@devlab.group/agent-commerce 2.3.0 → 2.4.1

package/dist/cli/{x402-YTKFNWVQ.js → x402-7WBFZQXV.js}

@@ -1,9 +1,9 @@
-import { chainIdFromCaip2 } from './chunk-BR7CMJOE.js';
-export { createX402PaymentProvider } from './chunk-BR7CMJOE.js';
-import './chunk-KTV52MCU.js';
+import { chainIdFromCaip2 } from './chunk-TNMLDPUO.js';
+export { createX402PaymentProvider } from './chunk-TNMLDPUO.js';
+import './chunk-WYOGIANL.js';
 export { SUPPORTED_NETWORK_IDS } from './chunk-OZ4LAWBK.js';
 import './chunk-OSTCU6ZK.js';
-import './chunk-DYHVNKRB.js';
+import './chunk-ITWNSS2B.js';
 import { CommerceError } from './chunk-QQ3WY5L3.js';
 import './chunk-3M6U7ILB.js';
 import { PaymentRequirementsV2Schema } from '@x402/core/schemas';
@@ -92,5 +92,5 @@ function randomNonce() {
 }
 
 export { createPaymentProof };
-//# sourceMappingURL=x402-YTKFNWVQ.js.map
-//# sourceMappingURL=x402-YTKFNWVQ.js.map
+//# sourceMappingURL=x402-7WBFZQXV.js.map
+//# sourceMappingURL=x402-7WBFZQXV.js.map

package/dist/cli/{x402-YTKFNWVQ.js.map → x402-7WBFZQXV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../../src/payments/x402/client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAkCA,IAAM,YAAA,GAAe,CAAA;AAErB,IAAM,iCAAA,GAAoC;AAAA,EACxC,yBAAA,EAA2B;AAAA,IACzB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AAAA,IAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,SAAA,EAAU;AAAA,IACtC,EAAE,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,SAAA,EAAU;AAAA,IACvC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU;AAErC,CAAA;AAGA,eAAsB,mBAAmB,OAAA,EAAqD;AAC5F,EAAA,MAAM,YAAA,GAAe,2BAAA,CAA4B,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,KAAA,GAAQ,qBAAqB,CAAA;AACzD,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,SAAA,EAAW;AAChD,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,8DAAA,EAAiE,MAAA,CAAO,MAAM,CAAC,CAAA,oCAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,IACE,CAAC,YAAA,CAAa,KAAA,IACd,OAAO,aAAa,KAAA,CAAM,MAAM,CAAA,KAAM,QAAA,IACtC,OAAO,YAAA,CAAa,KAAA,CAAM,SAAS,MAAM,QAAA,EACzC;AACA,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,YAAA,CAAa,OAAO,CAAA;AACrD,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,aAAa,OAAO,CAAA,4EAAA;AAAA,KACtD;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,OAAA,CAAQ,eAAe,CAAA;AAE3D,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,WAAA,EAAY;AACtD,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAG/C,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,SAAA,EAAW,UAAA,IAAc,CAAA;AACpD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,WAAA,IAAe,aAAa,YAAA,CAAa,iBAAA;AAChF,EAAA,MAAM,KAAK,UAAA,CAAY,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,KAAuB,CAAA;AACvF,EAAA,MAAM,QAAQ,MAAA,CAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,MAAM,CAAA;AAEpE,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,aAAA,CAAc;AAAA,IAC5C,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA,CAAa,KAAA,CAAM,MAAM,CAAA;AAAA,MAC/B,OAAA,EAAS,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AAAA,MACrC,OAAA;AAAA,MACA,iBAAA,EAAmB,UAAA,CAAW,YAAA,CAAa,KAAsB;AAAA,KACnE;AAAA,IACA,KAAA,EAAO,iCAAA;AAAA,IACP,WAAA,EAAa,2BAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,OAAA;AAAA,MACd,EAAA;AAAA,MACA,KAAA;AAAA,MACA,UAAA,EAAY,OAAO,UAAU,CAAA;AAAA,MAC7B,WAAA,EAAa,OAAO,WAAW,CAAA;AAAA,MAC/B;AAAA;AACF,GACD,CAAA;AAKD,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,WAAA,EAAa,YAAA;AAAA,IACb,QAAA,EAAU,YAAA;AAAA,IACV,OAAA,EAAS;AAAA,MACP,SAAA;AAAA,MACA,aAAA,EAAe;AAAA,QACb,MAAM,OAAA,CAAQ,OAAA;AAAA,QACd,EAAA;AAAA,QACA,KAAA,EAAO,MAAM,QAAA,EAAS;AAAA,QACtB,UAAA,EAAY,WAAW,QAAA,EAAS;AAAA,QAChC,WAAA,EAAa,YAAY,QAAA,EAAS;AAAA,QAClC;AAAA;AACF;AACF,GACF;AAEA,EAAA,OAAO,MAAA,CAAO,KAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACvE;AAEA,SAAS,WAAA,GAA6B;AACpC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,MAAM,KAAK,CAAA;AACpB","file":"x402-YTKFNWVQ.js","sourcesContent":["/**\n * Client-side payment helper: builds and EIP-712-signs an x402 v2 `exact`/EVM\n * authorization on the buyer's side. The demo buyer agent and the test suites\n * use it, and the `/x402` entry exports it. The gateway never calls it and\n * never holds a buyer key.\n *\n * It signs directly rather than through the SDK's `x402Client` because of\n * `overrides`: negative tests need deliberately wrong authorizations that a\n * conforming client will not produce. The x402 settlement E2E suite also\n * settles a payment built by `x402Client` itself to cover interoperability.\n */\n\nimport { PaymentRequirementsV2Schema } from '@x402/core/schemas';\nimport type { PaymentPayload, PaymentRequirements } from '@x402/core/types';\nimport { getAddress, toHex } from 'viem';\nimport { privateKeyToAccount } from 'viem/accounts';\nimport { CommerceError } from '../../core';\nimport { chainIdFromCaip2 } from './chain';\n\nexport interface CreatePaymentProofOptions {\n  /** The buyer's private key. It signs locally and is never sent anywhere */\n  readonly buyerPrivateKey: `0x${string}`;\n  /** One entry from PaymentRequiredEnvelope.payment.accepts, verbatim */\n  readonly accepts: Readonly<Record<string, unknown>>;\n  /** For negative tests only: a wrong amount, recipient, nonce or validity window */\n  readonly overrides?: {\n    readonly value?: string;\n    readonly payTo?: string;\n    readonly nonce?: `0x${string}`;\n    readonly validBefore?: number;\n    readonly validAfter?: number;\n  };\n}\n\nconst X402_VERSION = 2;\n\nconst TRANSFER_WITH_AUTHORIZATION_TYPES = {\n  TransferWithAuthorization: [\n    { name: 'from', type: 'address' },\n    { name: 'to', type: 'address' },\n    { name: 'value', type: 'uint256' },\n    { name: 'validAfter', type: 'uint256' },\n    { name: 'validBefore', type: 'uint256' },\n    { name: 'nonce', type: 'bytes32' },\n  ],\n} as const;\n\n/** Returns the base64 `PAYMENT-SIGNATURE` value to send back to the gateway */\nexport async function createPaymentProof(options: CreatePaymentProofOptions): Promise<string> {\n  const requirements = PaymentRequirementsV2Schema.parse(options.accepts);\n  const method = requirements.extra?.['assetTransferMethod'];\n  if (method !== undefined && method !== 'eip3009') {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: signs EIP-3009 only, and this offer uses \"${String(method)}\"; sign it with the SDK's x402Client`,\n    );\n  }\n  if (\n    !requirements.extra ||\n    typeof requirements.extra['name'] !== 'string' ||\n    typeof requirements.extra['version'] !== 'string'\n  ) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      'createPaymentProof: payment requirement is missing extra.name/extra.version, so the EIP-712 domain cannot be built',\n    );\n  }\n\n  const chainId = chainIdFromCaip2(requirements.network);\n  if (chainId === undefined) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: network \"${requirements.network}\" is not a CAIP-2 eip155 identifier, so there is no chain id to sign against`,\n    );\n  }\n\n  const account = privateKeyToAccount(options.buyerPrivateKey);\n\n  const nonce = options.overrides?.nonce ?? randomNonce();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  // 0, as in the SDK's own v2 client: nothing here wants the authorization\n  // delayed\n  const validAfter = options.overrides?.validAfter ?? 0;\n  const validBefore = options.overrides?.validBefore ?? nowSeconds + requirements.maxTimeoutSeconds;\n  const to = getAddress((options.overrides?.payTo ?? requirements.payTo) as `0x${string}`);\n  const value = BigInt(options.overrides?.value ?? requirements.amount);\n\n  const signature = await account.signTypedData({\n    domain: {\n      name: requirements.extra['name'],\n      version: requirements.extra['version'],\n      chainId,\n      verifyingContract: getAddress(requirements.asset as `0x${string}`),\n    },\n    types: TRANSFER_WITH_AUTHORIZATION_TYPES,\n    primaryType: 'TransferWithAuthorization',\n    message: {\n      from: account.address,\n      to,\n      value,\n      validAfter: BigInt(validAfter),\n      validBefore: BigInt(validBefore),\n      nonce,\n    },\n  });\n\n  // v2 echoes the chosen requirement back as `accepted` so a stateless\n  // facilitator knows which offer was taken. The gateway verifies against its\n  // own copy.\n  const payload: PaymentPayload = {\n    x402Version: X402_VERSION,\n    accepted: requirements as PaymentRequirements,\n    payload: {\n      signature,\n      authorization: {\n        from: account.address,\n        to,\n        value: value.toString(),\n        validAfter: validAfter.toString(),\n        validBefore: validBefore.toString(),\n        nonce,\n      },\n    },\n  };\n\n  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');\n}\n\nfunction randomNonce(): `0x${string}` {\n  const bytes = new Uint8Array(32);\n  crypto.getRandomValues(bytes);\n  return toHex(bytes);\n}\n"]}
+{"version":3,"sources":["../../src/payments/x402/client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAkCA,IAAM,YAAA,GAAe,CAAA;AAErB,IAAM,iCAAA,GAAoC;AAAA,EACxC,yBAAA,EAA2B;AAAA,IACzB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AAAA,IAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,SAAA,EAAU;AAAA,IACtC,EAAE,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,SAAA,EAAU;AAAA,IACvC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU;AAErC,CAAA;AAGA,eAAsB,mBAAmB,OAAA,EAAqD;AAC5F,EAAA,MAAM,YAAA,GAAe,2BAAA,CAA4B,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,KAAA,GAAQ,qBAAqB,CAAA;AACzD,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,SAAA,EAAW;AAChD,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,8DAAA,EAAiE,MAAA,CAAO,MAAM,CAAC,CAAA,oCAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,IACE,CAAC,YAAA,CAAa,KAAA,IACd,OAAO,aAAa,KAAA,CAAM,MAAM,CAAA,KAAM,QAAA,IACtC,OAAO,YAAA,CAAa,KAAA,CAAM,SAAS,MAAM,QAAA,EACzC;AACA,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,YAAA,CAAa,OAAO,CAAA;AACrD,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,aAAa,OAAO,CAAA,4EAAA;AAAA,KACtD;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,OAAA,CAAQ,eAAe,CAAA;AAE3D,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,WAAA,EAAY;AACtD,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAG/C,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,SAAA,EAAW,UAAA,IAAc,CAAA;AACpD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,WAAA,IAAe,aAAa,YAAA,CAAa,iBAAA;AAChF,EAAA,MAAM,KAAK,UAAA,CAAY,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,KAAuB,CAAA;AACvF,EAAA,MAAM,QAAQ,MAAA,CAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,MAAM,CAAA;AAEpE,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,aAAA,CAAc;AAAA,IAC5C,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA,CAAa,KAAA,CAAM,MAAM,CAAA;AAAA,MAC/B,OAAA,EAAS,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AAAA,MACrC,OAAA;AAAA,MACA,iBAAA,EAAmB,UAAA,CAAW,YAAA,CAAa,KAAsB;AAAA,KACnE;AAAA,IACA,KAAA,EAAO,iCAAA;AAAA,IACP,WAAA,EAAa,2BAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,OAAA;AAAA,MACd,EAAA;AAAA,MACA,KAAA;AAAA,MACA,UAAA,EAAY,OAAO,UAAU,CAAA;AAAA,MAC7B,WAAA,EAAa,OAAO,WAAW,CAAA;AAAA,MAC/B;AAAA;AACF,GACD,CAAA;AAKD,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,WAAA,EAAa,YAAA;AAAA,IACb,QAAA,EAAU,YAAA;AAAA,IACV,OAAA,EAAS;AAAA,MACP,SAAA;AAAA,MACA,aAAA,EAAe;AAAA,QACb,MAAM,OAAA,CAAQ,OAAA;AAAA,QACd,EAAA;AAAA,QACA,KAAA,EAAO,MAAM,QAAA,EAAS;AAAA,QACtB,UAAA,EAAY,WAAW,QAAA,EAAS;AAAA,QAChC,WAAA,EAAa,YAAY,QAAA,EAAS;AAAA,QAClC;AAAA;AACF;AACF,GACF;AAEA,EAAA,OAAO,MAAA,CAAO,KAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACvE;AAEA,SAAS,WAAA,GAA6B;AACpC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,MAAM,KAAK,CAAA;AACpB","file":"x402-7WBFZQXV.js","sourcesContent":["/**\n * Client-side payment helper: builds and EIP-712-signs an x402 v2 `exact`/EVM\n * authorization on the buyer's side. The demo buyer agent and the test suites\n * use it, and the `/x402` entry exports it. The gateway never calls it and\n * never holds a buyer key.\n *\n * It signs directly rather than through the SDK's `x402Client` because of\n * `overrides`: negative tests need deliberately wrong authorizations that a\n * conforming client will not produce. The x402 settlement E2E suite also\n * settles a payment built by `x402Client` itself to cover interoperability.\n */\n\nimport { PaymentRequirementsV2Schema } from '@x402/core/schemas';\nimport type { PaymentPayload, PaymentRequirements } from '@x402/core/types';\nimport { getAddress, toHex } from 'viem';\nimport { privateKeyToAccount } from 'viem/accounts';\nimport { CommerceError } from '../../core';\nimport { chainIdFromCaip2 } from './chain';\n\nexport interface CreatePaymentProofOptions {\n  /** The buyer's private key. It signs locally and is never sent anywhere */\n  readonly buyerPrivateKey: `0x${string}`;\n  /** One entry from PaymentRequiredEnvelope.payment.accepts, verbatim */\n  readonly accepts: Readonly<Record<string, unknown>>;\n  /** For negative tests only: a wrong amount, recipient, nonce or validity window */\n  readonly overrides?: {\n    readonly value?: string;\n    readonly payTo?: string;\n    readonly nonce?: `0x${string}`;\n    readonly validBefore?: number;\n    readonly validAfter?: number;\n  };\n}\n\nconst X402_VERSION = 2;\n\nconst TRANSFER_WITH_AUTHORIZATION_TYPES = {\n  TransferWithAuthorization: [\n    { name: 'from', type: 'address' },\n    { name: 'to', type: 'address' },\n    { name: 'value', type: 'uint256' },\n    { name: 'validAfter', type: 'uint256' },\n    { name: 'validBefore', type: 'uint256' },\n    { name: 'nonce', type: 'bytes32' },\n  ],\n} as const;\n\n/** Returns the base64 `PAYMENT-SIGNATURE` value to send back to the gateway */\nexport async function createPaymentProof(options: CreatePaymentProofOptions): Promise<string> {\n  const requirements = PaymentRequirementsV2Schema.parse(options.accepts);\n  const method = requirements.extra?.['assetTransferMethod'];\n  if (method !== undefined && method !== 'eip3009') {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: signs EIP-3009 only, and this offer uses \"${String(method)}\"; sign it with the SDK's x402Client`,\n    );\n  }\n  if (\n    !requirements.extra ||\n    typeof requirements.extra['name'] !== 'string' ||\n    typeof requirements.extra['version'] !== 'string'\n  ) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      'createPaymentProof: payment requirement is missing extra.name/extra.version, so the EIP-712 domain cannot be built',\n    );\n  }\n\n  const chainId = chainIdFromCaip2(requirements.network);\n  if (chainId === undefined) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: network \"${requirements.network}\" is not a CAIP-2 eip155 identifier, so there is no chain id to sign against`,\n    );\n  }\n\n  const account = privateKeyToAccount(options.buyerPrivateKey);\n\n  const nonce = options.overrides?.nonce ?? randomNonce();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  // 0, as in the SDK's own v2 client: nothing here wants the authorization\n  // delayed\n  const validAfter = options.overrides?.validAfter ?? 0;\n  const validBefore = options.overrides?.validBefore ?? nowSeconds + requirements.maxTimeoutSeconds;\n  const to = getAddress((options.overrides?.payTo ?? requirements.payTo) as `0x${string}`);\n  const value = BigInt(options.overrides?.value ?? requirements.amount);\n\n  const signature = await account.signTypedData({\n    domain: {\n      name: requirements.extra['name'],\n      version: requirements.extra['version'],\n      chainId,\n      verifyingContract: getAddress(requirements.asset as `0x${string}`),\n    },\n    types: TRANSFER_WITH_AUTHORIZATION_TYPES,\n    primaryType: 'TransferWithAuthorization',\n    message: {\n      from: account.address,\n      to,\n      value,\n      validAfter: BigInt(validAfter),\n      validBefore: BigInt(validBefore),\n      nonce,\n    },\n  });\n\n  // v2 echoes the chosen requirement back as `accepted` so a stateless\n  // facilitator knows which offer was taken. The gateway verifies against its\n  // own copy.\n  const payload: PaymentPayload = {\n    x402Version: X402_VERSION,\n    accepted: requirements as PaymentRequirements,\n    payload: {\n      signature,\n      authorization: {\n        from: account.address,\n        to,\n        value: value.toString(),\n        validAfter: validAfter.toString(),\n        validBefore: validBefore.toString(),\n        nonce,\n      },\n    },\n  };\n\n  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');\n}\n\nfunction randomNonce(): `0x${string}` {\n  const bytes = new Uint8Array(32);\n  crypto.getRandomValues(bytes);\n  return toHex(bytes);\n}\n"]}

package/dist/{constants-nackLItD.d.ts → constants-BG22tE8S.d.ts}

@@ -46,4 +46,5 @@ type MppNetwork = (typeof MPP_NETWORKS)[number];
 /** Compact descriptor value naming the core draft, intent and method */
 declare const MPP_SUPPORTED_SPEC: string;
 
-export { type MppNetwork as M, MPPX_VERSION as a, MPP_PROFILE as b, MPP_SPEC_COMMIT as c, MPP_SPEC_DRAFTS as d, MPP_SPEC_REPOSITORY as e, MPP_SUPPORTED_SPEC as f };
+export { MPPX_VERSION as a, MPP_PROFILE as b, MPP_SPEC_COMMIT as c, MPP_SPEC_DRAFTS as d, MPP_SPEC_REPOSITORY as e, MPP_SUPPORTED_SPEC as f };
+export type { MppNetwork as M };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { f as Ap2AuthorizationConfig } from './types-CVw6Sf46.js';
-import { I as IsoTimestamp, D as DecimalAmount, P as PaymentMethodName, a as CommerceResource, b as PaymentSubmission, B as BackendHandler, A as AdapterDescriptor, c as AdapterHealth, R as ResourceRegistry, d as PaymentProvider, L as Logger, C as Clock, e as IdGenerator } from './runtime-7vLNYvmU.js';
-export { f as AdapterHealthComponent, g as AuthorizationMethodName, h as BackendMethod, i as DEFAULT_BACKEND_TIMEOUT_MS, J as JsonSchema, N as NOOP_LOGGER, j as PAYMENT_METHOD_NAMES, k as PROTOCOL_NAMES, l as PaymentChallenge, m as PaymentContext, n as PaymentRequirement, o as PaymentResult, p as PaymentSettlementContext, q as PaymentVerificationContext, r as Pricing, s as ProtocolName, t as systemClock } from './runtime-7vLNYvmU.js';
-import { M as MppNetwork } from './constants-nackLItD.js';
-import { X as X402PaymentFlow, a as X402FacilitatorConfig } from './guardrails-CX_jYXvZ.js';
-import { C as CustomNetworks } from './networks-DTWRlj-K.js';
-import { a as AuthorizationRequirement, b as AuthorizationSubmission, A as AuthorizationProvider } from './authorization-CMkIuAkO.js';
-export { c as AuthorizationFinalizeContext, d as AuthorizationRecord, e as AuthorizationVerification, f as AuthorizationVerificationContext } from './authorization-CMkIuAkO.js';
-import { D as DeliveredOutcome, P as PaymentRequiredOutcome, C as CommerceEvent, a as PaymentAttempt, b as CommerceReceipt, E as ExecutionPipeline, c as ProtocolAdapter, H as HttpProtocolAdapter, A as AdapterHttpRoute, d as ProtocolAdapterContext } from './protocol-adapter-CfxU8Z2T.js';
-export { e as COMMERCE_EVENT_TYPES, f as CanonicalRequest, g as CommerceEventType, h as EventSink, i as ExecutionOutcome, j as isHttpProtocolAdapter } from './protocol-adapter-CfxU8Z2T.js';
+import { Ap2AuthorizationConfig } from './ap2.js';
+import { I as IsoTimestamp, D as DecimalAmount, P as PaymentMethodName, a as CommerceResource, b as PaymentSubmission, B as BackendHandler, A as AdapterDescriptor, c as AdapterHealth, R as ResourceRegistry, d as PaymentProvider, L as Logger, C as Clock, e as IdGenerator } from './runtime-Cl_BLVZV.js';
+export { f as AdapterHealthComponent, g as AuthorizationMethodName, h as BackendMethod, i as DEFAULT_BACKEND_TIMEOUT_MS, J as JsonSchema, N as NOOP_LOGGER, j as PAYMENT_METHOD_NAMES, k as PROTOCOL_NAMES, l as PaymentChallenge, m as PaymentContext, n as PaymentRequirement, o as PaymentResult, p as PaymentSettlementContext, q as PaymentVerificationContext, r as Pricing, s as ProtocolName, t as systemClock } from './runtime-Cl_BLVZV.js';
+import { M as MppNetwork } from './constants-BG22tE8S.js';
+import { X402PaymentFlow, X402FacilitatorConfig } from './x402.js';
+import { C as CustomNetworks } from './networks-DDHYJLcg.js';
+import { a as AuthorizationRequirement, b as AuthorizationSubmission, A as AuthorizationProvider } from './authorization-DjAecwuW.js';
+export { c as AuthorizationFinalizeContext, d as AuthorizationRecord, e as AuthorizationVerification, f as AuthorizationVerificationContext } from './authorization-DjAecwuW.js';
+import { D as DeliveredOutcome, P as PaymentRequiredOutcome, C as CommerceEvent, a as PaymentAttempt, b as CommerceReceipt, E as ExecutionPipeline, c as ProtocolAdapter, H as HttpProtocolAdapter, A as AdapterHttpRoute, d as ProtocolAdapterContext } from './protocol-adapter-C9odYl6l.js';
+export { e as COMMERCE_EVENT_TYPES, f as CanonicalRequest, g as CommerceEventType, h as EventSink, i as ExecutionOutcome, j as isHttpProtocolAdapter } from './protocol-adapter-C9odYl6l.js';
 import { FastifyInstance } from 'fastify';
 import { IncomingMessage, ServerResponse } from 'node:http';
 
@@ -535,6 +535,13 @@ interface GatewayConfig {
              * Absent when no resource overrides its offers.
              */
             readonly resourceOptions?: Readonly<Record<string, readonly X402OptionConfig[]>>;
+            /**
+             * Experimental ERC-8409 quotes. Config loading includes this field only
+             * when `quote.enabled` is true. The signing key must not hold funds.
+             */
+            readonly quote?: {
+                readonly signerPrivateKey: string;
+            };
         };
         readonly mpp?: {
             readonly enabled: boolean;
@@ -740,4 +747,5 @@ interface SqliteReceiptStoreOptions {
 }
 declare function createSqliteReceiptStore(options: SqliteReceiptStoreOptions): ReceiptStore;
 
-export { A2A_AGENT_CARD_PATH, A2A_PROTOCOL_VERSION, A2A_SPEC_VERSION, type A2aAdapterOptions, ACP_API_VERSION, ACP_SPEC_VERSION, ACP_WELL_KNOWN_PATH, AUTHORIZATION_HEADER, AUTHORIZATION_INPUT_FIELD, type AcpAdapterOptions, AdapterDescriptor, AdapterHealth, AdapterHttpRoute, AuthorizationProvider, AuthorizationRequirement, AuthorizationSubmission, type BackendExecutor, BackendHandler, type BackendRequest, type BackendResponse, COMMERCE_ERROR_CODES, COMMERCE_ERROR_HTTP_STATUS, Clock, CommerceError, type CommerceErrorCode, type CommerceErrorInfo, type CommerceErrorOptions, CommerceEvent, CommerceReceipt, CommerceResource, DELIVERY_SUMMARY_META_KEY, DecimalAmount, DeliveredOutcome, type DeliverySummary, type ErrorEnvelope, ExecutionPipeline, type GatewayConfig, type GatewayInstance, type GatewayOptions, HttpProtocolAdapter, IdGenerator, IsoTimestamp, type ListOptions, Logger, MAX_AUTHORIZATION_HEADER_BYTES, PAYMENT_HEADER, PAYMENT_INPUT_FIELD, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, PaymentAttempt, type PaymentAttemptListOptions, type PaymentAttemptReservation, type PaymentAttemptUpdate, PaymentMethodName, PaymentProvider, type PaymentRequiredEnvelope, PaymentRequiredOutcome, PaymentSubmission, ProtocolAdapter, ProtocolAdapterContext, RESERVED_INPUT_FIELDS, RETRYABLE_ERROR_CODES, type ReceiptListOptions, type ReceiptStore, ResourceRegistry, createA2aAdapter, createAcpAdapter, createGateway, createSqliteReceiptStore, extractReservedInputFields, isCommerceError, isPaymentRequiredEnvelope, loadConfig, parseAuthorizationHeader, parseAuthorizationSubmission, parseConfig, createSqliteReceiptStore as receipts, toCommerceError, toDeliverySummary, toErrorEnvelope, toPaymentRequiredEnvelope };
+export { A2A_AGENT_CARD_PATH, A2A_PROTOCOL_VERSION, A2A_SPEC_VERSION, ACP_API_VERSION, ACP_SPEC_VERSION, ACP_WELL_KNOWN_PATH, AUTHORIZATION_HEADER, AUTHORIZATION_INPUT_FIELD, AdapterDescriptor, AdapterHealth, AdapterHttpRoute, AuthorizationProvider, AuthorizationRequirement, AuthorizationSubmission, BackendHandler, COMMERCE_ERROR_CODES, COMMERCE_ERROR_HTTP_STATUS, Clock, CommerceError, CommerceEvent, CommerceReceipt, CommerceResource, DELIVERY_SUMMARY_META_KEY, DecimalAmount, DeliveredOutcome, ExecutionPipeline, HttpProtocolAdapter, IdGenerator, IsoTimestamp, Logger, MAX_AUTHORIZATION_HEADER_BYTES, PAYMENT_HEADER, PAYMENT_INPUT_FIELD, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, PaymentAttempt, PaymentMethodName, PaymentProvider, PaymentRequiredOutcome, PaymentSubmission, ProtocolAdapter, ProtocolAdapterContext, RESERVED_INPUT_FIELDS, RETRYABLE_ERROR_CODES, ResourceRegistry, createA2aAdapter, createAcpAdapter, createGateway, createSqliteReceiptStore, extractReservedInputFields, isCommerceError, isPaymentRequiredEnvelope, loadConfig, parseAuthorizationHeader, parseAuthorizationSubmission, parseConfig, createSqliteReceiptStore as receipts, toCommerceError, toDeliverySummary, toErrorEnvelope, toPaymentRequiredEnvelope };
+export type { A2aAdapterOptions, AcpAdapterOptions, BackendExecutor, BackendRequest, BackendResponse, CommerceErrorCode, CommerceErrorInfo, CommerceErrorOptions, DeliverySummary, ErrorEnvelope, GatewayConfig, GatewayInstance, GatewayOptions, ListOptions, PaymentAttemptListOptions, PaymentAttemptReservation, PaymentAttemptUpdate, PaymentRequiredEnvelope, ReceiptListOptions, ReceiptStore };

package/dist/index.js

@@ -1,10 +1,10 @@
-import { openSqliteDatabase, AP2_SPEC_VERSION, AP2_MODES, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_JWK_MEMBERS, AP2_KEY_TYPE, AP2_SIGNING_ALGORITHM, AP2_JWK_CURVE, AP2_JWK_COORDINATE_BYTES, AP2_MAX_CLOCK_SKEW_SECONDS } from './chunk-4ZSE5DCH.js';
+import { openSqliteDatabase, AP2_SPEC_VERSION, AP2_MODES, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_JWK_MEMBERS, AP2_KEY_TYPE, AP2_SIGNING_ALGORITHM, AP2_JWK_CURVE, AP2_JWK_COORDINATE_BYTES, AP2_MAX_CLOCK_SKEW_SECONDS } from './chunk-WZW5ORZH.js';
 import { readCappedBody, createBearerCheck, MCP_TOOL_NAME_PATTERN, settlementResponse, joinUrl, settlementResponseFromDetails, settlementFailure, x402ErrorCode, x402RefusalStatus } from './chunk-ES3V6ECS.js';
 import { MPP_DEFAULT_NETWORK, isMppNetwork, MPP_NETWORKS, MPP_DEFAULT_PAYMENT_FLOW, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPP_PROFILE } from './chunk-6Z2H53CG.js';
 import { contentDigest, CONTENT_DIGEST_METADATA_KEY, mppProblem, mppProblemDetail } from './chunk-5ZYXBCDX.js';
-import { X402_PAYMENT_FLOWS, validateCustomNetworks, findX402Network, X402_DEFAULT_PAYMENT_FLOW, resolveX402Deployment, SETTLE_AFTER_BACKEND_METADATA_KEY, resolveDeploymentMode, requireX402Network, resolveX402Option, isEvmAddress, isEvmZeroAddress, x402OfferName, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY } from './chunk-XVU46YAH.js';
-import { RESERVED_INPUT_FIELDS, PROTOCOL_NAMES, PAYMENT_METHOD_NAMES, PAYMENT_HEADER, AUTHORIZATION_HEADER, CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION, toCommerceError, DEFAULT_BACKEND_TIMEOUT_MS, isCommerceError, describeError, isHttpProtocolAdapter, toLogInfo, extractReservedInputFields, parseAuthorizationHeader, toPaymentRequiredEnvelope, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, parseAuthorizationSubmission } from './chunk-Q5TII32R.js';
-export { AUTHORIZATION_HEADER, AUTHORIZATION_INPUT_FIELD, COMMERCE_ERROR_CODES, COMMERCE_ERROR_HTTP_STATUS, COMMERCE_EVENT_TYPES, CommerceError, DEFAULT_BACKEND_TIMEOUT_MS, DELIVERY_SUMMARY_META_KEY, MAX_AUTHORIZATION_HEADER_BYTES, NOOP_LOGGER, PAYMENT_HEADER, PAYMENT_INPUT_FIELD, PAYMENT_METHOD_NAMES, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, PROTOCOL_NAMES, RESERVED_INPUT_FIELDS, RETRYABLE_ERROR_CODES, extractReservedInputFields, isCommerceError, isHttpProtocolAdapter, isPaymentRequiredEnvelope, parseAuthorizationHeader, parseAuthorizationSubmission, systemClock, toCommerceError, toDeliverySummary, toErrorEnvelope, toPaymentRequiredEnvelope } from './chunk-Q5TII32R.js';
+import { X402_PAYMENT_FLOWS, validateCustomNetworks, findX402Network, X402_DEFAULT_PAYMENT_FLOW, resolveX402Deployment, SETTLE_AFTER_BACKEND_METADATA_KEY, resolveDeploymentMode, requireX402Network, resolveX402Option, isEvmAddress, isEvmZeroAddress, x402OfferName, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY } from './chunk-QPV3EGJO.js';
+import { RESERVED_INPUT_FIELDS, PROTOCOL_NAMES, PAYMENT_METHOD_NAMES, PAYMENT_HEADER, AUTHORIZATION_HEADER, CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION, toCommerceError, DEFAULT_BACKEND_TIMEOUT_MS, isCommerceError, describeError, isHttpProtocolAdapter, toLogInfo, extractReservedInputFields, parseAuthorizationHeader, toPaymentRequiredEnvelope, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, parseAuthorizationSubmission } from './chunk-DTKU3Z2M.js';
+export { AUTHORIZATION_HEADER, AUTHORIZATION_INPUT_FIELD, COMMERCE_ERROR_CODES, COMMERCE_ERROR_HTTP_STATUS, COMMERCE_EVENT_TYPES, CommerceError, DEFAULT_BACKEND_TIMEOUT_MS, DELIVERY_SUMMARY_META_KEY, MAX_AUTHORIZATION_HEADER_BYTES, NOOP_LOGGER, PAYMENT_HEADER, PAYMENT_INPUT_FIELD, PAYMENT_METHOD_NAMES, PAYMENT_REQUIRED_HEADER, PAYMENT_RESPONSE_HEADER, PROTOCOL_NAMES, RESERVED_INPUT_FIELDS, RETRYABLE_ERROR_CODES, extractReservedInputFields, isCommerceError, isHttpProtocolAdapter, isPaymentRequiredEnvelope, parseAuthorizationHeader, parseAuthorizationSubmission, systemClock, toCommerceError, toDeliverySummary, toErrorEnvelope, toPaymentRequiredEnvelope } from './chunk-DTKU3Z2M.js';
 import { isRecord } from './chunk-2CJNA7MS.js';
 import { promises, accessSync, constants } from 'fs';
 import * as path from 'path';
@@ -725,6 +725,16 @@ function normalizeX402(raw, resources) {
   const resourceOptions = Object.fromEntries(
     Object.entries(resourceTerms).map(([id, terms]) => [id, terms.options])
   );
+  let quote;
+  if (raw.quote !== void 0 && toBoolean(raw.quote.enabled, `${at}.quote.enabled`)) {
+    if (raw.quote.signerPrivateKey === void 0) {
+      throw x402Invalid(
+        `${at}.quote.signerPrivateKey is required when quotes are enabled`,
+        `${at}.quote.signerPrivateKey`
+      );
+    }
+    quote = { signerPrivateKey: raw.quote.signerPrivateKey };
+  }
   const config = {
     enabled: toBoolean(raw.enabled, `${at}.enabled`),
     ...first,
@@ -735,7 +745,8 @@ function normalizeX402(raw, resources) {
     ...allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator } : {},
     ...networks !== void 0 ? { networks } : {},
     options,
-    ...Object.keys(resourceOptions).length > 0 ? { resourceOptions } : {}
+    ...Object.keys(resourceOptions).length > 0 ? { resourceOptions } : {},
+    ...quote !== void 0 ? { quote } : {}
   };
   return { config, ...rail, resources: resourceTerms };
 }
@@ -1023,7 +1034,12 @@ var X402Schema = z.object({
   // Real funds. Never defaulted; see src/payments/x402/guardrails.ts
   allowMainnet: BooleanOrString.optional(),
   // Accepts credential-free facilitator access on mainnet. Never defaulted
-  allowUnauthenticatedFacilitator: BooleanOrString.optional()
+  allowUnauthenticatedFacilitator: BooleanOrString.optional(),
+  // Experimental ERC-8409 quotes; signing a quote transfers no funds
+  quote: z.object({
+    enabled: BooleanOrString,
+    signerPrivateKey: z.string().min(1).optional()
+  }).strict().optional()
 }).strict();
 var MppSchema = z.object({
   enabled: BooleanOrString,
@@ -1720,6 +1736,7 @@ function createPaymentAdmission(ctx, authorizeAndReserve) {
         amount: pricing.amount,
         currency: pricing.currency,
         requestedAt: options.clock.nowIso(),
+        input: validInput,
         // Transport facts a rail may bind into its challenge, such as a body digest
         ...request.metadata !== void 0 ? { metadata: request.metadata } : {}
       });
@@ -3623,6 +3640,12 @@ function publicOffer(option, statuses) {
 function flowOverrides(flows) {
   return flows !== void 0 && Object.keys(flows).length > 0 ? { resourcePaymentFlows: flows } : {};
 }
+function publicQuote(providers) {
+  const x402 = providers.find((provider) => provider.name === "x402");
+  if (x402?.quote === void 0) return void 0;
+  const { issuer, requestScheme, extension } = x402.quote;
+  return { issuer, requestScheme, extension, status: "experimental" };
+}
 function buildWellKnownDocument(options) {
   const adapters = options.adapters.map(({ descriptor, health }) => ({
     ...descriptor,
@@ -3633,6 +3656,7 @@ function buildWellKnownDocument(options) {
   const offerStatuses = new Map(
     (x402Health?.components ?? []).map((component) => [component.name, component.status])
   );
+  const quote = publicQuote(options.paymentProviders);
   return {
     gateway: {
       implementationVersion: PACKAGE_VERSION,
@@ -3672,7 +3696,8 @@ function buildWellKnownDocument(options) {
                 list.map((option) => publicOffer(option, offerStatuses))
               ])
             )
-          } : {}
+          } : {},
+          ...quote !== void 0 ? { quote } : {}
         }
       } : {},
       ...mpp !== void 0 ? {