTimeoutSeconds?: number;
+    extra?: PaymentRequirementsExtra;
+}
+interface PaymentRequirementsV2 {
+    scheme: string;
+    network: string;
+    asset: string;
+    amount: string;
+    payTo: string;
+    maxTimeoutSeconds?: number;
+    extra?: PaymentRequirementsExtra;
+}
+type PaymentRequirements = PaymentRequirementsV2;
+interface PaymentRequirementsExtra {
+    tabEndpoint?: string;
+    validationRegistryAddress?: string;
+    validationChainId?: number;
+    validatorAddress?: string;
+    validatorAgentId?: string;
+    minValidationScore?: number;
+    jobHash?: string;
+    requiredValidationTag?: string;
+}
+interface TabResponse {
+    userAddress: string;
+    nextReqId?: string;
+}
+type X402PaymentPayloadClaims = PaymentPayload["claims"];
+type X402PaymentPayload = PaymentPayload;
+interface X402PaymentEnvelopeV1 {
+    x402Version: number;
+    scheme: string;
+    network: string;
+    payload: X402PaymentPayload;
+}
+interface X402ResourceInfo {
+    url: string;
+    description: string;
+    mimeType: string;
+}
+interface X402PaymentEnvelopeV2 {
+    x402Version: number;
+    accepted: PaymentRequirementsV2;
+    payload: X402PaymentPayload;
+    resource: X402ResourceInfo;
+}
+interface X402SignedPayment {
+    header: string;
+    payload: X402PaymentPayload;
+    signature: PaymentSignature;
+}
+interface X402SettledPayment {
+    payment: X402SignedPayment;
+    settlement: unknown;
+}
+interface X402PaymentRequired {
+    x402Version: number;
+    error?: string;
+    resource: X402ResourceInfo;
+    accepts: PaymentRequirementsV2[];
+    extensions?: Record<string, unknown>;
+}
+
+export { AdminApiKeySecret as A, type BLSCert as B, CorePublicParameters as C, type X402PaymentPayloadClaims as D, PaymentGuaranteeRequestClaims as P, RecipientPaymentInfo as R, SupportedTokensResponse as S, type TabResponse as T, UserSuspensionStatus as U, type X402SignedPayment as X, type ClearingSettlementActionKind as a, AdminApiKeyInfo as b, PaymentGuaranteeRequestClaimsV2 as c, SigningScheme as d, type PaymentGuaranteeClaims as e, ClearingParticipantProof as f, ClearingSettlementActionResponse as g, AssetBalanceInfo as h, type UserInfo as i, type PaymentSignature as j, type PaymentPayload as k, type PaymentPayloadClaims as l, type PaymentPayloadClaimsV2 as m, type PaymentRequirementsV1 as n, type X402PaymentRequired as o, type PaymentRequirementsV2 as p, type X402SettledPayment as q, type X402ResourceInfo as r, type ClearingParticipantRole as s, type PaymentGuaranteeValidationPolicyV2 as t, type PaymentRequirements as u, type PaymentRequirementsExtra as v, type SupportedTokenInfo as w, type X402PaymentEnvelopeV1 as x, type X402PaymentEnvelopeV2 as y, type X402PaymentPayload as z };

package/dist/server.cjs

@@ -0,0 +1,172 @@
+'use strict';
+
+// src/server/base64.ts
+function base64ToBytes(b64) {
+  const binary = atob(b64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 1) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+function base64ToUtf8(b64) {
+  return new TextDecoder().decode(base64ToBytes(b64));
+}
+function utf8ToBase64(text) {
+  return bytesToBase64(new TextEncoder().encode(text));
+}
+
+// src/errors/index.ts
+var FourMicaError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = this.constructor.name;
+  }
+};
+var X402Error = class extends FourMicaError {
+};
+
+// src/server/envelope.ts
+function parsePaymentHeader(header) {
+  if (!header || typeof header !== "string") {
+    throw new X402Error("missing payment header");
+  }
+  try {
+    const decoded = base64ToUtf8(header);
+    return JSON.parse(decoded);
+  } catch (err) {
+    throw new X402Error(`invalid payment header: ${String(err)}`);
+  }
+}
+
+// src/server/paywall.ts
+var X402_VERSION = 1;
+var DEFAULT_SCHEME = "4mica";
+var PAYMENT_HEADER = "x-payment";
+var PAYMENT_RESPONSE_HEADER = "X-PAYMENT-RESPONSE";
+var JSON_HEADERS = {
+  "content-type": "application/json"
+};
+function resolveVerifier(verifier) {
+  if ("issueGuarantee" in verifier && typeof verifier.issueGuarantee === "function") {
+    return verifier;
+  }
+  const withRpc = verifier;
+  if (withRpc.rpc && typeof withRpc.rpc.issueGuarantee === "function") {
+    return withRpc.rpc;
+  }
+  throw new TypeError(
+    "paywall verifier must expose issueGuarantee() or a .rpc that does"
+  );
+}
+function buildResource(input, config) {
+  return {
+    url: config.resource?.url ?? input.url,
+    description: config.resource?.description ?? config.description ?? "",
+    mimeType: config.resource?.mimeType ?? config.mimeType ?? ""
+  };
+}
+function buildRequirements(input, config, error) {
+  if (config.buildRequirements) {
+    const custom = config.buildRequirements(input);
+    return error ? { ...custom, error } : custom;
+  }
+  const accepts = {
+    scheme: config.scheme ?? DEFAULT_SCHEME,
+    network: config.network,
+    asset: config.asset,
+    amount: config.amount,
+    payTo: config.payTo,
+    maxTimeoutSeconds: config.maxTimeoutSeconds,
+    extra: { tabEndpoint: config.tabEndpoint, ...config.extra }
+  };
+  return {
+    x402Version: config.x402Version ?? X402_VERSION,
+    ...error ? { error } : {},
+    resource: buildResource(input, config),
+    accepts: [accepts]
+  };
+}
+function requireResponse(input, config, error) {
+  return {
+    ok: false,
+    status: 402,
+    headers: { ...JSON_HEADERS },
+    body: buildRequirements(input, config, error)
+  };
+}
+function createPaywall(verifier, config) {
+  const guarantor = resolveVerifier(verifier);
+  async function protect(input) {
+    const paymentHeader = input.header(PAYMENT_HEADER);
+    if (!paymentHeader) {
+      return requireResponse(input, config);
+    }
+    let payload;
+    try {
+      payload = parsePaymentHeader(paymentHeader).payload;
+    } catch (err) {
+      return requireResponse(
+        input,
+        config,
+        err instanceof Error ? err.message : String(err)
+      );
+    }
+    try {
+      const raw = await guarantor.issueGuarantee(payload);
+      const claims = typeof raw.claims === "string" ? raw.claims : "";
+      const signature = typeof raw.signature === "string" ? raw.signature : "";
+      const guarantee = { claims, signature, raw };
+      return {
+        ok: true,
+        guarantee,
+        responseHeaders: {
+          [PAYMENT_RESPONSE_HEADER]: utf8ToBase64(
+            JSON.stringify({ success: true, guarantee: { claims, signature } })
+          )
+        }
+      };
+    } catch (err) {
+      return requireResponse(
+        input,
+        config,
+        err instanceof Error ? err.message : String(err)
+      );
+    }
+  }
+  async function handle(request) {
+    const decision = await protect({
+      method: request.method,
+      url: request.url,
+      header: (name) => request.headers.get(name)
+    });
+    if (!decision.ok) {
+      return new Response(JSON.stringify(decision.body), {
+        status: decision.status,
+        headers: decision.headers
+      });
+    }
+    return {
+      ok: true,
+      headers: new Headers(decision.responseHeaders),
+      guarantee: decision.guarantee
+    };
+  }
+  return { protect, handle };
+}
+
+exports.base64ToBytes = base64ToBytes;
+exports.base64ToUtf8 = base64ToUtf8;
+exports.bytesToBase64 = bytesToBase64;
+exports.createPaywall = createPaywall;
+exports.parsePaymentHeader = parsePaymentHeader;
+exports.utf8ToBase64 = utf8ToBase64;
+//# sourceMappingURL=server.cjs.map
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/base64.ts","../src/errors/index.ts","../src/server/envelope.ts","../src/server/paywall.ts"],"names":[],"mappings":";;;AAQO,SAAS,cAAc,GAAA,EAAyB;AACrD,EAAA,MAAM,MAAA,GAAS,KAAK,GAAG,CAAA;AACvB,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,KAAK,CAAA,EAAG;AACzC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAc,KAAA,EAA2B;AACvD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAA,IAAU,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,CAAC,CAAW,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB;AAEO,SAAS,aAAa,GAAA,EAAqB;AAChD,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,aAAA,CAAc,GAAG,CAAC,CAAA;AACpD;AAEO,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,OAAO,cAAc,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC,CAAA;AACrD;;;AC9BO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAAA,EAC/B;AACF,CAAA;AA8BO,IAAM,SAAA,GAAN,cAAwB,aAAA,CAAc;AAAC,CAAA;;;ACxBvC,SAAS,mBAAmB,MAAA,EAAqC;AACtE,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,MAAM,IAAI,UAAU,wBAAwB,CAAA;AAAA,EAC9C;AACA,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,aAAa,MAAM,CAAA;AACnC,IAAA,OAAO,IAAA,CAAK,MAAM,OAAO,CAAA;AAAA,EAC3B,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,SAAA,CAAU,CAAA,wBAAA,EAA2B,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC9D;AACF;;;ACLA,IAAM,YAAA,GAAe,CAAA;AACrB,IAAM,cAAA,GAAiB,OAAA;AACvB,IAAM,cAAA,GAAiB,WAAA;AACvB,IAAM,uBAAA,GAA0B,oBAAA;AAChC,IAAM,YAAA,GAAuC;AAAA,EAC3C,cAAA,EAAgB;AAClB,CAAA;AAEA,SAAS,gBAAgB,QAAA,EAA8C;AACrE,EAAA,IACE,gBAAA,IAAoB,QAAA,IACpB,OAAQ,QAAA,CAA+B,mBAAmB,UAAA,EAC1D;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,QAAA;AAChB,EAAA,IAAI,QAAQ,GAAA,IAAO,OAAO,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAA,EAAY;AACnE,IAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,EACjB;AACA,EAAA,MAAM,IAAI,SAAA;AAAA,IACR;AAAA,GACF;AACF;AAEA,SAAS,aAAA,CACP,OACA,MAAA,EACkB;AAClB,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,MAAA,CAAO,QAAA,EAAU,GAAA,IAAO,KAAA,CAAM,GAAA;AAAA,IACnC,WAAA,EAAa,MAAA,CAAO,QAAA,EAAU,WAAA,IAAe,OAAO,WAAA,IAAe,EAAA;AAAA,IACnE,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,QAAA,IAAY,OAAO,QAAA,IAAY;AAAA,GAC5D;AACF;AAEA,SAAS,iBAAA,CACP,KAAA,EACA,MAAA,EACA,KAAA,EACqB;AACrB,EAAA,IAAI,OAAO,iBAAA,EAAmB;AAC5B,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,iBAAA,CAAkB,KAAK,CAAA;AAC7C,IAAA,OAAO,KAAA,GAAQ,EAAE,GAAG,MAAA,EAAQ,OAAM,GAAI,MAAA;AAAA,EACxC;AACA,EAAA,MAAM,OAAA,GAAiC;AAAA,IACrC,MAAA,EAAQ,OAAO,MAAA,IAAU,cAAA;AAAA,IACzB,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,OAAO,MAAA,CAAO,KAAA;AAAA,IACd,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,OAAO,EAAE,WAAA,EAAa,OAAO,WAAA,EAAa,GAAG,OAAO,KAAA;AAAM,GAC5D;AACA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,OAAO,WAAA,IAAe,YAAA;AAAA,IACnC,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,IACzB,QAAA,EAAU,aAAA,CAAc,KAAA,EAAO,MAAM,CAAA;AAAA,IACrC,OAAA,EAAS,CAAC,OAAO;AAAA,GACnB;AACF;AAEA,SAAS,eAAA,CACP,KAAA,EACA,MAAA,EACA,KAAA,EACyC;AACzC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS,EAAE,GAAG,YAAA,EAAa;AAAA,IAC3B,IAAA,EAAM,iBAAA,CAAkB,KAAA,EAAO,MAAA,EAAQ,KAAK;AAAA,GAC9C;AACF;AAeO,SAAS,aAAA,CACd,UACA,MAAA,EACS;AACT,EAAA,MAAM,SAAA,GAAY,gBAAgB,QAAQ,CAAA;AAE1C,EAAA,eAAe,QAAQ,KAAA,EAA+C;AACpE,IAAA,MAAM,aAAA,GAAgB,KAAA,CAAM,MAAA,CAAO,cAAc,CAAA;AACjD,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,OAAO,eAAA,CAAgB,OAAO,MAAM,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,kBAAA,CAAmB,aAAa,CAAA,CAAE,OAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,eAAA;AAAA,QACL,KAAA;AAAA,QACA,MAAA;AAAA,QACA,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,OACjD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,cAAA,CAAe,OAAO,CAAA;AAClD,MAAA,MAAM,SAAS,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,GAAW,IAAI,MAAA,GAAS,EAAA;AAC7D,MAAA,MAAM,YAAY,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY,EAAA;AACtE,MAAA,MAAM,SAAA,GAA8B,EAAE,MAAA,EAAQ,SAAA,EAAW,GAAA,EAAI;AAC7D,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,SAAA;AAAA,QACA,eAAA,EAAiB;AAAA,UACf,CAAC,uBAAuB,GAAG,YAAA;AAAA,YACzB,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,IAAA,EAAM,WAAW,EAAE,MAAA,EAAQ,SAAA,EAAU,EAAG;AAAA;AACpE;AACF,OACF;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,eAAA;AAAA,QACL,KAAA;AAAA,QACA,MAAA;AAAA,QACA,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,OACjD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,OAAO,OAAA,EAAkB;AACtC,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ;AAAA,MAC7B,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,KAAK,OAAA,CAAQ,GAAA;AAAA,MACb,QAAQ,CAAC,IAAA,KAAS,OAAA,CAAQ,OAAA,CAAQ,IAAI,IAAI;AAAA,KAC3C,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAI,CAAA,EAAG;AAAA,QACjD,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,SAAS,QAAA,CAAS;AAAA,OACnB,CAAA;AAAA,IACH;AACA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,OAAA,EAAS,IAAI,OAAA,CAAQ,QAAA,CAAS,eAAe,CAAA;AAAA,MAC7C,WAAW,QAAA,CAAS;AAAA,KACtB;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAC3B","file":"server.cjs","sourcesContent":["/**\n * Edge-safe base64 helpers.\n *\n * Uses only Web-standard `atob`/`btoa` + `TextEncoder`/`TextDecoder`, which are\n * available on Node (>=16), Bun, Deno, browsers, and edge/worker runtimes — so\n * the server paywall path never depends on Node's `Buffer`.\n */\n\nexport function base64ToBytes(b64: string): Uint8Array {\n  const binary = atob(b64);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i += 1) {\n    bytes[i] = binary.charCodeAt(i);\n  }\n  return bytes;\n}\n\nexport function bytesToBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i += 1) {\n    binary += String.fromCharCode(bytes[i] as number);\n  }\n  return btoa(binary);\n}\n\nexport function base64ToUtf8(b64: string): string {\n  return new TextDecoder().decode(base64ToBytes(b64));\n}\n\nexport function utf8ToBase64(text: string): string {\n  return bytesToBase64(new TextEncoder().encode(text));\n}\n","/** Base class for all 4Mica SDK errors. Sets `error.name` to the subclass name. */\nexport class FourMicaError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = this.constructor.name;\n  }\n}\n\n/** Thrown when the SDK configuration is invalid (e.g. missing required fields or bad URL). */\nexport class ConfigError extends FourMicaError {}\n\n/** Thrown when a 4Mica core RPC call fails. Includes the HTTP status and raw response body. */\nexport class RpcError extends FourMicaError {\n  readonly status?: number;\n  readonly body?: unknown;\n\n  constructor(message: string, options?: { status?: number; body?: unknown }) {\n    super(message);\n    this.status = options?.status;\n    this.body = options?.body;\n  }\n}\n\n/** Thrown when the SDK client fails to initialise (e.g. chain ID mismatch). */\nexport class ClientInitializationError extends FourMicaError {}\n\n/** Thrown when signing a payment claim fails (e.g. unsupported scheme, address mismatch). */\nexport class SigningError extends FourMicaError {}\n\n/** Thrown when an on-chain contract call fails or returns an unexpected result. */\nexport class ContractError extends FourMicaError {}\n\n/** Thrown when BLS certificate verification fails (e.g. domain mismatch, invalid encoding). */\nexport class VerificationError extends FourMicaError {}\n\n/** Thrown when an x402 HTTP payment flow encounters an error. */\nexport class X402Error extends FourMicaError {}\n\n/** Base class for authentication-related errors. */\nexport class AuthError extends FourMicaError {}\n\n/** Thrown when the auth URL is invalid or unreachable. */\nexport class AuthUrlError extends AuthError {}\n\n/** Thrown when a network-level error occurs during authentication. */\nexport class AuthTransportError extends AuthError {}\n\n/** Thrown when the auth server response cannot be decoded. */\nexport class AuthDecodeError extends AuthError {}\n\n/** Thrown when the auth server returns an error response. Includes HTTP status and body. */\nexport class AuthApiError extends AuthError {\n  readonly status?: number;\n  readonly body?: unknown;\n\n  constructor(message: string, options?: { status?: number; body?: unknown }) {\n    super(message);\n    this.status = options?.status;\n    this.body = options?.body;\n  }\n}\n\n/** Thrown when auth configuration is invalid. */\nexport class AuthConfigError extends AuthError {}\n\n/** Thrown when an authenticated operation is attempted without auth being configured. */\nexport class AuthMissingConfigError extends AuthConfigError {}\n","import { X402Error } from \"@/errors\";\nimport { base64ToUtf8 } from \"@/server/base64\";\nimport type { X402PaymentEnvelope } from \"@/server/models\";\n\n/**\n * Decode a base64 `X-PAYMENT` header into its x402 payment envelope.\n *\n * Runtime-neutral and edge-safe (no `Buffer`). Shared by the payer-side\n * {@link X402Flow} and the server-side paywall so both agree on the wire format.\n *\n * @throws {@link X402Error} if the header is missing or not valid base64 JSON.\n */\nexport function parsePaymentHeader(header: string): X402PaymentEnvelope {\n  if (!header || typeof header !== \"string\") {\n    throw new X402Error(\"missing payment header\");\n  }\n  try {\n    const decoded = base64ToUtf8(header);\n    return JSON.parse(decoded) as X402PaymentEnvelope;\n  } catch (err) {\n    throw new X402Error(`invalid payment header: ${String(err)}`);\n  }\n}\n","import { utf8ToBase64 } from \"@/server/base64\";\nimport { parsePaymentHeader } from \"@/server/envelope\";\nimport type {\n  GuaranteeVerifier,\n  Paywall,\n  PaywallConfig,\n  PaywallDecision,\n  PaywallGuarantee,\n  PaywallInput,\n  PaywallVerifier,\n} from \"@/server/models\";\nimport type {\n  PaymentRequirementsV2,\n  X402PaymentRequired,\n  X402ResourceInfo,\n} from \"@/x402/models\";\n\nconst X402_VERSION = 1;\nconst DEFAULT_SCHEME = \"4mica\";\nconst PAYMENT_HEADER = \"x-payment\";\nconst PAYMENT_RESPONSE_HEADER = \"X-PAYMENT-RESPONSE\";\nconst JSON_HEADERS: Record<string, string> = {\n  \"content-type\": \"application/json\",\n};\n\nfunction resolveVerifier(verifier: PaywallVerifier): GuaranteeVerifier {\n  if (\n    \"issueGuarantee\" in verifier &&\n    typeof (verifier as GuaranteeVerifier).issueGuarantee === \"function\"\n  ) {\n    return verifier as GuaranteeVerifier;\n  }\n  const withRpc = verifier as { rpc?: GuaranteeVerifier };\n  if (withRpc.rpc && typeof withRpc.rpc.issueGuarantee === \"function\") {\n    return withRpc.rpc;\n  }\n  throw new TypeError(\n    \"paywall verifier must expose issueGuarantee() or a .rpc that does\",\n  );\n}\n\nfunction buildResource(\n  input: PaywallInput,\n  config: PaywallConfig,\n): X402ResourceInfo {\n  return {\n    url: config.resource?.url ?? input.url,\n    description: config.resource?.description ?? config.description ?? \"\",\n    mimeType: config.resource?.mimeType ?? config.mimeType ?? \"\",\n  };\n}\n\nfunction buildRequirements(\n  input: PaywallInput,\n  config: PaywallConfig,\n  error?: string,\n): X402PaymentRequired {\n  if (config.buildRequirements) {\n    const custom = config.buildRequirements(input);\n    return error ? { ...custom, error } : custom;\n  }\n  const accepts: PaymentRequirementsV2 = {\n    scheme: config.scheme ?? DEFAULT_SCHEME,\n    network: config.network,\n    asset: config.asset,\n    amount: config.amount,\n    payTo: config.payTo,\n    maxTimeoutSeconds: config.maxTimeoutSeconds,\n    extra: { tabEndpoint: config.tabEndpoint, ...config.extra },\n  };\n  return {\n    x402Version: config.x402Version ?? X402_VERSION,\n    ...(error ? { error } : {}),\n    resource: buildResource(input, config),\n    accepts: [accepts],\n  };\n}\n\nfunction requireResponse(\n  input: PaywallInput,\n  config: PaywallConfig,\n  error?: string,\n): Extract<PaywallDecision, { ok: false }> {\n  return {\n    ok: false,\n    status: 402,\n    headers: { ...JSON_HEADERS },\n    body: buildRequirements(input, config, error),\n  };\n}\n\n/**\n * Create a runtime-neutral x402 paywall.\n *\n * The paywall advertises {@link X402PaymentRequired} when no valid `X-PAYMENT`\n * header is present, and otherwise decodes the header and forwards the payment\n * payload to the verifier's `issueGuarantee`. A successful guarantee means the\n * payment is cryptographically covered → allow the request. On-chain settlement\n * (the cycle-clearing `claimNetCredit` flow) is intentionally left as an\n * out-of-band recipient operation.\n *\n * @param verifier - `client.rpc`, the SDK `Client`, or any {@link GuaranteeVerifier}.\n * @param config - Advertised requirements for the protected resource.\n */\nexport function createPaywall(\n  verifier: PaywallVerifier,\n  config: PaywallConfig,\n): Paywall {\n  const guarantor = resolveVerifier(verifier);\n\n  async function protect(input: PaywallInput): Promise<PaywallDecision> {\n    const paymentHeader = input.header(PAYMENT_HEADER);\n    if (!paymentHeader) {\n      return requireResponse(input, config);\n    }\n\n    let payload: unknown;\n    try {\n      payload = parsePaymentHeader(paymentHeader).payload;\n    } catch (err) {\n      return requireResponse(\n        input,\n        config,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n\n    try {\n      const raw = await guarantor.issueGuarantee(payload);\n      const claims = typeof raw.claims === \"string\" ? raw.claims : \"\";\n      const signature = typeof raw.signature === \"string\" ? raw.signature : \"\";\n      const guarantee: PaywallGuarantee = { claims, signature, raw };\n      return {\n        ok: true,\n        guarantee,\n        responseHeaders: {\n          [PAYMENT_RESPONSE_HEADER]: utf8ToBase64(\n            JSON.stringify({ success: true, guarantee: { claims, signature } }),\n          ),\n        },\n      };\n    } catch (err) {\n      return requireResponse(\n        input,\n        config,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  async function handle(request: Request) {\n    const decision = await protect({\n      method: request.method,\n      url: request.url,\n      header: (name) => request.headers.get(name),\n    });\n    if (!decision.ok) {\n      return new Response(JSON.stringify(decision.body), {\n        status: decision.status,\n        headers: decision.headers,\n      });\n    }\n    return {\n      ok: true as const,\n      headers: new Headers(decision.responseHeaders),\n      guarantee: decision.guarantee,\n    };\n  }\n\n  return { protect, handle };\n}\n"]}