@devlab.group/agent-commerce 2.1.0 → 2.2.0

package/dist/cli/svm-3MMYFPC7.js

@@ -0,0 +1,33 @@
+import { computeSvmReplayKey } from './chunk-OSTCU6ZK.js';
+import { isRecord } from './chunk-3M6U7ILB.js';
+import { getAddressEncoder, getProgramDerivedAddress, address } from '@solana/kit';
+import { transactionMessageHash, decodeTransactionFromPayload } from '@x402/svm';
+
+var MAX_TRANSACTION_BASE64 = 1644;
+var ASSOCIATED_TOKEN_PROGRAM = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+async function associatedTokenAccount(owner, mint, tokenProgram) {
+  const encoder = getAddressEncoder();
+  const [account] = await getProgramDerivedAddress({
+    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),
+    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key)))
+  });
+  return account;
+}
+function svmReplayKey(payload, network) {
+  if (!isRecord(payload)) return "invalid_exact_svm_payload_transaction";
+  const transaction = payload["transaction"];
+  if (typeof transaction !== "string" || transaction.length > MAX_TRANSACTION_BASE64) {
+    return "invalid_exact_svm_payload_transaction";
+  }
+  let messageHash;
+  try {
+    messageHash = transactionMessageHash(decodeTransactionFromPayload({ transaction }));
+  } catch {
+    return "invalid_exact_svm_payload_transaction_could_not_be_decoded";
+  }
+  return { replayKey: computeSvmReplayKey({ network, messageHash }) };
+}
+
+export { associatedTokenAccount, svmReplayKey };
+//# sourceMappingURL=svm-3MMYFPC7.js.map
+//# sourceMappingURL=svm-3MMYFPC7.js.map

package/dist/cli/svm-3MMYFPC7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/payments/x402/svm.ts"],"names":[],"mappings":";;;;;AAgBA,IAAM,sBAAA,GAAyB,IAAA;AAE/B,IAAM,wBAAA,GAA2B,8CAAA;AAMjC,eAAsB,sBAAA,CACpB,KAAA,EACA,IAAA,EACA,YAAA,EACiB;AACjB,EAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,EAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,wBAAA,CAAyB;AAAA,IAC/C,cAAA,EAAgB,QAAQ,wBAAwB,CAAA;AAAA,IAChD,KAAA,EAAO,CAAC,KAAA,EAAO,YAAA,EAAc,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,KAAQ,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAC;AAAA,GAC7E,CAAA;AACD,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,YAAA,CAAa,SAAkB,OAAA,EAAiD;AAC9F,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,uCAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,QAAQ,aAAa,CAAA;AACzC,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,IAAY,WAAA,CAAY,SAAS,sBAAA,EAAwB;AAClF,IAAA,OAAO,uCAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACF,IAAA,WAAA,GAAc,sBAAA,CAAuB,4BAAA,CAA6B,EAAE,WAAA,EAAa,CAAC,CAAA;AAAA,EACpF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,4DAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,SAAA,EAAW,mBAAA,CAAoB,EAAE,OAAA,EAAS,WAAA,EAAa,CAAA,EAAE;AACpE","file":"svm-3MMYFPC7.js","sourcesContent":["/**\n * Solana `exact` payload inspection: bounded decoding and the replay identity.\n * The provider loads this module only for a Solana offer, so an EVM-only\n * deployment never imports `@x402/svm` or `@solana/kit`.\n *\n * The facilitator checks the transaction itself: the fee payer, signatures,\n * instruction layout, mint, recipient token account and amount, and a\n * simulation. Its smart-wallet path accepts layouts the gateway could not\n * parse, so the gateway does not read the transfer.\n */\nimport { address, getAddressEncoder, getProgramDerivedAddress } from '@solana/kit';\nimport { decodeTransactionFromPayload, transactionMessageHash } from '@x402/svm';\nimport { isRecord } from '../../core/is-record';\nimport { computeSvmReplayKey } from './replay-key';\n\n// A Solana transaction fits a 1232-byte packet, which is 1644 base64 characters\nconst MAX_TRANSACTION_BASE64 = 1644;\n\nconst ASSOCIATED_TOKEN_PROGRAM = 'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL';\n\n/**\n * The associated token account of `owner` for `mint`, where the SDK client\n * sends a Solana `exact` payment. Its transaction cannot create the account.\n */\nexport async function associatedTokenAccount(\n  owner: string,\n  mint: string,\n  tokenProgram: string,\n): Promise<string> {\n  const encoder = getAddressEncoder();\n  const [account] = await getProgramDerivedAddress({\n    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),\n    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key))),\n  });\n  return account;\n}\n\n/**\n * Returns the Solana `exact` replay key, or an SDK refusal reason for a\n * missing, oversized or undecodable transaction.\n */\nexport function svmReplayKey(payload: unknown, network: string): { replayKey: string } | string {\n  if (!isRecord(payload)) return 'invalid_exact_svm_payload_transaction';\n  const transaction = payload['transaction'];\n  if (typeof transaction !== 'string' || transaction.length > MAX_TRANSACTION_BASE64) {\n    return 'invalid_exact_svm_payload_transaction';\n  }\n  let messageHash: string;\n  try {\n    messageHash = transactionMessageHash(decodeTransactionFromPayload({ transaction }));\n  } catch {\n    return 'invalid_exact_svm_payload_transaction_could_not_be_decoded';\n  }\n  return { replayKey: computeSvmReplayKey({ network, messageHash }) };\n}\n"]}

package/dist/cli/x402-NKR3WQDQ.js

@@ -0,0 +1,96 @@
+import { chainIdFromCaip2 } from './chunk-KLX2YZDG.js';
+export { createX402PaymentProvider } from './chunk-KLX2YZDG.js';
+import './chunk-NSPPEF5M.js';
+export { SUPPORTED_NETWORK_IDS } from './chunk-7JNYFUT3.js';
+import './chunk-OSTCU6ZK.js';
+import './chunk-FRMLWGSS.js';
+import { CommerceError } from './chunk-QQ3WY5L3.js';
+import './chunk-3M6U7ILB.js';
+import { PaymentRequirementsV2Schema } from '@x402/core/schemas';
+import { getAddress, toHex } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+
+var X402_VERSION = 2;
+var TRANSFER_WITH_AUTHORIZATION_TYPES = {
+  TransferWithAuthorization: [
+    { name: "from", type: "address" },
+    { name: "to", type: "address" },
+    { name: "value", type: "uint256" },
+    { name: "validAfter", type: "uint256" },
+    { name: "validBefore", type: "uint256" },
+    { name: "nonce", type: "bytes32" }
+  ]
+};
+async function createPaymentProof(options) {
+  const requirements = PaymentRequirementsV2Schema.parse(options.accepts);
+  const method = requirements.extra?.["assetTransferMethod"];
+  if (method !== void 0 && method !== "eip3009") {
+    throw new CommerceError(
+      "INPUT_INVALID",
+      `createPaymentProof: signs EIP-3009 only, and this offer uses "${String(method)}"; sign it with the SDK's x402Client`
+    );
+  }
+  if (!requirements.extra || typeof requirements.extra["name"] !== "string" || typeof requirements.extra["version"] !== "string") {
+    throw new CommerceError(
+      "INPUT_INVALID",
+      "createPaymentProof: payment requirement is missing extra.name/extra.version, so the EIP-712 domain cannot be built"
+    );
+  }
+  const chainId = chainIdFromCaip2(requirements.network);
+  if (chainId === void 0) {
+    throw new CommerceError(
+      "INPUT_INVALID",
+      `createPaymentProof: network "${requirements.network}" is not a CAIP-2 eip155 identifier, so there is no chain id to sign against`
+    );
+  }
+  const account = privateKeyToAccount(options.buyerPrivateKey);
+  const nonce = options.overrides?.nonce ?? randomNonce();
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const validAfter = options.overrides?.validAfter ?? 0;
+  const validBefore = options.overrides?.validBefore ?? nowSeconds + requirements.maxTimeoutSeconds;
+  const to = getAddress(options.overrides?.payTo ?? requirements.payTo);
+  const value = BigInt(options.overrides?.value ?? requirements.amount);
+  const signature = await account.signTypedData({
+    domain: {
+      name: requirements.extra["name"],
+      version: requirements.extra["version"],
+      chainId,
+      verifyingContract: getAddress(requirements.asset)
+    },
+    types: TRANSFER_WITH_AUTHORIZATION_TYPES,
+    primaryType: "TransferWithAuthorization",
+    message: {
+      from: account.address,
+      to,
+      value,
+      validAfter: BigInt(validAfter),
+      validBefore: BigInt(validBefore),
+      nonce
+    }
+  });
+  const payload = {
+    x402Version: X402_VERSION,
+    accepted: requirements,
+    payload: {
+      signature,
+      authorization: {
+        from: account.address,
+        to,
+        value: value.toString(),
+        validAfter: validAfter.toString(),
+        validBefore: validBefore.toString(),
+        nonce
+      }
+    }
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64");
+}
+function randomNonce() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return toHex(bytes);
+}
+
+export { createPaymentProof };
+//# sourceMappingURL=x402-NKR3WQDQ.js.map
+//# sourceMappingURL=x402-NKR3WQDQ.js.map

package/dist/cli/x402-NKR3WQDQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/payments/x402/client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAkCA,IAAM,YAAA,GAAe,CAAA;AAErB,IAAM,iCAAA,GAAoC;AAAA,EACxC,yBAAA,EAA2B;AAAA,IACzB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AAAA,IAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,SAAA,EAAU;AAAA,IACtC,EAAE,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,SAAA,EAAU;AAAA,IACvC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU;AAErC,CAAA;AAGA,eAAsB,mBAAmB,OAAA,EAAqD;AAC5F,EAAA,MAAM,YAAA,GAAe,2BAAA,CAA4B,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,KAAA,GAAQ,qBAAqB,CAAA;AACzD,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,SAAA,EAAW;AAChD,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,8DAAA,EAAiE,MAAA,CAAO,MAAM,CAAC,CAAA,oCAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,IACE,CAAC,YAAA,CAAa,KAAA,IACd,OAAO,aAAa,KAAA,CAAM,MAAM,CAAA,KAAM,QAAA,IACtC,OAAO,YAAA,CAAa,KAAA,CAAM,SAAS,MAAM,QAAA,EACzC;AACA,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,YAAA,CAAa,OAAO,CAAA;AACrD,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,aAAa,OAAO,CAAA,4EAAA;AAAA,KACtD;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,OAAA,CAAQ,eAAe,CAAA;AAE3D,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,WAAA,EAAY;AACtD,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAG/C,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,SAAA,EAAW,UAAA,IAAc,CAAA;AACpD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,WAAA,IAAe,aAAa,YAAA,CAAa,iBAAA;AAChF,EAAA,MAAM,KAAK,UAAA,CAAY,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,KAAuB,CAAA;AACvF,EAAA,MAAM,QAAQ,MAAA,CAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,MAAM,CAAA;AAEpE,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,aAAA,CAAc;AAAA,IAC5C,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA,CAAa,KAAA,CAAM,MAAM,CAAA;AAAA,MAC/B,OAAA,EAAS,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AAAA,MACrC,OAAA;AAAA,MACA,iBAAA,EAAmB,UAAA,CAAW,YAAA,CAAa,KAAsB;AAAA,KACnE;AAAA,IACA,KAAA,EAAO,iCAAA;AAAA,IACP,WAAA,EAAa,2BAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,OAAA;AAAA,MACd,EAAA;AAAA,MACA,KAAA;AAAA,MACA,UAAA,EAAY,OAAO,UAAU,CAAA;AAAA,MAC7B,WAAA,EAAa,OAAO,WAAW,CAAA;AAAA,MAC/B;AAAA;AACF,GACD,CAAA;AAKD,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,WAAA,EAAa,YAAA;AAAA,IACb,QAAA,EAAU,YAAA;AAAA,IACV,OAAA,EAAS;AAAA,MACP,SAAA;AAAA,MACA,aAAA,EAAe;AAAA,QACb,MAAM,OAAA,CAAQ,OAAA;AAAA,QACd,EAAA;AAAA,QACA,KAAA,EAAO,MAAM,QAAA,EAAS;AAAA,QACtB,UAAA,EAAY,WAAW,QAAA,EAAS;AAAA,QAChC,WAAA,EAAa,YAAY,QAAA,EAAS;AAAA,QAClC;AAAA;AACF;AACF,GACF;AAEA,EAAA,OAAO,MAAA,CAAO,KAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACvE;AAEA,SAAS,WAAA,GAA6B;AACpC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,MAAM,KAAK,CAAA;AACpB","file":"x402-NKR3WQDQ.js","sourcesContent":["/**\n * Client-side payment helper: builds and EIP-712-signs an x402 v2 `exact`/EVM\n * authorization on the buyer's side. The demo buyer agent and the test suites\n * use it, and the `/x402` entry exports it. The gateway never calls it and\n * never holds a buyer key.\n *\n * It signs directly rather than through the SDK's `x402Client` because of\n * `overrides`: negative tests need deliberately wrong authorizations that a\n * conforming client will not produce. The x402 settlement E2E suite also\n * settles a payment built by `x402Client` itself to cover interoperability.\n */\n\nimport { PaymentRequirementsV2Schema } from '@x402/core/schemas';\nimport type { PaymentPayload, PaymentRequirements } from '@x402/core/types';\nimport { getAddress, toHex } from 'viem';\nimport { privateKeyToAccount } from 'viem/accounts';\nimport { CommerceError } from '../../core';\nimport { chainIdFromCaip2 } from './chain';\n\nexport interface CreatePaymentProofOptions {\n  /** The buyer's private key. It signs locally and is never sent anywhere */\n  readonly buyerPrivateKey: `0x${string}`;\n  /** One entry from PaymentRequiredEnvelope.payment.accepts, verbatim */\n  readonly accepts: Readonly<Record<string, unknown>>;\n  /** For negative tests only: a wrong amount, recipient, nonce or validity window */\n  readonly overrides?: {\n    readonly value?: string;\n    readonly payTo?: string;\n    readonly nonce?: `0x${string}`;\n    readonly validBefore?: number;\n    readonly validAfter?: number;\n  };\n}\n\nconst X402_VERSION = 2;\n\nconst TRANSFER_WITH_AUTHORIZATION_TYPES = {\n  TransferWithAuthorization: [\n    { name: 'from', type: 'address' },\n    { name: 'to', type: 'address' },\n    { name: 'value', type: 'uint256' },\n    { name: 'validAfter', type: 'uint256' },\n    { name: 'validBefore', type: 'uint256' },\n    { name: 'nonce', type: 'bytes32' },\n  ],\n} as const;\n\n/** Returns the base64 `PAYMENT-SIGNATURE` value to send back to the gateway */\nexport async function createPaymentProof(options: CreatePaymentProofOptions): Promise<string> {\n  const requirements = PaymentRequirementsV2Schema.parse(options.accepts);\n  const method = requirements.extra?.['assetTransferMethod'];\n  if (method !== undefined && method !== 'eip3009') {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: signs EIP-3009 only, and this offer uses \"${String(method)}\"; sign it with the SDK's x402Client`,\n    );\n  }\n  if (\n    !requirements.extra ||\n    typeof requirements.extra['name'] !== 'string' ||\n    typeof requirements.extra['version'] !== 'string'\n  ) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      'createPaymentProof: payment requirement is missing extra.name/extra.version, so the EIP-712 domain cannot be built',\n    );\n  }\n\n  const chainId = chainIdFromCaip2(requirements.network);\n  if (chainId === undefined) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: network \"${requirements.network}\" is not a CAIP-2 eip155 identifier, so there is no chain id to sign against`,\n    );\n  }\n\n  const account = privateKeyToAccount(options.buyerPrivateKey);\n\n  const nonce = options.overrides?.nonce ?? randomNonce();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  // 0, as in the SDK's own v2 client: nothing here wants the authorization\n  // delayed\n  const validAfter = options.overrides?.validAfter ?? 0;\n  const validBefore = options.overrides?.validBefore ?? nowSeconds + requirements.maxTimeoutSeconds;\n  const to = getAddress((options.overrides?.payTo ?? requirements.payTo) as `0x${string}`);\n  const value = BigInt(options.overrides?.value ?? requirements.amount);\n\n  const signature = await account.signTypedData({\n    domain: {\n      name: requirements.extra['name'],\n      version: requirements.extra['version'],\n      chainId,\n      verifyingContract: getAddress(requirements.asset as `0x${string}`),\n    },\n    types: TRANSFER_WITH_AUTHORIZATION_TYPES,\n    primaryType: 'TransferWithAuthorization',\n    message: {\n      from: account.address,\n      to,\n      value,\n      validAfter: BigInt(validAfter),\n      validBefore: BigInt(validBefore),\n      nonce,\n    },\n  });\n\n  // v2 echoes the chosen requirement back as `accepted` so a stateless\n  // facilitator knows which offer was taken. The gateway verifies against its\n  // own copy.\n  const payload: PaymentPayload = {\n    x402Version: X402_VERSION,\n    accepted: requirements as PaymentRequirements,\n    payload: {\n      signature,\n      authorization: {\n        from: account.address,\n        to,\n        value: value.toString(),\n        validAfter: validAfter.toString(),\n        validBefore: validBefore.toString(),\n        nonce,\n      },\n    },\n  };\n\n  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');\n}\n\nfunction randomNonce(): `0x${string}` {\n  const bytes = new Uint8Array(32);\n  crypto.getRandomValues(bytes);\n  return toHex(bytes);\n}\n"]}

package/dist/index.d.ts

@@ -496,6 +496,8 @@ interface GatewayConfig {
             readonly paymentFlow?: X402PaymentFlow;
             /** Resources whose `paymentFlow` overrides the rail's, by resource id */
             readonly resourcePaymentFlows?: Readonly<Record<string, X402PaymentFlow>>;
+            /** Resources that set `mimeType`, by resource id; others declare `application/json` */
+            readonly resourceMimeTypes?: Readonly<Record<string, string>>;
             readonly facilitator: X402FacilitatorConfig;
             readonly allowMainnet?: boolean;
             readonly allowUnauthenticatedFacilitator?: boolean;

package/dist/index.js

@@ -1,10 +1,10 @@
-import { openSqliteDatabase, AP2_SPEC_VERSION, AP2_MODES, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_JWK_MEMBERS, AP2_KEY_TYPE, AP2_SIGNING_ALGORITHM, AP2_JWK_CURVE, AP2_JWK_COORDINATE_BYTES, AP2_MAX_CLOCK_SKEW_SECONDS } from './chunk-LZS5BL3W.js';
+import { openSqliteDatabase, AP2_SPEC_VERSION, AP2_MODES, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_JWK_MEMBERS, AP2_KEY_TYPE, AP2_SIGNING_ALGORITHM, AP2_JWK_CURVE, AP2_JWK_COORDINATE_BYTES, AP2_MAX_CLOCK_SKEW_SECONDS } from './chunk-IEW7NSP2.js';
 import { readCappedBody, createBearerCheck, MCP_TOOL_NAME_PATTERN, settlementResponse, joinUrl, settlementResponseFromDetails, settlementFailure, x402ErrorCode, x402RefusalStatus } from './chunk-ES3V6ECS.js';
 import { MPP_DEFAULT_NETWORK, isMppNetwork, MPP_NETWORKS, MPP_DEFAULT_PAYMENT_FLOW, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPP_PROFILE } from './chunk-6Z2H53CG.js';
 import { contentDigest, CONTENT_DIGEST_METADATA_KEY, mppProblem, mppProblemDetail } from './chunk-5ZYXBCDX.js';
-import { X402_PAYMENT_FLOWS, validateCustomNetworks, findX402Network, X402_DEFAULT_PAYMENT_FLOW, resolveX402Deployment, SETTLE_AFTER_BACKEND_METADATA_KEY, resolveDeploymentMode, requireX402Network, resolveX402Option, isEvmAddress, isEvmZeroAddress, x402OfferName, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY } from './chunk-IFGRCXME.js';
-import { RESERVED_INPUT_FIELDS, PROTOCOL_NAMES, PAYMENT_METHOD_NAMES, PAYMENT_HEADER, AUTHORIZATION_HEADER, CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION, toCommerceError, DEFAULT_BACKEND_TIMEOUT_MS, isCommerceError, describeError, isHttpProtocolAdapter, toLogInfo, extractReservedInputFields, parseAuthorizationHeader, toPaymentRequiredEnvelope, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, parseAuthorizationSubmission } from './chunk-SY6GUYSQ.js';
-export { AUTHORIZATION_HEADER, AUTHORIZATION_INPUT_FIELD, COMMERCE_ERROR_CODES, COMMERCE_ERROR_HTTP_STATUS, COMMERCE_EVENT_TYPES, CommerceError, DEFAULT_BACKEND_TIMEOUT_MS, DELIVERY_SUMMARY_META_KEY, MAX_AUTHORIZATION_HEADER_BYTES, NOOP_LOGGER, PAYMENT_HEADER, PAYMENT_INPUT_FIELD, PAYMENT_METHOD_NAMES, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, PROTOCOL_NAMES, RESERVED_INPUT_FIELDS, RETRYABLE_ERROR_CODES, extractReservedInputFields, isCommerceError, isHttpProtocolAdapter, isPaymentRequiredEnvelope, parseAuthorizationHeader, parseAuthorizationSubmission, systemClock, toCommerceError, toDeliverySummary, toErrorEnvelope, toPaymentRequiredEnvelope } from './chunk-SY6GUYSQ.js';
+import { X402_PAYMENT_FLOWS, validateCustomNetworks, findX402Network, X402_DEFAULT_PAYMENT_FLOW, resolveX402Deployment, SETTLE_AFTER_BACKEND_METADATA_KEY, resolveDeploymentMode, requireX402Network, resolveX402Option, isEvmAddress, isEvmZeroAddress, x402OfferName, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY } from './chunk-Y4RE3XYF.js';
+import { RESERVED_INPUT_FIELDS, PROTOCOL_NAMES, PAYMENT_METHOD_NAMES, PAYMENT_HEADER, AUTHORIZATION_HEADER, CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION, toCommerceError, DEFAULT_BACKEND_TIMEOUT_MS, isCommerceError, describeError, isHttpProtocolAdapter, toLogInfo, extractReservedInputFields, parseAuthorizationHeader, toPaymentRequiredEnvelope, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, parseAuthorizationSubmission } from './chunk-7ZMMXZ4G.js';
+export { AUTHORIZATION_HEADER, AUTHORIZATION_INPUT_FIELD, COMMERCE_ERROR_CODES, COMMERCE_ERROR_HTTP_STATUS, COMMERCE_EVENT_TYPES, CommerceError, DEFAULT_BACKEND_TIMEOUT_MS, DELIVERY_SUMMARY_META_KEY, MAX_AUTHORIZATION_HEADER_BYTES, NOOP_LOGGER, PAYMENT_HEADER, PAYMENT_INPUT_FIELD, PAYMENT_METHOD_NAMES, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, PROTOCOL_NAMES, RESERVED_INPUT_FIELDS, RETRYABLE_ERROR_CODES, extractReservedInputFields, isCommerceError, isHttpProtocolAdapter, isPaymentRequiredEnvelope, parseAuthorizationHeader, parseAuthorizationSubmission, systemClock, toCommerceError, toDeliverySummary, toErrorEnvelope, toPaymentRequiredEnvelope } from './chunk-7ZMMXZ4G.js';
 import { isRecord } from './chunk-2CJNA7MS.js';
 import { promises, accessSync, constants } from 'fs';
 import * as path from 'path';
@@ -810,6 +810,9 @@ function normalizeMpp(raw) {
 var SUPPORTED_CONFIG_VERSION = 1;
 var NumberOrString = z.union([z.number(), z.string()]);
 var BooleanOrString = z.union([z.boolean(), z.string()]);
+var MediaType = z.string().regex(/^[A-Za-z0-9][\w!#$&^.+-]*\/[A-Za-z0-9][\w!#$&^.+-]*(?:[ \t]*;.*)?$/, {
+  message: "must be a media type such as application/json"
+});
 var RpcUrl = z.string().min(1).refine(isHttpUrl, { message: "must be an http:// or https:// URL" });
 function isHttpUrl(value) {
   try {
@@ -955,6 +958,8 @@ var ResourceEntrySchema = z.object({
   description: z.string().optional(),
   input: JsonSchemaValueSchema.optional(),
   output: JsonSchemaValueSchema.optional(),
+  // What the backend returns; x402 challenges declare it, `application/json` by default
+  mimeType: MediaType.optional(),
   backend: BackendHandlerSchema,
   pricing: PricingSchema,
   expose: z.array(z.string().min(1)).min(1),
@@ -2803,6 +2808,13 @@ function normalizeResource(id, entry, protocols, x402, mpp, ap2) {
       { details: { path: `resources.${id}.paymentFlow`, resourceId: id } }
     );
   }
+  if (entry.mimeType !== void 0 && (entry.pricing.type !== "fixed" || !paymentMethods.includes("x402"))) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      `Resource "${id}" sets mimeType, which requires fixed pricing and "x402" in payments`,
+      { details: { path: `resources.${id}.mimeType`, resourceId: id } }
+    );
+  }
   const pricing = entry.pricing.type === "free" ? { type: "free" } : { type: "fixed", amount: entry.pricing.amount, currency: entry.pricing.currency };
   const authorization = normalizeResourceAuthorization(id, entry, pricing, ap2);
   return {
@@ -2897,7 +2909,17 @@ function normalize(raw) {
     );
     return Object.keys(flows).length > 0 ? { resourcePaymentFlows: flows } : {};
   };
-  const x402WithFlows = x402 !== void 0 ? { ...x402, ...flowOverrides2("x402") } : x402;
+  const mimeTypes = Object.fromEntries(
+    resources.flatMap((resource) => {
+      const mimeType = raw.resources[resource.id]?.mimeType;
+      return mimeType !== void 0 ? [[resource.id, mimeType]] : [];
+    })
+  );
+  const x402WithFlows = x402 !== void 0 ? {
+    ...x402,
+    ...flowOverrides2("x402"),
+    ...Object.keys(mimeTypes).length > 0 ? { resourceMimeTypes: mimeTypes } : {}
+  } : x402;
   const mppWithFlows = mpp !== void 0 ? { ...mpp, ...flowOverrides2("mpp") } : mpp;
   if (protocols.acp.enabled) validateAcpCheckoutMapping(protocols.acp, resources);
   if (protocols.a2a.enabled && !resources.some((r) => r.exposedVia.includes("a2a"))) {
@@ -3819,11 +3841,32 @@ async function handleInvoke(request, reply, options) {
       }
       reply.header("cache-control", "private");
     }
+    const contentType = relayedContentType(outcome.headers?.["content-type"], outcome.body);
+    if (contentType !== void 0) reply.type(contentType);
+    if (typeof outcome.body === "string") {
+      reply.header("content-security-policy", "sandbox");
+      reply.header("x-content-type-options", "nosniff");
+    }
     reply.status(outcome.backendStatus).send(outcome.body);
   } catch (error) {
     sendInvokeError(reply, toCommerceError(error), paymentMethod);
   }
 }
+function relayedContentType(header2, body) {
+  if (header2 === void 0) return void 0;
+  const [essence = "", ...parameters] = (header2.match(/(?:[^;"]|"(?:[^"\\]|\\.)*"?)+/g) ?? []).map(
+    (part) => part.trim()
+  );
+  const json = /[/+]json$/i.test(essence);
+  if (!isTextType(essence) || json === (typeof body === "string")) return void 0;
+  const kept = parameters.filter(
+    (parameter) => parameter !== "" && !/^charset\s*=/i.test(parameter)
+  );
+  return [essence, ...kept, "charset=utf-8"].join("; ");
+}
+function isTextType(essence) {
+  return /^text\//i.test(essence) || /[/+](?:json|xml)$/i.test(essence) || /^application\/(?:java|ecma)script$/i.test(essence);
+}
 var PROVIDER_UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
   "PAYMENT_PROVIDER_UNAVAILABLE",
   "AUTHORIZATION_PROVIDER_UNAVAILABLE"