@x402jp/delivery-receipt-verify 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,3 @@
-# Temporary Holding Version
+# @x402jp/delivery-receipt-verify
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+x402 の Delivery Receipt（買い手側の検証と再取得。実行時の依存なし）。使い方・仕様は https://github.com/kato9292929/delivery-receipt を参照。

package/dist/index.d.ts

@@ -0,0 +1,148 @@
+/**
+ * @x402jp/delivery-receipt-verify
+ *
+ * Buyer-side verifier for x402 Delivery Receipts.
+ *
+ * This file is intentionally self-contained: it depends only on `node:crypto`
+ * and the global `fetch`, so it can be vendor-copied into another repository
+ * as a single file. See docs/spec.md for the protocol.
+ */
+import { type KeyObject } from "node:crypto";
+export declare const RECEIPT_VERSION: 1;
+/** Response header carrying the encoded receipt. */
+export declare const RECEIPT_HEADER = "X-Delivery-Receipt";
+/** Request header a buyer sets (with the payment_id) to ask for a refetch. */
+export declare const REFETCH_HEADER = "X-Payment-Refetch";
+/** Path of the seller's public key document. */
+export declare const WELL_KNOWN_PATH = "/.well-known/x402-receipt.json";
+/** Minimum refetch window a seller may advertise (24h). */
+export declare const MIN_REFETCH_WINDOW_S = 86400;
+/** Default refetch window / retention (7 days). */
+export declare const DEFAULT_REFETCH_WINDOW_S = 604800;
+export type Delivery = "first" | "refetch";
+/** Every receipt field except `sig`; this is what gets signed. */
+export interface ReceiptPayload {
+    v: 1;
+    /** Solana: transfer tx signature. EVM: EIP-3009 authorization nonce (0x + 64 hex). */
+    payment_id: string;
+    /** CAIP-2 network id, e.g. "eip155:8453" or "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp". */
+    network: string;
+    /** Absolute URL of the paid resource. */
+    resource: string;
+    /** Lowercase hex sha256 of the exact response body bytes. */
+    body_sha256: string;
+    /** Body length in bytes. */
+    content_length: number;
+    /** ISO 8601 UTC timestamp of when this receipt was signed. */
+    issued_at: string;
+    delivery: Delivery;
+    key_id: string;
+}
+export interface Receipt extends ReceiptPayload {
+    /** base64url (no padding) Ed25519 signature over canonicalJson(payload). */
+    sig: string;
+}
+export interface WellKnownKey {
+    key_id: string;
+    alg: "Ed25519";
+    /** base64url (no padding) of the raw 32-byte Ed25519 public key. */
+    public_key: string;
+    /** ISO 8601. Receipts are valid under this key only if issued_at < revoked_at. */
+    revoked_at?: string;
+}
+export interface WellKnown {
+    keys: WellKnownKey[];
+    refetch_window_s: number;
+    refetch_header: string;
+}
+export type VerifyFailureReason = "receipt_missing" | "receipt_bad_signature" | "receipt_hash_mismatch" | "receipt_key_unknown";
+export type VerifyResult = {
+    ok: true;
+    receipt: Receipt;
+} | {
+    ok: false;
+    reason: VerifyFailureReason;
+    detail?: string;
+};
+export type RefetchFailureReason = "refetch_expired" | "refetch_refused" | VerifyFailureReason;
+export type RefetchResult = {
+    ok: true;
+    body: Uint8Array;
+    receipt: Receipt;
+    status: number;
+} | {
+    ok: false;
+    reason: RefetchFailureReason;
+    status?: number;
+    detail?: string;
+};
+export type FetchLike = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export interface VerifyReceiptInput {
+    /** Raw value of the X-Delivery-Receipt header (null when absent). */
+    header: string | null | undefined;
+    /** Exact response body bytes as received. */
+    body: Uint8Array;
+    wellKnown: WellKnown;
+    /** Optional bindings the caller expects the receipt to carry. */
+    expect?: {
+        payment_id?: string;
+        resource?: string;
+    };
+}
+export interface RefetchInput {
+    url: string;
+    /**
+     * The ORIGINAL payment header(s) sent with the first request, e.g.
+     * `{ "PAYMENT-SIGNATURE": "<base64>" }` (x402 v2) or `{ "X-PAYMENT": "<base64>" }` (v1).
+     */
+    paymentHeaders: Record<string, string>;
+    paymentId: string;
+    /** Seller key document; fetched from `<origin>/.well-known/x402-receipt.json` when omitted. */
+    wellKnown?: WellKnown;
+    fetch?: FetchLike;
+    /** Extra request headers (e.g. Accept). */
+    headers?: Record<string, string>;
+    /** Additionally require receipt.resource to equal this value. */
+    expectResource?: string;
+}
+/** base64url without padding. */
+export declare function base64urlEncode(bytes: Uint8Array): string;
+/** Strict base64url decode (no padding, no '+' or '/'). Throws on invalid input. */
+export declare function base64urlDecode(s: string): Uint8Array;
+/** Lowercase hex sha256. */
+export declare function sha256Hex(bytes: Uint8Array | string): string;
+/**
+ * Canonical JSON: object keys sorted (recursively, by UTF-16 code unit order,
+ * which equals alphabetical order for ASCII keys), no whitespace. Array order is
+ * preserved; `undefined` object members are omitted as in JSON.stringify.
+ */
+export declare function canonicalJson(value: unknown): string;
+/** The exact bytes that are signed: UTF-8 canonical JSON of every field except `sig`. */
+export declare function receiptSigningBytes(receipt: ReceiptPayload | Receipt): Uint8Array;
+/** Encode a receipt as the X-Delivery-Receipt header value (base64url of its JSON). */
+export declare function encodeReceipt(receipt: Receipt): string;
+/** Decode and shape-check an X-Delivery-Receipt header value. Throws on malformed input. */
+export declare function decodeReceipt(header: string): Receipt;
+/** Import a base64url raw 32-byte Ed25519 public key. */
+export declare function importEd25519PublicKey(publicKeyB64u: string): KeyObject;
+/** Shape-check a parsed well-known document. Throws on malformed input. */
+export declare function parseWellKnown(doc: unknown): WellKnown;
+/** Fetch and validate `<origin>/.well-known/x402-receipt.json`. */
+export declare function fetchWellKnown(origin: string, opts?: {
+    fetch?: FetchLike;
+}): Promise<WellKnown>;
+/**
+ * Verify a receipt against the exact body bytes and the seller's key document.
+ *
+ * Check order: presence -> key lookup -> signature -> revocation -> body hash -> expectations.
+ * An `expect` mismatch is reported as `receipt_bad_signature` (the receipt does not
+ * attest to what the caller asked for) with a `detail`.
+ */
+export declare function verifyReceipt(input: VerifyReceiptInput): VerifyResult;
+/**
+ * Re-fetch already-paid content by re-sending the original payment header plus
+ * `X-Payment-Refetch: <payment_id>`, then verify the returned receipt.
+ *
+ * 410 -> refetch_expired; any other non-200 (including 402) -> refetch_refused.
+ */
+export declare function refetch(input: RefetchInput): Promise<RefetchResult>;

package/dist/index.js

@@ -0,0 +1,261 @@
+/**
+ * @x402jp/delivery-receipt-verify
+ *
+ * Buyer-side verifier for x402 Delivery Receipts.
+ *
+ * This file is intentionally self-contained: it depends only on `node:crypto`
+ * and the global `fetch`, so it can be vendor-copied into another repository
+ * as a single file. See docs/spec.md for the protocol.
+ */
+import { createHash, createPublicKey, verify as cryptoVerify } from "node:crypto";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+export const RECEIPT_VERSION = 1;
+/** Response header carrying the encoded receipt. */
+export const RECEIPT_HEADER = "X-Delivery-Receipt";
+/** Request header a buyer sets (with the payment_id) to ask for a refetch. */
+export const REFETCH_HEADER = "X-Payment-Refetch";
+/** Path of the seller's public key document. */
+export const WELL_KNOWN_PATH = "/.well-known/x402-receipt.json";
+/** Minimum refetch window a seller may advertise (24h). */
+export const MIN_REFETCH_WINDOW_S = 86_400;
+/** Default refetch window / retention (7 days). */
+export const DEFAULT_REFETCH_WINDOW_S = 604_800;
+// ---------------------------------------------------------------------------
+// Encoding helpers
+// ---------------------------------------------------------------------------
+const B64URL_RE = /^[A-Za-z0-9_-]*$/;
+/** base64url without padding. */
+export function base64urlEncode(bytes) {
+    return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64url");
+}
+/** Strict base64url decode (no padding, no '+' or '/'). Throws on invalid input. */
+export function base64urlDecode(s) {
+    if (!B64URL_RE.test(s) || s.length % 4 === 1)
+        throw new Error("invalid base64url");
+    return new Uint8Array(Buffer.from(s, "base64url"));
+}
+/** Lowercase hex sha256. */
+export function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * Canonical JSON: object keys sorted (recursively, by UTF-16 code unit order,
+ * which equals alphabetical order for ASCII keys), no whitespace. Array order is
+ * preserved; `undefined` object members are omitted as in JSON.stringify.
+ */
+export function canonicalJson(value) {
+    if (value === null)
+        return "null";
+    switch (typeof value) {
+        case "string":
+        case "boolean":
+            return JSON.stringify(value);
+        case "number":
+            if (!Number.isFinite(value))
+                throw new Error("canonicalJson: non-finite number");
+            return JSON.stringify(value);
+        case "object": {
+            if (Array.isArray(value)) {
+                return "[" + value.map((v) => (v === undefined ? "null" : canonicalJson(v))).join(",") + "]";
+            }
+            const obj = value;
+            const keys = Object.keys(obj)
+                .filter((k) => obj[k] !== undefined)
+                .sort();
+            return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalJson(obj[k])).join(",") + "}";
+        }
+        default:
+            throw new Error(`canonicalJson: unsupported type ${typeof value}`);
+    }
+}
+/** The exact bytes that are signed: UTF-8 canonical JSON of every field except `sig`. */
+export function receiptSigningBytes(receipt) {
+    const { sig: _sig, ...payload } = receipt;
+    return new Uint8Array(Buffer.from(canonicalJson(payload), "utf8"));
+}
+/** Encode a receipt as the X-Delivery-Receipt header value (base64url of its JSON). */
+export function encodeReceipt(receipt) {
+    return base64urlEncode(new Uint8Array(Buffer.from(canonicalJson(receipt), "utf8")));
+}
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+const HEX64_RE = /^[0-9a-f]{64}$/;
+/** Decode and shape-check an X-Delivery-Receipt header value. Throws on malformed input. */
+export function decodeReceipt(header) {
+    const json = Buffer.from(base64urlDecode(header.trim())).toString("utf8");
+    const r = JSON.parse(json);
+    if (typeof r !== "object" || r === null || Array.isArray(r))
+        throw new Error("receipt: not an object");
+    if (r.v !== 1)
+        throw new Error("receipt: unsupported version");
+    for (const k of ["payment_id", "network", "resource", "body_sha256", "issued_at", "key_id", "sig"]) {
+        if (typeof r[k] !== "string" || r[k].length === 0)
+            throw new Error(`receipt: bad ${k}`);
+    }
+    if (!HEX64_RE.test(r.body_sha256))
+        throw new Error("receipt: bad body_sha256");
+    if (!Number.isSafeInteger(r.content_length) || r.content_length < 0) {
+        throw new Error("receipt: bad content_length");
+    }
+    if (!ISO_RE.test(r.issued_at) || Number.isNaN(Date.parse(r.issued_at))) {
+        throw new Error("receipt: bad issued_at");
+    }
+    if (r.delivery !== "first" && r.delivery !== "refetch")
+        throw new Error("receipt: bad delivery");
+    return r;
+}
+/** Import a base64url raw 32-byte Ed25519 public key. */
+export function importEd25519PublicKey(publicKeyB64u) {
+    const raw = base64urlDecode(publicKeyB64u);
+    if (raw.length !== 32)
+        throw new Error("Ed25519 public key must be 32 bytes");
+    return createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: publicKeyB64u }, format: "jwk" });
+}
+// ---------------------------------------------------------------------------
+// Well-known document
+// ---------------------------------------------------------------------------
+/** Shape-check a parsed well-known document. Throws on malformed input. */
+export function parseWellKnown(doc) {
+    const d = doc;
+    if (!d || typeof d !== "object" || !Array.isArray(d.keys))
+        throw new Error("well-known: missing keys");
+    for (const k of d.keys) {
+        if (!k || typeof k.key_id !== "string" || typeof k.public_key !== "string" || k.alg !== "Ed25519") {
+            throw new Error("well-known: bad key entry");
+        }
+        if (k.revoked_at !== undefined && Number.isNaN(Date.parse(k.revoked_at))) {
+            throw new Error("well-known: bad revoked_at");
+        }
+    }
+    if (typeof d.refetch_window_s !== "number" || d.refetch_window_s < MIN_REFETCH_WINDOW_S) {
+        throw new Error("well-known: refetch_window_s must be >= 86400");
+    }
+    if (typeof d.refetch_header !== "string")
+        throw new Error("well-known: missing refetch_header");
+    return d;
+}
+/** Fetch and validate `<origin>/.well-known/x402-receipt.json`. */
+export async function fetchWellKnown(origin, opts = {}) {
+    const f = opts.fetch ?? globalThis.fetch;
+    const url = new URL(WELL_KNOWN_PATH, origin);
+    const res = await f(url, { headers: { accept: "application/json" } });
+    if (res.status !== 200)
+        throw new Error(`well-known: HTTP ${res.status}`);
+    return parseWellKnown(await res.json());
+}
+// ---------------------------------------------------------------------------
+// Verification
+// ---------------------------------------------------------------------------
+/**
+ * Verify a receipt against the exact body bytes and the seller's key document.
+ *
+ * Check order: presence -> key lookup -> signature -> revocation -> body hash -> expectations.
+ * An `expect` mismatch is reported as `receipt_bad_signature` (the receipt does not
+ * attest to what the caller asked for) with a `detail`.
+ */
+export function verifyReceipt(input) {
+    const { header, body, wellKnown, expect } = input;
+    if (header === null || header === undefined || header.trim() === "") {
+        return { ok: false, reason: "receipt_missing" };
+    }
+    let receipt;
+    try {
+        receipt = decodeReceipt(header);
+    }
+    catch (e) {
+        return { ok: false, reason: "receipt_bad_signature", detail: `malformed: ${e.message}` };
+    }
+    const key = wellKnown.keys.find((k) => k.key_id === receipt.key_id);
+    if (!key || key.alg !== "Ed25519")
+        return { ok: false, reason: "receipt_key_unknown", detail: "unknown key_id" };
+    let pub;
+    try {
+        pub = importEd25519PublicKey(key.public_key);
+    }
+    catch {
+        return { ok: false, reason: "receipt_key_unknown", detail: "unusable public key" };
+    }
+    let sigOk = false;
+    try {
+        const sig = base64urlDecode(receipt.sig);
+        sigOk = sig.length === 64 && cryptoVerify(null, receiptSigningBytes(receipt), pub, sig);
+    }
+    catch {
+        sigOk = false;
+    }
+    if (!sigOk)
+        return { ok: false, reason: "receipt_bad_signature" };
+    if (key.revoked_at !== undefined && !(Date.parse(receipt.issued_at) < Date.parse(key.revoked_at))) {
+        return { ok: false, reason: "receipt_key_unknown", detail: "issued at or after key revocation" };
+    }
+    if (receipt.content_length !== body.byteLength || sha256Hex(body) !== receipt.body_sha256) {
+        return { ok: false, reason: "receipt_hash_mismatch" };
+    }
+    if (expect?.payment_id !== undefined && !samePaymentId(expect.payment_id, receipt.payment_id)) {
+        return { ok: false, reason: "receipt_bad_signature", detail: "payment_id mismatch" };
+    }
+    if (expect?.resource !== undefined && expect.resource !== receipt.resource) {
+        return { ok: false, reason: "receipt_bad_signature", detail: "resource mismatch" };
+    }
+    return { ok: true, receipt };
+}
+/** EVM nonces are hex and compared case-insensitively; Solana signatures are case-sensitive base58. */
+function samePaymentId(a, b) {
+    if (a.startsWith("0x") && b.startsWith("0x"))
+        return a.toLowerCase() === b.toLowerCase();
+    return a === b;
+}
+// ---------------------------------------------------------------------------
+// Refetch
+// ---------------------------------------------------------------------------
+/**
+ * Re-fetch already-paid content by re-sending the original payment header plus
+ * `X-Payment-Refetch: <payment_id>`, then verify the returned receipt.
+ *
+ * 410 -> refetch_expired; any other non-200 (including 402) -> refetch_refused.
+ */
+export async function refetch(input) {
+    const f = input.fetch ?? globalThis.fetch;
+    const headers = {
+        ...(input.headers ?? {}),
+        ...input.paymentHeaders,
+        [REFETCH_HEADER]: input.paymentId,
+    };
+    let res;
+    try {
+        res = await f(input.url, { method: "GET", headers });
+    }
+    catch (e) {
+        return { ok: false, reason: "refetch_refused", detail: `network error: ${e.message}` };
+    }
+    if (res.status === 410) {
+        await res.body?.cancel().catch(() => { });
+        return { ok: false, reason: "refetch_expired", status: 410 };
+    }
+    if (res.status !== 200) {
+        await res.body?.cancel().catch(() => { });
+        return { ok: false, reason: "refetch_refused", status: res.status };
+    }
+    const body = new Uint8Array(await res.arrayBuffer());
+    const header = res.headers.get(RECEIPT_HEADER);
+    let wellKnown = input.wellKnown;
+    if (!wellKnown) {
+        try {
+            wellKnown = await fetchWellKnown(new URL(input.url).origin, { fetch: f });
+        }
+        catch (e) {
+            return { ok: false, reason: "receipt_key_unknown", status: 200, detail: e.message };
+        }
+    }
+    const v = verifyReceipt({
+        header,
+        body,
+        wellKnown,
+        expect: { payment_id: input.paymentId, resource: input.expectResource },
+    });
+    if (!v.ok)
+        return { ...v, status: 200 };
+    return { ok: true, body, receipt: v.receipt, status: 200 };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAkB,MAAM,aAAa,CAAC;AAElG,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAU,CAAC;AAC1C,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAChE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AA4FhD,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,iCAAiC;AACjC,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,SAAS,CAAC,KAA0B;IAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YAC/F,CAAC;YACD,MAAM,GAAG,GAAG,KAAgC,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;iBAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;iBACnC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAChG,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,OAAiC;IACnE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,GAAG,OAAkB,CAAC;IACrD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,MAAM,GAAG,gDAAgD,CAAC;AAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACtD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAU,EAAE,CAAC;QAC5G,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,CAAC,CAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,WAAqB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,IAAK,CAAC,CAAC,cAAyB,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAmB,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAmB,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACjG,OAAO,CAAuB,CAAC;AACjC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,sBAAsB,CAAC,aAAqB;IAC1D,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC9E,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,GAAgB,CAAC;IAC3B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACvG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,CAAC,gBAAgB,GAAG,oBAAoB,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,OAA8B,EAAE;IACnF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAAmB,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,cAAe,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjH,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACrF,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,KAAK,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAElE,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,uGAAuG;AACvG,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,IAAK,UAAU,CAAC,KAAmB,CAAC;IACzD,MAAM,OAAO,GAA2B;QACtC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACxB,GAAG,KAAK,CAAC,cAAc;QACvB,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS;KAClC,CAAC;IACF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAmB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE/C,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;QACjG,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,aAAa,CAAC;QACtB,MAAM;QACN,IAAI;QACJ,SAAS;QACT,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE;KACxE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC7D,CAAC"}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@x402jp/delivery-receipt-verify",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Zero-dependency verifier for x402 Delivery Receipts (buyer side).",
+  "type": "module",
+  "license": "MIT",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "test": "node --test --import tsx test/*.test.ts",
+    "build": "tsc -p tsconfig.build.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kato9292929/delivery-receipt.git",
+    "directory": "packages/verify"
+  },
+  "keywords": [
+    "x402",
+    "delivery-receipt",
+    "usdc",
+    "payments"
+  ]
+}