chit402-verify 0.3.5 → 0.4.0

package/dist/shell.js

@@ -0,0 +1,268 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INCLUDED_SHELL_LINE = exports.SHELL_SCHEMA = void 0;
+exports.isReceiptShell = isReceiptShell;
+exports.decodeJwsPayload = decodeJwsPayload;
+exports.shellFromHolder = shellFromHolder;
+exports.holderDocumentFromOwnerView = holderDocumentFromOwnerView;
+exports.shellHolderVerdict = shellHolderVerdict;
+exports.signedShellFromHolder = signedShellFromHolder;
+exports.compareShellToJws = compareShellToJws;
+exports.openV11Commitment = openV11Commitment;
+/**
+ * Public receipt shell verdicts.
+ * A shell is inclusion and payment facts without the holder signature.
+ * INCLUDED_SHELL is never VERIFIED. A gated URL without the holder JWS
+ * is owner_proof_required.
+ * `--jws` is VERIFIED only when the holder key is trusted, inclusion
+ * passed, and the signed payment is present. The key inside the holder
+ * is not a trust root.
+ */
+const node_crypto_1 = __importDefault(require("node:crypto"));
+exports.SHELL_SCHEMA = 'chit402.receipt_shell.v1';
+exports.INCLUDED_SHELL_LINE = 'INCLUDED_SHELL: signature requires owner view';
+function isReceiptShell(doc) {
+    return !!doc && typeof doc === 'object' && doc.schema === exports.SHELL_SCHEMA;
+}
+function jcs(value) {
+    return JSON.stringify(canonicalize(value));
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const child = value[key];
+            if (child === undefined)
+                continue;
+            out[key] = canonicalize(child);
+        }
+        return out;
+    }
+    return value;
+}
+function decodeJwsPayload(jws) {
+    if (typeof jws !== 'string')
+        return null;
+    const parts = jws.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function minuteIso(value) {
+    if (value == null || value === '')
+        return null;
+    const ms = typeof value === 'number'
+        ? (value < 1e12 ? value * 1000 : value)
+        : Date.parse(String(value));
+    if (!Number.isFinite(ms))
+        return null;
+    const date = new Date(ms);
+    date.setUTCSeconds(0, 0);
+    return date.toISOString();
+}
+function paymentOf(claims, receipt) {
+    const payment = (claims?.payment && typeof claims.payment === 'object')
+        ? claims.payment
+        : {};
+    const outer = (receipt.payment && typeof receipt.payment === 'object')
+        ? receipt.payment
+        : {};
+    return { ...outer, ...payment };
+}
+/** Project the public shell from a holder receipt. Leaf proof is not invented. */
+function shellFromHolder(receipt) {
+    const issuer = (receipt.issuer_signature && typeof receipt.issuer_signature === 'object')
+        ? receipt.issuer_signature
+        : {};
+    const claims = decodeJwsPayload(issuer.jws) || {};
+    const payment = paymentOf(claims, receipt);
+    const ref = String(payment.ref || '');
+    const prefix = ref.includes(':') ? ref.slice(0, ref.indexOf(':')) : '';
+    const network = String(payment.network || receipt.payment_meta?.network || prefix || '');
+    const tx = ref.includes(':') ? ref.slice(ref.indexOf(':') + 1) : (ref || null);
+    const receiptId = (receipt.task_id || claims.task_id || receipt.receipt_id || null);
+    const gross = payment.gross_amount ?? null;
+    const settled = payment.settled_amount ?? null;
+    const inclusion = (receipt.inclusion && typeof receipt.inclusion === 'object')
+        ? receipt.inclusion
+        : null;
+    return {
+        schema: exports.SHELL_SCHEMA,
+        unsigned: true,
+        receipt_id: receiptId,
+        task_id: receiptId,
+        payload_version: claims.payload_version ?? issuer.payload_version ?? null,
+        asset: payment.asset || 'USDC',
+        chain: network || null,
+        pay_to: payment.payee ?? null,
+        amount_gross: gross == null ? null : String(gross),
+        amount_settled: settled == null ? null : String(settled),
+        payment_tx: tx,
+        issued_at: minuteIso(claims.iat ?? receipt.created_at ?? receipt.issued_at ?? null),
+        inclusion: {
+            leaf_hash: inclusion?.leaf || inclusion?.leaf_hash || null,
+            proof: inclusion?.proof ?? null,
+            signed_head: inclusion?.root
+                ? { root: inclusion.root, tree_size: inclusion.tree_size ?? null, signature: null }
+                : null,
+        },
+    };
+}
+const COMPARE_FIELDS = [
+    'receipt_id',
+    'payload_version',
+    'asset',
+    'chain',
+    'pay_to',
+    'amount_gross',
+    'amount_settled',
+    'payment_tx',
+    'issued_at',
+];
+/**
+ * The owner view returns `{ jws, salt, private_fields }`. A saved holder
+ * receipt has `issuer_signature`. Either can be the `--jws` file.
+ * An `issuer_jwk` on the owner-view body is ignored. Trust is a pinned
+ * kid or a JWKS entry, not a key the response carries.
+ */
+function holderDocumentFromOwnerView(doc) {
+    if (typeof doc === 'string') {
+        const compact = doc.trim();
+        if (compact.split('.').length === 3)
+            return holderDocumentFromOwnerView({ jws: compact });
+        throw new Error('holder is not a receipt or an owner-view response');
+    }
+    const signature = doc.issuer_signature;
+    if (signature && typeof signature === 'object' && typeof signature.jws === 'string') {
+        return doc;
+    }
+    const jws = typeof doc.jws === 'string' ? doc.jws : null;
+    if (!jws || jws.split('.').length !== 3) {
+        throw new Error('owner view is missing the holder JWS');
+    }
+    const claims = decodeJwsPayload(jws) || {};
+    let kid;
+    try {
+        const header = JSON.parse(Buffer.from(jws.split('.')[0], 'base64url').toString('utf8'));
+        if (typeof header.kid === 'string')
+            kid = header.kid;
+    }
+    catch {
+        kid = undefined;
+    }
+    // Owner view carries this receipt's own book row hash so the leaf
+    // task_id|row_hash can be rebuilt. It is not a signed claim; the leaf
+    // still has to be in a signed tree head.
+    const rowHash = typeof doc.row_hash === 'string' && /^[0-9a-f]{64}$/i.test(doc.row_hash) ? doc.row_hash : null;
+    return {
+        ...claims,
+        task_id: claims.task_id ?? null,
+        ...(rowHash ? { book_chain: { row_hash: rowHash } } : {}),
+        issuer_signature: {
+            jws,
+            kid,
+            payload_version: claims.payload_version ?? null,
+        },
+    };
+}
+/**
+ * VERIFIED requires a trusted issuer key, a passing inclusion proof, and a
+ * signed payment. A shell alone, a missing proof, or a key that only
+ * verifies because it is embedded in the holder is not VERIFIED.
+ */
+function shellHolderVerdict(check) {
+    if (!check.signatureValid || !check.keyTrusted) {
+        return { verified: false, reason: check.signatureReason || 'key untrusted' };
+    }
+    if (!check.inclusionSupplied || !check.inclusionOk) {
+        return { verified: false, reason: check.inclusionReason || 'inclusion_missing' };
+    }
+    const shellLeaf = check.shellLeaf ? String(check.shellLeaf).replace(/^0x/i, '').toLowerCase() : '';
+    const proved = check.provedLeaf ? String(check.provedLeaf).replace(/^0x/i, '').toLowerCase() : '';
+    if (shellLeaf && proved && shellLeaf !== proved) {
+        return { verified: false, reason: 'inclusion_mismatch' };
+    }
+    if (shellLeaf && !proved) {
+        return { verified: false, reason: 'inclusion_mismatch' };
+    }
+    // A {root, tree_size} written by hand (or a proof's own root) is not a log.
+    if (check.headSigned !== true) {
+        return { verified: false, reason: 'head_signature_missing' };
+    }
+    const ref = check.paymentRef ? String(check.paymentRef) : '';
+    if (!ref)
+        return { verified: false, reason: 'payment_unchecked' };
+    if (check.bindingExpected && !check.bindingMatches) {
+        return { verified: false, reason: 'payment_unchecked' };
+    }
+    return { verified: true, reason: null };
+}
+/**
+ * Expected shell from the signed JWS claims only. Outer holder fields
+ * (payment.settled_amount, payment.network, payment_meta, task_id) are
+ * not signed and are not used, so they cannot ride along under VERIFIED.
+ */
+function signedShellFromHolder(holder) {
+    const holderDoc = typeof holder === 'string' ? { issuer_signature: { jws: holder } } : holder;
+    const sig = (holderDoc.issuer_signature && typeof holderDoc.issuer_signature === 'object')
+        ? holderDoc.issuer_signature
+        : {};
+    return shellFromHolder({ issuer_signature: { jws: typeof sig.jws === 'string' ? sig.jws : null } });
+}
+function compareShellToJws(shell, holder) {
+    const holderDoc = typeof holder === 'string' ? { issuer_signature: { jws: holder } } : holder;
+    const expected = signedShellFromHolder(holderDoc);
+    for (const field of COMPARE_FIELDS) {
+        if (String(shell[field] ?? '') !== String(expected[field] ?? '')) {
+            return { ok: false, field };
+        }
+    }
+    const shellLeaf = shell.inclusion?.leaf_hash ?? null;
+    const expectedLeaf = expected.inclusion?.leaf_hash ?? null;
+    if (shellLeaf && expectedLeaf && String(shellLeaf) !== String(expectedLeaf)) {
+        return { ok: false, field: 'inclusion.leaf_hash' };
+    }
+    return { ok: true };
+}
+/**
+ * v11: body_commitment = HMAC-SHA256(salt, raw body),
+ * request_digest = SHA-256 of the JCS object
+ * {body_commitment, idempotency_key, method, nonce, path}.
+ */
+function openV11Commitment(input) {
+    const payload = input.payload;
+    if (!payload || payload.request_digest == null)
+        return { ok: false, reason: 'no_v11_commitment' };
+    let salt;
+    try {
+        salt = Buffer.from(input.saltHex, 'hex');
+    }
+    catch {
+        return { ok: false, reason: 'bad_salt' };
+    }
+    if (salt.length !== 32)
+        return { ok: false, reason: 'bad_salt' };
+    const body = Buffer.isBuffer(input.body) ? input.body : Buffer.from(input.body);
+    const bodyCommitment = node_crypto_1.default.createHmac('sha256', salt).update(body).digest('hex');
+    const digest = node_crypto_1.default.createHash('sha256').update(jcs({
+        body_commitment: bodyCommitment,
+        idempotency_key: input.idempotencyKey ?? payload.idempotency_key ?? null,
+        method: input.method ?? payload.method ?? null,
+        nonce: input.nonce ?? payload.nonce ?? null,
+        path: input.path ?? payload.path ?? null,
+    })).digest('hex');
+    if (digest !== String(payload.request_digest))
+        return { ok: false, reason: 'commitment_mismatch' };
+    return { ok: true };
+}
+//# sourceMappingURL=shell.js.map

package/dist/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":";;;;;;AAcA,wCAEC;AAoBD,4CASC;AAwBD,0CAqCC;AAoBD,kEAoCC;AAuBD,gDAyBC;AAOD,sDAMC;AAED,8CAcC;AAOD,8CAyBC;AA/QD;;;;;;;;GAQG;AACH,8DAAiC;AAEpB,QAAA,YAAY,GAAG,0BAA0B,CAAC;AAC1C,QAAA,mBAAmB,GAAG,+CAA+C,CAAC;AAEnF,SAAgB,cAAc,CAAC,GAAY;IACzC,OAAO,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAK,GAA2B,CAAC,MAAM,KAAK,oBAAY,CAAC;AAClG,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ;QAClC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,MAAsC,EAAE,OAAgC;IACzF,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,MAAM,CAAC,OAAkC;QAC3C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC;QACpE,CAAC,CAAC,OAAO,CAAC,OAAkC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,kFAAkF;AAClF,SAAgB,eAAe,CAAC,OAAgC;IAC9D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC;QACvF,CAAC,CAAC,OAAO,CAAC,gBAA2C;QACrD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAK,OAAO,CAAC,YAAiD,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/H,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,IAAI,IAAI,CAAkB,CAAC;IACrG,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC;QAC5E,CAAC,CAAC,OAAO,CAAC,SAAoC;QAC9C,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,MAAM,EAAE,oBAAY;QACpB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,IAAI,IAAI;QACzE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM;QAC9B,KAAK,EAAE,OAAO,IAAI,IAAI;QACtB,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC7B,YAAY,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAClD,cAAc,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACxD,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QACnF,SAAS,EAAE;YACT,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,SAAS,IAAI,IAAI;YAC1D,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,IAAI;YAC/B,WAAW,EAAE,SAAS,EAAE,IAAI;gBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;gBACnF,CAAC,CAAC,IAAI;SACT;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,YAAY;IACZ,iBAAiB;IACjB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,WAAW;CACH,CAAC;AAEX;;;;;GAKG;AACH,SAAgB,2BAA2B,CAAC,GAAqC;IAC/E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,2BAA2B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACvC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAQ,SAA+B,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3G,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqB,CAAC;QAC5G,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,kEAAkE;IAClE,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,gBAAgB,EAAE;YAChB,GAAG;YACH,GAAG;YACH,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;SAChD;KACF,CAAC;AACJ,CAAC;AAkBD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,KAAuB;IACxD,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC/C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,IAAI,eAAe,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,IAAI,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,SAAS,IAAI,MAAM,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC3D,CAAC;IACD,4EAA4E;IAC5E,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,MAAwC;IAC5E,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9F,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,gBAAgB,IAAI,OAAO,SAAS,CAAC,gBAAgB,KAAK,QAAQ,CAAC;QACxF,CAAC,CAAC,SAAS,CAAC,gBAAqC;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,eAAe,CAAC,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAA8B,EAAE,MAAwC;IACxG,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAI,KAAK,CAAC,SAAiD,EAAE,SAAS,IAAI,IAAI,CAAC;IAC9F,MAAM,YAAY,GAAI,QAAQ,CAAC,SAAiD,EAAE,SAAS,IAAI,IAAI,CAAC;IACpG,IAAI,SAAS,IAAI,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,KAQjC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAClG,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAAC,CAAC;IACrG,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACpD,eAAe,EAAE,cAAc;QAC/B,eAAe,EAAE,KAAK,CAAC,cAAc,IAAI,OAAO,CAAC,eAAe,IAAI,IAAI;QACxE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI;KACzC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClB,IAAI,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACnG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/solana-payer.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Offline Solana payer verification for Chit402 receipts.
+ *
+ * When payment.ref starts with `solana:`, fetch the settled transaction and
+ * confirm a USDC transfer of payment.gross_amount involving caller_binding.payer_wallet
+ * as authority (x402 exact-svm) without trusting Chit logs.
+ */
+/** Solana mainnet USDC mint (SPL, 6 decimals). */
+export declare const SOLANA_USDC_MINT_MAINNET = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+/** Solana devnet USDC mint (SPL, 6 decimals). */
+export declare const SOLANA_USDC_MINT_DEVNET = "Gh9ZwEmdLJ8DscKNTkTqPbNwLNNBjuSzaG9Vp2KGtKJr";
+/** Default public Solana mainnet RPC (override with SOLANA_RPC_URL). */
+export declare const SOLANA_RPC_URL = "https://api.mainnet-beta.solana.com";
+export interface SolanaPayerVerification {
+    checked: boolean;
+    valid: boolean;
+    signature?: string;
+    payerWallet?: string;
+    expectedAmount?: string;
+    transferredAmount?: string;
+    mint?: string;
+    reason?: string;
+}
+export interface SolanaRpcGetTransactionResult {
+    meta?: {
+        err?: unknown;
+        preTokenBalances?: Array<{
+            accountIndex: number;
+            mint: string;
+            owner?: string;
+            uiTokenAmount?: {
+                amount: string;
+            };
+        }>;
+        postTokenBalances?: Array<{
+            accountIndex: number;
+            mint: string;
+            owner?: string;
+            uiTokenAmount?: {
+                amount: string;
+            };
+        }>;
+    } | null;
+    transaction?: {
+        message?: {
+            accountKeys?: Array<{
+                pubkey: string;
+                signer?: boolean;
+            } | string>;
+            instructions?: Array<{
+                program?: string;
+                programId?: string;
+                parsed?: {
+                    type?: string;
+                    info?: Record<string, unknown>;
+                };
+            }>;
+        };
+        signatures?: string[];
+    };
+}
+export type SolanaRpcFetcher = (signature: string, rpcUrl: string) => Promise<SolanaRpcGetTransactionResult | null>;
+/**
+ * True for a plausible Solana base58 pubkey (32–44 chars).
+ */
+export declare function isSolanaBase58Pubkey(value: unknown): boolean;
+/**
+ * Extract the tx signature from `solana:<sig>` payment.ref.
+ */
+export declare function parseSolanaPaymentRef(paymentRef: string | null | undefined): string | null;
+/**
+ * Parse USDC transfer instructions from a jsonParsed getTransaction result.
+ */
+export declare function extractUsdcTransfersFromTx(tx: SolanaRpcGetTransactionResult, mint?: string): Array<{
+    authority: string;
+    amount: bigint;
+    mint: string;
+}>;
+/**
+ * Fallback: infer USDC outflow from pre/post token balance deltas for a payer owner.
+ */
+export declare function inferUsdcOutflowFromBalances(tx: SolanaRpcGetTransactionResult, payerWallet: string, mint?: string): bigint;
+/**
+ * Default JSON-RPC fetcher for getTransaction (jsonParsed).
+ */
+export declare function fetchSolanaTransaction(signature: string, rpcUrl?: string): Promise<SolanaRpcGetTransactionResult | null>;
+export interface VerifySolanaPayerInput {
+    paymentRef: string;
+    payerWallet: string;
+    grossAmount: string | number | bigint;
+    mint?: string;
+    rpcUrl?: string;
+    fetchTransaction?: SolanaRpcFetcher;
+}
+/**
+ * Verify caller_binding.payer_wallet against a Solana USDC settlement tx.
+ */
+export declare function verifySolanaPayer(input: VerifySolanaPayerInput): Promise<SolanaPayerVerification>;
+//# sourceMappingURL=solana-payer.d.ts.map

package/dist/solana-payer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"solana-payer.d.ts","sourceRoot":"","sources":["../src/solana-payer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,iDAAiD,CAAC;AAEvF,iDAAiD;AACjD,eAAO,MAAM,uBAAuB,iDAAiD,CAAC;AAEtF,wEAAwE;AACxE,eAAO,MAAM,cAAc,wCAAwC,CAAC;AAQpE,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,gBAAgB,CAAC,EAAE,KAAK,CAAC;YACvB,YAAY,EAAE,MAAM,CAAC;YACrB,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,aAAa,CAAC,EAAE;gBAAE,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC;SACpC,CAAC,CAAC;QACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;YACxB,YAAY,EAAE,MAAM,CAAC;YACrB,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,aAAa,CAAC,EAAE;gBAAE,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC;SACpC,CAAC,CAAC;KACJ,GAAG,IAAI,CAAC;IACT,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE;YACR,WAAW,CAAC,EAAE,KAAK,CAAC;gBAAE,MAAM,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE,OAAO,CAAA;aAAE,GAAG,MAAM,CAAC,CAAC;YACnE,YAAY,CAAC,EAAE,KAAK,CAAC;gBACnB,OAAO,CAAC,EAAE,MAAM,CAAC;gBACjB,SAAS,CAAC,EAAE,MAAM,CAAC;gBACnB,MAAM,CAAC,EAAE;oBACP,IAAI,CAAC,EAAE,MAAM,CAAC;oBACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;iBAChC,CAAC;aACH,CAAC,CAAC;SACJ,CAAC;QACF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAAC;AAMnD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM1F;AAUD;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,EAAE,EAAE,6BAA6B,EACjC,IAAI,GAAE,MAAiC,GACtC,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAoC5D;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,6BAA6B,EACjC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,MAAiC,GACtC,MAAM,CAoCR;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAwB/C;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyGvG"}

package/dist/solana-payer.js

@@ -0,0 +1,258 @@
+"use strict";
+/**
+ * Offline Solana payer verification for Chit402 receipts.
+ *
+ * When payment.ref starts with `solana:`, fetch the settled transaction and
+ * confirm a USDC transfer of payment.gross_amount involving caller_binding.payer_wallet
+ * as authority (x402 exact-svm) without trusting Chit logs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOLANA_RPC_URL = exports.SOLANA_USDC_MINT_DEVNET = exports.SOLANA_USDC_MINT_MAINNET = void 0;
+exports.isSolanaBase58Pubkey = isSolanaBase58Pubkey;
+exports.parseSolanaPaymentRef = parseSolanaPaymentRef;
+exports.extractUsdcTransfersFromTx = extractUsdcTransfersFromTx;
+exports.inferUsdcOutflowFromBalances = inferUsdcOutflowFromBalances;
+exports.fetchSolanaTransaction = fetchSolanaTransaction;
+exports.verifySolanaPayer = verifySolanaPayer;
+/** Solana mainnet USDC mint (SPL, 6 decimals). */
+exports.SOLANA_USDC_MINT_MAINNET = 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v';
+/** Solana devnet USDC mint (SPL, 6 decimals). */
+exports.SOLANA_USDC_MINT_DEVNET = 'Gh9ZwEmdLJ8DscKNTkTqPbNwLNNBjuSzaG9Vp2KGtKJr';
+/** Default public Solana mainnet RPC (override with SOLANA_RPC_URL). */
+exports.SOLANA_RPC_URL = 'https://api.mainnet-beta.solana.com';
+/** SPL Token program id. */
+const TOKEN_PROGRAM_ID = 'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA';
+/** Base58 alphabet (no 0, O, I, l). */
+const BASE58_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+function resolveRpcUrl(override) {
+    return override || process.env.SOLANA_RPC_URL || exports.SOLANA_RPC_URL;
+}
+/**
+ * True for a plausible Solana base58 pubkey (32–44 chars).
+ */
+function isSolanaBase58Pubkey(value) {
+    return typeof value === 'string' && BASE58_RE.test(value);
+}
+/**
+ * Extract the tx signature from `solana:<sig>` payment.ref.
+ */
+function parseSolanaPaymentRef(paymentRef) {
+    if (!paymentRef || typeof paymentRef !== 'string')
+        return null;
+    const trimmed = paymentRef.trim();
+    if (!trimmed.toLowerCase().startsWith('solana:'))
+        return null;
+    const sig = trimmed.slice('solana:'.length).trim();
+    return sig.length > 0 ? sig : null;
+}
+function accountPubkey(key) {
+    return typeof key === 'string' ? key : key.pubkey;
+}
+function isSigner(key) {
+    return typeof key !== 'string' && key.signer === true;
+}
+/**
+ * Parse USDC transfer instructions from a jsonParsed getTransaction result.
+ */
+function extractUsdcTransfersFromTx(tx, mint = exports.SOLANA_USDC_MINT_MAINNET) {
+    const transfers = [];
+    const instructions = tx.transaction?.message?.instructions || [];
+    for (const ix of instructions) {
+        const program = ix.program || '';
+        const programId = ix.programId || '';
+        if (program !== 'spl-token' && programId !== TOKEN_PROGRAM_ID)
+            continue;
+        const parsed = ix.parsed;
+        if (!parsed || typeof parsed !== 'object')
+            continue;
+        const type = parsed.type;
+        const info = parsed.info || {};
+        if (type === 'transferChecked') {
+            const ixMint = String(info.mint || '');
+            if (ixMint !== mint)
+                continue;
+            const authority = String(info.authority || info.sourceOwner || '');
+            const tokenAmount = info.tokenAmount;
+            const raw = tokenAmount?.amount ?? info.amount;
+            if (!authority || raw == null)
+                continue;
+            transfers.push({ authority, amount: BigInt(String(raw)), mint: ixMint });
+            continue;
+        }
+        if (type === 'transfer') {
+            // Legacy transfer ix — confirm mint via token balance owner match when possible.
+            const authority = String(info.authority || info.source || '');
+            const raw = info.tokenAmount?.amount ?? info.amount;
+            if (!authority || raw == null)
+                continue;
+            transfers.push({ authority, amount: BigInt(String(raw)), mint });
+        }
+    }
+    return transfers;
+}
+/**
+ * Fallback: infer USDC outflow from pre/post token balance deltas for a payer owner.
+ */
+function inferUsdcOutflowFromBalances(tx, payerWallet, mint = exports.SOLANA_USDC_MINT_MAINNET) {
+    const pre = tx.meta?.preTokenBalances || [];
+    const post = tx.meta?.postTokenBalances || [];
+    const byIndex = new Map();
+    for (const row of pre) {
+        if (row.mint !== mint || !row.owner)
+            continue;
+        const entry = byIndex.get(row.accountIndex) || {
+            pre: 0n,
+            post: 0n,
+            owner: row.owner,
+            mint: row.mint,
+        };
+        entry.pre = BigInt(row.uiTokenAmount?.amount || '0');
+        byIndex.set(row.accountIndex, entry);
+    }
+    for (const row of post) {
+        if (row.mint !== mint || !row.owner)
+            continue;
+        const entry = byIndex.get(row.accountIndex) || {
+            pre: 0n,
+            post: 0n,
+            owner: row.owner,
+            mint: row.mint,
+        };
+        entry.post = BigInt(row.uiTokenAmount?.amount || '0');
+        byIndex.set(row.accountIndex, entry);
+    }
+    let totalOut = 0n;
+    for (const entry of byIndex.values()) {
+        if (entry.owner !== payerWallet)
+            continue;
+        if (entry.pre > entry.post) {
+            totalOut += entry.pre - entry.post;
+        }
+    }
+    return totalOut;
+}
+/**
+ * Default JSON-RPC fetcher for getTransaction (jsonParsed).
+ */
+async function fetchSolanaTransaction(signature, rpcUrl) {
+    const url = resolveRpcUrl(rpcUrl);
+    const body = {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'getTransaction',
+        params: [signature, { encoding: 'jsonParsed', maxSupportedTransactionVersion: 0 }],
+    };
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        throw new Error(`Solana RPC HTTP ${res.status}`);
+    }
+    const json = await res.json();
+    if (json.error) {
+        throw new Error(`Solana RPC error: ${json.error.message || 'unknown'}`);
+    }
+    return json.result ?? null;
+}
+/**
+ * Verify caller_binding.payer_wallet against a Solana USDC settlement tx.
+ */
+async function verifySolanaPayer(input) {
+    const signature = parseSolanaPaymentRef(input.paymentRef);
+    if (!signature) {
+        return { checked: false, valid: false, reason: 'not_solana_payment_ref' };
+    }
+    const payerWallet = String(input.payerWallet || '').trim();
+    if (!isSolanaBase58Pubkey(payerWallet)) {
+        return { checked: false, valid: false, reason: 'invalid_solana_payer_wallet' };
+    }
+    const expectedAmount = BigInt(String(input.grossAmount ?? '0'));
+    if (expectedAmount <= 0n) {
+        return { checked: false, valid: false, reason: 'invalid_gross_amount' };
+    }
+    const mint = input.mint || exports.SOLANA_USDC_MINT_MAINNET;
+    const fetcher = input.fetchTransaction || fetchSolanaTransaction;
+    const rpcUrl = resolveRpcUrl(input.rpcUrl);
+    let tx;
+    try {
+        tx = await fetcher(signature, rpcUrl);
+    }
+    catch (err) {
+        return {
+            checked: true,
+            valid: false,
+            signature,
+            payerWallet,
+            expectedAmount: expectedAmount.toString(),
+            mint,
+            reason: `rpc_error: ${err.message}`,
+        };
+    }
+    if (!tx) {
+        return {
+            checked: true,
+            valid: false,
+            signature,
+            payerWallet,
+            expectedAmount: expectedAmount.toString(),
+            mint,
+            reason: 'transaction_not_found',
+        };
+    }
+    if (tx.meta?.err != null) {
+        return {
+            checked: true,
+            valid: false,
+            signature,
+            payerWallet,
+            expectedAmount: expectedAmount.toString(),
+            mint,
+            reason: 'transaction_failed',
+        };
+    }
+    const accountKeys = tx.transaction?.message?.accountKeys || [];
+    const payerIsSigner = accountKeys.some((k) => accountPubkey(k) === payerWallet && isSigner(k));
+    const transfers = extractUsdcTransfersFromTx(tx, mint);
+    const authorityMatch = transfers.find((t) => t.authority === payerWallet && t.amount >= expectedAmount);
+    if (authorityMatch) {
+        return {
+            checked: true,
+            valid: true,
+            signature,
+            payerWallet,
+            expectedAmount: expectedAmount.toString(),
+            transferredAmount: authorityMatch.amount.toString(),
+            mint,
+        };
+    }
+    // x402 exact-svm: payer may co-sign while authority is their ATA owner — accept signer + balance delta.
+    const outflow = inferUsdcOutflowFromBalances(tx, payerWallet, mint);
+    if (payerIsSigner && outflow >= expectedAmount) {
+        return {
+            checked: true,
+            valid: true,
+            signature,
+            payerWallet,
+            expectedAmount: expectedAmount.toString(),
+            transferredAmount: outflow.toString(),
+            mint,
+            reason: undefined,
+        };
+    }
+    const anyTransfer = transfers.find((t) => t.amount >= expectedAmount);
+    return {
+        checked: true,
+        valid: false,
+        signature,
+        payerWallet,
+        expectedAmount: expectedAmount.toString(),
+        transferredAmount: anyTransfer?.amount.toString(),
+        mint,
+        reason: anyTransfer
+            ? `payer_mismatch: authority ${anyTransfer.authority} !== ${payerWallet}`
+            : `no_usdc_transfer_of_${expectedAmount.toString()}_from_${payerWallet}`,
+    };
+}
+//# sourceMappingURL=solana-payer.js.map

package/dist/solana-payer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solana-payer.js","sourceRoot":"","sources":["../src/solana-payer.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAwEH,oDAEC;AAKD,sDAMC;AAaD,gEAuCC;AAKD,oEAwCC;AAKD,wDA2BC;AAcD,8CAyGC;AA3UD,kDAAkD;AACrC,QAAA,wBAAwB,GAAG,8CAA8C,CAAC;AAEvF,iDAAiD;AACpC,QAAA,uBAAuB,GAAG,8CAA8C,CAAC;AAEtF,wEAAwE;AAC3D,QAAA,cAAc,GAAG,qCAAqC,CAAC;AAEpE,4BAA4B;AAC5B,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAEvE,uCAAuC;AACvC,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAkDlD,SAAS,aAAa,CAAC,QAAiB;IACtC,OAAO,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,sBAAc,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,KAAc;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,UAAqC;IACzE,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,GAAgC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAkD;IAClE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CACxC,EAAiC,EACjC,OAAe,gCAAwB;IAEvC,MAAM,SAAS,GAA+D,EAAE,CAAC;IACjF,MAAM,YAAY,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IAEjE,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,KAAK,WAAW,IAAI,SAAS,KAAK,gBAAgB;YAAE,SAAS;QAExE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QAEpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAE/B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAS;YAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,WAA8C,CAAC;YACxE,MAAM,GAAG,GAAG,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YAC/C,IAAI,CAAC,SAAS,IAAI,GAAG,IAAI,IAAI;gBAAE,SAAS;YACxC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,iFAAiF;YACjF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAI,IAAI,CAAC,WAA+C,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YACzF,IAAI,CAAC,SAAS,IAAI,GAAG,IAAI,IAAI;gBAAE,SAAS;YACxC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAC1C,EAAiC,EACjC,WAAmB,EACnB,OAAe,gCAAwB;IAEvC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,iBAAiB,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsE,CAAC;IAE9F,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI;YAC7C,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI;YAC7C,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,SAAS;QAC1C,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,QAAQ,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,MAAe;IAEf,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,CAAC;QACL,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,8BAA8B,EAAE,CAAC,EAAE,CAAC;KACnF,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAqF,CAAC;IACjH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;AAC7B,CAAC;AAWD;;GAEG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,cAAc,IAAI,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,gCAAwB,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,IAAI,sBAAsB,CAAC;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE3C,IAAI,EAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;YACZ,SAAS;YACT,WAAW;YACX,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;YACzC,IAAI;YACJ,MAAM,EAAE,cAAe,GAAa,CAAC,OAAO,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;YACZ,SAAS;YACT,WAAW;YACX,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;YACzC,IAAI;YACJ,MAAM,EAAE,uBAAuB;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;YACZ,SAAS;YACT,WAAW;YACX,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;YACzC,IAAI;YACJ,MAAM,EAAE,oBAAoB;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;IAC/D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/F,MAAM,SAAS,GAAG,0BAA0B,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;IAExG,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,SAAS;YACT,WAAW;YACX,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;YACzC,iBAAiB,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE;YACnD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,wGAAwG;IACxG,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACpE,IAAI,aAAa,IAAI,OAAO,IAAI,cAAc,EAAE,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,SAAS;YACT,WAAW;YACX,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;YACzC,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE;YACrC,IAAI;YACJ,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,SAAS;QACT,WAAW;QACX,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;QACzC,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE;QACjD,IAAI;QACJ,MAAM,EAAE,WAAW;YACjB,CAAC,CAAC,6BAA6B,WAAW,CAAC,SAAS,QAAQ,WAAW,EAAE;YACzE,CAAC,CAAC,uBAAuB,cAAc,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE;KAC3E,CAAC;AACJ,CAAC"}