@drm3/sdk 0.1.2

package/dist/switcher.js

@@ -0,0 +1,174 @@
+// @drm3/app-sdk/switcher - the DRM3 cross-app "waffle" switcher, as a one-call drop-in.
+//
+//   import { mountAppSwitcher } from "@drm3/app-sdk/switcher";
+//   mountAppSwitcher(document.getElementById("drm3-apps"));
+//
+// Framework-agnostic, zero deps. Injects its own scoped styles, lazy-loads the canonical app
+// catalog with live health from status.drm3.network, and renders a tile grid with a "you are
+// here" marker for the current app. The same switcher that ships in the DRM3 account hub.
+import { fetchApps, fetchBalance } from "./index.js";
+const HEALTH = {
+    up: ["All systems go", "#22c55e"],
+    degraded: ["Partial outage", "#f59e0b"],
+    down: ["Down", "#ef4444"],
+    unknown: ["Status unknown", "#9ca3af"],
+};
+let stylesInjected = false;
+function injectStyles() {
+    if (stylesInjected || typeof document === "undefined")
+        return;
+    stylesInjected = true;
+    const s = document.createElement("style");
+    s.textContent = `
+.drm3sw{position:relative;display:inline-block;font-family:ui-sans-serif,system-ui,sans-serif}
+.drm3sw-btn{display:grid;place-items:center;width:38px;height:38px;border:0;border-radius:10px;
+  background:transparent;color:inherit;cursor:pointer;opacity:.8}
+.drm3sw-btn:hover{opacity:1;background:rgba(127,127,127,.12)}
+.drm3sw-menu{position:absolute;right:0;top:46px;width:312px;max-height:70vh;overflow:auto;z-index:9999;
+  background:#0b0f14;border:1px solid #1e2733;border-radius:14px;padding:10px;
+  box-shadow:0 18px 50px rgba(0,0,0,.5);display:none}
+.drm3sw[data-open="1"] .drm3sw-menu{display:block}
+.drm3sw-h{display:flex;justify-content:space-between;align-items:center;padding:6px 8px 10px;
+  color:#cbd5e1;font-size:13px;font-weight:600}
+.drm3sw-h span{color:#64748b;font-size:11px;font-weight:500}
+.drm3sw-list{display:block}
+.drm3sw-grid{display:grid;grid-template-columns:1fr 1fr;gap:8px}
+.drm3sw-sec{padding:9px 4px 6px;font-size:10.5px;font-weight:700;text-transform:uppercase;letter-spacing:.08em;color:#64748b}
+.drm3sw-a{display:flex;flex-direction:column;gap:7px;padding:11px;border-radius:11px;text-decoration:none;
+  background:#0f141b;border:1px solid #1b2430;transition:border-color .12s,transform .12s}
+.drm3sw-a:hover{border-color:#2b6cb0;transform:translateY(-1px)}
+.drm3sw-a[data-here="1"]{border-color:#2b6cb0;background:#101a26}
+.drm3sw-ic{width:30px;height:30px;border-radius:9px;display:grid;place-items:center;color:#fff;
+  font-weight:700;font-size:14px}
+.drm3sw-nm{color:#e8eef5;font-size:13px;font-weight:600;line-height:1.15}
+.drm3sw-hl{display:flex;align-items:center;gap:5px;color:#94a3b8;font-size:10.5px}
+.drm3sw-dot{width:6px;height:6px;border-radius:50%}
+.drm3sw-foot{padding:10px 8px 4px;margin-top:6px;border-top:1px solid #1b2430}
+.drm3sw-foot a{color:#7aa7d6;font-size:12px;text-decoration:none}
+.drm3sw-foot a:hover{text-decoration:underline}`;
+    document.head.appendChild(s);
+}
+const WAFFLE_SVG = `<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+<circle cx="4" cy="4" r="1.9"/><circle cx="10" cy="4" r="1.9"/><circle cx="16" cy="4" r="1.9"/>
+<circle cx="4" cy="10" r="1.9"/><circle cx="10" cy="10" r="1.9"/><circle cx="16" cy="10" r="1.9"/>
+<circle cx="4" cy="16" r="1.9"/><circle cx="10" cy="16" r="1.9"/><circle cx="16" cy="16" r="1.9"/></svg>`;
+function esc(s) {
+    return s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+}
+function isHere(a, currentId) {
+    if (currentId && a.id === currentId)
+        return true;
+    if (typeof location === "undefined")
+        return false;
+    try {
+        const h = new URL(a.url).hostname;
+        return !!h && (location.hostname === h || location.hostname.endsWith(h));
+    }
+    catch {
+        return false;
+    }
+}
+function tile(a, here) {
+    const [label, color] = HEALTH[a.health || "unknown"] || HEALTH.unknown;
+    const accent = a.color || "#2b6cb0";
+    return `<a class="drm3sw-a"${here ? ' data-here="1"' : ""} href="${esc(a.url)}">
+  <div class="drm3sw-ic" style="background:linear-gradient(135deg,${esc(accent)},#0f172a)">${esc((a.name || "?")[0])}</div>
+  <div class="drm3sw-nm">${esc(a.name)}</div>
+  <div class="drm3sw-hl"><span class="drm3sw-dot" style="background:${color}"></span>${esc(label)}</div>
+</a>`;
+}
+// Sectioned layout (Current / Switch application) to match the Newsboy switcher.
+function renderList(apps, currentId) {
+    if (!apps.length)
+        return `<div style="padding:14px 8px;color:#64748b;font-size:12px">No apps available.</div>`;
+    const cur = apps.filter((a) => isHere(a, currentId));
+    const oth = apps.filter((a) => !isHere(a, currentId));
+    let h = "";
+    if (cur.length)
+        h += `<div class="drm3sw-sec">Current</div><div class="drm3sw-grid">${cur.map((a) => tile(a, true)).join("")}</div>`;
+    if (oth.length)
+        h += `<div class="drm3sw-sec">Switch application</div><div class="drm3sw-grid">${oth.map((a) => tile(a, false)).join("")}</div>`;
+    return h;
+}
+/**
+ * Mount the DRM3 app-switcher into `target`. Idempotent per element; lazy-loads on first open.
+ * Signed-in-only: when the user is not authenticated, nothing is rendered (the target is left empty).
+ */
+export function mountAppSwitcher(target, opts = {}) {
+    if (!target || typeof document === "undefined")
+        return;
+    // The switcher is private to a signed-in user. Resolve auth first and only build the
+    // UI when a DRM3 session is confirmed; otherwise leave the target empty (fail closed).
+    if (opts.authed === false) {
+        target.replaceChildren();
+        return;
+    }
+    if (opts.authed === true) {
+        buildSwitcher(target, opts);
+        return;
+    }
+    // Unknown: probe the account hub. fetchBalance returns null when not signed in (or the
+    // hub is unreachable), so an unauthenticated visitor never sees the switcher.
+    void fetchBalance(opts.ssoToken).then((bal) => {
+        if (bal)
+            buildSwitcher(target, opts);
+    });
+}
+function buildSwitcher(target, opts) {
+    injectStyles();
+    target.classList.add("drm3sw");
+    target.innerHTML = `<button class="drm3sw-btn" aria-label="DRM3 apps" aria-expanded="false">${WAFFLE_SVG}</button>
+<div class="drm3sw-menu" role="menu">
+  <div class="drm3sw-h">DRM3 apps <span>live status</span></div>
+  <div class="drm3sw-list">Loading...</div>
+  <div class="drm3sw-foot"><a href="https://drm3.network/account">Your DRM3 account &rarr;</a></div>
+</div>`;
+    const btn = target.querySelector(".drm3sw-btn");
+    const list = target.querySelector(".drm3sw-list");
+    let cache = null;
+    let fetching = false;
+    // Fetch the catalog once, render from cache, and refresh quietly. Preloaded on
+    // mount (default) so the first open is instant instead of a spinner-then-pop.
+    const load = async () => {
+        if (cache)
+            list.innerHTML = renderList(cache, opts.currentId);
+        if (fetching)
+            return;
+        fetching = true;
+        try {
+            cache = await fetchApps();
+            list.innerHTML = renderList(cache, opts.currentId);
+        }
+        catch {
+            if (!cache)
+                list.innerHTML = `<div style="padding:14px 8px;color:#64748b;font-size:12px">Could not load apps.</div>`;
+        }
+        finally {
+            fetching = false;
+        }
+    };
+    const close = () => {
+        target.removeAttribute("data-open");
+        btn.setAttribute("aria-expanded", "false");
+    };
+    btn.addEventListener("click", (e) => {
+        e.stopPropagation();
+        const open = target.getAttribute("data-open") === "1";
+        if (open)
+            return close();
+        target.setAttribute("data-open", "1");
+        btn.setAttribute("aria-expanded", "true");
+        load(); // refresh health on open (instant paint from cache first)
+    });
+    if (opts.preload !== false)
+        load();
+    document.addEventListener("click", (e) => {
+        if (!target.contains(e.target))
+            close();
+    });
+    document.addEventListener("keydown", (e) => {
+        if (e.key === "Escape")
+            close();
+    });
+}
+//# sourceMappingURL=switcher.js.map

package/dist/switcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"switcher.js","sourceRoot":"","sources":["../src/switcher.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,+DAA+D;AAC/D,4DAA4D;AAC5D,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,0FAA0F;AAE1F,OAAO,EAAgB,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,MAAM,MAAM,GAAqC;IAC/C,EAAE,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;IACjC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;IACvC,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;IACzB,OAAO,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;CACvC,CAAC;AAEF,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,YAAY;IACnB,IAAI,cAAc,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO;IAC9D,cAAc,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;gDA0B8B,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,GAAG;;;yGAGsF,CAAC;AAE1G,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAC,CAAU,EAAE,SAAkB;IAC5C,IAAI,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAClC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,CAAU,EAAE,IAAa;IACrC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC;IACpC,OAAO,sBAAsB,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oEACX,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;2BACzF,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;sEACgC,KAAK,YAAY,GAAG,CAAC,KAAK,CAAC;KAC5F,CAAC;AACN,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAe,EAAE,SAAkB;IACrD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,qFAAqF,CAAC;IAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,IAAI,GAAG,CAAC,MAAM;QAAE,CAAC,IAAI,iEAAiE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC;IACrI,IAAI,GAAG,CAAC,MAAM;QAAE,CAAC,IAAI,4EAA4E,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC;IACjJ,OAAO,CAAC,CAAC;AACX,CAAC;AAmBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,OAAwB,EAAE;IACrF,IAAI,CAAC,MAAM,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO;IAEvD,qFAAqF;IACrF,uFAAuF;IACvF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,eAAe,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,uFAAuF;IACvF,8EAA8E;IAC9E,KAAK,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5C,IAAI,GAAG;YAAE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,IAAqB;IAC/D,YAAY,EAAE,CAAC;IACf,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,CAAC,SAAS,GAAG,2EAA2E,UAAU;;;;;OAKnG,CAAC;IACN,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,aAAa,CAAsB,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,cAAc,CAAgB,CAAC;IACjE,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,KAAK;YAAE,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,GAAG,uFAAuF,CAAC;QACvH,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACpC,GAAG,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,CAAC,CAAC,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC;QACtD,IAAI,IAAI;YAAE,OAAO,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC,CAAC,0DAA0D;IACpE,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,IAAI,EAAE,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAc,CAAC;YAAE,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,IAAK,CAAmB,CAAC,GAAG,KAAK,QAAQ;YAAE,KAAK,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/x402/chain.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @drm3/sdk/x402 - chain / asset config + resolution.
+ *
+ * The asset/chain a payment is bound to. Defaults are USDC on Base (the DRM3
+ * gateway default); an app on another asset/chain overrides these. The EIP-712
+ * domain binds a signature to exactly this asset + chain, so a signature for any
+ * other asset or chain cannot verify.
+ */
+/** USDC (native, Circle) on Base mainnet. */
+export declare const X402_ASSET_USDC_BASE = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+/** eip155:8453 (Base). */
+export declare const BASE_CHAIN_ID = 8453n;
+/** x402 network label for Base. */
+export declare const BASE_NETWORK = "base";
+/** Circle FiatTokenV2 EIP-712 domain name on Base. */
+export declare const USDC_DOMAIN_NAME = "USD Coin";
+/** Circle FiatTokenV2 EIP-712 domain version on Base. */
+export declare const USDC_DOMAIN_VERSION = "2";
+/** Default advertised authorization lifetime. */
+export declare const DEFAULT_MAX_TIMEOUT_SECONDS = 60;
+/** Default in-flight grace (seconds) so a fresh authorization is not rejected as near-expiry. */
+export declare const DEFAULT_GRACE_SECONDS = 6n;
+/**
+ * The asset/chain a payment is bound to. Defaults are USDC on Base (the DRM3
+ * gateway default); an app on another asset/chain overrides these. The EIP-712
+ * domain binds a signature to exactly this asset + chain, so a signature for any
+ * other asset or chain cannot verify.
+ */
+export interface X402ChainConfig {
+    /** x402 network label. Default "base". */
+    network?: string;
+    /** ERC-20 (verifyingContract) address. Default native USDC on Base. */
+    asset?: string;
+    /** EIP-155 chain id. Default 8453n (Base). */
+    chainId?: bigint;
+    /** EIP-712 domain name. Default "USD Coin". */
+    domainName?: string;
+    /** EIP-712 domain version. Default "2". */
+    domainVersion?: string;
+}
+export interface ResolvedChain {
+    network: string;
+    asset: string;
+    chainId: bigint;
+    domainName: string;
+    domainVersion: string;
+}
+export declare function resolveChain(c?: X402ChainConfig): ResolvedChain;
+//# sourceMappingURL=chain.d.ts.map

package/dist/x402/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/x402/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,6CAA6C;AAC7C,eAAO,MAAM,oBAAoB,+CAA+C,CAAC;AACjF,0BAA0B;AAC1B,eAAO,MAAM,aAAa,QAAQ,CAAC;AACnC,mCAAmC;AACnC,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAC3C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,iDAAiD;AACjD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAE,eAAoB,GAAG,aAAa,CAQnE"}

package/dist/x402/chain.js

@@ -0,0 +1,33 @@
+/**
+ * @drm3/sdk/x402 - chain / asset config + resolution.
+ *
+ * The asset/chain a payment is bound to. Defaults are USDC on Base (the DRM3
+ * gateway default); an app on another asset/chain overrides these. The EIP-712
+ * domain binds a signature to exactly this asset + chain, so a signature for any
+ * other asset or chain cannot verify.
+ */
+// ─── Chain / asset config ───
+/** USDC (native, Circle) on Base mainnet. */
+export const X402_ASSET_USDC_BASE = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+/** eip155:8453 (Base). */
+export const BASE_CHAIN_ID = 8453n;
+/** x402 network label for Base. */
+export const BASE_NETWORK = "base";
+/** Circle FiatTokenV2 EIP-712 domain name on Base. */
+export const USDC_DOMAIN_NAME = "USD Coin";
+/** Circle FiatTokenV2 EIP-712 domain version on Base. */
+export const USDC_DOMAIN_VERSION = "2";
+/** Default advertised authorization lifetime. */
+export const DEFAULT_MAX_TIMEOUT_SECONDS = 60;
+/** Default in-flight grace (seconds) so a fresh authorization is not rejected as near-expiry. */
+export const DEFAULT_GRACE_SECONDS = 6n;
+export function resolveChain(c = {}) {
+    return {
+        network: c.network ?? BASE_NETWORK,
+        asset: c.asset ?? X402_ASSET_USDC_BASE,
+        chainId: c.chainId ?? BASE_CHAIN_ID,
+        domainName: c.domainName ?? USDC_DOMAIN_NAME,
+        domainVersion: c.domainVersion ?? USDC_DOMAIN_VERSION,
+    };
+}
+//# sourceMappingURL=chain.js.map

package/dist/x402/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x402/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+BAA+B;AAE/B,6CAA6C;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AACjF,0BAA0B;AAC1B,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,mCAAmC;AACnC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAC3C,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,iDAAiD;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,iGAAiG;AACjG,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AA6BxC,MAAM,UAAU,YAAY,CAAC,IAAqB,EAAE;IAClD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,YAAY;QAClC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB;QACtC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,aAAa;QACnC,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,gBAAgB;QAC5C,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,mBAAmB;KACtD,CAAC;AACJ,CAAC"}

package/dist/x402/crypto.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @drm3/sdk/x402 - secp256k1 / keccak256 primitives + hex helpers.
+ *
+ * The cryptographic floor of the x402 gateway: keccak256, EIP-3009 signer
+ * recovery (`ecrecover`), and the hex/bigint conversions the rest of the module
+ * builds on. Byte-identical to MorScan's reference implementation: DO NOT relax
+ * any check, constant, byte order, or comparison.
+ */
+/** keccak256 hash of arbitrary bytes. */
+export declare function keccak256(data: Uint8Array): Uint8Array;
+/**
+ * Recover the signer's Ethereum address from a secp256k1 signature.
+ *
+ * @param messageHash - 32-byte hash of the signed message
+ * @param sigHex - 65-byte signature as hex string (r || s || v)
+ * @returns Checksumless lowercase Ethereum address (0x-prefixed)
+ */
+export declare function ecrecover(messageHash: Uint8Array, sigHex: string): string;
+/** Decode a hex string (with or without 0x prefix) to bytes. */
+export declare function hexToBytes(hex: string): Uint8Array;
+/** Encode bytes to a lowercase hex string (no 0x prefix). */
+export declare function bytesToHex(bytes: Uint8Array): string;
+/** Convert a big-endian byte array to a BigInt. */
+export declare function bytesToBigInt(bytes: Uint8Array): bigint;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/x402/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/x402/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,yCAAyC;AACzC,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CA8BzE;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQlD;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMpD;AAED,mDAAmD;AACnD,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD"}

package/dist/x402/crypto.js

@@ -0,0 +1,74 @@
+/**
+ * @drm3/sdk/x402 - secp256k1 / keccak256 primitives + hex helpers.
+ *
+ * The cryptographic floor of the x402 gateway: keccak256, EIP-3009 signer
+ * recovery (`ecrecover`), and the hex/bigint conversions the rest of the module
+ * builds on. Byte-identical to MorScan's reference implementation: DO NOT relax
+ * any check, constant, byte order, or comparison.
+ */
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { keccak_256 } from "@noble/hashes/sha3.js";
+/** keccak256 hash of arbitrary bytes. */
+export function keccak256(data) {
+    return keccak_256(data);
+}
+/**
+ * Recover the signer's Ethereum address from a secp256k1 signature.
+ *
+ * @param messageHash - 32-byte hash of the signed message
+ * @param sigHex - 65-byte signature as hex string (r || s || v)
+ * @returns Checksumless lowercase Ethereum address (0x-prefixed)
+ */
+export function ecrecover(messageHash, sigHex) {
+    const sigBytes = hexToBytes(sigHex);
+    if (sigBytes.length !== 65) {
+        throw new Error(`Signature must be 65 bytes, got ${sigBytes.length}`);
+    }
+    const r = sigBytes.slice(0, 32);
+    const s = sigBytes.slice(32, 64);
+    let v = sigBytes[64];
+    // Normalize v: EIP-155 uses 27/28, @noble/curves uses 0/1
+    if (v >= 27)
+        v -= 27;
+    if (v !== 0 && v !== 1) {
+        throw new Error(`Invalid recovery id: ${v}`);
+    }
+    const rBig = bytesToBigInt(r);
+    const sBig = bytesToBigInt(s);
+    const sig = new secp256k1.Signature(rBig, sBig, v);
+    const pubkey = sig.recoverPublicKey(messageHash);
+    // Uncompressed public key (65 bytes: 0x04 || x || y) - skip the 0x04 prefix
+    const pubkeyBytes = pubkey.toBytes(false).slice(1); // 64 bytes
+    // Ethereum address = last 20 bytes of keccak256(pubkey_bytes)
+    const hash = keccak256(pubkeyBytes);
+    const address = hash.slice(12);
+    return `0x${bytesToHex(address)}`;
+}
+/** Decode a hex string (with or without 0x prefix) to bytes. */
+export function hexToBytes(hex) {
+    const h = hex.startsWith("0x") ? hex.slice(2) : hex;
+    if (h.length % 2 !== 0)
+        throw new Error("Invalid hex string");
+    const bytes = new Uint8Array(h.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = Number.parseInt(h.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+/** Encode bytes to a lowercase hex string (no 0x prefix). */
+export function bytesToHex(bytes) {
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++) {
+        hex += bytes[i].toString(16).padStart(2, "0");
+    }
+    return hex;
+}
+/** Convert a big-endian byte array to a BigInt. */
+export function bytesToBigInt(bytes) {
+    let result = 0n;
+    for (let i = 0; i < bytes.length; i++) {
+        result = (result << 8n) | BigInt(bytes[i]);
+    }
+    return result;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/x402/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/x402/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,yCAAyC;AACzC,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,WAAuB,EAAE,MAAc;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAErB,0DAA0D;IAC1D,IAAI,CAAC,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAE9B,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAEjD,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW;IAE/D,8DAA8D;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE/B,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/x402/eip712.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @drm3/sdk/x402 - EIP-712 / EIP-3009 TransferWithAuthorization digest.
+ *
+ * The typed-data typehashes + domain separator + the `transferAuthDigest` a
+ * client signs (and `verifyX402Payment` recovers against). Byte-identical to
+ * MorScan's reference implementation: DO NOT change any type string or byte
+ * order.
+ */
+import { type X402ChainConfig } from "./chain.js";
+export interface X402Authorization {
+    from: string;
+    to: string;
+    value: string;
+    validAfter: string;
+    validBefore: string;
+    nonce: string;
+}
+/** EIP-712 digest of a TransferWithAuthorization struct, bound to the given asset/chain. */
+export declare function transferAuthDigest(a: X402Authorization, chainConfig?: X402ChainConfig): Uint8Array;
+//# sourceMappingURL=eip712.d.ts.map

package/dist/x402/eip712.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip712.d.ts","sourceRoot":"","sources":["../../src/x402/eip712.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAsB,KAAK,eAAe,EAAgB,MAAM,YAAY,CAAC;AAGpF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAgDD,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,GAAE,eAAoB,GAAG,UAAU,CActG"}

package/dist/x402/eip712.js

@@ -0,0 +1,49 @@
+/**
+ * @drm3/sdk/x402 - EIP-712 / EIP-3009 TransferWithAuthorization digest.
+ *
+ * The typed-data typehashes + domain separator + the `transferAuthDigest` a
+ * client signs (and `verifyX402Payment` recovers against). Byte-identical to
+ * MorScan's reference implementation: DO NOT change any type string or byte
+ * order.
+ */
+import { resolveChain } from "./chain.js";
+import { hexToBytes, keccak256 } from "./crypto.js";
+// ─── EIP-712 / EIP-3009 verification ───
+function encUint(v) {
+    const out = new Uint8Array(32);
+    let x = v;
+    for (let i = 31; i >= 0 && x > 0n; i--) {
+        out[i] = Number(x & 0xffn);
+        x >>= 8n;
+    }
+    return out;
+}
+function encAddress(addr) {
+    const out = new Uint8Array(32);
+    out.set(hexToBytes(addr), 12);
+    return out;
+}
+function concat(...parts) {
+    const total = parts.reduce((n, p) => n + p.length, 0);
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.length;
+    }
+    return out;
+}
+const enc = new TextEncoder();
+const TYPEHASH = keccak256(enc.encode("TransferWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce)"));
+const DOMAIN_TYPEHASH = keccak256(enc.encode("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"));
+/** EIP-712 domain separator for the asset/chain in `chain`. */
+function domainSeparator(chain) {
+    return keccak256(concat(DOMAIN_TYPEHASH, keccak256(enc.encode(chain.domainName)), keccak256(enc.encode(chain.domainVersion)), encUint(chain.chainId), encAddress(chain.asset)));
+}
+/** EIP-712 digest of a TransferWithAuthorization struct, bound to the given asset/chain. */
+export function transferAuthDigest(a, chainConfig = {}) {
+    const chain = resolveChain(chainConfig);
+    const structHash = keccak256(concat(TYPEHASH, encAddress(a.from), encAddress(a.to), encUint(BigInt(a.value)), encUint(BigInt(a.validAfter)), encUint(BigInt(a.validBefore)), hexToBytes(a.nonce)));
+    return keccak256(concat(new Uint8Array([0x19, 0x01]), domainSeparator(chain), structHash));
+}
+//# sourceMappingURL=eip712.js.map

package/dist/x402/eip712.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip712.js","sourceRoot":"","sources":["../../src/x402/eip712.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAA4C,YAAY,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAWpD,0CAA0C;AAE1C,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,uHAAuH,CAAC,CAAC,CAAC;AAChK,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,oFAAoF,CAAC,CAAC,CAAC;AAEpI,+DAA+D;AAC/D,SAAS,eAAe,CAAC,KAAoB;IAC3C,OAAO,SAAS,CACd,MAAM,CACJ,eAAe,EACf,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EACvC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAC1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EACtB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CACxB,CACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,CAAoB,EAAE,cAA+B,EAAE;IACxF,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,SAAS,CAC1B,MAAM,CACJ,QAAQ,EACR,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAClB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAChB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EACxB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAC7B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAC9B,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CACpB,CACF,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AAC7F,CAAC"}

package/dist/x402/envelope.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @drm3/sdk/x402 - the spec-shaped 402 envelope + offers-menu builder.
+ *
+ * `x402Requirements` (the single `accepts` entry, x402 "exact" scheme) and
+ * `x402Body` (the full 402 Payment Required JSON body), plus the gateway +
+ * envelope option types. The payTo, price, and chain overrides come from the
+ * caller's config.
+ */
+import { type X402ChainConfig } from "./chain.js";
+/** Config for advertising and verifying an x402 gateway. `payTo` = the shared DRM3 gateway wallet. */
+export interface X402GatewayConfig extends X402ChainConfig {
+    /** The wallet payments settle to (the shared DRM3 x402 gateway wallet). */
+    payTo: string;
+    /** The required price per call, in atomic asset units (USDC = 6 decimals). */
+    priceAtomic: bigint;
+}
+/** Options for the `accepts` requirement + the full 402 body. */
+export interface X402EnvelopeOptions {
+    /** The resource URL being paid for. */
+    resource: string;
+    /** Human description shown in the `accepts` entry. */
+    description: string;
+    /** Advertised authorization lifetime. Default 60. */
+    maxTimeoutSeconds?: number;
+    /** Additive, non-spec access-door menu (app-specific; x402 clients ignore it). */
+    offers?: unknown;
+    /** Additive, non-spec plain-language pointer for a human who lands on the 402. */
+    hint?: string;
+    /** Optional error string to attach (e.g. why a submitted X-PAYMENT failed). */
+    error?: string;
+}
+/**
+ * The single `accepts` entry we advertise (x402 "exact" scheme). The client must
+ * sign a `TransferWithAuthorization` under the EIP-712 domain in `extra`.
+ */
+export declare function x402Requirements(config: X402GatewayConfig, opts: Pick<X402EnvelopeOptions, "resource" | "description" | "maxTimeoutSeconds">): Record<string, unknown>;
+/**
+ * Build the 402 Payment Required JSON body: the spec-shaped x402 envelope
+ * (`x402Version` + `accepts`, untouched for client compatibility) plus ADDITIVE
+ * non-spec fields the caller supplies - `offers` (an access-door menu) and `hint`
+ * (a plain-language pointer). x402 clients ignore unknown top-level fields, so
+ * the additions cannot break them.
+ */
+export declare function x402Body(config: X402GatewayConfig, opts: X402EnvelopeOptions): Record<string, unknown>;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/x402/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/x402/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAA+B,KAAK,eAAe,EAAgB,MAAM,YAAY,CAAC;AAI7F,sGAAsG;AACtG,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,GAAG,aAAa,GAAG,mBAAmB,CAAC,GAChF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAStG"}

package/dist/x402/envelope.js

@@ -0,0 +1,50 @@
+/**
+ * @drm3/sdk/x402 - the spec-shaped 402 envelope + offers-menu builder.
+ *
+ * `x402Requirements` (the single `accepts` entry, x402 "exact" scheme) and
+ * `x402Body` (the full 402 Payment Required JSON body), plus the gateway +
+ * envelope option types. The payTo, price, and chain overrides come from the
+ * caller's config.
+ */
+import { DEFAULT_MAX_TIMEOUT_SECONDS, resolveChain } from "./chain.js";
+/**
+ * The single `accepts` entry we advertise (x402 "exact" scheme). The client must
+ * sign a `TransferWithAuthorization` under the EIP-712 domain in `extra`.
+ */
+export function x402Requirements(config, opts) {
+    const chain = resolveChain(config);
+    return {
+        scheme: "exact",
+        network: chain.network,
+        maxAmountRequired: config.priceAtomic.toString(),
+        resource: opts.resource,
+        description: opts.description,
+        mimeType: "application/json",
+        payTo: config.payTo,
+        maxTimeoutSeconds: opts.maxTimeoutSeconds ?? DEFAULT_MAX_TIMEOUT_SECONDS,
+        asset: chain.asset,
+        // EIP-712 domain the client must sign under (per x402 exact/evm scheme).
+        extra: { name: chain.domainName, version: chain.domainVersion },
+    };
+}
+/**
+ * Build the 402 Payment Required JSON body: the spec-shaped x402 envelope
+ * (`x402Version` + `accepts`, untouched for client compatibility) plus ADDITIVE
+ * non-spec fields the caller supplies - `offers` (an access-door menu) and `hint`
+ * (a plain-language pointer). x402 clients ignore unknown top-level fields, so
+ * the additions cannot break them.
+ */
+export function x402Body(config, opts) {
+    const body = {
+        x402Version: 1,
+        accepts: [x402Requirements(config, opts)],
+    };
+    if (opts.offers !== undefined)
+        body.offers = opts.offers;
+    if (opts.hint !== undefined)
+        body.hint = opts.hint;
+    if (opts.error)
+        body.error = opts.error;
+    return body;
+}
+//# sourceMappingURL=envelope.js.map

package/dist/x402/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/x402/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,2BAA2B,EAAwB,YAAY,EAAE,MAAM,YAAY,CAAC;AA4B7F;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,EACzB,IAAiF;IAEjF,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE;QAChD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,2BAA2B;QACxE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,yEAAyE;QACzE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAyB,EAAE,IAAyB;IAC3E,MAAM,IAAI,GAA4B;QACpC,WAAW,EAAE,CAAC;QACd,OAAO,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;KAC1C,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/x402/index.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @drm3/sdk/x402 - the ONE shared DRM3 x402 payment gateway core.
+ *
+ * x402 agent micropayments (https://www.x402.org) - the "exact" scheme on Base.
+ * This is the studio model applied to x402: like one Stripe is one gateway for
+ * every checkout, this is one x402 gateway library for every DRM3 app. Every app
+ * (except MorScan, which stays its own animal with its own wallet + commerce
+ * seam) imports THIS to advertise a 402 and verify the signed EIP-3009 payment
+ * that follows, and every app points at the ONE shared DRM3 x402 gateway wallet
+ * (the funded `X402_PAY_TO`). The payTo, the price, and the storage (the replay
+ * gate / settlement ledger) are the caller's app-specific config; the crypto,
+ * the verification, and the 402 envelope live here, once.
+ *
+ * What this module is:
+ *  - the secp256k1 / keccak256 primitives (`keccak256`, `ecrecover`, hex helpers),
+ *  - the EIP-712 / EIP-3009 `TransferWithAuthorization` digest + full server-side
+ *    verification of an `X-PAYMENT` header (`verifyX402Payment`), and
+ *  - the spec-shaped 402 envelope + offers-menu builder (`x402Requirements`,
+ *    `x402Body`).
+ *
+ * What this module is NOT: it holds no signing key, touches no database, and
+ * broadcasts nothing on-chain. `verifyX402Payment` here is pure and synchronous
+ * (envelope structure, scheme/network, payTo, amount, validity window, and the
+ * EIP-712 signature recovering the payer). The nonce-replay gate, the per-payer
+ * abuse cap, and settlement are storage-specific and stay in the calling app
+ * (Newsboy runs them against Postgres, for example). The verification here is
+ * byte-identical to MorScan's reference implementation: DO NOT relax any check.
+ *
+ * Zero runtime deps beyond @noble; Workers, Bun, and Node.
+ *
+ * This file is a thin barrel: the implementation lives in sibling modules split
+ * by concern - `crypto.ts` (secp/keccak/hex), `chain.ts` (asset/chain config),
+ * `eip712.ts` (the TransferWithAuthorization digest), `envelope.ts` (the 402
+ * envelope), and `verify.ts` (X-PAYMENT decoding + verification).
+ */
+export { bytesToBigInt, bytesToHex, ecrecover, hexToBytes, keccak256 } from "./crypto.js";
+export { BASE_CHAIN_ID, BASE_NETWORK, DEFAULT_GRACE_SECONDS, DEFAULT_MAX_TIMEOUT_SECONDS, USDC_DOMAIN_NAME, USDC_DOMAIN_VERSION, X402_ASSET_USDC_BASE, type X402ChainConfig, } from "./chain.js";
+export { type X402Authorization, transferAuthDigest } from "./eip712.js";
+export { type X402EnvelopeOptions, type X402GatewayConfig, x402Body, x402Requirements, } from "./envelope.js";
+export { type DecodedPaymentHeader, decodePaymentHeader, type X402Payment, type X402VerifyConfig, type X402VerifyResult, verifyX402Payment, } from "./verify.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/x402/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/x402/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,QAAQ,EACR,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,iBAAiB,GAClB,MAAM,aAAa,CAAC"}