@peaje/proxy 0.1.0

package/README.md

@@ -0,0 +1,107 @@
+# @peaje/proxy
+
+Peaje for any server. It makes your own domain answer HTTP 402 (MPP, x402) for the priced API routes in your Peaje dashboard, and serves your agent catalog (`/llms.txt`, `/openapi.json`, `/mcp`, `/.well-known/*`) and `/r/` priced links from the same domain.
+
+It reads the route list from your gateway at runtime (`/{slug}/kit/manifest.json`, cached for 60 seconds), so a route you publish tomorrow is charged without a redeploy. Everything else goes to your app untouched.
+
+For Next.js use [`@peaje/next`](../peaje-next) instead. `npx @peaje/cli@1 init <slug>` installs either one for you.
+
+## Install
+
+```sh
+npm install @peaje/proxy
+```
+
+Node 20 or newer, or any runtime with `fetch`, `Request` and `Response`.
+
+## The secret
+
+Set `PEAJE_ORIGIN_SECRET` in your hosting environment variables. Copy it from the Kit page of your Peaje dashboard.
+
+After an agent pays, the gateway forwards the request to your site with that secret in the `x-peaje-origin` header, and only then does the proxy let it through to your handler. Without it the proxy cannot tell the gateway apart from someone faking the header, so priced API routes are not forwarded (they would be free) and you get one warning in the logs. Discovery files and `/r/` links work anyway.
+
+You can also pass it as an option: `{ slug, secret }`.
+
+## Express
+
+```js
+import express from 'express'
+import { peajeExpress } from '@peaje/proxy/express'
+
+const app = express()
+app.use(peajeExpress({ slug: 'cafe-andino' }))   // first: before express.json() and your routes
+app.use(express.json())
+
+app.get('/api/forecast', (req, res) => res.json({ tempC: 18 }))
+```
+
+CommonJS: `const { peajeExpress } = require('@peaje/proxy/express')`. Works with Express 4 and 5 and plain Connect. Put it before body parsers: the body of a Peaje request is forwarded raw. If a parser already ran, it forwards `req.body` as JSON.
+
+## Hono
+
+```ts
+import { Hono } from 'hono'
+import { peajeHono } from '@peaje/proxy/hono'
+
+const app = new Hono()
+app.use(peajeHono({ slug: 'cafe-andino' }))
+
+app.get('/api/forecast', (c) => c.json({ tempC: 18 }))
+```
+
+On Cloudflare Workers the secret is read from `c.env.PEAJE_ORIGIN_SECRET` (`wrangler secret put PEAJE_ORIGIN_SECRET`). On Node, Bun and Deno it comes from `process.env`.
+
+## Vite (or any non-Next project) on Vercel
+
+Vercel Routing Middleware runs before your static files, so a Vite SPA gets 402s on its own domain without a server. Create `middleware.ts` at the project root, next to `package.json`:
+
+```ts
+import peaje from '@peaje/proxy/vercel'
+
+export default peaje({ slug: 'cafe-andino' })
+
+export const config = {
+  matcher: ['/((?!assets/|favicon.ico).*)'],
+}
+```
+
+It answers with the same headers that `rewrite()` and `next()` from `@vercel/functions` produce, so there is nothing else to install: Vercel rewrites the request to the gateway itself (method, body and query intact), and your middleware never proxies bytes. With a middleware of your own: `peaje({ slug }, yourMiddleware)`; Peaje runs first and yours runs when the request is not Peaje's.
+
+## Anything else (Astro, SvelteKit, Bun, Deno, Workers)
+
+`peajeFetch` takes a `Request` and returns the gateway's `Response`, or `null` when the request is not Peaje's:
+
+```ts
+import { peajeFetch } from '@peaje/proxy'
+
+const peaje = peajeFetch({ slug: 'cafe-andino' })
+
+// Astro (SSR), src/middleware.ts
+export const onRequest = async (context, next) => (await peaje(context.request)) ?? next()
+
+// SvelteKit, src/hooks.server.ts
+export const handle = async ({ event, resolve }) => (await peaje(event.request)) ?? resolve(event)
+
+// Bun / Deno / Workers
+export default { fetch: async (req: Request) => (await peaje(req)) ?? app(req) }
+```
+
+## What gets forwarded
+
+- The catalog paths: `/llms.txt`, `/openapi.json`, `/mcp`, `/.well-known/*` Peaje files, `/developers`, `/docs` and the rest of the kit list.
+- `/r/*` priced links and `/checkout_sessions/*`.
+- Your priced API routes from the dashboard (`GET /api/forecast`, `/api/history/:city`, `/api/batch/*`), matching the method. Catch-alls at the root (`/*`, `/:id`) are never forwarded from your domain: they would send the whole site to the gateway.
+
+The forwarded request keeps method, body and query, and carries `x-forwarded-host` and `x-forwarded-proto` so the 402 challenge names your domain (strict x402 clients abort when it does not). If the gateway is unreachable, the catalog paths are still forwarded from a built-in list; priced API routes resume when the manifest loads.
+
+## Options
+
+| Option | Default |
+|---|---|
+| `slug` | required, the business slug from your dashboard |
+| `secret` | `process.env.PEAJE_ORIGIN_SECRET` |
+| `gateway` | `process.env.PEAJE_GATEWAY_URL` or `https://peaje-gateway.up.railway.app` |
+
+## License
+
+MIT

package/dist/chunk-BYMBIN6F.js

@@ -0,0 +1,345 @@
+// ../shared/src/kit/rutas.ts
+var RUTAS_PROXY = [
+  { path: "/llms.txt", nota: "gu\xEDa para agentes (fusionada con la tuya)" },
+  { path: "/pricing.md", nota: "precios por endpoint" },
+  { path: "/auth.md", nota: 'c\xF3mo pagar (el "auth" ac\xE1 es el pago)' },
+  { path: "/agents.md", nota: "qu\xE9 es y cu\xE1ndo usarte" },
+  { path: "/openapi.json", nota: "discovery con precios" },
+  { path: "/mcp", nota: "MCP server con tools pagas, en TU dominio" },
+  { path: "/.well-known/mcp", nota: "el MCP tambi\xE9n ac\xE1: es donde lo buscan los auditores" },
+  { path: "/.well-known/ard.json", nota: "cat\xE1logo ARD (path can\xF3nico)" },
+  { path: "/.well-known/ai-catalog.json", nota: "cat\xE1logo ARD (alias legacy)" },
+  { path: "/.well-known/api-catalog", nota: "linkset RFC 9727" },
+  { path: "/.well-known/agent-card.json", nota: "agent card A2A" },
+  { path: "/.well-known/mcp/server-card.json", nota: "server card MCP" },
+  { path: "/discovery/resources", nota: "lista x402 Bazaar: lo que cobra 402 de verdad" },
+  { path: "/.well-known/ucp", nota: "perfil UCP: qu\xE9 sabe hacer tu negocio" },
+  { path: "/checkout_sessions", nota: "checkout ACP (el de OpenAI)" },
+  { path: "/agentic_commerce/delegate_payment", nota: "delegate payment ACP" },
+  { path: "/developers", nota: "portal de desarrolladores, renderizado con tus precios" },
+  { path: "/.well-known/peaje-indexnow.txt", nota: "clave IndexNow: avisa a Bing y Copilot cuando cambian precios" },
+  // Los auditores prueban /docs y /developers; el gateway redirige uno al otro.
+  { path: "/docs", nota: "alias del portal: los auditores prueban ambos" }
+];
+var RUTAS_DINAMICAS = [
+  { path: "/r/:slug", prefijo: "/r/", nota: "links con precio: el 402 en tu dominio" },
+  { path: "/checkout_sessions/:id", prefijo: "/checkout_sessions/", nota: "leer una sesi\xF3n de checkout ACP" }
+];
+var PEAJE_FETCH_HEADER = "x-peaje-fetch";
+
+// ../shared/src/kit/proxy-runtime.ts
+var PEAJE_ORIGIN_HEADER = "x-peaje-origin";
+function iguales(a, b) {
+  if (a.length !== b.length) return false;
+  let d = 0;
+  for (let i = 0; i < a.length; i++) d |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return d === 0;
+}
+function coincidePatron(patron, pathname) {
+  const p = patron.split("/").filter(Boolean);
+  const parts = segmentosCanonicos(pathname);
+  for (let i = 0; i < p.length; i++) {
+    const seg = p[i];
+    if (seg === "*") return true;
+    const v = parts[i];
+    if (v === void 0) return false;
+    if (seg.startsWith(":")) continue;
+    if (seg.toLowerCase() !== v.toLowerCase()) return false;
+  }
+  return p.length === parts.length;
+}
+function segmentosCanonicos(pathname) {
+  const out = [];
+  for (const crudo of pathname.split(/[\\/]+/)) {
+    if (!crudo) continue;
+    let seg = crudo;
+    try {
+      seg = decodeURIComponent(crudo);
+    } catch {
+    }
+    for (const s of seg.split(/[\\/]+/)) {
+      if (!s || s === ".") continue;
+      if (s === "..") out.pop();
+      else out.push(s);
+    }
+  }
+  return out;
+}
+var pathCanonico = (pathname) => `/${segmentosCanonicos(pathname).join("/")}`;
+function patronReenviable(patron) {
+  const segs = patron.split("/").filter(Boolean);
+  if (segs.length === 0) return false;
+  return !(segs.length === 1 && (segs[0] === "*" || segs[0].startsWith(":")));
+}
+function crearProxyRuntime(opciones) {
+  const base = opciones.base.replace(/\/+$/, "");
+  const ttl = opciones.ttlMs ?? 6e4;
+  const fetchImpl = opciones.fetchImpl ?? fetch;
+  let cache = {
+    at: 0,
+    rutas: opciones.respaldo?.rutas ?? [],
+    prefijos: opciones.respaldo?.prefijos ?? [],
+    patrones: opciones.respaldo?.patrones ?? []
+  };
+  let refrescando = null;
+  async function refrescar() {
+    try {
+      const res = await fetchImpl(`${base}/kit/manifest.json`, { signal: AbortSignal.timeout(5e3) });
+      if (!res.ok) throw new Error(String(res.status));
+      const m = await res.json();
+      cache = {
+        at: Date.now(),
+        rutas: Array.isArray(m.rutas) ? m.rutas : cache.rutas,
+        prefijos: Array.isArray(m.prefijos) ? m.prefijos : cache.prefijos,
+        patrones: Array.isArray(m.patrones) ? m.patrones : cache.patrones
+      };
+    } catch {
+      cache = { ...cache, at: Date.now() };
+    } finally {
+      refrescando = null;
+    }
+  }
+  async function listas() {
+    const vencido = Date.now() - cache.at >= ttl;
+    if (vencido) {
+      refrescando ??= refrescar();
+      if (cache.at === 0) await refrescando;
+    }
+    return cache;
+  }
+  return {
+    /** Rutas de API con precio que este sitio no puede cobrar por falta de secreto. */
+    async sinSecreto() {
+      if (opciones.secreto) return [];
+      return (await listas()).patrones.filter((p) => patronReenviable(p.path));
+    },
+    /** Fuerza la carga del manifiesto (útil al arrancar o en tests). */
+    cargar: () => refrescando ??= refrescar(),
+    /**
+     * Decide si la request va al gateway. `method` y `pathname` de la request,
+     * `search` con el `?` incluido, y los headers para cortar bucles.
+     */
+    async decidir(input) {
+      const secreto = opciones.secreto || null;
+      const prueba = input.headers.get(PEAJE_ORIGIN_HEADER);
+      if (secreto && prueba && iguales(prueba, secreto)) return null;
+      const { rutas, prefijos, patrones } = await listas();
+      const path = input.pathname;
+      const canon = pathCanonico(path).toLowerCase();
+      const esFetchDePeaje = input.headers.get(PEAJE_FETCH_HEADER) !== null;
+      const fija = (rutas.includes(path) || rutas.some((r) => r.toLowerCase() === canon)) && !(canon === "/llms.txt" && esFetchDePeaje);
+      const prefijo = prefijos.some((p) => path.startsWith(p) || canon.startsWith(p.toLowerCase()));
+      const method = input.method.toUpperCase();
+      const patron = secreto !== null && patrones.some((p) => p.method.toUpperCase() === method && patronReenviable(p.path) && coincidePatron(p.path, path));
+      if (!fija && !prefijo && !patron) return null;
+      return { destino: `${base}${path}${input.search ?? ""}` };
+    }
+  };
+}
+
+// ../shared/src/index.ts
+var TEMPO = {
+  mainnet: {
+    chainId: 4217,
+    rpcUrl: "https://rpc.tempo.xyz",
+    explorerUrl: "https://explore.tempo.xyz"
+  },
+  testnet: {
+    chainId: 42431,
+    rpcUrl: "https://rpc.moderato.tempo.xyz",
+    explorerUrl: "https://explore.testnet.tempo.xyz"
+  }
+};
+var TOKENS = {
+  pathUsd: "0x20c0000000000000000000000000000000000000",
+  usdc: "0x20C000000000000000000000b9537d11c60E8b50"
+};
+var DEFAULT_CURRENCY = TOKENS.pathUsd;
+var NETWORKS = {
+  tempo: {
+    id: "tempo",
+    label: "Tempo",
+    token: TOKENS.pathUsd,
+    tokenSymbol: "pathUSD",
+    decimals: 6,
+    mainnet: TEMPO.mainnet,
+    testnet: TEMPO.testnet
+  },
+  arc: {
+    id: "arc",
+    label: "Arc",
+    // Interfaz ERC-20 del USDC nativo de Arc; el gas de la red se paga en ese mismo USDC.
+    token: "0x3600000000000000000000000000000000000000",
+    tokenSymbol: "USDC",
+    decimals: 6,
+    // Leído on-chain del contrato: name() = "USDC", version() = "2".
+    eip3009: { name: "USDC", version: "2" },
+    // Arc no publica direcciones de mainnet todavía (sept 2026).
+    mainnet: null,
+    testnet: {
+      chainId: 5042002,
+      rpcUrl: "https://rpc.testnet.arc.io",
+      explorerUrl: "https://testnet.arcscan.app"
+    }
+  },
+  arbitrum: {
+    id: "arbitrum",
+    label: "Arbitrum",
+    // USDC de Circle en Arbitrum Sepolia. En Arbitrum One vive en otra dirección,
+    // por eso mainnet queda en null hasta que el gateway opere allá.
+    token: "0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d",
+    tokenSymbol: "USDC",
+    decimals: 6,
+    // Leído on-chain: name() = "USD Coin", version() = "2" (distinto al USDC de Arc).
+    eip3009: { name: "USD Coin", version: "2" },
+    mainnet: null,
+    testnet: {
+      chainId: 421614,
+      rpcUrl: "https://sepolia-rollup.arbitrum.io/rpc",
+      explorerUrl: "https://sepolia.arbiscan.io"
+    }
+  },
+  "arbitrum-usdg": {
+    id: "arbitrum-usdg",
+    label: "Arbitrum \xB7 USDG",
+    // Mismo contrato y misma cadena que el riel USDC: cambia el stablecoin.
+    // Un riel es (cadena, token), y el saldo del negocio se lleva por token.
+    token: "0xFFC95faa3d63Cde504a05B567C600B78C0b41892",
+    tokenSymbol: "USDG",
+    decimals: 6,
+    eip3009: { name: "Global Dollar", version: "1" },
+    mainnet: null,
+    testnet: {
+      chainId: 421614,
+      rpcUrl: "https://sepolia-rollup.arbitrum.io/rpc",
+      explorerUrl: "https://sepolia.arbiscan.io"
+    }
+  },
+  robinhood: {
+    id: "robinhood",
+    label: "Robinhood",
+    // USDG de Paxos en Robinhood Chain Testnet (el "USDC" de esa testnet es un
+    // mock sin EIP-3009). Leído on-chain: dominio "Global Dollar", versión "1".
+    token: "0x7E955252E15c84f5768B83c41a71F9eba181802F",
+    tokenSymbol: "USDG",
+    decimals: 6,
+    eip3009: { name: "Global Dollar", version: "1" },
+    mainnet: null,
+    testnet: {
+      chainId: 46630,
+      rpcUrl: "https://rpc.testnet.chain.robinhood.com",
+      explorerUrl: "https://explorer.testnet.chain.robinhood.com"
+    }
+  }
+};
+var NETWORK_IDS = Object.keys(NETWORKS);
+var CHAIN_LABELS = [
+  ...new Map(NETWORK_IDS.map((id) => [NETWORKS[id].testnet.chainId, NETWORKS[id].label.split(" \xB7 ")[0] ?? NETWORKS[id].label])).values()
+];
+var GATEWAY_RAILS = {
+  "gateway-arbitrum": {
+    id: "gateway-arbitrum",
+    label: "Arbitrum \xB7 Nanopayments",
+    chainId: 421614,
+    rpcUrl: "https://sepolia-rollup.arbitrum.io/rpc",
+    token: "0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d",
+    decimals: 6,
+    verifyingContract: "0x0077777d7EBA4688BDeF3E311b846F25870A19B9",
+    facilitatorUrl: "https://gateway-api-testnet.circle.com/v1/x402",
+    sdkChain: "arbitrumSepolia",
+    explorerUrl: "https://sepolia.arbiscan.io"
+  },
+  "gateway-arc": {
+    id: "gateway-arc",
+    label: "Arc \xB7 Nanopayments",
+    chainId: 5042002,
+    rpcUrl: "https://rpc.testnet.arc.network",
+    token: "0x3600000000000000000000000000000000000000",
+    decimals: 6,
+    verifyingContract: "0x0077777d7EBA4688BDeF3E311b846F25870A19B9",
+    facilitatorUrl: "https://gateway-api-testnet.circle.com/v1/x402",
+    sdkChain: "arcTestnet",
+    explorerUrl: "https://testnet.arcscan.app"
+  }
+};
+var GATEWAY_RAIL_IDS = Object.keys(GATEWAY_RAILS);
+
+// src/index.ts
+var GATEWAY_POR_DEFECTO = "https://peaje-gateway.up.railway.app";
+function env(nombre) {
+  return typeof process !== "undefined" ? process.env?.[nombre] : void 0;
+}
+function baseDe({ slug, gateway }) {
+  const raiz = (gateway ?? env("PEAJE_GATEWAY_URL") ?? GATEWAY_POR_DEFECTO).replace(/\/+$/, "");
+  return `${raiz}/${slug}`;
+}
+var SALTO = ["host", "connection", "keep-alive", "proxy-connection", "transfer-encoding", "upgrade", "te", "trailer", "content-length"];
+var avisado = false;
+function _reiniciarAviso() {
+  avisado = false;
+}
+function crearPeaje(opciones) {
+  if (!opciones?.slug) throw new Error("@peaje/proxy: `slug` is required (the business slug from your Peaje dashboard).");
+  const base = baseDe(opciones);
+  const secreto = opciones.secret ?? env("PEAJE_ORIGIN_SECRET") ?? null;
+  const fetchImpl = opciones.fetch ?? ((...a) => fetch(...a));
+  const runtime = crearProxyRuntime({
+    base,
+    secreto,
+    fetchImpl,
+    respaldo: { rutas: RUTAS_PROXY.map((x) => x.path), prefijos: RUTAS_DINAMICAS.map((x) => x.prefijo), patrones: [] }
+  });
+  return {
+    base,
+    async decidir({ method, url, headers }) {
+      if (!secreto && !avisado) {
+        avisado = true;
+        void runtime.sinSecreto().then((faltan) => {
+          if (faltan.length > 0) {
+            console.warn(
+              `[peaje] ${faltan.length} priced API route(s) are not charged on this domain because PEAJE_ORIGIN_SECRET is not set: ${faltan.map((p) => `${p.method} ${p.path}`).join(", ")}. Copy it from the Kit page of your Peaje dashboard into your hosting environment variables.`
+            );
+          }
+        });
+      }
+      const d = await runtime.decidir({ method, pathname: url.pathname, search: url.search, headers });
+      return d?.destino ?? null;
+    },
+    async reenviar(destino, { method, url, headers, body }) {
+      const salida = new Headers(headers);
+      for (const h of SALTO) salida.delete(h);
+      const primero = (h) => headers.get(h)?.split(",")[0]?.trim() || null;
+      salida.set("x-forwarded-host", primero("x-forwarded-host") ?? url.host);
+      salida.set("x-forwarded-proto", primero("x-forwarded-proto") ?? url.protocol.replace(":", ""));
+      const sinBody = method === "GET" || method === "HEAD";
+      const res = await fetchImpl(destino, { method, headers: salida, body: sinBody ? null : body, redirect: "manual" });
+      const vuelta = new Headers(res.headers);
+      vuelta.delete("content-encoding");
+      vuelta.delete("content-length");
+      vuelta.delete("transfer-encoding");
+      vuelta.delete("connection");
+      return new Response(method === "HEAD" ? null : res.body, { status: res.status, statusText: res.statusText, headers: vuelta });
+    }
+  };
+}
+function peajeFetch(opciones) {
+  const peaje = crearPeaje(opciones);
+  return async (request) => {
+    const url = new URL(request.url);
+    const entrada = { method: request.method.toUpperCase(), url, headers: request.headers };
+    const destino = await peaje.decidir(entrada);
+    if (!destino) return null;
+    const body = entrada.method === "GET" || entrada.method === "HEAD" ? null : await request.arrayBuffer();
+    return peaje.reenviar(destino, { ...entrada, body });
+  };
+}
+var src_default = peajeFetch;
+
+export {
+  GATEWAY_POR_DEFECTO,
+  baseDe,
+  _reiniciarAviso,
+  crearPeaje,
+  peajeFetch,
+  src_default
+};