@bankofai/x402-cli 1.0.0-beta.3 → 1.0.0-beta.5

package/dist/cli.js

@@ -5,11 +5,13 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import YAML from "yaml";
-import { createPaymentPayload, decodeRequired, decodeResponse, encodeRequired, encodeResponse, encodeSignature, headers } from "./x402.js";
-import { findTokenByAddress, getToken, normalizeNetwork, toSmallestUnit } from "./tokens.js";
-const BOOLEAN_FLAGS = new Set(["daemon", "dry-run", "help", "human", "include-blocked", "json", "version"]);
+import { createPaymentPayload, decodeRequired, decodeResponse, decodeSignature, encodeRequired, encodeResponse, encodeSignature, headers } from "./x402.js";
+import { assertRawAmount, findTokenByAddress, getToken, normalizeNetwork, toSmallestUnit } from "./tokens.js";
+const BOOLEAN_FLAGS = new Set(["daemon", "dry-run", "force", "help", "human", "include-blocked", "json", "version"]);
+const require = createRequire(import.meta.url);
 function parseArgs(argv) {
     const [command = "help", ...rest] = argv;
     const positional = [];
@@ -53,7 +55,7 @@ function parseArgs(argv) {
         else if (BOOLEAN_FLAGS.has(key)) {
             options[key] = true;
         }
-        else if (!next || next.startsWith("-")) {
+        else if (!next || next.startsWith("--")) {
             options[key] = true;
         }
         else {
@@ -342,7 +344,11 @@ function readYaml(file) {
     return YAML.parse(fs.readFileSync(file, "utf8"));
 }
 function expandEnv(value) {
-    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => {
+        if (!(name in process.env))
+            throw new Error(`environment variable \${${name}} is not set`);
+        return process.env[name] ?? "";
+    });
 }
 function expandDeep(value) {
     if (typeof value === "string")
@@ -384,6 +390,14 @@ function validateProvider(provider, file = "provider.yml") {
         if (typeof value !== "string" || !value.trim())
             throw new Error(`${file}: ${name} is required`);
     }
+    try {
+        const url = new URL(provider.forward_url);
+        if (!["http:", "https:"].includes(url.protocol))
+            throw new Error("unsupported protocol");
+    }
+    catch {
+        throw new Error(`${file}: forward_url must be a valid http(s) URL`);
+    }
     if (!Array.isArray(provider.endpoints) || !provider.endpoints.length) {
         throw new Error(`${file}: endpoints must contain at least one endpoint`);
     }
@@ -392,6 +406,12 @@ function validateProvider(provider, file = "provider.yml") {
         if (typeof endpoint.method !== "string" || typeof endpoint.path !== "string") {
             throw new Error(`${file}: each endpoint needs method and path`);
         }
+        if (!endpoint.method.trim() || !endpoint.path.trim() || !endpoint.path.startsWith("/")) {
+            throw new Error(`${file}: endpoint method/path must be non-empty and path must start with /`);
+        }
+        const price = providerPrice(endpoint);
+        if (!Number.isFinite(price) || price < 0)
+            throw new Error(`${file}: endpoint price_usd must be a finite number >= 0`);
         const key = `${endpoint.method.toUpperCase()} ${endpoint.path}`;
         if (seen.has(key))
             throw new Error(`${file}: duplicate endpoint ${key}`);
@@ -566,10 +586,41 @@ function cachedCatalogPath() {
 function providerFilename(fqn) {
     return `${fqn.replace(/\//g, "__")}.json`;
 }
+function sanitizeProviderName(name) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(name) || name.includes("..")) {
+        throw new Error("provider name must be a safe FQN using letters, numbers, dots, underscores, dashes, or slashes");
+    }
+    return name;
+}
+function safeOutputPath(baseDir, ...parts) {
+    const root = path.resolve(baseDir);
+    const target = path.resolve(root, ...parts);
+    if (target !== root && !target.startsWith(`${root}${path.sep}`)) {
+        throw new Error(`refusing to write outside output directory: ${target}`);
+    }
+    return target;
+}
+function ensureWritable(file, options) {
+    if (fs.existsSync(file) && !hasFlag(options, "force")) {
+        throw new Error(`${file} already exists; pass --force to overwrite`);
+    }
+}
 function defaultCatalogSource() {
+    const envSource = process.env.X402_CATALOG || process.env.X402_GATEWAY_CATALOG;
+    if (envSource)
+        return envSource;
     return fs.existsSync(cachedCatalogPath())
         ? cachedCatalogPath()
-        : "https://tm-x402-catalog.bankofai.io/api/catalog.json";
+        : "https://x402-catalog.bankofai.io/api/catalog.json";
+}
+function positiveIntegerOption(options, key, fallback) {
+    const value = opt(options, key, String(fallback));
+    if (!/^\d+$/.test(value))
+        throw new Error(`--${key} must be a positive integer`);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0)
+        throw new Error(`--${key} must be a positive integer`);
+    return parsed;
 }
 function remoteBaseFromCatalogPayload(payload) {
     const base = payload.base_url ?? payload.baseUrl;
@@ -597,7 +648,7 @@ function catalogDetailSource(source, section, name) {
             : base.pathname.endsWith("/")
                 ? base.pathname
                 : `${base.pathname}/`;
-        base.pathname = `${pathname}${section}/${name}.json`;
+        base.pathname = `${pathname}${section}/${providerFilename(name)}`;
         base.search = "";
         base.hash = "";
         return base.toString();
@@ -614,8 +665,6 @@ async function readCatalogProvider(source, name) {
     const summary = providers.find((item) => item.name === name || item.fqn === name);
     if (!summary)
         throw new Error(`provider not found: ${name}`);
-    if (Array.isArray(summary.endpoints) && summary.endpoints.length)
-        return summary;
     const fqn = summary.fqn ?? summary.name ?? name;
     try {
         return await readJson(catalogDetailSource(source, "providers", fqn));
@@ -696,7 +745,7 @@ function submissionCatalog(detail) {
         description,
         useCase,
         i18n: detail.i18n ?? { "zh-CN": zhCopy(title, subtitle, description, useCase) },
-        logo: detail.logo ?? "https://tm-x402-catalog.bankofai.io/assets/providers/default.png",
+        logo: detail.logo ?? "https://x402-catalog.bankofai.io/assets/providers/default.png",
         category: detail.category ?? "other",
         chains: detail.chains ?? [],
         isFirstParty: Boolean(detail.is_first_party ?? detail.isFirstParty),
@@ -762,12 +811,18 @@ async function catalogExportGateway(gatewayUrl, options) {
     const providerFqn = opt(options, "provider");
     if (!providerFqn)
         throw new Error("--provider is required");
+    sanitizeProviderName(providerFqn);
     const base = gatewayUrl.replace(/\/+$/, "");
-    const detail = await readJson(`${base}/__402/catalog/providers/${providerFqn}.json`);
-    const target = opt(options, "output-dir", path.join("providers", providerFqn));
+    const detail = await readJson(`${base}/__402/catalog/providers/${providerFilename(providerFqn)}`);
+    const outputRoot = opt(options, "output-dir", "providers");
+    const target = opt(options, "output-dir")
+        ? path.resolve(outputRoot)
+        : safeOutputPath("providers", providerFilename(providerFqn).replace(/\.json$/, ""));
     fs.mkdirSync(target, { recursive: true });
     const catalogPath = path.join(target, "catalog.json");
     const payMdPath = path.join(target, "pay.md");
+    ensureWritable(catalogPath, options);
+    ensureWritable(payMdPath, options);
     writeJson(catalogPath, submissionCatalog(detail));
     fs.writeFileSync(payMdPath, payMarkdownFromDetail(detail));
     emit({ command: "catalog export-gateway", mode: outputMode(options), result: { provider: providerFqn, catalog: catalogPath, payMd: payMdPath } });
@@ -788,7 +843,11 @@ function buildRequirement(options) {
     const decimals = decimalsOption !== undefined ? Number(decimalsOption) : registryToken.decimals;
     if (!Number.isInteger(decimals) || decimals < 0)
         throw new Error("--decimals must be a non-negative integer");
-    const amount = opt(options, "rawAmount") ?? toSmallestUnit(opt(options, "amount", "0.0001"), decimals);
+    const rawAmount = opt(options, "rawAmount") ?? opt(options, "raw-amount");
+    const humanAmount = opt(options, "amount");
+    if (rawAmount && humanAmount)
+        throw new Error("--amount and --rawAmount are mutually exclusive");
+    const amount = rawAmount ? assertRawAmount(rawAmount, "--rawAmount") : toSmallestUnit(humanAmount ?? "0.0001", decimals);
     const assetAddress = explicitAsset ?? registryToken.address;
     const assetTransferMethod = registryToken?.assetTransferMethod ?? "permit2";
     return {
@@ -827,6 +886,9 @@ function stripFlag(argv, flag) {
     return argv.filter(item => item !== flag);
 }
 function serveDaemon(argv, options) {
+    const requirement = buildRequirement(options);
+    if (!requirement.payTo)
+        throw new Error("--pay-to is required");
     const daemonArgs = stripFlag(stripFlag(argv, "--daemon"), "-d");
     const script = fileURLToPath(import.meta.url);
     const child = spawn(process.execPath, [script, ...daemonArgs], {
@@ -841,7 +903,7 @@ function serveDaemon(argv, options) {
     emit({
         command: "server",
         mode: outputMode(options),
-        network: normalizeNetwork(opt(options, "network", "tron:nile")),
+        network: requirement.network,
         scheme: "exact",
         result: {
             pid: child.pid,
@@ -854,7 +916,7 @@ function serveDaemon(argv, options) {
 function validateAmountLimits(selected, options) {
     const maxRaw = opt(options, "max-rawAmount") ?? opt(options, "max-raw-amount");
     const maxAmount = opt(options, "max-amount");
-    if (maxRaw && BigInt(selected.amount) > BigInt(maxRaw)) {
+    if (maxRaw && BigInt(selected.amount) > BigInt(assertRawAmount(maxRaw, "--max-rawAmount"))) {
         throw new Error(`payment raw amount ${selected.amount} exceeds --max-rawAmount ${maxRaw}`);
     }
     if (maxAmount) {
@@ -887,17 +949,18 @@ async function serve(options) {
     };
     const server = http.createServer(async (request, response) => {
         try {
-            if (request.url?.startsWith("/health")) {
+            const pathname = new URL(request.url ?? "/", `http://${host}:${port}`).pathname;
+            if (pathname === "/health") {
                 response.writeHead(200, { "content-type": "application/json" });
                 response.end(JSON.stringify({ ok: true }));
                 return;
             }
-            if (request.url?.startsWith("/.well-known/x402")) {
+            if (pathname === "/.well-known/x402") {
                 response.writeHead(200, { "content-type": "application/json" });
-                response.end(JSON.stringify({ network: requirement.network, scheme: "exact", asset: requirement.asset, amount: requirement.amount, payTo: requirement.payTo, pay_url: resourceUrl }));
+                response.end(JSON.stringify({ network: requirement.network, scheme: "exact", asset: requirement.asset, rawAmount: requirement.amount, amount: requirement.amount, payTo: requirement.payTo, pay_url: resourceUrl }));
                 return;
             }
-            if (!request.url?.startsWith("/pay")) {
+            if (pathname !== "/pay") {
                 response.writeHead(404).end("not found");
                 return;
             }
@@ -910,22 +973,33 @@ async function serve(options) {
                 response.end(JSON.stringify(challenge));
                 return;
             }
-            const payload = Buffer.from(signature, "base64").toString("utf8").startsWith("{")
-                ? JSON.parse(Buffer.from(signature, "base64").toString("utf8"))
-                : signature;
+            let payload;
+            try {
+                payload = decodeSignature(signature);
+            }
+            catch {
+                response.writeHead(400, { "content-type": "application/json" });
+                response.end(JSON.stringify({ error: "invalid payment signature" }));
+                return;
+            }
             const verify = await facilitatorPost(facilitatorUrl, "/verify", {
                 paymentPayload: payload,
                 paymentRequirements: requirement,
             });
-            if (verify?.valid === false || verify?.isValid === false) {
+            if (!(verify?.valid === true || verify?.isValid === true)) {
                 response.writeHead(400, { "content-type": "application/json" });
-                response.end(JSON.stringify({ error: "payment verification failed", verify }));
+                response.end(JSON.stringify({ error: "payment verification failed" }));
                 return;
             }
             const settle = await facilitatorPost(facilitatorUrl, "/settle", {
                 paymentPayload: payload,
                 paymentRequirements: requirement,
             });
+            if (!(settle?.success === true || settle?.settled === true || typeof settle?.transaction === "string" || typeof settle?.txHash === "string")) {
+                response.writeHead(502, { "content-type": "application/json" });
+                response.end(JSON.stringify({ error: "settlement failed" }));
+                return;
+            }
             response.writeHead(200, {
                 "content-type": "application/json",
                 [headers.response]: encodeResponse(settle),
@@ -937,13 +1011,18 @@ async function serve(options) {
             response.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
         }
     });
-    server.listen(port, host, () => {
-        emit({
-            command: "server",
-            network: requirement.network,
-            scheme: "exact",
-            mode: outputMode(options),
-            result: { pay_url: resourceUrl, token: opt(options, "token", "USDT"), rawAmount: requirement.amount, pay_to: requirement.payTo },
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            emit({
+                command: "server",
+                network: requirement.network,
+                scheme: "exact",
+                mode: outputMode(options),
+                result: { pay_url: resourceUrl, token: opt(options, "token", "USDT"), rawAmount: requirement.amount, pay_to: requirement.payTo },
+            });
+            resolve();
         });
     });
 }
@@ -1023,7 +1102,7 @@ async function pay(url, options) {
     const paid = await fetch(url, {
         method,
         headers: retryHeaders,
-        body: opt(options, "body"),
+        body: ["GET", "HEAD"].includes(method.toUpperCase()) ? undefined : opt(options, "body"),
     });
     const body = await responsePayload(paid);
     const paymentResponse = paid.headers.get(headers.response);
@@ -1067,10 +1146,20 @@ function executableInPath(name) {
     }
     return undefined;
 }
+function resolveGatewayPackageRuntime() {
+    try {
+        return require.resolve("@bankofai/x402-gateway/dist/cli.js");
+    }
+    catch {
+        return undefined;
+    }
+}
 function gatewayCommand(options) {
     const explicit = opt(options, "gateway-bin");
+    const gatewayPackageRuntime = resolveGatewayPackageRuntime();
     const candidates = [
         explicit ? { file: explicit, source: "--gateway-bin" } : undefined,
+        gatewayPackageRuntime ? { file: gatewayPackageRuntime, source: "@bankofai/x402-gateway dependency" } : undefined,
         { file: path.resolve(path.dirname(fileURLToPath(import.meta.url)), "gateway", "cli.js"), source: "bundled gateway runtime" },
         executableInPath("x402-gateway") ? { file: executableInPath("x402-gateway"), source: "PATH x402-gateway" } : undefined,
         { file: path.resolve(process.cwd(), "../x402-gateway/dist/cli.js"), source: "sibling ../x402-gateway" },
@@ -1087,7 +1176,7 @@ function gatewayCommand(options) {
             // Try the next candidate.
         }
     }
-    throw new Error("x402-gateway runtime not found. Install/publish a x402-gateway npm binary, run from a checkout with ../x402-gateway/dist/cli.js, or pass --gateway-bin <path>.");
+    throw new Error("x402-gateway runtime not found. Install @bankofai/x402-gateway, run from a checkout with ../x402-gateway/dist/cli.js, or pass --gateway-bin <path>.");
 }
 async function gatewayStart(args, options) {
     const gateway = gatewayCommand(options);
@@ -1269,7 +1358,7 @@ async function searchCatalog(source, query, options) {
     }
     return hits
         .sort((a, b) => b.score - a.score || a.fqn.localeCompare(b.fqn))
-        .slice(0, Number(opt(options, "limit", "10")));
+        .slice(0, positiveIntegerOption(options, "limit", 10));
 }
 function searchHitToJson(hit) {
     return {

package/dist/gateway/cli.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { loadProviders } from "./config.js";
+import { createGatewayServer } from "./server.js";
+function parseArgs(argv) {
+    const options = {};
+    for (let i = 0; i < argv.length; i += 1) {
+        const item = argv[i];
+        if (!item.startsWith("--"))
+            continue;
+        const key = item.slice(2);
+        const next = argv[i + 1];
+        if (!next || next.startsWith("--"))
+            options[key] = true;
+        else {
+            options[key] = next;
+            i += 1;
+        }
+    }
+    return options;
+}
+function opt(options, key, fallback) {
+    const value = options[key];
+    return typeof value === "string" ? value : fallback;
+}
+const options = parseArgs(process.argv.slice(2));
+const providersPath = opt(options, "providers", opt(options, "provider", process.env.X402_GATEWAY_PROVIDERS_DIR || "/app/providers"));
+const host = opt(options, "host", process.env.X402_GATEWAY_HOST || "0.0.0.0");
+const port = Number(opt(options, "port", process.env.PORT || "8080"));
+const providers = loadProviders(providersPath);
+const server = createGatewayServer(providers);
+server.listen(port, host, () => {
+    process.stdout.write(JSON.stringify({ ok: true, host, port, providers: [...providers.keys()] }, null, 2) + "\n");
+});

package/dist/gateway/config.js

@@ -0,0 +1,136 @@
+import fs from "node:fs";
+import path from "node:path";
+import YAML from "yaml";
+import { getToken, normalizeNetwork, toSmallestUnit } from "./tokens.js";
+function expandEnv(value) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
+}
+function expandDeep(value) {
+    if (typeof value === "string")
+        return expandEnv(value);
+    if (Array.isArray(value))
+        return value.map(expandDeep);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, expandDeep(item)]));
+    }
+    return value;
+}
+function assertString(value, name) {
+    if (typeof value !== "string" || !value.trim())
+        throw new Error(`${name} is required`);
+}
+function validateProvider(config, file) {
+    assertString(config.name, `${file}: name`);
+    assertString(config.forward_url, `${file}: forward_url`);
+    assertString(config.operator?.network, `${file}: operator.network`);
+    assertString(config.operator?.recipient, `${file}: operator.recipient`);
+    if (!config.endpoints?.length)
+        throw new Error(`${file}: endpoints must contain at least one endpoint`);
+    const seen = new Set();
+    for (const [index, endpoint] of config.endpoints.entries()) {
+        assertString(endpoint.method, `${file}: endpoints[${index}].method`);
+        assertString(endpoint.path, `${file}: endpoints[${index}].path`);
+        if (!endpoint.path.startsWith("/"))
+            throw new Error(`${file}: endpoint path must start with /`);
+        const method = endpoint.method.toUpperCase();
+        if (!["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(method)) {
+            throw new Error(`${file}: unsupported endpoint method ${endpoint.method}`);
+        }
+        const key = `${method} ${endpoint.path}`;
+        if (seen.has(key))
+            throw new Error(`${file}: duplicate endpoint ${key}`);
+        seen.add(key);
+        for (const [tierIndex, tier] of (endpoint.metering?.dimensions?.[0]?.tiers ?? []).entries()) {
+            if (typeof tier.price_usd !== "number" || tier.price_usd < 0) {
+                throw new Error(`${file}: endpoints[${index}].metering tier ${tierIndex} price_usd must be >= 0`);
+            }
+        }
+    }
+}
+export function loadProvider(file) {
+    const config = expandDeep(YAML.parse(fs.readFileSync(file, "utf8")));
+    validateProvider(config, file);
+    config.operator.network = normalizeNetwork(config.operator.network);
+    normalizePaymentProtocol(config, file);
+    return {
+        config,
+        facilitatorUrl: config.operator.facilitator_url ||
+            process.env.X402_FACILITATOR_URL ||
+            process.env.FACILITATOR_URL ||
+            "https://facilitator.bankofai.io",
+        facilitatorApiKey: config.operator.facilitator_api_key ||
+            (config.operator.facilitator_api_key_env
+                ? process.env[config.operator.facilitator_api_key_env]
+                : undefined) ||
+            process.env.X402_FACILITATOR_API_KEY ||
+            process.env.FACILITATOR_API_KEY,
+    };
+}
+function normalizePaymentProtocol(config, file) {
+    const raw = String(config.operator.protocol || config.operator.scheme || "exact").toLowerCase();
+    const normalized = raw.replace(/[-:\s]/g, "_");
+    if (!["exact", "exact_permit", "permit2", "exact_permit2"].includes(normalized)) {
+        throw new Error(`${file}: unsupported x402 protocol ${raw}; use exact + permit2`);
+    }
+    config.operator.scheme = "exact";
+    config.operator.protocol = "exact";
+    config.operator.asset_transfer_method = "permit2";
+    config.operator.assetTransferMethod = "permit2";
+}
+export function loadProviders(providerPath) {
+    const stat = fs.statSync(providerPath);
+    const files = stat.isDirectory()
+        ? fs.readdirSync(providerPath, { recursive: true })
+            .map(item => path.join(providerPath, String(item)))
+            .filter(item => item.endsWith("provider.yml") || item.endsWith("provider.yaml"))
+        : [providerPath];
+    const entries = files.map(file => {
+        const entry = loadProvider(file);
+        return [entry.config.name, entry];
+    });
+    const names = new Set();
+    for (const [name] of entries) {
+        if (names.has(name))
+            throw new Error(`duplicate provider name: ${name}`);
+        names.add(name);
+    }
+    return new Map(entries);
+}
+export function endpointFor(provider, method, routePath) {
+    return provider.endpoints?.find(endpoint => endpoint.method.toUpperCase() === method.toUpperCase() && pathMatches(endpoint.path, routePath));
+}
+function pathMatches(template, routePath) {
+    const templateParts = template.split("/").filter(Boolean);
+    const routeParts = routePath.split("/").filter(Boolean);
+    if (templateParts.length !== routeParts.length)
+        return false;
+    return templateParts.every((part, index) => {
+        if (part.startsWith("{") && part.endsWith("}"))
+            return routeParts[index].length > 0;
+        return part === routeParts[index];
+    });
+}
+export function priceUsd(endpoint, params = {}) {
+    const variant = endpoint?.metering?.variants?.find(item => params[item.param] === item.value);
+    return (variant?.dimensions ?? endpoint?.metering?.dimensions)?.[0]?.tiers?.[0]?.price_usd ?? 0;
+}
+export function paymentRequirements(provider, price) {
+    if (price <= 0)
+        return [];
+    const network = normalizeNetwork(provider.operator.network);
+    const symbols = provider.operator.currencies?.usd ?? ["USDT"];
+    const payTo = provider.recipients?.[provider.operator.recipient]?.account ?? provider.operator.recipient;
+    return symbols.map(symbol => {
+        const token = getToken(network, symbol);
+        const transferMethod = provider.operator.assetTransferMethod || provider.operator.asset_transfer_method || token.assetTransferMethod;
+        return {
+            scheme: "exact",
+            network,
+            amount: toSmallestUnit(price, token.decimals),
+            asset: token.address,
+            payTo,
+            maxTimeoutSeconds: provider.operator.valid_for_seconds ?? 300,
+            extra: transferMethod === "permit2" ? { assetTransferMethod: "permit2" } : {},
+        };
+    });
+}

package/dist/gateway/server.js

@@ -0,0 +1,249 @@
+import http from "node:http";
+import { URL } from "node:url";
+import { endpointFor, paymentRequirements, priceUsd } from "./config.js";
+import { decodeSignature, encodeRequired, encodeResponse, headers, matchRequirement } from "./x402.js";
+const metrics = {
+    requests: 0,
+    paidRequests: 0,
+    verifyFailures: 0,
+    settleFailures: 0,
+    upstreamFailures: 0,
+};
+async function readBody(request) {
+    const chunks = [];
+    for await (const chunk of request)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks);
+}
+function json(response, status, body, extraHeaders = {}) {
+    response.writeHead(status, { "content-type": "application/json", ...extraHeaders });
+    response.end(JSON.stringify(body));
+}
+async function facilitatorPost(entry, path, body) {
+    const headers = { "content-type": "application/json" };
+    if (entry.facilitatorApiKey) {
+        headers.authorization = `Bearer ${entry.facilitatorApiKey}`;
+    }
+    const response = await fetch(new URL(path, entry.facilitatorUrl), {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    });
+    const text = await response.text();
+    const data = text ? JSON.parse(text) : {};
+    if (!response.ok)
+        throw new Error(`facilitator ${path} failed: ${response.status} ${text}`);
+    return data;
+}
+async function attachFeeQuotes(entry, requirements, context) {
+    try {
+        const quotes = await facilitatorPost(entry, "/fee_quote", {
+            paymentRequirements: requirements,
+            context,
+        });
+        const list = Array.isArray(quotes) ? quotes : quotes.quotes ?? quotes.fees ?? [];
+        return requirements.map(requirement => {
+            const quote = list.find((item) => item.scheme === requirement.scheme &&
+                item.network === requirement.network &&
+                String(item.asset).toLowerCase() === requirement.asset.toLowerCase());
+            return quote?.fee ? { ...requirement, extra: { ...requirement.extra, fee: quote.fee } } : requirement;
+        });
+    }
+    catch {
+        return requirements;
+    }
+}
+function isAdminAllowed(request) {
+    const token = process.env.X402_GATEWAY_ADMIN_TOKEN;
+    if (!token)
+        return true;
+    const auth = request.headers.authorization ?? "";
+    return auth === `Bearer ${token}`;
+}
+function requestParams(url, body, request) {
+    const params = {};
+    url.searchParams.forEach((value, key) => { params[key] = value; });
+    const contentType = String(request.headers["content-type"] ?? "").split(";", 1)[0].toLowerCase();
+    try {
+        if (body.length && contentType === "application/json") {
+            const parsed = JSON.parse(body.toString("utf8"));
+            if (parsed && typeof parsed === "object") {
+                for (const [key, value] of Object.entries(parsed)) {
+                    if (["string", "number", "boolean"].includes(typeof value))
+                        params[key] = String(value);
+                }
+            }
+        }
+        else if (body.length && contentType === "application/x-www-form-urlencoded") {
+            new URLSearchParams(body.toString("utf8")).forEach((value, key) => { params[key] = value; });
+        }
+    }
+    catch {
+        // Metering variants are advisory; malformed bodies just do not add params.
+    }
+    return params;
+}
+function upstreamHeaders(request, entry) {
+    const headersOut = new Headers();
+    for (const [key, value] of Object.entries(request.headers)) {
+        if (!value)
+            continue;
+        const lower = key.toLowerCase();
+        if (["host", "connection", "content-length", "authorization", "payment-signature"].includes(lower))
+            continue;
+        headersOut.set(key, Array.isArray(value) ? value.join(",") : value);
+    }
+    const auth = entry.config.routing?.auth;
+    if (auth) {
+        const value = auth.value ?? (auth.value_from_env ? process.env[auth.value_from_env] : undefined);
+        if (value && ["header", "access_token", "oauth2", undefined].includes(auth.method)) {
+            headersOut.set(auth.key ?? "Authorization", `${auth.prefix ?? ""}${value}`);
+        }
+    }
+    return headersOut;
+}
+function upstreamUrl(entry, request, routePath) {
+    const sourceUrl = new URL(request.url ?? "/", "http://local");
+    const upstream = new URL(routePath + (sourceUrl.search || ""), entry.config.forward_url);
+    const auth = entry.config.routing?.auth;
+    const value = auth?.value ?? (auth?.value_from_env ? process.env[auth.value_from_env] : undefined);
+    if (auth?.method === "query_param" && value) {
+        upstream.searchParams.set(auth.param ?? auth.key ?? "api_key", value);
+    }
+    return upstream;
+}
+async function forward(entry, request, response, routePath, body, paymentResponse) {
+    const upstream = upstreamUrl(entry, request, routePath);
+    const upstreamResponse = await fetch(upstream, {
+        method: request.method,
+        headers: upstreamHeaders(request, entry),
+        body: ["GET", "HEAD"].includes(request.method ?? "GET") ? undefined : new Uint8Array(body),
+    });
+    const responseHeaders = {};
+    upstreamResponse.headers.forEach((value, key) => {
+        if (!["connection", "transfer-encoding", "content-encoding", "content-length"].includes(key.toLowerCase())) {
+            responseHeaders[key] = value;
+        }
+    });
+    if (paymentResponse)
+        responseHeaders[headers.response] = encodeResponse(paymentResponse);
+    response.writeHead(upstreamResponse.status, responseHeaders);
+    response.end(Buffer.from(await upstreamResponse.arrayBuffer()));
+}
+export function createGatewayServer(providers) {
+    return http.createServer(async (request, response) => {
+        try {
+            metrics.requests += 1;
+            const url = new URL(request.url ?? "/", "http://local");
+            if (url.pathname === "/__402/health") {
+                json(response, 200, { ok: true, providers: providers.size });
+                return;
+            }
+            if (url.pathname === "/__402/ready") {
+                json(response, 200, { ok: true, providers: providers.size });
+                return;
+            }
+            if (url.pathname === "/__402/providers") {
+                if (!isAdminAllowed(request))
+                    return json(response, 401, { error: "unauthorized" });
+                json(response, 200, { providers: [...providers.values()].map(entry => ({
+                        name: entry.config.name,
+                        title: entry.config.title,
+                        network: entry.config.operator.network,
+                        facilitatorUrl: entry.facilitatorUrl,
+                        endpoints: entry.config.endpoints?.length ?? 0,
+                    })) });
+                return;
+            }
+            if (url.pathname === "/__402/endpoints") {
+                if (!isAdminAllowed(request))
+                    return json(response, 401, { error: "unauthorized" });
+                json(response, 200, { endpoints: [...providers.values()].flatMap(entry => (entry.config.endpoints ?? []).map(endpoint => ({
+                        provider: entry.config.name,
+                        method: endpoint.method,
+                        path: endpoint.path,
+                        priceUsd: priceUsd(endpoint),
+                        network: entry.config.operator.network,
+                    }))) });
+                return;
+            }
+            if (url.pathname === "/metrics") {
+                response.writeHead(200, { "content-type": "text/plain; version=0.0.4" });
+                response.end([
+                    `x402_gateway_requests_total ${metrics.requests}`,
+                    `x402_gateway_paid_requests_total ${metrics.paidRequests}`,
+                    `x402_gateway_verify_failures_total ${metrics.verifyFailures}`,
+                    `x402_gateway_settle_failures_total ${metrics.settleFailures}`,
+                    `x402_gateway_upstream_failures_total ${metrics.upstreamFailures}`,
+                    "",
+                ].join("\n"));
+                return;
+            }
+            const match = url.pathname.match(/^\/providers\/([^/]+)(\/.*)$/);
+            if (!match) {
+                json(response, 404, { error: "not found" });
+                return;
+            }
+            const entry = providers.get(match[1]);
+            if (!entry) {
+                json(response, 404, { error: "provider not found" });
+                return;
+            }
+            const routePath = match[2];
+            const endpoint = endpointFor(entry.config, request.method ?? "GET", routePath);
+            if (!endpoint) {
+                json(response, 404, { error: "endpoint not found" });
+                return;
+            }
+            const body = await readBody(request);
+            const requirements = paymentRequirements(entry.config, priceUsd(endpoint, requestParams(url, body, request)));
+            if (!requirements.length) {
+                await forward(entry, request, response, routePath, body);
+                return;
+            }
+            const paymentHeader = request.headers[headers.signature.toLowerCase()];
+            if (!paymentHeader || Array.isArray(paymentHeader)) {
+                const accepts = await attachFeeQuotes(entry, requirements);
+                const challenge = {
+                    x402Version: 2,
+                    error: "Payment required",
+                    resource: { url: url.pathname },
+                    accepts,
+                };
+                json(response, 402, challenge, { [headers.required]: encodeRequired(challenge) });
+                return;
+            }
+            const payload = decodeSignature(paymentHeader);
+            const requirement = requirements.find(item => matchRequirement(payload, item));
+            if (!requirement) {
+                json(response, 400, { error: "payment does not match any requirement" });
+                return;
+            }
+            const verify = await facilitatorPost(entry, "/verify", {
+                paymentPayload: payload,
+                paymentRequirements: requirement,
+            });
+            if (verify?.valid === false || verify?.isValid === false) {
+                metrics.verifyFailures += 1;
+                json(response, 400, { error: "payment verification failed", verify });
+                return;
+            }
+            let settle;
+            try {
+                settle = await facilitatorPost(entry, "/settle", {
+                    paymentPayload: payload,
+                    paymentRequirements: requirement,
+                });
+            }
+            catch (error) {
+                metrics.settleFailures += 1;
+                throw error;
+            }
+            metrics.paidRequests += 1;
+            await forward(entry, request, response, routePath, body, settle);
+        }
+        catch (error) {
+            json(response, 500, { error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+}

package/dist/gateway/tokens.js

@@ -0,0 +1,38 @@
+export const TOKENS = {
+    "tron:mainnet": {
+        USDT: { address: "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t", decimals: 6, name: "Tether USD", symbol: "USDT", assetTransferMethod: "permit2" },
+        USDD: { address: "TXDk8mbtRbXeYuMNS83CfKPaYYT8XWv9Hz", decimals: 18, name: "Decentralized USD", symbol: "USDD", assetTransferMethod: "permit2" },
+    },
+    "tron:nile": {
+        USDT: { address: "TXYZopYRdj2D9XRtbG411XZZ3kM5VkAeBf", decimals: 6, name: "Tether USD", symbol: "USDT", assetTransferMethod: "permit2" },
+        USDD: { address: "TGjgvdTWWrybVLaVeFqSyVqJQWjxqRYbaK", decimals: 18, name: "Decentralized USD", symbol: "USDD", assetTransferMethod: "permit2" },
+    },
+    "eip155:56": {
+        USDT: { address: "0x55d398326f99059fF775485246999027B3197955", decimals: 18, name: "Tether USD", symbol: "USDT", assetTransferMethod: "permit2" },
+    },
+    "eip155:97": {
+        USDT: { address: "0x337610d27c682E347C9cD60BD4b3b107C9d34dDd", decimals: 18, name: "Tether USD", symbol: "USDT", assetTransferMethod: "permit2" },
+        USDC: { address: "0x64544969ed7EBf5f083679233325356EbE738930", decimals: 18, name: "USD Coin", symbol: "USDC", assetTransferMethod: "permit2" },
+    },
+};
+export function normalizeNetwork(network) {
+    return ({
+        "tron-mainnet": "tron:mainnet",
+        "tron-shasta": "tron:shasta",
+        "tron-nile": "tron:nile",
+        "bsc-mainnet": "eip155:56",
+        "bsc-testnet": "eip155:97",
+    }[network] ?? network);
+}
+export function getToken(network, symbol) {
+    const normalized = normalizeNetwork(network);
+    const token = TOKENS[normalized]?.[symbol.toUpperCase()];
+    if (!token)
+        throw new Error(`unknown token ${symbol} on ${network}`);
+    return token;
+}
+export function toSmallestUnit(amount, decimals) {
+    const [whole, fraction = ""] = String(amount).split(".");
+    const padded = (fraction + "0".repeat(decimals)).slice(0, decimals);
+    return (BigInt(whole || "0") * 10n ** BigInt(decimals) + BigInt(padded || "0")).toString();
+}

package/dist/gateway/x402.js

@@ -0,0 +1,25 @@
+import { decodePaymentSignatureHeader, encodePaymentRequiredHeader, encodePaymentResponseHeader, } from "@bankofai/x402-core/http";
+export const headers = {
+    required: "PAYMENT-REQUIRED",
+    signature: "PAYMENT-SIGNATURE",
+    response: "PAYMENT-RESPONSE",
+};
+export function encodeRequired(value) {
+    return encodePaymentRequiredHeader(value);
+}
+export function encodeResponse(value) {
+    return encodePaymentResponseHeader(value);
+}
+export function decodeSignature(value) {
+    return decodePaymentSignatureHeader(value);
+}
+export function matchRequirement(payload, requirement) {
+    const accepted = payload?.accepted ?? payload?.payment?.accepted ?? payload;
+    if (!accepted || typeof accepted !== "object")
+        return false;
+    return (accepted.scheme === requirement.scheme &&
+        accepted.network === requirement.network &&
+        String(accepted.amount) === requirement.amount &&
+        String(accepted.asset).toLowerCase() === requirement.asset.toLowerCase() &&
+        String(accepted.payTo) === requirement.payTo);
+}

package/dist/tokens.js

@@ -56,9 +56,9 @@ export const TOKENS = {
     },
     "eip155:97": {
         USDT: {
-            address: "0x64544969ed7EBf5f083679233325356EbE738930",
+            address: "0x337610d27c682E347C9cD60BD4b3b107C9d34dDd",
             decimals: 18,
-            name: "USD Coin",
+            name: "Tether USD",
             symbol: "USDT",
             version: "1",
             assetTransferMethod: "permit2",
@@ -92,8 +92,19 @@ export function findTokenByAddress(network, address) {
     const lower = address.toLowerCase();
     return Object.values(TOKENS[normalizeNetwork(network)] ?? {}).find(token => token.address.toLowerCase() === lower);
 }
+export function assertRawAmount(value, name = "raw amount") {
+    if (!/^\d+$/.test(value))
+        throw new Error(`${name} must be a non-negative integer string`);
+    return value.replace(/^0+(?=\d)/, "");
+}
 export function toSmallestUnit(amount, decimals) {
+    if (!Number.isInteger(decimals) || decimals < 0)
+        throw new Error("token decimals must be a non-negative integer");
+    if (!/^\d+(\.\d+)?$/.test(amount))
+        throw new Error("amount must be a non-negative decimal string");
     const [whole, fraction = ""] = amount.split(".");
+    if (fraction.length > decimals)
+        throw new Error(`amount has more than ${decimals} decimal places`);
     const padded = (fraction + "0".repeat(decimals)).slice(0, decimals);
-    return (BigInt(whole || "0") * 10n ** BigInt(decimals) + BigInt(padded || "0")).toString();
+    return assertRawAmount((BigInt(whole || "0") * 10n ** BigInt(decimals) + BigInt(padded || "0")).toString());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bankofai/x402-cli",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.5",
   "type": "module",
   "files": [
     "dist"
@@ -10,6 +10,8 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
+    "bundle:gateway": "node scripts/bundle-gateway.mjs",
+    "prepack": "npm run build && npm run bundle:gateway",
     "test": "npm run build && node --test tests/*.test.mjs",
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts"
@@ -20,9 +22,10 @@
   "dependencies": {
     "@bankofai/x402-core": "1.0.0",
     "@bankofai/x402-evm": "1.0.0",
+    "@bankofai/x402-gateway": "^1.0.0-beta.1",
     "@bankofai/x402-tron": "1.0.0",
-    "tronweb": "^6.0.4",
-    "viem": "^2.40.3",
+    "tronweb": "6.0.2",
+    "viem": "^2.55.0",
     "yaml": "^2.8.2"
   },
   "devDependencies": {