kite-x402-hono 0.1.0

package/.env.example

@@ -0,0 +1,11 @@
+PAY_TO=0x0000000000000000000000000000000000000001
+KITE_NETWORK=testnet
+UPSTREAM_URL=http://127.0.0.1:8081
+PRICE_USD=0.001
+PORT=8080
+# Replace PAY_TO with your own receiving wallet before real paid calls.
+# FACILITATOR_URL=https://facilitator.pieverse.io/v2
+# UPSTREAM_AUTH_HEADER=Authorization
+# UPSTREAM_AUTH_VALUE=Bearer your-upstream-key
+# UPSTREAM_TIMEOUT_MS=10000
+# MAX_BODY_BYTES=1048576

package/CONTRIBUTING.md

@@ -0,0 +1,22 @@
+# Contributing
+
+Use Bun 1.4.2 and Node.js 22. Install with `npm ci` (package-lock.json is the
+canonical dependency lock), then run `npm run check` and `npm run test:coverage`.
+Keep the official Kite environment names and `/v1/*` route prefix compatible.
+Never include real credentials, wallet keys, `.env`, or fabricated payment receipts.
+
+Any change affecting payments must test missing/invalid payment, successful
+verify -> upstream -> settle ordering, upstream failure, and settlement failure.
+Keep simulated-facilitator tests distinct from any real paid-call evidence.
+
+## Release v0.1.0
+
+1. Run checks and `npm audit --omit=dev --audit-level=high`.
+2. Run `npm pack --dry-run`, review contents, then `npm pack`.
+3. Install the tarball into an empty directory and exercise CLI help and health.
+4. Confirm the GitHub CI result for the commit being released.
+5. Authenticate to npm interactively; never put tokens or OTPs in committed files.
+6. Publish the reviewed tarball: `npm publish kite-x402-hono-0.1.0.tgz --access public`.
+7. Verify registry version/integrity, then tag the exact source revision.
+
+Do not claim a version has been published until the npm registry confirms it.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,12 @@
+Kite x402 Hono
+Copyright 2026 BrK
+
+Kite network constants and the environment/route compatibility contract are
+adapted from gokite-ai/kite-x402-services, Apache-2.0:
+https://github.com/gokite-ai/kite-x402-services
+Reference revision: 893a27509648b660bbba626b0da59619a94f04ab
+
+Payment processing uses the separately licensed x402 SDK:
+https://github.com/x402-foundation/x402
+
+This is an independent community project, not an official Kite release.

package/README.md

@@ -0,0 +1,156 @@
+# Kite x402 Hono
+
+[![CI](https://github.com/BrKDDD/kite-x402-hono/actions/workflows/ci.yml/badge.svg)](https://github.com/BrKDDD/kite-x402-hono/actions/workflows/ci.yml)
+
+A Bun/Hono reverse-proxy template for paid HTTP APIs on Kite. It complements
+the [official Express and Go templates](https://github.com/gokite-ai/kite-x402-services)
+with the same environment variables and `/v1/*` contract, using the official
+`@x402/hono` middleware rather than implementing payment verification itself.
+
+Independent community project. Apache-2.0; upstream attribution is in NOTICE.
+
+## Quick start from source
+
+Requires Bun 1.3 or later and Node.js 22 or later for npm/build tooling.
+CI is pinned to Bun 1.4.2.
+
+```sh
+git clone https://github.com/BrKDDD/kite-x402-hono.git
+cd kite-x402-hono
+npm ci
+cp .env.example .env
+# Replace PAY_TO in .env with your own receiving wallet.
+bun run example
+```
+
+In another terminal in the same directory:
+
+```sh
+bun run start
+curl -i http://localhost:8080/healthz
+curl -i 'http://localhost:8080/v1/echo?message=hello'
+```
+
+`/healthz` returns 200 without contacting a facilitator. `/v1/echo` returns
+402 with an x402 v2 `PAYMENT-REQUIRED` header when the configured facilitator
+is reachable and supports the selected network. A facilitator outage returns
+503 instead; the upstream is never called without verified payment.
+
+The example is a local echo API, not a deployed service or paid-call receipt.
+Bun reads `.env` automatically; the library's `loadConfig()` only reads the
+environment supplied to it.
+
+## Package use
+
+After version 0.1.0 has been published to npm:
+
+```sh
+npm install kite-x402-hono
+bunx kite-x402-hono --help
+# Set PAY_TO and UPSTREAM_URL, or provide a local .env, before starting.
+bunx kite-x402-hono
+```
+
+Library API:
+
+```ts
+import { createApp, loadConfig } from "kite-x402-hono";
+
+const config = loadConfig();
+const app = createApp(config);
+Bun.serve({ port: config.port, fetch: app.fetch });
+```
+
+`createApp(config, { facilitator, fetchUpstream })` also allows dependency
+injection for tests. Never use a simulated facilitator in a production service.
+
+## Configuration
+
+| Variable               | Default                              | Meaning                                                                         |
+| ---------------------- | ------------------------------------ | ------------------------------------------------------------------------------- |
+| `PAY_TO`               | Required                             | Nonzero EVM receiving address                                                   |
+| `UPSTREAM_URL`         | Required                             | Fixed HTTP(S) origin, with no path, credentials or query                        |
+| `KITE_NETWORK`         | `mainnet`                            | `mainnet` or `testnet`                                                          |
+| `PRICE_USD`            | `0.001`                              | Positive decimal, at most 6 fractional digits; optional `$` prefix              |
+| `FACILITATOR_URL`      | `https://facilitator.pieverse.io/v2` | Keep the `/v2` suffix                                                           |
+| `UPSTREAM_AUTH_HEADER` | `Authorization`                      | Upstream credential header name                                                 |
+| `UPSTREAM_AUTH_VALUE`  | Empty                                | Server-side credential; replaces buyer-supplied values                          |
+| `SERVICE_DESCRIPTION`  | Kite paid API description            | Included in the payment challenge                                               |
+| `PORT`                 | `8080`                               | Wrapper port                                                                    |
+| `UPSTREAM_TIMEOUT_MS`  | `10000`                              | Timeout for reading the request body, then separately for upstream headers/body |
+| `MAX_BODY_BYTES`       | `1048576`                            | Request and response byte limit; maximum 16 MiB                                 |
+
+HTTPS is required for upstream/facilitator URLs except localhost development.
+The example `.env` explicitly selects testnet; the compatibility default remains
+mainnet. This wrapper requires no wallet private key.
+
+| Network | CAIP-2        | Token  | Decimals | EIP-712 domain                        |
+| ------- | ------------- | ------ | -------- | ------------------------------------- |
+| Mainnet | `eip155:2366` | USDC.e | 6        | `Bridged USDC (Kite AI)`, version `2` |
+| Testnet | `eip155:2368` | pieUSD | 18       | `pieUSD`, version `1`                 |
+
+Token addresses are pinned in `src/networks.ts` from official Kite template
+revision `893a27509648b660bbba626b0da59619a94f04ab`. Price conversion uses
+integer arithmetic, including for testnet's 18 decimals.
+
+## Payment and proxy contract
+
+1. No payment or invalid payment: return 402; do not call the upstream.
+2. Verified payment: strip `/v1`, preserve the query/method/body, inject the
+   configured upstream credential, and call the fixed upstream origin.
+3. Upstream 2xx: buffer the bounded response, then ask the facilitator to settle.
+4. Successful settlement: return the upstream response and `PAYMENT-RESPONSE`.
+5. Upstream 4xx/5xx, timeout, oversized body or connection failure: do not settle.
+6. Settlement refusal: return the SDK failure response, withholding protected data.
+
+Compatibility notes:
+
+- `/v1/echo` maps to upstream `/echo`. `/v1/v1/forecast` maps to `/v1/forecast`.
+- All HTTP methods under `/v1/*` are paid; the selected upstream must support them.
+- Unlike the reference template's general below-400 rule, this template **refuses
+  upstream redirects** with 502, without settlement, so credentials cannot follow
+  redirects to a different host. Use the final upstream origin directly.
+- Payment headers, client authorization/cookies, proxy headers and hop-by-hop
+  headers are removed. Upstream authentication response headers and cookies are
+  also stripped. The upstream is trusted: do not select one that echoes secrets
+  into response bodies or unrelated headers.
+- Response buffering is deliberate. Streaming/SSE, WebSocket and unbounded
+  downloads are outside v0.1.0.
+- Upstream actions happen before settlement. For non-idempotent POST operations,
+  settlement failure does not undo the upstream action. Use an upstream with
+  idempotency support; the wrapper does not provide exactly-once execution.
+- A facilitator timeout may leave the on-chain settlement outcome unknown. An
+  error response is not proof of no charge. Reconcile before retrying a payment.
+- `/healthz` is process liveness, not proof of upstream/facilitator readiness.
+- The CLI disables Bun's short idle timeout so it does not disconnect a client
+  during settlement. SDK facilitator calls have their own 90-second timeout;
+  deploy behind a reverse proxy with suitable request deadlines and rate limits.
+
+## Verification
+
+```sh
+npm run typecheck
+bun test --coverage
+npm run build
+npm audit --omit=dev --audit-level=high
+npm pack
+```
+
+Tests exercise the real x402 Hono middleware. A deterministic fake facilitator
+supplies verification/settlement results; a separate HTTP test runs the SDK
+client against local `/v2/supported`, `/v2/verify`, `/v2/settle` endpoints and
+proxies real HTTP requests. Fixtures are clearly labeled and are **not valid
+signatures or evidence of on-chain payment**. CI publishes coverage, JUnit and
+the installable package artifact, and tests installing that artifact separately.
+
+For real paid acceptance, deploy a public HTTPS origin, replace PAY_TO, use a
+Kite Passport sandbox session with testnet pieUSD, and retain the real response
+and transaction hash. Follow the current Passport CLI documentation because its
+commands evolve. No mainnet transaction is required for local development.
+
+## Release and contribution
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for local checks and
+[docs/week-1.md](docs/week-1.md) for the bounty scope and evidence checklist.
+AI tools assisted development; BrK reviews and owns the contribution. Original
+wrapper/configuration/test work is distinguished from upstream SDK functionality.

package/SECURITY.md

@@ -0,0 +1,18 @@
+# Security
+
+Use this template with a trusted upstream and a trusted facilitator. Payment
+cryptography and on-chain verification are delegated to the official x402 SDK
+and the configured facilitator; the proxy does not independently validate chain
+state. Pin dependencies and review updates before upgrading.
+
+Run behind HTTPS with request-rate limits. Keep the receiving wallet separate
+from application secrets. No signing key belongs in this wrapper. Never log
+payment signatures, authorization headers, full request bodies or `.env`.
+
+This is a bounded-response template, not a hardened multi-tenant API gateway.
+An upstream can perform an action before settlement fails. Idempotency and
+reconciliation for such actions must be provided by the upstream/application.
+Do not automatically retry an indeterminate settlement.
+
+Report security issues using GitHub's private vulnerability reporting when
+enabled; do not publish credentials or exploitable details in public issues.

package/dist/app.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import { type FacilitatorClient } from "@x402/core/server";
+import { type Config } from "./config.js";
+import { type FetchUpstream } from "./proxy.js";
+export interface AppOptions {
+    facilitator?: FacilitatorClient;
+    fetchUpstream?: FetchUpstream;
+}
+export declare function createApp(config?: Config, options?: AppOptions): Hono;

package/dist/app.js

@@ -0,0 +1,52 @@
+import { Hono } from "hono";
+import { paymentMiddlewareFromHTTPServer, x402HTTPResourceServer, x402ResourceServer, } from "@x402/hono";
+import { HTTPFacilitatorClient, } from "@x402/core/server";
+import { ExactEvmScheme } from "@x402/evm/exact/server";
+import { loadConfig } from "./config.js";
+import { parsePrice } from "./networks.js";
+import { proxy } from "./proxy.js";
+export function createApp(config = loadConfig(), options = {}) {
+    const app = new Hono();
+    const facilitator = options.facilitator ??
+        new HTTPFacilitatorClient({ url: config.facilitatorUrl });
+    const server = new x402ResourceServer(facilitator).register(config.chain.network, new ExactEvmScheme());
+    const httpServer = new x402HTTPResourceServer(server, {
+        "/v1/*": {
+            accepts: {
+                scheme: "exact",
+                price: parsePrice(config.price, config.chain),
+                network: config.chain.network,
+                payTo: config.payTo,
+                maxTimeoutSeconds: 60,
+            },
+            description: config.description,
+            mimeType: "application/json",
+        },
+    });
+    const payments = paymentMiddlewareFromHTTPServer(httpServer, undefined, undefined, false);
+    // Initialize lazily so /healthz never needs network access and startup errors stay request-scoped.
+    let initialization;
+    app.get("/healthz", (c) => c.json({
+        ok: true,
+        network: config.chain.network,
+        asset: config.chain.symbol,
+        price: `$${config.price}`,
+    }));
+    app.use("/v1/*", async (c, next) => {
+        c.header("cache-control", "no-store");
+        try {
+            initialization ??= httpServer.initialize().catch((error) => {
+                initialization = undefined;
+                throw error;
+            });
+            await initialization;
+        }
+        catch {
+            return c.json({ error: "facilitator_unavailable" }, 503);
+        }
+        return payments(c, next);
+    });
+    app.all("/v1/*", (c) => proxy(c.req.raw, config, options.fetchUpstream ?? ((request) => fetch(request))));
+    app.onError(() => Response.json({ error: "internal_error" }, { status: 500, headers: { "cache-control": "no-store" } }));
+    return app;
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};

package/dist/cli.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env bun
+import { createApp } from "./app.js";
+import { loadConfig } from "./config.js";
+if (process.argv.includes("--help")) {
+    console.log("Usage: kite-x402-hono\nRequired: PAY_TO, UPSTREAM_URL\nOptional: KITE_NETWORK, PRICE_USD, PORT, FACILITATOR_URL, UPSTREAM_AUTH_HEADER, UPSTREAM_AUTH_VALUE, UPSTREAM_TIMEOUT_MS, MAX_BODY_BYTES\nSee README.md for configuration and examples.");
+}
+else {
+    try {
+        const config = loadConfig();
+        const app = createApp(config);
+        const server = Bun.serve({
+            port: config.port,
+            fetch: app.fetch,
+            maxRequestBodySize: config.maxBodyBytes,
+            idleTimeout: 0,
+        });
+        console.log(`Kite x402 Hono listening at ${server.url} (${config.chain.network})`);
+        const shutdown = () => {
+            void server.stop(true);
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : "Unable to start wrapper");
+        process.exitCode = 1;
+    }
+}

package/dist/config.d.ts

@@ -0,0 +1,15 @@
+import { type KiteNetwork } from "./networks.js";
+export interface Config {
+    payTo: string;
+    chain: KiteNetwork;
+    upstream: string;
+    price: string;
+    facilitatorUrl: string;
+    authHeader: string;
+    authValue: string;
+    description: string;
+    port: number;
+    timeoutMs: number;
+    maxBodyBytes: number;
+}
+export declare function loadConfig(env?: Record<string, string | undefined>): Config;

package/dist/config.js

@@ -0,0 +1,82 @@
+import { KITE_NETWORKS, parsePrice } from "./networks.js";
+function integer(value, key, max) {
+    if (!/^\d+$/.test(value) || Number(value) < 1 || Number(value) > max) {
+        throw new Error(`${key} must be an integer between 1 and ${max}`);
+    }
+    return Number(value);
+}
+function httpUrl(value, key, originOnly = false) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${key} must be an absolute HTTP(S) URL`);
+    }
+    if (!["http:", "https:"].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (originOnly && url.pathname !== "/")) {
+        throw new Error(`${key} must be an HTTP(S) ${originOnly ? "origin" : "URL"} without credentials, query or fragment`);
+    }
+    if (url.protocol === "http:" &&
+        !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+        throw new Error(`${key} requires HTTPS except on localhost`);
+    }
+    return originOnly ? url.origin : url.href.replace(/\/$/, "");
+}
+export function loadConfig(env = process.env) {
+    const get = (key, fallback = "") => env[key]?.trim() || fallback;
+    const payTo = get("PAY_TO");
+    if (!/^0x[\da-fA-F]{40}$/.test(payTo) || /^0x0{40}$/i.test(payTo))
+        throw new Error("PAY_TO must be a nonzero EVM address");
+    const network = get("KITE_NETWORK", "mainnet");
+    if (network !== "mainnet" && network !== "testnet")
+        throw new Error("KITE_NETWORK must be mainnet or testnet");
+    const chain = KITE_NETWORKS[network];
+    const price = get("PRICE_USD", "0.001").replace(/^\$/, "");
+    parsePrice(price, chain);
+    const authHeader = get("UPSTREAM_AUTH_HEADER", "Authorization").toLowerCase();
+    if (!/^[!#$%&'*+.^_`|~\da-z-]+$/.test(authHeader) ||
+        [
+            "host",
+            "connection",
+            "content-length",
+            "transfer-encoding",
+            "payment-signature",
+            "payment-response",
+            "payment-required",
+            "x-payment",
+            "x-payment-response",
+            "cookie",
+            "set-cookie",
+            "proxy-authorization",
+            "proxy-authenticate",
+            "content-encoding",
+            "accept-encoding",
+            "upgrade",
+            "te",
+            "trailer",
+            "keep-alive",
+        ].includes(authHeader)) {
+        throw new Error("UPSTREAM_AUTH_HEADER must be a valid application authentication header");
+    }
+    const authValue = get("UPSTREAM_AUTH_VALUE");
+    if (/[\r\n\0]/.test(authValue))
+        throw new Error("UPSTREAM_AUTH_VALUE contains invalid characters");
+    return {
+        payTo,
+        chain,
+        price,
+        authHeader,
+        authValue,
+        upstream: httpUrl(get("UPSTREAM_URL"), "UPSTREAM_URL", true),
+        facilitatorUrl: httpUrl(get("FACILITATOR_URL", "https://facilitator.pieverse.io/v2"), "FACILITATOR_URL"),
+        description: get("SERVICE_DESCRIPTION", "Paid API wrapped for the Kite network"),
+        port: integer(get("PORT", "8080"), "PORT", 65535),
+        timeoutMs: integer(get("UPSTREAM_TIMEOUT_MS", "10000"), "UPSTREAM_TIMEOUT_MS", 120000),
+        maxBodyBytes: integer(get("MAX_BODY_BYTES", "1048576"), "MAX_BODY_BYTES", 16777216),
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { createApp, type AppOptions } from "./app.js";
+export { loadConfig, type Config } from "./config.js";
+export { KITE_NETWORKS, parsePrice, type KiteNetwork } from "./networks.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createApp } from "./app.js";
+export { loadConfig } from "./config.js";
+export { KITE_NETWORKS, parsePrice } from "./networks.js";

package/dist/networks.d.ts

@@ -0,0 +1,28 @@
+import type { AssetAmount, Network } from "@x402/core/types";
+export interface KiteNetwork {
+    readonly network: Network;
+    readonly asset: string;
+    readonly symbol: string;
+    readonly decimals: number;
+    readonly name: string;
+    readonly version: string;
+}
+export declare const KITE_NETWORKS: {
+    readonly mainnet: {
+        readonly network: "eip155:2366";
+        readonly asset: "0x7aB6f3ed87C42eF0aDb67Ed95090f8bF5240149e";
+        readonly symbol: "USDC.e";
+        readonly decimals: 6;
+        readonly name: "Bridged USDC (Kite AI)";
+        readonly version: "2";
+    };
+    readonly testnet: {
+        readonly network: "eip155:2368";
+        readonly asset: "0x38129cf4CE5E183eFF248F42A7D345Bb1B47621A";
+        readonly symbol: "pieUSD";
+        readonly decimals: 18;
+        readonly name: "pieUSD";
+        readonly version: "1";
+    };
+};
+export declare function parsePrice(price: string, chain: KiteNetwork): AssetAmount;

package/dist/networks.js

@@ -0,0 +1,34 @@
+// Network constants follow gokite-ai/kite-x402-services (see NOTICE).
+export const KITE_NETWORKS = {
+    mainnet: {
+        network: "eip155:2366",
+        asset: "0x7aB6f3ed87C42eF0aDb67Ed95090f8bF5240149e",
+        symbol: "USDC.e",
+        decimals: 6,
+        name: "Bridged USDC (Kite AI)",
+        version: "2",
+    },
+    testnet: {
+        network: "eip155:2368",
+        asset: "0x38129cf4CE5E183eFF248F42A7D345Bb1B47621A",
+        symbol: "pieUSD",
+        decimals: 18,
+        name: "pieUSD",
+        version: "1",
+    },
+};
+export function parsePrice(price, chain) {
+    const value = price.trim().replace(/^\$/, "");
+    if (!/^\d+(?:\.\d{1,6})?$/.test(value) || value.length > 40) {
+        throw new Error("PRICE_USD must be a positive decimal with at most 6 fractional digits");
+    }
+    const [whole = "0", fractional = ""] = value.split(".");
+    const units = BigInt(whole + fractional.padEnd(chain.decimals, "0"));
+    if (units <= 0n)
+        throw new Error("PRICE_USD must be greater than zero");
+    return {
+        asset: chain.asset,
+        amount: units.toString(),
+        extra: { name: chain.name, version: chain.version },
+    };
+}

package/dist/proxy.d.ts

@@ -0,0 +1,5 @@
+import type { Config } from "./config.js";
+export type FetchUpstream = (request: Request) => Promise<Response>;
+export declare function cleanHeaders(source: Headers, authHeader: string): Headers;
+export declare function readLimited(stream: ReadableStream<Uint8Array> | null, limit: number, signal?: AbortSignal): Promise<Uint8Array<ArrayBuffer>>;
+export declare function proxy(request: Request, config: Config, fetchUpstream: FetchUpstream): Promise<Response>;

package/dist/proxy.js

@@ -0,0 +1,149 @@
+const blocked = new Set([
+    "connection",
+    "keep-alive",
+    "transfer-encoding",
+    "te",
+    "trailer",
+    "upgrade",
+    "host",
+    "content-length",
+    "proxy-authorization",
+    "proxy-authenticate",
+    "payment-signature",
+    "payment-required",
+    "payment-response",
+    "x-payment",
+    "x-payment-response",
+    "x-payment-required",
+    "cookie",
+    "set-cookie",
+    "authorization",
+    "forwarded",
+    "x-forwarded-for",
+    "x-forwarded-host",
+    "x-forwarded-proto",
+    "x-real-ip",
+]);
+export function cleanHeaders(source, authHeader) {
+    const headers = new Headers(source);
+    const connectionTokens = (headers.get("connection") ?? "")
+        .split(",")
+        .map((token) => token.trim().toLowerCase());
+    for (const key of [...headers.keys()]) {
+        if (blocked.has(key) ||
+            key === authHeader ||
+            connectionTokens.includes(key) ||
+            key.startsWith("x402-"))
+            headers.delete(key);
+    }
+    return headers;
+}
+class BodyTooLarge extends Error {
+}
+export async function readLimited(stream, limit, signal) {
+    if (!stream)
+        return new Uint8Array();
+    const reader = stream.getReader();
+    const cancel = () => {
+        void reader.cancel().catch(() => { });
+    };
+    signal?.addEventListener("abort", cancel, { once: true });
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            signal?.throwIfAborted();
+            const { done, value } = await reader.read();
+            signal?.throwIfAborted();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > limit) {
+                await reader.cancel();
+                throw new BodyTooLarge();
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        signal?.removeEventListener("abort", cancel);
+        reader.releaseLock();
+    }
+    const output = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+export async function proxy(request, config, fetchUpstream) {
+    const incoming = new URL(request.url);
+    // Assign pathname rather than resolving user input: //host must never replace the configured origin.
+    const target = new URL(config.upstream);
+    target.pathname = incoming.pathname.slice(3) || "/";
+    target.search = incoming.search;
+    const headers = cleanHeaders(request.headers, config.authHeader);
+    headers.set("accept-encoding", "identity");
+    if (config.authValue)
+        headers.set(config.authHeader, config.authValue);
+    let body;
+    const bodySignal = AbortSignal.any([
+        request.signal,
+        AbortSignal.timeout(config.timeoutMs),
+    ]);
+    try {
+        if (!["GET", "HEAD"].includes(request.method))
+            body = await readLimited(request.body, config.maxBodyBytes, bodySignal);
+    }
+    catch (error) {
+        if (bodySignal.aborted)
+            return Response.json({ error: "request_timeout_or_abort" }, { status: 408 });
+        return Response.json({
+            error: error instanceof BodyTooLarge
+                ? "request_too_large"
+                : "invalid_request_body",
+        }, { status: error instanceof BodyTooLarge ? 413 : 400 });
+    }
+    const controller = new AbortController();
+    const onAbort = () => controller.abort();
+    request.signal.addEventListener("abort", onAbort, { once: true });
+    if (request.signal.aborted)
+        controller.abort();
+    const timer = setTimeout(() => controller.abort(), config.timeoutMs);
+    try {
+        const upstream = await fetchUpstream(new Request(target, {
+            method: request.method,
+            headers,
+            ...(body ? { body } : {}),
+            signal: controller.signal,
+            redirect: "manual",
+        }));
+        // No redirect following: an upstream cannot forward the injected credential to another host.
+        if (upstream.status >= 300 && upstream.status < 400) {
+            await upstream.body?.cancel();
+            return Response.json({ error: "upstream_redirect_refused" }, { status: 502 });
+        }
+        const bytes = await readLimited(upstream.body, config.maxBodyBytes, controller.signal);
+        const responseHeaders = cleanHeaders(upstream.headers, config.authHeader);
+        responseHeaders.delete("content-encoding");
+        responseHeaders.set("cache-control", "no-store");
+        return new Response(request.method === "HEAD" || [204, 205, 304].includes(upstream.status)
+            ? null
+            : bytes, { status: upstream.status, headers: responseHeaders });
+    }
+    catch (error) {
+        const timeout = controller.signal.aborted;
+        return Response.json({
+            error: timeout
+                ? "upstream_timeout_or_abort"
+                : error instanceof BodyTooLarge
+                    ? "upstream_response_too_large"
+                    : "upstream_unavailable",
+        }, { status: timeout ? 504 : 502 });
+    }
+    finally {
+        clearTimeout(timer);
+        request.signal.removeEventListener("abort", onAbort);
+    }
+}

package/docs/week-1.md

@@ -0,0 +1,41 @@
+# Week 1: Bun/Hono x402 Wrapper
+
+- Direction: `x402-wrapper`
+- Owner: BrKDDD
+- Repository: https://github.com/BrKDDD/kite-x402-hono
+- Target release: `kite-x402-hono@0.1.0`
+- Reference: gokite-ai/kite-x402-services at `893a27509648b660bbba626b0da59619a94f04ab`
+
+## Contribution
+
+Added a Bun/Hono wrapper using the official x402 SDK with Kite mainnet/testnet
+asset configuration, precise integer pricing, compatible environment names and
+routes, bounded proxying, credential/header filtering, and explicit failure
+handling. Tests verify the payment lifecycle and real local HTTP transport.
+GitHub Actions builds, audits, tests, and installs the packed package.
+
+The Hono/Bun application, config validation, proxy restrictions, test suite and
+packaging are this project's work. Kite network constants and compatibility
+requirements come from the attributed official templates. x402 cryptography,
+protocol negotiation and settlement middleware come from the upstream SDK.
+
+## Submission checklist
+
+- Public repository under the bound GitHub account.
+- Current-week commit authored by BrK and linked to BrKDDD.
+- Passing CI for the submitted commit, with downloadable evidence artifacts.
+- npm package URL and installable version verified after publication.
+- Commands, example requests and known compatibility differences in README.
+- No claim that mocked settlement receipts are real paid calls.
+
+Suggested summary:
+
+> Implemented a Kite x402 Bun/Hono wrapper with mainnet/testnet pricing,
+> /v1/\* proxy compatibility, verify-before-upstream and settle-after-success
+> behavior, failure-path coverage, a runnable echo example, and package/CI
+> verification. Payment handling reuses the official x402 SDK. Automated
+> payment evidence uses a simulated facilitator; no on-chain payment is claimed.
+
+Append the actual commit link, successful Actions run, and published npm URL
+when submitting. The activity dashboard's owner/week/EC rules remain external
+acceptance criteria; repository checks alone do not imply bounty approval.

package/examples/upstream.ts

@@ -0,0 +1,21 @@
+import { Hono } from "hono";
+
+const app = new Hono();
+app.get("/echo", (c) =>
+  c.json({
+    message: c.req.query("message") ?? "Hello from Kite",
+    method: c.req.method,
+  }),
+);
+app.post("/echo", async (c) =>
+  c.json({ body: await c.req.text(), method: c.req.method }),
+);
+app.get("/fail", (c) =>
+  c.json({ error: "demonstration_upstream_failure" }, 503),
+);
+const server = Bun.serve({
+  hostname: "127.0.0.1",
+  port: 8081,
+  fetch: app.fetch,
+});
+console.log(`Example upstream: ${server.url}`);

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "kite-x402-hono",
+  "version": "0.1.0",
+  "description": "Bun and Hono reverse proxy for x402 payments on Kite",
+  "type": "module",
+  "license": "Apache-2.0",
+  "author": "BrK",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BrKDDD/kite-x402-hono.git"
+  },
+  "homepage": "https://github.com/BrKDDD/kite-x402-hono#readme",
+  "bugs": {
+    "url": "https://github.com/BrKDDD/kite-x402-hono/issues"
+  },
+  "keywords": [
+    "kite",
+    "x402",
+    "hono",
+    "bun",
+    "payments"
+  ],
+  "engines": {
+    "bun": ">=1.3.0"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "CONTRIBUTING.md",
+    "SECURITY.md",
+    "docs",
+    ".env.example",
+    "examples"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "kite-x402-hono": "dist/cli.js"
+  },
+  "scripts": {
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "dev": "bun --watch src/cli.ts",
+    "start": "bun src/cli.ts",
+    "example": "bun examples/upstream.ts",
+    "typecheck": "tsc --noEmit",
+    "build": "tsc -p tsconfig.build.json",
+    "test": "bun test",
+    "test:coverage": "bun test --coverage",
+    "check": "npm run typecheck && npm test && npm run build",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@x402/core": "2.26.0",
+    "@x402/evm": "2.26.0",
+    "@x402/hono": "2.26.0",
+    "hono": "4.13.8"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.0",
+    "prettier": "3.6.2",
+    "typescript": "^5.9.3"
+  }
+}