@envarai/envarpay 0.2.0-alpha.19 → 0.2.0-alpha.20

package/dist/commerce/x402.js

@@ -1,181 +0,0 @@
-import { findDefaultAsset } from '@x402/evm';
-import { x402ResourceServer, HTTPFacilitatorClient } from '@x402/core/server';
-import { decodePaymentSignatureHeader, encodePaymentRequiredHeader, encodePaymentResponseHeader } from '@x402/core/http';
-import { ExactEvmScheme } from '@x402/evm/exact/server';
-import { PAYMENT_IDENTIFIER, declarePaymentIdentifierExtension, extractPaymentIdentifier, validatePaymentIdentifier, paymentIdentifierResourceServerExtension, } from '@x402/extensions/payment-identifier';
-import { CommerceError } from './types.js';
-import { digest } from './config.js';
-/** Official x402 v2 exact settlement, with independent chain evidence before work. */
-export class X402Gate {
-    options;
-    servers = new Map();
-    constructor(options) {
-        this.options = options;
-    }
-    async check(profiles) {
-        for (const profile of profiles) {
-            const { facilitator } = await this.resource(profile);
-            const supported = await facilitator.getSupported();
-            if (!supported.kinds.some(k => k.x402Version === 2 && k.scheme === 'exact' && k.network === profile.network))
-                throw new CommerceError('facilitator_network', 'Configured facilitator does not support exact payments on this network');
-            if (this.options.checkpoint)
-                await this.options.checkpoint({ scheme: 'exact', network: profile.network, asset: profile.asset, payTo: profile.payTo, amount: '1', maxTimeoutSeconds: 300, extra: {} });
-        }
-    }
-    async recover(orderId, caller) {
-        const order = this.options.store.getOrder(orderId, caller);
-        if (!order)
-            throw new CommerceError('order_not_found', 'Order not found for this buyer');
-        const attempt = this.options.store.paymentForOrder(order.id);
-        if (!attempt)
-            throw new CommerceError('attempt_not_found', 'No original payment to recover');
-        if (attempt.state === 'confirmed')
-            return { state: 'confirmed', taskId: order.taskId };
-        if (attempt.state === 'rejected')
-            return { state: 'rejected', taskId: order.taskId };
-        const saved = this.options.vault.get(attempt.credentialRef);
-        const required = this.options.store.paymentChallenge(order.id);
-        if (saved.quoteId !== order.quote.quoteId || !required?.accepts.some(r => digest(r) === digest(saved.requirements))) {
-            throw new CommerceError('recovery_conflict', 'Stored authorization differs from the frozen challenge');
-        }
-        let receipt = attempt.receipt;
-        if (!receipt?.transaction && saved.fromBlock && this.options.findOriginalReceipt) {
-            receipt = await this.options.findOriginalReceipt(saved.payload, saved.requirements, saved.fromBlock) ?? null;
-        }
-        if (!receipt?.transaction) {
-            if (await this.options.proveExpiredUnused?.(saved.payload, saved.requirements)) {
-                this.options.store.recordSettlement(attempt.id, 'rejected', { errorReason: 'authorization_expired_unused' });
-                return { state: 'rejected', taskId: order.taskId };
-            }
-            return { state: 'unknown', taskId: order.taskId };
-        }
-        let proven = false;
-        try {
-            proven = await this.options.verifyReceipt(receipt, saved.payload, saved.requirements);
-        }
-        catch { }
-        // Persist the discovered transaction even if confirmations are still pending.
-        this.options.store.recordSettlement(attempt.id, proven ? 'confirmed' : 'unknown', receipt);
-        return { state: proven ? 'confirmed' : 'unknown', taskId: order.taskId };
-    }
-    async resource(profile) {
-        const key = digest(profile);
-        let promise = this.servers.get(key);
-        if (!promise) {
-            promise = (async () => {
-                const facilitator = this.options.facilitator?.(profile) ?? new HTTPFacilitatorClient({ url: profile.facilitatorUrl });
-                const server = new x402ResourceServer(facilitator)
-                    .register(profile.network, new ExactEvmScheme())
-                    .registerExtension(paymentIdentifierResourceServerExtension);
-                await server.initialize();
-                return { server, facilitator };
-            })();
-            this.servers.set(key, promise);
-            void promise.catch(() => this.servers.delete(key));
-        }
-        return promise;
-    }
-    async handle(request, order) {
-        const profile = order.quote.paymentProfile;
-        if (profile?.adapter !== 'x402')
-            throw new CommerceError('payment_method_unavailable', 'This offer requires another installed payment adapter');
-        const previous = this.options.store.paymentForOrder(order.id);
-        if (order.paymentState === 'confirmed' && previous?.receipt) {
-            return { headers: { 'PAYMENT-RESPONSE': encodePaymentResponseHeader(previous.receipt) } };
-        }
-        if (['settling', 'unknown'].includes(order.paymentState)) {
-            const recovered = await this.recover(order.id, order.caller);
-            if (recovered.state === 'confirmed') {
-                const receipt = this.options.store.paymentForOrder(order.id).receipt;
-                return { headers: { 'PAYMENT-RESPONSE': encodePaymentResponseHeader(receipt) } };
-            }
-            if (recovered.state === 'rejected')
-                return { response: Response.json({ error: 'authorization_expired_unused', taskId: order.taskId }, { status: 409, headers: { 'Cache-Control': 'no-store' } }) };
-            return { response: Response.json({ error: 'payment_reconciliation_required', taskId: order.taskId }, { status: 503, headers: { 'Cache-Control': 'no-store' } }) };
-        }
-        if (Date.now() >= Date.parse(order.quote.expiresAt))
-            return { response: Response.json({ error: 'quote_expired' }, { status: 409 }) };
-        const { server, facilitator } = await this.resource(profile);
-        let required = this.options.store.paymentChallenge(order.id);
-        if (!required) {
-            const token = findDefaultAsset(profile.asset, profile.network);
-            if (!token)
-                throw new CommerceError('unsupported_asset', 'Official token signing domain is unavailable');
-            const requirements = await server.buildPaymentRequirements({
-                scheme: 'exact', network: profile.network, payTo: profile.payTo,
-                price: { asset: profile.asset, amount: order.quote.amount, extra: { name: token.name, version: token.version } },
-                maxTimeoutSeconds: 300, extra: { paymentFlow: 'upfront', assetTransferMethod: 'eip3009' },
-            });
-            const resource = new URL(request.url);
-            resource.search = '';
-            resource.searchParams.set('quote', order.quote.quoteId);
-            required = this.options.store.freezePaymentChallenge(order.id, await server.createPaymentRequiredResponse(requirements, { url: resource.href, description: order.quote.serviceId, mimeType: 'application/json' }, undefined, { [PAYMENT_IDENTIFIER]: declarePaymentIdentifierExtension(false), 'urn:envarpay:quote:1': { info: { quoteId: order.quote.quoteId, messageId: order.messageId, serviceId: order.quote.serviceId, serviceRevision: order.quote.serviceRevision, offerId: order.offerId, inputDigest: order.inputDigest, termsDigest: order.quote.termsDigest, expiresAt: order.quote.expiresAt, amount: order.quote.amount, currency: order.quote.currency, recipient: order.quote.recipient } } }));
-        }
-        // Identifier is optional for unextended standard clients; nonce dedup is mandatory.
-        const challenge = () => ({ response: new Response('{}', {
-                status: 402, headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'PAYMENT-REQUIRED': encodePaymentRequiredHeader(required) },
-            }) });
-        const header = request.headers.get('PAYMENT-SIGNATURE');
-        if (!header)
-            return challenge();
-        if (header.length > 32768)
-            throw new CommerceError('payment_payload_size', 'Payment credential exceeds limit');
-        let payload;
-        try {
-            payload = decodePaymentSignatureHeader(header);
-        }
-        catch {
-            throw new CommerceError('invalid_payment', 'Malformed payment credential');
-        }
-        const matched = server.findMatchingRequirements(required.accepts, payload);
-        if (!matched || payload.x402Version !== 2 || payload.resource?.url !== required.resource.url || digest(payload.accepted) !== digest(matched)) {
-            throw new CommerceError('quote_mismatch', 'Payment does not match the frozen quote');
-        }
-        const extension = payload.extensions?.[PAYMENT_IDENTIFIER];
-        // Validate against our schema; never compile a schema supplied by the buyer.
-        if (extension !== undefined && !validatePaymentIdentifier({ info: extension?.info, schema: declarePaymentIdentifierExtension(false).schema }).valid) {
-            throw new CommerceError('invalid_payment_identifier', 'Invalid standard payment identifier');
-        }
-        const identifier = extractPaymentIdentifier(payload, false);
-        const native = payload.payload;
-        const auth = native.authorization;
-        const payer = this.options.payerFor(order.caller);
-        if (!payer || !auth?.from || auth.from.toLowerCase() !== payer.toLowerCase() || auth.to?.toLowerCase() !== profile.payTo.toLowerCase() || auth.value !== order.quote.amount || !/^0x[0-9a-fA-F]{64}$/.test(auth.nonce ?? '') || !native.signature) {
-            throw new CommerceError('payment_identity', 'Signed payer, recipient, amount and nonce must match authorized buyer and quote');
-        }
-        // Quote UI metadata is locally checked above. It is not a facilitator
-        // settlement extension; do not require third-party facilitators to implement it.
-        const settlementPayload = { ...payload, extensions: Object.fromEntries(Object.entries(payload.extensions ?? {}).filter(([key]) => key !== 'urn:envarpay:quote:1')) };
-        // Upfront SDK verification may skip /verify; explicitly perform it before reserve.
-        const verified = await facilitator.verify(settlementPayload, matched);
-        if (!verified.isValid)
-            return challenge();
-        if (verified.payer && verified.payer.toLowerCase() !== payer.toLowerCase())
-            throw new CommerceError('payment_identity', 'Verified payer differs from authorized buyer');
-        const economicKey = digest({ network: profile.network, asset: profile.asset.toLowerCase(), payer: payer.toLowerCase(), nonce: auth.nonce.toLowerCase() });
-        const fromBlock = await this.options.checkpoint?.(matched);
-        const saved = { payload, requirements: matched, quoteId: order.quote.quoteId, ...(fromBlock !== undefined ? { fromBlock } : {}) };
-        const credentialRef = this.options.vault.put(saved);
-        const attempt = this.options.store.reservePayment(order.id, order.caller, economicKey, credentialRef, identifier ?? undefined);
-        let result;
-        try {
-            result = await server.settlePayment(settlementPayload, matched, undefined, undefined, undefined, 'before-handler');
-        }
-        catch {
-            this.options.store.recordSettlement(attempt, 'unknown', {});
-            return { response: Response.json({ error: 'payment_outcome_unknown' }, { status: 503 }) };
-        }
-        // A failure can follow broadcast. Never create a second economic authorization.
-        let proven = false;
-        if (result.success) {
-            try {
-                proven = await this.options.verifyReceipt(result, payload, matched);
-            }
-            catch { }
-        }
-        this.options.store.recordSettlement(attempt, proven ? 'confirmed' : 'unknown', result);
-        if (!proven)
-            return { response: Response.json({ error: result.success ? 'receipt_verification_pending' : 'payment_outcome_unknown' }, { status: 503 }) };
-        return { headers: { 'PAYMENT-RESPONSE': encodePaymentResponseHeader(result) } };
-    }
-}

package/examples/buyer-policy.json

@@ -1,18 +0,0 @@
-{
-  "policyVersion":1,
-  "paymentsEnabled":false,
-  "approval":"per_purchase",
-  "peers":[{
-    "id":"research-seller",
-    "cardUrl":"https://seller.example/services/research/v1/offers/usdc-once/agent-card.json",
-    "protocol":"x402",
-    "currency":"eip155:84532/erc20:0x036CbD53842c5426634e7929541eC2318f3dCF7e",
-    "recipient":"0x2222222222222222222222222222222222222222",
-    "maxPerPurchase":"3000000"
-  }],
-  "budgets":[{
-    "currency":"eip155:84532/erc20:0x036CbD53842c5426634e7929541eC2318f3dCF7e",
-    "maxTotal":"10000000",
-    "period":"cumulative"
-  }]
-}

package/schemas/buyer-policy.schema.json

@@ -1,253 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "urn:envarpay:buyer-policy:1",
-  "title": "Local buyer permission policy; not supplied by the seller",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "policyVersion",
-    "paymentsEnabled",
-    "approval",
-    "peers",
-    "budgets"
-  ],
-  "properties": {
-    "policyVersion": {
-      "const": 1
-    },
-    "paymentsEnabled": {
-      "type": "boolean"
-    },
-    "approval": {
-      "enum": [
-        "per_purchase",
-        "within_preapproved_limits"
-      ]
-    },
-    "peers": {
-      "type": "array",
-      "minItems": 1,
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": [
-          "id",
-          "cardUrl",
-          "protocol",
-          "currency",
-          "recipient",
-          "maxPerPurchase"
-        ],
-        "properties": {
-          "id": {
-            "type": "string",
-            "pattern": "^[a-z][a-z0-9-]{0,63}$"
-          },
-          "cardUrl": {
-            "type": "string",
-            "format": "uri",
-            "pattern": "^https://"
-          },
-          "protocol": {
-            "enum": [
-              "x402",
-              "mpp",
-              "free"
-            ]
-          },
-          "currency": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "recipient": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "maxPerPurchase": {
-            "type": "string",
-            "pattern": "^(0|[1-9][0-9]{0,77})$"
-          },
-          "mode": {
-            "enum": [
-              "envarpay",
-              "standard-a2a"
-            ]
-          },
-          "endpoint": {
-            "type": "string",
-            "format": "uri",
-            "pattern": "^https://"
-          },
-          "authentication": {
-            "enum": [
-              "none",
-              "bearer"
-            ]
-          },
-          "localContract": {
-            "type": "object",
-            "additionalProperties": false,
-            "required": [
-              "revision",
-              "offerId",
-              "inputSchema",
-              "amount",
-              "paidOnly"
-            ],
-            "properties": {
-              "revision": {
-                "type": "integer",
-                "minimum": 1,
-                "maximum": 9007199254740991
-              },
-              "offerId": {
-                "type": "string",
-                "pattern": "^[a-z][a-z0-9-]{0,63}$"
-              },
-              "inputSchema": {
-                "type": "object"
-              },
-              "amount": {
-                "$ref": "#/$defs/amount"
-              },
-              "paidOnly": {
-                "const": true
-              }
-            }
-          }
-        },
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "protocol": {
-                  "const": "free"
-                }
-              }
-            },
-            "then": {
-              "properties": {
-                "currency": {
-                  "const": null
-                },
-                "recipient": {
-                  "const": null
-                },
-                "maxPerPurchase": {
-                  "const": "0"
-                }
-              }
-            },
-            "else": {
-              "properties": {
-                "currency": {
-                  "type": "string",
-                  "minLength": 1
-                },
-                "recipient": {
-                  "type": "string",
-                  "minLength": 1
-                },
-                "maxPerPurchase": {
-                  "$ref": "#/$defs/amount"
-                }
-              }
-            }
-          },
-          {
-            "if": {
-              "required": [
-                "mode"
-              ],
-              "properties": {
-                "mode": {
-                  "const": "standard-a2a"
-                }
-              }
-            },
-            "then": {
-              "required": [
-                "endpoint",
-                "authentication",
-                "localContract"
-              ],
-              "properties": {
-                "protocol": {
-                  "const": "x402"
-                },
-                "endpoint": {},
-                "authentication": {},
-                "localContract": {}
-              }
-            },
-            "else": {
-              "not": {
-                "anyOf": [
-                  {
-                    "required": [
-                      "endpoint"
-                    ],
-                    "properties": {
-                      "endpoint": {}
-                    }
-                  },
-                  {
-                    "required": [
-                      "authentication"
-                    ],
-                    "properties": {
-                      "authentication": {}
-                    }
-                  },
-                  {
-                    "required": [
-                      "localContract"
-                    ],
-                    "properties": {
-                      "localContract": {}
-                    }
-                  }
-                ]
-              }
-            }
-          }
-        ]
-      }
-    },
-    "budgets": {
-      "type": "array",
-      "minItems": 0,
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": [
-          "currency",
-          "maxTotal",
-          "period"
-        ],
-        "properties": {
-          "currency": {
-            "type": "string",
-            "minLength": 1
-          },
-          "maxTotal": {
-            "$ref": "#/$defs/amount"
-          },
-          "period": {
-            "const": "cumulative"
-          }
-        }
-      }
-    }
-  },
-  "$defs": {
-    "amount": {
-      "type": "string",
-      "pattern": "^[1-9][0-9]{0,77}$"
-    }
-  }
-}