@orbitmem/relay 0.1.0

package/README.md

@@ -0,0 +1,108 @@
+# @orbitmem/relay
+
+HTTP relay server for OrbitMem — authenticated vault access, data discovery, and snapshot archival.
+
+## Install
+
+```bash
+npm install @orbitmem/relay
+```
+
+## Quick Start
+
+```bash
+# Development (hot reload)
+PORT=3000 RELAY_MODE=mock bun run --hot src/index.ts
+
+# Production
+bun run dist/index.js
+```
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `PORT` | `3000` | Server port |
+| `RELAY_MODE` | `mock` | `mock` (in-memory) or `live` (OrbitDB/IPFS) |
+
+## API Endpoints
+
+All routes are prefixed with `/v1`.
+
+### Health
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/health` | No | Health check |
+
+### Auth
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| POST | `/auth/challenge` | No | Generate nonce + message for wallet signing |
+| POST | `/auth/session` | ERC-8128 | Issue session token |
+
+### Vault
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/vault/public/:address/keys` | No | List public keys |
+| GET | `/vault/public/:address/:key` | No | Read public value |
+| POST | `/vault/read` | ERC-8128 | Read encrypted value |
+| POST | `/vault/write` | ERC-8128 | Write vault entry |
+| POST | `/vault/delete` | ERC-8128 | Delete vault entry |
+| POST | `/vault/keys` | ERC-8128 | List vault keys |
+| POST | `/vault/sync` | ERC-8128 | Trigger vault sync |
+
+### Discovery
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/data/stats` | No | Global data statistics |
+| GET | `/data/user/stats` | ERC-8128 | Per-user statistics |
+| GET | `/data/search` | No | Search data registrations |
+| GET | `/data/:dataId/score` | No | Get data quality score |
+
+### Snapshots
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/snapshots` | ERC-8128 | List snapshots |
+| POST | `/snapshots/archive` | ERC-8128 | Archive snapshot |
+| GET | `/snapshots/usage` | ERC-8128 | Storage usage and limit |
+
+## Authentication
+
+The relay supports three authentication methods, checked in order:
+
+1. **Bearer Session Token** — Stateless HMAC-SHA256 token (fastest)
+   ```
+   Authorization: Bearer <token>
+   ```
+
+2. **RFC 9421 Signature** — Standard HTTP message signatures with ERC-8128 verification
+
+3. **Legacy X-OrbitMem Headers** — Backward-compatible signed requests
+   ```
+   X-OrbitMem-Signer: 0x...
+   X-OrbitMem-Timestamp: 1234567890
+   X-OrbitMem-Nonce: unique-id
+   X-OrbitMem-Signature: 0x...
+   ```
+
+## Programmatic Usage
+
+```typescript
+import { createApp } from "@orbitmem/relay/app";
+import { createMockServices } from "@orbitmem/relay/services";
+
+const services = createMockServices();
+const app = createApp(services);
+
+// Use with any Hono-compatible runtime
+export default app;
+```
+
+## License
+
+MIT

package/dist/app.d.ts

@@ -0,0 +1,7 @@
+import { Hono } from "hono";
+import { type MPPConfig } from "./middleware/mpp.js";
+import type { RelayServices } from "./services/types.js";
+export declare function buildApp(services: RelayServices, mppConfig?: MPPConfig): Hono;
+declare const app: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+export { app };
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAMrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAS7E;AASD,QAAA,MAAM,GAAG,4EAAmD,CAAC;AAE7D,OAAO,EAAE,GAAG,EAAE,CAAC"}

package/dist/app.js

@@ -0,0 +1,27 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { logger } from "hono/logger";
+import { createDataRoutes } from "./routes/data.js";
+import { healthRoutes } from "./routes/health.js";
+import { createSnapshotRoutes } from "./routes/snapshots.js";
+import { createVaultRoutes } from "./routes/vault.js";
+import { createMockServices } from "./services/index.js";
+export function buildApp(services, mppConfig) {
+    const app = new Hono().basePath("/v1");
+    app.use(logger());
+    app.use(cors());
+    app.route("/", healthRoutes);
+    app.route("/", createVaultRoutes(services.vault, mppConfig));
+    app.route("/", createDataRoutes(services.discovery));
+    app.route("/", createSnapshotRoutes(services.snapshot, services.plan));
+    return app;
+}
+const defaultMppConfig = process.env.MPP_ACCEPTED_METHODS
+    ? {
+        acceptedMethods: process.env.MPP_ACCEPTED_METHODS.split(","),
+        network: (process.env.MPP_NETWORK ?? "base-sepolia"),
+    }
+    : undefined;
+const app = buildApp(createMockServices(), defaultMppConfig);
+export { app };
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,UAAU,QAAQ,CAAC,QAAuB,EAAE,SAAqB;IACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAClB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAChB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,gBAAgB,GAA0B,OAAO,CAAC,GAAG,CAAC,oBAAoB;IAC9E,CAAC,CAAC;QACE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAiC;QAC5F,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,cAAc,CAAyB;KAC7E;IACH,CAAC,CAAC,SAAS,CAAC;AAEd,MAAM,GAAG,GAAG,QAAQ,CAAC,kBAAkB,EAAE,EAAE,gBAAgB,CAAC,CAAC;AAE7D,OAAO,EAAE,GAAG,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+declare const _default: {
+    port: number;
+    fetch: (request: Request, Env?: unknown, executionCtx?: import("hono").ExecutionContext) => Response | Promise<Response>;
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AA4BA,wBAA0C"}

package/dist/index.js

@@ -0,0 +1,24 @@
+import { buildApp } from "./app.js";
+import { createLiveServices, createMockServices } from "./services/index.js";
+const port = Number(process.env.PORT ?? 3000);
+const mode = process.env.RELAY_MODE ?? "mock";
+console.log(`OrbitMem Relay starting on port ${port} (mode: ${mode})`);
+let app;
+if (mode === "live") {
+    const services = await createLiveServices();
+    app = buildApp(services);
+}
+else {
+    app = buildApp(createMockServices());
+}
+// Graceful shutdown
+process.on("SIGINT", () => {
+    console.log("Shutting down...");
+    process.exit(0);
+});
+process.on("SIGTERM", () => {
+    console.log("Shutting down...");
+    process.exit(0);
+});
+export default { port, fetch: app.fetch };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC;AAE9C,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,WAAW,IAAI,GAAG,CAAC,CAAC;AAEvE,IAAI,GAAgC,CAAC;AAErC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;IACpB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC5C,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;KAAM,CAAC;IACN,GAAG,GAAG,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,oBAAoB;AACpB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC"}

package/dist/middleware/ed25519-verify.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Verify an Ed25519 signature against a payload and public key.
+ * Used for Solana wallet authentication in the legacy X-OrbitMem-* header path.
+ *
+ * The signer address is the hex-encoded Ed25519 public key (not base58).
+ * This doubles as both identifier and verification key.
+ *
+ * @param payload - The signed payload bytes
+ * @param signature - The Ed25519 signature (64 bytes)
+ * @param publicKeyHex - The signer's public key as hex string (64 hex chars = 32 bytes)
+ * @returns true if the signature is valid
+ */
+export declare function verifyEd25519(payload: Uint8Array, signature: Uint8Array, publicKeyHex: string): Promise<boolean>;
+//# sourceMappingURL=ed25519-verify.d.ts.map

package/dist/middleware/ed25519-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/ed25519-verify.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/middleware/ed25519-verify.js

@@ -0,0 +1,31 @@
+import { ed25519 } from "@noble/curves/ed25519.js";
+/**
+ * Verify an Ed25519 signature against a payload and public key.
+ * Used for Solana wallet authentication in the legacy X-OrbitMem-* header path.
+ *
+ * The signer address is the hex-encoded Ed25519 public key (not base58).
+ * This doubles as both identifier and verification key.
+ *
+ * @param payload - The signed payload bytes
+ * @param signature - The Ed25519 signature (64 bytes)
+ * @param publicKeyHex - The signer's public key as hex string (64 hex chars = 32 bytes)
+ * @returns true if the signature is valid
+ */
+export async function verifyEd25519(payload, signature, publicKeyHex) {
+    try {
+        const publicKey = hexToBytes(publicKeyHex);
+        return ed25519.verify(signature, payload, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+function hexToBytes(hex) {
+    const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+//# sourceMappingURL=ed25519-verify.js.map

package/dist/middleware/ed25519-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-verify.js","sourceRoot":"","sources":["../../src/middleware/ed25519-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAmB,EACnB,SAAqB,EACrB,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/middleware/erc8128.d.ts

@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from "hono";
+export type ERC8128Env = {
+    Variables: {
+        signer: string;
+        signerFamily: string;
+        signerAlgorithm: string;
+    };
+};
+/**
+ * ERC-8128 signature verification middleware using @slicekit/erc8128.
+ *
+ * Options:
+ * - `verify: 'evm'` — cryptographic verification using viem (secp256k1 recovery)
+ * - `verifier: fn` — custom verification callback (legacy, mapped to verifyMessage)
+ * - neither — trusts headers without signature check (development/testing)
+ * - `required` — whether auth is required (default true)
+ * - `replayable` — allow replayable (nonce-less) class-bound signatures (default false)
+ */
+export declare function erc8128(opts?: {
+    verify?: "evm" | "auto";
+    verifier?: (payload: Uint8Array, signature: Uint8Array, algorithm: string) => Promise<boolean>;
+    required?: boolean;
+    replayable?: boolean;
+}): MiddlewareHandler<ERC8128Env>;
+//# sourceMappingURL=erc8128.d.ts.map

package/dist/middleware/erc8128.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erc8128.d.ts","sourceRoot":"","sources":["../../src/middleware/erc8128.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAM9C,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,CAAC;AA4BF;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,IAAI,CAAC,EAAE;IAC7B,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAuEhC"}

package/dist/middleware/erc8128.js

@@ -0,0 +1,196 @@
+import { createVerifierClient } from "@slicekit/erc8128";
+import { getAddress, verifyMessage } from "viem";
+import { verifyEd25519 } from "./ed25519-verify.js";
+import { verifySessionToken } from "./session.js";
+/**
+ * In-memory nonce store for replay protection.
+ * Entries auto-expire after their TTL.
+ */
+function createMemoryNonceStore() {
+    const seen = new Map(); // key -> expiry timestamp (ms)
+    function clean() {
+        const now = Date.now();
+        for (const [key, expiry] of seen) {
+            if (now > expiry)
+                seen.delete(key);
+        }
+    }
+    return {
+        async consume(key, ttlSeconds) {
+            clean();
+            if (seen.has(key))
+                return false; // already consumed
+            seen.set(key, Date.now() + ttlSeconds * 1000);
+            return true; // newly stored
+        },
+    };
+}
+const nonceStore = createMemoryNonceStore();
+/**
+ * ERC-8128 signature verification middleware using @slicekit/erc8128.
+ *
+ * Options:
+ * - `verify: 'evm'` — cryptographic verification using viem (secp256k1 recovery)
+ * - `verifier: fn` — custom verification callback (legacy, mapped to verifyMessage)
+ * - neither — trusts headers without signature check (development/testing)
+ * - `required` — whether auth is required (default true)
+ * - `replayable` — allow replayable (nonce-less) class-bound signatures (default false)
+ */
+export function erc8128(opts) {
+    const required = opts?.required ?? true;
+    const allowReplayable = opts?.replayable ?? true;
+    return async (c, next) => {
+        // --- Bearer session token path (fastest, no signature check) ---
+        const authHeader = c.req.header("Authorization");
+        if (authHeader?.startsWith("Bearer ")) {
+            const token = authHeader.slice(7);
+            const session = await verifySessionToken(token);
+            if (session) {
+                c.set("signer", session.address);
+                c.set("signerFamily", "session");
+                c.set("signerAlgorithm", "hmac-sha256");
+                await next();
+                return;
+            }
+            // Invalid/expired bearer — check for ERC-8128 fallback headers
+            const hasLegacy = !!c.req.header("X-OrbitMem-Signer");
+            const hasRfc = !!c.req.header("Signature-Input");
+            if (!hasLegacy && !hasRfc) {
+                return c.json({ error: "Invalid or expired session token" }, 401);
+            }
+            // Fall through to ERC-8128 verification below
+        }
+        // Check if this is a legacy X-OrbitMem-* request or RFC 9421 Signature request
+        const hasLegacyHeaders = !!c.req.header("X-OrbitMem-Signer");
+        const hasRfc9421Headers = !!c.req.header("Signature-Input");
+        if (!hasLegacyHeaders && !hasRfc9421Headers) {
+            if (!required) {
+                await next();
+                return;
+            }
+            return c.json({ error: "Missing ERC-8128 headers" }, 401);
+        }
+        // --- Legacy X-OrbitMem-* header path (backward compat) ---
+        if (hasLegacyHeaders) {
+            return handleLegacy(c, next, opts);
+        }
+        // --- RFC 9421 / @slicekit/erc8128 path ---
+        const shouldVerify = opts?.verify === "evm" || opts?.verifier;
+        if (!shouldVerify) {
+            // Trust mode: parse keyid from Signature-Input to extract signer address
+            const sigInput = c.req.header("Signature-Input") ?? "";
+            const keyidMatch = sigInput.match(/keyid="(?:eip155|erc8128):(\d+):(0x[a-fA-F0-9]+)"/);
+            if (!keyidMatch) {
+                return c.json({ error: "Cannot parse signer from Signature-Input" }, 401);
+            }
+            c.set("signer", getAddress(keyidMatch[2]));
+            c.set("signerFamily", "evm");
+            c.set("signerAlgorithm", "ecdsa-secp256k1");
+            await next();
+            return;
+        }
+        // Verified mode — use @slicekit/erc8128 verifier
+        const result = await verifyWithLibrary(c.req.raw.clone(), allowReplayable);
+        if (!result.ok) {
+            return c.json({ error: `Invalid signature: ${result.reason}` }, 401);
+        }
+        c.set("signer", getAddress(result.address));
+        c.set("signerFamily", "evm");
+        c.set("signerAlgorithm", "ecdsa-secp256k1");
+        await next();
+    };
+}
+async function verifyWithLibrary(request, allowReplayable) {
+    const verifier = createVerifierClient({
+        verifyMessage: async ({ address, message, signature }) => {
+            return verifyMessage({ address, message, signature });
+        },
+        nonceStore,
+        defaults: {
+            replayable: allowReplayable,
+            classBoundPolicies: [["@authority"]],
+            clockSkewSec: 30,
+            maxValiditySec: 3600, // 1 hour max
+        },
+    });
+    return verifier.verifyRequest({ request });
+}
+// --- Legacy handler for backward compatibility with X-OrbitMem-* headers ---
+const legacyNonceCache = new Map();
+const LEGACY_NONCE_TTL = 5 * 60 * 1000;
+const LEGACY_TIMESTAMP_TOLERANCE = 30 * 1000;
+function cleanLegacyNonces() {
+    const now = Date.now();
+    for (const [nonce, ts] of legacyNonceCache) {
+        if (now - ts > LEGACY_NONCE_TTL)
+            legacyNonceCache.delete(nonce);
+    }
+}
+async function evmVerify(payload, signature, claimedSigner) {
+    try {
+        const sigHex = `0x${Array.from(signature)
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("")}`;
+        return await verifyMessage({
+            address: claimedSigner,
+            message: { raw: payload },
+            signature: sigHex,
+        });
+    }
+    catch {
+        return false;
+    }
+}
+async function handleLegacy(c, next, opts) {
+    const signer = c.req.header("X-OrbitMem-Signer");
+    const family = c.req.header("X-OrbitMem-Family");
+    const algorithm = c.req.header("X-OrbitMem-Algorithm");
+    const timestampStr = c.req.header("X-OrbitMem-Timestamp");
+    const nonce = c.req.header("X-OrbitMem-Nonce");
+    const signatureHex = c.req.header("X-OrbitMem-Signature");
+    if (!signer || !family || !algorithm || !timestampStr || !nonce || !signatureHex) {
+        return c.json({ error: "Missing ERC-8128 headers" }, 401);
+    }
+    const timestamp = Number(timestampStr);
+    const now = Date.now();
+    if (Math.abs(now - timestamp) > LEGACY_TIMESTAMP_TOLERANCE) {
+        return c.json({ error: "Request timestamp out of tolerance" }, 401);
+    }
+    cleanLegacyNonces();
+    if (legacyNonceCache.has(nonce)) {
+        return c.json({ error: "Replay detected: nonce already used" }, 401);
+    }
+    const shouldVerify = opts?.verify === "evm" || opts?.verify === "auto" || opts?.verifier;
+    if (shouldVerify) {
+        const body = c.req.method !== "GET" ? await c.req.text() : undefined;
+        const bodyHash = body
+            ? new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)))
+            : new Uint8Array(0);
+        const payload = new TextEncoder().encode(`${c.req.method}\n${c.req.path}\n${timestamp}\n${nonce}\n${Array.from(bodyHash)
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("")}`);
+        const signature = new Uint8Array(signatureHex.match(/.{1,2}/g).map((byte) => parseInt(byte, 16)));
+        let valid;
+        if (opts?.verify === "evm" || (opts?.verify === "auto" && family === "evm")) {
+            valid = await evmVerify(payload, signature, signer);
+        }
+        else if (opts?.verify === "auto" && family === "solana" && algorithm === "ed25519") {
+            valid = await verifyEd25519(payload, signature, signer);
+        }
+        else if (opts?.verifier) {
+            valid = await opts.verifier(payload, signature, algorithm);
+        }
+        else {
+            valid = false;
+        }
+        if (!valid) {
+            return c.json({ error: "Invalid signature" }, 401);
+        }
+    }
+    legacyNonceCache.set(nonce, Date.now());
+    c.set("signer", signer);
+    c.set("signerFamily", family);
+    c.set("signerAlgorithm", algorithm);
+    await next();
+}
+//# sourceMappingURL=erc8128.js.map

package/dist/middleware/erc8128.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erc8128.js","sourceRoot":"","sources":["../../src/middleware/erc8128.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE7F,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAUlD;;;GAGG;AACH,SAAS,sBAAsB;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+BAA+B;IAEvE,SAAS,KAAK;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,GAAG,GAAG,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,UAAkB;YAC3C,KAAK,EAAE,CAAC;YACR,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,mBAAmB;YACpD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,CAAC,eAAe;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,IAKvB;IACC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC;IAEjD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,kEAAkE;QAClE,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBACjC,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;gBACxC,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,+DAA+D;YAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,8CAA8C;QAChD,CAAC;QAED,+EAA+E;QAC/E,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE5D,IAAI,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,4DAA4D;QAC5D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,4CAA4C;QAC5C,MAAM,YAAY,GAAG,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,IAAI,EAAE,QAAQ,CAAC;QAE9D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,yEAAyE;YACzE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5E,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAkB,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;YAC5C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;QAC5C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAgB,EAChB,eAAwB;IAExB,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,UAAU;QACV,QAAQ,EAAE;YACR,UAAU,EAAE,eAAe;YAC3B,kBAAkB,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY,EAAE,EAAE;YAChB,cAAc,EAAE,IAAI,EAAE,aAAa;SACpC;KACF,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;AACnD,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC3C,IAAI,GAAG,GAAG,EAAE,GAAG,gBAAgB;YAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAmB,EACnB,SAAqB,EACrB,aAAqB;IAErB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,EAAmB,CAAC;QAC/B,OAAO,MAAM,aAAa,CAAC;YACzB,OAAO,EAAE,aAA8B;YACvC,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;YACzB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,CAAM,EACN,IAAyB,EACzB,IAIC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAE1D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,0BAA0B,EAAE,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,iBAAiB,EAAE,CAAC;IACpB,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,IAAI,EAAE,MAAM,KAAK,MAAM,IAAI,IAAI,EAAE,QAAQ,CAAC;IACzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI;YACnB,CAAC,CAAC,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAiB,CAAC,CACtF;YACH,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACtC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,KAAK,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,EAAE,CACd,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,YAAY,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC;QAEF,IAAI,KAAc,CAAC;QACnB,IAAI,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;YAC5E,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,IAAI,EAAE,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACrF,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC1B,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAEpC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC"}

package/dist/middleware/mpp.d.ts

@@ -0,0 +1,36 @@
+import type { MiddlewareHandler } from "hono";
+import type { IVaultService } from "../services/types.js";
+export type MPPConfig = {
+    acceptedMethods: ("tempo" | "stripe" | "lightning")[];
+    network: "base" | "base-sepolia";
+};
+export type MPPEnv = {
+    Variables: {
+        mppPayment?: {
+            producer: string;
+            amount: string;
+            currency: string;
+            method: string;
+        };
+    };
+};
+/**
+ * MPP pricing middleware for vault read routes (GET with :address/:key params).
+ */
+export declare function mppPricing(opts: {
+    vault: IVaultService;
+    config: MPPConfig;
+}): MiddlewareHandler<MPPEnv>;
+/**
+ * MPP pricing middleware for POST /vault/read.
+ * Extracts vaultAddress from JSON body instead of route params.
+ */
+export declare function mppPricingPost(opts: {
+    vault: IVaultService;
+    config: MPPConfig;
+}): MiddlewareHandler<MPPEnv & {
+    Variables: {
+        signer: string;
+    };
+}>;
+//# sourceMappingURL=mpp.d.ts.map

package/dist/middleware/mpp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpp.d.ts","sourceRoot":"","sources":["../../src/middleware/mpp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,CAAC,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,MAAM,GAAG,cAAc,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,UAAU,CAAC,EAAE;YACX,QAAQ,EAAE,MAAM,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC;SAChB,CAAC;KACH,CAAC;CACH,CAAC;AA8BF;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;CACnB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAwD5B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;CACnB,GAAG,iBAAiB,CAAC,MAAM,GAAG;IAAE,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAsDhE"}

package/dist/middleware/mpp.js

@@ -0,0 +1,122 @@
+/** In-memory LRU pricing cache (address:path -> pricing). TTL: 60s. Only caches positive hits. */
+const pricingCache = new Map();
+const CACHE_TTL = 60_000;
+const MAX_CACHE_SIZE = 1000;
+function getCachedPricing(key) {
+    const entry = pricingCache.get(key);
+    if (!entry)
+        return undefined;
+    if (Date.now() > entry.expiry) {
+        pricingCache.delete(key);
+        return undefined;
+    }
+    return entry.value;
+}
+function setCachedPricing(key, value) {
+    if (pricingCache.size >= MAX_CACHE_SIZE) {
+        const keys = Array.from(pricingCache.keys());
+        for (let i = 0; i < keys.length / 2; i++) {
+            pricingCache.delete(keys[i]);
+        }
+    }
+    pricingCache.set(key, { value, expiry: Date.now() + CACHE_TTL });
+}
+/**
+ * MPP pricing middleware for vault read routes (GET with :address/:key params).
+ */
+export function mppPricing(opts) {
+    const { vault, config } = opts;
+    return async (c, next) => {
+        const address = c.req.param("address");
+        const key = c.req.param("key");
+        if (!address || !key) {
+            await next();
+            return;
+        }
+        const cacheKey = `${address}:${key}`;
+        let pricing = getCachedPricing(cacheKey);
+        if (pricing === undefined) {
+            const fetched = await vault.getVaultPricing(address, key);
+            if (fetched) {
+                setCachedPricing(cacheKey, fetched);
+                pricing = fetched;
+            }
+        }
+        if (!pricing) {
+            await next();
+            return;
+        }
+        const authHeader = c.req.header("Authorization");
+        if (!authHeader || !authHeader.startsWith("Payment ")) {
+            const challenge = `Payment realm="orbitmem", intent="charge", amount="${pricing.amount}", currency="${pricing.currency}", recipient="${address}", network="${config.network}"`;
+            c.header("WWW-Authenticate", challenge);
+            return c.json({
+                error: "payment_required",
+                amount: pricing.amount,
+                currency: pricing.currency,
+                recipient: address,
+                network: config.network,
+                methods: config.acceptedMethods,
+            }, 402);
+        }
+        // TODO: Verify payment credential via mppx once SDK API is confirmed.
+        // For now, accept any Authorization: Payment header as valid.
+        c.set("mppPayment", {
+            producer: address,
+            amount: pricing.amount,
+            currency: pricing.currency,
+            method: "unverified",
+        });
+        await next();
+    };
+}
+/**
+ * MPP pricing middleware for POST /vault/read.
+ * Extracts vaultAddress from JSON body instead of route params.
+ */
+export function mppPricingPost(opts) {
+    const { vault, config } = opts;
+    return async (c, next) => {
+        const body = await c.req.json();
+        const address = body.vaultAddress ?? c.get("signer");
+        const path = body.path;
+        if (!address || !path) {
+            await next();
+            return;
+        }
+        const cacheKey = `${address}:${path}`;
+        let pricing = getCachedPricing(cacheKey);
+        if (pricing === undefined) {
+            const fetched = await vault.getVaultPricing(address, path);
+            if (fetched) {
+                setCachedPricing(cacheKey, fetched);
+                pricing = fetched;
+            }
+        }
+        if (!pricing) {
+            await next();
+            return;
+        }
+        const authHeader = c.req.header("Authorization");
+        if (!authHeader || !authHeader.startsWith("Payment ")) {
+            const challenge = `Payment realm="orbitmem", intent="charge", amount="${pricing.amount}", currency="${pricing.currency}", recipient="${address}", network="${config.network}"`;
+            c.header("WWW-Authenticate", challenge);
+            return c.json({
+                error: "payment_required",
+                amount: pricing.amount,
+                currency: pricing.currency,
+                recipient: address,
+                network: config.network,
+                methods: config.acceptedMethods,
+            }, 402);
+        }
+        c.set("mppPayment", {
+            producer: address,
+            amount: pricing.amount,
+            currency: pricing.currency,
+            method: "unverified",
+        });
+        await next();
+    };
+}
+//# sourceMappingURL=mpp.js.map