@seedhape/core 0.1.0

package/dist/x402/client.js

@@ -0,0 +1,291 @@
+/**
+ * x402 client.
+ *
+ * Flow:
+ *   1. Plain request to the resource.
+ *   2. On 402, parse the challenge and pick an acceptable requirement.
+ *   3. Hand the candidate to the caller's `authorise` hook — this is where the
+ *      AP2 policy engine runs and where a human can be asked. If it declines,
+ *      we stop. No signature is ever produced for a declined payment.
+ *   4. Build and sign the selected EVM authorization or Solana transaction.
+ *   5. Replay the request with the version-appropriate payment header.
+ *   6. Decode the settlement response and hand back the result.
+ *
+ * The client never retries a payment automatically. A failed settlement returns
+ * to the caller; an agent looping on 402s is exactly the failure mode the
+ * policy engine's burst limit exists to catch.
+ */
+import { randomBytes } from "node:crypto";
+import { toHex } from "viem";
+import { ExactSvmScheme } from "@x402/svm/exact/client";
+import { NETWORKS } from "../types.js";
+import { validateOutboundUrl } from "./outbound.js";
+import { selectPaymentProvider } from "../wallet/providers.js";
+export class PaymentDeclinedError extends Error {
+    reason;
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "PaymentDeclinedError";
+    }
+}
+export class X402Client {
+    opts;
+    fetchImpl;
+    constructor(opts) {
+        this.opts = opts;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    /**
+     * Fetch a resource, paying if the server demands it.
+     * Returns the final Response plus settlement metadata when a payment happened.
+     */
+    async fetch(input, init = {}, context = {}) {
+        await validateOutboundUrl(input, this.opts.outboundPolicy);
+        const first = await this.fetchImpl(input, init);
+        if (first.status !== 402)
+            return { response: first, paid: false };
+        const challenge = await parseChallenge(first);
+        const requirement = this.select(challenge.accepts);
+        if (!requirement) {
+            throw new PaymentDeclinedError("No payment option offered by the server is acceptable to this client " +
+                `(offered: ${challenge.accepts.map((a) => `${a.scheme}/${a.network}`).join(", ") || "none"}).`, "NO_ACCEPTABLE_REQUIREMENT");
+        }
+        const amount = BigInt(requirement.maxAmountRequired);
+        if (amount > this.opts.absoluteMaxPerPayment) {
+            throw new PaymentDeclinedError(`Server requested ${amount} base units, above the client's absolute ceiling.`, "ABSOLUTE_CEILING");
+        }
+        const url = new URL(input);
+        const decision = await this.opts.authorise({
+            requirement,
+            amount,
+            host: url.host,
+            resource: requirement.resource || input,
+        });
+        if (!decision.approved) {
+            throw new PaymentDeclinedError(decision.reason ?? "Payment was not authorised.", "POLICY_DECLINED");
+        }
+        const provider = this.opts.paymentProviders?.length
+            ? selectPaymentProvider(this.opts.paymentProviders, requirement)
+            : undefined;
+        let header;
+        let headerName = challenge.x402Version >= 2
+            ? "PAYMENT-SIGNATURE"
+            : "X-PAYMENT";
+        if (provider) {
+            const permission = await provider.currentPermission();
+            if (!permission || permission.revoked) {
+                throw new PaymentDeclinedError(`The ${provider.kind} permission is not active.`, "PERMISSION_UNAVAILABLE");
+            }
+            const remaining = await provider.remainingAllowance();
+            if (remaining !== null && remaining < amount) {
+                throw new PaymentDeclinedError(`The ${provider.kind} permission has ${remaining} base units remaining, below the ${amount} required.`, "PERMISSION_ALLOWANCE_EXHAUSTED");
+            }
+            const authorisation = await provider.createPaymentAuthorization({ requirement, resource: requirement.resource || input });
+            const providerPayload = challenge.x402Version >= 2
+                ? { x402Version: 2, accepted: wireRequirement(requirement), payload: authorisation.payload, ...(context.ap2 ? { extensions: { ap2: context.ap2 } } : {}) }
+                : { x402Version: challenge.x402Version, scheme: "exact", network: requirement.network, payload: authorisation.payload, ...(context.ap2 ? { extensions: { ap2: context.ap2 } } : {}) };
+            header = encodePayment(providerPayload);
+        }
+        else {
+            const payload = await this.buildPayment(requirement, amount, challenge.x402Version);
+            if (context.ap2)
+                payload.extensions = { ...(payload.extensions ?? {}), ap2: context.ap2 };
+            header = encodePayment(payload);
+            if (challenge.x402Version >= 2 || requirement.network.startsWith("solana:")) {
+                headerName = "PAYMENT-SIGNATURE";
+            }
+        }
+        const headers = new Headers(init.headers);
+        headers.set(headerName, header);
+        // Ask the facilitator-backed server to return settlement details.
+        headers.set("Access-Control-Expose-Headers", "X-PAYMENT-RESPONSE");
+        await validateOutboundUrl(input, this.opts.outboundPolicy);
+        const second = await this.fetchImpl(input, { ...init, headers });
+        const settlement = decodeSettlement(second);
+        await this.opts.onSettlement?.(decision.spendId, settlement, second.status);
+        return {
+            response: second,
+            paid: true,
+            settlement: settlement ?? undefined,
+            requirement,
+            amount,
+        };
+    }
+    /** Probe a resource's price without paying. Used by the `quote` MCP tool. */
+    async quote(input) {
+        await validateOutboundUrl(input, this.opts.outboundPolicy);
+        const res = await this.fetchImpl(input, { method: "GET" });
+        if (res.status !== 402)
+            return null;
+        return parseChallenge(res);
+    }
+    select(accepts) {
+        const allowedNetworks = new Set(this.opts.allowedNetworks);
+        const viable = accepts.filter((a) => a.scheme === "exact" &&
+            allowedNetworks.has(a.network) &&
+            this.opts.allowedAssets.some((allowed) => assetsEqual(a.network, allowed, a.asset)));
+        if (viable.length === 0)
+            return null;
+        // Cheapest wins. Ties broken by first offered, which is the merchant's preference.
+        return viable.reduce((best, cur) => BigInt(cur.maxAmountRequired) < BigInt(best.maxAmountRequired) ? cur : best);
+    }
+    async buildPayment(req, amount, x402Version) {
+        if (req.network.startsWith("solana:")) {
+            if (!this.opts.svmSigner) {
+                throw new PaymentDeclinedError("No Solana signer is configured for this payment.", "SIGNER_UNAVAILABLE");
+            }
+            const scheme = new ExactSvmScheme(this.opts.svmSigner, this.opts.svmRpcUrl
+                ? { rpcUrl: this.opts.svmRpcUrl }
+                : undefined);
+            const accepted = wireRequirement(req);
+            const result = await scheme.createPaymentPayload(x402Version, accepted);
+            return {
+                x402Version,
+                accepted,
+                resource: {
+                    url: req.resource,
+                    description: req.description,
+                    mimeType: req.mimeType ?? "application/json",
+                },
+                payload: result.payload,
+            };
+        }
+        if (!this.opts.signer) {
+            throw new PaymentDeclinedError("No EVM signer is configured for this payment.", "SIGNER_UNAVAILABLE");
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const authorization = {
+            from: this.opts.signer.address,
+            to: req.payTo,
+            value: amount.toString(),
+            // Backdate slightly to tolerate clock skew between us and the facilitator.
+            validAfter: String(now - 60),
+            validBefore: String(now + (req.maxTimeoutSeconds || 300)),
+            nonce: toHex(randomBytes(32)),
+        };
+        const chainId = chainIdFor(req.network);
+        const signature = await this.opts.signer.signTypedData({
+            domain: {
+                name: req.extra?.name ?? "USD Coin",
+                version: req.extra?.version ?? "2",
+                chainId,
+                verifyingContract: req.asset,
+            },
+            types: {
+                TransferWithAuthorization: [
+                    { name: "from", type: "address" },
+                    { name: "to", type: "address" },
+                    { name: "value", type: "uint256" },
+                    { name: "validAfter", type: "uint256" },
+                    { name: "validBefore", type: "uint256" },
+                    { name: "nonce", type: "bytes32" },
+                ],
+            },
+            primaryType: "TransferWithAuthorization",
+            message: {
+                from: authorization.from,
+                to: authorization.to,
+                value: BigInt(authorization.value),
+                validAfter: BigInt(authorization.validAfter),
+                validBefore: BigInt(authorization.validBefore),
+                nonce: authorization.nonce,
+            },
+        });
+        return x402Version >= 2
+            ? {
+                x402Version,
+                accepted: wireRequirement(req),
+                resource: { url: req.resource, description: req.description, mimeType: req.mimeType ?? "application/json" },
+                payload: { signature, authorization },
+            }
+            : { x402Version, scheme: "exact", network: req.network, payload: { signature, authorization } };
+    }
+}
+function assetsEqual(network, allowed, offered) {
+    return network.startsWith("solana:")
+        ? allowed === offered
+        : allowed.toLowerCase() === offered.toLowerCase();
+}
+// --- wire helpers ----------------------------------------------------------
+export function normaliseNetwork(n) {
+    if (n.includes(":"))
+        return n;
+    const known = NETWORKS[n];
+    return known ? known.caip2 : n;
+}
+export function chainIdFor(network) {
+    if (network.startsWith("eip155:"))
+        return Number(network.split(":")[1]);
+    const known = NETWORKS[network];
+    if (!known)
+        throw new Error(`Unknown network: ${network}`);
+    return known.chainId;
+}
+async function parseChallenge(res) {
+    let raw;
+    try {
+        const encoded = res.headers.get("payment-required");
+        raw = encoded
+            ? JSON.parse(Buffer.from(encoded, "base64").toString("utf8"))
+            : await res.clone().json();
+    }
+    catch {
+        throw new PaymentDeclinedError("Server returned 402 with a body that is not valid x402 JSON.", "MALFORMED_CHALLENGE");
+    }
+    const resource = isRecord(raw.resource) ? raw.resource : undefined;
+    const rawAccepts = Array.isArray(raw.accepts) ? raw.accepts : [];
+    const accepts = rawAccepts.filter(isRecord).map((entry) => ({
+        ...entry,
+        network: normaliseNetwork(String(entry.network ?? "")),
+        maxAmountRequired: String(entry.amount ?? entry.maxAmountRequired ?? ""),
+        amount: String(entry.amount ?? entry.maxAmountRequired ?? ""),
+        resource: typeof entry.resource === "string" ? entry.resource : String(resource?.url ?? ""),
+        description: typeof entry.description === "string" ? entry.description : String(resource?.description ?? ""),
+        mimeType: typeof entry.mimeType === "string" ? entry.mimeType : typeof resource?.mimeType === "string" ? resource.mimeType : undefined,
+        payTo: String(entry.payTo ?? entry.recipient ?? ""),
+        asset: String(entry.asset ?? entry.currency ?? ""),
+        maxTimeoutSeconds: Number(entry.maxTimeoutSeconds ?? 300),
+        extra: isRecord(entry.extra) ? entry.extra : undefined,
+    }));
+    return {
+        x402Version: typeof raw.x402Version === "number" ? raw.x402Version : 1,
+        accepts,
+        resource: resource,
+        extensions: isRecord(raw.extensions) ? raw.extensions : undefined,
+        error: typeof raw.error === "string" ? raw.error : undefined,
+        ap2CheckoutJwt: res.headers.get("ap2-checkout-jwt") ?? undefined,
+    };
+}
+function wireRequirement(req) {
+    return {
+        scheme: req.scheme,
+        network: req.network,
+        amount: req.maxAmountRequired,
+        asset: req.asset,
+        payTo: req.payTo,
+        maxTimeoutSeconds: req.maxTimeoutSeconds,
+        ...(req.extra ? { extra: req.extra } : {}),
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function encodePayment(p) {
+    return Buffer.from(JSON.stringify(p), "utf8").toString("base64");
+}
+export function decodePayment(header) {
+    return JSON.parse(Buffer.from(header, "base64").toString("utf8"));
+}
+function decodeSettlement(res) {
+    const h = res.headers.get("payment-response") ?? res.headers.get("x-payment-response");
+    if (!h)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(h, "base64").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/x402/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/x402/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAA8B,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAkC,MAAM,wBAAwB,CAAC;AAgE/F,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGlC;IAFX,YACE,OAAe,EACN,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,UAAU;IAGQ;IAFZ,SAAS,CAAe;IAEzC,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,KAAa,EACb,OAAoB,EAAE,EACtB,UAA8B,EAAE;QAQhC,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAElE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,oBAAoB,CAC5B,uEAAuE;gBACrE,aAAa,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,EAChG,2BAA2B,CAC5B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,IAAI,oBAAoB,CAC5B,oBAAoB,MAAM,mDAAmD,EAC7E,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YACzC,WAAW;YACX,MAAM;YACN,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,KAAK;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,CAAC,MAAM,IAAI,6BAA6B,EAChD,iBAAiB,CAClB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM;YACjD,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,MAAc,CAAC;QACnB,IAAI,UAAU,GAAsC,SAAS,CAAC,WAAW,IAAI,CAAC;YAC5E,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,WAAW,CAAC;QAChB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACtD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,IAAI,oBAAoB,CAAC,OAAO,QAAQ,CAAC,IAAI,4BAA4B,EAAE,wBAAwB,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACtD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,oBAAoB,CAC5B,OAAO,QAAQ,CAAC,IAAI,mBAAmB,SAAS,oCAAoC,MAAM,YAAY,EACtG,gCAAgC,CACjC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;YAC1H,MAAM,eAAe,GAAmB,SAAS,CAAC,WAAW,IAAI,CAAC;gBAChE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC1J,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxL,MAAM,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;YACpF,IAAI,OAAO,CAAC,GAAG;gBAAE,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1F,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,SAAS,CAAC,WAAW,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,UAAU,GAAG,mBAAmB,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChC,kEAAkE;QAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,oBAAoB,CAAC,CAAC;QAEnE,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAE5E,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,UAAU,IAAI,SAAS;YACnC,WAAW;YACX,MAAM;SACP,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,MAAM,CAAC,OAA6B;QAC1C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,OAAO;YACpB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CACtF,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,mFAAmF;QACnF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACjC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAC5E,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAuB,EACvB,MAAc,EACd,WAAmB;QAEnB,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,oBAAoB,CAAC,kDAAkD,EAAE,oBAAoB,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBACxE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACjC,CAAC,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAC9C,WAAW,EACX,QAAkD,CACnD,CAAC;YACF,OAAO;gBACL,WAAW;gBACX,QAAQ;gBACR,QAAQ,EAAE;oBACR,GAAG,EAAE,GAAG,CAAC,QAAQ;oBACjB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,kBAAkB;iBAC7C;gBACD,OAAO,EAAE,MAAM,CAAC,OAAkC;aACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,+CAA+C,EAAE,oBAAoB,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,aAAa,GAA0B;YAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAC9B,EAAE,EAAE,GAAG,CAAC,KAAgB;YACxB,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;YACxB,2EAA2E;YAC3E,UAAU,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAC5B,WAAW,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;YACzD,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;SAC9B,CAAC;QAEF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACrD,MAAM,EAAE;gBACN,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,UAAU;gBACnC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG;gBAClC,OAAO;gBACP,iBAAiB,EAAE,GAAG,CAAC,KAAK;aAC7B;YACD,KAAK,EAAE;gBACL,yBAAyB,EAAE;oBACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;oBACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;oBAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;oBACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;oBACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;iBACnC;aACF;YACD,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE;gBACP,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,EAAE,EAAE,aAAa,CAAC,EAAE;gBACpB,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;gBAClC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;gBAC5C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;gBAC9C,KAAK,EAAE,aAAa,CAAC,KAAK;aAC3B;SACF,CAAC,CAAC;QAEH,OAAO,WAAW,IAAI,CAAC;YACrB,CAAC,CAAC;gBACE,WAAW;gBACX,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;gBAC9B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,kBAAkB,EAAE;gBAC3G,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE;aACtC;YACH,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC;IACpG,CAAC;CACF;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,OAAe,EAAE,OAAe;IACpE,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAClC,CAAC,CAAC,OAAO,KAAK,OAAO;QACrB,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,GAAG,GAAG,OAAO;YACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B;YACxF,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAA6B,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,EAC9D,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,GAAG,KAAK;QACR,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACtD,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACxE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC7D,QAAQ,EAAE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QAC3F,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;QAC5G,QAAQ,EAAE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACtI,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QACnD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClD,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,GAAG,CAAC;QACzD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC,CAAyB,CAAC;IAC5B,OAAO;QACL,WAAW,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO;QACP,QAAQ,EAAE,QAA+C;QACzD,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC5D,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC9C,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,iBAAiB;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAiB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAa;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/x402/outbound.d.ts

@@ -0,0 +1,15 @@
+export interface OutboundRequestPolicy {
+    /** Allow loopback/private/link-local destinations only in isolated tests. */
+    allowPrivateNetworks?: boolean;
+    /** Production callers should require HTTPS for merchant resources. */
+    requireHttps?: boolean;
+}
+/**
+ * Validate a merchant URL before the server makes an agent-controlled request.
+ * DNS is resolved here so hostnames that point at private infrastructure are
+ * rejected before fetch is called. Production deployments should pair this
+ * with an egress proxy that pins the validated address to close the remaining
+ * DNS time-of-check/time-of-use gap.
+ */
+export declare function validateOutboundUrl(input: string, policy?: OutboundRequestPolicy): Promise<URL>;
+//# sourceMappingURL=outbound.d.ts.map

package/dist/x402/outbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../src/x402/outbound.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,sEAAsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAyBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,qBAA0B,GACjC,OAAO,CAAC,GAAG,CAAC,CA8Bd"}

package/dist/x402/outbound.js

@@ -0,0 +1,59 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+const PRIVATE_IPV4 = [
+    [/^10\./, "private 10/8"],
+    [/^127\./, "loopback"],
+    [/^169\.254\./, "link-local"],
+    [/^172\.(1[6-9]|2\d|3[01])\./, "private 172.16/12"],
+    [/^192\.168\./, "private 192.168/16"],
+];
+function privateAddress(address) {
+    if (isIP(address) === 4) {
+        return PRIVATE_IPV4.find(([pattern]) => pattern.test(address))?.[1];
+    }
+    if (isIP(address) === 6) {
+        const normalized = address.toLowerCase();
+        if (normalized === "::1")
+            return "loopback";
+        if (normalized.startsWith("fe80:"))
+            return "link-local";
+        if (normalized.startsWith("fc") || normalized.startsWith("fd"))
+            return "private IPv6";
+    }
+    return undefined;
+}
+/**
+ * Validate a merchant URL before the server makes an agent-controlled request.
+ * DNS is resolved here so hostnames that point at private infrastructure are
+ * rejected before fetch is called. Production deployments should pair this
+ * with an egress proxy that pins the validated address to close the remaining
+ * DNS time-of-check/time-of-use gap.
+ */
+export async function validateOutboundUrl(input, policy = {}) {
+    const url = new URL(input);
+    const requireHttps = policy.requireHttps ?? process.env.NODE_ENV === "production";
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`Outbound resource must use HTTP(S), got ${url.protocol}`);
+    }
+    if (requireHttps && url.protocol !== "https:") {
+        throw new Error("Outbound resource must use HTTPS in production.");
+    }
+    if (url.username || url.password) {
+        throw new Error("Outbound resource URLs must not contain embedded credentials.");
+    }
+    if (policy.allowPrivateNetworks)
+        return url;
+    const literalReason = privateAddress(url.hostname);
+    if (literalReason) {
+        throw new Error(`Outbound resource resolves to a blocked ${literalReason} address.`);
+    }
+    const addresses = await lookup(url.hostname, { all: true, verbatim: true });
+    for (const address of addresses) {
+        const reason = privateAddress(address.address);
+        if (reason) {
+            throw new Error(`Outbound resource resolves to a blocked ${reason} address.`);
+        }
+    }
+    return url;
+}
+//# sourceMappingURL=outbound.js.map

package/dist/x402/outbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.js","sourceRoot":"","sources":["../../src/x402/outbound.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAShC,MAAM,YAAY,GAAG;IACnB,CAAC,OAAO,EAAE,cAAc,CAAC;IACzB,CAAC,QAAQ,EAAE,UAAU,CAAC;IACtB,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,4BAA4B,EAAE,mBAAmB,CAAC;IACnD,CAAC,aAAa,EAAE,oBAAoB,CAAC;CAC7B,CAAC;AAEX,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC;QACxD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,cAAc,CAAC;IACxF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,SAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAElF,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB;QAAE,OAAO,GAAG,CAAC;IAE5C,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,2CAA2C,aAAa,WAAW,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,WAAW,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/x402/types.d.ts

@@ -0,0 +1,80 @@
+import type { Address, Hex } from "../types.js";
+/**
+ * A single payment option offered by the merchant in a 402 response.
+ * Field names follow x402 v2's chain-neutral `exact` requirements. Legacy EVM
+ * network aliases are normalized to CAIP-2 by the parser.
+ */
+export interface PaymentRequirement {
+    scheme: "exact" | string;
+    /** "base" (v1) or "eip155:8453" (v2). Normalised to CAIP-2 by the parser. */
+    network: string;
+    /** Max amount in asset base units, as a decimal string. */
+    maxAmountRequired: string;
+    /** Native x402 v2 wire name; retained alongside the normalized alias. */
+    amount?: string;
+    resource: string;
+    description: string;
+    mimeType?: string;
+    payTo: string;
+    maxTimeoutSeconds: number;
+    /** ERC-20 contract address or Solana token mint. */
+    asset: string;
+    /** EIP-712 domain of the token, needed to sign EIP-3009. */
+    extra?: {
+        name?: string;
+        version?: string;
+        decimals?: number;
+        assetTransferMethod?: "eip3009" | "erc7710" | "permit2" | "coinbase-spend-permission" | string;
+        facilitatorAddresses?: Address[];
+        feePayer?: string;
+        recentBlockhash?: string;
+        lastValidBlockHeight?: string;
+        memo?: string;
+        [key: string]: unknown;
+    };
+    outputSchema?: unknown;
+}
+export interface PaymentRequiredResponse {
+    x402Version: number;
+    accepts: PaymentRequirement[];
+    resource?: {
+        url: string;
+        description?: string;
+        mimeType?: string;
+        [key: string]: unknown;
+    };
+    extensions?: Record<string, unknown>;
+    error?: string;
+    ap2CheckoutJwt?: string;
+}
+/** EIP-3009 TransferWithAuthorization parameters. */
+export interface ExactEvmAuthorization {
+    from: Address;
+    to: Address;
+    value: string;
+    validAfter: string;
+    validBefore: string;
+    nonce: Hex;
+}
+export interface ExactEvmPayload {
+    signature: Hex;
+    authorization: ExactEvmAuthorization;
+}
+export interface PaymentPayload {
+    x402Version: number;
+    scheme?: string;
+    network?: string;
+    accepted?: Record<string, unknown>;
+    resource?: Record<string, unknown>;
+    payload: ExactEvmPayload | Record<string, unknown>;
+    extensions?: Record<string, unknown>;
+}
+/** Decoded X-PAYMENT-RESPONSE header returned by the merchant on success. */
+export interface SettlementResponse {
+    success: boolean;
+    transaction?: string;
+    network?: string;
+    payer?: string;
+    errorReason?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/x402/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/x402/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mBAAmB,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,2BAA2B,GAAG,MAAM,CAAC;QAC/F,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,GAAG,CAAC;IACf,aAAa,EAAE,qBAAqB,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/x402/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/x402/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/x402/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@seedhape/core",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": ["dist"],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "dependencies": {
+    "@solana/kit": "^5.5.1",
+    "@x402/core": "2.23.0",
+    "@x402/svm": "2.23.0",
+    "jose": "^6.2.10",
+    "pg": "^8.16.3",
+    "viem": "^2.21.0"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.15.5"
+  }
+}