@getalby/lightning-tools 8.1.0 → 8.1.1

package/dist/cjs/402.cjs

@@ -1352,7 +1352,7 @@ const buildX402PaymentSignature = (scheme, network, invoice, requirements) => {
     return btoa(unescape(encodeURIComponent(json)));
 };
 
-const handleX402Payment = async (x402Header, url, fetchArgs, headers, wallet) => {
+const decodeX402Header = (x402Header) => {
     let parsed;
     try {
         parsed = JSON.parse(decodeURIComponent(escape(atob(x402Header))));
@@ -1363,9 +1363,31 @@ const handleX402Payment = async (x402Header, url, fetchArgs, headers, wallet) =>
     if (!Array.isArray(parsed.accepts) || parsed.accepts.length === 0) {
         throw new Error("x402: PAYMENT-REQUIRED header contains no payment options");
     }
-    const requirements = parsed.accepts.find((e) => {
-        return e.extra?.paymentMethod === "lightning";
-    });
+    return { accepts: parsed.accepts };
+};
+/**
+ * Probe a PAYMENT-REQUIRED header for a lightning-payable offer without
+ * throwing. Returns the matching requirements, or null if the header has no
+ * lightning entry (e.g. USDC-only endpoints) or is malformed. Used by the
+ * top-level fetch402 dispatcher to decide whether to attempt payment or hand
+ * the 402 back to the caller.
+ */
+const findX402LightningRequirements = (x402Header) => {
+    let accepts;
+    try {
+        ({ accepts } = decodeX402Header(x402Header));
+    }
+    catch (_) {
+        return null;
+    }
+    const requirements = accepts.find((e) => e?.extra?.paymentMethod === "lightning");
+    if (!requirements?.extra?.invoice)
+        return null;
+    return requirements;
+};
+const handleX402Payment = async (x402Header, url, fetchArgs, headers, wallet) => {
+    const { accepts } = decodeX402Header(x402Header);
+    const requirements = accepts.find((e) => e?.extra?.paymentMethod === "lightning");
     if (!requirements) {
         throw new Error("x402: unsupported x402 network, only Bitcoin lightning network is supported.");
     }
@@ -1584,19 +1606,28 @@ const fetch402 = async (url, fetchArgs, options) => {
     const headers = new Headers(fetchArgs.headers ?? undefined);
     fetchArgs.headers = headers;
     const initResp = await fetch(url, fetchArgs);
+    // L402 / LSAT: dedicated scheme, dispatch directly.
     const wwwAuthHeader = initResp.headers.get("www-authenticate");
     if (wwwAuthHeader) {
         const trimmed = wwwAuthHeader.trimStart().toLowerCase();
-        if (trimmed.startsWith("payment")) {
-            return handleMppChargePayment(wwwAuthHeader, url, fetchArgs, headers, wallet);
-        }
         if (trimmed.startsWith("l402") || trimmed.startsWith("lsat")) {
             return handleL402Payment(wwwAuthHeader, url, fetchArgs, headers, wallet);
         }
-        throw new Error(`fetch402: unsupported WWW-Authenticate scheme: ${wwwAuthHeader}`);
     }
+    // A server may advertise multiple payment options at once (e.g. an MPP
+    // USDC challenge in WWW-Authenticate alongside an x402 PAYMENT-REQUIRED
+    // header that lists both USDC and lightning). Try each lightning-payable
+    // handler in turn; only if none matches do we hand the original 402 back
+    // to the caller so they can decide what to do with non-lightning offers.
+    // 1. MPP-lightning challenge (Payment method="lightning" intent="charge").
+    //    parseMppChallenge returns null for any other method, which lets us
+    //    fall through to x402 instead of throwing.
+    if (wwwAuthHeader && parseMppChallenge(wwwAuthHeader)) {
+        return handleMppChargePayment(wwwAuthHeader, url, fetchArgs, headers, wallet);
+    }
+    // 2. x402 PAYMENT-REQUIRED with a lightning entry in `accepts`.
     const x402Header = initResp.headers.get("PAYMENT-REQUIRED");
-    if (x402Header) {
+    if (x402Header && findX402LightningRequirements(x402Header)) {
         return handleX402Payment(x402Header, url, fetchArgs, headers, wallet);
     }
     return initResp;
@@ -1686,6 +1717,7 @@ exports.fetch402 = fetch402;
 exports.fetchWithL402 = fetchWithL402;
 exports.fetchWithMpp = fetchWithMpp;
 exports.fetchWithX402 = fetchWithX402;
+exports.findX402LightningRequirements = findX402LightningRequirements;
 exports.issueL402Macaroon = issueL402Macaroon;
 exports.makeL402AuthenticateHeader = makeL402AuthenticateHeader;
 exports.parseL402 = parseL402;