@devlab.group/agent-commerce 2.4.0 → 2.5.0

package/dist/cli/svm-3MMYFPC7.js

@@ -1,33 +0,0 @@
-import { computeSvmReplayKey } from './chunk-OSTCU6ZK.js';
-import { isRecord } from './chunk-3M6U7ILB.js';
-import { getAddressEncoder, getProgramDerivedAddress, address } from '@solana/kit';
-import { transactionMessageHash, decodeTransactionFromPayload } from '@x402/svm';
-
-var MAX_TRANSACTION_BASE64 = 1644;
-var ASSOCIATED_TOKEN_PROGRAM = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
-async function associatedTokenAccount(owner, mint, tokenProgram) {
-  const encoder = getAddressEncoder();
-  const [account] = await getProgramDerivedAddress({
-    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),
-    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key)))
-  });
-  return account;
-}
-function svmReplayKey(payload, network) {
-  if (!isRecord(payload)) return "invalid_exact_svm_payload_transaction";
-  const transaction = payload["transaction"];
-  if (typeof transaction !== "string" || transaction.length > MAX_TRANSACTION_BASE64) {
-    return "invalid_exact_svm_payload_transaction";
-  }
-  let messageHash;
-  try {
-    messageHash = transactionMessageHash(decodeTransactionFromPayload({ transaction }));
-  } catch {
-    return "invalid_exact_svm_payload_transaction_could_not_be_decoded";
-  }
-  return { replayKey: computeSvmReplayKey({ network, messageHash }) };
-}
-
-export { associatedTokenAccount, svmReplayKey };
-//# sourceMappingURL=svm-3MMYFPC7.js.map
-//# sourceMappingURL=svm-3MMYFPC7.js.map

package/dist/cli/svm-3MMYFPC7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/payments/x402/svm.ts"],"names":[],"mappings":";;;;;AAgBA,IAAM,sBAAA,GAAyB,IAAA;AAE/B,IAAM,wBAAA,GAA2B,8CAAA;AAMjC,eAAsB,sBAAA,CACpB,KAAA,EACA,IAAA,EACA,YAAA,EACiB;AACjB,EAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,EAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,wBAAA,CAAyB;AAAA,IAC/C,cAAA,EAAgB,QAAQ,wBAAwB,CAAA;AAAA,IAChD,KAAA,EAAO,CAAC,KAAA,EAAO,YAAA,EAAc,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,KAAQ,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAC;AAAA,GAC7E,CAAA;AACD,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,YAAA,CAAa,SAAkB,OAAA,EAAiD;AAC9F,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,uCAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,QAAQ,aAAa,CAAA;AACzC,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,IAAY,WAAA,CAAY,SAAS,sBAAA,EAAwB;AAClF,IAAA,OAAO,uCAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACF,IAAA,WAAA,GAAc,sBAAA,CAAuB,4BAAA,CAA6B,EAAE,WAAA,EAAa,CAAC,CAAA;AAAA,EACpF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,4DAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,SAAA,EAAW,mBAAA,CAAoB,EAAE,OAAA,EAAS,WAAA,EAAa,CAAA,EAAE;AACpE","file":"svm-3MMYFPC7.js","sourcesContent":["/**\n * Solana `exact` payload inspection: bounded decoding and the replay identity.\n * The provider loads this module only for a Solana offer, so an EVM-only\n * deployment never imports `@x402/svm` or `@solana/kit`.\n *\n * The facilitator checks the transaction itself: the fee payer, signatures,\n * instruction layout, mint, recipient token account and amount, and a\n * simulation. Its smart-wallet path accepts layouts the gateway could not\n * parse, so the gateway does not read the transfer.\n */\nimport { address, getAddressEncoder, getProgramDerivedAddress } from '@solana/kit';\nimport { decodeTransactionFromPayload, transactionMessageHash } from '@x402/svm';\nimport { isRecord } from '../../core/is-record';\nimport { computeSvmReplayKey } from './replay-key';\n\n// A Solana transaction fits a 1232-byte packet, which is 1644 base64 characters\nconst MAX_TRANSACTION_BASE64 = 1644;\n\nconst ASSOCIATED_TOKEN_PROGRAM = 'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL';\n\n/**\n * The associated token account of `owner` for `mint`, where the SDK client\n * sends a Solana `exact` payment. Its transaction cannot create the account.\n */\nexport async function associatedTokenAccount(\n  owner: string,\n  mint: string,\n  tokenProgram: string,\n): Promise<string> {\n  const encoder = getAddressEncoder();\n  const [account] = await getProgramDerivedAddress({\n    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),\n    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key))),\n  });\n  return account;\n}\n\n/**\n * Returns the Solana `exact` replay key, or an SDK refusal reason for a\n * missing, oversized or undecodable transaction.\n */\nexport function svmReplayKey(payload: unknown, network: string): { replayKey: string } | string {\n  if (!isRecord(payload)) return 'invalid_exact_svm_payload_transaction';\n  const transaction = payload['transaction'];\n  if (typeof transaction !== 'string' || transaction.length > MAX_TRANSACTION_BASE64) {\n    return 'invalid_exact_svm_payload_transaction';\n  }\n  let messageHash: string;\n  try {\n    messageHash = transactionMessageHash(decodeTransactionFromPayload({ transaction }));\n  } catch {\n    return 'invalid_exact_svm_payload_transaction_could_not_be_decoded';\n  }\n  return { replayKey: computeSvmReplayKey({ network, messageHash }) };\n}\n"]}

package/dist/cli/x402-BMVONZKA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/payments/x402/client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAkCA,IAAM,YAAA,GAAe,CAAA;AAErB,IAAM,iCAAA,GAAoC;AAAA,EACxC,yBAAA,EAA2B;AAAA,IACzB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AAAA,IAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,SAAA,EAAU;AAAA,IACtC,EAAE,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,SAAA,EAAU;AAAA,IACvC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU;AAErC,CAAA;AAGA,eAAsB,mBAAmB,OAAA,EAAqD;AAC5F,EAAA,MAAM,YAAA,GAAe,2BAAA,CAA4B,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,KAAA,GAAQ,qBAAqB,CAAA;AACzD,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,SAAA,EAAW;AAChD,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,8DAAA,EAAiE,MAAA,CAAO,MAAM,CAAC,CAAA,oCAAA;AAAA,KACjF;AAAA,EACF;AACA,EAAA,IACE,CAAC,YAAA,CAAa,KAAA,IACd,OAAO,aAAa,KAAA,CAAM,MAAM,CAAA,KAAM,QAAA,IACtC,OAAO,YAAA,CAAa,KAAA,CAAM,SAAS,MAAM,QAAA,EACzC;AACA,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,YAAA,CAAa,OAAO,CAAA;AACrD,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,eAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,aAAa,OAAO,CAAA,4EAAA;AAAA,KACtD;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,OAAA,CAAQ,eAAe,CAAA;AAE3D,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,WAAA,EAAY;AACtD,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAG/C,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,SAAA,EAAW,UAAA,IAAc,CAAA;AACpD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,SAAA,EAAW,WAAA,IAAe,aAAa,YAAA,CAAa,iBAAA;AAChF,EAAA,MAAM,KAAK,UAAA,CAAY,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,KAAuB,CAAA;AACvF,EAAA,MAAM,QAAQ,MAAA,CAAO,OAAA,CAAQ,SAAA,EAAW,KAAA,IAAS,aAAa,MAAM,CAAA;AAEpE,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,aAAA,CAAc;AAAA,IAC5C,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA,CAAa,KAAA,CAAM,MAAM,CAAA;AAAA,MAC/B,OAAA,EAAS,YAAA,CAAa,KAAA,CAAM,SAAS,CAAA;AAAA,MACrC,OAAA;AAAA,MACA,iBAAA,EAAmB,UAAA,CAAW,YAAA,CAAa,KAAsB;AAAA,KACnE;AAAA,IACA,KAAA,EAAO,iCAAA;AAAA,IACP,WAAA,EAAa,2BAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACP,MAAM,OAAA,CAAQ,OAAA;AAAA,MACd,EAAA;AAAA,MACA,KAAA;AAAA,MACA,UAAA,EAAY,OAAO,UAAU,CAAA;AAAA,MAC7B,WAAA,EAAa,OAAO,WAAW,CAAA;AAAA,MAC/B;AAAA;AACF,GACD,CAAA;AAKD,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,WAAA,EAAa,YAAA;AAAA,IACb,QAAA,EAAU,YAAA;AAAA,IACV,OAAA,EAAS;AAAA,MACP,SAAA;AAAA,MACA,aAAA,EAAe;AAAA,QACb,MAAM,OAAA,CAAQ,OAAA;AAAA,QACd,EAAA;AAAA,QACA,KAAA,EAAO,MAAM,QAAA,EAAS;AAAA,QACtB,UAAA,EAAY,WAAW,QAAA,EAAS;AAAA,QAChC,WAAA,EAAa,YAAY,QAAA,EAAS;AAAA,QAClC;AAAA;AACF;AACF,GACF;AAEA,EAAA,OAAO,MAAA,CAAO,KAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AACvE;AAEA,SAAS,WAAA,GAA6B;AACpC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,MAAM,KAAK,CAAA;AACpB","file":"x402-BMVONZKA.js","sourcesContent":["/**\n * Client-side payment helper: builds and EIP-712-signs an x402 v2 `exact`/EVM\n * authorization on the buyer's side. The demo buyer agent and the test suites\n * use it, and the `/x402` entry exports it. The gateway never calls it and\n * never holds a buyer key.\n *\n * It signs directly rather than through the SDK's `x402Client` because of\n * `overrides`: negative tests need deliberately wrong authorizations that a\n * conforming client will not produce. The x402 settlement E2E suite also\n * settles a payment built by `x402Client` itself to cover interoperability.\n */\n\nimport { PaymentRequirementsV2Schema } from '@x402/core/schemas';\nimport type { PaymentPayload, PaymentRequirements } from '@x402/core/types';\nimport { getAddress, toHex } from 'viem';\nimport { privateKeyToAccount } from 'viem/accounts';\nimport { CommerceError } from '../../core';\nimport { chainIdFromCaip2 } from './chain';\n\nexport interface CreatePaymentProofOptions {\n  /** The buyer's private key. It signs locally and is never sent anywhere */\n  readonly buyerPrivateKey: `0x${string}`;\n  /** One entry from PaymentRequiredEnvelope.payment.accepts, verbatim */\n  readonly accepts: Readonly<Record<string, unknown>>;\n  /** For negative tests only: a wrong amount, recipient, nonce or validity window */\n  readonly overrides?: {\n    readonly value?: string;\n    readonly payTo?: string;\n    readonly nonce?: `0x${string}`;\n    readonly validBefore?: number;\n    readonly validAfter?: number;\n  };\n}\n\nconst X402_VERSION = 2;\n\nconst TRANSFER_WITH_AUTHORIZATION_TYPES = {\n  TransferWithAuthorization: [\n    { name: 'from', type: 'address' },\n    { name: 'to', type: 'address' },\n    { name: 'value', type: 'uint256' },\n    { name: 'validAfter', type: 'uint256' },\n    { name: 'validBefore', type: 'uint256' },\n    { name: 'nonce', type: 'bytes32' },\n  ],\n} as const;\n\n/** Returns the base64 `PAYMENT-SIGNATURE` value to send back to the gateway */\nexport async function createPaymentProof(options: CreatePaymentProofOptions): Promise<string> {\n  const requirements = PaymentRequirementsV2Schema.parse(options.accepts);\n  const method = requirements.extra?.['assetTransferMethod'];\n  if (method !== undefined && method !== 'eip3009') {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: signs EIP-3009 only, and this offer uses \"${String(method)}\"; sign it with the SDK's x402Client`,\n    );\n  }\n  if (\n    !requirements.extra ||\n    typeof requirements.extra['name'] !== 'string' ||\n    typeof requirements.extra['version'] !== 'string'\n  ) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      'createPaymentProof: payment requirement is missing extra.name/extra.version, so the EIP-712 domain cannot be built',\n    );\n  }\n\n  const chainId = chainIdFromCaip2(requirements.network);\n  if (chainId === undefined) {\n    throw new CommerceError(\n      'INPUT_INVALID',\n      `createPaymentProof: network \"${requirements.network}\" is not a CAIP-2 eip155 identifier, so there is no chain id to sign against`,\n    );\n  }\n\n  const account = privateKeyToAccount(options.buyerPrivateKey);\n\n  const nonce = options.overrides?.nonce ?? randomNonce();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  // 0, as in the SDK's own v2 client: nothing here wants the authorization\n  // delayed\n  const validAfter = options.overrides?.validAfter ?? 0;\n  const validBefore = options.overrides?.validBefore ?? nowSeconds + requirements.maxTimeoutSeconds;\n  const to = getAddress((options.overrides?.payTo ?? requirements.payTo) as `0x${string}`);\n  const value = BigInt(options.overrides?.value ?? requirements.amount);\n\n  const signature = await account.signTypedData({\n    domain: {\n      name: requirements.extra['name'],\n      version: requirements.extra['version'],\n      chainId,\n      verifyingContract: getAddress(requirements.asset as `0x${string}`),\n    },\n    types: TRANSFER_WITH_AUTHORIZATION_TYPES,\n    primaryType: 'TransferWithAuthorization',\n    message: {\n      from: account.address,\n      to,\n      value,\n      validAfter: BigInt(validAfter),\n      validBefore: BigInt(validBefore),\n      nonce,\n    },\n  });\n\n  // v2 echoes the chosen requirement back as `accepted` so a stateless\n  // facilitator knows which offer was taken. The gateway verifies against its\n  // own copy.\n  const payload: PaymentPayload = {\n    x402Version: X402_VERSION,\n    accepted: requirements as PaymentRequirements,\n    payload: {\n      signature,\n      authorization: {\n        from: account.address,\n        to,\n        value: value.toString(),\n        validAfter: validAfter.toString(),\n        validBefore: validBefore.toString(),\n        nonce,\n      },\n    },\n  };\n\n  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');\n}\n\nfunction randomNonce(): `0x${string}` {\n  const bytes = new Uint8Array(32);\n  crypto.getRandomValues(bytes);\n  return toHex(bytes);\n}\n"]}

package/dist/near-D6C42VPE.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/payments/x402/near.ts"],"names":[],"mappings":";;;;AAeA,IAAM,0BAAA,GAA6B,IAAA;AAEnC,IAAM,SAAA,GAAY,EAAA;AAeX,SAAS,kBAAA,CACd,SACA,KAAA,EACiE;AACjE,EAAA,MAAM,UAAU,QAAA,CAAS,OAAO,CAAA,GAAI,OAAA,CAAQ,sBAAsB,CAAA,GAAI,MAAA;AACtE,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,SAAS,0BAAA,EAA4B;AAC9E,IAAA,OAAO,kCAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,uBAAA,CAAwB,OAAO,CAAA,CAAE,QAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,mDAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,WAAA,CAAY,OAAO,CAAA,EAAG,OAAO,mDAAA;AAClC,EAAA,IAAI,QAAA,CAAS,WAAA,KAAgB,CAAA,EAAG,OAAO,yCAAA;AACvC,EAAA,MAAM,OAAO,QAAA,CAAS,YAAA;AACtB,EAAA,IAAI,CAAC,MAAM,OAAO,wCAAA;AAClB,EAAA,IAAI,IAAA,CAAK,UAAA,KAAe,aAAA,EAAe,OAAO,wCAAA;AAC9C,EAAA,IAAI,QAAA,CAAS,UAAA,KAAe,KAAA,CAAM,KAAA,EAAO;AACvC,IAAA,OAAO,oDAAA;AAAA,EACT;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,mBAAA,CAAoB,KAAK,IAAI,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,6CAAA;AAAA,EACT;AACA,EAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,KAAA,CAAM,KAAA,EAAO,OAAO,+CAAA;AAC7C,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,KAAA,CAAM,MAAA,EAAQ,OAAO,4CAAA;AACzC,EAAA,IAAI,IAAA,CAAK,OAAA,KAAY,SAAA,EAAW,OAAO,6CAAA;AACvC,EAAA,OAAO;AAAA,IACL,OAAO,QAAA,CAAS,QAAA;AAAA,IAChB,WAAW,oBAAA,CAAqB;AAAA,MAC9B,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,UAAU,QAAA,CAAS,QAAA;AAAA,MACnB,WAAW,QAAA,CAAS,SAAA;AAAA,MACpB,OAAO,QAAA,CAAS;AAAA,KACjB;AAAA,GACH;AACF;AAOA,SAAS,YAAY,OAAA,EAA0B;AAC7C,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AAC3C,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,KAAM,SAAS,OAAO,KAAA;AACjD,EAAA,IAAI;AACF,IAAA,uBAAA,CAAwB,KAAA,CAAM,SAAS,CAAA,EAAG,KAAA,CAAM,SAAS,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAC,CAAA;AAC9E,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"near-D6C42VPE.js","sourcesContent":["/**\n * NEAR `exact` payload inspection: bounded decoding of the NEP-366 signed\n * delegate action, the transfer it authorizes and its replay identity. The\n * provider loads this module only for a NEAR offer, so other deployments never\n * import `@x402/near`.\n *\n * The facilitator checks the signature, the access key and its nonce, the\n * delegate window and chain state. The gateway checks the transfer the buyer\n * signed against the offer, so a proof for other terms never reaches it.\n */\nimport { decodeSignedDelegateB64, parseFtTransferArgs } from '@x402/near';\nimport { isRecord } from '../../core/is-record';\nimport { computeNearReplayKey } from './replay-key';\n\n// One `ft_transfer` delegate is a few hundred bytes; this bounds the decoder\nconst MAX_SIGNED_DELEGATE_BASE64 = 4096;\n// NEP-141 requires exactly one yoctoNEAR on `ft_transfer`\nconst ONE_YOCTO = 1n;\n\nexport interface NearTransferTerms {\n  readonly network: string;\n  /** The NEP-141 token contract the delegate must call */\n  readonly asset: string;\n  readonly payTo: string;\n  /** Atomic units, as the offer states them */\n  readonly amount: string;\n}\n\n/**\n * Returns the payer and replay key if the NEAR `exact` payload matches the\n * offer, or a refusal reason using the SDK facilitator's codes.\n */\nexport function inspectNearPayload(\n  payload: unknown,\n  terms: NearTransferTerms,\n): { readonly payer: string; readonly replayKey: string } | string {\n  const encoded = isRecord(payload) ? payload['signedDelegateAction'] : undefined;\n  if (typeof encoded !== 'string' || encoded.length > MAX_SIGNED_DELEGATE_BASE64) {\n    return 'invalid_exact_near_payload_shape';\n  }\n  let delegate: ReturnType<typeof decodeSignedDelegateB64>['delegate'];\n  try {\n    delegate = decodeSignedDelegateB64(encoded).delegate;\n  } catch {\n    return 'invalid_exact_near_payload_signed_delegate_action';\n  }\n  if (!isCanonical(encoded)) return 'invalid_exact_near_payload_signed_delegate_action';\n  if (delegate.actionCount !== 1) return 'invalid_exact_near_payload_action_count';\n  const call = delegate.functionCall;\n  if (!call) return 'invalid_exact_near_payload_action_kind';\n  if (call.methodName !== 'ft_transfer') return 'invalid_exact_near_payload_method_name';\n  if (delegate.receiverId !== terms.asset) {\n    return 'invalid_exact_near_payload_token_contract_mismatch';\n  }\n  let args: ReturnType<typeof parseFtTransferArgs>;\n  try {\n    args = parseFtTransferArgs(call.args);\n  } catch {\n    return 'invalid_exact_near_payload_ft_transfer_args';\n  }\n  if (args.receiver_id !== terms.payTo) return 'invalid_exact_near_payload_recipient_mismatch';\n  if (args.amount !== terms.amount) return 'invalid_exact_near_payload_amount_mismatch';\n  if (call.deposit !== ONE_YOCTO) return 'invalid_exact_near_payload_attached_deposit';\n  return {\n    payer: delegate.senderId,\n    replayKey: computeNearReplayKey({\n      network: terms.network,\n      senderId: delegate.senderId,\n      publicKey: delegate.publicKey,\n      nonce: delegate.nonce,\n    }),\n  };\n}\n\n/**\n * One delegate, one encoding: canonical base64, and no bytes after the signed\n * delegate. The SDK decoder ignores such bytes, so the check decodes the\n * payload without its last byte: a canonical encoding then runs short.\n */\nfunction isCanonical(encoded: string): boolean {\n  const bytes = Buffer.from(encoded, 'base64');\n  if (bytes.toString('base64') !== encoded) return false;\n  try {\n    decodeSignedDelegateB64(bytes.subarray(0, bytes.length - 1).toString('base64'));\n    return false;\n  } catch {\n    return true;\n  }\n}\n"]}

package/dist/svm-QEUAUNPQ.js

@@ -1,33 +0,0 @@
-import { computeSvmReplayKey } from './chunk-KA2AX5FH.js';
-import { isRecord } from './chunk-2CJNA7MS.js';
-import { getAddressEncoder, getProgramDerivedAddress, address } from '@solana/kit';
-import { transactionMessageHash, decodeTransactionFromPayload } from '@x402/svm';
-
-var MAX_TRANSACTION_BASE64 = 1644;
-var ASSOCIATED_TOKEN_PROGRAM = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
-async function associatedTokenAccount(owner, mint, tokenProgram) {
-  const encoder = getAddressEncoder();
-  const [account] = await getProgramDerivedAddress({
-    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),
-    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key)))
-  });
-  return account;
-}
-function svmReplayKey(payload, network) {
-  if (!isRecord(payload)) return "invalid_exact_svm_payload_transaction";
-  const transaction = payload["transaction"];
-  if (typeof transaction !== "string" || transaction.length > MAX_TRANSACTION_BASE64) {
-    return "invalid_exact_svm_payload_transaction";
-  }
-  let messageHash;
-  try {
-    messageHash = transactionMessageHash(decodeTransactionFromPayload({ transaction }));
-  } catch {
-    return "invalid_exact_svm_payload_transaction_could_not_be_decoded";
-  }
-  return { replayKey: computeSvmReplayKey({ network, messageHash }) };
-}
-
-export { associatedTokenAccount, svmReplayKey };
-//# sourceMappingURL=svm-QEUAUNPQ.js.map
-//# sourceMappingURL=svm-QEUAUNPQ.js.map

package/dist/svm-QEUAUNPQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/payments/x402/svm.ts"],"names":[],"mappings":";;;;;AAgBA,IAAM,sBAAA,GAAyB,IAAA;AAE/B,IAAM,wBAAA,GAA2B,8CAAA;AAMjC,eAAsB,sBAAA,CACpB,KAAA,EACA,IAAA,EACA,YAAA,EACiB;AACjB,EAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,EAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,wBAAA,CAAyB;AAAA,IAC/C,cAAA,EAAgB,QAAQ,wBAAwB,CAAA;AAAA,IAChD,KAAA,EAAO,CAAC,KAAA,EAAO,YAAA,EAAc,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,GAAA,KAAQ,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAC,CAAC;AAAA,GAC7E,CAAA;AACD,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,YAAA,CAAa,SAAkB,OAAA,EAAiD;AAC9F,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,CAAA,EAAG,OAAO,uCAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,QAAQ,aAAa,CAAA;AACzC,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,IAAY,WAAA,CAAY,SAAS,sBAAA,EAAwB;AAClF,IAAA,OAAO,uCAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACF,IAAA,WAAA,GAAc,sBAAA,CAAuB,4BAAA,CAA6B,EAAE,WAAA,EAAa,CAAC,CAAA;AAAA,EACpF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,4DAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,SAAA,EAAW,mBAAA,CAAoB,EAAE,OAAA,EAAS,WAAA,EAAa,CAAA,EAAE;AACpE","file":"svm-QEUAUNPQ.js","sourcesContent":["/**\n * Solana `exact` payload inspection: bounded decoding and the replay identity.\n * The provider loads this module only for a Solana offer, so an EVM-only\n * deployment never imports `@x402/svm` or `@solana/kit`.\n *\n * The facilitator checks the transaction itself: the fee payer, signatures,\n * instruction layout, mint, recipient token account and amount, and a\n * simulation. Its smart-wallet path accepts layouts the gateway could not\n * parse, so the gateway does not read the transfer.\n */\nimport { address, getAddressEncoder, getProgramDerivedAddress } from '@solana/kit';\nimport { decodeTransactionFromPayload, transactionMessageHash } from '@x402/svm';\nimport { isRecord } from '../../core/is-record';\nimport { computeSvmReplayKey } from './replay-key';\n\n// A Solana transaction fits a 1232-byte packet, which is 1644 base64 characters\nconst MAX_TRANSACTION_BASE64 = 1644;\n\nconst ASSOCIATED_TOKEN_PROGRAM = 'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL';\n\n/**\n * The associated token account of `owner` for `mint`, where the SDK client\n * sends a Solana `exact` payment. Its transaction cannot create the account.\n */\nexport async function associatedTokenAccount(\n  owner: string,\n  mint: string,\n  tokenProgram: string,\n): Promise<string> {\n  const encoder = getAddressEncoder();\n  const [account] = await getProgramDerivedAddress({\n    programAddress: address(ASSOCIATED_TOKEN_PROGRAM),\n    seeds: [owner, tokenProgram, mint].map((key) => encoder.encode(address(key))),\n  });\n  return account;\n}\n\n/**\n * Returns the Solana `exact` replay key, or an SDK refusal reason for a\n * missing, oversized or undecodable transaction.\n */\nexport function svmReplayKey(payload: unknown, network: string): { replayKey: string } | string {\n  if (!isRecord(payload)) return 'invalid_exact_svm_payload_transaction';\n  const transaction = payload['transaction'];\n  if (typeof transaction !== 'string' || transaction.length > MAX_TRANSACTION_BASE64) {\n    return 'invalid_exact_svm_payload_transaction';\n  }\n  let messageHash: string;\n  try {\n    messageHash = transactionMessageHash(decodeTransactionFromPayload({ transaction }));\n  } catch {\n    return 'invalid_exact_svm_payload_transaction_could_not_be_decoded';\n  }\n  return { replayKey: computeSvmReplayKey({ network, messageHash }) };\n}\n"]}