moltspay 1.5.0 → 2.0.0

package/dist/{registry-OsEO2dOu.d.mts → registry-DIo0WNoO.d.mts}

@@ -26,6 +26,13 @@ interface X402PaymentPayload {
 }
 /**
  * x402 Payment Requirements (server specifies what it accepts)
+ *
+ * **Per-scheme `extra` conventions:**
+ * - `alipay-aipay` (2.0.0+): `extra` carries the parallel `Payment-Needed`
+ *   contents so x402-aware clients don't need to read the separate HTTP
+ *   header. Server side, `AlipayFacilitator.createPaymentRequirements`
+ *   populates: `payment_needed_header` (Base64URL of nested
+ *   `{protocol, method}` JSON), `out_trade_no`, `pay_before`, `service_id`.
  */
 interface X402PaymentRequirements {
     scheme: string;
@@ -230,4 +237,4 @@ declare function getDefaultRegistry(): FacilitatorRegistry;
  */
 declare function createRegistry(selection?: FacilitatorSelection): FacilitatorRegistry;
 
-export { BaseFacilitator as B, type Facilitator as F, type HealthCheckResult as H, type SelectionStrategy as S, type VerifyResult as V, type X402PaymentPayload as X, type FacilitatorConfig as a, type FacilitatorFee as b, FacilitatorRegistry as c, type FacilitatorSelection as d, type SettleResult as e, type X402PaymentRequirements as f, createRegistry as g, getDefaultRegistry as h };
+export { BaseFacilitator as B, type FacilitatorConfig as F, type HealthCheckResult as H, type SettleResult as S, type VerifyResult as V, type X402PaymentPayload as X, type X402PaymentRequirements as a, type FacilitatorFee as b, type Facilitator as c, FacilitatorRegistry as d, type FacilitatorSelection as e, type SelectionStrategy as f, createRegistry as g, getDefaultRegistry as h };

package/dist/{registry-OsEO2dOu.d.ts → registry-DIo0WNoO.d.ts}

@@ -26,6 +26,13 @@ interface X402PaymentPayload {
 }
 /**
  * x402 Payment Requirements (server specifies what it accepts)
+ *
+ * **Per-scheme `extra` conventions:**
+ * - `alipay-aipay` (2.0.0+): `extra` carries the parallel `Payment-Needed`
+ *   contents so x402-aware clients don't need to read the separate HTTP
+ *   header. Server side, `AlipayFacilitator.createPaymentRequirements`
+ *   populates: `payment_needed_header` (Base64URL of nested
+ *   `{protocol, method}` JSON), `out_trade_no`, `pay_before`, `service_id`.
  */
 interface X402PaymentRequirements {
     scheme: string;
@@ -230,4 +237,4 @@ declare function getDefaultRegistry(): FacilitatorRegistry;
  */
 declare function createRegistry(selection?: FacilitatorSelection): FacilitatorRegistry;
 
-export { BaseFacilitator as B, type Facilitator as F, type HealthCheckResult as H, type SelectionStrategy as S, type VerifyResult as V, type X402PaymentPayload as X, type FacilitatorConfig as a, type FacilitatorFee as b, FacilitatorRegistry as c, type FacilitatorSelection as d, type SettleResult as e, type X402PaymentRequirements as f, createRegistry as g, getDefaultRegistry as h };
+export { BaseFacilitator as B, type FacilitatorConfig as F, type HealthCheckResult as H, type SettleResult as S, type VerifyResult as V, type X402PaymentPayload as X, type X402PaymentRequirements as a, type FacilitatorFee as b, type Facilitator as c, FacilitatorRegistry as d, type FacilitatorSelection as e, type SelectionStrategy as f, createRegistry as g, getDefaultRegistry as h };

package/dist/server/index.d.mts

@@ -1,4 +1,4 @@
-import { d as FacilitatorSelection } from '../registry-OsEO2dOu.mjs';
+import { e as FacilitatorSelection } from '../registry-DIo0WNoO.mjs';
 
 /**
  * MoltsPay Server Types
@@ -22,6 +22,37 @@ interface ServiceConfig {
     command?: string;
     /** Function name to import from skill's index.js (new skill-based approach) */
     function?: string;
+    /**
+     * Alipay AI 收 per-service config (2.0.0+).
+     * Set when this service accepts CNY payments via the alipay rail.
+     * The `price`/`currency` fields above still describe USDC pricing
+     * for the x402 rails; `alipay.price_cny` is a separate CNY price.
+     */
+    alipay?: ServiceAlipayConfig;
+}
+/**
+ * Per-service Alipay AI 收 configuration (2.0.0+).
+ *
+ * Sample:
+ * ```json
+ * "alipay": {
+ *   "service_id": "API_0EA6DC4FC99A4DF7",
+ *   "price_cny": "7.00",
+ *   "goods_name": "产品演示视频 - 系列一"
+ * }
+ * ```
+ */
+interface ServiceAlipayConfig {
+    /** Per-service service_id (defaults to provider.alipay.service_id_default). */
+    service_id?: string;
+    /**
+     * CNY price as decimal string in **元** (e.g. `"7.00"` = 7 CNY).
+     * NOT cents: `"100"` means 100 元, not 100 分.
+     * Must match `/^\d+(\.\d{1,2})?$/`.
+     */
+    price_cny: string;
+    /** Goods name shown to the user in the Alipay app. */
+    goods_name: string;
 }
 interface InputField {
     type: 'string' | 'number' | 'boolean' | 'object';
@@ -45,6 +76,49 @@ interface ProviderConfig {
     solana_wallet?: string;
     chain?: string;
     chains?: ChainConfig[];
+    /**
+     * Alipay AI 收 provider-level config (2.0.0+).
+     * Required when `chains` includes `"alipay"`.
+     * Server validates `private_key_path` / `alipay_public_key_path` are
+     * readable + parse as RSA PEM at startup; rejects start otherwise.
+     */
+    alipay?: ProviderAlipayConfig;
+}
+/**
+ * Provider-level Alipay AI 收 configuration (2.0.0+).
+ *
+ * The user-facing form uses FILE PATHS for both PEM keys; the server
+ * resolves them to PEM strings before constructing AlipayFacilitator.
+ *
+ * Sample:
+ * ```json
+ * "alipay": {
+ *   "seller_id": "2088641494699428",
+ *   "app_id": "2021006150642142",
+ *   "seller_name": "上海超响应数字科技有限公司",
+ *   "service_id_default": "API_0EA6DC4FC99A4DF7",
+ *   "private_key_path": "./cert/ALIPAY_PRIVATE_KEY.txt",
+ *   "alipay_public_key_path": "./cert/ALIPAY_PUBLIC_KEY.txt"
+ * }
+ * ```
+ */
+interface ProviderAlipayConfig {
+    /** Merchant Alipay ID (16 digits, e.g. `"2088641494699428"`). */
+    seller_id: string;
+    /** Application ID from Alipay Open Platform. */
+    app_id: string;
+    /** Merchant legal name; appears in `method.seller_name` of the 402 challenge. */
+    seller_name: string;
+    /** Default `service_id` when a `services[].alipay` entry doesn't override it. */
+    service_id_default: string;
+    /** Path to the RSA2 merchant private key PEM file (relative to moltspay.services.json). */
+    private_key_path: string;
+    /** Path to the Alipay platform public key PEM file (relative to moltspay.services.json). */
+    alipay_public_key_path: string;
+    /** Open API gateway URL. Defaults to `"https://openapi.alipay.com/gateway.do"`. */
+    gateway_url?: string;
+    /** Signature algorithm. Only `"RSA2"` is supported in 2.0.0. */
+    sign_type?: 'RSA2';
 }
 interface ServicesManifest {
     provider: ProviderConfig;
@@ -84,12 +158,39 @@ interface Charge {
     paidAt?: number;
     completedAt?: number;
 }
+/**
+ * CORS configuration. See MoltsPayServerOptions.cors.
+ * Fine-grained shape for providers that need allowlist origins or custom control.
+ */
+interface CorsOptions {
+    /** Explicit origin allowlist. Either an array of origins, or a predicate function. */
+    origins: string[] | ((origin: string) => boolean);
+    /** Emit `Access-Control-Allow-Credentials: true`. Default false. */
+    credentials?: boolean;
+    /** Preflight cache seconds (`Access-Control-Max-Age`). Default 600. */
+    maxAge?: number;
+}
 interface MoltsPayServerOptions {
     port?: number;
     host?: string;
     chargeExpirySecs?: number;
     /** x402 Facilitator URL (default: https://x402.org/facilitator) */
     facilitatorUrl?: string;
+    /**
+     * CORS configuration.
+     *
+     * - `undefined` or `true` (default): allow any origin (`Access-Control-Allow-Origin: *`).
+     *   This matches the 1.5.x behavior — browser clients from any origin can call this server.
+     * - `false`: emit no CORS headers (same-origin only).
+     * - `string[]`: explicit origin allowlist. Request's Origin must match an entry.
+     * - `CorsOptions` object: fine-grained control (origins + credentials + maxAge).
+     *
+     * When CORS is active, the server always exposes the following response headers via
+     * `Access-Control-Expose-Headers`: `X-Payment-Required`, `X-Payment-Response`,
+     * `WWW-Authenticate`, `Payment-Receipt`. These are required for browser clients to
+     * read the 402 challenge and the payment receipt on successful responses.
+     */
+    cors?: boolean | string[] | CorsOptions;
 }
 
 /**
@@ -122,6 +223,8 @@ declare class MoltsPayServer {
     private registry;
     private networkId;
     private useMainnet;
+    /** Alipay AI 收 facilitator instance, set when `provider.alipay` is configured (2.0.0). */
+    private alipayFacilitator;
     constructor(servicesPath: string, options?: MoltsPayServerOptionsExtended);
     /**
      * Register a skill handler for a service
@@ -144,6 +247,21 @@ declare class MoltsPayServer {
      * Start HTTP server
      */
     listen(port?: number): void;
+    /**
+     * Apply CORS response headers according to the `cors` option.
+     *
+     * Default (`cors` unset or `true`): `Access-Control-Allow-Origin: *`. Matches 1.5.x behavior
+     * and works for every browser client whose origin does not need to send cookies.
+     *
+     * `cors: false`: emit no CORS headers. Same-origin only.
+     * `cors: string[]`: origin allowlist — echo the origin back iff it matches.
+     * `cors: CorsOptions`: full control (allowlist + credentials + maxAge).
+     *
+     * The required-for-Web response headers are always exposed when CORS is active:
+     * `X-Payment-Required, X-Payment-Response, WWW-Authenticate, Payment-Receipt`.
+     */
+    private applyCorsHeaders;
+    private writeCorsHeaders;
     /**
      * Handle incoming request
      */
@@ -164,6 +282,23 @@ declare class MoltsPayServer {
      * POST /execute - Execute service with x402 payment
      */
     private handleExecute;
+    /**
+     * Execute a service paid via the Alipay AI 收 fiat rail (2.0.0).
+     *
+     * Differs from the EVM/SVM path: no token detection, no EIP-3009/permit
+     * validation. Verify hits the Alipay Open API (`payment.verify`). Settlement
+     * (`fulfillment.confirm`) is FIRE-AND-FORGET per ALIPAY-INTEGRATION-DESIGN
+     * §5.1: a confirm failure is logged but does NOT fail the already-delivered
+     * response (the buyer's payment proof was already verified).
+     */
+    private handleAlipayExecute;
+    /**
+     * Build the Alipay 402 challenge for a service, or null when the alipay rail
+     * isn't configured for this server or this service. Returns the x402
+     * `accepts[]` entry plus the Base64URL `Payment-Needed` header value so the
+     * 402 responders can dual-emit both the x402 and legacy alipay-bot formats.
+     */
+    private buildAlipayChallenge;
     /**
      * Handle MPP (Machine Payments Protocol) request
      * Supports both x402 and MPP protocols on service endpoints
@@ -242,4 +377,4 @@ declare class MoltsPayServer {
     private sendProxyPaymentRequired;
 }
 
-export { type ChainConfig, type Charge, type ChargeStatus, type InputField, MoltsPayServer, type MoltsPayServerOptions, type MoltsPayServerOptionsExtended, type OutputField, type PaymentRequest, type ProviderConfig, type RegisteredSkill, type ServiceConfig, type ServicesManifest, type SkillFunction, type TokenSymbol, type VerifyRequest };
+export { type ChainConfig, type Charge, type ChargeStatus, type CorsOptions, type InputField, MoltsPayServer, type MoltsPayServerOptions, type MoltsPayServerOptionsExtended, type OutputField, type PaymentRequest, type ProviderAlipayConfig, type ProviderConfig, type RegisteredSkill, type ServiceAlipayConfig, type ServiceConfig, type ServicesManifest, type SkillFunction, type TokenSymbol, type VerifyRequest };

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { d as FacilitatorSelection } from '../registry-OsEO2dOu.js';
+import { e as FacilitatorSelection } from '../registry-DIo0WNoO.js';
 
 /**
  * MoltsPay Server Types
@@ -22,6 +22,37 @@ interface ServiceConfig {
     command?: string;
     /** Function name to import from skill's index.js (new skill-based approach) */
     function?: string;
+    /**
+     * Alipay AI 收 per-service config (2.0.0+).
+     * Set when this service accepts CNY payments via the alipay rail.
+     * The `price`/`currency` fields above still describe USDC pricing
+     * for the x402 rails; `alipay.price_cny` is a separate CNY price.
+     */
+    alipay?: ServiceAlipayConfig;
+}
+/**
+ * Per-service Alipay AI 收 configuration (2.0.0+).
+ *
+ * Sample:
+ * ```json
+ * "alipay": {
+ *   "service_id": "API_0EA6DC4FC99A4DF7",
+ *   "price_cny": "7.00",
+ *   "goods_name": "产品演示视频 - 系列一"
+ * }
+ * ```
+ */
+interface ServiceAlipayConfig {
+    /** Per-service service_id (defaults to provider.alipay.service_id_default). */
+    service_id?: string;
+    /**
+     * CNY price as decimal string in **元** (e.g. `"7.00"` = 7 CNY).
+     * NOT cents: `"100"` means 100 元, not 100 分.
+     * Must match `/^\d+(\.\d{1,2})?$/`.
+     */
+    price_cny: string;
+    /** Goods name shown to the user in the Alipay app. */
+    goods_name: string;
 }
 interface InputField {
     type: 'string' | 'number' | 'boolean' | 'object';
@@ -45,6 +76,49 @@ interface ProviderConfig {
     solana_wallet?: string;
     chain?: string;
     chains?: ChainConfig[];
+    /**
+     * Alipay AI 收 provider-level config (2.0.0+).
+     * Required when `chains` includes `"alipay"`.
+     * Server validates `private_key_path` / `alipay_public_key_path` are
+     * readable + parse as RSA PEM at startup; rejects start otherwise.
+     */
+    alipay?: ProviderAlipayConfig;
+}
+/**
+ * Provider-level Alipay AI 收 configuration (2.0.0+).
+ *
+ * The user-facing form uses FILE PATHS for both PEM keys; the server
+ * resolves them to PEM strings before constructing AlipayFacilitator.
+ *
+ * Sample:
+ * ```json
+ * "alipay": {
+ *   "seller_id": "2088641494699428",
+ *   "app_id": "2021006150642142",
+ *   "seller_name": "上海超响应数字科技有限公司",
+ *   "service_id_default": "API_0EA6DC4FC99A4DF7",
+ *   "private_key_path": "./cert/ALIPAY_PRIVATE_KEY.txt",
+ *   "alipay_public_key_path": "./cert/ALIPAY_PUBLIC_KEY.txt"
+ * }
+ * ```
+ */
+interface ProviderAlipayConfig {
+    /** Merchant Alipay ID (16 digits, e.g. `"2088641494699428"`). */
+    seller_id: string;
+    /** Application ID from Alipay Open Platform. */
+    app_id: string;
+    /** Merchant legal name; appears in `method.seller_name` of the 402 challenge. */
+    seller_name: string;
+    /** Default `service_id` when a `services[].alipay` entry doesn't override it. */
+    service_id_default: string;
+    /** Path to the RSA2 merchant private key PEM file (relative to moltspay.services.json). */
+    private_key_path: string;
+    /** Path to the Alipay platform public key PEM file (relative to moltspay.services.json). */
+    alipay_public_key_path: string;
+    /** Open API gateway URL. Defaults to `"https://openapi.alipay.com/gateway.do"`. */
+    gateway_url?: string;
+    /** Signature algorithm. Only `"RSA2"` is supported in 2.0.0. */
+    sign_type?: 'RSA2';
 }
 interface ServicesManifest {
     provider: ProviderConfig;
@@ -84,12 +158,39 @@ interface Charge {
     paidAt?: number;
     completedAt?: number;
 }
+/**
+ * CORS configuration. See MoltsPayServerOptions.cors.
+ * Fine-grained shape for providers that need allowlist origins or custom control.
+ */
+interface CorsOptions {
+    /** Explicit origin allowlist. Either an array of origins, or a predicate function. */
+    origins: string[] | ((origin: string) => boolean);
+    /** Emit `Access-Control-Allow-Credentials: true`. Default false. */
+    credentials?: boolean;
+    /** Preflight cache seconds (`Access-Control-Max-Age`). Default 600. */
+    maxAge?: number;
+}
 interface MoltsPayServerOptions {
     port?: number;
     host?: string;
     chargeExpirySecs?: number;
     /** x402 Facilitator URL (default: https://x402.org/facilitator) */
     facilitatorUrl?: string;
+    /**
+     * CORS configuration.
+     *
+     * - `undefined` or `true` (default): allow any origin (`Access-Control-Allow-Origin: *`).
+     *   This matches the 1.5.x behavior — browser clients from any origin can call this server.
+     * - `false`: emit no CORS headers (same-origin only).
+     * - `string[]`: explicit origin allowlist. Request's Origin must match an entry.
+     * - `CorsOptions` object: fine-grained control (origins + credentials + maxAge).
+     *
+     * When CORS is active, the server always exposes the following response headers via
+     * `Access-Control-Expose-Headers`: `X-Payment-Required`, `X-Payment-Response`,
+     * `WWW-Authenticate`, `Payment-Receipt`. These are required for browser clients to
+     * read the 402 challenge and the payment receipt on successful responses.
+     */
+    cors?: boolean | string[] | CorsOptions;
 }
 
 /**
@@ -122,6 +223,8 @@ declare class MoltsPayServer {
     private registry;
     private networkId;
     private useMainnet;
+    /** Alipay AI 收 facilitator instance, set when `provider.alipay` is configured (2.0.0). */
+    private alipayFacilitator;
     constructor(servicesPath: string, options?: MoltsPayServerOptionsExtended);
     /**
      * Register a skill handler for a service
@@ -144,6 +247,21 @@ declare class MoltsPayServer {
      * Start HTTP server
      */
     listen(port?: number): void;
+    /**
+     * Apply CORS response headers according to the `cors` option.
+     *
+     * Default (`cors` unset or `true`): `Access-Control-Allow-Origin: *`. Matches 1.5.x behavior
+     * and works for every browser client whose origin does not need to send cookies.
+     *
+     * `cors: false`: emit no CORS headers. Same-origin only.
+     * `cors: string[]`: origin allowlist — echo the origin back iff it matches.
+     * `cors: CorsOptions`: full control (allowlist + credentials + maxAge).
+     *
+     * The required-for-Web response headers are always exposed when CORS is active:
+     * `X-Payment-Required, X-Payment-Response, WWW-Authenticate, Payment-Receipt`.
+     */
+    private applyCorsHeaders;
+    private writeCorsHeaders;
     /**
      * Handle incoming request
      */
@@ -164,6 +282,23 @@ declare class MoltsPayServer {
      * POST /execute - Execute service with x402 payment
      */
     private handleExecute;
+    /**
+     * Execute a service paid via the Alipay AI 收 fiat rail (2.0.0).
+     *
+     * Differs from the EVM/SVM path: no token detection, no EIP-3009/permit
+     * validation. Verify hits the Alipay Open API (`payment.verify`). Settlement
+     * (`fulfillment.confirm`) is FIRE-AND-FORGET per ALIPAY-INTEGRATION-DESIGN
+     * §5.1: a confirm failure is logged but does NOT fail the already-delivered
+     * response (the buyer's payment proof was already verified).
+     */
+    private handleAlipayExecute;
+    /**
+     * Build the Alipay 402 challenge for a service, or null when the alipay rail
+     * isn't configured for this server or this service. Returns the x402
+     * `accepts[]` entry plus the Base64URL `Payment-Needed` header value so the
+     * 402 responders can dual-emit both the x402 and legacy alipay-bot formats.
+     */
+    private buildAlipayChallenge;
     /**
      * Handle MPP (Machine Payments Protocol) request
      * Supports both x402 and MPP protocols on service endpoints
@@ -242,4 +377,4 @@ declare class MoltsPayServer {
     private sendProxyPaymentRequired;
 }
 
-export { type ChainConfig, type Charge, type ChargeStatus, type InputField, MoltsPayServer, type MoltsPayServerOptions, type MoltsPayServerOptionsExtended, type OutputField, type PaymentRequest, type ProviderConfig, type RegisteredSkill, type ServiceConfig, type ServicesManifest, type SkillFunction, type TokenSymbol, type VerifyRequest };
+export { type ChainConfig, type Charge, type ChargeStatus, type CorsOptions, type InputField, MoltsPayServer, type MoltsPayServerOptions, type MoltsPayServerOptionsExtended, type OutputField, type PaymentRequest, type ProviderAlipayConfig, type ProviderConfig, type RegisteredSkill, type ServiceAlipayConfig, type ServiceConfig, type ServicesManifest, type SkillFunction, type TokenSymbol, type VerifyRequest };