aipp-node 1.0.2 → 1.2.0

package/dist/index.d.mts

@@ -6,16 +6,22 @@ interface ChargeParams {
     amountSats?: number;
     amountUsd?: number;
     memo?: string;
+    protocol?: 'L402' | 'x402';
 }
 interface ChargeResponse {
-    payment_request: string;
     payment_hash: string;
-    amount_sats: number;
+    protocol: 'L402' | 'x402';
+    amount_usd?: number;
+    pay_to?: string;
+    network?: string;
+    token?: string;
+    payment_request?: string;
+    amount_sats?: number;
 }
 interface ChargeStatus {
+    paid: boolean;
     status: 'pending' | 'settled';
-    payment_hash: string;
-    amount_sats: number;
+    preimage: string | null;
 }
 interface AippErrorResponse {
     error: string;
@@ -24,6 +30,7 @@ interface AippErrorResponse {
 interface PayoutResponse {
     message: string;
     amount_sats?: number;
+    amount_usd?: number;
 }
 
 declare class Aipp {
@@ -32,17 +39,33 @@ declare class Aipp {
     constructor(config: AippConfig);
     private request;
     /**
-     * Creates a new Lightning Invoice
+     * Creates a new Invoice (either L402 or x402)
      */
     createCharge(params: ChargeParams): Promise<ChargeResponse>;
     /**
      * Checks the status of an existing charge
      */
-    getCharge(paymentHash: string): Promise<ChargeStatus>;
+    getCharge(paymentHash: string, txHash?: string): Promise<ChargeStatus>;
     /**
      * Triggers a manual withdrawal of your merchant balance
      */
     payout(): Promise<PayoutResponse>;
 }
 
-export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type PayoutResponse };
+interface L402Options {
+    client: Aipp;
+    jwtSecret: string;
+    resourceId: string;
+    amountSats?: number;
+    amountUsd?: number;
+    expiresInSeconds?: number;
+}
+declare function l402Paywall(options: L402Options): (req: any, res: any, next: any) => Promise<any>;
+interface X402Options {
+    client: Aipp;
+    resourceId: string;
+    amountUsd: number;
+}
+declare function x402Paywall(options: X402Options): (req: any, res: any, next: any) => Promise<any>;
+
+export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type L402Options, type PayoutResponse, type X402Options, l402Paywall, x402Paywall };

package/dist/index.d.ts

@@ -6,16 +6,22 @@ interface ChargeParams {
     amountSats?: number;
     amountUsd?: number;
     memo?: string;
+    protocol?: 'L402' | 'x402';
 }
 interface ChargeResponse {
-    payment_request: string;
     payment_hash: string;
-    amount_sats: number;
+    protocol: 'L402' | 'x402';
+    amount_usd?: number;
+    pay_to?: string;
+    network?: string;
+    token?: string;
+    payment_request?: string;
+    amount_sats?: number;
 }
 interface ChargeStatus {
+    paid: boolean;
     status: 'pending' | 'settled';
-    payment_hash: string;
-    amount_sats: number;
+    preimage: string | null;
 }
 interface AippErrorResponse {
     error: string;
@@ -24,6 +30,7 @@ interface AippErrorResponse {
 interface PayoutResponse {
     message: string;
     amount_sats?: number;
+    amount_usd?: number;
 }
 
 declare class Aipp {
@@ -32,17 +39,33 @@ declare class Aipp {
     constructor(config: AippConfig);
     private request;
     /**
-     * Creates a new Lightning Invoice
+     * Creates a new Invoice (either L402 or x402)
      */
     createCharge(params: ChargeParams): Promise<ChargeResponse>;
     /**
      * Checks the status of an existing charge
      */
-    getCharge(paymentHash: string): Promise<ChargeStatus>;
+    getCharge(paymentHash: string, txHash?: string): Promise<ChargeStatus>;
     /**
      * Triggers a manual withdrawal of your merchant balance
      */
     payout(): Promise<PayoutResponse>;
 }
 
-export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type PayoutResponse };
+interface L402Options {
+    client: Aipp;
+    jwtSecret: string;
+    resourceId: string;
+    amountSats?: number;
+    amountUsd?: number;
+    expiresInSeconds?: number;
+}
+declare function l402Paywall(options: L402Options): (req: any, res: any, next: any) => Promise<any>;
+interface X402Options {
+    client: Aipp;
+    resourceId: string;
+    amountUsd: number;
+}
+declare function x402Paywall(options: X402Options): (req: any, res: any, next: any) => Promise<any>;
+
+export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type L402Options, type PayoutResponse, type X402Options, l402Paywall, x402Paywall };

package/dist/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,12 +17,22 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  Aipp: () => Aipp
+  Aipp: () => Aipp,
+  l402Paywall: () => l402Paywall,
+  x402Paywall: () => x402Paywall
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -55,7 +67,7 @@ var Aipp = class {
     return response.json();
   }
   /**
-   * Creates a new Lightning Invoice
+   * Creates a new Invoice (either L402 or x402)
    */
   async createCharge(params) {
     if (!params.amountSats && !params.amountUsd) {
@@ -64,6 +76,7 @@ var Aipp = class {
     const body = { memo: params.memo };
     if (params.amountSats) body.amount_sats = params.amountSats;
     if (params.amountUsd) body.amount_usd = params.amountUsd;
+    if (params.protocol) body.protocol = params.protocol;
     return this.request("/invoice/create", {
       method: "POST",
       body: JSON.stringify(body)
@@ -72,11 +85,12 @@ var Aipp = class {
   /**
    * Checks the status of an existing charge
    */
-  async getCharge(paymentHash) {
+  async getCharge(paymentHash, txHash) {
     if (!paymentHash) {
       throw new Error("AIPP: paymentHash is required");
     }
-    return this.request(`/invoice/status/${paymentHash}`, {
+    const query = txHash ? `?tx_hash=${txHash}` : "";
+    return this.request(`/invoice/status/${paymentHash}${query}`, {
       method: "GET"
     });
   }
@@ -89,7 +103,163 @@ var Aipp = class {
     });
   }
 };
+
+// src/middleware.ts
+var import_crypto2 = __toESM(require("crypto"));
+
+// src/jwt.ts
+var import_crypto = __toESM(require("crypto"));
+function base64urlEncode(str) {
+  const buf = Buffer.isBuffer(str) ? str : Buffer.from(str);
+  return buf.toString("base64url");
+}
+function base64urlDecode(str) {
+  return Buffer.from(str, "base64url").toString("utf8");
+}
+function signJwt(payload, secret) {
+  const header = { alg: "HS256", typ: "JWT" };
+  const encodedHeader = base64urlEncode(JSON.stringify(header));
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const signature = import_crypto.default.createHmac("sha256", secret).update(data).digest("base64url");
+  return `${data}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT format");
+  }
+  const [encodedHeader, encodedPayload, signature] = parts;
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const expectedSignature = import_crypto.default.createHmac("sha256", secret).update(data).digest("base64url");
+  const signatureBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  if (signatureBuffer.length !== expectedBuffer.length || !import_crypto.default.timingSafeEqual(signatureBuffer, expectedBuffer)) {
+    throw new Error("Invalid JWT signature");
+  }
+  const payload = JSON.parse(base64urlDecode(encodedPayload));
+  if (payload.exp && Date.now() >= payload.exp * 1e3) {
+    throw new Error("JWT expired");
+  }
+  return payload;
+}
+
+// src/middleware.ts
+function l402Paywall(options) {
+  if (!options.amountSats && !options.amountUsd) {
+    throw new Error("Either amountSats or amountUsd must be provided for l402Paywall");
+  }
+  return async (req, res, next) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let valid = false;
+    if (authHeader && typeof authHeader === "string" && authHeader.startsWith("L402 ")) {
+      const parts = authHeader.substring(5).split(":");
+      if (parts.length === 2) {
+        const [macaroonStr, preimage] = parts;
+        try {
+          const payload = verifyJwt(macaroonStr, options.jwtSecret);
+          if (payload.resource_id !== options.resourceId) {
+            throw new Error("Invalid resource");
+          }
+          const preimageHash = import_crypto2.default.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
+          const expectedHash = payload.payment_hash;
+          if (typeof expectedHash === "string" && expectedHash.length === preimageHash.length && import_crypto2.default.timingSafeEqual(Buffer.from(preimageHash, "hex"), Buffer.from(expectedHash, "hex"))) {
+            valid = true;
+          }
+        } catch (e) {
+        }
+      }
+    }
+    if (valid) {
+      return next();
+    }
+    try {
+      const charge = await options.client.createCharge({
+        amountSats: options.amountSats,
+        amountUsd: options.amountUsd,
+        memo: `L402 Payment for ${options.resourceId}`
+      });
+      const expiresIn = options.expiresInSeconds || 3600;
+      const payload = {
+        payment_hash: charge.payment_hash,
+        resource_id: options.resourceId,
+        exp: Math.floor(Date.now() / 1e3) + expiresIn
+      };
+      const jwtToken = signJwt(payload, options.jwtSecret);
+      res.status(402);
+      res.setHeader("Www-Authenticate", `L402 macaroon="${jwtToken}" invoice="${charge.payment_request}"`);
+      res.json({
+        error: "Payment Required",
+        code: "L402",
+        payment_request: charge.payment_request,
+        macaroon: jwtToken
+      });
+    } catch (err) {
+      res.status(500).json({ error: "Failed to generate L402 challenge", details: err.message || err });
+    }
+  };
+}
+function x402Paywall(options) {
+  return async (req, res, next) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let txHash = req.query.tx_hash || req.headers["payment-signature"] || req.headers["x-payment-signature"];
+    let paymentHash = req.query.payment_hash || req.headers["x-payment-hash"];
+    if (!txHash && authHeader && typeof authHeader === "string") {
+      if (authHeader.startsWith("Bearer ")) {
+        txHash = authHeader.substring(7).trim();
+      } else if (authHeader.startsWith("x402 ")) {
+        txHash = authHeader.substring(5).trim();
+      } else if (authHeader.startsWith("L402 ")) {
+        const parts = authHeader.substring(5).split(":");
+        if (parts.length === 2) {
+          paymentHash = parts[0];
+          txHash = parts[1];
+        }
+      }
+    }
+    if (paymentHash && txHash) {
+      try {
+        const chargeStatus = await options.client.getCharge(paymentHash, txHash);
+        if (chargeStatus.status === "settled") {
+          return next();
+        }
+      } catch (e) {
+      }
+    }
+    try {
+      const charge = await options.client.createCharge({
+        amountUsd: options.amountUsd,
+        protocol: "x402",
+        memo: `x402 Payment for ${options.resourceId}`
+      });
+      const challengeObj = {
+        scheme: "exact",
+        network: "base",
+        payTo: charge.pay_to || "",
+        price: options.amountUsd.toFixed(2),
+        token: charge.token || "",
+        payment_hash: charge.payment_hash
+      };
+      const challengeBase64 = Buffer.from(JSON.stringify(challengeObj), "utf8").toString("base64");
+      res.setHeader("PAYMENT-REQUIRED", challengeBase64);
+      res.status(402);
+      res.json({
+        error: "Payment Required",
+        code: "x402",
+        payment_hash: charge.payment_hash,
+        pay_to: challengeObj.payTo,
+        price: challengeObj.price,
+        token: challengeObj.token,
+        network: challengeObj.network
+      });
+    } catch (err) {
+      res.status(500).json({ error: "Failed to generate x402 challenge", details: err.message || err });
+    }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  Aipp
+  Aipp,
+  l402Paywall,
+  x402Paywall
 });

package/dist/index.mjs

@@ -29,7 +29,7 @@ var Aipp = class {
     return response.json();
   }
   /**
-   * Creates a new Lightning Invoice
+   * Creates a new Invoice (either L402 or x402)
    */
   async createCharge(params) {
     if (!params.amountSats && !params.amountUsd) {
@@ -38,6 +38,7 @@ var Aipp = class {
     const body = { memo: params.memo };
     if (params.amountSats) body.amount_sats = params.amountSats;
     if (params.amountUsd) body.amount_usd = params.amountUsd;
+    if (params.protocol) body.protocol = params.protocol;
     return this.request("/invoice/create", {
       method: "POST",
       body: JSON.stringify(body)
@@ -46,11 +47,12 @@ var Aipp = class {
   /**
    * Checks the status of an existing charge
    */
-  async getCharge(paymentHash) {
+  async getCharge(paymentHash, txHash) {
     if (!paymentHash) {
       throw new Error("AIPP: paymentHash is required");
     }
-    return this.request(`/invoice/status/${paymentHash}`, {
+    const query = txHash ? `?tx_hash=${txHash}` : "";
+    return this.request(`/invoice/status/${paymentHash}${query}`, {
       method: "GET"
     });
   }
@@ -63,6 +65,162 @@ var Aipp = class {
     });
   }
 };
+
+// src/middleware.ts
+import crypto2 from "crypto";
+
+// src/jwt.ts
+import crypto from "crypto";
+function base64urlEncode(str) {
+  const buf = Buffer.isBuffer(str) ? str : Buffer.from(str);
+  return buf.toString("base64url");
+}
+function base64urlDecode(str) {
+  return Buffer.from(str, "base64url").toString("utf8");
+}
+function signJwt(payload, secret) {
+  const header = { alg: "HS256", typ: "JWT" };
+  const encodedHeader = base64urlEncode(JSON.stringify(header));
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const signature = crypto.createHmac("sha256", secret).update(data).digest("base64url");
+  return `${data}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT format");
+  }
+  const [encodedHeader, encodedPayload, signature] = parts;
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const expectedSignature = crypto.createHmac("sha256", secret).update(data).digest("base64url");
+  const signatureBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  if (signatureBuffer.length !== expectedBuffer.length || !crypto.timingSafeEqual(signatureBuffer, expectedBuffer)) {
+    throw new Error("Invalid JWT signature");
+  }
+  const payload = JSON.parse(base64urlDecode(encodedPayload));
+  if (payload.exp && Date.now() >= payload.exp * 1e3) {
+    throw new Error("JWT expired");
+  }
+  return payload;
+}
+
+// src/middleware.ts
+function l402Paywall(options) {
+  if (!options.amountSats && !options.amountUsd) {
+    throw new Error("Either amountSats or amountUsd must be provided for l402Paywall");
+  }
+  return async (req, res, next) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let valid = false;
+    if (authHeader && typeof authHeader === "string" && authHeader.startsWith("L402 ")) {
+      const parts = authHeader.substring(5).split(":");
+      if (parts.length === 2) {
+        const [macaroonStr, preimage] = parts;
+        try {
+          const payload = verifyJwt(macaroonStr, options.jwtSecret);
+          if (payload.resource_id !== options.resourceId) {
+            throw new Error("Invalid resource");
+          }
+          const preimageHash = crypto2.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
+          const expectedHash = payload.payment_hash;
+          if (typeof expectedHash === "string" && expectedHash.length === preimageHash.length && crypto2.timingSafeEqual(Buffer.from(preimageHash, "hex"), Buffer.from(expectedHash, "hex"))) {
+            valid = true;
+          }
+        } catch (e) {
+        }
+      }
+    }
+    if (valid) {
+      return next();
+    }
+    try {
+      const charge = await options.client.createCharge({
+        amountSats: options.amountSats,
+        amountUsd: options.amountUsd,
+        memo: `L402 Payment for ${options.resourceId}`
+      });
+      const expiresIn = options.expiresInSeconds || 3600;
+      const payload = {
+        payment_hash: charge.payment_hash,
+        resource_id: options.resourceId,
+        exp: Math.floor(Date.now() / 1e3) + expiresIn
+      };
+      const jwtToken = signJwt(payload, options.jwtSecret);
+      res.status(402);
+      res.setHeader("Www-Authenticate", `L402 macaroon="${jwtToken}" invoice="${charge.payment_request}"`);
+      res.json({
+        error: "Payment Required",
+        code: "L402",
+        payment_request: charge.payment_request,
+        macaroon: jwtToken
+      });
+    } catch (err) {
+      res.status(500).json({ error: "Failed to generate L402 challenge", details: err.message || err });
+    }
+  };
+}
+function x402Paywall(options) {
+  return async (req, res, next) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let txHash = req.query.tx_hash || req.headers["payment-signature"] || req.headers["x-payment-signature"];
+    let paymentHash = req.query.payment_hash || req.headers["x-payment-hash"];
+    if (!txHash && authHeader && typeof authHeader === "string") {
+      if (authHeader.startsWith("Bearer ")) {
+        txHash = authHeader.substring(7).trim();
+      } else if (authHeader.startsWith("x402 ")) {
+        txHash = authHeader.substring(5).trim();
+      } else if (authHeader.startsWith("L402 ")) {
+        const parts = authHeader.substring(5).split(":");
+        if (parts.length === 2) {
+          paymentHash = parts[0];
+          txHash = parts[1];
+        }
+      }
+    }
+    if (paymentHash && txHash) {
+      try {
+        const chargeStatus = await options.client.getCharge(paymentHash, txHash);
+        if (chargeStatus.status === "settled") {
+          return next();
+        }
+      } catch (e) {
+      }
+    }
+    try {
+      const charge = await options.client.createCharge({
+        amountUsd: options.amountUsd,
+        protocol: "x402",
+        memo: `x402 Payment for ${options.resourceId}`
+      });
+      const challengeObj = {
+        scheme: "exact",
+        network: "base",
+        payTo: charge.pay_to || "",
+        price: options.amountUsd.toFixed(2),
+        token: charge.token || "",
+        payment_hash: charge.payment_hash
+      };
+      const challengeBase64 = Buffer.from(JSON.stringify(challengeObj), "utf8").toString("base64");
+      res.setHeader("PAYMENT-REQUIRED", challengeBase64);
+      res.status(402);
+      res.json({
+        error: "Payment Required",
+        code: "x402",
+        payment_hash: charge.payment_hash,
+        pay_to: challengeObj.payTo,
+        price: challengeObj.price,
+        token: challengeObj.token,
+        network: challengeObj.network
+      });
+    } catch (err) {
+      res.status(500).json({ error: "Failed to generate x402 challenge", details: err.message || err });
+    }
+  };
+}
 export {
-  Aipp
+  Aipp,
+  l402Paywall,
+  x402Paywall
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aipp-node",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "description": "Official Node.js SDK for AIPP - The Lightning Network Split-Payment Gateway",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/src/client.ts

@@ -36,7 +36,7 @@ export class Aipp {
   }
 
   /**
-   * Creates a new Lightning Invoice
+   * Creates a new Invoice (either L402 or x402)
    */
   async createCharge(params: ChargeParams): Promise<ChargeResponse> {
     if (!params.amountSats && !params.amountUsd) {
@@ -46,6 +46,7 @@ export class Aipp {
     const body: any = { memo: params.memo };
     if (params.amountSats) body.amount_sats = params.amountSats;
     if (params.amountUsd) body.amount_usd = params.amountUsd;
+    if (params.protocol) body.protocol = params.protocol;
 
     return this.request<ChargeResponse>('/invoice/create', {
       method: 'POST',
@@ -56,11 +57,12 @@ export class Aipp {
   /**
    * Checks the status of an existing charge
    */
-  async getCharge(paymentHash: string): Promise<ChargeStatus> {
+  async getCharge(paymentHash: string, txHash?: string): Promise<ChargeStatus> {
     if (!paymentHash) {
       throw new Error('AIPP: paymentHash is required');
     }
-    return this.request<ChargeStatus>(`/invoice/status/${paymentHash}`, {
+    const query = txHash ? `?tx_hash=${txHash}` : '';
+    return this.request<ChargeStatus>(`/invoice/status/${paymentHash}${query}`, {
       method: 'GET',
     });
   }

package/src/index.ts

@@ -1,2 +1,3 @@
 export * from './client';
 export * from './types';
+export * from './middleware';

package/src/jwt.ts

@@ -0,0 +1,48 @@
+import crypto from 'crypto';
+
+function base64urlEncode(str: string | Buffer): string {
+  const buf = Buffer.isBuffer(str) ? str : Buffer.from(str);
+  return buf.toString('base64url');
+}
+
+function base64urlDecode(str: string): string {
+  return Buffer.from(str, 'base64url').toString('utf8');
+}
+
+export function signJwt(payload: any, secret: string): string {
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const encodedHeader = base64urlEncode(JSON.stringify(header));
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  
+  const signature = crypto.createHmac('sha256', secret).update(data).digest('base64url');
+  return `${data}.${signature}`;
+}
+
+export function verifyJwt(token: string, secret: string): any {
+  const parts = token.split('.');
+  if (parts.length !== 3) {
+    throw new Error('Invalid JWT format');
+  }
+  
+  const [encodedHeader, encodedPayload, signature] = parts;
+  const data = `${encodedHeader}.${encodedPayload}`;
+  
+  const expectedSignature = crypto.createHmac('sha256', secret).update(data).digest('base64url');
+  
+  // Constant time comparison to prevent timing attacks
+  const signatureBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  
+  if (signatureBuffer.length !== expectedBuffer.length || !crypto.timingSafeEqual(signatureBuffer, expectedBuffer)) {
+    throw new Error('Invalid JWT signature');
+  }
+  
+  const payload = JSON.parse(base64urlDecode(encodedPayload));
+  
+  if (payload.exp && Date.now() >= payload.exp * 1000) {
+    throw new Error('JWT expired');
+  }
+  
+  return payload;
+}

package/src/middleware.ts

@@ -0,0 +1,159 @@
+import crypto from 'crypto';
+import { Aipp } from './client';
+import { signJwt, verifyJwt } from './jwt';
+
+export interface L402Options {
+  client: Aipp;
+  jwtSecret: string;
+  resourceId: string;
+  amountSats?: number;
+  amountUsd?: number;
+  expiresInSeconds?: number;
+}
+
+export function l402Paywall(options: L402Options) {
+  if (!options.amountSats && !options.amountUsd) {
+    throw new Error('Either amountSats or amountUsd must be provided for l402Paywall');
+  }
+
+  return async (req: any, res: any, next: any) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let valid = false;
+
+    if (authHeader && typeof authHeader === 'string' && authHeader.startsWith('L402 ')) {
+      const parts = authHeader.substring(5).split(':');
+      if (parts.length === 2) {
+        const [macaroonStr, preimage] = parts;
+        try {
+          // Verify JWT signature and expiration
+          const payload = verifyJwt(macaroonStr, options.jwtSecret);
+          
+          if (payload.resource_id !== options.resourceId) {
+            throw new Error('Invalid resource');
+          }
+
+          // Verify preimage hash matches payment_hash securely
+          const preimageHash = crypto.createHash('sha256').update(Buffer.from(preimage, 'hex')).digest('hex');
+          const expectedHash = payload.payment_hash;
+          
+          if (
+            typeof expectedHash === 'string' &&
+            expectedHash.length === preimageHash.length &&
+            crypto.timingSafeEqual(Buffer.from(preimageHash, 'hex'), Buffer.from(expectedHash, 'hex'))
+          ) {
+            valid = true;
+          }
+        } catch (e) {
+          // Invalid or expired JWT -> Fall through to 402 and issue new invoice
+        }
+      }
+    }
+
+    if (valid) {
+      return next();
+    }
+
+    try {
+      // Create invoice via AIPP
+      const charge = await options.client.createCharge({
+        amountSats: options.amountSats,
+        amountUsd: options.amountUsd,
+        memo: `L402 Payment for ${options.resourceId}`
+      });
+
+      // Issue JWT
+      const expiresIn = options.expiresInSeconds || 3600; // default 1 hour
+      const payload = {
+        payment_hash: charge.payment_hash,
+        resource_id: options.resourceId,
+        exp: Math.floor(Date.now() / 1000) + expiresIn
+      };
+      
+      const jwtToken = signJwt(payload, options.jwtSecret);
+
+      res.status(402);
+      res.setHeader('Www-Authenticate', `L402 macaroon="${jwtToken}" invoice="${charge.payment_request}"`);
+      res.json({
+        error: "Payment Required",
+        code: "L402",
+        payment_request: charge.payment_request,
+        macaroon: jwtToken
+      });
+    } catch (err: any) {
+      res.status(500).json({ error: "Failed to generate L402 challenge", details: err.message || err });
+    }
+  };
+}
+
+export interface X402Options {
+  client: Aipp;
+  resourceId: string;
+  amountUsd: number;
+}
+
+export function x402Paywall(options: X402Options) {
+  return async (req: any, res: any, next: any) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let txHash = (req.query.tx_hash || req.headers['payment-signature'] || req.headers['x-payment-signature']) as string;
+    let paymentHash = (req.query.payment_hash || req.headers['x-payment-hash']) as string;
+
+    if (!txHash && authHeader && typeof authHeader === 'string') {
+      if (authHeader.startsWith('Bearer ')) {
+        txHash = authHeader.substring(7).trim();
+      } else if (authHeader.startsWith('x402 ')) {
+        txHash = authHeader.substring(5).trim();
+      } else if (authHeader.startsWith('L402 ')) {
+        // Fallback or double format check
+        const parts = authHeader.substring(5).split(':');
+        if (parts.length === 2) {
+          paymentHash = parts[0];
+          txHash = parts[1];
+        }
+      }
+    }
+
+    if (paymentHash && txHash) {
+      try {
+        const chargeStatus = await options.client.getCharge(paymentHash, txHash);
+        if (chargeStatus.status === 'settled') {
+          return next();
+        }
+      } catch (e) {
+        // Validation failed, proceed to challenge
+      }
+    }
+
+    try {
+      const charge = await options.client.createCharge({
+        amountUsd: options.amountUsd,
+        protocol: 'x402',
+        memo: `x402 Payment for ${options.resourceId}`
+      });
+
+      const challengeObj = {
+        scheme: 'exact',
+        network: 'base',
+        payTo: charge.pay_to || '',
+        price: options.amountUsd.toFixed(2),
+        token: charge.token || '',
+        payment_hash: charge.payment_hash
+      };
+      
+      const challengeBase64 = Buffer.from(JSON.stringify(challengeObj), 'utf8').toString('base64');
+      res.setHeader('PAYMENT-REQUIRED', challengeBase64);
+
+      res.status(402);
+      res.json({
+        error: "Payment Required",
+        code: "x402",
+        payment_hash: charge.payment_hash,
+        pay_to: challengeObj.payTo,
+        price: challengeObj.price,
+        token: challengeObj.token,
+        network: challengeObj.network
+      });
+    } catch (err: any) {
+      res.status(500).json({ error: "Failed to generate x402 challenge", details: err.message || err });
+    }
+  };
+}

package/src/types.ts

@@ -7,18 +7,24 @@ export interface ChargeParams {
   amountSats?: number;
   amountUsd?: number;
   memo?: string;
+  protocol?: 'L402' | 'x402';
 }
 
 export interface ChargeResponse {
-  payment_request: string;
   payment_hash: string;
-  amount_sats: number;
+  protocol: 'L402' | 'x402';
+  amount_usd?: number;
+  pay_to?: string;
+  network?: string;
+  token?: string;
+  payment_request?: string; // For L402
+  amount_sats?: number; // For L402
 }
 
 export interface ChargeStatus {
+  paid: boolean;
   status: 'pending' | 'settled';
-  payment_hash: string;
-  amount_sats: number;
+  preimage: string | null;
 }
 
 export interface AippErrorResponse {
@@ -29,4 +35,5 @@ export interface AippErrorResponse {
 export interface PayoutResponse {
   message: string;
   amount_sats?: number;
+  amount_usd?: number;
 }