@alleyboss/micropay-solana-x402-paywall 1.0.0 → 1.0.1

package/dist/session/index.cjs

@@ -4,13 +4,38 @@ var jose = require('jose');
 var uuid = require('uuid');
 
 // src/session/core.ts
+var MAX_ARTICLES_PER_SESSION = 100;
+var MIN_SECRET_LENGTH = 32;
 function getSecretKey(secret) {
-  if (secret.length < 32) {
-    throw new Error("Session secret must be at least 32 characters");
+  if (!secret || typeof secret !== "string") {
+    throw new Error("Session secret is required");
+  }
+  if (secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);
   }
   return new TextEncoder().encode(secret);
 }
+function validateWalletAddress(address) {
+  if (!address || typeof address !== "string") return false;
+  const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+  return base58Regex.test(address);
+}
+function validateArticleId(articleId) {
+  if (!articleId || typeof articleId !== "string") return false;
+  if (articleId.length > 128) return false;
+  const safeIdRegex = /^[a-zA-Z0-9_-]+$/;
+  return safeIdRegex.test(articleId);
+}
 async function createSession(walletAddress, articleId, config, siteWide = false) {
+  if (!validateWalletAddress(walletAddress)) {
+    throw new Error("Invalid wallet address format");
+  }
+  if (!validateArticleId(articleId)) {
+    throw new Error("Invalid article ID format");
+  }
+  if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {
+    throw new Error("Session duration must be between 1 and 720 hours");
+  }
   const sessionId = uuid.v4();
   const now = Math.floor(Date.now() / 1e3);
   const expiresAt = now + config.durationHours * 3600;
@@ -18,7 +43,7 @@ async function createSession(walletAddress, articleId, config, siteWide = false)
     id: sessionId,
     walletAddress,
     unlockedArticles: [articleId],
-    siteWideUnlock: siteWide,
+    siteWideUnlock: Boolean(siteWide),
     createdAt: now,
     expiresAt
   };
@@ -26,7 +51,7 @@ async function createSession(walletAddress, articleId, config, siteWide = false)
     sub: walletAddress,
     sid: sessionId,
     articles: session.unlockedArticles,
-    siteWide,
+    siteWide: session.siteWideUnlock,
     iat: now,
     exp: expiresAt
   };
@@ -34,30 +59,39 @@ async function createSession(walletAddress, articleId, config, siteWide = false)
   return { token, session };
 }
 async function validateSession(token, secret) {
+  if (!token || typeof token !== "string") {
+    return { valid: false, reason: "Invalid token format" };
+  }
   try {
     const { payload } = await jose.jwtVerify(token, getSecretKey(secret));
     const sessionPayload = payload;
+    if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {
+      return { valid: false, reason: "Malformed session payload" };
+    }
     const now = Math.floor(Date.now() / 1e3);
     if (sessionPayload.exp < now) {
       return { valid: false, reason: "Session expired" };
     }
+    if (!validateWalletAddress(sessionPayload.sub)) {
+      return { valid: false, reason: "Invalid session data" };
+    }
     const session = {
       id: sessionPayload.sid,
       walletAddress: sessionPayload.sub,
-      unlockedArticles: sessionPayload.articles,
-      siteWideUnlock: sessionPayload.siteWide,
-      createdAt: sessionPayload.iat,
+      unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],
+      siteWideUnlock: Boolean(sessionPayload.siteWide),
+      createdAt: sessionPayload.iat ?? 0,
       expiresAt: sessionPayload.exp
     };
     return { valid: true, session };
   } catch (error) {
-    return {
-      valid: false,
-      reason: error instanceof Error ? error.message : "Invalid session"
-    };
+    return { valid: false, reason: "Invalid session" };
   }
 }
 async function addArticleToSession(token, articleId, secret) {
+  if (!validateArticleId(articleId)) {
+    return null;
+  }
   const validation = await validateSession(token, secret);
   if (!validation.valid || !validation.session) {
     return null;
@@ -66,6 +100,9 @@ async function addArticleToSession(token, articleId, secret) {
   if (session.unlockedArticles.includes(articleId)) {
     return { token, session };
   }
+  if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {
+    return null;
+  }
   const updatedArticles = [...session.unlockedArticles, articleId];
   const payload = {
     sub: session.walletAddress,
@@ -82,6 +119,9 @@ async function addArticleToSession(token, articleId, secret) {
   };
 }
 async function isArticleUnlocked(token, articleId, secret) {
+  if (!validateArticleId(articleId)) {
+    return false;
+  }
   const validation = await validateSession(token, secret);
   if (!validation.valid || !validation.session) {
     return false;

package/dist/session/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4","SignJWT","jwtVerify"],"mappings":";;;;;;AAQA,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,MAAA,CAAO,SAAS,EAAA,EAAI;AACpB,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EACnE;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAKA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAChD,EAAA,MAAM,YAAYA,OAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAA;AAAA,IAChB,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,QAAA;AAAA,IACA,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAIC,YAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAKA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAC1B,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAMC,eAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAEvB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,kBAAkB,cAAA,CAAe,QAAA;AAAA,MACjC,gBAAgB,cAAA,CAAe,QAAA;AAAA,MAC/B,WAAW,cAAA,CAAe,GAAA;AAAA,MAC1B,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AACZ,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KACrD;AAAA,EACJ;AACJ;AAKA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAID,YAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.cjs","sourcesContent":["// Session management with JWT (framework-agnostic core)\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from '../types';\n\n/**\n * Get the secret key for JWT signing\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (secret.length < 32) {\n        throw new Error('Session secret must be at least 32 characters');\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Create a new session after successful payment\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: siteWide,\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: sessionPayload.articles,\n            siteWideUnlock: sessionPayload.siteWide,\n            createdAt: sessionPayload.iat,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        return {\n            valid: false,\n            reason: error instanceof Error ? error.message : 'Invalid session',\n        };\n    }\n}\n\n/**\n * Add an article to an existing session\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}
+{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4","SignJWT","jwtVerify"],"mappings":";;;;;;AAOA,IAAM,wBAAA,GAA2B,GAAA;AAGjC,IAAM,iBAAA,GAAoB,EAAA;AAM1B,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,iBAAA,EAAmB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,iBAAiB,CAAA,WAAA,CAAa,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAMA,SAAS,sBAAsB,OAAA,EAA0B;AACrD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AAEpD,EAAA,MAAM,WAAA,GAAc,+BAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,OAAO,CAAA;AACnC;AAMA,SAAS,kBAAkB,SAAA,EAA4B;AACnD,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AAExD,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,GAAA,EAAK,OAAO,KAAA;AACnC,EAAA,MAAM,WAAA,GAAc,kBAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,SAAS,CAAA;AACrC;AAMA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAEhD,EAAA,IAAI,CAAC,qBAAA,CAAsB,aAAa,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,OAAO,aAAA,IAAiB,MAAA,CAAO,iBAAiB,CAAA,IAAK,MAAA,CAAO,gBAAgB,GAAA,EAAK;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,YAAYA,OAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAQ,QAAQ,CAAA;AAAA,IAChC,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAIC,YAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAMA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAE1B,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACrC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EAC1D;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAMC,eAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAGvB,IAAA,IAAI,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,EAAK;AACnE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC/D;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,qBAAA,CAAsB,cAAA,CAAe,GAAG,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IAC1D;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,gBAAA,EAAkB,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA,GAAI,cAAA,CAAe,WAAW,EAAC;AAAA,MACtF,cAAA,EAAgB,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA;AAAA,MAC/C,SAAA,EAAW,eAAe,GAAA,IAAO,CAAA;AAAA,MACjC,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AAEZ,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,EACrD;AACJ;AAMA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AAEvD,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAGA,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,MAAA,IAAU,wBAAA,EAA0B;AAC7D,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAID,YAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.cjs","sourcesContent":["// Session management with JWT (framework-agnostic core)\n// SECURITY: Uses jose library with HS256, constant-time validation, input sanitization\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from '../types';\n\n// Maximum articles per session to prevent unbounded growth\nconst MAX_ARTICLES_PER_SESSION = 100;\n\n// Minimum secret length for security\nconst MIN_SECRET_LENGTH = 32;\n\n/**\n * Get the secret key for JWT signing\n * SECURITY: Enforces minimum secret length\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (!secret || typeof secret !== 'string') {\n        throw new Error('Session secret is required');\n    }\n    if (secret.length < MIN_SECRET_LENGTH) {\n        throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Validate wallet address format (base58, 32-44 chars)\n * SECURITY: Prevents injection via wallet address field\n */\nfunction validateWalletAddress(address: string): boolean {\n    if (!address || typeof address !== 'string') return false;\n    // Solana addresses are base58, typically 32-44 characters\n    const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;\n    return base58Regex.test(address);\n}\n\n/**\n * Validate article ID format\n * SECURITY: Prevents injection via articleId field\n */\nfunction validateArticleId(articleId: string): boolean {\n    if (!articleId || typeof articleId !== 'string') return false;\n    // Allow alphanumeric, hyphens, underscores, max 128 chars\n    if (articleId.length > 128) return false;\n    const safeIdRegex = /^[a-zA-Z0-9_-]+$/;\n    return safeIdRegex.test(articleId);\n}\n\n/**\n * Create a new session after successful payment\n * SECURITY: Validates inputs, enforces limits\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    // Input validation\n    if (!validateWalletAddress(walletAddress)) {\n        throw new Error('Invalid wallet address format');\n    }\n    if (!validateArticleId(articleId)) {\n        throw new Error('Invalid article ID format');\n    }\n    if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {\n        throw new Error('Session duration must be between 1 and 720 hours');\n    }\n\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: Boolean(siteWide),\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n * SECURITY: jose library handles timing-safe comparison internally\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    // Input validation\n    if (!token || typeof token !== 'string') {\n        return { valid: false, reason: 'Invalid token format' };\n    }\n\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        // Validate required fields exist\n        if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {\n            return { valid: false, reason: 'Malformed session payload' };\n        }\n\n        // Check expiration (jose already checks, but double-check)\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        // Validate wallet address format from token\n        if (!validateWalletAddress(sessionPayload.sub)) {\n            return { valid: false, reason: 'Invalid session data' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],\n            siteWideUnlock: Boolean(sessionPayload.siteWide),\n            createdAt: sessionPayload.iat ?? 0,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        // SECURITY: Don't expose internal error details\n        return { valid: false, reason: 'Invalid session' };\n    }\n}\n\n/**\n * Add an article to an existing session\n * SECURITY: Enforces article limit to prevent token bloat\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    // Validate article ID\n    if (!validateArticleId(articleId)) {\n        return null;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    // SECURITY: Enforce maximum articles per session\n    if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {\n        return null;\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    if (!validateArticleId(articleId)) {\n        return false;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}

package/dist/session/index.d.cts

@@ -1 +1 @@
-export { e as addArticleToSession, d as createSession, i as isArticleUnlocked, v as validateSession } from '../index-DptevtnU.cjs';
+export { e as addArticleToSession, d as createSession, i as isArticleUnlocked, v as validateSession } from '../index-uxMb72hH.cjs';

package/dist/session/index.d.ts

@@ -1 +1 @@
-export { e as addArticleToSession, d as createSession, i as isArticleUnlocked, v as validateSession } from '../index-DptevtnU.js';
+export { e as addArticleToSession, d as createSession, i as isArticleUnlocked, v as validateSession } from '../index-uxMb72hH.js';

package/dist/session/index.js

@@ -2,13 +2,38 @@ import { SignJWT, jwtVerify } from 'jose';
 import { v4 } from 'uuid';
 
 // src/session/core.ts
+var MAX_ARTICLES_PER_SESSION = 100;
+var MIN_SECRET_LENGTH = 32;
 function getSecretKey(secret) {
-  if (secret.length < 32) {
-    throw new Error("Session secret must be at least 32 characters");
+  if (!secret || typeof secret !== "string") {
+    throw new Error("Session secret is required");
+  }
+  if (secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);
   }
   return new TextEncoder().encode(secret);
 }
+function validateWalletAddress(address) {
+  if (!address || typeof address !== "string") return false;
+  const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+  return base58Regex.test(address);
+}
+function validateArticleId(articleId) {
+  if (!articleId || typeof articleId !== "string") return false;
+  if (articleId.length > 128) return false;
+  const safeIdRegex = /^[a-zA-Z0-9_-]+$/;
+  return safeIdRegex.test(articleId);
+}
 async function createSession(walletAddress, articleId, config, siteWide = false) {
+  if (!validateWalletAddress(walletAddress)) {
+    throw new Error("Invalid wallet address format");
+  }
+  if (!validateArticleId(articleId)) {
+    throw new Error("Invalid article ID format");
+  }
+  if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {
+    throw new Error("Session duration must be between 1 and 720 hours");
+  }
   const sessionId = v4();
   const now = Math.floor(Date.now() / 1e3);
   const expiresAt = now + config.durationHours * 3600;
@@ -16,7 +41,7 @@ async function createSession(walletAddress, articleId, config, siteWide = false)
     id: sessionId,
     walletAddress,
     unlockedArticles: [articleId],
-    siteWideUnlock: siteWide,
+    siteWideUnlock: Boolean(siteWide),
     createdAt: now,
     expiresAt
   };
@@ -24,7 +49,7 @@ async function createSession(walletAddress, articleId, config, siteWide = false)
     sub: walletAddress,
     sid: sessionId,
     articles: session.unlockedArticles,
-    siteWide,
+    siteWide: session.siteWideUnlock,
     iat: now,
     exp: expiresAt
   };
@@ -32,30 +57,39 @@ async function createSession(walletAddress, articleId, config, siteWide = false)
   return { token, session };
 }
 async function validateSession(token, secret) {
+  if (!token || typeof token !== "string") {
+    return { valid: false, reason: "Invalid token format" };
+  }
   try {
     const { payload } = await jwtVerify(token, getSecretKey(secret));
     const sessionPayload = payload;
+    if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {
+      return { valid: false, reason: "Malformed session payload" };
+    }
     const now = Math.floor(Date.now() / 1e3);
     if (sessionPayload.exp < now) {
       return { valid: false, reason: "Session expired" };
     }
+    if (!validateWalletAddress(sessionPayload.sub)) {
+      return { valid: false, reason: "Invalid session data" };
+    }
     const session = {
       id: sessionPayload.sid,
       walletAddress: sessionPayload.sub,
-      unlockedArticles: sessionPayload.articles,
-      siteWideUnlock: sessionPayload.siteWide,
-      createdAt: sessionPayload.iat,
+      unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],
+      siteWideUnlock: Boolean(sessionPayload.siteWide),
+      createdAt: sessionPayload.iat ?? 0,
       expiresAt: sessionPayload.exp
     };
     return { valid: true, session };
   } catch (error) {
-    return {
-      valid: false,
-      reason: error instanceof Error ? error.message : "Invalid session"
-    };
+    return { valid: false, reason: "Invalid session" };
   }
 }
 async function addArticleToSession(token, articleId, secret) {
+  if (!validateArticleId(articleId)) {
+    return null;
+  }
   const validation = await validateSession(token, secret);
   if (!validation.valid || !validation.session) {
     return null;
@@ -64,6 +98,9 @@ async function addArticleToSession(token, articleId, secret) {
   if (session.unlockedArticles.includes(articleId)) {
     return { token, session };
   }
+  if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {
+    return null;
+  }
   const updatedArticles = [...session.unlockedArticles, articleId];
   const payload = {
     sub: session.walletAddress,
@@ -80,6 +117,9 @@ async function addArticleToSession(token, articleId, secret) {
   };
 }
 async function isArticleUnlocked(token, articleId, secret) {
+  if (!validateArticleId(articleId)) {
+    return false;
+  }
   const validation = await validateSession(token, secret);
   if (!validation.valid || !validation.session) {
     return false;

package/dist/session/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4"],"mappings":";;;;AAQA,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,MAAA,CAAO,SAAS,EAAA,EAAI;AACpB,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EACnE;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAKA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAChD,EAAA,MAAM,YAAYA,EAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAA;AAAA,IAChB,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,QAAA;AAAA,IACA,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAI,OAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAKA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAC1B,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAM,UAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAEvB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,kBAAkB,cAAA,CAAe,QAAA;AAAA,MACjC,gBAAgB,cAAA,CAAe,QAAA;AAAA,MAC/B,WAAW,cAAA,CAAe,GAAA;AAAA,MAC1B,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AACZ,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,KAAA;AAAA,MACP,MAAA,EAAQ,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KACrD;AAAA,EACJ;AACJ;AAKA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAI,OAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.js","sourcesContent":["// Session management with JWT (framework-agnostic core)\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from '../types';\n\n/**\n * Get the secret key for JWT signing\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (secret.length < 32) {\n        throw new Error('Session secret must be at least 32 characters');\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Create a new session after successful payment\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: siteWide,\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: sessionPayload.articles,\n            siteWideUnlock: sessionPayload.siteWide,\n            createdAt: sessionPayload.iat,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        return {\n            valid: false,\n            reason: error instanceof Error ? error.message : 'Invalid session',\n        };\n    }\n}\n\n/**\n * Add an article to an existing session\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}
+{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4"],"mappings":";;;;AAOA,IAAM,wBAAA,GAA2B,GAAA;AAGjC,IAAM,iBAAA,GAAoB,EAAA;AAM1B,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,iBAAA,EAAmB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,iBAAiB,CAAA,WAAA,CAAa,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAMA,SAAS,sBAAsB,OAAA,EAA0B;AACrD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AAEpD,EAAA,MAAM,WAAA,GAAc,+BAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,OAAO,CAAA;AACnC;AAMA,SAAS,kBAAkB,SAAA,EAA4B;AACnD,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AAExD,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,GAAA,EAAK,OAAO,KAAA;AACnC,EAAA,MAAM,WAAA,GAAc,kBAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,SAAS,CAAA;AACrC;AAMA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAEhD,EAAA,IAAI,CAAC,qBAAA,CAAsB,aAAa,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,OAAO,aAAA,IAAiB,MAAA,CAAO,iBAAiB,CAAA,IAAK,MAAA,CAAO,gBAAgB,GAAA,EAAK;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,YAAYA,EAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAQ,QAAQ,CAAA;AAAA,IAChC,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAI,OAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAMA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAE1B,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACrC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EAC1D;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAM,UAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAGvB,IAAA,IAAI,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,EAAK;AACnE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC/D;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,qBAAA,CAAsB,cAAA,CAAe,GAAG,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IAC1D;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,gBAAA,EAAkB,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA,GAAI,cAAA,CAAe,WAAW,EAAC;AAAA,MACtF,cAAA,EAAgB,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA;AAAA,MAC/C,SAAA,EAAW,eAAe,GAAA,IAAO,CAAA;AAAA,MACjC,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AAEZ,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,EACrD;AACJ;AAMA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AAEvD,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAGA,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,MAAA,IAAU,wBAAA,EAA0B;AAC7D,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAI,OAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.js","sourcesContent":["// Session management with JWT (framework-agnostic core)\n// SECURITY: Uses jose library with HS256, constant-time validation, input sanitization\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from '../types';\n\n// Maximum articles per session to prevent unbounded growth\nconst MAX_ARTICLES_PER_SESSION = 100;\n\n// Minimum secret length for security\nconst MIN_SECRET_LENGTH = 32;\n\n/**\n * Get the secret key for JWT signing\n * SECURITY: Enforces minimum secret length\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (!secret || typeof secret !== 'string') {\n        throw new Error('Session secret is required');\n    }\n    if (secret.length < MIN_SECRET_LENGTH) {\n        throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Validate wallet address format (base58, 32-44 chars)\n * SECURITY: Prevents injection via wallet address field\n */\nfunction validateWalletAddress(address: string): boolean {\n    if (!address || typeof address !== 'string') return false;\n    // Solana addresses are base58, typically 32-44 characters\n    const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;\n    return base58Regex.test(address);\n}\n\n/**\n * Validate article ID format\n * SECURITY: Prevents injection via articleId field\n */\nfunction validateArticleId(articleId: string): boolean {\n    if (!articleId || typeof articleId !== 'string') return false;\n    // Allow alphanumeric, hyphens, underscores, max 128 chars\n    if (articleId.length > 128) return false;\n    const safeIdRegex = /^[a-zA-Z0-9_-]+$/;\n    return safeIdRegex.test(articleId);\n}\n\n/**\n * Create a new session after successful payment\n * SECURITY: Validates inputs, enforces limits\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    // Input validation\n    if (!validateWalletAddress(walletAddress)) {\n        throw new Error('Invalid wallet address format');\n    }\n    if (!validateArticleId(articleId)) {\n        throw new Error('Invalid article ID format');\n    }\n    if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {\n        throw new Error('Session duration must be between 1 and 720 hours');\n    }\n\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: Boolean(siteWide),\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n * SECURITY: jose library handles timing-safe comparison internally\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    // Input validation\n    if (!token || typeof token !== 'string') {\n        return { valid: false, reason: 'Invalid token format' };\n    }\n\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        // Validate required fields exist\n        if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {\n            return { valid: false, reason: 'Malformed session payload' };\n        }\n\n        // Check expiration (jose already checks, but double-check)\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        // Validate wallet address format from token\n        if (!validateWalletAddress(sessionPayload.sub)) {\n            return { valid: false, reason: 'Invalid session data' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],\n            siteWideUnlock: Boolean(sessionPayload.siteWide),\n            createdAt: sessionPayload.iat ?? 0,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        // SECURITY: Don't expose internal error details\n        return { valid: false, reason: 'Invalid session' };\n    }\n}\n\n/**\n * Add an article to an existing session\n * SECURITY: Enforces article limit to prevent token bloat\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    // Validate article ID\n    if (!validateArticleId(articleId)) {\n        return null;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    // SECURITY: Enforce maximum articles per session\n    if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {\n        return null;\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    if (!validateArticleId(articleId)) {\n        return false;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}

package/dist/solana/index.cjs

@@ -42,6 +42,16 @@ function isMainnet(network) {
 function toX402Network(network) {
   return network === "mainnet-beta" ? "solana-mainnet" : "solana-devnet";
 }
+var SIGNATURE_REGEX = /^[1-9A-HJ-NP-Za-km-z]{87,88}$/;
+var WALLET_REGEX = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+function isValidSignature(signature) {
+  if (!signature || typeof signature !== "string") return false;
+  return SIGNATURE_REGEX.test(signature);
+}
+function isValidWalletAddress(address) {
+  if (!address || typeof address !== "string") return false;
+  return WALLET_REGEX.test(address);
+}
 function parseSOLTransfer(transaction, expectedRecipient) {
   const instructions = transaction.transaction.message.instructions;
   for (const ix of instructions) {
@@ -82,6 +92,16 @@ async function verifyPayment(params) {
     maxAgeSeconds = 300,
     clientConfig
   } = params;
+  if (!isValidSignature(signature)) {
+    return { valid: false, confirmed: false, signature, error: "Invalid signature format" };
+  }
+  if (!isValidWalletAddress(expectedRecipient)) {
+    return { valid: false, confirmed: false, signature, error: "Invalid recipient address" };
+  }
+  if (expectedAmount <= 0n) {
+    return { valid: false, confirmed: false, signature, error: "Invalid expected amount" };
+  }
+  const effectiveMaxAge = Math.min(Math.max(maxAgeSeconds, 60), 3600);
   const connection = getConnection(clientConfig);
   try {
     const transaction = await connection.getParsedTransaction(signature, {
@@ -96,14 +116,17 @@ async function verifyPayment(params) {
         valid: false,
         confirmed: true,
         signature,
-        error: `Transaction failed: ${JSON.stringify(transaction.meta.err)}`
+        error: "Transaction failed on-chain"
       };
     }
     if (transaction.blockTime) {
       const now = Math.floor(Date.now() / 1e3);
-      if (now - transaction.blockTime > maxAgeSeconds) {
+      if (now - transaction.blockTime > effectiveMaxAge) {
         return { valid: false, confirmed: true, signature, error: "Transaction too old" };
       }
+      if (transaction.blockTime > now + 60) {
+        return { valid: false, confirmed: true, signature, error: "Invalid transaction time" };
+      }
     }
     const transferDetails = parseSOLTransfer(transaction, expectedRecipient);
     if (!transferDetails) {
@@ -122,7 +145,7 @@ async function verifyPayment(params) {
         from: transferDetails.from,
         to: transferDetails.to,
         amount: transferDetails.amount,
-        error: `Insufficient amount: expected ${expectedAmount}, got ${transferDetails.amount}`
+        error: "Insufficient payment amount"
       };
     }
     return {
@@ -140,33 +163,34 @@ async function verifyPayment(params) {
       valid: false,
       confirmed: false,
       signature,
-      error: error instanceof Error ? error.message : "Unknown verification error"
+      error: "Verification failed"
     };
   }
 }
 async function waitForConfirmation(signature, clientConfig) {
+  if (!isValidSignature(signature)) {
+    return { confirmed: false, error: "Invalid signature format" };
+  }
   const connection = getConnection(clientConfig);
   try {
     const confirmation = await connection.confirmTransaction(signature, "confirmed");
     if (confirmation.value.err) {
-      return {
-        confirmed: false,
-        error: `Transaction failed: ${JSON.stringify(confirmation.value.err)}`
-      };
+      return { confirmed: false, error: "Transaction failed" };
     }
     return { confirmed: true, slot: confirmation.context?.slot };
-  } catch (error) {
-    return {
-      confirmed: false,
-      error: error instanceof Error ? error.message : "Confirmation timeout"
-    };
+  } catch {
+    return { confirmed: false, error: "Confirmation timeout" };
   }
 }
 async function getWalletTransactions(walletAddress, clientConfig, limit = 20) {
+  if (!isValidWalletAddress(walletAddress)) {
+    return [];
+  }
+  const safeLimit = Math.min(Math.max(limit, 1), 100);
   const connection = getConnection(clientConfig);
-  const pubkey = new web3_js.PublicKey(walletAddress);
   try {
-    const signatures = await connection.getSignaturesForAddress(pubkey, { limit });
+    const pubkey = new web3_js.PublicKey(walletAddress);
+    const signatures = await connection.getSignaturesForAddress(pubkey, { limit: safeLimit });
     return signatures.map((sig) => ({
       signature: sig.signature,
       blockTime: sig.blockTime ?? void 0,
@@ -180,6 +204,9 @@ function lamportsToSol(lamports) {
   return Number(lamports) / web3_js.LAMPORTS_PER_SOL;
 }
 function solToLamports(sol) {
+  if (!Number.isFinite(sol) || sol < 0) {
+    throw new Error("Invalid SOL amount");
+  }
   return BigInt(Math.floor(sol * web3_js.LAMPORTS_PER_SOL));
 }
 

package/dist/solana/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/solana/client.ts","../../src/solana/verification.ts"],"names":["clusterApiUrl","Connection","PublicKey","LAMPORTS_PER_SOL"],"mappings":";;;;;AAeA,IAAI,gBAAA,GAAsC,IAAA;AAC1C,IAAI,aAAA,GAAsC,IAAA;AAQ1C,SAAS,YAAY,MAAA,EAAoC;AACrD,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAQ,WAAA,EAAY,GAAI,MAAA;AAEzC,EAAA,IAAI,MAAA,EAAQ;AAER,IAAA,IAAI,MAAA,CAAO,SAAS,UAAU,CAAA,IAAK,eAAe,CAAC,MAAA,CAAO,QAAA,CAAS,WAAW,CAAA,EAAG;AAC7E,MAAA,OAAO,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,EAAG,MAAM,CAAA,EAAG,WAAW,CAAA,CAAA,GAAK,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,IACtF;AACA,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,IAAI,WAAA,EAAa;AACb,IAAA,MAAM,OAAA,GAAU,OAAA,KAAY,cAAA,GACtB,yCAAA,GACA,wCAAA;AACN,IAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,EACpC;AAGA,EAAA,OAAOA,sBAAc,OAAkB,CAAA;AAC3C;AAMO,SAAS,cAAc,MAAA,EAAwC;AAClE,EAAA,MAAM,EAAE,SAAQ,GAAI,MAAA;AAGpB,EAAA,IAAI,gBAAA,IAAoB,kBAAkB,OAAA,EAAS;AAC/C,IAAA,OAAO,gBAAA;AAAA,EACX;AAEA,EAAA,MAAM,MAAA,GAAS,YAAY,MAAM,CAAA;AAEjC,EAAA,gBAAA,GAAmB,IAAIC,mBAAW,MAAA,EAAQ;AAAA,IACtC,UAAA,EAAY,WAAA;AAAA,IACZ,gCAAA,EAAkC;AAAA,GACrC,CAAA;AACD,EAAA,aAAA,GAAgB,OAAA;AAEhB,EAAA,OAAO,gBAAA;AACX;AAMO,SAAS,eAAA,GAAwB;AACpC,EAAA,gBAAA,GAAmB,IAAA;AACnB,EAAA,aAAA,GAAgB,IAAA;AACpB;AAKO,SAAS,UAAU,OAAA,EAAiC;AACvD,EAAA,OAAO,OAAA,KAAY,cAAA;AACvB;AAKO,SAAS,cAAc,OAAA,EAA4D;AACtF,EAAA,OAAO,OAAA,KAAY,iBAAiB,gBAAA,GAAmB,eAAA;AAC3D;AC/CA,SAAS,gBAAA,CACL,aACA,iBAAA,EACmD;AACnD,EAAA,MAAM,YAAA,GAAe,WAAA,CAAY,WAAA,CAAY,OAAA,CAAQ,YAAA;AAGrD,EAAA,KAAA,MAAW,MAAM,YAAA,EAAc;AAC3B,IAAA,IAAI,QAAA,IAAY,EAAA,IAAM,EAAA,CAAG,OAAA,KAAY,QAAA,EAAU;AAC3C,MAAA,MAAM,SAAS,EAAA,CAAG,MAAA;AAKlB,MAAA,IAAI,OAAO,IAAA,KAAS,UAAA,IAAc,MAAA,CAAO,IAAA,CAAK,gBAAgB,iBAAA,EAAmB;AAC7E,QAAA,OAAO;AAAA,UACH,IAAA,EAAM,OAAO,IAAA,CAAK,MAAA;AAAA,UAClB,EAAA,EAAI,OAAO,IAAA,CAAK,WAAA;AAAA,UAChB,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ;AAAA,SACvC;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,IAAI,WAAA,CAAY,MAAM,iBAAA,EAAmB;AACrC,IAAA,KAAA,MAAW,KAAA,IAAS,WAAA,CAAY,IAAA,CAAK,iBAAA,EAAmB;AACpD,MAAA,KAAA,MAAW,EAAA,IAAM,MAAM,YAAA,EAAc;AACjC,QAAA,IAAI,QAAA,IAAY,EAAA,IAAM,EAAA,CAAG,OAAA,KAAY,QAAA,EAAU;AAC3C,UAAA,MAAM,SAAS,EAAA,CAAG,MAAA;AAKlB,UAAA,IAAI,OAAO,IAAA,KAAS,UAAA,IAAc,MAAA,CAAO,IAAA,CAAK,gBAAgB,iBAAA,EAAmB;AAC7E,YAAA,OAAO;AAAA,cACH,IAAA,EAAM,OAAO,IAAA,CAAK,MAAA;AAAA,cAClB,EAAA,EAAI,OAAO,IAAA,CAAK,WAAA;AAAA,cAChB,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ;AAAA,aACvC;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,OAAO,IAAA;AACX;AAKA,eAAsB,cAClB,MAAA,EACsC;AACtC,EAAA,MAAM;AAAA,IACF,SAAA;AAAA,IACA,iBAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA,GAAgB,GAAA;AAAA,IAChB;AAAA,GACJ,GAAI,MAAA;AAEJ,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAE7C,EAAA,IAAI;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,UAAA,CAAW,oBAAA,CAAqB,SAAA,EAAW;AAAA,MACjE,UAAA,EAAY,WAAA;AAAA,MACZ,8BAAA,EAAgC;AAAA,KACnC,CAAA;AAED,IAAA,IAAI,CAAC,WAAA,EAAa;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,KAAA,EAAO,SAAA,EAAW,OAAO,uBAAA,EAAwB;AAAA,IACvF;AAGA,IAAA,IAAI,WAAA,CAAY,MAAM,GAAA,EAAK;AACvB,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,SAAA;AAAA,QACA,OAAO,CAAA,oBAAA,EAAuB,IAAA,CAAK,UAAU,WAAA,CAAY,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,OACtE;AAAA,IACJ;AAGA,IAAA,IAAI,YAAY,SAAA,EAAW;AACvB,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,MAAA,IAAI,GAAA,GAAM,WAAA,CAAY,SAAA,GAAY,aAAA,EAAe;AAC7C,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,IAAA,EAAM,SAAA,EAAW,OAAO,qBAAA,EAAsB;AAAA,MACpF;AAAA,IACJ;AAGA,IAAA,MAAM,eAAA,GAAkB,gBAAA,CAAiB,WAAA,EAAa,iBAAiB,CAAA;AAEvE,IAAA,IAAI,CAAC,eAAA,EAAiB;AAClB,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,SAAA;AAAA,QACA,KAAA,EAAO;AAAA,OACX;AAAA,IACJ;AAGA,IAAA,IAAI,eAAA,CAAgB,SAAS,cAAA,EAAgB;AACzC,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,SAAA;AAAA,QACA,MAAM,eAAA,CAAgB,IAAA;AAAA,QACtB,IAAI,eAAA,CAAgB,EAAA;AAAA,QACpB,QAAQ,eAAA,CAAgB,MAAA;AAAA,QACxB,KAAA,EAAO,CAAA,8BAAA,EAAiC,cAAc,CAAA,MAAA,EAAS,gBAAgB,MAAM,CAAA;AAAA,OACzF;AAAA,IACJ;AAEA,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,IAAA;AAAA,MACP,SAAA,EAAW,IAAA;AAAA,MACX,SAAA;AAAA,MACA,MAAM,eAAA,CAAgB,IAAA;AAAA,MACtB,IAAI,eAAA,CAAgB,EAAA;AAAA,MACpB,QAAQ,eAAA,CAAgB,MAAA;AAAA,MACxB,SAAA,EAAW,YAAY,SAAA,IAAa,KAAA,CAAA;AAAA,MACpC,MAAM,WAAA,CAAY;AAAA,KACtB;AAAA,EACJ,SAAS,KAAA,EAAO;AACZ,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,KAAA;AAAA,MACP,SAAA,EAAW,KAAA;AAAA,MACX,SAAA;AAAA,MACA,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KACpD;AAAA,EACJ;AACJ;AAKA,eAAsB,mBAAA,CAClB,WACA,YAAA,EAC8D;AAC9D,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAE7C,EAAA,IAAI;AACA,IAAA,MAAM,YAAA,GAAe,MAAM,UAAA,CAAW,kBAAA,CAAmB,WAAW,WAAW,CAAA;AAE/E,IAAA,IAAI,YAAA,CAAa,MAAM,GAAA,EAAK;AACxB,MAAA,OAAO;AAAA,QACH,SAAA,EAAW,KAAA;AAAA,QACX,OAAO,CAAA,oBAAA,EAAuB,IAAA,CAAK,UAAU,YAAA,CAAa,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,OACxE;AAAA,IACJ;AAEA,IAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,YAAA,CAAa,SAAS,IAAA,EAAK;AAAA,EAC/D,SAAS,KAAA,EAAO;AACZ,IAAA,OAAO;AAAA,MACH,SAAA,EAAW,KAAA;AAAA,MACX,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KACpD;AAAA,EACJ;AACJ;AAKA,eAAsB,qBAAA,CAClB,aAAA,EACA,YAAA,EACA,KAAA,GAAgB,EAAA,EACuD;AACvE,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,IAAIC,iBAAA,CAAU,aAAa,CAAA;AAE1C,EAAA,IAAI;AACA,IAAA,MAAM,aAAa,MAAM,UAAA,CAAW,wBAAwB,MAAA,EAAQ,EAAE,OAAO,CAAA;AAC7E,IAAA,OAAO,UAAA,CAAW,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,MAC5B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,SAAA,EAAW,IAAI,SAAA,IAAa,KAAA,CAAA;AAAA,MAC5B,MAAM,GAAA,CAAI;AAAA,KACd,CAAE,CAAA;AAAA,EACN,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAKO,SAAS,cAAc,QAAA,EAAmC;AAC7D,EAAA,OAAO,MAAA,CAAO,QAAQ,CAAA,GAAIC,wBAAA;AAC9B;AAKO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAMA,wBAAgB,CAAC,CAAA;AACpD","file":"index.cjs","sourcesContent":["// Solana RPC client with multi-provider support\nimport { Connection, clusterApiUrl, type Cluster } from '@solana/web3.js';\nimport type { SolanaNetwork } from '../types';\n\n/** Configuration for Solana client */\nexport interface SolanaClientConfig {\n    /** Network to connect to */\n    network: SolanaNetwork;\n    /** Custom RPC URL (optional) */\n    rpcUrl?: string;\n    /** Tatum.io API key for RPC (optional) */\n    tatumApiKey?: string;\n}\n\n// Singleton state\nlet cachedConnection: Connection | null = null;\nlet cachedNetwork: SolanaNetwork | null = null;\n\n/**\n * Build RPC URL based on configuration priority:\n * 1. Custom RPC URL\n * 2. Tatum.io with API key\n * 3. Public RPC (rate limited)\n */\nfunction buildRpcUrl(config: SolanaClientConfig): string {\n    const { network, rpcUrl, tatumApiKey } = config;\n\n    if (rpcUrl) {\n        // If Tatum URL without key, append key if available\n        if (rpcUrl.includes('tatum.io') && tatumApiKey && !rpcUrl.includes(tatumApiKey)) {\n            return rpcUrl.endsWith('/') ? `${rpcUrl}${tatumApiKey}` : `${rpcUrl}/${tatumApiKey}`;\n        }\n        return rpcUrl;\n    }\n\n    if (tatumApiKey) {\n        const baseUrl = network === 'mainnet-beta'\n            ? 'https://solana-mainnet.gateway.tatum.io'\n            : 'https://solana-devnet.gateway.tatum.io';\n        return `${baseUrl}/${tatumApiKey}`;\n    }\n\n    // Fallback to public RPC\n    return clusterApiUrl(network as Cluster);\n}\n\n/**\n * Get or create a Solana connection\n * Uses singleton pattern with network-aware caching\n */\nexport function getConnection(config: SolanaClientConfig): Connection {\n    const { network } = config;\n\n    // Return cached if same network\n    if (cachedConnection && cachedNetwork === network) {\n        return cachedConnection;\n    }\n\n    const rpcUrl = buildRpcUrl(config);\n\n    cachedConnection = new Connection(rpcUrl, {\n        commitment: 'confirmed',\n        confirmTransactionInitialTimeout: 60000,\n    });\n    cachedNetwork = network;\n\n    return cachedConnection;\n}\n\n/**\n * Reset the cached connection\n * Useful for testing or network switching\n */\nexport function resetConnection(): void {\n    cachedConnection = null;\n    cachedNetwork = null;\n}\n\n/**\n * Check if network is mainnet\n */\nexport function isMainnet(network: SolanaNetwork): boolean {\n    return network === 'mainnet-beta';\n}\n\n/**\n * Convert Solana network to x402 network identifier\n */\nexport function toX402Network(network: SolanaNetwork): 'solana-devnet' | 'solana-mainnet' {\n    return network === 'mainnet-beta' ? 'solana-mainnet' : 'solana-devnet';\n}\n","// Transaction verification for SOL payments\nimport { PublicKey, LAMPORTS_PER_SOL, type ParsedTransactionWithMeta } from '@solana/web3.js';\nimport { getConnection, type SolanaClientConfig } from './client';\n\n/** Result of transaction verification */\nexport interface TransactionVerificationResult {\n    /** Whether the transaction is valid for the payment */\n    valid: boolean;\n    /** Whether the transaction is confirmed on-chain */\n    confirmed: boolean;\n    /** Transaction signature */\n    signature: string;\n    /** Sender wallet address */\n    from?: string;\n    /** Recipient wallet address */\n    to?: string;\n    /** Amount transferred in lamports */\n    amount?: bigint;\n    /** Block time (Unix timestamp) */\n    blockTime?: number;\n    /** Slot number */\n    slot?: number;\n    /** Error message if verification failed */\n    error?: string;\n}\n\n/** Parameters for verifying a payment */\nexport interface VerifyPaymentParams {\n    /** Transaction signature to verify */\n    signature: string;\n    /** Expected recipient wallet address */\n    expectedRecipient: string;\n    /** Expected amount in lamports */\n    expectedAmount: bigint;\n    /** Maximum age of transaction in seconds (default: 300) */\n    maxAgeSeconds?: number;\n    /** Solana client configuration */\n    clientConfig: SolanaClientConfig;\n}\n\n/**\n * Parse SOL transfer details from a transaction\n */\nfunction parseSOLTransfer(\n    transaction: ParsedTransactionWithMeta,\n    expectedRecipient: string\n): { from: string; to: string; amount: bigint } | null {\n    const instructions = transaction.transaction.message.instructions;\n\n    // Check main instructions\n    for (const ix of instructions) {\n        if ('parsed' in ix && ix.program === 'system') {\n            const parsed = ix.parsed as {\n                type: string;\n                info: { source: string; destination: string; lamports: number }\n            };\n\n            if (parsed.type === 'transfer' && parsed.info.destination === expectedRecipient) {\n                return {\n                    from: parsed.info.source,\n                    to: parsed.info.destination,\n                    amount: BigInt(parsed.info.lamports),\n                };\n            }\n        }\n    }\n\n    // Check inner instructions\n    if (transaction.meta?.innerInstructions) {\n        for (const inner of transaction.meta.innerInstructions) {\n            for (const ix of inner.instructions) {\n                if ('parsed' in ix && ix.program === 'system') {\n                    const parsed = ix.parsed as {\n                        type: string;\n                        info: { source: string; destination: string; lamports: number }\n                    };\n\n                    if (parsed.type === 'transfer' && parsed.info.destination === expectedRecipient) {\n                        return {\n                            from: parsed.info.source,\n                            to: parsed.info.destination,\n                            amount: BigInt(parsed.info.lamports),\n                        };\n                    }\n                }\n            }\n        }\n    }\n\n    return null;\n}\n\n/**\n * Verify a SOL transfer transaction\n */\nexport async function verifyPayment(\n    params: VerifyPaymentParams\n): Promise<TransactionVerificationResult> {\n    const {\n        signature,\n        expectedRecipient,\n        expectedAmount,\n        maxAgeSeconds = 300,\n        clientConfig\n    } = params;\n\n    const connection = getConnection(clientConfig);\n\n    try {\n        const transaction = await connection.getParsedTransaction(signature, {\n            commitment: 'confirmed',\n            maxSupportedTransactionVersion: 0,\n        });\n\n        if (!transaction) {\n            return { valid: false, confirmed: false, signature, error: 'Transaction not found' };\n        }\n\n        // Check for transaction errors\n        if (transaction.meta?.err) {\n            return {\n                valid: false,\n                confirmed: true,\n                signature,\n                error: `Transaction failed: ${JSON.stringify(transaction.meta.err)}`,\n            };\n        }\n\n        // Validate transaction age\n        if (transaction.blockTime) {\n            const now = Math.floor(Date.now() / 1000);\n            if (now - transaction.blockTime > maxAgeSeconds) {\n                return { valid: false, confirmed: true, signature, error: 'Transaction too old' };\n            }\n        }\n\n        // Parse transfer details\n        const transferDetails = parseSOLTransfer(transaction, expectedRecipient);\n\n        if (!transferDetails) {\n            return {\n                valid: false,\n                confirmed: true,\n                signature,\n                error: 'No valid SOL transfer to recipient found',\n            };\n        }\n\n        // Validate amount\n        if (transferDetails.amount < expectedAmount) {\n            return {\n                valid: false,\n                confirmed: true,\n                signature,\n                from: transferDetails.from,\n                to: transferDetails.to,\n                amount: transferDetails.amount,\n                error: `Insufficient amount: expected ${expectedAmount}, got ${transferDetails.amount}`,\n            };\n        }\n\n        return {\n            valid: true,\n            confirmed: true,\n            signature,\n            from: transferDetails.from,\n            to: transferDetails.to,\n            amount: transferDetails.amount,\n            blockTime: transaction.blockTime ?? undefined,\n            slot: transaction.slot,\n        };\n    } catch (error) {\n        return {\n            valid: false,\n            confirmed: false,\n            signature,\n            error: error instanceof Error ? error.message : 'Unknown verification error',\n        };\n    }\n}\n\n/**\n * Wait for transaction confirmation\n */\nexport async function waitForConfirmation(\n    signature: string,\n    clientConfig: SolanaClientConfig\n): Promise<{ confirmed: boolean; slot?: number; error?: string }> {\n    const connection = getConnection(clientConfig);\n\n    try {\n        const confirmation = await connection.confirmTransaction(signature, 'confirmed');\n\n        if (confirmation.value.err) {\n            return {\n                confirmed: false,\n                error: `Transaction failed: ${JSON.stringify(confirmation.value.err)}`,\n            };\n        }\n\n        return { confirmed: true, slot: confirmation.context?.slot };\n    } catch (error) {\n        return {\n            confirmed: false,\n            error: error instanceof Error ? error.message : 'Confirmation timeout',\n        };\n    }\n}\n\n/**\n * Get recent transactions for a wallet\n */\nexport async function getWalletTransactions(\n    walletAddress: string,\n    clientConfig: SolanaClientConfig,\n    limit: number = 20\n): Promise<Array<{ signature: string; blockTime?: number; slot: number }>> {\n    const connection = getConnection(clientConfig);\n    const pubkey = new PublicKey(walletAddress);\n\n    try {\n        const signatures = await connection.getSignaturesForAddress(pubkey, { limit });\n        return signatures.map((sig) => ({\n            signature: sig.signature,\n            blockTime: sig.blockTime ?? undefined,\n            slot: sig.slot,\n        }));\n    } catch {\n        return [];\n    }\n}\n\n/**\n * Convert lamports to SOL\n */\nexport function lamportsToSol(lamports: bigint | number): number {\n    return Number(lamports) / LAMPORTS_PER_SOL;\n}\n\n/**\n * Convert SOL to lamports\n */\nexport function solToLamports(sol: number): bigint {\n    return BigInt(Math.floor(sol * LAMPORTS_PER_SOL));\n}\n"]}
+{"version":3,"sources":["../../src/solana/client.ts","../../src/solana/verification.ts"],"names":["clusterApiUrl","Connection","PublicKey","LAMPORTS_PER_SOL"],"mappings":";;;;;AAeA,IAAI,gBAAA,GAAsC,IAAA;AAC1C,IAAI,aAAA,GAAsC,IAAA;AAQ1C,SAAS,YAAY,MAAA,EAAoC;AACrD,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAQ,WAAA,EAAY,GAAI,MAAA;AAEzC,EAAA,IAAI,MAAA,EAAQ;AAER,IAAA,IAAI,MAAA,CAAO,SAAS,UAAU,CAAA,IAAK,eAAe,CAAC,MAAA,CAAO,QAAA,CAAS,WAAW,CAAA,EAAG;AAC7E,MAAA,OAAO,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,EAAG,MAAM,CAAA,EAAG,WAAW,CAAA,CAAA,GAAK,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,IACtF;AACA,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,IAAI,WAAA,EAAa;AACb,IAAA,MAAM,OAAA,GAAU,OAAA,KAAY,cAAA,GACtB,yCAAA,GACA,wCAAA;AACN,IAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA;AAAA,EACpC;AAGA,EAAA,OAAOA,sBAAc,OAAkB,CAAA;AAC3C;AAMO,SAAS,cAAc,MAAA,EAAwC;AAClE,EAAA,MAAM,EAAE,SAAQ,GAAI,MAAA;AAGpB,EAAA,IAAI,gBAAA,IAAoB,kBAAkB,OAAA,EAAS;AAC/C,IAAA,OAAO,gBAAA;AAAA,EACX;AAEA,EAAA,MAAM,MAAA,GAAS,YAAY,MAAM,CAAA;AAEjC,EAAA,gBAAA,GAAmB,IAAIC,mBAAW,MAAA,EAAQ;AAAA,IACtC,UAAA,EAAY,WAAA;AAAA,IACZ,gCAAA,EAAkC;AAAA,GACrC,CAAA;AACD,EAAA,aAAA,GAAgB,OAAA;AAEhB,EAAA,OAAO,gBAAA;AACX;AAMO,SAAS,eAAA,GAAwB;AACpC,EAAA,gBAAA,GAAmB,IAAA;AACnB,EAAA,aAAA,GAAgB,IAAA;AACpB;AAKO,SAAS,UAAU,OAAA,EAAiC;AACvD,EAAA,OAAO,OAAA,KAAY,cAAA;AACvB;AAKO,SAAS,cAAc,OAAA,EAA4D;AACtF,EAAA,OAAO,OAAA,KAAY,iBAAiB,gBAAA,GAAmB,eAAA;AAC3D;AChDA,IAAM,eAAA,GAAkB,+BAAA;AAGxB,IAAM,YAAA,GAAe,+BAAA;AAMrB,SAAS,iBAAiB,SAAA,EAA4B;AAClD,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AACxD,EAAA,OAAO,eAAA,CAAgB,KAAK,SAAS,CAAA;AACzC;AAMA,SAAS,qBAAqB,OAAA,EAA0B;AACpD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AACpD,EAAA,OAAO,YAAA,CAAa,KAAK,OAAO,CAAA;AACpC;AAKA,SAAS,gBAAA,CACL,aACA,iBAAA,EACmD;AACnD,EAAA,MAAM,YAAA,GAAe,WAAA,CAAY,WAAA,CAAY,OAAA,CAAQ,YAAA;AAGrD,EAAA,KAAA,MAAW,MAAM,YAAA,EAAc;AAC3B,IAAA,IAAI,QAAA,IAAY,EAAA,IAAM,EAAA,CAAG,OAAA,KAAY,QAAA,EAAU;AAC3C,MAAA,MAAM,SAAS,EAAA,CAAG,MAAA;AAKlB,MAAA,IAAI,OAAO,IAAA,KAAS,UAAA,IAAc,MAAA,CAAO,IAAA,CAAK,gBAAgB,iBAAA,EAAmB;AAC7E,QAAA,OAAO;AAAA,UACH,IAAA,EAAM,OAAO,IAAA,CAAK,MAAA;AAAA,UAClB,EAAA,EAAI,OAAO,IAAA,CAAK,WAAA;AAAA,UAChB,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ;AAAA,SACvC;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,IAAI,WAAA,CAAY,MAAM,iBAAA,EAAmB;AACrC,IAAA,KAAA,MAAW,KAAA,IAAS,WAAA,CAAY,IAAA,CAAK,iBAAA,EAAmB;AACpD,MAAA,KAAA,MAAW,EAAA,IAAM,MAAM,YAAA,EAAc;AACjC,QAAA,IAAI,QAAA,IAAY,EAAA,IAAM,EAAA,CAAG,OAAA,KAAY,QAAA,EAAU;AAC3C,UAAA,MAAM,SAAS,EAAA,CAAG,MAAA;AAKlB,UAAA,IAAI,OAAO,IAAA,KAAS,UAAA,IAAc,MAAA,CAAO,IAAA,CAAK,gBAAgB,iBAAA,EAAmB;AAC7E,YAAA,OAAO;AAAA,cACH,IAAA,EAAM,OAAO,IAAA,CAAK,MAAA;AAAA,cAClB,EAAA,EAAI,OAAO,IAAA,CAAK,WAAA;AAAA,cAChB,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ;AAAA,aACvC;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,OAAO,IAAA;AACX;AAMA,eAAsB,cAClB,MAAA,EACsC;AACtC,EAAA,MAAM;AAAA,IACF,SAAA;AAAA,IACA,iBAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA,GAAgB,GAAA;AAAA,IAChB;AAAA,GACJ,GAAI,MAAA;AAGJ,EAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,KAAA,EAAO,SAAA,EAAW,OAAO,0BAAA,EAA2B;AAAA,EAC1F;AAGA,EAAA,IAAI,CAAC,oBAAA,CAAqB,iBAAiB,CAAA,EAAG;AAC1C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,KAAA,EAAO,SAAA,EAAW,OAAO,2BAAA,EAA4B;AAAA,EAC3F;AAGA,EAAA,IAAI,kBAAkB,EAAA,EAAI;AACtB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,KAAA,EAAO,SAAA,EAAW,OAAO,yBAAA,EAA0B;AAAA,EACzF;AAGA,EAAA,MAAM,eAAA,GAAkB,KAAK,GAAA,CAAI,IAAA,CAAK,IAAI,aAAA,EAAe,EAAE,GAAG,IAAI,CAAA;AAElE,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAE7C,EAAA,IAAI;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,UAAA,CAAW,oBAAA,CAAqB,SAAA,EAAW;AAAA,MACjE,UAAA,EAAY,WAAA;AAAA,MACZ,8BAAA,EAAgC;AAAA,KACnC,CAAA;AAED,IAAA,IAAI,CAAC,WAAA,EAAa;AACd,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,KAAA,EAAO,SAAA,EAAW,OAAO,uBAAA,EAAwB;AAAA,IACvF;AAGA,IAAA,IAAI,WAAA,CAAY,MAAM,GAAA,EAAK;AACvB,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,SAAA;AAAA,QACA,KAAA,EAAO;AAAA,OACX;AAAA,IACJ;AAGA,IAAA,IAAI,YAAY,SAAA,EAAW;AACvB,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,MAAA,IAAI,GAAA,GAAM,WAAA,CAAY,SAAA,GAAY,eAAA,EAAiB;AAC/C,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,IAAA,EAAM,SAAA,EAAW,OAAO,qBAAA,EAAsB;AAAA,MACpF;AAEA,MAAA,IAAI,WAAA,CAAY,SAAA,GAAY,GAAA,GAAM,EAAA,EAAI;AAClC,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,WAAW,IAAA,EAAM,SAAA,EAAW,OAAO,0BAAA,EAA2B;AAAA,MACzF;AAAA,IACJ;AAGA,IAAA,MAAM,eAAA,GAAkB,gBAAA,CAAiB,WAAA,EAAa,iBAAiB,CAAA;AAEvE,IAAA,IAAI,CAAC,eAAA,EAAiB;AAClB,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,SAAA;AAAA,QACA,KAAA,EAAO;AAAA,OACX;AAAA,IACJ;AAGA,IAAA,IAAI,eAAA,CAAgB,SAAS,cAAA,EAAgB;AACzC,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,SAAA;AAAA,QACA,MAAM,eAAA,CAAgB,IAAA;AAAA,QACtB,IAAI,eAAA,CAAgB,EAAA;AAAA,QACpB,QAAQ,eAAA,CAAgB,MAAA;AAAA,QACxB,KAAA,EAAO;AAAA,OACX;AAAA,IACJ;AAEA,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,IAAA;AAAA,MACP,SAAA,EAAW,IAAA;AAAA,MACX,SAAA;AAAA,MACA,MAAM,eAAA,CAAgB,IAAA;AAAA,MACtB,IAAI,eAAA,CAAgB,EAAA;AAAA,MACpB,QAAQ,eAAA,CAAgB,MAAA;AAAA,MACxB,SAAA,EAAW,YAAY,SAAA,IAAa,KAAA,CAAA;AAAA,MACpC,MAAM,WAAA,CAAY;AAAA,KACtB;AAAA,EACJ,SAAS,KAAA,EAAO;AAEZ,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,KAAA;AAAA,MACP,SAAA,EAAW,KAAA;AAAA,MACX,SAAA;AAAA,MACA,KAAA,EAAO;AAAA,KACX;AAAA,EACJ;AACJ;AAKA,eAAsB,mBAAA,CAClB,WACA,YAAA,EAC8D;AAC9D,EAAA,IAAI,CAAC,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,0BAAA,EAA2B;AAAA,EACjE;AAEA,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAE7C,EAAA,IAAI;AACA,IAAA,MAAM,YAAA,GAAe,MAAM,UAAA,CAAW,kBAAA,CAAmB,WAAW,WAAW,CAAA;AAE/E,IAAA,IAAI,YAAA,CAAa,MAAM,GAAA,EAAK;AACxB,MAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,oBAAA,EAAqB;AAAA,IAC3D;AAEA,IAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,YAAA,CAAa,SAAS,IAAA,EAAK;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,sBAAA,EAAuB;AAAA,EAC7D;AACJ;AAKA,eAAsB,qBAAA,CAClB,aAAA,EACA,YAAA,EACA,KAAA,GAAgB,EAAA,EACuD;AACvE,EAAA,IAAI,CAAC,oBAAA,CAAqB,aAAa,CAAA,EAAG;AACtC,IAAA,OAAO,EAAC;AAAA,EACZ;AAGA,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,CAAI,IAAA,CAAK,IAAI,KAAA,EAAO,CAAC,GAAG,GAAG,CAAA;AAElD,EAAA,MAAM,UAAA,GAAa,cAAc,YAAY,CAAA;AAE7C,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,IAAIC,iBAAA,CAAU,aAAa,CAAA;AAC1C,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,uBAAA,CAAwB,QAAQ,EAAE,KAAA,EAAO,WAAW,CAAA;AACxF,IAAA,OAAO,UAAA,CAAW,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,MAC5B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,SAAA,EAAW,IAAI,SAAA,IAAa,KAAA,CAAA;AAAA,MAC5B,MAAM,GAAA,CAAI;AAAA,KACd,CAAE,CAAA;AAAA,EACN,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAC;AAAA,EACZ;AACJ;AAKO,SAAS,cAAc,QAAA,EAAmC;AAC7D,EAAA,OAAO,MAAA,CAAO,QAAQ,CAAA,GAAIC,wBAAA;AAC9B;AAKO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,MAAM,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAMA,wBAAgB,CAAC,CAAA;AACpD","file":"index.cjs","sourcesContent":["// Solana RPC client with multi-provider support\nimport { Connection, clusterApiUrl, type Cluster } from '@solana/web3.js';\nimport type { SolanaNetwork } from '../types';\n\n/** Configuration for Solana client */\nexport interface SolanaClientConfig {\n    /** Network to connect to */\n    network: SolanaNetwork;\n    /** Custom RPC URL (optional) */\n    rpcUrl?: string;\n    /** Tatum.io API key for RPC (optional) */\n    tatumApiKey?: string;\n}\n\n// Singleton state\nlet cachedConnection: Connection | null = null;\nlet cachedNetwork: SolanaNetwork | null = null;\n\n/**\n * Build RPC URL based on configuration priority:\n * 1. Custom RPC URL\n * 2. Tatum.io with API key\n * 3. Public RPC (rate limited)\n */\nfunction buildRpcUrl(config: SolanaClientConfig): string {\n    const { network, rpcUrl, tatumApiKey } = config;\n\n    if (rpcUrl) {\n        // If Tatum URL without key, append key if available\n        if (rpcUrl.includes('tatum.io') && tatumApiKey && !rpcUrl.includes(tatumApiKey)) {\n            return rpcUrl.endsWith('/') ? `${rpcUrl}${tatumApiKey}` : `${rpcUrl}/${tatumApiKey}`;\n        }\n        return rpcUrl;\n    }\n\n    if (tatumApiKey) {\n        const baseUrl = network === 'mainnet-beta'\n            ? 'https://solana-mainnet.gateway.tatum.io'\n            : 'https://solana-devnet.gateway.tatum.io';\n        return `${baseUrl}/${tatumApiKey}`;\n    }\n\n    // Fallback to public RPC\n    return clusterApiUrl(network as Cluster);\n}\n\n/**\n * Get or create a Solana connection\n * Uses singleton pattern with network-aware caching\n */\nexport function getConnection(config: SolanaClientConfig): Connection {\n    const { network } = config;\n\n    // Return cached if same network\n    if (cachedConnection && cachedNetwork === network) {\n        return cachedConnection;\n    }\n\n    const rpcUrl = buildRpcUrl(config);\n\n    cachedConnection = new Connection(rpcUrl, {\n        commitment: 'confirmed',\n        confirmTransactionInitialTimeout: 60000,\n    });\n    cachedNetwork = network;\n\n    return cachedConnection;\n}\n\n/**\n * Reset the cached connection\n * Useful for testing or network switching\n */\nexport function resetConnection(): void {\n    cachedConnection = null;\n    cachedNetwork = null;\n}\n\n/**\n * Check if network is mainnet\n */\nexport function isMainnet(network: SolanaNetwork): boolean {\n    return network === 'mainnet-beta';\n}\n\n/**\n * Convert Solana network to x402 network identifier\n */\nexport function toX402Network(network: SolanaNetwork): 'solana-devnet' | 'solana-mainnet' {\n    return network === 'mainnet-beta' ? 'solana-mainnet' : 'solana-devnet';\n}\n","// Transaction verification for SOL payments\n// SECURITY: On-chain verification, signature validation, replay protection\nimport { PublicKey, LAMPORTS_PER_SOL, type ParsedTransactionWithMeta } from '@solana/web3.js';\nimport { getConnection, type SolanaClientConfig } from './client';\n\n/** Result of transaction verification */\nexport interface TransactionVerificationResult {\n    /** Whether the transaction is valid for the payment */\n    valid: boolean;\n    /** Whether the transaction is confirmed on-chain */\n    confirmed: boolean;\n    /** Transaction signature */\n    signature: string;\n    /** Sender wallet address */\n    from?: string;\n    /** Recipient wallet address */\n    to?: string;\n    /** Amount transferred in lamports */\n    amount?: bigint;\n    /** Block time (Unix timestamp) */\n    blockTime?: number;\n    /** Slot number */\n    slot?: number;\n    /** Error message if verification failed */\n    error?: string;\n}\n\n/** Parameters for verifying a payment */\nexport interface VerifyPaymentParams {\n    /** Transaction signature to verify */\n    signature: string;\n    /** Expected recipient wallet address */\n    expectedRecipient: string;\n    /** Expected amount in lamports */\n    expectedAmount: bigint;\n    /** Maximum age of transaction in seconds (default: 300) */\n    maxAgeSeconds?: number;\n    /** Solana client configuration */\n    clientConfig: SolanaClientConfig;\n}\n\n// Signature validation regex (base58, 87-88 chars)\nconst SIGNATURE_REGEX = /^[1-9A-HJ-NP-Za-km-z]{87,88}$/;\n\n// Wallet address validation regex\nconst WALLET_REGEX = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;\n\n/**\n * Validate transaction signature format\n * SECURITY: Prevents malformed signatures from reaching RPC\n */\nfunction isValidSignature(signature: string): boolean {\n    if (!signature || typeof signature !== 'string') return false;\n    return SIGNATURE_REGEX.test(signature);\n}\n\n/**\n * Validate wallet address format\n * SECURITY: Ensures valid base58 address\n */\nfunction isValidWalletAddress(address: string): boolean {\n    if (!address || typeof address !== 'string') return false;\n    return WALLET_REGEX.test(address);\n}\n\n/**\n * Parse SOL transfer details from a transaction\n */\nfunction parseSOLTransfer(\n    transaction: ParsedTransactionWithMeta,\n    expectedRecipient: string\n): { from: string; to: string; amount: bigint } | null {\n    const instructions = transaction.transaction.message.instructions;\n\n    // Check main instructions\n    for (const ix of instructions) {\n        if ('parsed' in ix && ix.program === 'system') {\n            const parsed = ix.parsed as {\n                type: string;\n                info: { source: string; destination: string; lamports: number }\n            };\n\n            if (parsed.type === 'transfer' && parsed.info.destination === expectedRecipient) {\n                return {\n                    from: parsed.info.source,\n                    to: parsed.info.destination,\n                    amount: BigInt(parsed.info.lamports),\n                };\n            }\n        }\n    }\n\n    // Check inner instructions\n    if (transaction.meta?.innerInstructions) {\n        for (const inner of transaction.meta.innerInstructions) {\n            for (const ix of inner.instructions) {\n                if ('parsed' in ix && ix.program === 'system') {\n                    const parsed = ix.parsed as {\n                        type: string;\n                        info: { source: string; destination: string; lamports: number }\n                    };\n\n                    if (parsed.type === 'transfer' && parsed.info.destination === expectedRecipient) {\n                        return {\n                            from: parsed.info.source,\n                            to: parsed.info.destination,\n                            amount: BigInt(parsed.info.lamports),\n                        };\n                    }\n                }\n            }\n        }\n    }\n\n    return null;\n}\n\n/**\n * Verify a SOL transfer transaction\n * SECURITY: Full on-chain verification with amount/recipient/age checks\n */\nexport async function verifyPayment(\n    params: VerifyPaymentParams\n): Promise<TransactionVerificationResult> {\n    const {\n        signature,\n        expectedRecipient,\n        expectedAmount,\n        maxAgeSeconds = 300,\n        clientConfig\n    } = params;\n\n    // SECURITY: Validate signature format before RPC call\n    if (!isValidSignature(signature)) {\n        return { valid: false, confirmed: false, signature, error: 'Invalid signature format' };\n    }\n\n    // SECURITY: Validate recipient address format\n    if (!isValidWalletAddress(expectedRecipient)) {\n        return { valid: false, confirmed: false, signature, error: 'Invalid recipient address' };\n    }\n\n    // SECURITY: Validate expected amount is positive\n    if (expectedAmount <= 0n) {\n        return { valid: false, confirmed: false, signature, error: 'Invalid expected amount' };\n    }\n\n    // SECURITY: Enforce reasonable max age (prevent replay with very old transactions)\n    const effectiveMaxAge = Math.min(Math.max(maxAgeSeconds, 60), 3600); // 1 min to 1 hour\n\n    const connection = getConnection(clientConfig);\n\n    try {\n        const transaction = await connection.getParsedTransaction(signature, {\n            commitment: 'confirmed',\n            maxSupportedTransactionVersion: 0,\n        });\n\n        if (!transaction) {\n            return { valid: false, confirmed: false, signature, error: 'Transaction not found' };\n        }\n\n        // Check for transaction errors\n        if (transaction.meta?.err) {\n            return {\n                valid: false,\n                confirmed: true,\n                signature,\n                error: 'Transaction failed on-chain',\n            };\n        }\n\n        // SECURITY: Validate transaction age (replay protection)\n        if (transaction.blockTime) {\n            const now = Math.floor(Date.now() / 1000);\n            if (now - transaction.blockTime > effectiveMaxAge) {\n                return { valid: false, confirmed: true, signature, error: 'Transaction too old' };\n            }\n            // Also reject future-dated transactions (clock skew attack)\n            if (transaction.blockTime > now + 60) {\n                return { valid: false, confirmed: true, signature, error: 'Invalid transaction time' };\n            }\n        }\n\n        // Parse transfer details\n        const transferDetails = parseSOLTransfer(transaction, expectedRecipient);\n\n        if (!transferDetails) {\n            return {\n                valid: false,\n                confirmed: true,\n                signature,\n                error: 'No valid SOL transfer to recipient found',\n            };\n        }\n\n        // SECURITY: Validate amount (must meet or exceed expected)\n        if (transferDetails.amount < expectedAmount) {\n            return {\n                valid: false,\n                confirmed: true,\n                signature,\n                from: transferDetails.from,\n                to: transferDetails.to,\n                amount: transferDetails.amount,\n                error: 'Insufficient payment amount',\n            };\n        }\n\n        return {\n            valid: true,\n            confirmed: true,\n            signature,\n            from: transferDetails.from,\n            to: transferDetails.to,\n            amount: transferDetails.amount,\n            blockTime: transaction.blockTime ?? undefined,\n            slot: transaction.slot,\n        };\n    } catch (error) {\n        // SECURITY: Don't expose internal error details\n        return {\n            valid: false,\n            confirmed: false,\n            signature,\n            error: 'Verification failed',\n        };\n    }\n}\n\n/**\n * Wait for transaction confirmation\n */\nexport async function waitForConfirmation(\n    signature: string,\n    clientConfig: SolanaClientConfig\n): Promise<{ confirmed: boolean; slot?: number; error?: string }> {\n    if (!isValidSignature(signature)) {\n        return { confirmed: false, error: 'Invalid signature format' };\n    }\n\n    const connection = getConnection(clientConfig);\n\n    try {\n        const confirmation = await connection.confirmTransaction(signature, 'confirmed');\n\n        if (confirmation.value.err) {\n            return { confirmed: false, error: 'Transaction failed' };\n        }\n\n        return { confirmed: true, slot: confirmation.context?.slot };\n    } catch {\n        return { confirmed: false, error: 'Confirmation timeout' };\n    }\n}\n\n/**\n * Get recent transactions for a wallet\n */\nexport async function getWalletTransactions(\n    walletAddress: string,\n    clientConfig: SolanaClientConfig,\n    limit: number = 20\n): Promise<Array<{ signature: string; blockTime?: number; slot: number }>> {\n    if (!isValidWalletAddress(walletAddress)) {\n        return [];\n    }\n\n    // SECURITY: Cap limit to prevent abuse\n    const safeLimit = Math.min(Math.max(limit, 1), 100);\n\n    const connection = getConnection(clientConfig);\n\n    try {\n        const pubkey = new PublicKey(walletAddress);\n        const signatures = await connection.getSignaturesForAddress(pubkey, { limit: safeLimit });\n        return signatures.map((sig) => ({\n            signature: sig.signature,\n            blockTime: sig.blockTime ?? undefined,\n            slot: sig.slot,\n        }));\n    } catch {\n        return [];\n    }\n}\n\n/**\n * Convert lamports to SOL\n */\nexport function lamportsToSol(lamports: bigint | number): number {\n    return Number(lamports) / LAMPORTS_PER_SOL;\n}\n\n/**\n * Convert SOL to lamports\n */\nexport function solToLamports(sol: number): bigint {\n    if (!Number.isFinite(sol) || sol < 0) {\n        throw new Error('Invalid SOL amount');\n    }\n    return BigInt(Math.floor(sol * LAMPORTS_PER_SOL));\n}\n"]}

package/dist/solana/index.d.cts

@@ -38,6 +38,7 @@ interface VerifyPaymentParams {
 }
 /**
  * Verify a SOL transfer transaction
+ * SECURITY: Full on-chain verification with amount/recipient/age checks
  */
 declare function verifyPayment(params: VerifyPaymentParams): Promise<TransactionVerificationResult>;
 /**

package/dist/solana/index.d.ts

@@ -38,6 +38,7 @@ interface VerifyPaymentParams {
 }
 /**
  * Verify a SOL transfer transaction
+ * SECURITY: Full on-chain verification with amount/recipient/age checks
  */
 declare function verifyPayment(params: VerifyPaymentParams): Promise<TransactionVerificationResult>;
 /**