@warda_protocol/vendor 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artautas Jasinskas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,76 @@
+# @warda_protocol/vendor
+
+Sell an API for Kaspa, over HTTP 402.
+
+```ts
+import { priced } from "@warda_protocol/vendor";
+
+export default priced(
+  {
+    payTo: process.env.PAY_TO!,      // the address that must be paid
+    sompi: 4_000_000n,               // 0.04 KAS, exactly
+    network: "mainnet",
+    secret: process.env.QUOTE_SECRET!,
+  },
+  async () => ({ answer: 42 }),
+);
+```
+
+No payment header, and it quotes a price. With one, it looks in the UTXO set for
+a coin **at your address, from the transaction the buyer named, for exactly the
+amount you quoted** — and only then calls your function.
+
+It never reads the payment header as truth. The header is written by the party
+who benefits from lying, and a fabricated transaction id is as easy to write as
+a real one.
+
+## It does not know what a covenant is
+
+A [Warda](https://wardaprotocol.com) grant is one kind of buyer. An ordinary
+wallet is another. This cannot tell them apart and does not try: whether a
+payment was *allowed* is a question answered on the buyer's side before the
+transaction existed. A seller only needs to know whether it arrived.
+
+## Replays are your decision, and you have to make it
+
+A coin at your address stays there. So the same proof verifies every time, and
+a buyer who paid once can call forever. There is no stateless fix — spending
+the coin onward costs a transaction and a fee; binding payment to the request
+body needs both ends to implement it. What a seller needs is a set of
+transaction ids already served:
+
+```ts
+priced({ ..., spent: { has: (id) => redis.sismember("paid", id),
+                       add: (id) => redis.sadd("paid", id) } }, deliver)
+```
+
+The default, `inMemorySpent()`, holds for one process and says so on startup.
+Under any serverless host that is most requests. `replayAllowed()` exists so
+that choosing to allow them is visible in your source rather than looking like
+an oversight.
+
+## The status codes are the API
+
+A buyer holding a broadcast payment reads them to decide whether to wait, stop,
+or re-present the same proof. That difference is one payment or two.
+
+| | |
+|---|---|
+| `402` no header | here is the price |
+| `402` + `retry` | **re-present the same proof.** Not yet visible on chain |
+| `400` | the proof is wrong, or the amount is. Paying again will not help |
+| `409` | this payment already bought one thing |
+| `503` | the seller cannot see the chain. Same proof again, do not re-pay |
+| `502` | paid, and the goods failed. The txid is in the body |
+| `200` | served, with a receipt naming what was checked and which node said so |
+
+## Which node answered
+
+Your security here is "the money is visibly in the UTXO set", which makes the
+node answering that part of your security. `rpc` is tried first, always. A
+`resolver` is consulted only if that fails, and when it does the response says
+so in `readFrom` — a node you do not control is then telling you that you were
+paid. That risk is yours, not the buyer's, which is why the fallback exists at
+all and why it is reported rather than hidden.
+
+MIT.

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Sell an API for Kaspa, over HTTP 402.
+ *
+ * The seller's half of what @warda_protocol/x402 buys. It quotes a price, and
+ * then — before serving anything — looks in the UTXO set for a coin at its own
+ * address, from the transaction the buyer named, for exactly the amount
+ * quoted. It never trusts the payment header, because the header is written by
+ * the party who benefits from lying.
+ *
+ * Nothing here knows what a covenant is. A Warda grant is one kind of buyer;
+ * an ordinary wallet is another; this cannot tell them apart and does not try.
+ * Whether a payment was ALLOWED is a question the buyer's side answered before
+ * the transaction existed. All a seller needs to know is whether it arrived.
+ */
+export { priced, pricedFetch, type PricedOptions, type Deliver } from "./priced.ts";
+export { settle, type SaleTerms, type SettleInput, type SettleResult } from "./settle.ts";
+export { checkPayment, type PaymentClaim, type PaymentCheck } from "./verify.ts";
+export { issueQuote, checkQuote, type QuoteTerms, type QuoteOptions } from "./quote.ts";
+export { inMemorySpent, replayAllowed, type SpentStore } from "./spent.ts";
+export { openNode, type NodeSource, type OpenedNode } from "./node.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,21 @@
+/**
+ * Sell an API for Kaspa, over HTTP 402.
+ *
+ * The seller's half of what @warda_protocol/x402 buys. It quotes a price, and
+ * then — before serving anything — looks in the UTXO set for a coin at its own
+ * address, from the transaction the buyer named, for exactly the amount
+ * quoted. It never trusts the payment header, because the header is written by
+ * the party who benefits from lying.
+ *
+ * Nothing here knows what a covenant is. A Warda grant is one kind of buyer;
+ * an ordinary wallet is another; this cannot tell them apart and does not try.
+ * Whether a payment was ALLOWED is a question the buyer's side answered before
+ * the transaction existed. All a seller needs to know is whether it arrived.
+ */
+export { priced, pricedFetch } from "./priced.js";
+export { settle } from "./settle.js";
+export { checkPayment } from "./verify.js";
+export { issueQuote, checkQuote } from "./quote.js";
+export { inMemorySpent, replayAllowed } from "./spent.js";
+export { openNode } from "./node.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAoC,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,MAAM,EAAuD,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAwC,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAsC,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAoC,MAAM,WAAW,CAAC"}

package/dist/node.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Getting a node to ask, and saying which one answered.
+ *
+ * A seller's entire security here is "the money is visibly in the UTXO set",
+ * which makes the node answering that question part of the security. Reading
+ * your own is the strong version. Everything else is a trade, and the trade is
+ * worth naming rather than hiding: a dishonest node could report a payment
+ * that does not exist and you would hand over the goods. That risk is the
+ * SELLER's — a buyer loses nothing by it — which is why a fallback is offered
+ * at all, and why what it cost you is reported in the response instead of
+ * being left for someone to discover.
+ *
+ * ## Why the fallback exists
+ *
+ * The vendor this was extracted from pointed WARDA_RPC_JSON at a Cloudflare
+ * quick tunnel, which is handed a new random hostname every time it restarts.
+ * It restarted. Every paid request after that failed, including one already
+ * paid for, and nothing said so. An endpoint that only works while one machine
+ * is up is not published.
+ */
+import { NodeClient } from "@warda_protocol/kaspa";
+export interface NodeSource {
+    /** Your node's JSON wRPC url. Tried first, always. */
+    rpc?: string;
+    /** A Kaspa Resolver, used only if `rpc` is absent or unreachable. */
+    resolver?: string;
+    /** Which chain, as kaspad names it: `mainnet`, `testnet-10`. */
+    network: string;
+}
+export interface OpenedNode {
+    client: NodeClient;
+    /** Sentence for the receipt: which node's word this is. */
+    readFrom: string;
+}
+export declare function openNode(source: NodeSource): Promise<OpenedNode>;
+//# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAA6B,MAAM,uBAAuB,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CA8CtE"}

package/dist/node.js

@@ -0,0 +1,64 @@
+/**
+ * Getting a node to ask, and saying which one answered.
+ *
+ * A seller's entire security here is "the money is visibly in the UTXO set",
+ * which makes the node answering that question part of the security. Reading
+ * your own is the strong version. Everything else is a trade, and the trade is
+ * worth naming rather than hiding: a dishonest node could report a payment
+ * that does not exist and you would hand over the goods. That risk is the
+ * SELLER's — a buyer loses nothing by it — which is why a fallback is offered
+ * at all, and why what it cost you is reported in the response instead of
+ * being left for someone to discover.
+ *
+ * ## Why the fallback exists
+ *
+ * The vendor this was extracted from pointed WARDA_RPC_JSON at a Cloudflare
+ * quick tunnel, which is handed a new random hostname every time it restarts.
+ * It restarted. Every paid request after that failed, including one already
+ * paid for, and nothing said so. An endpoint that only works while one machine
+ * is up is not published.
+ */
+import { NodeClient, resolveNode, resolverFrom } from "@warda_protocol/kaspa";
+export async function openNode(source) {
+    let firstFailure = null;
+    if (source.rpc) {
+        try {
+            return {
+                client: await NodeClient.connect({ url: source.rpc }),
+                readFrom: "this vendor's own node",
+            };
+        }
+        catch (e) {
+            firstFailure = e.message;
+        }
+    }
+    const resolver = source.resolver ?? resolverFrom({});
+    if (resolver) {
+        /**
+         * `resolveNode` then `open`, not `open` alone.
+         *
+         * `NodeClient.open` consults a resolver only when NO node is named, and it
+         * counts WARDA_RPC_JSON as naming one — correctly, for its own purposes.
+         * At this point that variable holds the url that just failed, so calling
+         * `open()` here re-dials the dead host and throws the same error twice.
+         * The fallback existed, was deployed, and did nothing. Resolving first and
+         * passing the url explicitly is what actually gets past a
+         * configured-but-unreachable node.
+         */
+        const found = await resolveNode({ resolver, networkId: source.network });
+        const { client, health } = await NodeClient.open({
+            url: found.url,
+            networkId: source.network,
+        });
+        return {
+            client,
+            readFrom: `a public node found by a resolver (kaspad ${health.serverVersion}), because this ` +
+                `vendor's own node could not be reached. A node this vendor does not control is ` +
+                `answering whether you paid it.`,
+        };
+    }
+    throw new Error(firstFailure
+        ? `${firstFailure}\n\nNo resolver was configured, so there was nothing to fall back to.`
+        : "no rpc url and no resolver: this vendor cannot read the chain");
+}
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAiB9E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAkB;IAC/C,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;gBACrD,QAAQ,EAAE,wBAAwB;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,GAAI,CAAW,CAAC,OAAO,CAAC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb;;;;;;;;;;WAUG;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;YAC/C,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EAAE,MAAM,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,QAAQ,EACN,6CAA6C,MAAM,CAAC,aAAa,kBAAkB;gBACnF,iFAAiF;gBACjF,gCAAgC;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,YAAY;QACV,CAAC,CAAC,GAAG,YAAY,uEAAuE;QACxF,CAAC,CAAC,+DAA+D,CACpE,CAAC;AACJ,CAAC"}

package/dist/priced.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The ten-line version.
+ *
+ * `settle` is the whole protocol and takes eight things. Most sellers have one
+ * endpoint, one price and one address, and should not have to assemble a state
+ * machine to charge for it — so this wraps it into the two shapes people
+ * actually deploy: a node:http handler and a Fetch handler.
+ *
+ *     export default priced(
+ *       { payTo: process.env.PAY_TO!, sompi: 4_000_000n, network: "mainnet",
+ *         secret: process.env.QUOTE_SECRET! },
+ *       async () => ({ answer: 42 }),
+ *     );
+ *
+ * Everything the wrapper decides for you is a default you can override, except
+ * one: it will not start without a quote secret, and it will not invent one.
+ * A generated-per-process secret makes every quote unverifiable by the next
+ * process, which on a serverless host is most of them — the failure would be
+ * intermittent, would look like a buyer problem, and would land after the money
+ * was spent.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type SpentStore } from "./spent.ts";
+import { type SaleTerms } from "./settle.ts";
+export interface PricedOptions extends Omit<SaleTerms, "resource"> {
+    /** Signs quotes. Required, and must be the same across every instance. */
+    secret: string;
+    /** What is being sold. Defaults to the request path. */
+    resource?: string;
+    /** How long a quote is good for. Default two minutes. */
+    ttlMs?: number;
+    /** Your node's JSON wRPC url. Falls back to WARDA_RPC_JSON. */
+    rpc?: string;
+    /** A Kaspa Resolver, used only when the node above is unreachable. */
+    resolver?: string;
+    /** Replay protection. Defaults to per-process memory, which warns. */
+    spent?: SpentStore;
+}
+export type Deliver = (context: {
+    txid: string;
+}) => unknown | Promise<unknown>;
+/** For `node:http`, and for hosts that hand you (req, res) — Vercel included. */
+export declare function priced(options: PricedOptions, deliver: Deliver): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/** For Fetch-shaped hosts: Workers, Deno, Bun, and Next's route handlers. */
+export declare function pricedFetch(options: PricedOptions, deliver: Deliver): (request: Request) => Promise<Response>;
+//# sourceMappingURL=priced.d.ts.map

package/dist/priced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"priced.d.ts","sourceRoot":"","sources":["../src/priced.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;IAChE,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAchF,iFAAiF;AACjF,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,IAG/B,KAAK,eAAe,EAAE,KAAK,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC,CAwBxF;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,IAGpC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAuBnE"}

package/dist/priced.js

@@ -0,0 +1,78 @@
+import { openNode } from "./node.js";
+import { inMemorySpent } from "./spent.js";
+import { settle } from "./settle.js";
+function prepare(options) {
+    if (!options.secret) {
+        throw new Error("@warda_protocol/vendor: `secret` is required and cannot be generated for you. It signs " +
+            "quotes, so every instance must use the SAME value — a per-process secret makes each " +
+            "quote unverifiable by the next process, which under a serverless host is most of them.");
+    }
+    const spent = options.spent ?? inMemorySpent();
+    return { spent };
+}
+/** For `node:http`, and for hosts that hand you (req, res) — Vercel included. */
+export function priced(options, deliver) {
+    const { spent } = prepare(options);
+    return async function handler(req, res) {
+        const resource = options.resource ?? (req.url ?? "/").split("?")[0];
+        const header = req.headers["x-payment"];
+        const result = await settle({
+            terms: { ...options, resource },
+            paymentHeader: header === undefined ? null : String(header),
+            quote: { secret: options.secret, ttlMs: options.ttlMs },
+            spent,
+            openNode: () => openNode({
+                rpc: options.rpc ?? process.env.WARDA_RPC_JSON,
+                resolver: options.resolver,
+                network: options.network,
+            }),
+            deliver: () => deliver({ txid: decodeTxid(header) }),
+        });
+        res.writeHead(result.status, {
+            "content-type": "application/json",
+            "access-control-allow-origin": "*",
+        });
+        res.end(JSON.stringify(result.body, null, 2));
+    };
+}
+/** For Fetch-shaped hosts: Workers, Deno, Bun, and Next's route handlers. */
+export function pricedFetch(options, deliver) {
+    const { spent } = prepare(options);
+    return async function handler(request) {
+        const header = request.headers.get("x-payment");
+        const resource = options.resource ?? new URL(request.url).pathname;
+        const result = await settle({
+            terms: { ...options, resource },
+            paymentHeader: header,
+            quote: { secret: options.secret, ttlMs: options.ttlMs },
+            spent,
+            openNode: () => openNode({
+                rpc: options.rpc ?? process.env.WARDA_RPC_JSON,
+                resolver: options.resolver,
+                network: options.network,
+            }),
+            deliver: () => deliver({ txid: decodeTxid(header) }),
+        });
+        return new Response(JSON.stringify(result.body, null, 2), {
+            status: result.status,
+            headers: { "content-type": "application/json", "access-control-allow-origin": "*" },
+        });
+    };
+}
+/* The txid is handed to `deliver` so a seller can file its own receipt against
+   the payment. Decoding it a second time here rather than threading it out of
+   settle keeps that function's return shape about the RESPONSE; by the time
+   deliver runs the header has already been parsed and verified, so this cannot
+   fail in a way that matters. */
+function decodeTxid(header) {
+    if (!header)
+        return "";
+    try {
+        const parsed = JSON.parse(Buffer.from(String(header), "base64").toString("utf8"));
+        return typeof parsed?.txid === "string" ? parsed.txid : "";
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=priced.js.map

package/dist/priced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"priced.js","sourceRoot":"","sources":["../src/priced.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAmB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAmBrD,SAAS,OAAO,CAAC,OAAsB;IACrC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,sFAAsF;YACtF,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,MAAM,CAAC,OAAsB,EAAE,OAAgB;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnC,OAAO,KAAK,UAAU,OAAO,CAAC,GAAoB,EAAE,GAAmB;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE;YAC/B,aAAa,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3D,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YACvD,KAAK;YACL,QAAQ,EAAE,GAAG,EAAE,CACb,QAAQ,CAAC;gBACP,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;gBAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;YACJ,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE;YAC3B,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,GAAG;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,OAAsB,EAAE,OAAgB;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnC,OAAO,KAAK,UAAU,OAAO,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE;YAC/B,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YACvD,KAAK;YACL,QAAQ,EAAE,GAAG,EAAE,CACb,QAAQ,CAAC;gBACP,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;gBAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;YACJ,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACxD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,GAAG,EAAE;SACpF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;iCAIiC;AACjC,SAAS,UAAU,CAAC,MAA4C;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,OAAO,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/quote.d.ts

@@ -0,0 +1,27 @@
+/** What a quote commits to. Change any of it and the signature stops matching. */
+export interface QuoteTerms {
+    /** The resource being sold — usually the request path. */
+    resource: string;
+    /** The exact price. `exact` means exact: over- and under-payment both fail. */
+    sompi: bigint;
+    /** Unix ms after which this quote is refused. */
+    expiresAt: number;
+}
+export interface QuoteOptions {
+    /** The signing secret. Anyone holding it can mint quotes in your name. */
+    secret: string;
+    /** How long a quote stays good. Default two minutes. */
+    ttlMs?: number;
+}
+/** Mint a nonce for these terms: `<expiry>.<mac>`. */
+export declare function issueQuote(terms: QuoteTerms, options: QuoteOptions): string;
+/**
+ * Check a nonce against the terms it claims to be for.
+ *
+ * Returns a reason, or null when it is good. A reason rather than a boolean
+ * because the three ways this fails are three different conversations with the
+ * buyer: a malformed nonce is a client bug, an expired one means ask again,
+ * and a mismatch means the quote came from somewhere else.
+ */
+export declare function checkQuote(nonce: string, terms: Omit<QuoteTerms, "expiresAt">, options: QuoteOptions, now?: number): string | null;
+//# sourceMappingURL=quote.d.ts.map

package/dist/quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.d.ts","sourceRoot":"","sources":["../src/quote.ts"],"names":[],"mappings":"AAwBA,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CAE3E;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EACpC,OAAO,EAAE,YAAY,EACrB,GAAG,GAAE,MAAmB,GACvB,MAAM,GAAG,IAAI,CAaf"}

package/dist/quote.js

@@ -0,0 +1,56 @@
+/**
+ * A quote you can verify without having remembered issuing it.
+ *
+ * The obvious implementation keeps the nonce it just handed out in a variable
+ * and compares on the way back. That works for one caller on localhost and
+ * fails for everything else, in a way worth spelling out because it is the
+ * failure this file exists to prevent: two agents overlapping means the second
+ * quote overwrites the first, and the first agent's perfectly good payment is
+ * then rejected for a nonce mismatch it did nothing to cause — AFTER it has
+ * spent the money. On a serverless host it is worse still, because two
+ * requests need not share a process at all, so the variable is empty for
+ * almost everyone.
+ *
+ * An HMAC over the fields being quoted, plus an expiry, needs no memory: the
+ * server can tell its own quote from a made-up one by recomputing it. That is
+ * what lets this run as a lambda, and it is why the nonce carries its own
+ * expiry in the clear — there is nowhere else to keep it.
+ *
+ * What this does NOT do is stop a quote being used twice. See `spent.ts`: a
+ * signature proves the vendor issued the price, not that the buyer has only
+ * arrived once.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+const mac = (secret, t) => createHmac("sha256", secret)
+    .update(`${t.resource}:${t.sompi}:${t.expiresAt}`)
+    .digest("hex")
+    .slice(0, 32);
+/** Mint a nonce for these terms: `<expiry>.<mac>`. */
+export function issueQuote(terms, options) {
+    return `${terms.expiresAt}.${mac(options.secret, terms)}`;
+}
+/**
+ * Check a nonce against the terms it claims to be for.
+ *
+ * Returns a reason, or null when it is good. A reason rather than a boolean
+ * because the three ways this fails are three different conversations with the
+ * buyer: a malformed nonce is a client bug, an expired one means ask again,
+ * and a mismatch means the quote came from somewhere else.
+ */
+export function checkQuote(nonce, terms, options, now = Date.now()) {
+    const [expiryText, presented] = String(nonce).split(".");
+    const expiresAt = Number(expiryText);
+    if (!expiryText || !presented || !Number.isFinite(expiresAt))
+        return "malformed quote";
+    if (now > expiresAt)
+        return "the quote has expired; ask again";
+    const expected = mac(options.secret, { ...terms, expiresAt });
+    const a = Buffer.from(presented);
+    const b = Buffer.from(expected);
+    /* Length first: timingSafeEqual throws on a mismatch rather than returning
+       false, and a thrown comparison is a 500 where a 400 was meant. */
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return "this quote was not issued here";
+    return null;
+}
+//# sourceMappingURL=quote.js.map

package/dist/quote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.js","sourceRoot":"","sources":["../src/quote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAmB1D,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,CAAa,EAAU,EAAE,CACpD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;KACzB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;KACjD,MAAM,CAAC,KAAK,CAAC;KACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAElB,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,KAAiB,EAAE,OAAqB;IACjE,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,KAAoC,EACpC,OAAqB,EACrB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACvF,IAAI,GAAG,GAAG,SAAS;QAAE,OAAO,kCAAkC,CAAC;IAE/D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;wEACoE;IACpE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,gCAAgC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/settle.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The whole 402 exchange, with no HTTP in it.
+ *
+ * Takes what the request carried and returns what to answer. No req, no res,
+ * no framework — because the same seven branches are correct on node:http, on
+ * a Fetch handler, in a Worker and in a test, and the one place this logic
+ * gets copied is the place the copies drift.
+ *
+ * ## The branches, and why each answers as it does
+ *
+ * The status codes are not decoration. A buyer that has already broadcast a
+ * payment reads them to decide whether to wait, give up, or re-present the
+ * same proof — and the difference between those is the difference between one
+ * payment and two.
+ *
+ *   402 no header       here is the price. Nothing has happened yet.
+ *   400 bad proof       the buyer's client is wrong. Paying again will not help.
+ *   402 not visible     RETRY, with the SAME proof. This is the important one.
+ *   409 already served  this payment bought one thing and has had it.
+ *   503 no node         the seller is blind, not the buyer wrong. Same proof again.
+ *   502 delivery failed paid, and we could not produce it. Says so, with the txid.
+ *   200 served          with a receipt naming what was checked and by whom.
+ *
+ * The 402-with-retry is what stops double payment, so it is deliberately the
+ * same status as the initial quote: a client that treats any 402 as "pay" would
+ * pay twice, and the adapter on the other side of this exists to get that
+ * right. See @warda_protocol/x402.
+ */
+import { type QuoteOptions } from "./quote.ts";
+import type { SpentStore } from "./spent.ts";
+import type { NodeClient } from "@warda_protocol/kaspa";
+export interface SaleTerms {
+    /** What is being sold; goes in the quote's signature. Usually the path. */
+    resource: string;
+    /** The address that must be paid. */
+    payTo: string;
+    /** The exact price in sompi. */
+    sompi: bigint;
+    /** As the buyer's client will read it: `mainnet`, `testnet-10`. */
+    network: string;
+    /** Optional, for the 402 body. */
+    description?: string;
+    /** Who is selling — echoed in the receipt so a buyer knows who it paid. */
+    seller?: string;
+}
+export interface SettleInput {
+    terms: SaleTerms;
+    /** The raw `X-PAYMENT` header, or null when there was none. */
+    paymentHeader: string | null;
+    quote: QuoteOptions;
+    spent: SpentStore;
+    /** Opens a node and says which one. Called only once a proof is presented. */
+    openNode: () => Promise<{
+        client: Pick<NodeClient, "getUtxosByAddresses" | "close">;
+        readFrom: string;
+    }>;
+    /** Produce the goods. Called ONLY after the money is confirmed on chain. */
+    deliver: () => unknown | Promise<unknown>;
+    now?: () => number;
+}
+export interface SettleResult {
+    status: number;
+    body: Record<string, unknown>;
+}
+export declare function settle(input: SettleInput): Promise<SettleResult>;
+//# sourceMappingURL=settle.d.ts.map

package/dist/settle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settle.d.ts","sourceRoot":"","sources":["../src/settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,CAAC;IACjB,+DAA+D;IAC/D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzG,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAID,wBAAsB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAsItE"}

package/dist/settle.js

@@ -0,0 +1,155 @@
+/**
+ * The whole 402 exchange, with no HTTP in it.
+ *
+ * Takes what the request carried and returns what to answer. No req, no res,
+ * no framework — because the same seven branches are correct on node:http, on
+ * a Fetch handler, in a Worker and in a test, and the one place this logic
+ * gets copied is the place the copies drift.
+ *
+ * ## The branches, and why each answers as it does
+ *
+ * The status codes are not decoration. A buyer that has already broadcast a
+ * payment reads them to decide whether to wait, give up, or re-present the
+ * same proof — and the difference between those is the difference between one
+ * payment and two.
+ *
+ *   402 no header       here is the price. Nothing has happened yet.
+ *   400 bad proof       the buyer's client is wrong. Paying again will not help.
+ *   402 not visible     RETRY, with the SAME proof. This is the important one.
+ *   409 already served  this payment bought one thing and has had it.
+ *   503 no node         the seller is blind, not the buyer wrong. Same proof again.
+ *   502 delivery failed paid, and we could not produce it. Says so, with the txid.
+ *   200 served          with a receipt naming what was checked and by whom.
+ *
+ * The 402-with-retry is what stops double payment, so it is deliberately the
+ * same status as the initial quote: a client that treats any 402 as "pay" would
+ * pay twice, and the adapter on the other side of this exists to get that
+ * right. See @warda_protocol/x402.
+ */
+import { checkQuote, issueQuote } from "./quote.js";
+import { checkPayment } from "./verify.js";
+const MAX_TIMEOUT_SECONDS = 60;
+export async function settle(input) {
+    const { terms, quote: quoteOptions, spent } = input;
+    const now = input.now ?? Date.now;
+    if (!input.paymentHeader) {
+        const expiresAt = now() + (quoteOptions.ttlMs ?? 120_000);
+        return {
+            status: 402,
+            body: {
+                x402Version: 1,
+                error: "payment required",
+                accepts: [
+                    {
+                        scheme: "exact",
+                        network: terms.network,
+                        asset: "KAS",
+                        payTo: terms.payTo,
+                        amountSompi: terms.sompi.toString(),
+                        nonce: issueQuote({ resource: terms.resource, sompi: terms.sompi, expiresAt }, quoteOptions),
+                        maxTimeoutSeconds: MAX_TIMEOUT_SECONDS,
+                        ...(terms.description ? { description: terms.description } : {}),
+                    },
+                ],
+            },
+        };
+    }
+    let proof;
+    try {
+        proof = JSON.parse(Buffer.from(input.paymentHeader, "base64").toString("utf8"));
+    }
+    catch {
+        return { status: 400, body: { error: "X-PAYMENT is not base64 JSON" } };
+    }
+    const badQuote = checkQuote(String(proof.nonce ?? ""), { resource: terms.resource, sompi: terms.sompi }, quoteOptions, now());
+    if (badQuote)
+        return { status: 400, body: { error: badQuote } };
+    const txid = typeof proof.txid === "string" ? proof.txid : "";
+    if (!txid)
+        return { status: 400, body: { error: "no txid in the payment proof" } };
+    /* Before the node, not after: a replay is answerable without asking anyone,
+       and asking the chain about a payment already served wastes a round trip to
+       arrive at the same refusal. */
+    if (await spent.has(txid)) {
+        return {
+            status: 409,
+            body: {
+                error: "this payment has already been served",
+                settledBy: txid,
+                detail: "One payment buys one delivery. The coin is still in the UTXO set and always will " +
+                    "be, so presenting it again proves nothing new. Buy again to get another.",
+            },
+        };
+    }
+    let opened;
+    try {
+        opened = await input.openNode();
+    }
+    catch (e) {
+        return {
+            status: 503,
+            body: {
+                error: `could not reach a node: ${e.message}`,
+                detail: "the payment may well be on chain; this vendor cannot see it. Re-present the same " +
+                    "X-PAYMENT header rather than paying again — this vendor has NOT been paid twice " +
+                    "and a second payment would not help.",
+            },
+        };
+    }
+    try {
+        const check = await checkPayment(opened.client, {
+            txid,
+            payTo: terms.payTo,
+            sompi: terms.sompi,
+        });
+        if (!check.paid) {
+            return {
+                status: check.retry ? 402 : 400,
+                body: {
+                    error: check.reason,
+                    ...(check.retry ? { retry: true } : {}),
+                    readFrom: opened.readFrom,
+                },
+            };
+        }
+        /* Recorded BEFORE delivery. If the seller crashes between the two, a buyer
+           loses a purchase it paid for — bad, and recoverable by a human. Recorded
+           after, a crash leaves a payment that can be replayed forever, which is
+           not recoverable by anyone. Of the two ways to be wrong, this is the one
+           that fails towards the seller noticing. */
+        await spent.add(txid);
+        let payload;
+        try {
+            payload = await input.deliver();
+        }
+        catch (e) {
+            return {
+                status: 502,
+                body: {
+                    error: `payment settled but the goods could not be produced: ${e.message}`,
+                    settledBy: txid,
+                    paidTo: terms.payTo,
+                    ...(terms.seller ? { seller: terms.seller } : {}),
+                },
+            };
+        }
+        return {
+            status: 200,
+            body: {
+                ...payload,
+                ...(terms.seller ? { seller: terms.seller } : {}),
+                paidTo: terms.payTo,
+                settledBy: txid,
+                verified: "a UTXO at this endpoint's payee address, from that transaction, for exactly the quoted amount",
+                readFrom: opened.readFrom,
+            },
+        };
+    }
+    catch (e) {
+        return { status: 503, body: { error: `could not reach a node: ${e.message}` } };
+    }
+    finally {
+        opened.client.close();
+    }
+}
+//# sourceMappingURL=settle.js.map

package/dist/settle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settle.js","sourceRoot":"","sources":["../src/settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAqC3C,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAkB;IAC7C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAElC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC;gBACd,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,OAAO;wBACf,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,KAAK,EAAE,KAAK;wBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE;wBACnC,KAAK,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC;wBAC5F,iBAAiB,EAAE,mBAAmB;wBACtC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACjE;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CACzB,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EACzB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAChD,YAAY,EACZ,GAAG,EAAE,CACN,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,CAAC;IAEnF;;qCAEiC;IACjC,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,sCAAsC;gBAC7C,SAAS,EAAE,IAAI;gBACf,MAAM,EACJ,mFAAmF;oBACnF,0EAA0E;aAC7E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,2BAA4B,CAAW,CAAC,OAAO,EAAE;gBACxD,MAAM,EACJ,mFAAmF;oBACnF,kFAAkF;oBAClF,sCAAsC;aACzC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE;YAC9C,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBAC/B,IAAI,EAAE;oBACJ,KAAK,EAAE,KAAK,CAAC,MAAM;oBACnB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;aACF,CAAC;QACJ,CAAC;QAED;;;;qDAI6C;QAC7C,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEtB,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,KAAK,EAAE,wDAAyD,CAAW,CAAC,OAAO,EAAE;oBACrF,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,KAAK,CAAC,KAAK;oBACnB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,GAAI,OAAkB;gBACtB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,KAAK;gBACnB,SAAS,EAAE,IAAI;gBACf,QAAQ,EACN,+FAA+F;gBACjG,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA4B,CAAW,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7F,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/spent.d.ts

@@ -0,0 +1,54 @@
+/**
+ * One payment, one delivery.
+ *
+ * Everything else here can be done with no memory at all: the quote carries
+ * its own signature, and the chain remembers the payment. This cannot. A coin
+ * sitting at your address is a fact that stays true, so a buyer who paid once
+ * can present the same `X-PAYMENT` header a hundred times and every check in
+ * `verify.ts` passes every time. The demo vendor this package was extracted
+ * from has exactly that hole, and on a testnet demo it costs nothing; on a
+ * priced API it is the whole business model.
+ *
+ * There is no clever stateless fix. The alternatives are worse or harder:
+ * spending the coin onward makes delivery cost a transaction and a fee;
+ * binding the payment to the request body is what kaspa-x402 v2 does and needs
+ * both ends to implement it. What a seller actually needs is a set of
+ * transaction ids it has already served, which is a database row.
+ *
+ * So this package asks for one rather than pretending it does not need it. The
+ * interface is two methods so that a Redis SET, a unique index, a KV namespace
+ * or a Map all satisfy it without an adapter.
+ *
+ * ## The default is memory, and it is not a store
+ *
+ * `inMemorySpent()` exists so the first five minutes work. It is per-process,
+ * so under any host that runs more than one — every serverless platform, and
+ * every deployment with two instances — a replayed payment lands on a process
+ * that has not seen it and is served again. It says so in its own name and it
+ * says so on startup. It is a placeholder for a decision, not a decision.
+ */
+export interface SpentStore {
+    /** Has this transaction already been served? */
+    has(txid: string): boolean | Promise<boolean>;
+    /** Record that it has. Called only after the payment verified. */
+    add(txid: string): void | Promise<void>;
+}
+/**
+ * A per-process set. Correct on one long-lived instance, wrong everywhere else.
+ *
+ * The warning goes to stderr once, at construction, rather than on every
+ * request: a line per paid call is a line nobody reads, and the decision this
+ * is standing in for is made at deploy time.
+ */
+export declare function inMemorySpent(options?: {
+    quiet?: boolean;
+}): SpentStore;
+/**
+ * A store that permits replays, for a seller who has decided that is fine.
+ *
+ * Named for what it does rather than offered as `spent: undefined`, because
+ * the difference between "I chose to allow replays" and "I did not think about
+ * replays" should be visible in the source of whatever is deployed.
+ */
+export declare function replayAllowed(): SpentStore;
+//# sourceMappingURL=spent.d.ts.map

package/dist/spent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spent.d.ts","sourceRoot":"","sources":["../src/spent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,kEAAkE;IAClE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,UAAU,CAa3E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,UAAU,CAE1C"}

package/dist/spent.js

@@ -0,0 +1,59 @@
+/**
+ * One payment, one delivery.
+ *
+ * Everything else here can be done with no memory at all: the quote carries
+ * its own signature, and the chain remembers the payment. This cannot. A coin
+ * sitting at your address is a fact that stays true, so a buyer who paid once
+ * can present the same `X-PAYMENT` header a hundred times and every check in
+ * `verify.ts` passes every time. The demo vendor this package was extracted
+ * from has exactly that hole, and on a testnet demo it costs nothing; on a
+ * priced API it is the whole business model.
+ *
+ * There is no clever stateless fix. The alternatives are worse or harder:
+ * spending the coin onward makes delivery cost a transaction and a fee;
+ * binding the payment to the request body is what kaspa-x402 v2 does and needs
+ * both ends to implement it. What a seller actually needs is a set of
+ * transaction ids it has already served, which is a database row.
+ *
+ * So this package asks for one rather than pretending it does not need it. The
+ * interface is two methods so that a Redis SET, a unique index, a KV namespace
+ * or a Map all satisfy it without an adapter.
+ *
+ * ## The default is memory, and it is not a store
+ *
+ * `inMemorySpent()` exists so the first five minutes work. It is per-process,
+ * so under any host that runs more than one — every serverless platform, and
+ * every deployment with two instances — a replayed payment lands on a process
+ * that has not seen it and is served again. It says so in its own name and it
+ * says so on startup. It is a placeholder for a decision, not a decision.
+ */
+/**
+ * A per-process set. Correct on one long-lived instance, wrong everywhere else.
+ *
+ * The warning goes to stderr once, at construction, rather than on every
+ * request: a line per paid call is a line nobody reads, and the decision this
+ * is standing in for is made at deploy time.
+ */
+export function inMemorySpent(options = {}) {
+    const seen = new Set();
+    if (!options.quiet) {
+        console.error("[warda/vendor] replay protection is IN MEMORY. It holds for one process only, so a " +
+            "second instance — or the next cold start — will serve a replayed payment again. " +
+            "Pass a shared `spent` store before charging anyone real money.");
+    }
+    return {
+        has: (txid) => seen.has(txid),
+        add: (txid) => void seen.add(txid),
+    };
+}
+/**
+ * A store that permits replays, for a seller who has decided that is fine.
+ *
+ * Named for what it does rather than offered as `spent: undefined`, because
+ * the difference between "I chose to allow replays" and "I did not think about
+ * replays" should be visible in the source of whatever is deployed.
+ */
+export function replayAllowed() {
+    return { has: () => false, add: () => { } };
+}
+//# sourceMappingURL=spent.js.map

package/dist/spent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spent.js","sourceRoot":"","sources":["../src/spent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AASH;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAA+B,EAAE;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,qFAAqF;YACnF,kFAAkF;YAClF,gEAAgE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAC7C,CAAC"}

package/dist/verify.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Did the money arrive?
+ *
+ * This is the only question a seller actually needs answered, and the only
+ * honest way to answer it is to look at the UTXO set. A vendor that reads the
+ * buyer's `X-PAYMENT` header and believes it has verified nothing: the header
+ * is written by the party who benefits from lying, and a fabricated
+ * transaction id is as easy to write as a real one.
+ *
+ * So: ask a node what is sitting at YOUR address, and look for a coin from the
+ * transaction the buyer named, worth exactly what you quoted.
+ *
+ * ## Three things this deliberately does not accept
+ *
+ * A coin at the right address from a DIFFERENT transaction. Somebody else's
+ * payment, or an earlier one of this buyer's, is not this purchase.
+ *
+ * A coin from the right transaction for a different amount. `exact` is the
+ * scheme's name and its meaning; underpayment is not a discount and
+ * overpayment is not a tip, because a vendor that rounds is a vendor whose
+ * price is a suggestion.
+ *
+ * A transaction that exists in a mempool somewhere. Only a UTXO counts. A
+ * payment in flight is indistinguishable, from here, from one that will never
+ * confirm — and the caller is told to come back rather than refused, because
+ * it has already spent the money.
+ */
+import type { NodeClient } from "@warda_protocol/kaspa";
+export interface PaymentClaim {
+    /** The transaction the buyer says paid you. */
+    txid: string;
+    /** The address you quoted. */
+    payTo: string;
+    /** The exact amount you quoted, in sompi. */
+    sompi: bigint;
+}
+export type PaymentCheck = {
+    paid: true;
+    txid: string;
+}
+/**
+ * Not visible. `retry` is the whole reason this is one shape rather than a
+ * boolean: a buyer whose payment has not landed yet must be told to
+ * re-present the SAME proof, and a buyer whose payment is wrong must not be.
+ * Collapsing those two into "no" is how a client ends up paying twice.
+ */
+ | {
+    paid: false;
+    retry: boolean;
+    reason: string;
+};
+export declare function checkPayment(client: Pick<NodeClient, "getUtxosByAddresses">, claim: PaymentClaim): Promise<PaymentCheck>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC9B;;;;;GAKG;GACD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,wBAAsB,YAAY,CAChC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAC/C,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,YAAY,CAAC,CAiCvB"}

package/dist/verify.js

@@ -0,0 +1,31 @@
+import { toHex } from "@warda_protocol/kaspa";
+export async function checkPayment(client, claim) {
+    const utxos = await client.getUtxosByAddresses([claim.payTo]);
+    const wanted = claim.txid.toLowerCase();
+    const fromThatTx = utxos.filter((u) => toHex(u.outpoint.transactionId).toLowerCase() === wanted);
+    if (fromThatTx.length === 0) {
+        return {
+            paid: false,
+            retry: true,
+            reason: "payment not yet visible on chain",
+        };
+    }
+    const exact = fromThatTx.find((u) => u.entry.value === claim.sompi);
+    if (!exact) {
+        /* The transaction IS there and pays this address the wrong amount. Not a
+           retry: waiting will not change what it paid, and telling a buyer to wait
+           for a payment that can never be accepted is how money gets spent twice
+           chasing a purchase that was refused the first time. Name both figures —
+           the buyer cannot see its own transaction from inside this refusal. */
+        const paid = fromThatTx.map((u) => u.entry.value.toString()).join(", ");
+        return {
+            paid: false,
+            retry: false,
+            reason: `transaction ${claim.txid} pays this address ${paid} sompi, and the quote was ` +
+                `${claim.sompi}. The scheme is "exact": this is not underpayment or overpayment, ` +
+                `it is a different purchase.`,
+        };
+    }
+    return { paid: true, txid: claim.txid };
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAqB9C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA+C,EAC/C,KAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IAEjG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX;;;;gFAIwE;QACxE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,eAAe,KAAK,CAAC,IAAI,sBAAsB,IAAI,4BAA4B;gBAC/E,GAAG,KAAK,CAAC,KAAK,oEAAoE;gBAClF,6BAA6B;SAChC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC"}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@warda_protocol/vendor",
+  "version": "0.1.0",
+  "description": "Sell an API for Kaspa over HTTP 402. Quotes a price, then verifies the payment is in the UTXO set before serving \u2014 it never trusts the payment header.",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --experimental-strip-types --test test/*.test.ts",
+    "typecheck": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+  },
+  "dependencies": {
+    "@warda_protocol/kaspa": "^0.5.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.4.0"
+  },
+  "keywords": [
+    "kaspa",
+    "x402",
+    "http-402",
+    "agent-payments",
+    "paid-api",
+    "vendor"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ArtyKOMarkets/warda.git",
+    "directory": "vendor"
+  },
+  "homepage": "https://wardaprotocol.com",
+  "bugs": {
+    "url": "https://github.com/ArtyKOMarkets/warda/issues"
+  },
+  "sideEffects": false
+}