@xona-labs/xpay 0.2.14 → 0.2.16

package/dist/x402/evm-payment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-payment.d.ts","sourceRoot":"","sources":["../../src/x402/evm-payment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuBtD,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,aAAa,EAAE,CAAC,SAAS,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,kBAAkB,CAAC;IAChC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASlD;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAEnE;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8DtF"}

package/dist/x402/evm-payment.js

@@ -0,0 +1,121 @@
+/**
+ * Build the canonical x402 EVM v2 `X-Payment` header value (gasless).
+ *
+ * Spec flow (`exact` scheme on eip155 networks):
+ *   client signs an EIP-3009 `TransferWithAuthorization` typed-data payload
+ *   (an off-chain signature — USDC supports it natively) → header carries
+ *   the authorization + signature → facilitator submits the transfer
+ *   on-chain and pays the gas.
+ *
+ * The payer wallet therefore needs ZERO native ETH: this replaces the legacy
+ * `signer.pay()` path, which broadcast a plain `erc20.transfer()` from the
+ * wallet and failed with "insufficient funds for intrinsic transaction cost"
+ * on gasless agent wallets.
+ *
+ * Payload shape mirrors `@x402/evm`'s `exact` client scheme, which is what
+ * `ExactEvmScheme` servers + facilitators (PayAI, CDP) verify against.
+ */
+/** EIP-712 types for EIP-3009 transferWithAuthorization. */
+const AUTHORIZATION_TYPES = {
+    TransferWithAuthorization: [
+        { name: "from", type: "address" },
+        { name: "to", type: "address" },
+        { name: "value", type: "uint256" },
+        { name: "validAfter", type: "uint256" },
+        { name: "validBefore", type: "uint256" },
+        { name: "nonce", type: "bytes32" },
+    ],
+};
+/** Chain ids for the named networks xpay profiles use. */
+const NAMED_CHAIN_IDS = {
+    base: 8453,
+    ethereum: 1,
+    arbitrum: 42161,
+    optimism: 10,
+    robinhood: 4663,
+};
+export function evmChainId(network) {
+    if (network.startsWith("eip155:")) {
+        const id = Number(network.slice("eip155:".length));
+        if (Number.isInteger(id) && id > 0)
+            return id;
+        throw new Error(`buildEvmPaymentHeader: bad eip155 network "${network}"`);
+    }
+    const id = NAMED_CHAIN_IDS[network];
+    if (!id)
+        throw new Error(`buildEvmPaymentHeader: unknown EVM network "${network}"`);
+    return id;
+}
+/** True for networks paid via the EVM x402 path (eip155 CAIP ids or named EVM chains). */
+export function isEvmNetwork(network) {
+    return network.startsWith("eip155:") || network in NAMED_CHAIN_IDS;
+}
+/**
+ * True when this requirement carries the EIP-712 domain params (`extra.name`
+ * + `extra.version`) the gasless signature needs. Catalog snapshots usually
+ * strip `extra` — a fresh 402 challenge always has it.
+ */
+export function hasEvmDomainParams(req) {
+    return Boolean(req.extra?.name && req.extra?.version);
+}
+/**
+ * Returns the value of the `X-Payment` header (base64 of canonical JSON
+ * envelope), ready to attach to the retry request. Nothing is broadcast —
+ * the facilitator settles server-side.
+ */
+export async function buildEvmPaymentHeader(args) {
+    const req = args.requirement;
+    // The EIP-3009 payload shape only exists in x402 v2 — never emit a v1
+    // envelope here (v1 catalog entries without a version reach us as 1).
+    const version = Math.max(args.x402Version ?? 2, 2);
+    if (!hasEvmDomainParams(req)) {
+        throw new Error(`buildEvmPaymentHeader: EIP-712 domain params (extra.name/extra.version) missing for asset ${req.asset} — re-fetch the live 402 challenge`);
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const nonceBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
+    const nonce = "0x" + Buffer.from(nonceBytes).toString("hex");
+    // Authorization values travel as decimal strings in the header payload but
+    // are signed as uint256 — same split @x402/evm's client makes.
+    const authorization = {
+        from: args.address,
+        to: req.payTo,
+        value: req.amount ?? "0",
+        validAfter: String(now - 600), // small back-date absorbs clock skew
+        validBefore: String(now + (req.maxTimeoutSeconds ?? 300)),
+        nonce,
+    };
+    const signature = await args.signTypedData({
+        domain: {
+            name: String(req.extra.name),
+            version: String(req.extra.version),
+            chainId: evmChainId(req.network),
+            verifyingContract: req.asset,
+        },
+        types: AUTHORIZATION_TYPES,
+        message: {
+            from: authorization.from,
+            to: authorization.to,
+            value: BigInt(authorization.value),
+            validAfter: BigInt(authorization.validAfter),
+            validBefore: BigInt(authorization.validBefore),
+            nonce: authorization.nonce,
+        },
+    });
+    // Full canonical PaymentPayloadV2 envelope, same assembly as the SVM
+    // builder: `accepted` echoes which of the server's accepts[] we picked.
+    const envelope = {
+        x402Version: version,
+        accepted: {
+            payTo: req.payTo,
+            amount: req.amount ?? "0",
+            asset: req.asset,
+            network: req.network,
+            scheme: req.scheme || "exact",
+            maxTimeoutSeconds: req.maxTimeoutSeconds ?? 300,
+            extra: req.extra ?? undefined,
+        },
+        payload: { signature, authorization },
+    };
+    return Buffer.from(JSON.stringify(envelope), "utf8").toString("base64");
+}
+//# sourceMappingURL=evm-payment.js.map

package/dist/x402/evm-payment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm-payment.js","sourceRoot":"","sources":["../../src/x402/evm-payment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG;IAC1B,yBAAyB,EAAE;QACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;KACnC;CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC;AAiBF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;IACpF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,IAAI,eAAe,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAyB;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,6FAA6F,GAAG,CAAC,KAAK,oCAAoC,CAC3I,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE7D,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,aAAa,GAAG;QACpB,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,qCAAqC;QACpE,WAAW,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;QACzD,KAAK;KACN,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAM,CAAC,IAAI,CAAC;YAC7B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,KAAM,CAAC,OAAO,CAAC;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;YAChC,iBAAiB,EAAE,GAAG,CAAC,KAAK;SAC7B;QACD,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE;YACP,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAClC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YAC5C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;YAC9C,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B;KACF,CAAC,CAAC;IAEH,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,QAAQ,GAAG;QACf,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE;YACR,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG;YACzB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO;YAC7B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,GAAG;YAC/C,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;SAC9B;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE;KACtC,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xona-labs/xpay",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Discovery and usage layer for agentic commerce — multi-network wallet, x402 payments, AgenC marketplace hires, 20k+ services via PayAI and other catalogs",
   "type": "module",
   "main": "dist/index.js",