@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/payments/gate.js

@@ -0,0 +1,481 @@
+/**
+ * The `PaymentGate` (src/contracts/payment-gate.ts; payments spec §4, §13.4; Go Prod §11.3; NOTES
+ * D30–D34), standard x402 since contracts v1.3: offer → 402 → payer binding (read locally from the
+ * payment delegation) → the key's cap → verify = the facilitator RESERVES the price per claim →
+ * (the router records the rows `reserved` and starts the claims) … and after the decision row,
+ * settle on the engine's receipt (settle.ts). Nothing is reserved for a payer the source refuses.
+ *
+ * What the gate keeps, in CACHE_KV:
+ *   - `x402-offer:<offerId>` — the offer (source, key, items with their amounts) for a day: the paid
+ *     retry's claimIds come from HERE, never from the retry, and a retry after the offer expired
+ *     is re-offered for the same claims.
+ *   - `x402-paid:<offerId>` — the offer plus the VERIFIED `PAYMENT-SIGNATURE`, sealed
+ *     (header-seal.ts), for a week: every `/settle` of the offer's claims is built from it, so a
+ *     retry's body is identical (x402's `settlement_pending` resolves only that way).
+ *
+ * A claimId that has an `api_charges` row is NEVER offered again (`refuse`): it is recorded, and a
+ * second payment for it would reserve money for a claim `recordApiClaims` answers `exists` for.
+ *
+ * Refusals the payer can act on are results with a 402 body; one with nothing payable to offer
+ * throws `AppError.paymentRequired` (`nonce_unknown`, a charged claim), a payer who is not the
+ * source's throws FORBIDDEN (`payer_not_member`); a facilitator outage or a config the operator must
+ * fix throws `AppError.unavailable` (503 `SOURCE_PAUSED { payments-disabled }`).
+ */
+import { and, eq, gt, inArray, isNull, ne, notInArray, or, sql } from "drizzle-orm";
+import { z } from "zod";
+import { EvmAddress, MAX_BATCH_CLAIMS, OfferNonce, } from "../../contracts/index.js";
+import { apiCharges, apiKeys } from "../../db/schema.js";
+import { liveGrant } from "../api-lane/members.js";
+import { DAY_MS } from "../api-lane/retention.js";
+import { createEngineClient } from "../engine/client.js";
+import { AppError } from "../errors.js";
+import { readCache } from "../metrics.js";
+import { createFacilitatorClient } from "./facilitator.js";
+import { sealHeader } from "./header-seal.js";
+import { publishedPrice } from "./price.js";
+import { settleClaim } from "./settle.js";
+const OFFER_KEEP_SEC = 86_400;
+/** Well past the 24 h reservation: a `settlement_pending` (a payer short of funds for a few days)
+ *  can still be re-settled with its identical body. */
+const PAID_KEEP_SEC = 7 * 86_400;
+const offerKey = (offerId) => `x402-offer:${offerId}`;
+const paidKey = (offerId) => `x402-paid:${offerId}`;
+/** claimId → the offer whose payment `/verify` accepted for it: that claim is never offered anew. */
+const verifiedClaimKey = (claimId) => `x402-verified-claim:${claimId}`;
+// --- headers (board ixo-pay README "Header encoding": standard base64 of UTF-8 JSON) --------------
+export function encodeHeader(value) {
+    let binary = "";
+    for (const byte of new TextEncoder().encode(JSON.stringify(value))) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+export function decodeHeader(header) {
+    try {
+        const bytes = Uint8Array.from(atob(header.trim()), (c) => c.charCodeAt(0));
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * All the gate reads of a `PAYMENT-SIGNATURE`: the offer it names and, for PAY, the payment
+ * delegation (for its payer). Card (`stripe-manual-capture`, contracts v1.4) carries the authorized
+ * PaymentIntent instead: no delegation, so its payer is the one `/verify` names. USDC on Base
+ * (x402's `exact`) carries a signed EIP-3009 authorization: its payer is an EVM account. The
+ * facilitator checks the rest; the header goes to it unchanged.
+ */
+const SignedNonce = z.union([
+    z.looseObject({
+        x402Version: z.literal(2),
+        accepted: z.looseObject({
+            scheme: z.literal("stripe-manual-capture"),
+            extra: z.looseObject({ nonce: OfferNonce }),
+        }),
+        payload: z.looseObject({ paymentIntentId: z.string().min(1), customerId: z.string().min(1) }),
+    }),
+    z.looseObject({
+        x402Version: z.literal(2),
+        accepted: z.looseObject({
+            scheme: z.literal("exact"),
+            extra: z.looseObject({ nonce: OfferNonce }),
+        }),
+        payload: z.looseObject({
+            signature: z.string().min(1),
+            authorization: z.looseObject({ from: EvmAddress }),
+        }),
+    }),
+    z.looseObject({
+        x402Version: z.literal(2),
+        accepted: z.looseObject({ extra: z.looseObject({ nonce: OfferNonce }) }),
+        payload: z.looseObject({ delegation: z.string().min(1) }),
+    }),
+]);
+const INVALID_SIGNATURE = "The PAYMENT-SIGNATURE header is not a valid payment (a base64 x402 v2 PaymentPayload naming an offer, with its payment delegation or, for card, its PaymentIntent, or, for USDC, its signed authorization). Resend the request without the PAYMENT-SIGNATURE header to get a new offer.";
+function readSignature(header) {
+    const parsed = SignedNonce.safeParse(decodeHeader(header));
+    // No offer to rebuild from: nothing but a 400 can tell the payer what is wrong.
+    if (!parsed.success)
+        throw AppError.validation(INVALID_SIGNATURE);
+    return { payload: parsed.data, nonce: parsed.data.accepted.extra.nonce };
+}
+/**
+ * The payer, read locally BEFORE anything is reserved (payments spec §4 step 3): the issuer at the
+ * root of the payment delegation (a base64 CAR), the account the facilitator charges. Unverified
+ * here — only a pre-check: the facilitator verifies the signature chain, and the gate then holds
+ * its `payer` to this one. An undecodable delegation is the invalid-payload 400; a chain whose
+ * root is not in the CAR (a proof by link only) is null — no local pre-check then, the
+ * post-`/verify` binding decides.
+ */
+async function payerOf(delegation) {
+    const { UcantoServer } = await import("@ixo/ucan");
+    let extracted;
+    try {
+        extracted = await UcantoServer.Delegation.extract(new Uint8Array(Buffer.from(delegation, "base64")));
+    }
+    catch {
+        throw AppError.validation(INVALID_SIGNATURE);
+    }
+    if (extracted.error)
+        throw AppError.validation(INVALID_SIGNATURE);
+    let root = extracted.ok;
+    while (root.proofs.length > 0) {
+        const [proof] = root.proofs;
+        if (!proof || !UcantoServer.isDelegation(proof))
+            return null;
+        root = proof;
+    }
+    return root.issuer.did();
+}
+/**
+ * The standard x402 `/verify` body, and `/settle`'s before its `receipts` (payments spec §13.0): the
+ * offer id top-level AND as `extra.nonce` (§13.1), the payload's echoed terms as the requirements.
+ */
+const facilitatorBody = (payload, offerId) => ({
+    x402Version: 2,
+    offerId,
+    paymentRequirements: payload.accepted,
+    paymentPayload: payload,
+});
+/** The `/verify` body for a header the oracle itself built (a chain claim's, review-billing.ts). */
+export const verifyBody = (header, offerId) => facilitatorBody(readSignature(header).payload, offerId);
+/** One claim's `/settle` body: the verified payment plus the engine's receipt (§13.0 addition 2).
+ *  Built from the kept header alone, so every retry for the claim is byte-identical. */
+export function settleBody(header, offerId, claimId, receiptJws) {
+    const { payload } = readSignature(header);
+    return { ...facilitatorBody(payload, offerId), receipts: [{ claimId, jws: receiptJws }] };
+}
+async function readKv(cache, key) {
+    const raw = await cache.get(key);
+    return raw ? JSON.parse(raw) : null;
+}
+export const readPaidOffer = (cache, offerId) => readKv(cache, paidKey(offerId));
+const codeFor = (reason) => reason === "spend_cap"
+    ? "SPEND_CAP"
+    : reason === "insufficient_credits"
+        ? "INSUFFICIENT_CREDITS"
+        : "PAYMENT_REQUIRED";
+function consoleUrl(config) {
+    if (!config.CONSOLE_URL)
+        throw AppError.unavailable("CONSOLE_URL is not set: no fundingUrl");
+    return config.CONSOLE_URL;
+}
+/** What the 402 quotes: the whole request (one claim ⇒ that decision's price). */
+function totalOf(items) {
+    const upay = items.reduce((sum, i) => sum + BigInt(i.amount), 0n);
+    return {
+        // 1 upay = 1 micro-USD (price.ts), so the base units ARE the micro-USD.
+        amountMicroUsd: Number(upay),
+        amountCents: items.reduce((sum, i) => sum + i.amountCents, 0),
+        currency: "USD",
+        amount: String(upay),
+        asset: "upay",
+    };
+}
+const PLAN_PAY_KEY = "x402-plan-takes-pay";
+/** As review billing's plan read: an IXO admin's change shows within minutes. */
+const PLAN_PAY_TTL_SEC = 300;
+/**
+ * Whether IXO's plan for this oracle takes PAY, i.e. whether an offer carries ixo-pay terms. The
+ * facilitator holds the offer to the plan both ways: it refuses ixo-pay terms (400) when the plan's
+ * `accepts` has no `upay`, which is every third-party oracle (`card` and/or `usdc-base`; PAY is
+ * IXO's only), and requires them when it has. Read from the engine's `GET /v1/oracles/me`
+ * `accepts`. On an engine that does not send it yet, `ixoManaged: false` also means no PAY (the
+ * engine refuses `upay` on a plan IXO does not run), and neither field keeps today's PAY offer.
+ * KV-cached 5 minutes. A read that fails is unavailable (payments-disabled), never a guess.
+ */
+async function planTakesPay(deps) {
+    const cached = await readCache(PLAN_PAY_KEY, () => deps.cache.get(PLAN_PAY_KEY));
+    if (cached !== null)
+        return cached === "1";
+    let me;
+    try {
+        me = await createEngineClient(deps).me();
+    }
+    catch (err) {
+        deps.logger.error("payments.plan-unreadable", { detail: String(err) });
+        throw AppError.unavailable("The oracle's plan could not be read: no way to pay is offered");
+    }
+    const takesPay = me.accepts ? me.accepts.includes("upay") : me.ixoManaged !== false;
+    await deps.cache.put(PLAN_PAY_KEY, takesPay ? "1" : "0", { expirationTtl: PLAN_PAY_TTL_SEC });
+    return takesPay;
+}
+// --- the gate ---------------------------------------------------------------------------------------
+export function createPaymentGate(deps) {
+    const { config, cache, db, logger } = deps;
+    const requestId = deps.requestId ?? "unknown";
+    function body(code, message, price, paymentRequired) {
+        const base = consoleUrl(config);
+        return {
+            error: {
+                code,
+                message,
+                requestId,
+                docsUrl: `${base}/docs/errors#${code}`,
+                details: {
+                    ...(paymentRequired ? { paymentRequired } : {}),
+                    price,
+                    fundingUrl: `${base}/credits`,
+                },
+            },
+        };
+    }
+    /** A protocol with no published price is never offered: the facilitator would refuse the offer
+     *  (`price_mismatch` against "not published"), so it is the operator's config to fix. */
+    function priceOf(protocolDid) {
+        const price = publishedPrice(config, protocolDid);
+        if (!price)
+            throw AppError.unavailable(`No price is published for ${protocolDid}`);
+        return price;
+    }
+    /** Register one offer for `items` (already priced) and keep it; the 402 body. */
+    async function register(req, message) {
+        const { items } = req;
+        const total = totalOf(items);
+        const protocols = [...new Set(items.map((i) => i.protocolDid))];
+        const origin = `https://${config.ORACLE_HOSTNAME}`;
+        const network = config.X402_NETWORK;
+        if (!network)
+            throw AppError.unavailable("X402_NETWORK is not set: payments are off");
+        // A plan without PAY (card and/or USDC on Base): no ixo-pay terms, and no IXO payee needed.
+        // The facilitator adds the plan's card and `exact` entries itself; the 402 is its, verbatim.
+        const takesPay = await planTakesPay(deps);
+        // The operator names its own payee (payments spec §3.2); a PAY offer cannot be made without one.
+        const payTo = config.EARNINGS_ADDRESS;
+        if (takesPay && !payTo) {
+            throw AppError.unavailable("EARNINGS_ADDRESS is not set: PAY cannot be offered");
+        }
+        const fundingUrl = `${consoleUrl(config)}/credits`;
+        const offered = await createFacilitatorClient(deps).offers({
+            resource: {
+                // One claim ⇒ the submit URL with its claimId as fragment; a batch ⇒ the batch URL (D1, D32).
+                url: items.length === 1
+                    ? `${origin}/v1/api/claims#${items[0]?.claimId}`
+                    : `${origin}/v1/api/claims/batch`,
+                description: `${items.length === 1 ? "One decision" : `${items.length} decisions`}${protocols.length === 1 ? ` under protocol ${protocols[0]}` : ""}`,
+                mimeType: "application/json",
+            },
+            // `payTo`: the operator's own account (§3.2, §13.1); the facilitator checks it, never picks one.
+            ...(takesPay
+                ? {
+                    paymentRequirements: {
+                        scheme: "ixo-pay",
+                        network,
+                        asset: "upay",
+                        amount: total.amount,
+                        payTo,
+                        maxTimeoutSeconds: 120,
+                        extra: { fundingUrl },
+                    },
+                }
+                : {}),
+            charges: items.map((i) => ({
+                claimId: i.claimId,
+                sourceId: req.sourceId,
+                protocolDid: i.protocolDid,
+                amount: i.amount,
+            })),
+        });
+        const paymentRequired = offered.paymentRequired;
+        const stored = {
+            offerId: offered.offerId,
+            sourceId: req.sourceId,
+            keyPrefix: req.keyPrefix,
+            items,
+            expiresAt: offered.expiresAt,
+            paymentRequired,
+        };
+        await cache.put(offerKey(offered.offerId), JSON.stringify(stored), {
+            expirationTtl: OFFER_KEEP_SEC,
+        });
+        return body("PAYMENT_REQUIRED", message, total, paymentRequired);
+    }
+    /**
+     * A claim whose payment `/verify` already accepted (reserved, or a card authorized) but whose
+     * charge row never landed — a 5xx between the two — must not get a second offer: that would be a
+     * second reservation, or a second hold on a real card. The same offer's 402 is answered again, so
+     * resending the same PAYMENT-SIGNATURE is idempotent at the facilitator. Null: no claim verified.
+     */
+    async function verifiedOffer(req) {
+        const found = await Promise.all(req.items.map((i) => cache.get(verifiedClaimKey(i.claimId))));
+        const offerId = found.find((f) => f !== null);
+        if (!offerId)
+            return null;
+        const earlier = (await readKv(cache, paidKey(offerId))) ??
+            (await readKv(cache, offerKey(offerId)));
+        const sameClaims = !!earlier &&
+            found.every((f) => f === offerId) &&
+            earlier.items.length === req.items.length &&
+            req.items.every((i) => earlier.items.some((e) => e.claimId === i.claimId));
+        if (earlier?.paymentRequired &&
+            sameClaims &&
+            earlier.sourceId === req.sourceId &&
+            earlier.keyPrefix === req.keyPrefix) {
+            logger.warn("payments.offer.reanswered", { offerId, claims: earlier.items.length });
+            return body("PAYMENT_REQUIRED", "This payment was already accepted: resend the same request with the same PAYMENT-SIGNATURE (no new payment is needed).", totalOf(earlier.items), earlier.paymentRequired);
+        }
+        throw AppError.paymentRequired(`A payment for claim ${req.items[found.indexOf(offerId)]?.claimId} was already accepted under offer ${offerId}: resend that request with its PAYMENT-SIGNATURE, with the same claims.`, { reason: "payment_accepted", offerId });
+    }
+    async function offer(req, message) {
+        if (req.items.length === 0 || req.items.length > MAX_BATCH_CLAIMS) {
+            throw AppError.validation(`One payment covers 1 to ${MAX_BATCH_CLAIMS} claims; split the request.`);
+        }
+        const again = await verifiedOffer(req);
+        if (again)
+            return again;
+        const items = req.items.map(({ claimId, protocolDid }) => {
+            const price = priceOf(protocolDid);
+            return { claimId, protocolDid, amount: price.amount, amountCents: price.amountCents };
+        });
+        return register({ sourceId: req.sourceId, keyPrefix: req.keyPrefix, items }, message ??
+            "This decision has to be paid for first: pay the offer in the PAYMENT-REQUIRED header, then resend the same request with the payment in a PAYMENT-SIGNATURE header.");
+    }
+    /** `SPEND_CAP` / `INSUFFICIENT_CREDITS`: nothing an SDK may auto-pay, just the price and where to top up. */
+    function capRefusal(code, reason, price) {
+        // The facilitator's `spend_cap` covers both a used-up delegation cap and a deed send
+        // permission that is missing or too low (for about a minute after a purchase or top-up, the
+        // facilitator still caches "no grant"); its detail never reaches us, so its text names both.
+        // Only our own key cap is a "for today" cap.
+        const message = code === "INSUFFICIENT_CREDITS"
+            ? "There aren't enough PAY credits to pay for this decision. Top up in the console (details.fundingUrl) and retry."
+            : reason === "key_daily_cap"
+                ? "This source has reached its spending cap for today. Wait until tomorrow, or have its owner raise the cap in the console."
+                : "The payment couldn't be authorised: the spending permission is used up or not active yet. If you just bought or topped up credits, try again in a minute; otherwise top up or raise the limit in the console.";
+        return { ok: false, code, reason, paymentRequired: body(code, message, price) };
+    }
+    /**
+     * The refusal for `reason`: the two caps carry nothing payable; anything else is a fresh offer
+     * for the SAME claims at today's price — unless one of them already has a charge row. Such a
+     * claim is recorded and `recordApiClaims` would answer `exists` for it forever, so paying a new
+     * offer for it would reserve money for a claim that never starts on it: nothing payable then,
+     * and the client resubmits for new claimIds.
+     */
+    async function refuse(from, reason, code = codeFor(reason)) {
+        logger.info("payments.refused", { offerId: from.offerId, sourceId: from.sourceId, reason });
+        if (code !== "PAYMENT_REQUIRED")
+            return capRefusal(code, reason, totalOf(from.items));
+        const charged = await db
+            .select({ claimId: apiCharges.claimId })
+            .from(apiCharges)
+            .where(inArray(apiCharges.claimId, from.items.map((i) => i.claimId)))
+            .limit(1);
+        if (charged.length > 0) {
+            throw AppError.paymentRequired(`The payment for this claim was refused (${reason}). Resend the request without the PAYMENT-SIGNATURE header to get a new offer.`, { reason });
+        }
+        return {
+            ok: false,
+            code,
+            reason,
+            paymentRequired: await offer({ sourceId: from.sourceId, keyPrefix: from.keyPrefix, items: from.items }, `The payment was refused (${reason}). A new offer is in the PAYMENT-REQUIRED header: pay it and resend the request.`),
+        };
+    }
+    /** The key's cap over the last 24 h (§4.1 `SPEND_CAP`): every charge that may still move money
+     *  (`released` / `failed` moved nothing); this offer's own rows are not counted twice. */
+    async function overKeyCap(keyPrefix, offered) {
+        const key = await db.query.apiKeys.findFirst({
+            columns: { maxSpendCentsPerDay: true },
+            where: eq(apiKeys.prefix, keyPrefix),
+        });
+        const cap = key?.maxSpendCentsPerDay;
+        if (cap === null || cap === undefined)
+            return false;
+        const [row] = await db
+            .select({ spent: sql `coalesce(sum(${apiCharges.amountCents}), 0)` })
+            .from(apiCharges)
+            .where(and(eq(apiCharges.keyPrefix, keyPrefix), gt(apiCharges.createdAt, new Date(Date.now() - DAY_MS)), notInArray(apiCharges.status, ["released", "failed"]), or(isNull(apiCharges.offerId), ne(apiCharges.offerId, offered.offerId))));
+        return (row?.spent ?? 0) + totalOf(offered.items).amountCents > cap;
+    }
+    /** Go Prod §3.4, NOTES D34: only the source's owner or a member with a LIVE grant may pay for
+     *  it — a revoked or expired member's payment delegation stops paying the moment the grant does. */
+    async function mayPay(sourceId, payer) {
+        return (await liveGrant({ db, chain: deps }, sourceId, payer)) !== null;
+    }
+    /** Go Prod §3.4 / App. A's 403 `PAYER_NOT_MEMBER` (contracts v1.1): `AppError` has no such code,
+     *  so FORBIDDEN with the reason, which the `/v1/api` envelope maps to it; never a payable 402
+     *  (another offer would not change the payer). */
+    async function bindPayer(sourceId, payer, offerId) {
+        if (await mayPay(sourceId, payer))
+            return;
+        logger.warn("payments.payer-not-member", { sourceId, payer, offerId });
+        throw new AppError("The account paying for this claim is not the source's owner or one of its members. Pay from an account that belongs to this source.", { code: "FORBIDDEN", details: { reason: "payer_not_member" } });
+    }
+    /**
+     * Every check that can refuse a paid retry WITHOUT reserving anything (the seam's `preflight`):
+     * the offer the nonce names (this source's, this key's), the payer read locally from the
+     * delegation, the key's daily cap. The router runs it, makes its own checks against the offer's
+     * items, and only then calls `verify` — nothing may reserve and then refuse.
+     */
+    async function preflight(header, source) {
+        const { payload, nonce } = readSignature(header);
+        const offered = await readKv(cache, offerKey(nonce));
+        // Never ours, long gone, another source's or another key's (null = the console): there are no
+        // claims of THIS request to re-offer, so the router answers a plain 402 and the client asks
+        // again without the header.
+        if (!offered ||
+            offered.sourceId !== source.sourceId ||
+            offered.keyPrefix !== source.keyPrefix) {
+            throw AppError.paymentRequired("The PAYMENT-SIGNATURE header doesn't match any payment offer for this source (it may have expired). Resend the request without the PAYMENT-SIGNATURE header to get a new offer.", { reason: "nonce_unknown" });
+        }
+        // A leaked delegation must not even lock its owner's funds. Card has none: its payer is bound
+        // to verify's answer (the post-verify path below), as a delegation rooted only by link is.
+        const { delegation } = payload.payload;
+        const payer = typeof delegation === "string" ? await payerOf(delegation) : null;
+        if (payer !== null)
+            await bindPayer(source.sourceId, payer, nonce);
+        if (source.keyPrefix && (await overKeyCap(source.keyPrefix, offered))) {
+            return refuse(offered, "key_daily_cap", "SPEND_CAP");
+        }
+        return { ok: true, offerId: nonce, items: offered.items, payer, offer: offered };
+    }
+    return {
+        quote: async (_sourceId, protocolDid) => priceOf(protocolDid),
+        offer: (req) => offer(req),
+        preflight,
+        async verify(header, source) {
+            const checked = await preflight(header, source);
+            if (!checked.ok)
+                return checked;
+            const { payload, nonce } = readSignature(header);
+            const offered = checked.offer;
+            // Reserves the price of every claim, all or none; idempotent per offer, so the header re-sent
+            // (a keyless repeat, a crash before the rows landed) answers the stored `isValid: true`. A
+            // refusal reserved nothing, so a fresh offer is safe.
+            const verdict = await createFacilitatorClient(deps).verify(facilitatorBody(payload, nonce));
+            if (verdict.isValid !== true)
+                return refuse(offered, verdict.invalidReason);
+            // The facilitator verified the chain the binding read. A different payer means one of the two
+            // readings is wrong: terminal, never a payable re-offer (its reservation is never settled and
+            // lapses at 24 h). Without a local reading (a root only by link), bind the facilitator's.
+            // USDC (`exact`) is not bound to the source's members: its payer is an EVM account, not an
+            // IXO one a source can list, and its authorization is single-use, for this offer's amount to
+            // the oracle owner's payTo — no standing credential to leak. The source itself was
+            // authenticated (its key or console); verify must name the authorization's own signer.
+            const local = payload.accepted.scheme === "exact"
+                ? payload.payload.authorization.from.toLowerCase()
+                : checked.payer;
+            const named = payload.accepted.scheme === "exact" ? verdict.payer.toLowerCase() : verdict.payer;
+            if (local === null) {
+                await bindPayer(source.sourceId, verdict.payer, nonce);
+            }
+            else if (named !== local) {
+                logger.error("payments.payer-mismatch", {
+                    offerId: nonce,
+                    local,
+                    facilitator: verdict.payer,
+                });
+                throw new AppError("The account the payment names is not the account that signed it. Pay again with a payment delegation of your own.", { code: "FORBIDDEN", details: { reason: "payer_mismatch" } });
+            }
+            // Every `/settle` of these claims is built from this exact header (settle.ts): the router
+            // stores it on each claim's charge row; KV is the second copy. Sealed in both: it carries the
+            // payer's reusable payment delegation.
+            const paid = { ...offered, header: await sealHeader(config, header) };
+            await cache.put(paidKey(nonce), JSON.stringify(paid), { expirationTtl: PAID_KEEP_SEC });
+            await Promise.all(offered.items.map((i) => cache.put(verifiedClaimKey(i.claimId), nonce, { expirationTtl: PAID_KEEP_SEC })));
+            logger.info("payments.reserved", { offerId: nonce, claims: offered.items.length });
+            return { ok: true, payer: verdict.payer, offerId: nonce, items: offered.items };
+        },
+        settle: (claimId, receiptJws) => settleClaim(deps, claimId, receiptJws),
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/lib/payments/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/lib/payments/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,UAAU,GAOX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAwB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAwBvC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B;uDACuD;AACvD,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AACjC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,cAAc,OAAO,EAAE,CAAC;AAC9D,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,aAAa,OAAO,EAAE,CAAC;AAC5D,qGAAqG;AACrG,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,uBAAuB,OAAO,EAAE,CAAC;AAE/E,qGAAqG;AAErG,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,CAAC,CAAC,WAAW,CAAC;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC;YACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;YAC1C,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SAC5C,CAAC;QACF,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;IACF,CAAC,CAAC,WAAW,CAAC;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC;YACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC1B,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SAC5C,CAAC;QACF,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC;YACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SACnD,CAAC;KACH,CAAC;IACF,CAAC,CAAC,WAAW,CAAC;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,iBAAiB,GACrB,yRAAyR,CAAC;AAE5R,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,gFAAgF;IAChF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAClE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CAAC,UAAkB;IACvC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,SAAsE,CAAC;IAC3E,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,OAAO,CAC/C,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAClD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,SAAS,CAAC,KAAK;QAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAoC,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC;IAClF,WAAW,EAAE,CAAC;IACd,OAAO;IACP,mBAAmB,EAAE,OAAO,CAAC,QAAQ;IACrC,cAAc,EAAE,OAAO;CACxB,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CAC5D,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAE1D;wFACwF;AACxF,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,OAAe,EAAE,UAAkB;IAC7F,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,MAAM,CAAI,KAAkB,EAAE,GAAW;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAE,OAAe,EAAE,EAAE,CACnE,MAAM,CAAY,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7C,MAAM,OAAO,GAAG,CAAC,MAAc,EAA0B,EAAE,CACzD,MAAM,KAAK,WAAW;IACpB,CAAC,CAAC,WAAW;IACb,CAAC,CAAC,MAAM,KAAK,sBAAsB;QACjC,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,kBAAkB,CAAC;AAE3B,SAAS,UAAU,CAAC,MAAmC;IACrD,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,kFAAkF;AAClF,SAAS,OAAO,CAAC,KAA8D;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO;QACL,wEAAwE;QACxE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC;QAC5B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7D,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM;KACd,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,IAAqB;IAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,KAAK,GAAG,CAAC;IAC3C,IAAI,EAAY,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,QAAQ,CAAC,WAAW,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC;IACpF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9F,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uGAAuG;AAEvG,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IAE9C,SAAS,IAAI,CACX,IAA4B,EAC5B,OAAe,EACf,KAAY,EACZ,eAA4E;QAE5E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO;YACL,KAAK,EAAE;gBACL,IAAI;gBACJ,OAAO;gBACP,SAAS;gBACT,OAAO,EAAE,GAAG,IAAI,gBAAgB,IAAI,EAAE;gBACtC,OAAO,EAAE;oBACP,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,KAAK;oBACL,UAAU,EAAE,GAAG,IAAI,UAAU;iBAC9B;aACF;SACF,CAAC;IACJ,CAAC;IAED;6FACyF;IACzF,SAAS,OAAO,CAAC,WAAmB;QAClC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iFAAiF;IACjF,KAAK,UAAU,QAAQ,CACrB,GAA0D,EAC1D,OAAe;QAEf,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,eAAe,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACtF,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,iGAAiG;QACjG,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACtC,IAAI,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC,WAAW,CAAC,oDAAoD,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACzD,QAAQ,EAAE;gBACR,8FAA8F;gBAC9F,GAAG,EACD,KAAK,CAAC,MAAM,KAAK,CAAC;oBAChB,CAAC,CAAC,GAAG,MAAM,kBAAkB,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE;oBAChD,CAAC,CAAC,GAAG,MAAM,sBAAsB;gBACrC,WAAW,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,YAAY,GAC/E,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAC/D,EAAE;gBACF,QAAQ,EAAE,kBAAkB;aAC7B;YACD,iGAAiG;YACjG,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC;oBACE,mBAAmB,EAAE;wBACnB,MAAM,EAAE,SAAS;wBACjB,OAAO;wBACP,KAAK,EAAE,MAAM;wBACb,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,KAAK;wBACL,iBAAiB,EAAE,GAAG;wBACtB,KAAK,EAAE,EAAE,UAAU,EAAE;qBACtB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,MAAM,eAAe,GACnB,OAAO,CAAC,eAA6E,CAAC;QACxF,MAAM,MAAM,GAAgB;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe;SAChB,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YACjE,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa,CAAC,GAAmB;QAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GACX,CAAC,MAAM,MAAM,CAAc,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC,MAAM,MAAM,CAAc,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GACd,CAAC,CAAC,OAAO;YACT,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM;YACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,IACE,OAAO,EAAE,eAAe;YACxB,UAAU;YACV,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YACjC,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EACnC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CACT,kBAAkB,EAClB,wHAAwH,EACxH,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EACtB,OAAO,CAAC,eAAe,CACxB,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,CAAC,eAAe,CAC5B,uBAAuB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,qCAAqC,OAAO,yEAAyE,EACtL,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,CACxC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,GAAmB,EAAE,OAAgB;QACxD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClE,MAAM,QAAQ,CAAC,UAAU,CACvB,2BAA2B,gBAAgB,6BAA6B,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE;YACvD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CACb,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,EAC3D,OAAO;YACL,oKAAoK,CACvK,CAAC;IACJ,CAAC;IAED,6GAA6G;IAC7G,SAAS,UAAU,CACjB,IAA0C,EAC1C,MAAc,EACd,KAAY;QAEZ,qFAAqF;QACrF,4FAA4F;QAC5F,6FAA6F;QAC7F,6CAA6C;QAC7C,MAAM,OAAO,GACX,IAAI,KAAK,sBAAsB;YAC7B,CAAC,CAAC,iHAAiH;YACnH,CAAC,CAAC,MAAM,KAAK,eAAe;gBAC1B,CAAC,CAAC,0HAA0H;gBAC5H,CAAC,CAAC,+MAA+M,CAAC;QACxN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;IAClF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,MAAM,CACnB,IAAiB,EACjB,MAAc,EACd,IAAI,GAA2B,OAAO,CAAC,MAAM,CAAC;QAE9C,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,KAAK,kBAAkB;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;aACvC,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CACJ,OAAO,CACL,UAAU,CAAC,OAAO,EAClB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACjC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC,eAAe,CAC5B,2CAA2C,MAAM,gFAAgF,EACjI,EAAE,MAAM,EAAE,CACX,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,MAAM;YACN,eAAe,EAAE,MAAM,KAAK,CAC1B,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACzE,4BAA4B,MAAM,kFAAkF,CACrH;SACF,CAAC;IACJ,CAAC;IAED;8FAC0F;IAC1F,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,OAAoB;QAC/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,OAAO,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;YACtC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,EAAE,mBAAmB,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,gBAAgB,UAAU,CAAC,WAAW,OAAO,EAAE,CAAC;aAC3E,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EACnC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,EACvD,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EACrD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CACxE,CACF,CAAC;QACJ,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;IACtE,CAAC;IAED;wGACoG;IACpG,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,KAAa;QACnD,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;IAC1E,CAAC;IAED;;sDAEkD;IAClD,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe;QACvE,IAAI,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO;QAC1C,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,QAAQ,CAChB,qIAAqI,EACrI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,SAAS,CACtB,MAAc,EACd,MAAsD;QAKtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAc,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,8FAA8F;QAC9F,4FAA4F;QAC5F,4BAA4B;QAC5B,IACE,CAAC,OAAO;YACR,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YACpC,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACtC,CAAC;YACD,MAAM,QAAQ,CAAC,eAAe,CAC5B,iLAAiL,EACjL,EAAE,MAAM,EAAE,eAAe,EAAE,CAC5B,CAAC;QACJ,CAAC;QACD,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACnF,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;QAE7D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;QAE1B,SAAS;QAET,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM;YACzB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;YAE9B,8FAA8F;YAC9F,2FAA2F;YAC3F,sDAAsD;YACtD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5F,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC5E,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,2FAA2F;YAC3F,6FAA6F;YAC7F,mFAAmF;YACnF,uFAAuF;YACvF,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;gBACjC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAC,aAAkC,CAAC,IAAI,CAAC,WAAW,EAAE;gBACxE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACpF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;oBACtC,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,WAAW,EAAE,OAAO,CAAC,KAAK;iBAC3B,CAAC,CAAC;gBACH,MAAM,IAAI,QAAQ,CAChB,mHAAmH,EACnH,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAC7D,CAAC;YACJ,CAAC;YAED,0FAA0F;YAC1F,8FAA8F;YAC9F,uCAAuC;YACvC,MAAM,IAAI,GAAc,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACjF,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;YACxF,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAChF,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/lib/payments/header-seal.d.ts

@@ -0,0 +1,33 @@
+/**
+ * A verified `PAYMENT-SIGNATURE` at rest (owner, 2026-10-14). The header embeds the payer's payment
+ * delegation — a REUSABLE bearer credential up to its `maxAmount` — and every `/settle` of the claim
+ * is rebuilt from it byte for byte (settle.ts), so it must be recoverable: sealed with
+ * `WEBHOOK_ENCRYPTION_KEY` (`v1:` AES-256-GCM, api-lane/webhook-crypto.ts), on `api_charges` and in
+ * the KV `x402-paid:` copy alike, never in the clear.
+ *
+ * Rows written before this rule hold the base64 header itself: `openHeader` reads either (a base64
+ * header never contains `:`), and `sealLegacyHeaders` — the housekeeping hour's — seals them in
+ * place, a page at a time, until none is left. The KV copies expire within a week on their own.
+ *
+ * What a charge was paid in (`chargeTerms`) is read off the header's `accepted.scheme`, so the
+ * scheme is kept beside it in the clear (`api_charges.scheme`) — nothing secret, and no decrypt on
+ * a claim read.
+ */
+import type { Config } from "../../config.js";
+import type { Database } from "../../db/client.js";
+export type ChargeScheme = "ixo-pay" | "stripe-manual-capture" | "exact";
+type KeyConfig = Pick<Config, "WEBHOOK_ENCRYPTION_KEY">;
+export declare const sealHeader: (config: KeyConfig, header: string) => Promise<string>;
+/** The header as the payer sent it, from a sealed value or a row written before sealing. */
+export declare const openHeader: (config: KeyConfig, stored: string) => Promise<string>;
+/** The scheme a header pays with; PAY when it names none or one we do not know (the only way to
+ *  pay before card). */
+export declare function schemeOf(header: string): ChargeScheme;
+/**
+ * Seal the charge rows still holding a header in the clear (written before 2026-10-14), and fill
+ * their `scheme`. Guarded on the very value read, so a row a settle rewrote meanwhile is left to
+ * the next run. Returns how many it sealed.
+ */
+export declare function sealLegacyHeaders(db: Database, config: KeyConfig): Promise<number>;
+export {};
+//# sourceMappingURL=header-seal.d.ts.map

package/dist/lib/payments/header-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-seal.d.ts","sourceRoot":"","sources":["../../../src/lib/payments/header-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAKhD,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,uBAAuB,GAAG,OAAO,CAAC;AAEzE,KAAK,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AASxD,eAAO,MAAM,UAAU,WAAY,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAC5C,CAAC;AAElC,4FAA4F;AAC5F,eAAO,MAAM,UAAU,WAAY,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CACC,CAAC;AAE/E;wBACwB;AACxB,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAYrD;AAKD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BxF"}

package/dist/lib/payments/header-seal.js

@@ -0,0 +1,76 @@
+/**
+ * A verified `PAYMENT-SIGNATURE` at rest (owner, 2026-10-14). The header embeds the payer's payment
+ * delegation — a REUSABLE bearer credential up to its `maxAmount` — and every `/settle` of the claim
+ * is rebuilt from it byte for byte (settle.ts), so it must be recoverable: sealed with
+ * `WEBHOOK_ENCRYPTION_KEY` (`v1:` AES-256-GCM, api-lane/webhook-crypto.ts), on `api_charges` and in
+ * the KV `x402-paid:` copy alike, never in the clear.
+ *
+ * Rows written before this rule hold the base64 header itself: `openHeader` reads either (a base64
+ * header never contains `:`), and `sealLegacyHeaders` — the housekeeping hour's — seals them in
+ * place, a page at a time, until none is left. The KV copies expire within a week on their own.
+ *
+ * What a charge was paid in (`chargeTerms`) is read off the header's `accepted.scheme`, so the
+ * scheme is kept beside it in the clear (`api_charges.scheme`) — nothing secret, and no decrypt on
+ * a claim read.
+ */
+import { and, eq, isNotNull, isNull, notLike, or } from "drizzle-orm";
+import { apiCharges } from "../../db/schema.js";
+import { isSealed, openText, sealText } from "../api-lane/webhook-crypto.js";
+import { AppError } from "../errors.js";
+function keyOf(config) {
+    // Required whenever API_LANE is on (config.ts), and nothing stores a header without the lane.
+    const key = config.WEBHOOK_ENCRYPTION_KEY;
+    if (!key)
+        throw AppError.internal("WEBHOOK_ENCRYPTION_KEY is not set: a payment is never kept");
+    return key;
+}
+export const sealHeader = (config, header) => sealText(header, keyOf(config));
+/** The header as the payer sent it, from a sealed value or a row written before sealing. */
+export const openHeader = (config, stored) => isSealed(stored) ? openText(stored, keyOf(config)) : Promise.resolve(stored);
+/** The scheme a header pays with; PAY when it names none or one we do not know (the only way to
+ *  pay before card). */
+export function schemeOf(header) {
+    let signed;
+    try {
+        // gate.ts `decodeHeader`, inlined: the gate seals with this module, so it cannot import back.
+        signed = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(header.trim()), (c) => c.charCodeAt(0))));
+    }
+    catch {
+        signed = undefined;
+    }
+    const scheme = signed?.accepted?.scheme;
+    return scheme === "stripe-manual-capture" || scheme === "exact" ? scheme : "ixo-pay";
+}
+/** Legacy rows sealed per housekeeping run — the hour's sweep stays short whatever is left. */
+const SEAL_BATCH = 200;
+/**
+ * Seal the charge rows still holding a header in the clear (written before 2026-10-14), and fill
+ * their `scheme`. Guarded on the very value read, so a row a settle rewrote meanwhile is left to
+ * the next run. Returns how many it sealed.
+ */
+export async function sealLegacyHeaders(db, config) {
+    if (!config.WEBHOOK_ENCRYPTION_KEY)
+        return 0;
+    const rows = await db
+        .select({ claimId: apiCharges.claimId, paymentHeader: apiCharges.paymentHeader })
+        .from(apiCharges)
+        .where(and(isNotNull(apiCharges.paymentHeader), or(notLike(apiCharges.paymentHeader, "v1:%"), isNull(apiCharges.scheme))))
+        .limit(SEAL_BATCH);
+    let sealed = 0;
+    for (const row of rows) {
+        const stored = row.paymentHeader;
+        const header = await openHeader(config, stored);
+        const [done] = await db
+            .update(apiCharges)
+            .set({
+            paymentHeader: isSealed(stored) ? stored : await sealHeader(config, header),
+            scheme: schemeOf(header),
+        })
+            .where(and(eq(apiCharges.claimId, row.claimId), eq(apiCharges.paymentHeader, stored)))
+            .returning({ claimId: apiCharges.claimId });
+        if (done)
+            sealed += 1;
+    }
+    return sealed;
+}
+//# sourceMappingURL=header-seal.js.map

package/dist/lib/payments/header-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-seal.js","sourceRoot":"","sources":["../../../src/lib/payments/header-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAMrC,SAAS,KAAK,CAAC,MAAiB;IAC9B,8FAA8F;IAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,4DAA4D,CAAC,CAAC;IAChG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAiB,EAAE,MAAc,EAAmB,EAAE,CAC/E,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAElC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAiB,EAAE,MAAc,EAAmB,EAAE,CAC/E,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAE/E;wBACwB;AACxB,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,8FAA8F;QAC9F,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CACvF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;IACxC,OAAO,MAAM,KAAK,uBAAuB,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,MAAiB;IACrE,IAAI,CAAC,MAAM,CAAC,sBAAsB;QAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC;SAChF,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EACnC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzE,CACF;SACA,KAAK,CAAC,UAAU,CAAC,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,aAAuB,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;YAC3E,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;SACzB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;aACrF,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}