@lunora/x402 1.0.0-alpha.9 → 1.0.0-alpha.90

package/dist/packem_shared/{config.d-B-NYmHgG.d.mts → index.d-A-g7yKuO.d.ts}

@@ -1,14 +1,72 @@
-import { ClientEvmSigner } from '@x402/evm';
-import { ClientSvmSigner } from '@x402/svm';
-import { ProcessSettleSuccessResponse } from '@x402/core/http';
-import { BeforePaymentCreationHook, PaymentPolicy, OnPaymentCreationFailureHook } from '@x402/core/client';
 import { PaymentRequirements } from '@x402/core/types';
+import { TransactionSigner } from '@solana/accounts';
+/**
+ * ClientEvmSigner - Used by x402 clients to sign payment authorizations.
+ *
+ * Typically a viem LocalAccount:
+ * ```typescript
+ * const account = privateKeyToAccount('0x...');
+ * ```
+ *
+ * Or composed via `toClientEvmSigner(account, publicClient)`.
+ */
+type ClientEvmSigner = {
+  readonly address: `0x${string}`;
+  signTypedData(message: {
+    domain: Record<string, unknown>;
+    types: Record<string, unknown>;
+    primaryType: string;
+    message: Record<string, unknown>;
+  }): Promise<`0x${string}`>;
+  /**
+   * Optional on-chain reads.
+   * Required only for extension enrichment (EIP-2612 / ERC-20 approval).
+   */
+  readContract?(args: {
+    address: `0x${string}`;
+    abi: readonly unknown[];
+    functionName: string;
+    args?: readonly unknown[];
+  }): Promise<unknown>;
+  /**
+   * Optional: Signs a raw EIP-1559 transaction without broadcasting.
+   * Required for ERC-20 approval gas sponsoring when the token lacks EIP-2612.
+   */
+  signTransaction?(args: {
+    to: `0x${string}`;
+    data: `0x${string}`;
+    nonce: number;
+    gas: bigint;
+    maxFeePerGas: bigint;
+    maxPriorityFeePerGas: bigint;
+    chainId: number;
+  }): Promise<`0x${string}`>;
+  /**
+   * Optional: Gets the current transaction count (nonce) for an address.
+   * Required for ERC-20 approval gas sponsoring.
+   */
+  getTransactionCount?(args: {
+    address: `0x${string}`;
+  }): Promise<number>;
+  /**
+   * Optional: Estimates current gas fees per gas.
+   * Required for ERC-20 approval gas sponsoring.
+   */
+  estimateFeesPerGas?(): Promise<{
+    maxFeePerGas: bigint;
+    maxPriorityFeePerGas: bigint;
+  }>;
+};
+/**
+ * Client-side signer for creating and signing Solana transactions
+ * This is a wrapper around TransactionSigner from @solana/kit
+ */
+type ClientSvmSigner = TransactionSigner;
 /**
  * A normalised record of one settled x402 payment. The settled `amount` is kept
  * as its exact on-chain atomic-unit string (USDC has 6 decimals) — never coerced
  * to a fractional-dollar number — so no precision is lost crossing the reporting
  * seam.
- * @experimental
  */
 interface X402Receipt {
   /** Settled amount in the asset's atomic base units (USDC: 6 decimals), as an exact string. */
@@ -34,26 +92,12 @@ interface X402Receipt {
  * settlement, does not block the paid response on it, and swallows any error it
  * throws — so a sink must never rely on being awaited or on its failures
  * surfacing.
- * @experimental
  */
 type X402ReceiptSink = (receipt: X402Receipt) => Promise<void> | void;
-/**
- * Normalise a successful facilitator settlement into an {@link X402Receipt}.
- * `resource` (the gated URL or procedure id) and `ts` are supplied by the caller —
- * the settlement result carries neither. Prefers the actual settled `amount`
- * (present for `upto`-scheme partial settlements) and falls back to the route's
- * required amount for `exact`.
- * @experimental
- */
-declare const toReceipt: (settlement: ProcessSettleSuccessResponse, context: {
-  readonly resource: string;
-  readonly ts: number;
-}) => X402Receipt;
 /**
  * A row for `@lunora/payment`'s durable `events` table. Deliberately a plain
  * structural type — building one imports nothing from `@lunora/payment`, so the
  * rails stay decoupled.
- * @experimental
  */
 interface PaymentEventRow {
   /** Epoch milliseconds the settlement was recorded. */
@@ -81,47 +125,25 @@ interface PaymentEventRow {
  * table (`packages/payment/src/schema.ts`). Amount / from / to / resource are
  * intentionally not on this row — that card renders none of them; read them off
  * the {@link X402Receipt} (e.g. into your own revenue table) if you need them.
- * @experimental
  */
 declare const toPaymentEventRow: (receipt: X402Receipt) => PaymentEventRow;
-/**
- * Network identity for `@lunora/x402`.
- *
- * `@x402/core` v2 speaks **CAIP-2** chain ids (`eip155:8453` for Base,
- * `solana:5eyk…` for Solana mainnet) — `type Network = ` `${string}:${string}` ``.
- * Lunora keeps ergonomic **friendly** names (`"base"`, `"base-sepolia"`) as the
- * public surface and maps them to CAIP-2 here, at the single seam where we hand a
- * network to the SDK. A raw CAIP-2 string is also accepted as a power-user escape
- * hatch (e.g. a chain we don't yet have a friendly alias for).
- *
- * The friendly set is intentionally scoped to chains `@x402/evm` / `@x402/svm`
- * can settle the ergonomic `price:"$0.01"` path on out of the box (i.e. chains in
- * their `DEFAULT_STABLECOINS` registry). Notably that excludes Optimism and
- * Avalanche today — advertising them would 500 at settlement — so they are not
- * friendly aliases; a caller who needs them can still pass a raw CAIP-2 id with an
- * explicit asset.
- */
 /**
  * A CAIP-2 chain identifier, e.g. `"eip155:8453"` (Base) or `"solana:5eyk…"`.
- * @experimental
  */
 type Caip2 = `${string}:${string}`;
 /**
  * Friendly network names Lunora maps to CAIP-2 for `@x402/core`.
- * @experimental
  */
 type FriendlyNetwork = "arbitrum" | "arbitrum-sepolia" | "base" | "base-sepolia" | "ethereum" | "polygon" | "solana" | "solana-devnet";
 /**
  * A network Lunora can settle on: a {@link FriendlyNetwork} alias (mapped to
  * CAIP-2 internally) or a raw {@link Caip2} id for chains without a friendly name.
- * @experimental
  */
 type X402Network = Caip2 | FriendlyNetwork;
 /**
  * Friendly name → CAIP-2 id. Values verified against `@x402/evm` and `@x402/svm`
  * `DEFAULT_STABLECOINS` at 2.17.0. `base` / `base-sepolia` are the primary
  * prod / test pair.
- * @experimental
  */
 declare const NETWORK_TO_CAIP2: {
   readonly arbitrum: "eip155:42161";
@@ -135,55 +157,100 @@ declare const NETWORK_TO_CAIP2: {
 };
 /**
  * EVM friendly networks (signed via `@x402/evm` + viem).
- * @experimental
  */
 declare const EVM_NETWORKS: readonly ["arbitrum", "arbitrum-sepolia", "base", "base-sepolia", "ethereum", "polygon"];
 /**
  * Solana friendly networks (signed via `@x402/svm`).
- * @experimental
  */
 declare const SVM_NETWORKS: readonly ["solana", "solana-devnet"];
 /**
  * Resolve a network to its CAIP-2 id. Friendly aliases are looked up; a value
  * that already looks like CAIP-2 (`namespace:reference`) passes through.
- * @experimental
  */
 declare const toCaip2: (network: X402Network) => Caip2;
 /**
  * True when `network` settles on an EVM chain (viem signer path).
- * @experimental
  */
 declare const isEvmNetwork: (network: X402Network) => boolean;
 /**
  * True when `network` settles on Solana (`@x402/svm` signer path).
- * @experimental
  */
 declare const isSvmNetwork: (network: X402Network) => boolean;
 /**
- * USDC — and every asset in `@x402/evm` / `@x402/svm`'s `DEFAULT_STABLECOINS` —
- * uses 6 decimals, so a USD price converts to atomic base units at `10 ** 6`.
- * Override per {@link SpendPolicy.decimals} only for a custom, non-6-decimal asset.
- * @experimental
+ * USDC uses 6 decimals, so a USD price converts to atomic base units at `10 ** 6`.
+ * This is only the *default* for the standalone {@link usdToAtomic} helper —
+ * a spend policy never assumes it, and scales each requirement by the decimals of
+ * the asset it actually names (see {@link SpendPolicy.allowedAssets}).
  */
 declare const DEFAULT_STABLECOIN_DECIMALS = 6;
+/**
+ * A stablecoin an agent wallet may pay in, and the decimals its atomic amounts are
+ * denominated in.
+ *
+ * `decimals` is required and explicit: a 402 server names the token contract to
+ * transfer, and the same atomic amount means a wildly different sum in a 6-decimal
+ * versus an 18-decimal token. Assuming a decimal count is how a tiny USD cap comes
+ * to authorise a large transfer, so the caller states it per asset. Note
+ * `@x402/evm`'s own `DEFAULT_STABLECOINS` registry is *not* uniformly 6-decimal
+ * (MegaUSD and Mezo USD are 18), which is exactly why it can't be trusted as a gate.
+ */
+interface AllowedAsset {
+  /** Token contract (EVM) or mint (SVM) address. Matched case-insensitively on EVM, exactly on SVM. */
+  readonly asset: string;
+  /** Atomic base-unit decimals for this asset. Used to scale the USD caps — must match the token on chain. */
+  readonly decimals: number;
+  /** The network this asset lives on. Friendly names are resolved to CAIP-2. */
+  readonly network: X402Network;
+}
+/**
+ * The assets a policy allows when it doesn't name its own — the canonical
+ * 6-decimal, dollar-pegged USDC on each network Lunora has a friendly alias for.
+ *
+ * Deliberately a small hand-mirrored table rather than `@x402/evm`'s
+ * `DEFAULT_STABLECOINS`: that registry mixes 6- and 18-decimal assets, and importing
+ * it would pull viem into every bundle that touches a policy (the scheme modules are
+ * dynamically imported for exactly that reason — see `wallet.ts`). Addresses verified
+ * against `@x402/evm` `DEFAULT_STABLECOINS` and `@x402/svm` `USDC_*_ADDRESS` at 2.19.0.
+ *
+ * `ethereum` (`eip155:1`) is absent — the SDK ships no default stablecoin for it, so
+ * paying there needs an explicit {@link SpendPolicy.allowedAssets} entry.
+ */
+declare const DEFAULT_ALLOWED_ASSETS: ReadonlyArray<AllowedAsset>;
 /**
  * Spend limits and approval gates for an agent wallet. At least one bound must be
  * set — see {@link assertBoundedPolicy} — or the pay rail refuses to build.
  *
  * Caps are denominated in USD (the stablecoin's dollar value); addresses and
  * networks are matched against the requirement the server offers.
- * @experimental
  */
 interface SpendPolicy {
+  /**
+   * Asset allowlist, each entry carrying its own `decimals` (defaults to
+   * {@link DEFAULT_ALLOWED_ASSETS} — canonical USDC per friendly network).
+   *
+   * This is a **security gate, not a convenience**: the server picks which token
+   * contract gets transferred, so a policy that only caps a USD amount caps nothing
+   * until the asset behind that amount is pinned. A requirement naming an asset
+   * outside this list is refused, and the USD caps are scaled by the matched entry's
+   * `decimals` — never by an assumed decimal count.
+   *
+   * Every entry must be dollar-pegged: the caps are USD, and the per-run ledger sums
+   * atomic units across payments, so a non-$1 asset silently mis-prices both.
+   */
+  readonly allowedAssets?: ReadonlyArray<AllowedAsset>;
   /** Network allowlist. When set, only these networks may be paid on. */
   readonly allowedNetworks?: ReadonlyArray<X402Network>;
   /** Recipient allowlist. When set, only these `payTo` addresses may be paid. */
   readonly allowedRecipients?: ReadonlyArray<string>;
-  /** Stablecoin decimals for USD→atomic conversion (default {@link DEFAULT_STABLECOIN_DECIMALS}). */
-  readonly decimals?: number;
   /** Hard ceiling on a single payment, in USD. */
   readonly maxPerCall?: X402Price;
-  /** Hard ceiling on cumulative spend across this wallet's lifetime, in USD. */
+  /**
+   * Hard ceiling on cumulative spend by one pay rail, in USD. The ledger lives
+   * in memory on the rail, so the cap covers one `createX402Pay` result, and for
+   * `ctx.x402` one function invocation (codegen builds a rail per ctx). It is not
+   * a budget across invocations: for that, keep a counter in durable state (a
+   * Durable Object, a table) and check it in `onPaymentRequired`.
+   */
   readonly maxPerRun?: X402Price;
   /**
    * Approval gate. Called with the selected requirement before signing; return
@@ -192,87 +259,20 @@ interface SpendPolicy {
    */
   readonly onPaymentRequired?: (requirement: PaymentRequirements) => Promise<boolean> | boolean;
 }
-/**
- * A running spend ledger the per-run cap is measured (and reserved) against.
- * @experimental
- */
-interface SpendState {
-  /** Reserve a payment (atomic base units) against the running total, before it is signed. */
-  readonly add: (amount: bigint) => void;
-  /** Release a previously reserved amount (atomic base units) — e.g. a declined or failed payment. Clamps at 0. */
-  readonly release: (amount: bigint) => void;
-  /** Cumulative spend so far, in atomic base units. */
-  readonly spentAtomic: bigint;
-}
-/**
- * A fresh spend ledger. One per wallet instance; the guard reserves into it and
- * releases from it.
- * @experimental
- */
-declare const createSpendState: () => SpendState;
 /**
  * Convert a USD amount (`0.01`, `"0.01"`, or the `"$0.01"` shorthand) to atomic
  * stablecoin base units, exactly — parsed digit-by-digit so no binary-float drift
  * can round a cap the wrong way. Throws on a malformed amount (including
  * exponential notation like `"1e-7"`, which a decimal string never needs).
- * @experimental
  */
 declare const usdToAtomic: (usd: X402Price, decimals?: number) => bigint;
-/**
- * A `PaymentPolicy` that narrows the server's offered requirements to those a
- * bounded wallet may pay: within the per-call cap, to an allowed recipient, on an
- * allowed network. An empty result means the client cannot pay — fail-closed.
- * @experimental
- */
-declare const buildSpendPolicy: (policy: SpendPolicy) => PaymentPolicy;
-/**
- * A `BeforePaymentCreationHook` enforcing the stateful bounds the stateless
- * {@link buildSpendPolicy} filter can't: the cumulative per-run cap and the async
- * confirmation gate. Aborts (no signature) when either would be violated.
- *
- * The per-run cap is *reserved* into `state` as soon as the check passes — before
- * the `await policy.onPaymentRequired` below, and before `@x402/core` ever attempts
- * to sign — not recorded afterwards. This closes a check-then-act race: without an
- * atomic reserve, N concurrent payments could each read the same `spentAtomic`,
- * all pass the cap check, and all record, overspending the cap by up to
- * (N−1)×maxPerCall. A declined confirmation releases the reservation before this
- * hook returns; {@link releaseSpendOnFailure} releases it if the signature itself
- * later fails. The reservation is intentionally *not* released on success — a
- * committed payment stays counted.
- * @experimental
- */
-declare const buildPaymentGuard: (policy: SpendPolicy, state: SpendState) => BeforePaymentCreationHook;
-/**
- * An `OnPaymentCreationFailureHook` that releases a reservation
- * {@link buildPaymentGuard} made when the scheme's signature creation itself
- * throws (network error, wallet error, …) after the guard already approved and
- * reserved the amount. Without this, a failed signature would permanently
- * over-count against the per-run cap for the rest of the run — fail-closed, but
- * needlessly so when the client (`wrapFetchWithPayment`) may retry.
- * @experimental
- */
-declare const releaseSpendOnFailure: (state: SpendState) => OnPaymentCreationFailureHook;
-/**
- * Guard at wallet-build time: refuse a policy with no bound whatsoever. Signing
- * money on an agent's behalf with unlimited spend authority is never the intent,
- * so this fails loudly rather than defaulting to unbounded.
- *
- * `allowedNetworks` / `allowedRecipients` narrow *where* a payment can go, but
- * neither caps *how much* — a policy with only an allowlist still authorises
- * unlimited spend to any recipient it permits. Only `maxPerCall`, `maxPerRun`, or
- * a dynamic `onPaymentRequired` gate actually bound spend, so only those count here.
- * @experimental
- */
-declare const assertBoundedPolicy: (policy: SpendPolicy) => void;
 /**
  * The public, Coinbase-operated facilitator (verify + settle). It needs no API
  * key. Override with a self-hosted or CDP facilitator via {@link FacilitatorConfig}.
- * @experimental
  */
 declare const DEFAULT_FACILITATOR_URL = "https://x402.org/facilitator";
 /**
  * How to reach a facilitator's `/verify` + `/settle` endpoints.
- * @experimental
  */
 interface FacilitatorConfig {
   /** Extra headers for a private facilitator (e.g. a CDP bearer token). */
@@ -286,17 +286,14 @@ interface FacilitatorConfig {
  * to the network's stablecoin base units (USDC has 6 decimals) at challenge
  * time. (Kept `number | string` rather than a `` `$${string}` `` template
  * member — the template is subsumed by `string`, so it only adds noise.)
- * @experimental
  */
 type X402Price = number | string;
 /**
  * An EVM recipient address (the merchant wallet that receives settlement).
- * @experimental
  */
 type EvmAddress = `0x${string}`;
 /**
  * Recipient wallet the facilitator settles payments to, per network family.
- * @experimental
  */
 interface X402Recipient {
   /** EVM payout address (required for EVM networks). */
@@ -307,7 +304,6 @@ interface X402Recipient {
 /**
  * Server-side (charge rail) config. The server needs only a **recipient
  * address** — no private key — because the facilitator performs settlement.
- * @experimental
  */
 interface X402ChargeConfig {
   readonly facilitator?: FacilitatorConfig;
@@ -329,7 +325,6 @@ interface X402ChargeConfig {
  * Client-side (pay rail) config. The signer holds spending authority, so the
  * pay rail is ActionCtx-only and MUST be paired with a spend `policy` — the pay
  * rail refuses to build if the policy is unbounded.
- * @experimental
  */
 interface X402PayConfig {
   /** Network to transact on. Determines the signer family (EVM vs SVM). */
@@ -349,7 +344,6 @@ interface X402PayConfig {
  * custody is `@coinbase/cdp-sdk`.) EVM only today; for CDP on Solana, build a
  * `@solana/kit` signer around your CDP account and pass it via the `"signer"`
  * escape hatch.
- * @experimental
  */
 interface X402CdpSignerConfig {
   /** CDP account name to get-or-create and sign with. */
@@ -381,7 +375,6 @@ interface X402CdpSignerConfig {
  * Wired today: raw-key (EVM + SVM), the user-supplied signer (both families),
  * and CDP-managed EVM custody. CDP on Solana is not yet wired — use the escape
  * hatch.
- * @experimental
  */
 type X402SignerConfig = X402CdpSignerConfig | {
   /** Name of the `ctx.secrets` entry holding the private key. */
@@ -398,7 +391,6 @@ type X402SignerConfig = X402CdpSignerConfig | {
 };
 /**
  * Resolve a facilitator's base URL, applying the public default.
- * @experimental
  */
 declare const resolveFacilitatorUrl: (facilitator?: FacilitatorConfig) => string;
-export { Caip2 as C, DEFAULT_FACILITATOR_URL as D, EVM_NETWORKS as E, FacilitatorConfig as F, NETWORK_TO_CAIP2 as N, PaymentEventRow as P, SVM_NETWORKS as S, X402CdpSignerConfig as X, EvmAddress as a, FriendlyNetwork as b, X402ChargeConfig as c, X402Network as d, X402PayConfig as e, X402Price as f, X402Receipt as g, X402ReceiptSink as h, X402Recipient as i, X402SignerConfig as j, isEvmNetwork as k, isSvmNetwork as l, DEFAULT_STABLECOIN_DECIMALS as m, SpendPolicy as n, SpendState as o, assertBoundedPolicy as p, buildPaymentGuard as q, resolveFacilitatorUrl as r, buildSpendPolicy as s, toCaip2 as t, createSpendState as u, releaseSpendOnFailure as v, usdToAtomic as w, toPaymentEventRow as x, toReceipt as y };
+export { AllowedAsset as A, type Caip2 as C, DEFAULT_ALLOWED_ASSETS as D, EvmAddress as E, type FacilitatorConfig as F, NETWORK_TO_CAIP2 as N, PaymentEventRow as P, type SpendPolicy as S, X402PayConfig as X, DEFAULT_FACILITATOR_URL as a, DEFAULT_STABLECOIN_DECIMALS as b, type X402CdpSignerConfig as c, type X402Network as d, type X402Price as e, type X402SignerConfig as f, type isSvmNetwork as g, X402ChargeConfig as h, isEvmNetwork as i, X402Receipt as j, X402ReceiptSink as k, X402Recipient as l, toPaymentEventRow as m, EVM_NETWORKS as n, FriendlyNetwork as o, SVM_NETWORKS as p, resolveFacilitatorUrl as r, toCaip2 as t, usdToAtomic as u };

package/dist/packem_shared/optional-peer-BBhVxozi.mjs

@@ -0,0 +1 @@
+import{LunoraError as u}from"@lunora/errors";const a=new Set(["ERR_MODULE_NOT_FOUND","MODULE_NOT_FOUND"]),i=/cannot find (?:module|package)|module not found|failed to resolve (?:module|import)/i,s=(t,o=3)=>{if(typeof t!="object"||t===null||o<0)return!1;const{cause:e,code:r,message:n}=t;return typeof r=="string"&&a.has(r)||typeof n=="string"&&i.test(n)?!0:s(e,o-1)},f=async(t,o)=>{try{return await t()}catch(e){throw s(e)?new u("ENV_INVALID",o,{cause:e}):e}};export{f as i};

package/dist/packem_shared/toPaymentEventRow-DTXuTDh0.mjs

@@ -0,0 +1 @@
+const e=(r,o)=>({amount:r.amount??r.requirements.amount,asset:r.requirements.asset,from:r.payer,network:r.network,resource:o.resource,to:r.requirements.payTo,ts:o.ts,tx:r.transaction}),s=r=>({processedAt:r.ts,provider:"x402",providerEventId:r.tx,type:"x402.settled"});export{s as toPaymentEventRow,e as toReceipt};

package/dist/packem_shared/withX402-mUrRb9a2.mjs

@@ -0,0 +1 @@
+import{createChargeMiddleware as w}from"./createChargeMiddleware-DyOEuTCT.mjs";const h=(o,r)=>{let t;return async(n,a)=>{t??=w(o).catch(i=>{throw t=void 0,i});const d=await t,e=n,c=typeof e.waitUntil=="function"?{waitUntil:i=>{e.waitUntil?.(i)}}:void 0;return d.handle(a,()=>r(n,a),c)}};export{h as withX402};

package/dist/pay/index.d.mts

@@ -1,70 +1,22 @@
-import { e as X402PayConfig } from "../packem_shared/config.d-B-NYmHgG.mjs";
-export { type C as Caip2, D as DEFAULT_FACILITATOR_URL, m as DEFAULT_STABLECOIN_DECIMALS, type n as SpendPolicy, type o as SpendState, type X as X402CdpSignerConfig, type d as X402Network, type f as X402Price, type j as X402SignerConfig, p as assertBoundedPolicy, q as buildPaymentGuard, s as buildSpendPolicy, u as createSpendState, k as isEvmNetwork, l as isSvmNetwork, v as releaseSpendOnFailure, r as resolveFacilitatorUrl, t as toCaip2, w as usdToAtomic } from "../packem_shared/config.d-B-NYmHgG.mjs";
-import { x402Client } from '@x402/core/client';
-import { ClientSvmSigner } from '@x402/svm';
-import { PrivateKeyAccount } from 'viem/accounts';
-import '@x402/evm';
-import '@x402/core/http';
+import { X as X402PayConfig } from "../packem_shared/index.d-A-g7yKuO.mjs";
+export { type A as AllowedAsset, type C as Caip2, D as DEFAULT_ALLOWED_ASSETS, a as DEFAULT_FACILITATOR_URL, b as DEFAULT_STABLECOIN_DECIMALS, type S as SpendPolicy, type c as X402CdpSignerConfig, type d as X402Network, type e as X402Price, type f as X402SignerConfig, i as isEvmNetwork, g as isSvmNetwork, r as resolveFacilitatorUrl, t as toCaip2, u as usdToAtomic } from "../packem_shared/index.d-A-g7yKuO.mjs";
 import '@x402/core/types';
-/** Reads a secret by name; resolves `undefined` when unset. */
-type GetSecret = (name: string) => Promise<string | undefined> | string | undefined;
-/**
- * How the wallet reads its key material — wired to `ctx.secrets.get` in an action.
- * @experimental
- */
-interface WalletDeps {
-  /** Read a secret (e.g. a private key) by name; `undefined` when unset. */
-  readonly getSecret: GetSecret;
-}
-/**
- * Resolve a viem `LocalAccount` from a raw private key. The key may be given with
- * or without the `0x` prefix. The account is a structural `ClientEvmSigner`
- * (`address` + `signTypedData`), so `@x402/evm` accepts it directly.
- * @experimental
- */
-declare const resolveEvmAccount: (privateKey: string) => Promise<PrivateKeyAccount>;
-/**
- * Resolve a `@solana/kit` `KeyPairSigner` from a raw Solana secret key. The secret
- * may be given as a JSON byte array (`[12,34,…]`, the `solana-keygen` keyfile
- * format) or as a base58 string. A 64-byte value is a full secret key (seed ‖
- * public key); a 32-byte value is the seed alone. The returned signer is a
- * structural `ClientSvmSigner` (`TransactionSigner`), so `@x402/svm` accepts it.
- * @experimental
- */
-declare const resolveSvmSigner: (secret: string) => Promise<ClientSvmSigner>;
-/**
- * Register the scheme family the configured network needs on `client`, wired to
- * the agent signer. Dispatches on network family (EVM vs SVM) and on custody —
- * `"signer"` (a signer the caller already built; registered directly, no secret
- * read), `"raw-key"` (a `ctx.secrets` private key → viem account on EVM or a
- * `@solana/kit` keypair on SVM), or `"cdp"` (a Coinbase-managed wallet via
- * `@coinbase/cdp-sdk`).
- * @experimental
- */
-declare const registerWallet: (client: x402Client, config: X402PayConfig, deps: WalletDeps) => Promise<void>;
+import '@solana/accounts';
 /**
  * A payment-enabled `fetch`: same signature as the platform `fetch`.
- * @experimental
  */
 type PayFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 /**
  * Dependencies for building a pay-rail fetch: secret access, plus an optional base `fetch` to wrap.
- * @experimental
  */
-interface X402PayDeps extends WalletDeps {
+interface X402PayDeps {
   /** The `fetch` to wrap (defaults to `globalThis.fetch`). Inject to test or to chain transports. */
   readonly fetch?: typeof globalThis.fetch;
+  /** Read a secret (e.g. a private key) by name; `undefined` when unset. Wire it to `ctx.secrets.get`. */
+  readonly getSecret: (name: string) => Promise<string | undefined> | string | undefined;
 }
-/**
- * Build a payment-enabled `fetch` for `config`. Throws (before resolving a
- * signer) when `config.policy` is unbounded — an agent wallet is never built
- * with unlimited spend authority.
- * @experimental
- */
-declare const createPayFetch: (config: X402PayConfig, deps: X402PayDeps) => Promise<PayFetch>;
 /**
  * A configured pay rail: a payment-enabled `fetch` bounded by the spend policy.
- * @experimental
  */
 interface X402Pay {
   /** A `fetch` that transparently pays for `402`-gated resources under the policy. */
@@ -74,7 +26,6 @@ interface X402Pay {
  * Build a pay rail for `config`. The returned `fetch` answers `402` challenges by
  * signing and retrying, within `config.policy`. Throws (before touching the
  * signer) when the policy is unbounded.
- * @experimental
  */
 declare const createX402Pay: (config: X402PayConfig, deps: X402PayDeps) => Promise<X402Pay>;
 /**
@@ -86,10 +37,10 @@ declare const createX402Pay: (config: X402PayConfig, deps: X402PayDeps) => Promi
  * memoises it: the viem/`@x402` signer imports + Secrets Store read are paid for
  * only when an action actually pays, and the single `SpendState` behind the
  * rail is shared across every payment for the lifetime of this ctx — so the
- * per-run cap scopes to the ctx, not to each request. A failed build (e.g. an
+ * per-run cap scopes to the ctx (one function invocation), not to each request
+ * and not across invocations. A failed build (e.g. an
  * unbounded policy) is memoised too, keeping the rail deterministically
  * fail-closed.
- * @experimental
  */
 declare const lazyX402Pay: (config: X402PayConfig, deps: X402PayDeps) => X402Pay;
-export { type PayFetch, type WalletDeps, X402Pay, type X402PayConfig, type X402PayDeps, createPayFetch, createX402Pay, lazyX402Pay, registerWallet, resolveEvmAccount, resolveSvmSigner };
+export { type PayFetch, X402Pay, type X402PayConfig, type X402PayDeps, createX402Pay, lazyX402Pay };

package/dist/pay/index.d.ts

@@ -1,70 +1,22 @@
-import { e as X402PayConfig } from "../packem_shared/config.d-B-NYmHgG.js";
-export { type C as Caip2, D as DEFAULT_FACILITATOR_URL, m as DEFAULT_STABLECOIN_DECIMALS, type n as SpendPolicy, type o as SpendState, type X as X402CdpSignerConfig, type d as X402Network, type f as X402Price, type j as X402SignerConfig, p as assertBoundedPolicy, q as buildPaymentGuard, s as buildSpendPolicy, u as createSpendState, k as isEvmNetwork, l as isSvmNetwork, v as releaseSpendOnFailure, r as resolveFacilitatorUrl, t as toCaip2, w as usdToAtomic } from "../packem_shared/config.d-B-NYmHgG.js";
-import { x402Client } from '@x402/core/client';
-import { ClientSvmSigner } from '@x402/svm';
-import { PrivateKeyAccount } from 'viem/accounts';
-import '@x402/evm';
-import '@x402/core/http';
+import { X as X402PayConfig } from "../packem_shared/index.d-A-g7yKuO.js";
+export { type A as AllowedAsset, type C as Caip2, D as DEFAULT_ALLOWED_ASSETS, a as DEFAULT_FACILITATOR_URL, b as DEFAULT_STABLECOIN_DECIMALS, type S as SpendPolicy, type c as X402CdpSignerConfig, type d as X402Network, type e as X402Price, type f as X402SignerConfig, i as isEvmNetwork, g as isSvmNetwork, r as resolveFacilitatorUrl, t as toCaip2, u as usdToAtomic } from "../packem_shared/index.d-A-g7yKuO.js";
 import '@x402/core/types';
-/** Reads a secret by name; resolves `undefined` when unset. */
-type GetSecret = (name: string) => Promise<string | undefined> | string | undefined;
-/**
- * How the wallet reads its key material — wired to `ctx.secrets.get` in an action.
- * @experimental
- */
-interface WalletDeps {
-  /** Read a secret (e.g. a private key) by name; `undefined` when unset. */
-  readonly getSecret: GetSecret;
-}
-/**
- * Resolve a viem `LocalAccount` from a raw private key. The key may be given with
- * or without the `0x` prefix. The account is a structural `ClientEvmSigner`
- * (`address` + `signTypedData`), so `@x402/evm` accepts it directly.
- * @experimental
- */
-declare const resolveEvmAccount: (privateKey: string) => Promise<PrivateKeyAccount>;
-/**
- * Resolve a `@solana/kit` `KeyPairSigner` from a raw Solana secret key. The secret
- * may be given as a JSON byte array (`[12,34,…]`, the `solana-keygen` keyfile
- * format) or as a base58 string. A 64-byte value is a full secret key (seed ‖
- * public key); a 32-byte value is the seed alone. The returned signer is a
- * structural `ClientSvmSigner` (`TransactionSigner`), so `@x402/svm` accepts it.
- * @experimental
- */
-declare const resolveSvmSigner: (secret: string) => Promise<ClientSvmSigner>;
-/**
- * Register the scheme family the configured network needs on `client`, wired to
- * the agent signer. Dispatches on network family (EVM vs SVM) and on custody —
- * `"signer"` (a signer the caller already built; registered directly, no secret
- * read), `"raw-key"` (a `ctx.secrets` private key → viem account on EVM or a
- * `@solana/kit` keypair on SVM), or `"cdp"` (a Coinbase-managed wallet via
- * `@coinbase/cdp-sdk`).
- * @experimental
- */
-declare const registerWallet: (client: x402Client, config: X402PayConfig, deps: WalletDeps) => Promise<void>;
+import '@solana/accounts';
 /**
  * A payment-enabled `fetch`: same signature as the platform `fetch`.
- * @experimental
  */
 type PayFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 /**
  * Dependencies for building a pay-rail fetch: secret access, plus an optional base `fetch` to wrap.
- * @experimental
  */
-interface X402PayDeps extends WalletDeps {
+interface X402PayDeps {
   /** The `fetch` to wrap (defaults to `globalThis.fetch`). Inject to test or to chain transports. */
   readonly fetch?: typeof globalThis.fetch;
+  /** Read a secret (e.g. a private key) by name; `undefined` when unset. Wire it to `ctx.secrets.get`. */
+  readonly getSecret: (name: string) => Promise<string | undefined> | string | undefined;
 }
-/**
- * Build a payment-enabled `fetch` for `config`. Throws (before resolving a
- * signer) when `config.policy` is unbounded — an agent wallet is never built
- * with unlimited spend authority.
- * @experimental
- */
-declare const createPayFetch: (config: X402PayConfig, deps: X402PayDeps) => Promise<PayFetch>;
 /**
  * A configured pay rail: a payment-enabled `fetch` bounded by the spend policy.
- * @experimental
  */
 interface X402Pay {
   /** A `fetch` that transparently pays for `402`-gated resources under the policy. */
@@ -74,7 +26,6 @@ interface X402Pay {
  * Build a pay rail for `config`. The returned `fetch` answers `402` challenges by
  * signing and retrying, within `config.policy`. Throws (before touching the
  * signer) when the policy is unbounded.
- * @experimental
  */
 declare const createX402Pay: (config: X402PayConfig, deps: X402PayDeps) => Promise<X402Pay>;
 /**
@@ -86,10 +37,10 @@ declare const createX402Pay: (config: X402PayConfig, deps: X402PayDeps) => Promi
  * memoises it: the viem/`@x402` signer imports + Secrets Store read are paid for
  * only when an action actually pays, and the single `SpendState` behind the
  * rail is shared across every payment for the lifetime of this ctx — so the
- * per-run cap scopes to the ctx, not to each request. A failed build (e.g. an
+ * per-run cap scopes to the ctx (one function invocation), not to each request
+ * and not across invocations. A failed build (e.g. an
  * unbounded policy) is memoised too, keeping the rail deterministically
  * fail-closed.
- * @experimental
  */
 declare const lazyX402Pay: (config: X402PayConfig, deps: X402PayDeps) => X402Pay;
-export { type PayFetch, type WalletDeps, X402Pay, type X402PayConfig, type X402PayDeps, createPayFetch, createX402Pay, lazyX402Pay, registerWallet, resolveEvmAccount, resolveSvmSigner };
+export { type PayFetch, X402Pay, type X402PayConfig, type X402PayDeps, createX402Pay, lazyX402Pay };

package/dist/pay/index.mjs

@@ -1 +1 @@
-import{createPayFetch as c}from"../packem_shared/createPayFetch-CDZJaS13.mjs";import{DEFAULT_FACILITATOR_URL as p,resolveFacilitatorUrl as d}from"../packem_shared/DEFAULT_FACILITATOR_URL-lUtljfJI.mjs";import{isEvmNetwork as S,isSvmNetwork as f,toCaip2 as u}from"../packem_shared/EVM_NETWORKS-XOms9Rtk.mjs";import{DEFAULT_STABLECOIN_DECIMALS as v,assertBoundedPolicy as E,buildPaymentGuard as F,buildSpendPolicy as L,createSpendState as P,releaseSpendOnFailure as T,usdToAtomic as x}from"../packem_shared/DEFAULT_STABLECOIN_DECIMALS-gY9zXmGa.mjs";import{registerWallet as w,resolveEvmAccount as C,resolveSvmSigner as I}from"../packem_shared/registerWallet-Cu4qF5tj.mjs";const i=async(e,r)=>({fetch:await c(e,r)}),s=(e,r)=>{let t;return{fetch:async(o,a)=>(t??=i(e,r),(await t).fetch(o,a))}};export{p as DEFAULT_FACILITATOR_URL,v as DEFAULT_STABLECOIN_DECIMALS,E as assertBoundedPolicy,F as buildPaymentGuard,L as buildSpendPolicy,c as createPayFetch,P as createSpendState,i as createX402Pay,S as isEvmNetwork,f as isSvmNetwork,s as lazyX402Pay,w as registerWallet,T as releaseSpendOnFailure,C as resolveEvmAccount,d as resolveFacilitatorUrl,I as resolveSvmSigner,u as toCaip2,x as usdToAtomic};
+import{x402Client as h}from"@x402/core/client";import{wrapFetchWithPayment as u}from"@x402/fetch";import{assertBoundedPolicy as E,buildSpendPolicy as S,buildPaymentGuard as k,createSpendState as A,releaseSpendOnFailure as N}from"../packem_shared/DEFAULT_ALLOWED_ASSETS-CX67Ktyc.mjs";import{DEFAULT_ALLOWED_ASSETS as B,DEFAULT_STABLECOIN_DECIMALS as W,usdToAtomic as $}from"../packem_shared/DEFAULT_ALLOWED_ASSETS-CX67Ktyc.mjs";import{LunoraError as c}from"@lunora/errors";import{toCaip2 as f,isEvmNetwork as x}from"../packem_shared/EVM_NETWORKS-CwbBEtp1.mjs";import{isSvmNetwork as Y}from"../packem_shared/EVM_NETWORKS-CwbBEtp1.mjs";import{i as l}from"../packem_shared/optional-peer-BBhVxozi.mjs";import{DEFAULT_FACILITATOR_URL as G,resolveFacilitatorUrl as q}from"../packem_shared/DEFAULT_FACILITATOR_URL-CPJNUMvi.mjs";const P=/^0x[0-9a-fA-F]{64}$/,p=async(e,t)=>{const a=await e(t);if(a===void 0||a.length===0)throw new c("ENV_INVALID",`x402 pay: secret "${t}" is not set — the agent wallet has no key to sign with.`);return a},g=(e,t)=>{const a=e.address.startsWith("0x");if(t&&!a)throw new c("ENV_INVALID",`x402 pay: the supplied signer address "${e.address}" is not an EVM (0x…) address, but the network is EVM.`);if(!t&&a)throw new c("ENV_INVALID",`x402 pay: the supplied signer address "${e.address}" is an EVM (0x…) address, but the network is Solana.`)},I=async(e,t)=>{const{CdpClient:a}=await l(()=>import("@coinbase/cdp-sdk"),'x402 pay: CDP-managed custody needs the optional @coinbase/cdp-sdk peer — install it, or use "raw-key"/"signer" custody instead.'),[i,o,r]=await Promise.all([p(t,e.apiKeyIdSecretName??"CDP_API_KEY_ID"),p(t,e.apiKeySecretName??"CDP_API_KEY_SECRET"),p(t,e.walletSecretName??"CDP_WALLET_SECRET")]);return new a({apiKeyId:i,apiKeySecret:o,walletSecret:r}).evm.getOrCreateAccount({name:e.account})},v=async e=>{const t=e.startsWith("0x")?e:`0x${e}`;if(!P.test(t))throw new c("ENV_INVALID","x402 pay: the EVM wallet key must be a 32-byte hex private key (64 hex chars, optional 0x prefix).");const{privateKeyToAccount:a}=await l(()=>import("viem/accounts"),'x402 pay: raw-key EVM custody needs the optional viem peer — install it, or use "cdp"/"signer" custody instead.');return a(t)},V=async e=>{const t=e.trim(),{createKeyPairSignerFromBytes:a,createKeyPairSignerFromPrivateKeyBytes:i,getBase58Encoder:o}=await l(()=>import("@solana/kit"),'x402 pay: raw-key Solana custody needs the optional @solana/kit peer — install it, or pass a pre-built signer via "signer" custody instead.');let r;if(t.startsWith("[")){let s;try{s=JSON.parse(t)}catch{throw new c("ENV_INVALID","x402 pay: the Solana wallet key looks like a JSON byte array but is not valid JSON.")}if(!Array.isArray(s)||s.some(n=>typeof n!="number"))throw new c("ENV_INVALID","x402 pay: the Solana wallet key JSON must be an array of byte values.");r=Uint8Array.from(s)}else try{r=Uint8Array.from(o().encode(t))}catch{throw new c("ENV_INVALID","x402 pay: the Solana wallet key must be a base58 secret key or a JSON byte array.")}if(r.length===64)return a(r);if(r.length===32)return i(r);throw new c("ENV_INVALID",`x402 pay: the Solana wallet key must decode to 32 or 64 bytes (got ${String(r.length)}). Provide a base58 secret key or a JSON byte array.`)},_=async(e,t,a)=>{const i=f(t.network),{signer:o}=t,r=x(t.network);let s;if(o.type==="signer")g(o.signer,r),s=o.signer;else if(o.type==="cdp"){if(!r)throw new c("NOT_IMPLEMENTED",`x402 pay: CDP-managed Solana custody (account "${o.account}") is not wired — a CDP Solana account is not a @solana/kit signer. Build a @solana/kit signer around it and pass it via the { type: "signer" } escape hatch, or use "raw-key".`);s=await I(o,a.getSecret)}else{const n=await p(a.getSecret,o.secretName);s=r?await v(n):await V(n)}if(r){const{registerExactEvmScheme:n}=await l(()=>import("@x402/evm/exact/client"),"x402 pay: EVM networks need the optional @x402/evm + viem peers — install them, or configure an SVM network.");n(e,{networks:[i],signer:s})}else{const{registerExactSvmScheme:n}=await l(()=>import("@x402/svm/exact/client"),"x402 pay: SVM networks need the optional @x402/svm + @solana/kit peers — install them, or configure an EVM network.");n(e,{networks:[i],signer:s})}},b=async(e,t)=>{E(e.policy);const a=A(),i=S(e.policy),o=k(e.policy,a),r=N(a),s=new h;await _(s,e,t),s.registerPolicy(i),s.onBeforePaymentCreation(o),s.onPaymentCreationFailure(r);const n=t.fetch??globalThis.fetch,w=u(n,s);return async(y,d)=>{const m=new Headers(d?.headers??(y instanceof Request?y.headers:void 0));return m.has("PAYMENT-SIGNATURE")||m.has("X-PAYMENT")?n(y,d):w(y,d)}},D=async(e,t)=>({fetch:await b(e,t)}),K=(e,t)=>{let a;return{fetch:async(o,r)=>(a??=D(e,t),(await a).fetch(o,r))}};export{B as DEFAULT_ALLOWED_ASSETS,G as DEFAULT_FACILITATOR_URL,W as DEFAULT_STABLECOIN_DECIMALS,D as createX402Pay,x as isEvmNetwork,Y as isSvmNetwork,K as lazyX402Pay,q as resolveFacilitatorUrl,f as toCaip2,$ as usdToAtomic};