@chipi-stack/backend 14.15.0 → 14.15.1

package/dist/index.d.mts

@@ -649,9 +649,13 @@ declare class ChipiAi {
      * session key: a USDC `transfer` to the offer's `payTo`, then the same call
      * again with `X-PAYMENT`. The price must be at most `maxAmount`, `model`
      * must be payable and the input within `maxPromptBytes`, all checked before
-     * paying. The session must whitelist `transfer` and cap USDC. A payment
-     * that was made but not served is reported in `error.details.xPayment`;
-     * pass it back as `options.xPayment` to retry without paying again.
+     * paying. The wallet must be a wallet of the organization that owns the
+     * `sk_`: the first request names it in `X-PAYER`, and when the API answers
+     * that a payment from it would be refused, nothing is paid
+     * (`X402_PAYER_NOT_IN_ORG`). The session must whitelist `transfer` and cap
+     * USDC. A payment that was made but not served is reported in
+     * `error.details.xPayment`; pass it back as `options.xPayment` to retry
+     * without paying again.
      *
      * @example
      * ```typescript

package/dist/index.d.ts

@@ -649,9 +649,13 @@ declare class ChipiAi {
      * session key: a USDC `transfer` to the offer's `payTo`, then the same call
      * again with `X-PAYMENT`. The price must be at most `maxAmount`, `model`
      * must be payable and the input within `maxPromptBytes`, all checked before
-     * paying. The session must whitelist `transfer` and cap USDC. A payment
-     * that was made but not served is reported in `error.details.xPayment`;
-     * pass it back as `options.xPayment` to retry without paying again.
+     * paying. The wallet must be a wallet of the organization that owns the
+     * `sk_`: the first request names it in `X-PAYER`, and when the API answers
+     * that a payment from it would be refused, nothing is paid
+     * (`X402_PAYER_NOT_IN_ORG`). The session must whitelist `transfer` and cap
+     * USDC. A payment that was made but not served is reported in
+     * `error.details.xPayment`; pass it back as `options.xPayment` to retry
+     * without paying again.
      *
      * @example
      * ```typescript

package/dist/index.js

@@ -3315,9 +3315,13 @@ var ChipiAi = class {
    * session key: a USDC `transfer` to the offer's `payTo`, then the same call
    * again with `X-PAYMENT`. The price must be at most `maxAmount`, `model`
    * must be payable and the input within `maxPromptBytes`, all checked before
-   * paying. The session must whitelist `transfer` and cap USDC. A payment
-   * that was made but not served is reported in `error.details.xPayment`;
-   * pass it back as `options.xPayment` to retry without paying again.
+   * paying. The wallet must be a wallet of the organization that owns the
+   * `sk_`: the first request names it in `X-PAYER`, and when the API answers
+   * that a payment from it would be refused, nothing is paid
+   * (`X402_PAYER_NOT_IN_ORG`). The session must whitelist `transfer` and cap
+   * USDC. A payment that was made but not served is reported in
+   * `error.details.xPayment`; pass it back as `options.xPayment` to retry
+   * without paying again.
    *
    * @example
    * ```typescript
@@ -3329,20 +3333,32 @@ var ChipiAi = class {
    * ```
    */
   async think(params, options = {}) {
+    let payer;
+    if (options.payWithSession && !options.xPayment) {
+      try {
+        payer = padFelt(options.payWithSession.wallet.publicKey);
+      } catch {
+        payer = void 0;
+      }
+    }
     try {
-      return await this.postThink(params, options.xPayment);
+      return await this.postThink(params, options.xPayment, payer);
     } catch (err) {
       const offer = options.payWithSession ? sessionTransferOffer(err) : void 0;
       if (!offer || !options.payWithSession) throw err;
       return this.payAndThink(params, offer, options.payWithSession);
     }
   }
-  postThink(params, xPayment) {
+  postThink(params, xPayment, payer) {
+    const headers = {
+      ...xPayment ? { "X-PAYMENT": xPayment } : {},
+      ...payer ? { "X-PAYER": payer } : {}
+    };
     return this.client.post({
       endpoint: `${AI_BASE}/think`,
       bearerToken: this.secret(),
       body: params,
-      ...xPayment ? { headers: { "X-PAYMENT": xPayment } } : {}
+      ...Object.keys(headers).length > 0 ? { headers } : {}
     });
   }
   /**
@@ -3395,6 +3411,15 @@ var ChipiAi = class {
         { x402: { accepts: [offer] } }
       );
     }
+    const payerCheck = offer.extra?.payer;
+    if (payerCheck?.accepted === false && typeof payerCheck.address === "string" && sameFelt(payerCheck.address, pay.wallet.publicKey)) {
+      throw new shared.ChipiApiError(
+        `Wallet ${pay.wallet.publicKey} is not a wallet of the organization that owns this API key, so the API would refuse its payment; nothing was paid. Pay from a wallet of this organization.`,
+        "X402_PAYER_NOT_IN_ORG",
+        402,
+        { x402: { accepts: [offer] } }
+      );
+    }
     const payer = pay.wallet.publicKey;
     const mask = (1n << 128n) - 1n;
     const transactionHash = await this.sessions.executeTransactionWithSession(