@bosonprotocol/x402-server 0.1.0-alpha-0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Boson Protocol
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,65 @@
+# @bosonprotocol/x402-server
+
+Framework-agnostic resource-server SDK for the Boson Protocol
+[`escrow`](https://github.com/bosonprotocol/x402-escrow-schema) scheme — the
+server side of [x402B](https://github.com/bosonprotocol/x402B).
+
+See [`docs/boson-impl-05-server-sdk.md`](../../../docs/boson-impl-05-server-sdk.md)
+for the spec and [`docs/boson-impl-01-escrow-scheme.md`](../../../docs/boson-impl-01-escrow-scheme.md)
+for the wire format.
+
+## Status
+
+**Pre-release.** v0.1 ships only the request-side primitives — the 402
+challenge builder, the seller FullOffer signer hook, and the
+`createX402bServer` factory that binds them together. Follow-up PRs add:
+
+- the `X-PAYMENT` 13-rule validator,
+- the facilitator HTTP client (talks to `@bosonprotocol/x402-facilitator`),
+- the convenience handlers (`commit-and-redeem`, `complete`, `dispute/*`),
+- a framework adapter (`@bosonprotocol/x402-server-express`).
+
+## Install
+
+```sh
+pnpm add @bosonprotocol/x402-server @bosonprotocol/x402-core @bosonprotocol/x402-actions
+```
+
+## Quick start
+
+```ts
+import { createX402bServer } from "@bosonprotocol/x402-server";
+import { buildChannelRegistry } from "@bosonprotocol/x402-actions";
+import { privateKeyToAccount } from "viem/accounts";
+
+const sellerAssistant = privateKeyToAccount(process.env.SELLER_PK as `0x${string}`);
+
+const server = createX402bServer({
+  network: "eip155:8453",
+  chainId: 8453,
+  escrow: "0xDIAMOND...",
+  signer: sellerAssistant,
+  facilitator: { url: "https://facilitator.example" },
+  channelRegistry: buildChannelRegistry({
+    channels: ["server", "facilitator", "onchain", "mcp"],
+    escrow: "0xDIAMOND...",
+    mcp: "boson://seller/12345",
+  }),
+});
+
+const requirements = await server.buildPaymentRequirements({
+  offer: { unsigned: { /* UnsignedFullOffer — see `@bosonprotocol/x402-core/eip712` */ } },
+  asset: "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913", // USDC on Base
+  amount: "1000000", // 1 USDC (6 decimals)
+  tokenAuthStrategies: ["erc3009"],
+  recipientId: "did:boson:seller:12345",
+  maxTimeoutSeconds: 300,
+});
+```
+
+`requirements` is an `EscrowPaymentRequirements` ready to embed in a
+402 response's `accepts[]` array.
+
+## License
+
+[Apache-2.0](./LICENSE)

package/dist/cjs/challenge/index.d.ts

@@ -0,0 +1,64 @@
+import { UnsignedFullOffer } from '@bosonprotocol/x402-core/eip712';
+import { Address, BosonOfferRef, TokenAuthStrategy, FulfillmentRequirements, EvmNetwork, EscrowPaymentRequirements } from '@bosonprotocol/x402-core/schemes/escrow';
+import { S as SellerSigner } from '../config-CBr9qMps.js';
+import { ChannelRegistry } from '@bosonprotocol/x402-actions';
+import '@bosonprotocol/x402-facilitator';
+import 'viem';
+import 'zod';
+import '@bosonprotocol/core-sdk';
+import '../onchain/index.js';
+
+interface SignFullOfferArgs {
+    fullOffer: UnsignedFullOffer;
+    signer: SellerSigner;
+    /** Boson Diamond address — the EIP-712 `verifyingContract`. */
+    escrow: Address;
+    chainId: number;
+}
+/**
+ * Sign a FullOffer via `@bosonprotocol/core-sdk`'s `signFullOffer`
+ * and return a `BosonOfferRef` ready to embed in
+ * `EscrowPaymentRequirements.offer`. The seller signer is plugged
+ * into core-sdk via a forwarding `Web3LibAdapter` so any viem
+ * `LocalAccount` / HSM / KMS signer drops in without exposing
+ * core-sdk's adapter shape in this package's public API.
+ *
+ * ERC-1271 contract-wallet sellers: pass the wallet's address as
+ * `signer.address` and route `signer.signTypedData` to whatever
+ * surface the wallet exposes — the protocol's on-chain `verifyOffer`
+ * runs via `EIP712Lib.verify` which already handles both ECDSA and
+ * ERC-1271 recovery.
+ */
+declare function signFullOffer({ fullOffer, signer, escrow, chainId, }: SignFullOfferArgs): Promise<BosonOfferRef>;
+
+interface BuildPaymentRequirementsArgs {
+    /** Signed offer reference — usually from `signFullOffer`. */
+    offer: BosonOfferRef;
+    /** ERC-20 token address the buyer pays in. */
+    asset: Address;
+    /** Atomic amount as a decimal string (e.g. wei). */
+    amount: string;
+    /** Token-auth strategies the server is willing to accept. */
+    tokenAuthStrategies: readonly TokenAuthStrategy[];
+    /** Routing-only seller identifier — numeric sellerId, `did:boson:seller:N`, or wallet address. */
+    recipientId: string;
+    /** Upper bound for `validBefore` / `deadline` in token-auth payloads. */
+    maxTimeoutSeconds: number;
+    /** Optional fulfillment channel options. Absent or `{required: false}` means the server treats payment as fully atomic. */
+    fulfillment?: FulfillmentRequirements;
+    /** CAIP-2 network identifier (e.g. `eip155:8453`). */
+    network: EvmNetwork;
+    /** Boson Diamond address — same as `config.escrow`. */
+    escrow: Address;
+    /** Per-seller channel registry consumed by `deriveInitialNextActions`. */
+    channelRegistry: ChannelRegistry;
+}
+/**
+ * Build an `EscrowPaymentRequirements` body (the entry that lives
+ * inside the 402 response's `accepts[]` array). The result is
+ * round-tripped through `escrowPaymentRequirementsSchema` to fail
+ * loudly if any caller-provided field violates the wire format.
+ */
+declare function buildPaymentRequirements(args: BuildPaymentRequirementsArgs): EscrowPaymentRequirements;
+
+export { type BuildPaymentRequirementsArgs, type SignFullOfferArgs, buildPaymentRequirements, signFullOffer };

package/dist/cjs/challenge/index.js

@@ -0,0 +1,96 @@
+'use strict';
+
+var coreSdk = require('@bosonprotocol/core-sdk');
+var x402Actions = require('@bosonprotocol/x402-actions');
+var escrow = require('@bosonprotocol/x402-core/schemes/escrow');
+
+// src/challenge/sign-full-offer.ts
+var STUB_CALLER_TAG = "@bosonprotocol/x402-server:sign-full-offer";
+async function signFullOffer({
+  fullOffer,
+  signer,
+  escrow,
+  chainId
+}) {
+  const web3Lib = buildForwardingAdapter(signer, chainId);
+  const result = await coreSdk.exchanges.handler.signFullOffer({
+    fullOfferArgsUnsigned: fullOffer,
+    contractAddress: escrow,
+    chainId,
+    web3Lib
+  });
+  return {
+    fullOffer,
+    sellerSig: result.signature,
+    creator: signer.address
+  };
+}
+function buildForwardingAdapter(signer, chainId) {
+  const unreachable = (method) => Promise.reject(
+    new Error(
+      `${STUB_CALLER_TAG}: Web3LibAdapter.${method}() called unexpectedly \u2014 sign-full-offer is a signing-only path.`
+    )
+  );
+  return {
+    uuid: `${STUB_CALLER_TAG}:forward`,
+    getSignerAddress: () => Promise.resolve(signer.address),
+    isSignerContract: () => Promise.resolve(false),
+    getChainId: () => Promise.resolve(chainId),
+    send: async (method, params) => {
+      if (method !== "eth_signTypedData_v4") {
+        throw new Error(`${STUB_CALLER_TAG}: unexpected RPC method: ${method}`);
+      }
+      const [, json] = params;
+      if (typeof json !== "string") {
+        throw new Error(`${STUB_CALLER_TAG}: eth_signTypedData_v4 payload is not a JSON string`);
+      }
+      const td = JSON.parse(json);
+      return signer.signTypedData({
+        domain: td.domain,
+        types: td.types,
+        primaryType: td.primaryType,
+        message: td.message
+      });
+    },
+    getBalance: () => unreachable("getBalance"),
+    estimateGas: () => unreachable("estimateGas"),
+    sendTransaction: () => unreachable("sendTransaction"),
+    call: () => unreachable("call"),
+    getTransactionReceipt: () => unreachable("getTransactionReceipt"),
+    getCurrentTimeMs: () => unreachable("getCurrentTimeMs")
+  };
+}
+function buildPaymentRequirements(args) {
+  const {
+    offer,
+    asset,
+    amount,
+    tokenAuthStrategies,
+    recipientId,
+    maxTimeoutSeconds,
+    fulfillment,
+    network,
+    escrow: escrow$1,
+    channelRegistry
+  } = args;
+  const actions = x402Actions.deriveInitialNextActions(channelRegistry);
+  const requirements = {
+    scheme: "escrow",
+    network,
+    asset,
+    amount,
+    escrowAddress: escrow$1,
+    recipientId,
+    maxTimeoutSeconds,
+    offer,
+    tokenAuthStrategies: [...tokenAuthStrategies],
+    ...fulfillment !== void 0 ? { fulfillment } : {},
+    actions
+  };
+  return escrow.escrowPaymentRequirementsSchema.parse(requirements);
+}
+
+exports.buildPaymentRequirements = buildPaymentRequirements;
+exports.signFullOffer = signFullOffer;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/cjs/challenge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/challenge/sign-full-offer.ts","../../../src/challenge/build-requirements.ts"],"names":["exchanges","escrow","deriveInitialNextActions","escrowPaymentRequirementsSchema"],"mappings":";;;;;;;AAuBA,IAAM,eAAA,GAAkB,4CAAA;AAwBxB,eAAsB,aAAA,CAAc;AAAA,EAClC,SAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA,EAA8C;AAC5C,EAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,MAAA,EAAQ,OAAO,CAAA;AACtD,EAAA,MAAM,MAAA,GAAS,MAAMA,iBAAA,CAAU,OAAA,CAAQ,aAAA,CAAc;AAAA,IACnD,qBAAA,EAAuB,SAAA;AAAA,IAGvB,eAAA,EAAiB,MAAA;AAAA,IACjB,OAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAS,MAAA,CAAO;AAAA,GAClB;AACF;AASA,SAAS,sBAAA,CAAuB,QAAsB,OAAA,EAAiC;AACrF,EAAA,MAAM,WAAA,GAAc,CAAC,MAAA,KACnB,OAAA,CAAQ,MAAA;AAAA,IACN,IAAI,KAAA;AAAA,MACF,CAAA,EAAG,eAAe,CAAA,iBAAA,EAAoB,MAAM,CAAA,qEAAA;AAAA;AAC9C,GACF;AAEF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,GAAG,eAAe,CAAA,QAAA,CAAA;AAAA,IACxB,gBAAA,EAAkB,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IACtD,gBAAA,EAAkB,MAAM,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA;AAAA,IAC7C,UAAA,EAAY,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAAA,IACzC,IAAA,EAAM,OAAO,MAAA,EAAQ,MAAA,KAAW;AAC9B,MAAA,IAAI,WAAW,sBAAA,EAAwB;AACrC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,eAAe,CAAA,yBAAA,EAA4B,MAAM,CAAA,CAAE,CAAA;AAAA,MACxE;AACA,MAAA,MAAM,GAAG,IAAI,CAAA,GAAI,MAAA;AACjB,MAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,eAAe,CAAA,mDAAA,CAAqD,CAAA;AAAA,MACzF;AACA,MAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAM1B,MAAA,OAAO,OAAO,aAAA,CAAc;AAAA,QAC1B,QAAQ,EAAA,CAAG,MAAA;AAAA,QACX,OAAO,EAAA,CAAG,KAAA;AAAA,QACV,aAAa,EAAA,CAAG,WAAA;AAAA,QAChB,SAAS,EAAA,CAAG;AAAA,OACb,CAAA;AAAA,IACH,CAAA;AAAA,IACA,UAAA,EAAY,MAAM,WAAA,CAAY,YAAY,CAAA;AAAA,IAC1C,WAAA,EAAa,MAAM,WAAA,CAAY,aAAa,CAAA;AAAA,IAC5C,eAAA,EAAiB,MAAM,WAAA,CAAY,iBAAiB,CAAA;AAAA,IACpD,IAAA,EAAM,MAAM,WAAA,CAAY,MAAM,CAAA;AAAA,IAC9B,qBAAA,EAAuB,MAAM,WAAA,CAAY,uBAAuB,CAAA;AAAA,IAChE,gBAAA,EAAkB,MAAM,WAAA,CAAY,kBAAkB;AAAA,GACxD;AACF;ACpEO,SAAS,yBACd,IAAA,EAC2B;AAC3B,EAAA,MAAM;AAAA,IACJ,KAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,mBAAA;AAAA,IACA,WAAA;AAAA,IACA,iBAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA;AAAA,YACAC,QAAA;AAAA,IACA;AAAA,GACF,GAAI,IAAA;AAEJ,EAAA,MAAM,OAAA,GAAUC,qCAAyB,eAAe,CAAA;AAExD,EAAA,MAAM,YAAA,GAA0C;AAAA,IAC9C,MAAA,EAAQ,QAAA;AAAA,IACR,OAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,aAAA,EAAeD,QAAA;AAAA,IACf,WAAA;AAAA,IACA,iBAAA;AAAA,IACA,KAAA;AAAA,IACA,mBAAA,EAAqB,CAAC,GAAG,mBAAmB,CAAA;AAAA,IAC5C,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB,EAAC;AAAA,IACnD;AAAA,GACF;AAEA,EAAA,OAAOE,sCAAA,CAAgC,MAAM,YAAY,CAAA;AAC3D","file":"index.js","sourcesContent":["// FullOffer signer hook — produces the seller's `BosonOfferRef` from\n// an unsigned FullOffer. Delegates directly to\n// `@bosonprotocol/core-sdk`'s `exchanges.handler.signFullOffer`,\n// supplying a forwarding `Web3LibAdapter` that routes the inner\n// `eth_signTypedData_v4` RPC call to the configured `SellerSigner`.\n//\n// Routing through core-sdk keeps the typed-data shape, EIP-712 domain\n// (salt-based `Boson Protocol` / `V2`), and offer-struct\n// canonicalisation in lock-step with the deployed protocol — we don't\n// re-derive the FullOffer EIP-712 type-list on our side.\n\nimport { exchanges } from \"@bosonprotocol/core-sdk\";\nimport type { Web3LibAdapter } from \"@bosonprotocol/common\";\nimport type { UnsignedFullOffer } from \"@bosonprotocol/x402-core/eip712\";\nimport type {\n  Address,\n  BosonOfferRef,\n  FullOffer,\n  Hex,\n} from \"@bosonprotocol/x402-core/schemes/escrow\";\n\nimport type { SellerSigner } from \"../config.js\";\n\nconst STUB_CALLER_TAG = \"@bosonprotocol/x402-server:sign-full-offer\";\n\nexport interface SignFullOfferArgs {\n  fullOffer: UnsignedFullOffer;\n  signer: SellerSigner;\n  /** Boson Diamond address — the EIP-712 `verifyingContract`. */\n  escrow: Address;\n  chainId: number;\n}\n\n/**\n * Sign a FullOffer via `@bosonprotocol/core-sdk`'s `signFullOffer`\n * and return a `BosonOfferRef` ready to embed in\n * `EscrowPaymentRequirements.offer`. The seller signer is plugged\n * into core-sdk via a forwarding `Web3LibAdapter` so any viem\n * `LocalAccount` / HSM / KMS signer drops in without exposing\n * core-sdk's adapter shape in this package's public API.\n *\n * ERC-1271 contract-wallet sellers: pass the wallet's address as\n * `signer.address` and route `signer.signTypedData` to whatever\n * surface the wallet exposes — the protocol's on-chain `verifyOffer`\n * runs via `EIP712Lib.verify` which already handles both ECDSA and\n * ERC-1271 recovery.\n */\nexport async function signFullOffer({\n  fullOffer,\n  signer,\n  escrow,\n  chainId,\n}: SignFullOfferArgs): Promise<BosonOfferRef> {\n  const web3Lib = buildForwardingAdapter(signer, chainId);\n  const result = await exchanges.handler.signFullOffer({\n    fullOfferArgsUnsigned: fullOffer as unknown as Parameters<\n      typeof exchanges.handler.signFullOffer\n    >[0][\"fullOfferArgsUnsigned\"],\n    contractAddress: escrow,\n    chainId,\n    web3Lib,\n  });\n  return {\n    fullOffer: fullOffer as unknown as FullOffer,\n    sellerSig: result.signature as Hex,\n    creator: signer.address,\n  };\n}\n\n/**\n * Build a `Web3LibAdapter` whose `send(\"eth_signTypedData_v4\", [from, json])`\n * routes to `signer.signTypedData(...)`. core-sdk's `signFullOffer`\n * path only touches `getSignerAddress`, `getChainId`, and that one\n * `send` invocation — every other adapter method rejects so a future\n * leak into a non-signing-only path is loud rather than silent.\n */\nfunction buildForwardingAdapter(signer: SellerSigner, chainId: number): Web3LibAdapter {\n  const unreachable = (method: string): Promise<never> =>\n    Promise.reject(\n      new Error(\n        `${STUB_CALLER_TAG}: Web3LibAdapter.${method}() called unexpectedly — sign-full-offer is a signing-only path.`,\n      ),\n    );\n\n  return {\n    uuid: `${STUB_CALLER_TAG}:forward`,\n    getSignerAddress: () => Promise.resolve(signer.address),\n    isSignerContract: () => Promise.resolve(false),\n    getChainId: () => Promise.resolve(chainId),\n    send: async (method, params) => {\n      if (method !== \"eth_signTypedData_v4\") {\n        throw new Error(`${STUB_CALLER_TAG}: unexpected RPC method: ${method}`);\n      }\n      const [, json] = params as [unknown, string];\n      if (typeof json !== \"string\") {\n        throw new Error(`${STUB_CALLER_TAG}: eth_signTypedData_v4 payload is not a JSON string`);\n      }\n      const td = JSON.parse(json) as {\n        domain: Record<string, unknown>;\n        types: Record<string, readonly { name: string; type: string }[]>;\n        primaryType: string;\n        message: Record<string, unknown>;\n      };\n      return signer.signTypedData({\n        domain: td.domain,\n        types: td.types,\n        primaryType: td.primaryType,\n        message: td.message,\n      });\n    },\n    getBalance: () => unreachable(\"getBalance\"),\n    estimateGas: () => unreachable(\"estimateGas\"),\n    sendTransaction: () => unreachable(\"sendTransaction\"),\n    call: () => unreachable(\"call\"),\n    getTransactionReceipt: () => unreachable(\"getTransactionReceipt\"),\n    getCurrentTimeMs: () => unreachable(\"getCurrentTimeMs\"),\n  };\n}\n","// 402 challenge builder — assembles an `EscrowPaymentRequirements`\n// from per-offer inputs (asset, amount, fulfillment, etc.) plus the\n// signed `BosonOfferRef` and the server's channel registry. The\n// initial `nextActions` envelope is filled via\n// `deriveInitialNextActions(registry)` so the legal transitions out\n// of `PRE_COMMIT` are always populated consistently.\n//\n// Source of truth: docs/boson-impl-01-escrow-scheme.md §2.\n\nimport { deriveInitialNextActions, type ChannelRegistry } from \"@bosonprotocol/x402-actions\";\nimport {\n  escrowPaymentRequirementsSchema,\n  type Address,\n  type BosonOfferRef,\n  type EscrowPaymentRequirements,\n  type EvmNetwork,\n  type FulfillmentRequirements,\n  type TokenAuthStrategy,\n} from \"@bosonprotocol/x402-core/schemes/escrow\";\n\nexport interface BuildPaymentRequirementsArgs {\n  /** Signed offer reference — usually from `signFullOffer`. */\n  offer: BosonOfferRef;\n  /** ERC-20 token address the buyer pays in. */\n  asset: Address;\n  /** Atomic amount as a decimal string (e.g. wei). */\n  amount: string;\n  /** Token-auth strategies the server is willing to accept. */\n  tokenAuthStrategies: readonly TokenAuthStrategy[];\n  /** Routing-only seller identifier — numeric sellerId, `did:boson:seller:N`, or wallet address. */\n  recipientId: string;\n  /** Upper bound for `validBefore` / `deadline` in token-auth payloads. */\n  maxTimeoutSeconds: number;\n  /** Optional fulfillment channel options. Absent or `{required: false}` means the server treats payment as fully atomic. */\n  fulfillment?: FulfillmentRequirements;\n  /** CAIP-2 network identifier (e.g. `eip155:8453`). */\n  network: EvmNetwork;\n  /** Boson Diamond address — same as `config.escrow`. */\n  escrow: Address;\n  /** Per-seller channel registry consumed by `deriveInitialNextActions`. */\n  channelRegistry: ChannelRegistry;\n}\n\n/**\n * Build an `EscrowPaymentRequirements` body (the entry that lives\n * inside the 402 response's `accepts[]` array). The result is\n * round-tripped through `escrowPaymentRequirementsSchema` to fail\n * loudly if any caller-provided field violates the wire format.\n */\nexport function buildPaymentRequirements(\n  args: BuildPaymentRequirementsArgs,\n): EscrowPaymentRequirements {\n  const {\n    offer,\n    asset,\n    amount,\n    tokenAuthStrategies,\n    recipientId,\n    maxTimeoutSeconds,\n    fulfillment,\n    network,\n    escrow,\n    channelRegistry,\n  } = args;\n\n  const actions = deriveInitialNextActions(channelRegistry);\n\n  const requirements: EscrowPaymentRequirements = {\n    scheme: \"escrow\",\n    network,\n    asset,\n    amount,\n    escrowAddress: escrow,\n    recipientId,\n    maxTimeoutSeconds,\n    offer,\n    tokenAuthStrategies: [...tokenAuthStrategies],\n    ...(fulfillment !== undefined ? { fulfillment } : {}),\n    actions,\n  };\n\n  return escrowPaymentRequirementsSchema.parse(requirements) as EscrowPaymentRequirements;\n}\n"]}

package/dist/cjs/client-tnrpqVMW.d.ts

@@ -0,0 +1,36 @@
+import { FacilitatorVerifyInput, FacilitatorVerifyResult, FacilitatorSettleInput, FacilitatorSettleResult, FacilitatorPerformActionInput, FacilitatorPerformActionResult } from '@bosonprotocol/x402-facilitator';
+
+type FetchLike = (input: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+    json?: () => Promise<unknown>;
+}>;
+interface CreateFacilitatorClientOptions {
+    /** Base URL of the facilitator service (no trailing slash needed). */
+    url: string;
+    /** Optional `fetch` override — defaults to the global `fetch`. Useful for tests + non-`fetch` runtimes. */
+    fetch?: FetchLike;
+    /** Optional headers attached to every request — e.g. an `Authorization` for hosted facilitators. */
+    headers?: Record<string, string>;
+}
+interface FacilitatorClient {
+    verify(input: FacilitatorVerifyInput): Promise<FacilitatorVerifyResult>;
+    settle(input: FacilitatorSettleInput): Promise<FacilitatorSettleResult>;
+    performAction(input: FacilitatorPerformActionInput): Promise<FacilitatorPerformActionResult>;
+}
+/**
+ * Construct a typed HTTP client for the facilitator. The returned
+ * methods stringify the input as JSON and POST to the matching path
+ * on the configured URL. Bodies matching the well-formed result shape
+ * (whether HTTP 2xx success or HTTP 400 domain rejection) are returned
+ * verbatim; transport failures (network, non-JSON body,
+ * schema-mismatched body) raise `FacilitatorHttpError`.
+ */
+declare function createFacilitatorClient(opts: CreateFacilitatorClientOptions): FacilitatorClient;
+
+export { type CreateFacilitatorClientOptions as C, type FacilitatorClient as F, type FetchLike as a, createFacilitatorClient as c };