@nevermined-io/payments 1.11.2 → 1.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. package/README.md +33 -0
  2. package/dist/a2a/clientRegistry.d.ts +10 -1
  3. package/dist/a2a/clientRegistry.d.ts.map +1 -1
  4. package/dist/a2a/clientRegistry.js +13 -4
  5. package/dist/a2a/clientRegistry.js.map +1 -1
  6. package/dist/a2a/paymentsClient.d.ts +60 -3
  7. package/dist/a2a/paymentsClient.d.ts.map +1 -1
  8. package/dist/a2a/paymentsClient.js +129 -8
  9. package/dist/a2a/paymentsClient.js.map +1 -1
  10. package/dist/a2a/types.d.ts +5 -0
  11. package/dist/a2a/types.d.ts.map +1 -1
  12. package/dist/a2a/types.js.map +1 -1
  13. package/dist/api/nvm-api.d.ts +2 -0
  14. package/dist/api/nvm-api.d.ts.map +1 -1
  15. package/dist/api/nvm-api.js +4 -0
  16. package/dist/api/nvm-api.js.map +1 -1
  17. package/dist/api/orders-api.d.ts +146 -0
  18. package/dist/api/orders-api.d.ts.map +1 -0
  19. package/dist/api/orders-api.js +107 -0
  20. package/dist/api/orders-api.js.map +1 -0
  21. package/dist/common/types.d.ts +87 -0
  22. package/dist/common/types.d.ts.map +1 -1
  23. package/dist/common/types.js.map +1 -1
  24. package/dist/index.d.ts +4 -1
  25. package/dist/index.d.ts.map +1 -1
  26. package/dist/index.js +2 -0
  27. package/dist/index.js.map +1 -1
  28. package/dist/mcp/core/paywall.d.ts.map +1 -1
  29. package/dist/mcp/core/paywall.js +10 -0
  30. package/dist/mcp/core/paywall.js.map +1 -1
  31. package/dist/mpp/fetch.d.ts +8 -3
  32. package/dist/mpp/fetch.d.ts.map +1 -1
  33. package/dist/mpp/fetch.js +6 -0
  34. package/dist/mpp/fetch.js.map +1 -1
  35. package/dist/mpp/mpp-api.d.ts +11 -5
  36. package/dist/mpp/mpp-api.d.ts.map +1 -1
  37. package/dist/mpp/mpp-api.js +10 -3
  38. package/dist/mpp/mpp-api.js.map +1 -1
  39. package/dist/payments.d.ts +3 -0
  40. package/dist/payments.d.ts.map +1 -1
  41. package/dist/payments.js +4 -0
  42. package/dist/payments.js.map +1 -1
  43. package/dist/x402/express/middleware.d.ts.map +1 -1
  44. package/dist/x402/express/middleware.js +98 -1
  45. package/dist/x402/express/middleware.js.map +1 -1
  46. package/dist/x402/facilitator-api.d.ts +90 -7
  47. package/dist/x402/facilitator-api.d.ts.map +1 -1
  48. package/dist/x402/facilitator-api.js +64 -3
  49. package/dist/x402/facilitator-api.js.map +1 -1
  50. package/dist/x402/index.d.ts +3 -2
  51. package/dist/x402/index.d.ts.map +1 -1
  52. package/dist/x402/index.js +1 -0
  53. package/dist/x402/index.js.map +1 -1
  54. package/dist/x402/token-request.d.ts +8 -0
  55. package/dist/x402/token-request.d.ts.map +1 -1
  56. package/dist/x402/token-request.js +101 -1
  57. package/dist/x402/token-request.js.map +1 -1
  58. package/dist/x402/token-version.d.ts +97 -0
  59. package/dist/x402/token-version.d.ts.map +1 -0
  60. package/dist/x402/token-version.js +127 -0
  61. package/dist/x402/token-version.js.map +1 -0
  62. package/dist/x402/token.d.ts +33 -2
  63. package/dist/x402/token.d.ts.map +1 -1
  64. package/dist/x402/token.js +47 -2
  65. package/dist/x402/token.js.map +1 -1
  66. package/package.json +1 -1
@@ -1 +1 @@
1
- {"version":3,"file":"payments.d.ts","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAExF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAS,SAAQ,eAAe;IACpC,KAAK,EAAG,UAAU,CAAA;IAClB,KAAK,EAAG,QAAQ,CAAA;IAChB,MAAM,EAAG,SAAS,CAAA;IAClB,QAAQ,EAAG,gBAAgB,CAAA;IAC3B,aAAa,EAAG,gBAAgB,CAAA;IAChC,aAAa,EAAG,gBAAgB,CAAA;IAChC,SAAS,EAAG,YAAY,CAAA;IACxB,WAAW,EAAG,cAAc,CAAA;IAC5B,IAAI,EAAG,YAAY,CAAA;IAC1B;;;;;;;;;;OAUG;IACI,GAAG,EAAG,MAAM,CAAA;IACnB,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAC,CAAe;IAEnC;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAC,CAAkD;IAE1E;;;OAGG;IACH,IAAW,GAAG;QAEV;;;WAGG;yBAEQ,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,KACzD,uBAAuB;QAE1B;;;;WAIG;6BACwB,GAAG;MAOjC;IAED;;;OAGG;IACH,IAAW,GAAG;;;sDAuIoC,CAAC,cAAc,CAAC,2LAKnC,CAAC;sDAK/B,CAAC,cACK,CAAC,uEAIO,CAAC;oFAKoC,CAAC,cACpD,CAAD,mLAGS,CAAC;;;;;;;6FA4C2H,CAAC,cAAc,CAAC;8IAAwd,CAAC,cAAwB,CAAC;+FAAyc,CAAC,cAAc,CAAC;;;kBAxBxjC,CAAC;;;;mBAwBsgJ,CAAC;;;;;;;;;MAtM/iJ;IAED;;;;;;;OAOG;IACH,IAAW,UAAU,IAAI,aAAa,CAUrC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG;;MAA4B;IAEtC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc;IAO1C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc;IAoBjD;;;;;OAKG;IACH,OAAO;IAOP;;OAEG;IACH,OAAO,CAAC,aAAa;IAarB;;;;;;;;;;OAUG;IACI,OAAO;IAMd;;;;;;;;;OASG;IACI,MAAM;IAIb;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAiBtE;;;;;;;OAOG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;CACF"}
1
+ {"version":3,"file":"payments.d.ts","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAExF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;;GAaG;AACH,qBAAa,QAAS,SAAQ,eAAe;IACpC,KAAK,EAAG,UAAU,CAAA;IAClB,KAAK,EAAG,QAAQ,CAAA;IAChB,MAAM,EAAG,SAAS,CAAA;IAClB,QAAQ,EAAG,gBAAgB,CAAA;IAC3B,aAAa,EAAG,gBAAgB,CAAA;IAChC,aAAa,EAAG,gBAAgB,CAAA;IAChC,MAAM,EAAG,SAAS,CAAA;IAClB,SAAS,EAAG,YAAY,CAAA;IACxB,WAAW,EAAG,cAAc,CAAA;IAC5B,IAAI,EAAG,YAAY,CAAA;IAC1B;;;;;;;;;;OAUG;IACI,GAAG,EAAG,MAAM,CAAA;IACnB,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAC,CAAe;IAEnC;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAC,CAAkD;IAE1E;;;OAGG;IACH,IAAW,GAAG;QAEV;;;WAGG;yBAEQ,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,KACzD,uBAAuB;QAE1B;;;;WAIG;6BACwB,GAAG;MAOjC;IAED;;;OAGG;IACH,IAAW,GAAG;;;sDA+Hb,CAAC,cACC,CAAA,2LAMO,CAAC;sDAE+B,CAAC,cAAc,CAAC,uEACxB,CAAC;oFASlC,CAAA,cACW,CAAC,mLAQmD,CAAC;;;;;;;6FA0CjD,CAAC,cAEhB,CAAH;8IAM4V,CAAC,cAAwB,CAAC;+FAAyc,CAAC,cAAc,CAAC;;;kBA7B/zB,CAAC;;;;mBA6B6wI,CAAC;;;;;;;;;MAxM5xI;IAED;;;;;;;OAOG;IACH,IAAW,UAAU,IAAI,aAAa,CAUrC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG;;MAA4B;IAEtC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc;IAO1C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc;IAoBjD;;;;;OAKG;IACH,OAAO;IAOP;;OAEG;IACH,OAAO,CAAC,aAAa;IAcrB;;;;;;;;;;OAUG;IACI,OAAO;IAMd;;;;;;;;;OASG;IACI,MAAM;IAIb;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAkBtE;;;;;;;OAOG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;CACF"}
package/dist/payments.js CHANGED
@@ -11,6 +11,7 @@ import { PaymentsA2AServer } from './a2a/server.js';
11
11
  import { buildPaymentAgentCard } from './a2a/agent-card.js';
12
12
  import * as mcpModule from './mcp/index.js';
13
13
  import { OrganizationsAPI } from './api/organizations-api/organizations-api.js';
14
+ import { OrdersAPI } from './api/orders-api.js';
14
15
  import { FacilitatorAPI } from './x402/facilitator-api.js';
15
16
  import { X402TokenAPI } from './x402/token.js';
16
17
  import { DelegationAPI } from './x402/delegation-api.js';
@@ -24,6 +25,7 @@ import { MppAPI } from './mpp/mpp-api.js';
24
25
  *
25
26
  * Each of these functionalities is encapsulated in its own API class:
26
27
  * - `plans`: Manages AI Plans, including registration and ordering and retrieving plan details.
28
+ * - `orders`: Browser-fiat Orders — merchant-initiated, off-plan charges for an arbitrary amount.
27
29
  * - `agents`: Handles AI Agents, including registration of AI Agents and access token generation.
28
30
  * - `requests`: Manages requests received by AI Agents, including validation and tracking.
29
31
  * - `observability`: Provides observability and logging utilities for AI Agents with Helicone integration
@@ -157,6 +159,7 @@ export class Payments extends BasePaymentsAPI {
157
159
  this.requests = AgentRequestsAPI.getInstance(options);
158
160
  this.observability = ObservabilityAPI.getInstance(options);
159
161
  this.organizations = OrganizationsAPI.getInstance(options);
162
+ this.orders = OrdersAPI.getInstance(options);
160
163
  this.query = AIQueryApi.getInstance();
161
164
  this.contracts = new ContractsAPI(options);
162
165
  this.facilitator = FacilitatorAPI.getInstance(options);
@@ -221,6 +224,7 @@ export class Payments extends BasePaymentsAPI {
221
224
  this.requests?.setOrganizationId(organizationId);
222
225
  this.observability?.setOrganizationId(organizationId);
223
226
  this.organizations?.setOrganizationId(organizationId);
227
+ this.orders?.setOrganizationId(organizationId);
224
228
  this.contracts?.setOrganizationId(organizationId);
225
229
  this.facilitator?.setOrganizationId(organizationId);
226
230
  this.x402?.setOrganizationId(organizationId);
@@ -1 +1 @@
1
- {"version":3,"file":"payments.js","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,QAAS,SAAQ,eAAe;IAgC3C;;;OAGG;IACH,IAAW,GAAG;QACZ,OAAO;YACL;;;eAGG;YACH,KAAK,EAAE,CACL,OAA0D,EACjC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAE5F;;;;eAIG;YACH,SAAS,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;gBAChC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnD,CAAC;SACF,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,IAAW,GAAG;QACZ,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH,IAAW,UAAU;QACnB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;gBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,eAAe;gBACjC,cAAc,EAAE,IAAI,CAAC,qBAAqB,IAAI,SAAS;gBACvD,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAQD;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAuB;QACxC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,gCAAgC,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAuB;QAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAW,CAAA;QAChE,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACtC,CAAC;QAED,MAAM,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAW,CAAA;QAC1E,IAAI,iBAAiB,EAAE,CAAC;YACtB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QAEvD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,YAAoB,OAAuB,EAAE,iBAAiB,GAAG,IAAI;QACnE,KAAK,CAAC,OAAO,CAAC,CAAA;QAEd,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,OAAuB;QAC3C,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;OAUG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAM;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACpF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;;;;OASG;IACI,MAAM;QACX,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAA6B;QAC7D,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC5C,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC3C,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;IAClC,CAAC;;AA9KD;;;GAGG;AACI,YAAG,GAAG,EAAE,qBAAqB,EAAE,CAAA","sourcesContent":["import { AIQueryApi } from './api/query-api.js'\nimport { PaymentsError } from './common/payments.error.js'\nimport { PaymentOptions } from './common/types.js'\nimport { BasePaymentsAPI } from './api/base-payments.js'\nimport { PlansAPI } from './api/plans-api.js'\nimport { ContractsAPI } from './api/contracts-api.js'\nimport { AgentsAPI } from './api/agents-api.js'\nimport { AgentRequestsAPI } from './api/requests-api.js'\nimport { ObservabilityAPI } from './api/observability-api/observability-api.js'\nimport { ClientRegistry } from './a2a/clientRegistry.js'\nimport type { PaymentsA2AServerOptions, PaymentsA2AServerResult } from './a2a/server.js'\nimport { PaymentsA2AServer } from './a2a/server.js'\nimport { buildPaymentAgentCard } from './a2a/agent-card.js'\nimport * as mcpModule from './mcp/index.js'\nimport { OrganizationsAPI } from './api/organizations-api/organizations-api.js'\nimport { FacilitatorAPI } from './x402/facilitator-api.js'\nimport { X402TokenAPI } from './x402/token.js'\nimport { DelegationAPI } from './x402/delegation-api.js'\nimport { MppAPI } from './mpp/mpp-api.js'\n\n/**\n * Main class that interacts with the Nevermined payments API.\n * Use `Payments.getInstance` for server-side usage or `Payments.getBrowserInstance` for browser usage.\n * @remarks This API requires a Nevermined API Key, which can be obtained by logging in to the Nevermined App.\n *\n * The library provides methods to manage AI Agents, Plans & process AI Agent Requests.\n *\n * Each of these functionalities is encapsulated in its own API class:\n * - `plans`: Manages AI Plans, including registration and ordering and retrieving plan details.\n * - `agents`: Handles AI Agents, including registration of AI Agents and access token generation.\n * - `requests`: Manages requests received by AI Agents, including validation and tracking.\n * - `observability`: Provides observability and logging utilities for AI Agents with Helicone integration\n */\nexport class Payments extends BasePaymentsAPI {\n public query!: AIQueryApi\n public plans!: PlansAPI\n public agents!: AgentsAPI\n public requests!: AgentRequestsAPI\n public observability!: ObservabilityAPI\n public organizations!: OrganizationsAPI\n public contracts!: ContractsAPI\n public facilitator!: FacilitatorAPI\n public x402!: X402TokenAPI\n /**\n * MPP (Machine Payments Protocol) surface — challenge/credential framing over\n * the same plans, delegations and credit burn as x402.\n *\n * @experimental Shipped ahead of its epic's declared MVP scope, so that the\n * Express middleware's own dependency on it is reachable rather than hidden\n * behind an internal handle. The NAME is settled — `payments.mpp` beside\n * `payments.x402` is what a seller will guess, and renaming it after a tag\n * costs a major. The SHAPE is not: this surface may change in a minor\n * release until the epic adopts it.\n */\n public mpp!: MppAPI\n private _a2aRegistry?: ClientRegistry\n private _delegation?: DelegationAPI\n\n /**\n * Cached MCP integration to preserve configuration (e.g., agentId, serverName)\n * across multiple getter accesses. This ensures callers do not need to retain\n * a reference to a previously configured instance.\n */\n private _mcpIntegration?: ReturnType<typeof mcpModule.buildMcpIntegration>\n\n /**\n * Exposes A2A server and client registry methods.\n * The client registry is initialized only if getClient is called.\n */\n public get a2a() {\n return {\n /**\n * Starts the A2A server with payment integration.\n * @param options - Server options.\n */\n start: (\n options: Omit<PaymentsA2AServerOptions, 'paymentsService'>,\n ): PaymentsA2AServerResult => PaymentsA2AServer.start({ ...options, paymentsService: this }),\n\n /**\n * Gets (or creates) a RegisteredPaymentsClient for the given alias.\n * The registry is initialized only on first use.\n * @param options - ClientRegistryOptions.\n */\n getClient: async (options: any) => {\n if (!this._a2aRegistry) {\n this._a2aRegistry = new ClientRegistry(this)\n }\n return await this._a2aRegistry.getClient(options)\n },\n }\n }\n\n /**\n * Returns the MCP integration API. The instance is memoized so that configuration\n * set via `configure({ agentId, serverName })` persists across calls.\n */\n public get mcp() {\n if (!this._mcpIntegration) {\n this._mcpIntegration = mcpModule.buildMcpIntegration(this)\n }\n return this._mcpIntegration\n }\n\n /**\n * Returns the Delegation API for listing enrolled payment methods.\n * The instance is lazily initialized on first access — the current\n * organization pin (set via `setOrganizationId` or the constructor\n * option) and the backend API version pin (`options.version`) are\n * forwarded so the first call carries the right `X-Current-Org-Id`\n * and `Nevermined-Version` headers.\n */\n public get delegation(): DelegationAPI {\n if (!this._delegation) {\n this._delegation = DelegationAPI.getInstance({\n nvmApiKey: this.nvmApiKey,\n environment: this.environmentName,\n organizationId: this.currentOrganizationId ?? undefined,\n version: this.version,\n })\n }\n return this._delegation\n }\n\n /**\n * Static A2A helpers and utilities.\n * Example: Payments.a2a.buildPaymentAgentCard(...)\n */\n static a2a = { buildPaymentAgentCard }\n\n /**\n * Get an instance of the Payments class for server-side usage.\n *\n * @param options - The options to initialize the payments class.\n * @example\n * ```\n * const payments = Payments.getInstance({\n * nvmApiKey: 'your-nvm-api-key',\n * environment: 'sandbox'\n * })\n * ```\n * @returns An instance of {@link Payments}\n * @throws PaymentsError if nvmApiKey is missing.\n */\n static getInstance(options: PaymentOptions) {\n if (!options.nvmApiKey) {\n throw new PaymentsError('Nevermined API Key is required')\n }\n return new Payments(options, false)\n }\n\n /**\n * Get an instance of the Payments class for browser usage.\n *\n * @remarks\n * This is a browser-only function.\n *\n * @param options - The options to initialize the payments class.\n * @example\n * ```\n * const payments = Payments.getBrowserInstance({\n * returnUrl: 'https://mysite.example',\n * environment: 'sandbox',\n * appId: 'my-app-id',\n * version: '1.1'\n * })\n * ```\n * @returns An instance of {@link Payments}\n * @throws PaymentsError if returnUrl is missing.\n */\n static getBrowserInstance(options: PaymentOptions) {\n if (!options.returnUrl) {\n throw new PaymentsError('returnUrl is required')\n }\n const url = new URL(window.location.href)\n const urlNvmApiKey = url.searchParams.get('nvmApiKey') as string\n if (urlNvmApiKey) {\n url.searchParams.delete('nvmApiKey')\n }\n\n const urlAccountAddress = url.searchParams.get('accountAddress') as string\n if (urlAccountAddress) {\n url.searchParams.delete('accountAddress')\n }\n\n history.replaceState(history.state, '', url.toString())\n\n return new Payments(options, true)\n }\n\n /**\n * Initializes the Payments class.\n *\n * @param options - The options to initialize the payments class.\n * @param isBrowserInstance - Whether this instance is for browser usage.\n */\n private constructor(options: PaymentOptions, isBrowserInstance = true) {\n super(options)\n\n this.isBrowserInstance = isBrowserInstance\n this.initializeApi(options)\n }\n\n /**\n * Initializes the AI Query Protocol API.\n */\n private initializeApi(options: PaymentOptions) {\n this.plans = PlansAPI.getInstance(options)\n this.agents = AgentsAPI.getInstance(options)\n this.requests = AgentRequestsAPI.getInstance(options)\n this.observability = ObservabilityAPI.getInstance(options)\n this.organizations = OrganizationsAPI.getInstance(options)\n this.query = AIQueryApi.getInstance()\n this.contracts = new ContractsAPI(options)\n this.facilitator = FacilitatorAPI.getInstance(options)\n this.x402 = X402TokenAPI.getInstance(options)\n this.mpp = MppAPI.getInstance(options)\n }\n\n /**\n * Initiates the connect flow. The user's browser will be redirected to\n * the Nevermined App login page.\n *\n * @remarks\n * This is a browser-only function.\n * @example\n * ```\n * payments.connect()\n * ```\n */\n public connect() {\n if (!this.isBrowserInstance) return\n const url = new URL(`/login?returnUrl=${this.returnUrl}`, this.environment.frontend)\n window.location.href = url.toString()\n }\n\n /**\n * Logs out the user by removing the NVM API key.\n *\n * @remarks\n * This is a browser-only function.\n * @example\n * ```\n * payments.logout()\n * ```\n */\n public logout() {\n this.nvmApiKey = ''\n }\n\n /**\n * Pins (or clears) the active organization workspace used by every\n * subsequent authenticated request. The SDK forwards the choice as the\n * `X-Current-Org-Id` header so the backend scopes publications and\n * other org-aware queries to the requested organization.\n *\n * Pass `null` to clear the pin and let the backend fall back to the\n * API key's org tag or the caller's most-recent active membership.\n *\n * For one-off targeting (e.g. publish a single agent into Org B without\n * leaving Org B as the active workspace) prefer the per-call\n * `{ organizationId }` option on `agents.registerAgent` /\n * `plans.registerPlan` / similar.\n *\n * @param organizationId - Org ID to pin (e.g. `org-…`) or `null` to clear.\n * @example\n * ```ts\n * payments.setOrganizationId('org-abc123')\n * await payments.agents.registerAgent(metadata, api, [planId]) // lands in org-abc123\n * ```\n */\n public override setOrganizationId(organizationId: string | null): void {\n super.setOrganizationId(organizationId)\n this.plans?.setOrganizationId(organizationId)\n this.agents?.setOrganizationId(organizationId)\n this.requests?.setOrganizationId(organizationId)\n this.observability?.setOrganizationId(organizationId)\n this.organizations?.setOrganizationId(organizationId)\n this.contracts?.setOrganizationId(organizationId)\n this.facilitator?.setOrganizationId(organizationId)\n this.x402?.setOrganizationId(organizationId)\n this.mpp?.setOrganizationId(organizationId)\n // `_delegation` is lazy — the getter forwards `currentOrganizationId`\n // on first access, so only propagate to an already-built instance.\n // (Eagerly constructing it here would change the lazy contract.)\n this._delegation?.setOrganizationId(organizationId)\n }\n\n /**\n * Checks if a user is logged in.\n * @example\n * ```\n * payments.isLoggedIn\n * ```\n * @returns True if the user is logged in.\n */\n get isLoggedIn(): boolean {\n return this.nvmApiKey.length > 0\n }\n}\n"]}
1
+ {"version":3,"file":"payments.js","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,QAAS,SAAQ,eAAe;IAiC3C;;;OAGG;IACH,IAAW,GAAG;QACZ,OAAO;YACL;;;eAGG;YACH,KAAK,EAAE,CACL,OAA0D,EACjC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAE5F;;;;eAIG;YACH,SAAS,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;gBAChC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnD,CAAC;SACF,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,IAAW,GAAG;QACZ,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH,IAAW,UAAU;QACnB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;gBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,eAAe;gBACjC,cAAc,EAAE,IAAI,CAAC,qBAAqB,IAAI,SAAS;gBACvD,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAQD;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAuB;QACxC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,gCAAgC,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAuB;QAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAW,CAAA;QAChE,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACtC,CAAC;QAED,MAAM,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAW,CAAA;QAC1E,IAAI,iBAAiB,EAAE,CAAC;YACtB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QAEvD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,YAAoB,OAAuB,EAAE,iBAAiB,GAAG,IAAI;QACnE,KAAK,CAAC,OAAO,CAAC,CAAA;QAEd,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,OAAuB;QAC3C,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;OAUG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAM;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACpF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;;;;OASG;IACI,MAAM;QACX,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAA6B;QAC7D,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC5C,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC3C,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;IAClC,CAAC;;AAhLD;;;GAGG;AACI,YAAG,GAAG,EAAE,qBAAqB,EAAE,CAAA","sourcesContent":["import { AIQueryApi } from './api/query-api.js'\nimport { PaymentsError } from './common/payments.error.js'\nimport { PaymentOptions } from './common/types.js'\nimport { BasePaymentsAPI } from './api/base-payments.js'\nimport { PlansAPI } from './api/plans-api.js'\nimport { ContractsAPI } from './api/contracts-api.js'\nimport { AgentsAPI } from './api/agents-api.js'\nimport { AgentRequestsAPI } from './api/requests-api.js'\nimport { ObservabilityAPI } from './api/observability-api/observability-api.js'\nimport { ClientRegistry } from './a2a/clientRegistry.js'\nimport type { PaymentsA2AServerOptions, PaymentsA2AServerResult } from './a2a/server.js'\nimport { PaymentsA2AServer } from './a2a/server.js'\nimport { buildPaymentAgentCard } from './a2a/agent-card.js'\nimport * as mcpModule from './mcp/index.js'\nimport { OrganizationsAPI } from './api/organizations-api/organizations-api.js'\nimport { OrdersAPI } from './api/orders-api.js'\nimport { FacilitatorAPI } from './x402/facilitator-api.js'\nimport { X402TokenAPI } from './x402/token.js'\nimport { DelegationAPI } from './x402/delegation-api.js'\nimport { MppAPI } from './mpp/mpp-api.js'\n\n/**\n * Main class that interacts with the Nevermined payments API.\n * Use `Payments.getInstance` for server-side usage or `Payments.getBrowserInstance` for browser usage.\n * @remarks This API requires a Nevermined API Key, which can be obtained by logging in to the Nevermined App.\n *\n * The library provides methods to manage AI Agents, Plans & process AI Agent Requests.\n *\n * Each of these functionalities is encapsulated in its own API class:\n * - `plans`: Manages AI Plans, including registration and ordering and retrieving plan details.\n * - `orders`: Browser-fiat Orders — merchant-initiated, off-plan charges for an arbitrary amount.\n * - `agents`: Handles AI Agents, including registration of AI Agents and access token generation.\n * - `requests`: Manages requests received by AI Agents, including validation and tracking.\n * - `observability`: Provides observability and logging utilities for AI Agents with Helicone integration\n */\nexport class Payments extends BasePaymentsAPI {\n public query!: AIQueryApi\n public plans!: PlansAPI\n public agents!: AgentsAPI\n public requests!: AgentRequestsAPI\n public observability!: ObservabilityAPI\n public organizations!: OrganizationsAPI\n public orders!: OrdersAPI\n public contracts!: ContractsAPI\n public facilitator!: FacilitatorAPI\n public x402!: X402TokenAPI\n /**\n * MPP (Machine Payments Protocol) surface — challenge/credential framing over\n * the same plans, delegations and credit burn as x402.\n *\n * @experimental Shipped ahead of its epic's declared MVP scope, so that the\n * Express middleware's own dependency on it is reachable rather than hidden\n * behind an internal handle. The NAME is settled — `payments.mpp` beside\n * `payments.x402` is what a seller will guess, and renaming it after a tag\n * costs a major. The SHAPE is not: this surface may change in a minor\n * release until the epic adopts it.\n */\n public mpp!: MppAPI\n private _a2aRegistry?: ClientRegistry\n private _delegation?: DelegationAPI\n\n /**\n * Cached MCP integration to preserve configuration (e.g., agentId, serverName)\n * across multiple getter accesses. This ensures callers do not need to retain\n * a reference to a previously configured instance.\n */\n private _mcpIntegration?: ReturnType<typeof mcpModule.buildMcpIntegration>\n\n /**\n * Exposes A2A server and client registry methods.\n * The client registry is initialized only if getClient is called.\n */\n public get a2a() {\n return {\n /**\n * Starts the A2A server with payment integration.\n * @param options - Server options.\n */\n start: (\n options: Omit<PaymentsA2AServerOptions, 'paymentsService'>,\n ): PaymentsA2AServerResult => PaymentsA2AServer.start({ ...options, paymentsService: this }),\n\n /**\n * Gets (or creates) a RegisteredPaymentsClient for the given alias.\n * The registry is initialized only on first use.\n * @param options - ClientRegistryOptions.\n */\n getClient: async (options: any) => {\n if (!this._a2aRegistry) {\n this._a2aRegistry = new ClientRegistry(this)\n }\n return await this._a2aRegistry.getClient(options)\n },\n }\n }\n\n /**\n * Returns the MCP integration API. The instance is memoized so that configuration\n * set via `configure({ agentId, serverName })` persists across calls.\n */\n public get mcp() {\n if (!this._mcpIntegration) {\n this._mcpIntegration = mcpModule.buildMcpIntegration(this)\n }\n return this._mcpIntegration\n }\n\n /**\n * Returns the Delegation API for listing enrolled payment methods.\n * The instance is lazily initialized on first access — the current\n * organization pin (set via `setOrganizationId` or the constructor\n * option) and the backend API version pin (`options.version`) are\n * forwarded so the first call carries the right `X-Current-Org-Id`\n * and `Nevermined-Version` headers.\n */\n public get delegation(): DelegationAPI {\n if (!this._delegation) {\n this._delegation = DelegationAPI.getInstance({\n nvmApiKey: this.nvmApiKey,\n environment: this.environmentName,\n organizationId: this.currentOrganizationId ?? undefined,\n version: this.version,\n })\n }\n return this._delegation\n }\n\n /**\n * Static A2A helpers and utilities.\n * Example: Payments.a2a.buildPaymentAgentCard(...)\n */\n static a2a = { buildPaymentAgentCard }\n\n /**\n * Get an instance of the Payments class for server-side usage.\n *\n * @param options - The options to initialize the payments class.\n * @example\n * ```\n * const payments = Payments.getInstance({\n * nvmApiKey: 'your-nvm-api-key',\n * environment: 'sandbox'\n * })\n * ```\n * @returns An instance of {@link Payments}\n * @throws PaymentsError if nvmApiKey is missing.\n */\n static getInstance(options: PaymentOptions) {\n if (!options.nvmApiKey) {\n throw new PaymentsError('Nevermined API Key is required')\n }\n return new Payments(options, false)\n }\n\n /**\n * Get an instance of the Payments class for browser usage.\n *\n * @remarks\n * This is a browser-only function.\n *\n * @param options - The options to initialize the payments class.\n * @example\n * ```\n * const payments = Payments.getBrowserInstance({\n * returnUrl: 'https://mysite.example',\n * environment: 'sandbox',\n * appId: 'my-app-id',\n * version: '1.1'\n * })\n * ```\n * @returns An instance of {@link Payments}\n * @throws PaymentsError if returnUrl is missing.\n */\n static getBrowserInstance(options: PaymentOptions) {\n if (!options.returnUrl) {\n throw new PaymentsError('returnUrl is required')\n }\n const url = new URL(window.location.href)\n const urlNvmApiKey = url.searchParams.get('nvmApiKey') as string\n if (urlNvmApiKey) {\n url.searchParams.delete('nvmApiKey')\n }\n\n const urlAccountAddress = url.searchParams.get('accountAddress') as string\n if (urlAccountAddress) {\n url.searchParams.delete('accountAddress')\n }\n\n history.replaceState(history.state, '', url.toString())\n\n return new Payments(options, true)\n }\n\n /**\n * Initializes the Payments class.\n *\n * @param options - The options to initialize the payments class.\n * @param isBrowserInstance - Whether this instance is for browser usage.\n */\n private constructor(options: PaymentOptions, isBrowserInstance = true) {\n super(options)\n\n this.isBrowserInstance = isBrowserInstance\n this.initializeApi(options)\n }\n\n /**\n * Initializes the AI Query Protocol API.\n */\n private initializeApi(options: PaymentOptions) {\n this.plans = PlansAPI.getInstance(options)\n this.agents = AgentsAPI.getInstance(options)\n this.requests = AgentRequestsAPI.getInstance(options)\n this.observability = ObservabilityAPI.getInstance(options)\n this.organizations = OrganizationsAPI.getInstance(options)\n this.orders = OrdersAPI.getInstance(options)\n this.query = AIQueryApi.getInstance()\n this.contracts = new ContractsAPI(options)\n this.facilitator = FacilitatorAPI.getInstance(options)\n this.x402 = X402TokenAPI.getInstance(options)\n this.mpp = MppAPI.getInstance(options)\n }\n\n /**\n * Initiates the connect flow. The user's browser will be redirected to\n * the Nevermined App login page.\n *\n * @remarks\n * This is a browser-only function.\n * @example\n * ```\n * payments.connect()\n * ```\n */\n public connect() {\n if (!this.isBrowserInstance) return\n const url = new URL(`/login?returnUrl=${this.returnUrl}`, this.environment.frontend)\n window.location.href = url.toString()\n }\n\n /**\n * Logs out the user by removing the NVM API key.\n *\n * @remarks\n * This is a browser-only function.\n * @example\n * ```\n * payments.logout()\n * ```\n */\n public logout() {\n this.nvmApiKey = ''\n }\n\n /**\n * Pins (or clears) the active organization workspace used by every\n * subsequent authenticated request. The SDK forwards the choice as the\n * `X-Current-Org-Id` header so the backend scopes publications and\n * other org-aware queries to the requested organization.\n *\n * Pass `null` to clear the pin and let the backend fall back to the\n * API key's org tag or the caller's most-recent active membership.\n *\n * For one-off targeting (e.g. publish a single agent into Org B without\n * leaving Org B as the active workspace) prefer the per-call\n * `{ organizationId }` option on `agents.registerAgent` /\n * `plans.registerPlan` / similar.\n *\n * @param organizationId - Org ID to pin (e.g. `org-…`) or `null` to clear.\n * @example\n * ```ts\n * payments.setOrganizationId('org-abc123')\n * await payments.agents.registerAgent(metadata, api, [planId]) // lands in org-abc123\n * ```\n */\n public override setOrganizationId(organizationId: string | null): void {\n super.setOrganizationId(organizationId)\n this.plans?.setOrganizationId(organizationId)\n this.agents?.setOrganizationId(organizationId)\n this.requests?.setOrganizationId(organizationId)\n this.observability?.setOrganizationId(organizationId)\n this.organizations?.setOrganizationId(organizationId)\n this.orders?.setOrganizationId(organizationId)\n this.contracts?.setOrganizationId(organizationId)\n this.facilitator?.setOrganizationId(organizationId)\n this.x402?.setOrganizationId(organizationId)\n this.mpp?.setOrganizationId(organizationId)\n // `_delegation` is lazy — the getter forwards `currentOrganizationId`\n // on first access, so only propagate to an already-built instance.\n // (Eagerly constructing it here would change the lazy contract.)\n this._delegation?.setOrganizationId(organizationId)\n }\n\n /**\n * Checks if a user is logged in.\n * @example\n * ```\n * payments.isLoggedIn\n * ```\n * @returns True if the user is logged in.\n */\n get isLoggedIn(): boolean {\n return this.nvmApiKey.length > 0\n }\n}\n"]}
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/x402/express/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE9D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAA;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAWzB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9E,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,cAAc,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;AAExD;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB,gDAAgD;;IAEhD,mEAAmE;;IAEnE,sEAAsE;;CAE9D,CAAA;AAEV;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,kCAAkC;IAClC,eAAe,EAAE,mBAAmB,CAAA;IACpC,kCAAkC;IAClC,eAAe,EAAE,MAAM,CAAA;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,iBAAiB,CAAA;IAChC,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,0EAA0E;IAC1E,GAAG,CAAC,EAAE;QACJ,gEAAgE;QAChE,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAA;IACpE,sCAAsC;IACtC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,mBAAmB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7F;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7F,8CAA8C;IAC9C,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7F;AA48BD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,CAwPnB;AAED,eAAe,iBAAiB,CAAA"}
1
+ {"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/x402/express/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE9D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAA;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAYzB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9E,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,cAAc,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;AAExD;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB,gDAAgD;;IAEhD,mEAAmE;;IAEnE,sEAAsE;;CAE9D,CAAA;AAEV;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,kCAAkC;IAClC,eAAe,EAAE,mBAAmB,CAAA;IACpC,kCAAkC;IAClC,eAAe,EAAE,MAAM,CAAA;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,iBAAiB,CAAA;IAChC,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,0EAA0E;IAC1E,GAAG,CAAC,EAAE;QACJ,gEAAgE;QAChE,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAA;IACpE,sCAAsC;IACtC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,mBAAmB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7F;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7F,8CAA8C;IAC9C,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7F;AA+/BD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,CA8SnB;AAED,eAAe,iBAAiB,CAAA"}
@@ -48,6 +48,7 @@
48
48
  import { buildPaymentRequired, resolveNetwork, resolveScheme, } from '../facilitator-api.js';
49
49
  import { MPP_HEADERS, extractCredential, mppCredentialId, mppResource, mppVerb, resolveMppOption, } from './mpp-support.js';
50
50
  import { computeBodyDigest, getRawBody } from './raw-body.js';
51
+ import { isAccessTokenAlreadyUsed, X402_TOKEN_ALREADY_USED_CODE } from '../token-version.js';
51
52
  import { MppError, MppCredentialRejectedError, MppSettlementOutcomeUnknownError, isRetryableMppCode, } from '../../mpp/errors.js';
52
53
  import { normalizeCredits } from '../../mpp/mpp-api.js';
53
54
  /**
@@ -299,6 +300,55 @@ function isCredentialSpent(credentialId) {
299
300
  }
300
301
  return true;
301
302
  }
303
+ /**
304
+ * How long a spent x402 access token stays refused.
305
+ *
306
+ * A v3 token has no expiry the seller can read, so this is a memory bound
307
+ * rather than a semantic one: past it the backend still refuses the token with
308
+ * `BCK.X402.0059`, and the only thing lost is this edge's ability to refuse it
309
+ * BEFORE running the handler. An hour is far longer than any plausible replay
310
+ * window and keeps the map small.
311
+ */
312
+ const SPENT_X402_TOKEN_TTL_MS = 3600000;
313
+ /**
314
+ * Access tokens whose settlement was refused as already spent
315
+ * (`BCK.X402.0059`), and the instant each stops being worth remembering.
316
+ *
317
+ * Single-use (v3) tokens turn a previously harmless swallow into free service.
318
+ * `verify()` is a dry run the seller may repeat, so the backend deliberately
319
+ * never consults the nonce there — only `settle` spends it. A buyer replaying a
320
+ * spent token therefore verifies clean, the handler runs, and settlement throws
321
+ * afterwards. Under v2 that cost the seller nothing (settle always burned); a
322
+ * v3 replay would be served for free, repeatably, by anyone who has seen one
323
+ * used token.
324
+ *
325
+ * So single-use is the seller edge's job here, exactly as it is for MPP
326
+ * credentials — see {@link spentMppCredentials}, whose shape this mirrors.
327
+ *
328
+ * Same process-local caveat: this does not span processes or horizontally
329
+ * scaled instances, which need a shared store this package does not provide.
330
+ */
331
+ const spentX402Tokens = new Map();
332
+ function markX402TokenSpent(token) {
333
+ const now = Date.now();
334
+ for (const [spent, expiresAt] of spentX402Tokens) {
335
+ if (expiresAt > now)
336
+ break;
337
+ spentX402Tokens.delete(spent);
338
+ }
339
+ spentX402Tokens.set(token, now + SPENT_X402_TOKEN_TTL_MS);
340
+ }
341
+ /** Whether this access token has already been settled once at this edge. */
342
+ function isX402TokenSpent(token) {
343
+ const expiresAt = spentX402Tokens.get(token);
344
+ if (expiresAt === undefined)
345
+ return false;
346
+ if (expiresAt <= Date.now()) {
347
+ spentX402Tokens.delete(token);
348
+ return false;
349
+ }
350
+ return true;
351
+ }
302
352
  /**
303
353
  * The MPP request path.
304
354
  *
@@ -1001,6 +1051,20 @@ export function paymentMiddleware(payments, routes, options = {}) {
1001
1051
  sendPaymentRequired(res, paymentRequired, `Missing x402 payment token. Send token in ${X402_HEADERS.PAYMENT_SIGNATURE} header.`);
1002
1052
  return;
1003
1053
  }
1054
+ // A token this edge already settled once is refused here, before the
1055
+ // handler runs. `verify` cannot catch it — the backend never consults the
1056
+ // nonce there — so without this the buyer is served and settlement fails
1057
+ // afterwards, which for a single-use token means free service.
1058
+ if (isX402TokenSpent(token)) {
1059
+ const error = new Error('Payment required: this x402 access token was already used');
1060
+ if (onPaymentError) {
1061
+ onPaymentError(error, req, res);
1062
+ return;
1063
+ }
1064
+ sendPaymentRequired(res, paymentRequired, 'This x402 access token was already used. Single-use (v3) tokens are consumed by their ' +
1065
+ 'first settlement — mint a new token for this request.');
1066
+ return;
1067
+ }
1004
1068
  // Calculate credits to verify
1005
1069
  const creditsToVerify = typeof credits === 'function' ? await credits(req, res) : credits;
1006
1070
  try {
@@ -1083,9 +1147,21 @@ export function paymentMiddleware(payments, routes, options = {}) {
1083
1147
  });
1084
1148
  })
1085
1149
  .catch((settleError) => {
1150
+ // A settle refused as already-spent is not a transient failure:
1151
+ // the token bought a response once and must not buy another.
1152
+ // Remember it so the NEXT request is refused before the handler
1153
+ // runs, and tell the buffered path below to withhold this body.
1154
+ if (isAccessTokenAlreadyUsed(settleError)) {
1155
+ markX402TokenSpent(token);
1156
+ spentTokenRefusal = settleError;
1157
+ }
1086
1158
  console.error('Payment settlement failed:', settleError);
1087
1159
  });
1088
1160
  };
1161
+ // Set when settlement was refused because the token had already been
1162
+ // spent, so the `end` wrapper can withhold a body that was never paid
1163
+ // for. Only reachable on a single-use (v3) token.
1164
+ let spentTokenRefusal = null;
1089
1165
  res.end = function (...args) {
1090
1166
  // Only bill on 2xx success. Skipping 3xx avoids charging when the
1091
1167
  // handler redirects (e.g. `res.redirect(...)`), 304 Not Modified,
@@ -1111,8 +1187,29 @@ export function paymentMiddleware(payments, routes, options = {}) {
1111
1187
  return originalEnd(...args);
1112
1188
  }
1113
1189
  // Buffered response path: defer the real `end` until settlement
1114
- // finishes so the receipt header makes it into the same response.
1190
+ // finishes so the receipt header makes it into the same response —
1191
+ // and so a settlement refused as already-spent can still withhold the
1192
+ // body the handler produced.
1115
1193
  runSettlement().finally(() => {
1194
+ if (spentTokenRefusal && !res.headersSent) {
1195
+ // The handler already ran, so the work is done and wasted; what
1196
+ // must not happen is delivering it. Replace the body with the
1197
+ // 402 the buyer would have got had `verify` been able to see the
1198
+ // spent nonce.
1199
+ const payload = JSON.stringify({
1200
+ error: 'This x402 access token was already used. Single-use (v3) tokens are consumed ' +
1201
+ 'by their first settlement — mint a new token for this request.',
1202
+ code: X402_TOKEN_ALREADY_USED_CODE,
1203
+ });
1204
+ res.statusCode = 402;
1205
+ res.removeHeader('ETag');
1206
+ res.setHeader('Content-Type', 'application/json');
1207
+ res.setHeader('Content-Length', Buffer.byteLength(payload));
1208
+ // `originalEnd` is Express's overloaded `end`; the 3-arg form
1209
+ // (chunk, encoding, callback) is the one its type accepts here.
1210
+ originalEnd(payload, 'utf8');
1211
+ return;
1212
+ }
1116
1213
  originalEnd(...args);
1117
1214
  });
1118
1215
  return res;