@obbyx/sdk 0.1.1 → 0.2.1

package/dist/seller/x402-server.js

@@ -1,7 +1,7 @@
 import { decodePaymentSignatureHeader } from '@x402/core/http';
-import { ObbyxError, fromDisplay, getNetwork, isAssetId, networkKey, parseAmount, } from '@obbyx/obyte';
+import { CHANNEL_BASE_AA, ObbyxError, fromDisplay, getNetwork, isAssetId, networkKey, parseAmount, } from '@obbyx/obyte';
 import { moduleLogger } from '@obbyx/obyte/logger';
-import { EXACT_SCHEME, bindingsEqual, exactExtraSchema } from '@obbyx/x402-obyte';
+import { BATCH_SCHEME, EXACT_SCHEME, batchExtraSchema, bindingsEqual, canonical, exactExtraSchema, sha256Hex, } from '@obbyx/x402-obyte';
 import { DEFAULT_QUOTE_TTL_SECONDS, DEFAULT_SERVING_LEASE_SECONDS } from './defaults.js';
 import { bodyHashOf, newQuote, offerBinding } from './quote.js';
 function requestOf(transportContext) {
@@ -17,9 +17,10 @@ function requestOf(transportContext) {
         paymentHeader: typeof request?.['paymentHeader'] === 'string' ? request['paymentHeader'] : undefined,
     };
 }
-export class ObyteExactServer {
+export class ObyteSchemeServer {
     options;
-    scheme = EXACT_SCHEME;
+    spec;
+    scheme;
     defaultAssetTransferMethod = 'default';
     paymentFlows = {
         default: { supported: ['upfront'], default: 'upfront' },
@@ -28,22 +29,24 @@ export class ObyteExactServer {
     schemeHooks;
     log;
     now;
-    constructor(options) {
+    constructor(options, spec) {
         this.options = options;
-        this.log = moduleLogger(options.logger, 'sdk.x402-server', { scheme: EXACT_SCHEME });
+        this.spec = spec;
+        this.scheme = spec.scheme;
+        this.log = moduleLogger(options.logger, 'sdk.x402-server', { scheme: spec.scheme });
         this.now = options.now ?? (() => Math.floor(Date.now() / 1000));
         this.schemeHooks = {
             onBeforeVerify: async (ctx) => {
-                const unit = ctx.paymentPayload.payload.unit?.unit;
+                const key = this.keyOf(ctx);
                 const binding = ctx.requirements.extra.binding;
-                if (typeof unit !== 'string' || typeof binding !== 'string') {
+                if (key === undefined || typeof binding !== 'string') {
                     return { abort: true, reason: 'invalid_payload' };
                 }
-                const { record } = this.options.proofs.begin(this.key(ctx.requirements.network, unit), binding);
+                const { record } = this.options.proofs.begin(key, binding);
                 if (!bindingsEqual(record.binding, binding))
                     return { abort: true, reason: 'invalid_payment_reused' };
                 if (record.state === 'served') {
-                    this.log.warn({ proofId: unit }, 'payment already served a request; refused');
+                    this.log.warn({ proofId: key }, 'payment already served a request; refused');
                     return { abort: true, reason: 'payment_already_used' };
                 }
                 return undefined;
@@ -121,7 +124,7 @@ export class ObyteExactServer {
     getAssetDecimals(asset) {
         return asset === 'base' ? 9 : undefined;
     }
-    /** Nothing to add from /supported for exact; the per-request fields come from the enrich hook. */
+    /** Nothing to add from /supported; the per-request fields come from the enrich hook. */
     async enhancePaymentRequirements(requirements) {
         return requirements;
     }
@@ -129,21 +132,22 @@ export class ObyteExactServer {
     enrichPaymentRequiredResponse = async (ctx) => {
         const request = requestOf(ctx.transportContext);
         if (request === undefined)
-            throw new ObbyxError('no_request', 'Obyte exact needs the HTTP request context');
+            throw new ObbyxError('no_request', `Obyte ${this.scheme} needs the HTTP request context`);
         const accepted = this.acceptedQuote(request);
         return ctx.requirements.map((req) => {
-            if (req.scheme !== EXACT_SCHEME)
+            if (req.scheme !== this.spec.scheme)
                 return req;
             const quote = accepted !== undefined &&
                 bindingsEqual(this.bindingFor(req, request, accepted), accepted.binding)
                 ? accepted
                 : undefined;
+            const extra = { ...req.extra, ...this.spec.staticExtra };
             if (quote !== undefined)
-                return { ...req, extra: { ...req.extra, ...quote } };
+                return { ...req, extra: { ...extra, ...quote } };
             const fresh = newQuote(this.now(), this.options.quoteTtlSeconds ?? DEFAULT_QUOTE_TTL_SECONDS);
             return {
                 ...req,
-                extra: { ...req.extra, binding: this.bindingFor(req, request, fresh), ...fresh },
+                extra: { ...extra, binding: this.bindingFor(req, request, fresh), ...fresh },
             };
         });
     };
@@ -151,23 +155,60 @@ export class ObyteExactServer {
         if (request.paymentHeader === undefined)
             return undefined;
         try {
-            const extra = exactExtraSchema.safeParse(decodePaymentSignatureHeader(request.paymentHeader).accepted?.extra);
-            return extra.success ? extra.data : undefined;
+            const accepted = decodePaymentSignatureHeader(request.paymentHeader).accepted;
+            if (accepted?.scheme !== this.spec.scheme)
+                return undefined;
+            const extra = this.spec.acceptedExtra(accepted.extra);
+            return { quoteId: extra.quoteId, validUntil: extra.validUntil, binding: extra.binding };
         }
         catch {
             return undefined;
         }
     }
     bindingFor(req, request, quote) {
-        return offerBinding(this.options, EXACT_SCHEME, quote, { method: request.method, url: request.url, bodyHash: bodyHashOf(request.body) }, { network: req.network, asset: req.asset, amount: req.amount, payTo: req.payTo });
+        return offerBinding(this.options, this.spec.scheme, quote, { method: request.method, url: request.url, bodyHash: bodyHashOf(request.body) }, { network: req.network, asset: req.asset, amount: req.amount, payTo: req.payTo });
     }
     /** Proof key of the payment in a hook context (undefined when malformed). */
     keyOf(ctx) {
-        const unit = ctx.paymentPayload.payload.unit?.unit;
-        return typeof unit === 'string' ? this.key(ctx.requirements.network, unit) : undefined;
+        const proof = this.spec.proofOf(ctx.paymentPayload.payload);
+        return proof === undefined
+            ? undefined
+            : networkKey(getNetwork(ctx.requirements.network), proof.kind, proof.id);
+    }
+}
+/** `exact`: the proof is the unit (key `<network>:unit:<hash>`, as ObytePaywall). */
+export class ObyteExactServer extends ObyteSchemeServer {
+    constructor(options) {
+        super(options, {
+            scheme: EXACT_SCHEME,
+            staticExtra: {},
+            acceptedExtra: (extra) => exactExtraSchema.parse(extra),
+            proofOf: (payload) => {
+                const unit = payload.unit?.unit;
+                return typeof unit === 'string' ? { kind: 'unit', id: unit } : undefined;
+            },
+        });
     }
-    key(network, unit) {
-        return networkKey(getNetwork(network), 'unit', unit);
+}
+/**
+ * `batch-settlement` (AA payment channels): the proof is the voucher (key
+ * `<network>:voucher:<sha256 of the canonical signed package>`, as
+ * ObytePaywall). Offers carry the channel base AA and the minimum dispute
+ * window. Needs a facilitator with batch-settlement and the seller's watcher.
+ */
+export class ObyteBatchServer extends ObyteSchemeServer {
+    constructor(options) {
+        super(options, {
+            scheme: BATCH_SCHEME,
+            staticExtra: { baseAa: CHANNEL_BASE_AA, minTimeout: options.minChannelTimeoutSeconds },
+            acceptedExtra: (extra) => batchExtraSchema.parse(extra),
+            proofOf: (payload) => {
+                const pkg = payload['signedPackage'];
+                return pkg !== null && typeof pkg === 'object'
+                    ? { kind: 'voucher', id: sha256Hex(canonical(pkg)) }
+                    : undefined;
+            },
+        });
     }
 }
 //# sourceMappingURL=x402-server.js.map

package/dist/seller/x402-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"x402-server.js","sourceRoot":"","sources":["../../src/seller/x402-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAU/D,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,SAAS,EACT,UAAU,EACV,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAe,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElF,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAc,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAqC5E,SAAS,SAAS,CAAC,gBAAyB;IAC1C,MAAM,OAAO,GAAI,gBAAsE,EAAE,OAAO,CAAC;IACjG,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,SAAS,CACyC,CAAC;IAC7E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;QAC9B,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE;QACzB,aAAa,EACX,OAAO,OAAO,EAAE,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;KACxF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IAWE;IAVpB,MAAM,GAAG,YAAY,CAAC;IACtB,0BAA0B,GAAG,SAAS,CAAC;IACvC,YAAY,GAAG;QACtB,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAU,EAAE,OAAO,EAAE,SAAkB,EAAE;KAC1E,CAAC;IACO,kBAAkB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1D,WAAW,CAAoB;IACvB,GAAG,CAAS;IACZ,GAAG,CAAe;IAEnC,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;QAC3D,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,GAAG;YACjB,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,IAAI,GAAI,GAAG,CAAC,cAAc,CAAC,OAAyC,CAAC,IAAI,EAAE,IAAI,CAAC;gBACtF,MAAM,OAAO,GAAI,GAAG,CAAC,YAAY,CAAC,KAA+B,CAAC,OAAO,CAAC;gBAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC5D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACpD,CAAC;gBACD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EACxC,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;oBACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC;oBAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBACzD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,0EAA0E;YAC1E,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnC,0EAA0E;gBAC1E,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,6BAA6B,CAAC,CAAC;gBAC5F,IACE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC;oBAC7C,+EAA+E;oBAC/E,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,SAAS,CAAC,EACpD,CAAC;oBACD,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,oDAAoD,CAAC,CAAC;gBAC/E,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;iBAC5E,CAAC;YACJ,CAAC;YACD,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO;gBAC9B,0EAA0E;gBAC1E,wDAAwD;gBACxD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;;oBAC5E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,uEAAuE;YACvE,6EAA6E;YAC7E,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO;gBAC9B,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;gBACnE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EACtB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACpF,CAAC;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,UAAU,CAAC,KAAY,EAAE,OAAgB;QAC7C,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;gBACzB,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iBAAiB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GACnB,gDAAgD,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,0BAA0B,CAC9B,YAAiC;QAEjC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,0FAA0F;IAC1F,6BAA6B,GAAG,KAAK,EACnC,GAAiC,EACD,EAAE;QAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS;YACvB,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,4CAA4C,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClC,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;gBAAE,OAAO,GAAG,CAAC;YAC5C,MAAM,KAAK,GACT,QAAQ,KAAK,SAAS;gBACtB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC;gBACtE,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAC;YAC9F,OAAO;gBACL,GAAG,GAAG;gBACN,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE;aACjF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEM,aAAa,CAAC,OAAoB;QACxC,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CACtC,4BAA4B,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,KAAK,CACpE,CAAC;YACF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,GAAwB,EAAE,OAAoB,EAAE,KAAY;QAC7E,OAAO,YAAY,CACjB,IAAI,CAAC,OAAO,EACZ,YAAY,EACZ,KAAK,EACL,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAChF,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CACjF,CAAC;IACJ,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,GAGb;QACC,MAAM,IAAI,GAAI,GAAG,CAAC,cAAc,CAAC,OAAyC,CAAC,IAAI,EAAE,IAAI,CAAC;QACtF,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,CAAC;IAEO,GAAG,CAAC,OAAe,EAAE,IAAY;QACvC,OAAO,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"x402-server.js","sourceRoot":"","sources":["../../src/seller/x402-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAU/D,OAAO,EACL,eAAe,EACf,UAAU,EACV,WAAW,EACX,UAAU,EACV,SAAS,EACT,UAAU,EACV,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAe,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAc,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAuC5E,SAAS,SAAS,CAAC,gBAAyB;IAC1C,MAAM,OAAO,GAAI,gBAAsE,EAAE,OAAO,CAAC;IACjG,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,SAAS,CACyC,CAAC;IAC7E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;QAC9B,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE;QACzB,aAAa,EACX,OAAO,OAAO,EAAE,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;KACxF,CAAC;AACJ,CAAC;AA0BD,MAAM,OAAgB,iBAAiB;IAYlB;IACA;IAZV,MAAM,CAAS;IACf,0BAA0B,GAAG,SAAS,CAAC;IACvC,YAAY,GAAG;QACtB,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAU,EAAE,OAAO,EAAE,SAAkB,EAAE;KAC1E,CAAC;IACO,kBAAkB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1D,WAAW,CAAoB;IACvB,GAAG,CAAS;IACZ,GAAG,CAAe;IAEnC,YACmB,OAAiC,EACjC,IAAqB;QADrB,YAAO,GAAP,OAAO,CAA0B;QACjC,SAAI,GAAJ,IAAI,CAAiB;QAEtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,GAAG;YACjB,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,OAAO,GAAI,GAAG,CAAC,YAAY,CAAC,KAA+B,CAAC,OAAO,CAAC;gBAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACpD,CAAC;gBACD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;oBACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;gBAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,2CAA2C,CAAC,CAAC;oBAC7E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBACzD,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,0EAA0E;YAC1E,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnC,0EAA0E;gBAC1E,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,6BAA6B,CAAC,CAAC;gBAC5F,IACE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC;oBAC7C,+EAA+E;oBAC/E,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,SAAS,CAAC,EACpD,CAAC;oBACD,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;gBAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,oDAAoD,CAAC,CAAC;gBAC/E,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;iBAC5E,CAAC;YACJ,CAAC;YACD,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO;gBAC9B,0EAA0E;gBAC1E,wDAAwD;gBACxD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;;oBAC5E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,uEAAuE;YACvE,6EAA6E;YAC7E,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO;gBAC9B,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;gBACnE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EACtB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACpF,CAAC;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,UAAU,CAAC,KAAY,EAAE,OAAgB;QAC7C,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;gBACzB,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iBAAiB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GACnB,gDAAgD,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,0BAA0B,CAC9B,YAAiC;QAEjC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,0FAA0F;IAC1F,6BAA6B,GAAG,KAAK,EACnC,GAAiC,EACD,EAAE;QAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS;YACvB,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,SAAS,IAAI,CAAC,MAAM,iCAAiC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAC;YAChD,MAAM,KAAK,GACT,QAAQ,KAAK,SAAS;gBACtB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC;gBACtE,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACzD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;YAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAC;YAC9F,OAAO;gBACL,GAAG,GAAG;gBACN,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE;aAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEM,aAAa,CAAC,OAAoB;QACxC,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC;YAC9E,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,GAAwB,EAAE,OAAoB,EAAE,KAAY;QAC7E,OAAO,YAAY,CACjB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,KAAK,EACL,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAChF,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CACjF,CAAC;IACJ,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,GAGb;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,OAAiC;QAC3C,KAAK,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,YAAY;YACpB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;YACvD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACnB,MAAM,IAAI,GAAI,OAAyC,CAAC,IAAI,EAAE,IAAI,CAAC;gBACnE,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,OAAgC;QAC1C,KAAK,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,YAAY;YACpB,WAAW,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,wBAAwB,EAAE;YACtF,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;YACvD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBACnB,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;gBACrC,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;oBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE;oBACpD,CAAC,CAAC,SAAS,CAAC;YAChB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@obbyx/sdk",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Accept and make x402 payments on Obyte: Express paywall, adapter for the official @x402 servers, paying fetch with spending budgets",
   "keywords": [
     "x402",
@@ -43,8 +43,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@obbyx/obyte": "^0.1.0",
-    "@obbyx/x402-obyte": "^0.2.0",
+    "@obbyx/obyte": "^0.1.1",
+    "@obbyx/x402-obyte": "^0.2.2",
     "@x402/core": "^2.29.0",
     "obyte": "0.2.1",
     "zod": "^4.6.7"

package/src/client/paying-fetch.ts

@@ -5,7 +5,13 @@ import {
   decodePaymentSignatureHeader,
   encodePaymentSignatureHeader,
 } from '@x402/core/http';
-import type { PaymentPayload, PaymentRequirements, SettleResponse } from '@x402/core/types';
+import type {
+  PaymentPayload,
+  PaymentPayloadResult,
+  PaymentRequired,
+  PaymentRequirements,
+  SettleResponse,
+} from '@x402/core/types';
 import { ObbyxError } from '@obbyx/obyte';
 import { type Logger, moduleLogger } from '@obbyx/obyte/logger';
 import type { BudgetReservation, SpendingBudget } from './budget.js';
@@ -84,59 +90,13 @@ export async function payingFetch(
     const required = response.headers.get('PAYMENT-REQUIRED');
     if (required === null)
       throw new ObbyxError('invalid_402', '402 without PAYMENT-REQUIRED header');
-    const offer = decodePaymentRequiredHeader(required);
-    // Offers in preference order (channel first). A channel that turns out to
-    // be unusable before anything is signed (not funded, closing, exhausted,
-    // busy) falls through to the next offer, normally `exact`.
-    let accepted: PaymentRequirements | undefined;
-    let result: Awaited<ReturnType<ExactObyteClient['createPaymentPayload']>> | undefined;
-    let lastChannelError: ObbyxError | undefined;
-    for (const candidate of chooseOffers(offer.accepts, options)) {
-      const mechanism =
-        candidate.scheme === BATCH_SCHEME ? options.mechanisms.batch : options.mechanisms.exact;
-      if (mechanism === undefined) continue;
-      log.info(
-        {
-          url,
-          scheme: candidate.scheme,
-          payTo: candidate.payTo,
-          asset: candidate.asset,
-          amount: candidate.amount,
-        },
-        'paying for request',
-      );
-      // Reserve the price BEFORE signing: concurrent calls cannot overshoot the budget.
-      reservation = options.budget?.reserve(candidate.asset, BigInt(candidate.amount));
-      try {
-        result = await mechanism.createPaymentPayload(2, candidate);
-        accepted = candidate;
-        break;
-      } catch (err) {
-        if (reservation) options.budget?.release(reservation); // nothing was signed or sent
-        reservation = undefined;
-        if (err instanceof ObbyxError && CHANNEL_UNUSABLE.has(err.code)) {
-          lastChannelError = err;
-          log.info(
-            { reason: err.code, detail: err.message },
-            'channel unusable; trying the next offer',
-          );
-          continue;
-        }
-        throw err;
-      }
-    }
-    if (accepted === undefined || result === undefined) {
-      // Nothing else to pay with: report why the channel could not (e.g. payment_pending).
-      throw lastChannelError ?? new ObbyxError('no_acceptable_offer', 'No offer could be paid');
-    }
-    const payload: PaymentPayload = {
-      x402Version: 2,
-      resource: offer.resource,
-      accepted,
-      payload: result.payload,
-      ...(offer.extensions ? { extensions: withPaymentId(offer.extensions, init.paymentId) } : {}),
-    };
-    header = encodePaymentSignatureHeader(payload);
+    ({ header, reservation } = await signPayment(
+      decodePaymentRequiredHeader(required),
+      init.paymentId,
+      url,
+      options,
+      log,
+    ));
     response = await request(header);
   }
 
@@ -144,16 +104,7 @@ export async function payingFetch(
   for (;;) {
     const settle = readSettle(response);
     if (response.status !== 402 || settle?.errorReason !== 'settlement_pending') {
-      const accepted = acceptedOf(header);
-      if (accepted?.scheme === BATCH_SCHEME) options.mechanisms.batch?.onSettled(accepted, settle);
-      if (reservation !== undefined && options.budget !== undefined) {
-        // I7: spend on success; release ONLY on a definite refusal (402: the
-        // payment was not used). Anything else (5xx, 409, no settlement info)
-        // is an unknown outcome: the reservation stays counted.
-        if (settle?.success === true || (response.ok && settle === undefined))
-          options.budget.spend(reservation);
-        else if (response.status === 402) options.budget.release(reservation);
-      }
+      recordOutcome(response, settle, header, reservation, options);
       return { response, ...(settle ? { payment: settle } : {}), paymentHeader: header };
     }
     if (Date.now() > deadline) throw new PaymentPendingError(header, settle.transaction);
@@ -169,6 +120,87 @@ export async function payingFetch(
   }
 }
 
+/**
+ * Signs a payment for the first usable offer, in preference order (channel
+ * first). A channel that turns out to be unusable before anything is signed
+ * (not funded, closing, exhausted, busy) falls through to the next offer,
+ * normally `exact`. The price is reserved in the budget BEFORE signing, so
+ * concurrent calls cannot overshoot it.
+ */
+async function signPayment(
+  offer: PaymentRequired,
+  paymentId: string | undefined,
+  url: string,
+  options: PayingFetchOptions,
+  log: Logger,
+): Promise<{ header: string; reservation: BudgetReservation | undefined }> {
+  let lastChannelError: ObbyxError | undefined;
+  for (const candidate of chooseOffers(offer.accepts, options)) {
+    const mechanism =
+      candidate.scheme === BATCH_SCHEME ? options.mechanisms.batch : options.mechanisms.exact;
+    if (mechanism === undefined) continue;
+    log.info(
+      {
+        url,
+        scheme: candidate.scheme,
+        payTo: candidate.payTo,
+        asset: candidate.asset,
+        amount: candidate.amount,
+      },
+      'paying for request',
+    );
+    const reservation = options.budget?.reserve(candidate.asset, BigInt(candidate.amount));
+    let result: PaymentPayloadResult;
+    try {
+      result = await mechanism.createPaymentPayload(2, candidate);
+    } catch (err) {
+      if (reservation) options.budget?.release(reservation); // nothing was signed or sent
+      if (err instanceof ObbyxError && CHANNEL_UNUSABLE.has(err.code)) {
+        lastChannelError = err;
+        log.info(
+          { reason: err.code, detail: err.message },
+          'channel unusable; trying the next offer',
+        );
+        continue;
+      }
+      throw err;
+    }
+    const payload: PaymentPayload = {
+      x402Version: 2,
+      resource: offer.resource,
+      accepted: candidate,
+      payload: result.payload,
+      ...(offer.extensions ? { extensions: withPaymentId(offer.extensions, paymentId) } : {}),
+    };
+    return { header: encodePaymentSignatureHeader(payload), reservation };
+  }
+  // Nothing else to pay with: report why the channel could not (e.g. payment_pending).
+  throw lastChannelError ?? new ObbyxError('no_acceptable_offer', 'No offer could be paid');
+}
+
+/**
+ * Applies the final answer: the channel voucher is confirmed or released, and
+ * the budget reservation is spent on success and released ONLY on a definite
+ * refusal (402: the payment was not used). Anything else (5xx, 409, no
+ * settlement info) is an unknown outcome: the reservation stays counted (I7).
+ */
+function recordOutcome(
+  response: Response,
+  settle: SettleResponse | undefined,
+  header: string,
+  reservation: BudgetReservation | undefined,
+  options: PayingFetchOptions,
+): void {
+  const accepted = acceptedOf(header);
+  if (accepted?.scheme === BATCH_SCHEME) options.mechanisms.batch?.onSettled(accepted, settle);
+  if (reservation === undefined || options.budget === undefined) return;
+  if (settle?.success === true || (response.ok && settle === undefined)) {
+    options.budget.spend(reservation);
+  } else if (response.status === 402) {
+    options.budget.release(reservation);
+  }
+}
+
 /** An offer from an untrusted seller: integer amount in smallest units, strings elsewhere. */
 const offerShape = z
   .object({

package/src/index.ts

@@ -32,4 +32,13 @@ export {
   type BudgetReservation,
   SpendingBudget,
 } from './client/budget.js';
-export { ObyteExactServer, type ObyteExactServerOptions } from './seller/x402-server.js';
+export {
+  ObyteBatchServer,
+  type ObyteBatchServerOptions,
+  ObyteExactServer,
+  type ObyteExactServerOptions,
+  ObyteSchemeServer,
+  type ObyteSchemeSpec,
+  type ObyteSchemeServerOptions,
+} from './seller/x402-server.js';
+export type { PaywallCorsOptions } from './seller/cors.js';

package/src/seller/consumed-proofs.ts

@@ -181,22 +181,16 @@ export class ConsumedProofsStore {
    */
   markSettled(key: string, binding: string, paymentResponse: string): ProofState {
     const ts = this.now();
-    this.db.exec('BEGIN IMMEDIATE');
-    try {
-      this.db
-        .prepare(
-          `INSERT INTO consumed_proofs (key, binding, state, payment_response, created_at, updated_at)
-           VALUES (?, ?, 'paid_not_served', ?, ?, ?)
-           ON CONFLICT(key) DO UPDATE SET state = 'paid_not_served', payment_response = excluded.payment_response,
-             updated_at = excluded.updated_at
-           WHERE consumed_proofs.state = 'settling'`,
-        )
-        .run(key, binding, paymentResponse, ts, ts);
-      this.db.exec('COMMIT');
-    } catch (err) {
-      this.db.exec('ROLLBACK');
-      throw err;
-    }
+    // One UPSERT statement: atomic on its own.
+    this.db
+      .prepare(
+        `INSERT INTO consumed_proofs (key, binding, state, payment_response, created_at, updated_at)
+         VALUES (?, ?, 'paid_not_served', ?, ?, ?)
+         ON CONFLICT(key) DO UPDATE SET state = 'paid_not_served', payment_response = excluded.payment_response,
+           updated_at = excluded.updated_at
+         WHERE consumed_proofs.state = 'settling'`,
+      )
+      .run(key, binding, paymentResponse, ts, ts);
     const record = this.get(key);
     if (record === undefined) throw new Error(`consumed proof ${key} vanished`);
     return record.state;

package/src/seller/cors.ts

@@ -0,0 +1,106 @@
+import type { Request, RequestHandler, Response } from 'express';
+
+/**
+ * CORS for browser clients of a paid route (x402 `transports-v2/http.md`,
+ * "Browser clients"). None of the x402 headers is CORS-safelisted: without
+ * these headers a cross-origin page cannot read the price (402) or send the
+ * payment. CORS decides who may READ a response; it is not a payment control.
+ */
+export interface PaywallCorsOptions {
+  /** Allowed origins (exact `scheme://host[:port]`), or `'*'` for any. */
+  readonly origins: readonly string[] | '*';
+  /** Whether requests may carry credentials (cookies); origins are then reflected, never `*`. */
+  readonly credentials?: boolean;
+  /** Preflight cache lifetime (default 600 s). */
+  readonly maxAgeSeconds?: number;
+}
+
+/** Response headers a browser client must read: the price and the settlement. */
+export const EXPOSED_HEADERS = ['PAYMENT-REQUIRED', 'PAYMENT-RESPONSE'] as const;
+/** Request headers a browser client sends: the payment, and Content-Type for a JSON body. */
+export const ALLOWED_HEADERS = ['PAYMENT-SIGNATURE', 'Content-Type'] as const;
+const DEFAULT_MAX_AGE_SECONDS = 600;
+
+/** Merges header names into a comma-separated list, keeping existing ones (case-insensitive). */
+export function mergeHeaderList(
+  existing: string | number | readonly string[] | undefined,
+  add: readonly string[],
+): string {
+  const current =
+    existing === undefined
+      ? []
+      : (Array.isArray(existing) ? existing.join(',') : String(existing))
+          .split(',')
+          .map((h) => h.trim())
+          .filter((h) => h.length > 0);
+  const seen = new Set(current.map((h) => h.toLowerCase()));
+  for (const h of add) {
+    if (!seen.has(h.toLowerCase())) {
+      current.push(h);
+      seen.add(h.toLowerCase());
+    }
+  }
+  return current.join(', ');
+}
+
+/** Always: lets a cross-origin page read the x402 headers (merged with any value already set). */
+export function exposePaymentHeaders(res: Response): void {
+  res.setHeader(
+    'Access-Control-Expose-Headers',
+    mergeHeaderList(res.getHeader('Access-Control-Expose-Headers'), EXPOSED_HEADERS),
+  );
+}
+
+/** Sets `Access-Control-Allow-Origin` for an allowed calling origin; false when not allowed. */
+export function allowOrigin(req: Request, res: Response, cors: PaywallCorsOptions): boolean {
+  const origin = req.get('origin');
+  if (origin === undefined) return false;
+  const anyOrigin = cors.origins === '*';
+  if (!anyOrigin && !cors.origins.includes(origin)) return false;
+  if (anyOrigin && cors.credentials !== true) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+  } else {
+    // A reflected origin varies per request: shared caches must key on it.
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Vary', mergeHeaderList(res.getHeader('Vary'), ['Origin']));
+  }
+  if (cors.credentials === true) res.setHeader('Access-Control-Allow-Credentials', 'true');
+  return true;
+}
+
+/**
+ * Answers the CORS preflight (`OPTIONS`) of paid routes without requiring
+ * payment. Allows the x402 request headers plus whatever else the browser
+ * announces: x402 client SDKs have added request headers of their own, and an
+ * allow list naming exactly the protocol headers would refuse their retry.
+ */
+export function preflightHandler(cors: PaywallCorsOptions): RequestHandler {
+  return (req, res, next) => {
+    if (req.method !== 'OPTIONS' || req.get('access-control-request-method') === undefined) {
+      next();
+      return;
+    }
+    if (!allowOrigin(req, res, cors)) {
+      res.status(204).end(); // no CORS headers: the browser refuses the call
+      return;
+    }
+    const requested = (req.get('access-control-request-headers') ?? '')
+      .split(',')
+      .map((h) => h.trim())
+      .filter((h) => h.length > 0);
+    res.setHeader(
+      'Access-Control-Allow-Headers',
+      mergeHeaderList(undefined, [...ALLOWED_HEADERS, ...requested]),
+    );
+    res.setHeader(
+      'Access-Control-Allow-Methods',
+      mergeHeaderList(undefined, [
+        req.get('access-control-request-method') ?? 'POST',
+        'GET',
+        'POST',
+      ]),
+    );
+    res.setHeader('Access-Control-Max-Age', String(cors.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS));
+    res.status(204).end();
+  };
+}