@okxweb3/app-x402-core 0.1.2 → 0.2.0

package/dist/esm/{chunk-XBQG2CDV.mjs → chunk-EYS4TWVA.mjs}

@@ -1,6 +1,10 @@
 import {
   x402Version
-} from "./chunk-O3IYMTNT.mjs";
+} from "./chunk-4KASWSSY.mjs";
+import {
+  asSubscriptionPaymentInner,
+  parseChainIdFromNetwork
+} from "./chunk-CKXR4QVD.mjs";
 import {
   FacilitatorResponseError,
   SettleError,
@@ -90,6 +94,8 @@ var HTTPFacilitatorClient = class {
   constructor(config) {
     this.url = config?.url || DEFAULT_FACILITATOR_URL;
     this._createAuthHeaders = config?.createAuthHeaders;
+    this._createSubscriptionAuthHeaders = config?.createSubscriptionAuthHeaders;
+    this._fetchFn = config?.fetchFn ?? fetch;
   }
   /**
    * Verify a payment with the facilitator
@@ -106,7 +112,7 @@ var HTTPFacilitatorClient = class {
       const authHeaders = await this.createAuthHeaders("verify");
       headers = { ...headers, ...authHeaders.headers };
     }
-    const response = await fetch(`${this.url}/verify`, {
+    const response = await this._fetchFn(`${this.url}/verify`, {
       method: "POST",
       headers,
       body: JSON.stringify({
@@ -147,7 +153,7 @@ var HTTPFacilitatorClient = class {
       const authHeaders = await this.createAuthHeaders("settle");
       headers = { ...headers, ...authHeaders.headers };
     }
-    const response = await fetch(`${this.url}/settle`, {
+    const response = await this._fetchFn(`${this.url}/settle`, {
       method: "POST",
       headers,
       body: JSON.stringify({
@@ -189,7 +195,7 @@ var HTTPFacilitatorClient = class {
     }
     let lastError = null;
     for (let attempt = 0; attempt < GET_SUPPORTED_RETRIES; attempt++) {
-      const response = await fetch(`${this.url}/supported`, {
+      const response = await this._fetchFn(`${this.url}/supported`, {
         method: "GET",
         headers
       });
@@ -223,10 +229,13 @@ var HTTPFacilitatorClient = class {
       const authHeaders = await this.createAuthHeaders("settle/status");
       headers = { ...headers, ...authHeaders.headers };
     }
-    const response = await fetch(`${this.url}/settle/status?txHash=${encodeURIComponent(txHash)}`, {
-      method: "GET",
-      headers
-    });
+    const response = await this._fetchFn(
+      `${this.url}/settle/status?txHash=${encodeURIComponent(txHash)}`,
+      {
+        method: "GET",
+        headers
+      }
+    );
     if (!response.ok) {
       const text = await response.text().catch(() => response.statusText);
       throw new Error(
@@ -265,6 +274,123 @@ var HTTPFacilitatorClient = class {
       JSON.stringify(obj, (_, value) => typeof value === "bigint" ? value.toString() : value)
     );
   }
+  // ── SubscriptionFacilitatorClient (period) ─────────────
+  //
+  // Generic JSON POST / GET helpers parameterized by `op` so the same code
+  // path covers all five subscription endpoints. The standard OKX envelope
+  // `{ code, msg?, data? }` is returned to the caller unparsed (the
+  // subscription scheme reads `code === "0"` and `data` directly).
+  async subscriptionAuthHeaders(op) {
+    if (!this._createSubscriptionAuthHeaders) return {};
+    return this._createSubscriptionAuthHeaders(op);
+  }
+  async subscriptionPost(op, path, body) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...await this.subscriptionAuthHeaders(op)
+    };
+    const resp = await this._fetchFn(`${this.url}${path}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(this.toJsonSafe(body))
+    });
+    if (!resp.ok) {
+      throw new Error(`facilitator ${op} returned HTTP ${resp.status}: ${await resp.text()}`);
+    }
+    return await resp.json();
+  }
+  async subscriptionGet(op, path) {
+    const headers = await this.subscriptionAuthHeaders(op);
+    const resp = await this._fetchFn(`${this.url}${path}`, { method: "GET", headers });
+    if (!resp.ok) {
+      throw new Error(`facilitator ${op} returned HTTP ${resp.status}: ${await resp.text()}`);
+    }
+    return await resp.json();
+  }
+  /**
+   * Build the {chainIndex, terms, permit, termsSig, permitSig, syncSettle}
+   * request body shared by subscribe / change endpoints.
+   */
+  buildWriteBody(payload, requirements, syncSettle) {
+    const inner = asSubscriptionPaymentInner(payload);
+    return {
+      chainIndex: parseChainIdFromNetwork(requirements.network),
+      terms: inner.terms,
+      permit: inner.permitSingle,
+      termsSig: inner.termsSignature,
+      permitSig: inner.permitSingleSignature,
+      syncSettle: syncSettle ?? true
+    };
+  }
+  async subscribe(paymentPayload, paymentRequirements, syncSettle) {
+    return this.subscriptionPost(
+      "subscribe",
+      "/api/v6/pay/x402/subscriptions",
+      this.buildWriteBody(paymentPayload, paymentRequirements, syncSettle)
+    );
+  }
+  async changeSubscription(paymentPayload, paymentRequirements, oldSubId, syncSettle) {
+    return this.subscriptionPost(
+      "change",
+      "/api/v6/pay/x402/subscriptions/change",
+      {
+        ...this.buildWriteBody(paymentPayload, paymentRequirements, syncSettle),
+        // `oldSubId` is informational — server reads
+        // newTerms.changeFromSubId for the authoritative value.
+        oldSubId,
+        // change body uses `newTerms` not `terms`.
+        newTerms: asSubscriptionPaymentInner(paymentPayload).terms,
+        terms: void 0
+      }
+    );
+  }
+  async cancelSubscription(subId, cancelAuth, syncSettle) {
+    return this.subscriptionPost(
+      "cancel",
+      "/api/v6/pay/x402/subscriptions/cancel",
+      { subId, cancelAuth, syncSettle: syncSettle ?? true }
+    );
+  }
+  async cancelPendingChange(subId, cancelAuth, syncSettle) {
+    return this.subscriptionPost(
+      "cancel-pending-change",
+      "/api/v6/pay/x402/subscriptions/cancel-pending-change",
+      { subId, cancelAuth, syncSettle: syncSettle ?? true }
+    );
+  }
+  async chargeSubscription(subId, syncSettle) {
+    return this.subscriptionPost(
+      "charge",
+      "/api/v6/pay/x402/subscriptions/charge",
+      { subId, syncSettle: syncSettle ?? true }
+    );
+  }
+  async finalizeExpired(subId, syncSettle) {
+    return this.subscriptionPost(
+      "finalize-expired",
+      "/api/v6/pay/x402/subscriptions/finalize-expired",
+      { subId, syncSettle: syncSettle ?? true }
+    );
+  }
+  async getCharges(subId, limit = 50, offset = 0) {
+    const q = new URLSearchParams({ subId, limit: String(limit), offset: String(offset) });
+    return this.subscriptionGet(
+      "getCharges",
+      `/api/v6/pay/x402/subscriptions/charges?${q.toString()}`
+    );
+  }
+  async getPendingChange(subId) {
+    return this.subscriptionGet(
+      "getPendingChange",
+      `/api/v6/pay/x402/subscriptions/pending?subId=${encodeURIComponent(subId)}`
+    );
+  }
+  async getSubscription(subId) {
+    return this.subscriptionGet(
+      "getSubscription",
+      `/api/v6/pay/x402/subscriptions/detail?subId=${encodeURIComponent(subId)}`
+    );
+  }
 };
 
 // src/server/x402ResourceServer.ts
@@ -338,6 +464,21 @@ var x402ResourceServer = class {
   hasRegisteredScheme(network, scheme) {
     return !!findByNetworkAndScheme(this.registeredServerSchemes, scheme, network);
   }
+  /**
+   * Look up the registered SchemeNetworkServer for a given network + scheme.
+   * Exposed so the HTTP dispatch layer can perform capability detection
+   * (e.g. `hasSubscriptionCapability(scheme)`) on the actual instance.
+   *
+   * Pattern matching follows the same CAIP-style rules as `verifyPayment`:
+   * registered keys may use wildcards like `eip155:*`.
+   *
+   * @param network - The network identifier
+   * @param scheme - The payment scheme name
+   * @returns The registered scheme server, or undefined if none matches.
+   */
+  findScheme(network, scheme) {
+    return findByNetworkAndScheme(this.registeredServerSchemes, scheme, network);
+  }
   /**
    * Registers a resource service extension that can enrich extension declarations.
    *
@@ -1131,6 +1272,7 @@ var x402HTTPResourceServer = class {
   constructor(ResourceServer, routes) {
     this.compiledRoutes = [];
     this.protectedRequestHooks = [];
+    this.beforeAccessHooks = [];
     this.pollDeadlineMs = DEFAULT_POLL_DEADLINE_MS;
     this.ResourceServer = ResourceServer;
     this.routesConfig = routes;
@@ -1205,6 +1347,22 @@ var x402HTTPResourceServer = class {
     this.protectedRequestHooks.push(hook);
     return this;
   }
+  /**
+   * Register a seller-global `onBeforeAccess` hook fired on every access-
+   * verified subscription request, AFTER `verifyAccess` (signature + payer
+   * + plan allowlist + period math) but BEFORE the handler runs. Seller
+   * uses it for cross-cutting access policy (quota / ban list / feature
+   * gating). Hooks are executed in order of registration; the first one
+   * to return `{ ok: false }` denies (→ 402). Route-level
+   * `RouteConfig.onBeforeAccess` runs AFTER all global hooks.
+   *
+   * @param hook - The hook function
+   * @returns The x402HTTPResourceServer instance for chaining
+   */
+  onBeforeAccess(hook) {
+    this.beforeAccessHooks.push(hook);
+    return this;
+  }
   /**
    * Register a hook to call when the facilitator returns status="timeout".
    * The hook should verify the tx on-chain and return { confirmed: boolean }.
@@ -1262,6 +1420,14 @@ var x402HTTPResourceServer = class {
     }
     const paymentOptions = this.normalizePaymentOptions(routeConfig);
     const paymentPayload = this.extractPayment(adapter);
+    if (routeConfig.operation === "cancel") {
+      const cancelResult = await this.tryDispatchCancelFlow(adapter, routeConfig, paymentOptions);
+      if (cancelResult) return cancelResult;
+    }
+    if (routeConfig.operation === "cancel-pending-change") {
+      const r = await this.tryDispatchCancelPendingChangeFlow(adapter, routeConfig, paymentOptions);
+      if (r) return r;
+    }
     const resourceInfo = {
       url: routeConfig.resource || enrichedContext.adapter.getUrl(),
       description: routeConfig.description || "",
@@ -1271,6 +1437,89 @@ var x402HTTPResourceServer = class {
       paymentOptions,
       enrichedContext
     );
+    if (routeConfig.operation === "change") {
+      let scheme = null;
+      for (const opt of paymentOptions) {
+        if (!opt.network || !opt.scheme) continue;
+        scheme = await this.resolveSubscriptionScheme(opt.network, opt.scheme);
+        if (scheme) break;
+      }
+      if (!scheme) {
+        return {
+          type: "payment-error",
+          response: {
+            status: 500,
+            headers: { "Content-Type": "application/json" },
+            body: { error: "change route: no subscription scheme registered" }
+          }
+        };
+      }
+      let currentSubId;
+      if (paymentPayload) {
+        const innerTerms = paymentPayload.payload?.terms;
+        currentSubId = innerTerms?.changeFromSubId;
+      } else {
+        const accessHeader = this.extractAccessProofHeader(enrichedContext.adapter);
+        if (!accessHeader) {
+          return {
+            type: "payment-error",
+            response: {
+              status: 401,
+              headers: { "Content-Type": "application/json" },
+              body: { error: "change route: missing APP-Access header" }
+            }
+          };
+        }
+        const { decodeAccessProof } = await this.loadSubscriptionModule();
+        let proof;
+        try {
+          proof = decodeAccessProof(accessHeader);
+        } catch {
+          return {
+            type: "payment-error",
+            response: {
+              status: 400,
+              headers: { "Content-Type": "application/json" },
+              body: { error: "change route: invalid APP-Access header" }
+            }
+          };
+        }
+        const verify = await scheme.verifyOwnership(proof);
+        if (!verify.ok) {
+          return {
+            type: "payment-error",
+            response: {
+              status: 401,
+              headers: { "Content-Type": "application/json" },
+              body: { error: verify.error }
+            }
+          };
+        }
+        currentSubId = verify.subId;
+      }
+      if (!currentSubId) {
+        return {
+          type: "payment-error",
+          response: {
+            status: 400,
+            headers: { "Content-Type": "application/json" },
+            body: { error: "change route: cannot resolve currentSubId" }
+          }
+        };
+      }
+      const enriched = await scheme.enrichAcceptsForChange(requirements, currentSubId);
+      if (enriched === null) {
+        return {
+          type: "payment-error",
+          response: {
+            status: 404,
+            headers: { "Content-Type": "application/json" },
+            body: { error: "sub_not_active_for_change" }
+          }
+        };
+      }
+      requirements = enriched;
+    }
     let extensions = routeConfig.extensions;
     if (extensions) {
       extensions = this.ResourceServer.enrichExtensions(extensions, enrichedContext);
@@ -1283,6 +1532,23 @@ var x402HTTPResourceServer = class {
       extensions,
       transportContext
     );
+    if (routeConfig.operation !== "change") {
+      const accessResult = await this.tryDispatchAccessFlow(
+        adapter,
+        routeConfig,
+        paymentOptions,
+        paymentRequired
+      );
+      if (accessResult) return accessResult;
+    }
+    if (paymentPayload) {
+      const subResult = await this.tryDispatchSubscriptionPresettle(
+        paymentPayload,
+        paymentRequired.accepts,
+        routeConfig.operation === "change" ? "change" : "subscribe"
+      );
+      if (subResult) return subResult;
+    }
     if (!paymentPayload) {
       const unpaidBody = routeConfig.unpaidResponseBody ? await routeConfig.unpaidResponseBody(enrichedContext) : void 0;
       return {
@@ -1504,6 +1770,322 @@ var x402HTTPResourceServer = class {
   requiresPayment(context) {
     return this.getRouteConfig(context.path, context.method) !== void 0;
   }
+  /**
+   * Lazy loader for the subscription submodule. The `import()` cache makes
+   * this effectively free after the first hit; isolating it in one place
+   * keeps dispatch helpers free of dynamic-import boilerplate and lets
+   * bundlers tree-shake the entire subscription path when no caller touches
+   * it.
+   */
+  loadSubscriptionModule() {
+    return import("./subscription/index.mjs");
+  }
+  /**
+   * Single chokepoint for "is this (network, scheme) backed by a
+   * SubscriptionCapability-implementing scheme?". Returns the narrowed
+   * capability (so callers get full typing on `verifyAccess` / `verifySubscribe`
+   * / etc.) or null if not registered or not a subscription scheme.
+   */
+  async resolveSubscriptionScheme(network, schemeName) {
+    const registered = this.ResourceServer.findScheme(network, schemeName);
+    if (!registered) return null;
+    const { hasSubscriptionCapability } = await this.loadSubscriptionModule();
+    return hasSubscriptionCapability(registered) ? registered : null;
+  }
+  /**
+   * period dispatch helper — Access flow.
+   *
+   * Returns an `access-verified` (or `payment-error`) HTTPProcessResult when
+   * the request carries `APP-Access` AND a subscription-capable scheme is
+   * registered for one of the route's accepted (scheme, network) pairs.
+   * Returns `null` to indicate the dispatcher should fall through to classic
+   * pay-per-request handling.
+   */
+  async tryDispatchAccessFlow(adapter, routeConfig, paymentOptions, paymentRequired) {
+    const headerB64 = this.extractAccessProofHeader(adapter);
+    if (!headerB64) return null;
+    const { decodeAccessProof } = await this.loadSubscriptionModule();
+    let proof;
+    try {
+      proof = decodeAccessProof(headerB64);
+    } catch (err) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 401,
+          headers: { "Content-Type": "application/json" },
+          body: { error: `invalid APP-Access: ${err.message}` }
+        }
+      };
+    }
+    const acceptedPlanIds = collectAcceptedPlanIds(paymentOptions);
+    for (const opt of paymentOptions) {
+      if (!opt.network || !opt.scheme) continue;
+      const scheme = await this.resolveSubscriptionScheme(opt.network, opt.scheme);
+      if (!scheme) continue;
+      const result = await scheme.verifyAccess(proof, { acceptedPlanIds });
+      if (!result.ok) {
+        return {
+          type: "payment-error",
+          response: {
+            status: 402,
+            headers: {
+              "Content-Type": "application/json",
+              "PAYMENT-REQUIRED": encodePaymentRequiredHeader(paymentRequired)
+            },
+            body: { error: result.error }
+          }
+        };
+      }
+      const hooks = [
+        ...this.beforeAccessHooks,
+        ...routeConfig.onBeforeAccess ? [routeConfig.onBeforeAccess] : []
+      ];
+      for (const hook of hooks) {
+        const decision = await hook({
+          subscription: result.subscription,
+          request: {
+            path: adapter.getPath(),
+            method: adapter.getMethod(),
+            headers: adapter.getHeaders?.() ?? {}
+          },
+          route: { acceptedPlanIds, accepts: paymentRequired.accepts }
+        });
+        if (!decision.ok) {
+          return {
+            type: "payment-error",
+            response: {
+              status: 402,
+              headers: { "Content-Type": "application/json" },
+              body: {
+                error: decision.error ?? "access_denied",
+                retryAfter: decision.retryAfter,
+                upgradeOffers: decision.upgradeOffers
+              }
+            }
+          };
+        }
+      }
+      return {
+        type: "access-verified",
+        subscription: result.subscription,
+        headers: {}
+      };
+    }
+    return {
+      type: "payment-error",
+      response: {
+        status: 401,
+        headers: { "Content-Type": "application/json" },
+        body: { error: "no subscription scheme registered for this route" }
+      }
+    };
+  }
+  /**
+   * period dispatch helper — Subscribe presettle flow.
+   *
+   * When the buyer presents a PaymentPayload whose `accepted.scheme` is a
+   * subscription scheme with `settlementMode === "pre"`, this runs verify +
+   * (settle on demand) and returns `payment-presettle`. The middleware is
+   * expected to call `result.settle()` AFTER decision-time but BEFORE
+   * `next()` so handler only runs when the chain creation succeeded.
+   *
+   * Returns `null` to fall through to classic post-settle path-verified flow.
+   */
+  async tryDispatchSubscriptionPresettle(paymentPayload, serverAccepts, operation) {
+    const { accepted } = paymentPayload;
+    const scheme = await this.resolveSubscriptionScheme(accepted.network, accepted.scheme);
+    if (!scheme) return null;
+    const serverReq = this.ResourceServer.findMatchingRequirements(serverAccepts, paymentPayload);
+    if (!serverReq) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 402,
+          headers: { "Content-Type": "application/json" },
+          body: { error: "no_matching_requirements" }
+        }
+      };
+    }
+    if (operation === "change") {
+      const verifyResult2 = await scheme.verifyChange(paymentPayload, serverReq);
+      if (!verifyResult2.ok) {
+        return {
+          type: "payment-error",
+          response: {
+            status: 402,
+            headers: { "Content-Type": "application/json" },
+            body: { error: verifyResult2.error }
+          }
+        };
+      }
+      return {
+        type: "payment-presettle",
+        paymentPayload,
+        paymentRequirements: serverReq,
+        operation: "change",
+        settle: async () => {
+          const r = await scheme.settleChange(paymentPayload, serverReq);
+          return r.success ? {
+            success: true,
+            headers: r.headers,
+            data: {
+              newSubId: r.newSubId,
+              oldSubId: r.oldSubId,
+              operationType: r.operationType,
+              scheduledFromPeriod: r.scheduledFromPeriod
+            }
+          } : { success: false, error: r.error };
+        }
+      };
+    }
+    const verifyResult = await scheme.verifySubscribe(paymentPayload, serverReq);
+    if (!verifyResult.ok) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 402,
+          headers: { "Content-Type": "application/json" },
+          body: { error: verifyResult.error }
+        }
+      };
+    }
+    return {
+      type: "payment-presettle",
+      paymentPayload,
+      paymentRequirements: serverReq,
+      operation: "subscribe",
+      settle: async () => {
+        const r = await scheme.settleSubscribe(paymentPayload, serverReq);
+        return r.success ? {
+          success: true,
+          headers: r.headers,
+          data: { subId: r.subId, subscription: r.subscription }
+        } : { success: false, error: r.error };
+      }
+    };
+  }
+  /**
+   * period dispatch helper — Cancel flow.
+   *
+   * Reads JSON body { auth: CancelAuth, subId: string }, runs verifyCancel
+   * then wraps settleCancel as a payment-presettle (settle-before-handler so
+   * the cancelation is on-chain before the seller's response).
+   */
+  async tryDispatchCancelFlow(adapter, routeConfig, paymentOptions) {
+    let scheme = null;
+    for (const opt of paymentOptions) {
+      if (!opt.network || !opt.scheme) continue;
+      const resolved = await this.resolveSubscriptionScheme(opt.network, opt.scheme);
+      if (resolved) {
+        scheme = resolved;
+        break;
+      }
+    }
+    if (!scheme) return null;
+    const body = adapter.getBody?.() ?? {};
+    if (!body.auth || !body.subId) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+          body: { error: "cancel: body must include auth and subId" }
+        }
+      };
+    }
+    const verifyResult = await scheme.verifyCancel(body.auth, body.subId);
+    if (!verifyResult.ok) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 402,
+          headers: { "Content-Type": "application/json" },
+          body: { error: verifyResult.error }
+        }
+      };
+    }
+    void routeConfig;
+    const settleScheme = scheme;
+    const auth = body.auth;
+    const subId = body.subId;
+    return {
+      type: "payment-presettle",
+      paymentPayload: { x402Version: 2, accepted: null, payload: {} },
+      paymentRequirements: null,
+      operation: "cancel",
+      settle: async () => {
+        const r = await settleScheme.settleCancel(auth, subId);
+        return r.success ? { success: true, headers: r.headers, data: { subId } } : { success: false, error: r.error };
+      }
+    };
+  }
+  /**
+   * period dispatch helper — Cancel-Pending-Change flow.
+   *
+   * Reads JSON body `{ auth: PendingChangeCancelAuth, subId: string }`. The
+   * auth must carry `newSubId` (matches the currently PENDING downgrade
+   * target). Runs verifyCancelPendingChange then wraps
+   * settleCancelPendingChange as a payment-presettle.
+   */
+  async tryDispatchCancelPendingChangeFlow(adapter, routeConfig, paymentOptions) {
+    let scheme = null;
+    for (const opt of paymentOptions) {
+      if (!opt.network || !opt.scheme) continue;
+      const resolved = await this.resolveSubscriptionScheme(opt.network, opt.scheme);
+      if (resolved) {
+        scheme = resolved;
+        break;
+      }
+    }
+    if (!scheme) return null;
+    const body = adapter.getBody?.() ?? {};
+    if (!body.auth || !body.subId) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+          body: { error: "cancel-pending-change: body must include auth and subId" }
+        }
+      };
+    }
+    if (!body.auth.newSubId) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+          body: { error: "cancel-pending-change: auth.newSubId is required" }
+        }
+      };
+    }
+    const verifyResult = await scheme.verifyCancelPendingChange(body.auth, body.subId);
+    if (!verifyResult.ok) {
+      return {
+        type: "payment-error",
+        response: {
+          status: 402,
+          headers: { "Content-Type": "application/json" },
+          body: { error: verifyResult.error }
+        }
+      };
+    }
+    void routeConfig;
+    const settleScheme = scheme;
+    const auth = body.auth;
+    const subId = body.subId;
+    return {
+      type: "payment-presettle",
+      paymentPayload: { x402Version: 2, accepted: null, payload: {} },
+      paymentRequirements: null,
+      operation: "cancel-pending-change",
+      settle: async () => {
+        const r = await settleScheme.settleCancelPendingChange(auth, subId);
+        return r.success ? { success: true, headers: r.headers, data: { subId: r.subId } } : { success: false, error: r.error };
+      }
+    };
+  }
   /**
    * Build HTTPResponseInstructions for settlement failure.
    * Uses settlementFailedResponseBody hook if configured, otherwise defaults to empty body.
@@ -1615,8 +2197,25 @@ var x402HTTPResourceServer = class {
         console.warn("Failed to decode PAYMENT-SIGNATURE header:", error);
       }
     }
+    const subHeader = adapter.getHeader("app-payment") || adapter.getHeader("APP-PAYMENT");
+    if (subHeader) {
+      try {
+        const json = Buffer.from(subHeader, "base64").toString("utf8");
+        return JSON.parse(json);
+      } catch (error) {
+        console.warn("Failed to decode APP-PAYMENT header:", error);
+      }
+    }
     return null;
   }
+  /**
+   * Extract `APP-Access` header (subscription access-flow). Returns the raw
+   * base64 string so callers can pass it through to `decodeAccessProof` in
+   * the subscription codec.
+   */
+  extractAccessProofHeader(adapter) {
+    return adapter.getHeader("app-access") || adapter.getHeader("APP-Access") || null;
+  }
   /**
    * Check if request is from a web browser
    *
@@ -1772,6 +2371,15 @@ var x402HTTPResourceServer = class {
     return 0;
   }
 };
+function collectAcceptedPlanIds(options) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const opt of options) {
+    const extra = opt.extra;
+    const id = extra?.plan?.id;
+    if (typeof id === "string" && id.length > 0) seen.add(id);
+  }
+  return Array.from(seen);
+}
 
 export {
   HTTPFacilitatorClient,
@@ -1789,4 +2397,4 @@ export {
   decodePaymentResponseHeader,
   x402HTTPClient
 };
-//# sourceMappingURL=chunk-XBQG2CDV.mjs.map
+//# sourceMappingURL=chunk-EYS4TWVA.mjs.map