moltspay 1.5.0 → 2.0.0

package/dist/server/index.mjs

@@ -229,6 +229,9 @@ var CDPFacilitator = class extends BaseFacilitator {
   }
 };
 
+// src/facilitators/tempo.ts
+import { ethers } from "ethers";
+
 // src/chains/index.ts
 var CHAINS = {
   // ============ Mainnet ============
@@ -395,18 +398,45 @@ var CHAINS = {
     requiresApproval: true
   }
 };
+var ALIPAY_CHAIN_ID = "alipay";
+function isAlipayChainId(id) {
+  return id === ALIPAY_CHAIN_ID;
+}
 
 // src/facilitators/tempo.ts
 var TRANSFER_EVENT_TOPIC = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
+var TIP20_PERMIT_ABI = [
+  "function permit(address owner, address spender, uint256 value, uint256 deadline, uint8 v, bytes32 r, bytes32 s)",
+  "function transferFrom(address from, address to, uint256 value) returns (bool)"
+];
 var TempoFacilitator = class extends BaseFacilitator {
   name = "tempo";
   displayName = "Tempo Testnet";
   supportedNetworks = ["eip155:42431"];
   // Tempo Moderato
   rpcUrl;
+  settlerWallet = null;
   constructor() {
     super();
     this.rpcUrl = CHAINS.tempo_moderato.rpc;
+    const settlerKey = process.env.TEMPO_SETTLER_KEY;
+    if (settlerKey) {
+      try {
+        const provider = new ethers.JsonRpcProvider(this.rpcUrl);
+        this.settlerWallet = new ethers.Wallet(settlerKey, provider);
+      } catch (err) {
+        console.warn("[TempoFacilitator] Invalid TEMPO_SETTLER_KEY, permit settlement disabled:", err);
+        this.settlerWallet = null;
+      }
+    }
+  }
+  /**
+   * Settler EOA address advertised to clients via `X-Payment-Required.extra.tempoSpender`.
+   * Web Client uses this as the `spender` field in the signed EIP-2612 Permit.
+   * Returns null if no TEMPO_SETTLER_KEY is configured — permit settlement unavailable.
+   */
+  getSpenderAddress() {
+    return this.settlerWallet?.address ?? null;
   }
   async healthCheck() {
     const start = Date.now();
@@ -432,6 +462,44 @@ var TempoFacilitator = class extends BaseFacilitator {
     }
   }
   async verify(paymentPayload, requirements) {
+    const inner = paymentPayload.payload;
+    if (inner && "permit" in inner && inner.permit) {
+      return this.verifyPermit(inner, requirements);
+    }
+    return this.verifyTxHash(paymentPayload, requirements);
+  }
+  /**
+   * Structural validation of an EIP-2612 permit payload. Does NOT submit
+   * anything on-chain — actual submission happens in settlePermit().
+   */
+  async verifyPermit(payload, requirements) {
+    if (!this.settlerWallet) {
+      return { valid: false, error: "Permit settlement not configured (TEMPO_SETTLER_KEY missing)" };
+    }
+    const p = payload.permit;
+    if (!p || !p.owner || !p.spender || !p.value || !p.deadline) {
+      return { valid: false, error: "Invalid permit payload: missing fields" };
+    }
+    if (p.spender.toLowerCase() !== this.settlerWallet.address.toLowerCase()) {
+      return {
+        valid: false,
+        error: `Permit spender ${p.spender} does not match configured settler ${this.settlerWallet.address}`
+      };
+    }
+    const deadline = BigInt(p.deadline);
+    const now = BigInt(Math.floor(Date.now() / 1e3));
+    if (deadline <= now) {
+      return { valid: false, error: "Permit deadline has expired" };
+    }
+    if (BigInt(p.value) < BigInt(requirements.amount || "0")) {
+      return {
+        valid: false,
+        error: `Permit value ${p.value} is less than required ${requirements.amount}`
+      };
+    }
+    return { valid: true, details: { scheme: "permit", owner: p.owner } };
+  }
+  async verifyTxHash(paymentPayload, requirements) {
     try {
       const tempoPayload = paymentPayload.payload;
       if (!tempoPayload?.txHash) {
@@ -489,7 +557,11 @@ var TempoFacilitator = class extends BaseFacilitator {
     }
   }
   async settle(paymentPayload, requirements) {
-    const verifyResult = await this.verify(paymentPayload, requirements);
+    const inner = paymentPayload.payload;
+    if (inner && "permit" in inner && inner.permit) {
+      return this.settlePermit(inner, requirements);
+    }
+    const verifyResult = await this.verifyTxHash(paymentPayload, requirements);
     if (!verifyResult.valid) {
       return { success: false, error: verifyResult.error };
     }
@@ -500,6 +572,52 @@ var TempoFacilitator = class extends BaseFacilitator {
       status: "settled"
     };
   }
+  /**
+   * EIP-2612 permit settlement path. Submits two transactions on Tempo:
+   *   1. pathUSD.permit(owner, spender=settler, value, deadline, v, r, s)
+   *   2. pathUSD.transferFrom(owner, payTo, value)
+   *
+   * The settler EOA pays Tempo gas (via the TIP-20 `feeToken` mechanism — no
+   * native tTEMPO required; any held TIP-20 token balance covers fees).
+   */
+  async settlePermit(payload, requirements) {
+    if (!this.settlerWallet) {
+      return { success: false, error: "Permit settlement not configured (TEMPO_SETTLER_KEY missing)" };
+    }
+    if (!requirements.asset || !requirements.payTo) {
+      return { success: false, error: "Missing asset or payTo in requirements" };
+    }
+    const verifyResult = await this.verifyPermit(payload, requirements);
+    if (!verifyResult.valid) {
+      return { success: false, error: verifyResult.error };
+    }
+    const token = new ethers.Contract(requirements.asset, TIP20_PERMIT_ABI, this.settlerWallet);
+    const p = payload.permit;
+    try {
+      const permitTx = await token.permit(
+        p.owner,
+        p.spender,
+        p.value,
+        p.deadline,
+        p.v,
+        p.r,
+        p.s
+      );
+      await permitTx.wait();
+      const transferTx = await token.transferFrom(p.owner, requirements.payTo, p.value);
+      await transferTx.wait();
+      return {
+        success: true,
+        transaction: transferTx.hash,
+        status: "settled"
+      };
+    } catch (err) {
+      return {
+        success: false,
+        error: `Tempo permit settlement failed: ${err.message}`
+      };
+    }
+  }
   async getTransactionReceipt(txHash) {
     const response = await fetch(this.rpcUrl, {
       method: "POST",
@@ -742,12 +860,12 @@ var BNBFacilitator = class extends BaseFacilitator {
     return this.spenderAddress;
   }
   async getServerAddress() {
-    const { ethers } = await import("ethers");
-    const wallet = new ethers.Wallet(this.serverPrivateKey);
+    const { ethers: ethers2 } = await import("ethers");
+    const wallet = new ethers2.Wallet(this.serverPrivateKey);
     return wallet.address;
   }
   async recoverIntentSigner(intent, chainId) {
-    const { ethers } = await import("ethers");
+    const { ethers: ethers2 } = await import("ethers");
     const domain = {
       ...EIP712_DOMAIN,
       chainId
@@ -761,7 +879,7 @@ var BNBFacilitator = class extends BaseFacilitator {
       nonce: intent.nonce,
       deadline: intent.deadline
     };
-    const recoveredAddress = ethers.verifyTypedData(
+    const recoveredAddress = ethers2.verifyTypedData(
       domain,
       INTENT_TYPES,
       message,
@@ -805,10 +923,10 @@ var BNBFacilitator = class extends BaseFacilitator {
     return result.result || "0x0";
   }
   async executeTransferFrom(from, to, amount, token, rpcUrl) {
-    const { ethers } = await import("ethers");
-    const provider = new ethers.JsonRpcProvider(rpcUrl);
-    const wallet = new ethers.Wallet(this.serverPrivateKey, provider);
-    const tokenContract = new ethers.Contract(token, [
+    const { ethers: ethers2 } = await import("ethers");
+    const provider = new ethers2.JsonRpcProvider(rpcUrl);
+    const wallet = new ethers2.Wallet(this.serverPrivateKey, provider);
+    const tokenContract = new ethers2.Contract(token, [
       "function transferFrom(address from, address to, uint256 amount) returns (bool)"
     ], wallet);
     const tx = await tokenContract.transferFrom(from, to, amount);
@@ -1045,6 +1163,374 @@ var SolanaFacilitator = class extends BaseFacilitator {
   }
 };
 
+// src/facilitators/alipay.ts
+import crypto2 from "crypto";
+
+// src/facilitators/alipay/rsa2.ts
+import crypto from "crypto";
+function rsa2Sign(data, privateKeyPem) {
+  const signer = crypto.createSign("RSA-SHA256");
+  signer.update(data, "utf-8");
+  signer.end();
+  return signer.sign(privateKeyPem, "base64");
+}
+
+// src/facilitators/alipay/encoding.ts
+function base64url(input) {
+  return Buffer.from(input, "utf-8").toString("base64url");
+}
+function decodeBase64UrlWithPadFix(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+  return Buffer.from(padded, "base64").toString("utf-8");
+}
+function toPem(key, kind) {
+  const trimmed = key.trim();
+  if (trimmed.includes("-----BEGIN")) return trimmed;
+  const label = kind === "PRIVATE" ? "PRIVATE KEY" : "PUBLIC KEY";
+  const body = trimmed.replace(/\s+/g, "").match(/.{1,64}/g)?.join("\n") ?? "";
+  return `-----BEGIN ${label}-----
+${body}
+-----END ${label}-----
+`;
+}
+
+// src/facilitators/alipay/openapi.ts
+function formatAlipayTimestamp(d = /* @__PURE__ */ new Date()) {
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+}
+function buildSigningString(params) {
+  return Object.keys(params).sort().map((k) => `${k}=${params[k]}`).join("&");
+}
+function responseWrapperKey(method) {
+  return `${method.replace(/\./g, "_")}_response`;
+}
+async function alipayOpenApiCall(method, bizContent, config) {
+  const publicParams = {
+    app_id: config.app_id,
+    method,
+    format: "JSON",
+    charset: "utf-8",
+    sign_type: config.sign_type ?? "RSA2",
+    timestamp: formatAlipayTimestamp(),
+    version: "1.0",
+    biz_content: JSON.stringify(bizContent)
+  };
+  const signingString = buildSigningString(publicParams);
+  const sign = rsa2Sign(signingString, config.private_key_pem);
+  const body = new URLSearchParams({ ...publicParams, sign }).toString();
+  const response = await fetch(config.gateway_url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded;charset=utf-8"
+    },
+    body
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "<unreadable>");
+    throw new Error(
+      `Alipay Open API HTTP ${response.status} for ${method}: ${text.slice(0, 500)}`
+    );
+  }
+  const json = await response.json();
+  const wrapperKey = responseWrapperKey(method);
+  const business = json[wrapperKey];
+  if (business === void 0 || business === null || typeof business !== "object") {
+    throw new Error(
+      `Alipay Open API response missing "${wrapperKey}" wrapper for ${method}: ${JSON.stringify(json).slice(0, 500)}`
+    );
+  }
+  return business;
+}
+
+// src/facilitators/alipay.ts
+var ALIPAY_NETWORK = "alipay";
+var ALIPAY_SCHEME = "alipay-aipay";
+var ALIPAY_GATEWAY_PROD = "https://openapi.alipay.com/gateway.do";
+var ALIPAY_AMOUNT_REGEX = /^\d+(\.\d{1,2})?$/;
+var ALIPAY_PAY_BEFORE_MS = 30 * 60 * 1e3;
+var ALIPAY_SIGNING_FIELDS = [
+  "amount",
+  "currency",
+  "goods_name",
+  "out_trade_no",
+  "pay_before",
+  "resource_id",
+  "seller_id",
+  "service_id"
+];
+var AlipayFacilitator = class extends BaseFacilitator {
+  name = "alipay";
+  displayName = "Alipay AI \u6536";
+  supportedNetworks = [ALIPAY_NETWORK];
+  config;
+  constructor(config) {
+    super();
+    this.config = {
+      gateway_url: ALIPAY_GATEWAY_PROD,
+      sign_type: "RSA2",
+      ...config
+    };
+  }
+  /**
+   * Build the 402 challenge for a service: signs the 8-field payload with
+   * RSA2, packages the nested `{protocol, method}` JSON as Base64URL for
+   * `Payment-Needed`, and emits the parallel x402 `accepts[]` entry.
+   */
+  async createPaymentRequirements(opts) {
+    if (!ALIPAY_AMOUNT_REGEX.test(opts.priceCny)) {
+      throw new Error(
+        `AlipayFacilitator.createPaymentRequirements: priceCny "${opts.priceCny}" does not match /^\\d+(\\.\\d{1,2})?$/ (unit is \u5143, not \u5206; e.g. "1.00" not "100")`
+      );
+    }
+    const now = /* @__PURE__ */ new Date();
+    const outTradeNo = opts.outTradeNo ?? generateOutTradeNo();
+    const payBefore = formatPayBefore(now);
+    const signedFields = {
+      amount: opts.priceCny,
+      currency: "CNY",
+      goods_name: opts.goodsName,
+      out_trade_no: outTradeNo,
+      pay_before: payBefore,
+      resource_id: opts.resourceId,
+      seller_id: this.config.seller_id,
+      service_id: opts.serviceId
+    };
+    const signingString = ALIPAY_SIGNING_FIELDS.map((k) => `${k}=${signedFields[k]}`).join("&");
+    const seller_signature = rsa2Sign(signingString, this.config.private_key_pem);
+    const challenge = {
+      protocol: {
+        out_trade_no: outTradeNo,
+        amount: signedFields.amount,
+        currency: signedFields.currency,
+        resource_id: signedFields.resource_id,
+        pay_before: payBefore,
+        seller_signature,
+        seller_sign_type: this.config.sign_type ?? "RSA2",
+        seller_unique_id: this.config.seller_id
+      },
+      method: {
+        seller_name: this.config.seller_name,
+        seller_id: this.config.seller_id,
+        seller_app_id: this.config.app_id,
+        goods_name: signedFields.goods_name,
+        seller_unique_id_key: "seller_id",
+        service_id: signedFields.service_id
+      }
+    };
+    const paymentNeededHeader = base64url(JSON.stringify(challenge));
+    const x402Accepts = {
+      scheme: ALIPAY_SCHEME,
+      network: ALIPAY_NETWORK,
+      asset: "CNY",
+      amount: opts.priceCny,
+      payTo: this.config.seller_id,
+      maxTimeoutSeconds: ALIPAY_PAY_BEFORE_MS / 1e3,
+      extra: {
+        payment_needed_header: paymentNeededHeader,
+        out_trade_no: outTradeNo,
+        pay_before: payBefore,
+        service_id: signedFields.service_id
+      }
+    };
+    return { x402Accepts, paymentNeededHeader };
+  }
+  /**
+   * Verify a `Payment-Proof` by calling
+   * `alipay.aipay.agent.payment.verify` against the Alipay Open API.
+   *
+   * The proof is conveyed via `paymentPayload.payload`, which may be:
+   * - a raw Base64URL string (the `Payment-Proof` header value), or
+   * - an object `{ paymentProof: string }` / `{ proofHeader: string }`.
+   *
+   * All failure modes (malformed payload, network errors, Alipay
+   * `code != 10000`) return `{ valid: false, error }`. No exception
+   * escapes, regardless of client-supplied input.
+   */
+  async verify(paymentPayload, _requirements) {
+    try {
+      const proofHeader = extractProofHeader(paymentPayload.payload);
+      const decoded = decodeProof(proofHeader);
+      const response = await alipayOpenApiCall(
+        "alipay.aipay.agent.payment.verify",
+        {
+          payment_proof: decoded.protocol.payment_proof,
+          trade_no: decoded.protocol.trade_no,
+          client_session: decoded.method.client_session
+        },
+        this.getOpenApiConfig()
+      );
+      if (response.code !== "10000") {
+        return {
+          valid: false,
+          error: `alipay verify ${response.code}: ${response.sub_msg ?? response.msg ?? "unknown"}`,
+          details: {
+            code: response.code,
+            sub_code: response.sub_code,
+            sub_msg: response.sub_msg
+          }
+        };
+      }
+      return {
+        valid: true,
+        details: {
+          trade_no: response.trade_no ?? decoded.protocol.trade_no,
+          amount: response.amount,
+          out_trade_no: response.out_trade_no,
+          resource_id: response.resource_id,
+          active: response.active
+        }
+      };
+    } catch (e) {
+      return {
+        valid: false,
+        error: e instanceof Error ? e.message : String(e)
+      };
+    }
+  }
+  /**
+   * Settle by calling `alipay.aipay.agent.fulfillment.confirm` after the
+   * service resource has been returned to the buyer.
+   *
+   * Per the design (see ALIPAY-INTEGRATION-DESIGN.md §5.1, risk row
+   * "履约确认失败"), this is **fire-and-forget**: the caller (registry /
+   * server) is expected to log fulfillment failures but NOT roll back
+   * the already-delivered resource.
+   *
+   * Re-decodes `paymentPayload.payload` to extract `trade_no` (verify
+   * does the same; the redundant Base64URL decode is negligible).
+   */
+  async settle(paymentPayload, _requirements) {
+    try {
+      const proofHeader = extractProofHeader(paymentPayload.payload);
+      const decoded = decodeProof(proofHeader);
+      const tradeNo = decoded.protocol.trade_no;
+      const response = await alipayOpenApiCall(
+        "alipay.aipay.agent.fulfillment.confirm",
+        { trade_no: tradeNo },
+        this.getOpenApiConfig()
+      );
+      if (response.code !== "10000") {
+        return {
+          success: false,
+          transaction: tradeNo,
+          error: `alipay fulfillment ${response.code}: ${response.sub_msg ?? response.msg ?? "unknown"}`,
+          status: "fulfillment_failed"
+        };
+      }
+      return {
+        success: true,
+        transaction: tradeNo,
+        status: "fulfilled"
+      };
+    } catch (e) {
+      return {
+        success: false,
+        error: e instanceof Error ? e.message : String(e)
+      };
+    }
+  }
+  /**
+   * Validate that the configured RSA keys parse and that the Open API
+   * gateway is reachable. Does NOT make a real business API call (would
+   * burn quota and could appear as a legitimate verify attempt in logs).
+   */
+  async healthCheck() {
+    const start = Date.now();
+    try {
+      crypto2.createPrivateKey(this.config.private_key_pem);
+    } catch (e) {
+      return {
+        healthy: false,
+        error: `merchant private_key_pem parse failed: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+    try {
+      crypto2.createPublicKey(this.config.alipay_public_key_pem);
+    } catch (e) {
+      return {
+        healthy: false,
+        error: `alipay_public_key_pem parse failed: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+    const gatewayUrl = this.config.gateway_url ?? ALIPAY_GATEWAY_PROD;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5e3);
+    const response = await fetch(gatewayUrl, {
+      method: "HEAD",
+      signal: controller.signal
+    }).catch(() => null);
+    clearTimeout(timeout);
+    const latencyMs = Date.now() - start;
+    if (!response) {
+      return { healthy: false, error: `gateway unreachable: ${gatewayUrl}`, latencyMs };
+    }
+    return { healthy: true, latencyMs };
+  }
+  /** Bundle the facilitator config into the shape openapi.ts wants. */
+  getOpenApiConfig() {
+    return {
+      gateway_url: this.config.gateway_url ?? ALIPAY_GATEWAY_PROD,
+      app_id: this.config.app_id,
+      private_key_pem: this.config.private_key_pem,
+      alipay_public_key_pem: this.config.alipay_public_key_pem,
+      sign_type: this.config.sign_type
+    };
+  }
+};
+function generateOutTradeNo() {
+  return "VID" + crypto2.randomBytes(22).toString("base64url").slice(0, 29);
+}
+function formatPayBefore(now) {
+  const expiry = new Date(now.getTime() + ALIPAY_PAY_BEFORE_MS);
+  return expiry.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function extractProofHeader(payload) {
+  if (typeof payload === "string") {
+    if (payload.length === 0) {
+      throw new Error("alipay Payment-Proof is empty");
+    }
+    return payload;
+  }
+  if (payload !== null && typeof payload === "object") {
+    const obj = payload;
+    const candidate = obj.paymentProof ?? obj.proofHeader;
+    if (typeof candidate === "string" && candidate.length > 0) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    "alipay payment payload must be a Base64URL string or {paymentProof: string} / {proofHeader: string}"
+  );
+}
+function decodeProof(proofHeader) {
+  let parsed;
+  try {
+    parsed = JSON.parse(decodeBase64UrlWithPadFix(proofHeader));
+  } catch (e) {
+    throw new Error(
+      `failed to decode Payment-Proof: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    throw new Error("decoded Payment-Proof is not an object");
+  }
+  const obj = parsed;
+  const protocol = obj.protocol;
+  const method = obj.method;
+  if (!protocol || typeof protocol.payment_proof !== "string") {
+    throw new Error("decoded Payment-Proof missing protocol.payment_proof");
+  }
+  if (typeof protocol.trade_no !== "string") {
+    throw new Error("decoded Payment-Proof missing protocol.trade_no");
+  }
+  if (!method || typeof method.client_session !== "string") {
+    throw new Error("decoded Payment-Proof missing method.client_session");
+  }
+  return parsed;
+}
+
 // src/facilitators/registry.ts
 import { Keypair as Keypair2 } from "@solana/web3.js";
 import bs58 from "bs58";
@@ -1069,6 +1555,7 @@ var FacilitatorRegistry = class {
       }
       return new SolanaFacilitator({ feePayerKeypair });
     });
+    this.registerFactory("alipay", (config) => new AlipayFacilitator(config));
     this.selection = selection || { primary: "cdp", fallback: ["tempo", "bnb", "solana"], strategy: "failover" };
   }
   /**
@@ -1293,6 +1780,11 @@ var PAYMENT_RESPONSE_HEADER = "x-payment-response";
 var MPP_AUTH_HEADER = "authorization";
 var MPP_WWW_AUTH_HEADER = "www-authenticate";
 var MPP_RECEIPT_HEADER = "payment-receipt";
+var ALIPAY_PAYMENT_NEEDED_HEADER = "payment-needed";
+var ALIPAY_PAYMENT_PROOF_HEADER = "payment-proof";
+function headerSafe(value) {
+  return String(value ?? "").replace(/[^\x20-\x7E]/g, (ch) => encodeURIComponent(ch)).replace(/"/g, "%22");
+}
 var TOKEN_ADDRESSES = {
   "eip155:8453": {
     USDC: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
@@ -1365,9 +1857,13 @@ var TOKEN_DOMAINS = {
     USDT: { name: "(PoS) Tether USD", version: "2" }
   },
   // Tempo Moderato testnet - TIP-20 stablecoins
+  // Domain names verified against on-chain DOMAIN_SEPARATOR values on 2026-04-21.
+  // See docs/TEMPO-WEB-SUPPORT.md Section 2 and test/server/tempo-domain.test.ts.
+  // All 4 Tempo TIP-20 tokens (pathUSD / AlphaUSD / BetaUSD / ThetaUSD) use
+  // the token symbol with first letter capitalized + version "1".
   "eip155:42431": {
-    USDC: { name: "pathUSD", version: "1" },
-    USDT: { name: "alphaUSD", version: "1" }
+    USDC: { name: "PathUSD", version: "1" },
+    USDT: { name: "AlphaUSD", version: "1" }
   },
   // BNB Smart Chain mainnet
   "eip155:56": {
@@ -1424,6 +1920,8 @@ var MoltsPayServer = class {
   registry;
   networkId;
   useMainnet;
+  /** Alipay AI 收 facilitator instance, set when `provider.alipay` is configured (2.0.0). */
+  alipayFacilitator = null;
   constructor(servicesPath, options = {}) {
     loadEnvFile2();
     const content = readFileSync2(servicesPath, "utf-8");
@@ -1445,7 +1943,38 @@ var MoltsPayServer = class {
         cdp: { useMainnet: this.useMainnet }
       }
     };
+    const providerAlipay = this.manifest.provider.alipay;
+    if (providerAlipay) {
+      try {
+        const baseDir = path2.dirname(servicesPath);
+        const resolvePem = (p, kind) => toPem(readFileSync2(path2.isAbsolute(p) ? p : path2.resolve(baseDir, p), "utf-8"), kind);
+        const alipayFacilitatorConfig = {
+          seller_id: providerAlipay.seller_id,
+          app_id: providerAlipay.app_id,
+          seller_name: providerAlipay.seller_name,
+          service_id_default: providerAlipay.service_id_default,
+          private_key_pem: resolvePem(providerAlipay.private_key_path, "PRIVATE"),
+          alipay_public_key_pem: resolvePem(providerAlipay.alipay_public_key_path, "PUBLIC"),
+          gateway_url: providerAlipay.gateway_url,
+          sign_type: providerAlipay.sign_type
+        };
+        facilitatorConfig.config = {
+          ...facilitatorConfig.config,
+          alipay: alipayFacilitatorConfig
+        };
+        facilitatorConfig.fallback = facilitatorConfig.fallback || [];
+        if (facilitatorConfig.primary !== "alipay" && !facilitatorConfig.fallback.includes("alipay")) {
+          facilitatorConfig.fallback.push("alipay");
+        }
+      } catch (err) {
+        throw new Error(`[MoltsPay] Alipay rail configured but key load failed: ${err.message}`);
+      }
+    }
     this.registry = new FacilitatorRegistry(facilitatorConfig);
+    if (providerAlipay) {
+      this.alipayFacilitator = this.registry.get("alipay");
+      console.log(`[MoltsPay] Alipay AI \u6536 rail enabled (seller ${providerAlipay.seller_id})`);
+    }
     const primaryFacilitator = this.registry.get(facilitatorConfig.primary);
     console.log(`[MoltsPay] Loaded ${this.manifest.services.length} services from ${servicesPath}`);
     console.log(`[MoltsPay] Provider: ${this.manifest.provider.name}`);
@@ -1535,14 +2064,63 @@ var MoltsPayServer = class {
       console.log(`  GET  /health       - Health check (incl. facilitators)`);
     });
   }
+  /**
+   * Apply CORS response headers according to the `cors` option.
+   *
+   * Default (`cors` unset or `true`): `Access-Control-Allow-Origin: *`. Matches 1.5.x behavior
+   * and works for every browser client whose origin does not need to send cookies.
+   *
+   * `cors: false`: emit no CORS headers. Same-origin only.
+   * `cors: string[]`: origin allowlist — echo the origin back iff it matches.
+   * `cors: CorsOptions`: full control (allowlist + credentials + maxAge).
+   *
+   * The required-for-Web response headers are always exposed when CORS is active:
+   * `X-Payment-Required, X-Payment-Response, WWW-Authenticate, Payment-Receipt`.
+   */
+  applyCorsHeaders(req, res) {
+    const cors = this.options.cors;
+    if (cors === false) {
+      return;
+    }
+    const requestOrigin = req.headers.origin ?? "*";
+    if (cors === void 0 || cors === true) {
+      this.writeCorsHeaders(res, "*");
+      return;
+    }
+    if (Array.isArray(cors)) {
+      if (cors.includes(requestOrigin)) {
+        this.writeCorsHeaders(res, requestOrigin);
+        res.setHeader("Vary", "Origin");
+      }
+      return;
+    }
+    const opt = cors;
+    const isAllowed = typeof opt.origins === "function" ? opt.origins(requestOrigin) : opt.origins.includes(requestOrigin);
+    if (!isAllowed) {
+      return;
+    }
+    this.writeCorsHeaders(res, requestOrigin);
+    res.setHeader("Vary", "Origin");
+    if (opt.credentials) {
+      res.setHeader("Access-Control-Allow-Credentials", "true");
+    }
+    const maxAge = opt.maxAge ?? 600;
+    res.setHeader("Access-Control-Max-Age", String(maxAge));
+  }
+  writeCorsHeaders(res, origin) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, X-Payment, Authorization, Payment-Proof");
+    res.setHeader(
+      "Access-Control-Expose-Headers",
+      "X-Payment-Required, X-Payment-Response, WWW-Authenticate, Payment-Receipt, Payment-Needed"
+    );
+  }
   /**
    * Handle incoming request
    */
   async handleRequest(req, res) {
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, X-Payment, Authorization");
-    res.setHeader("Access-Control-Expose-Headers", "X-Payment-Required, X-Payment-Response, WWW-Authenticate, Payment-Receipt");
+    this.applyCorsHeaders(req, res);
     if (req.method === "OPTIONS") {
       res.writeHead(204);
       res.end();
@@ -1562,7 +2140,8 @@ var MoltsPayServer = class {
       if (url.pathname === "/execute" && req.method === "POST") {
         const body = await this.readBody(req);
         const paymentHeader = req.headers[PAYMENT_HEADER];
-        return await this.handleExecute(body, paymentHeader, res);
+        const proofHeader = req.headers[ALIPAY_PAYMENT_PROOF_HEADER];
+        return await this.handleExecute(body, paymentHeader, res, proofHeader);
       }
       if (url.pathname === "/proxy" && req.method === "POST") {
         const clientIP = req.headers["x-real-ip"] || req.headers["x-forwarded-for"]?.split(",")[0]?.trim() || req.socket.remoteAddress || "";
@@ -1580,7 +2159,8 @@ var MoltsPayServer = class {
         const body = req.method === "POST" ? await this.readBody(req) : {};
         const authHeader = req.headers[MPP_AUTH_HEADER];
         const x402Header = req.headers[PAYMENT_HEADER];
-        return await this.handleMPPRequest(skill, body, authHeader, x402Header, res);
+        const proofHeader = req.headers[ALIPAY_PAYMENT_PROOF_HEADER];
+        return await this.handleMPPRequest(skill, body, authHeader, x402Header, res, proofHeader);
       }
       this.sendJson(res, 404, { error: "Not found" });
     } catch (err) {
@@ -1677,7 +2257,7 @@ var MoltsPayServer = class {
   /**
    * POST /execute - Execute service with x402 payment
    */
-  async handleExecute(body, paymentHeader, res) {
+  async handleExecute(body, paymentHeader, res, proofHeader) {
     const { service, params } = body;
     if (!service) {
       return this.sendJson(res, 400, { error: "Missing service" });
@@ -1691,6 +2271,15 @@ var MoltsPayServer = class {
         return this.sendJson(res, 400, { error: `Missing required param: ${key}` });
       }
     }
+    if (proofHeader) {
+      const alipayPayment = {
+        x402Version: X402_VERSION2,
+        scheme: ALIPAY_SCHEME,
+        network: ALIPAY_NETWORK,
+        payload: proofHeader
+      };
+      return this.handleAlipayExecute(skill, params || {}, alipayPayment, res);
+    }
     if (!paymentHeader) {
       return this.sendPaymentRequired(skill.config, res);
     }
@@ -1701,6 +2290,11 @@ var MoltsPayServer = class {
     } catch {
       return this.sendJson(res, 400, { error: "Invalid X-Payment header" });
     }
+    const payScheme = payment.accepted?.scheme || payment.scheme;
+    const payNetwork = payment.accepted?.network || payment.network;
+    if (payScheme === ALIPAY_SCHEME || (payNetwork ? isAlipayChainId(payNetwork) : false)) {
+      return this.handleAlipayExecute(skill, params || {}, payment, res);
+    }
     const validation = this.validatePayment(payment, skill.config);
     if (!validation.valid) {
       return this.sendJson(res, 402, { error: validation.error });
@@ -1765,6 +2359,14 @@ var MoltsPayServer = class {
         console.log(`[MoltsPay] Payment settled by ${settlement.facilitator}: ${settlement.transaction || "pending"}`);
       } catch (err) {
         console.error("[MoltsPay] Settlement failed:", err.message);
+        settlement = { success: false, error: err.message, facilitator: "none" };
+      }
+      if (!settlement?.success) {
+        return this.sendJson(res, 402, {
+          error: "Payment settlement failed",
+          message: settlement?.error || "Settlement returned no success state",
+          facilitator: settlement?.facilitator
+        });
       }
     }
     const responseHeaders = {};
@@ -1785,13 +2387,111 @@ var MoltsPayServer = class {
       payment: settlement?.success ? { transaction: settlement.transaction, status: "settled", facilitator: settlement.facilitator } : { status: "pending" }
     }, responseHeaders);
   }
+  /**
+   * Execute a service paid via the Alipay AI 收 fiat rail (2.0.0).
+   *
+   * Differs from the EVM/SVM path: no token detection, no EIP-3009/permit
+   * validation. Verify hits the Alipay Open API (`payment.verify`). Settlement
+   * (`fulfillment.confirm`) is FIRE-AND-FORGET per ALIPAY-INTEGRATION-DESIGN
+   * §5.1: a confirm failure is logged but does NOT fail the already-delivered
+   * response (the buyer's payment proof was already verified).
+   */
+  async handleAlipayExecute(skill, params, payment, res) {
+    if (!this.alipayFacilitator) {
+      return this.sendJson(res, 402, { error: "Alipay rail not configured on this server" });
+    }
+    const requirements = {
+      scheme: ALIPAY_SCHEME,
+      network: ALIPAY_NETWORK,
+      asset: "CNY",
+      amount: skill.config.alipay?.price_cny || "0",
+      payTo: this.manifest.provider.alipay?.seller_id || "",
+      maxTimeoutSeconds: 1800
+    };
+    console.log(`[MoltsPay] Verifying Alipay payment...`);
+    const verifyResult = await this.registry.verify(payment, requirements);
+    if (!verifyResult.valid) {
+      return this.sendJson(res, 402, {
+        error: `Payment verification failed: ${verifyResult.error}`,
+        facilitator: verifyResult.facilitator
+      });
+    }
+    console.log(`[MoltsPay] Alipay payment verified by ${verifyResult.facilitator}`);
+    const timeoutSeconds = parseInt(process.env.SKILL_TIMEOUT_SECONDS || "1200");
+    console.log(`[MoltsPay] Executing skill: ${skill.id} (timeout: ${timeoutSeconds}s)`);
+    let result;
+    try {
+      result = await Promise.race([
+        skill.handler(params),
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error(`Skill timeout after ${timeoutSeconds}s`)), timeoutSeconds * 1e3)
+        )
+      ]);
+    } catch (err) {
+      console.error("[MoltsPay] Skill execution failed:", err.message);
+      return this.sendJson(res, 500, {
+        error: "Service execution failed",
+        message: err.message
+      });
+    }
+    let settlement;
+    try {
+      settlement = await this.registry.settle(payment, requirements);
+      if (settlement.success) {
+        console.log(`[MoltsPay] Alipay fulfillment confirmed: ${settlement.transaction}`);
+      } else {
+        console.error(`[MoltsPay] Alipay fulfillment confirm failed (non-fatal): ${settlement.error}`);
+      }
+    } catch (err) {
+      console.error(`[MoltsPay] Alipay fulfillment confirm threw (non-fatal): ${err.message}`);
+      settlement = { success: false, error: err.message, facilitator: "alipay" };
+    }
+    const responseHeaders = {};
+    if (settlement.success) {
+      responseHeaders[PAYMENT_RESPONSE_HEADER] = Buffer.from(JSON.stringify({
+        success: true,
+        transaction: settlement.transaction,
+        network: ALIPAY_NETWORK,
+        facilitator: settlement.facilitator
+      })).toString("base64");
+    }
+    this.sendJson(res, 200, {
+      success: true,
+      result,
+      payment: settlement.success ? { transaction: settlement.transaction, status: "fulfilled", facilitator: settlement.facilitator } : { status: "delivered_unconfirmed", error: settlement.error }
+    }, responseHeaders);
+  }
+  /**
+   * Build the Alipay 402 challenge for a service, or null when the alipay rail
+   * isn't configured for this server or this service. Returns the x402
+   * `accepts[]` entry plus the Base64URL `Payment-Needed` header value so the
+   * 402 responders can dual-emit both the x402 and legacy alipay-bot formats.
+   */
+  async buildAlipayChallenge(config) {
+    if (!this.alipayFacilitator || !config.alipay) return null;
+    try {
+      const req = await this.alipayFacilitator.createPaymentRequirements({
+        serviceId: config.alipay.service_id || this.manifest.provider.alipay.service_id_default,
+        priceCny: config.alipay.price_cny,
+        goodsName: config.alipay.goods_name,
+        resourceId: `/execute?service=${config.id}`
+      });
+      return { accepts: req.x402Accepts, paymentNeededHeader: req.paymentNeededHeader };
+    } catch (err) {
+      console.error(`[MoltsPay] Alipay challenge build failed for ${config.id}: ${err.message}`);
+      return null;
+    }
+  }
   /**
    * Handle MPP (Machine Payments Protocol) request
    * Supports both x402 and MPP protocols on service endpoints
    */
-  async handleMPPRequest(skill, body, authHeader, x402Header, res) {
+  async handleMPPRequest(skill, body, authHeader, x402Header, res, proofHeader) {
     const config = skill.config;
     const params = body || {};
+    if (proofHeader) {
+      return await this.handleExecute({ service: config.id, params }, void 0, res, proofHeader);
+    }
     if (x402Header) {
       return await this.handleExecute({ service: config.id, params }, x402Header, res);
     }
@@ -1897,7 +2597,7 @@ var MoltsPayServer = class {
   /**
    * Return 402 with both x402 and MPP payment requirements
    */
-  sendMPPPaymentRequired(config, res) {
+  async sendMPPPaymentRequired(config, res) {
     const acceptedTokens = getAcceptedCurrencies(config);
     const providerChains = this.getProviderChains();
     const accepts = [];
@@ -1908,6 +2608,10 @@ var MoltsPayServer = class {
         }
       }
     }
+    const alipayChallenge = await this.buildAlipayChallenge(config);
+    if (alipayChallenge) {
+      accepts.push(alipayChallenge.accepts);
+    }
     const x402PaymentRequired = {
       x402Version: X402_VERSION2,
       accepts,
@@ -1935,7 +2639,7 @@ var MoltsPayServer = class {
       };
       const mppRequestEncoded = Buffer.from(JSON.stringify(mppRequest)).toString("base64");
       const expiresAt = new Date(Date.now() + 5 * 60 * 1e3).toISOString();
-      mppWwwAuth = `Payment id="${challengeId}", realm="${this.manifest.provider.name}", method="tempo", intent="charge", request="${mppRequestEncoded}", description="${config.name}", expires="${expiresAt}"`;
+      mppWwwAuth = `Payment id="${challengeId}", realm="${headerSafe(this.manifest.provider.name)}", method="tempo", intent="charge", request="${mppRequestEncoded}", description="${headerSafe(config.name)}", expires="${expiresAt}"`;
     }
     const headers = {
       "Content-Type": "application/problem+json",
@@ -1944,6 +2648,9 @@ var MoltsPayServer = class {
     if (mppWwwAuth) {
       headers[MPP_WWW_AUTH_HEADER] = mppWwwAuth;
     }
+    if (alipayChallenge) {
+      headers[ALIPAY_PAYMENT_NEEDED_HEADER] = alipayChallenge.paymentNeededHeader;
+    }
     res.writeHead(402, headers);
     res.end(JSON.stringify({
       type: "https://paymentauth.org/problems/payment-required",
@@ -1970,7 +2677,7 @@ var MoltsPayServer = class {
    * Return 402 with x402 payment requirements (v2 format)
    * Includes requirements for all chains and all accepted currencies
    */
-  sendPaymentRequired(config, res) {
+  async sendPaymentRequired(config, res) {
     const acceptedTokens = getAcceptedCurrencies(config);
     const providerChains = this.getProviderChains();
     const accepts = [];
@@ -1981,6 +2688,10 @@ var MoltsPayServer = class {
         }
       }
     }
+    const alipayChallenge = await this.buildAlipayChallenge(config);
+    if (alipayChallenge) {
+      accepts.push(alipayChallenge.accepts);
+    }
     const acceptedChains = providerChains.map((c) => {
       if (c.network === "eip155:8453") return "base";
       if (c.network === "eip155:137") return "polygon";
@@ -1998,10 +2709,14 @@ var MoltsPayServer = class {
       }
     };
     const encoded = Buffer.from(JSON.stringify(paymentRequired)).toString("base64");
-    res.writeHead(402, {
+    const headers = {
       "Content-Type": "application/json",
       [PAYMENT_REQUIRED_HEADER]: encoded
-    });
+    };
+    if (alipayChallenge) {
+      headers[ALIPAY_PAYMENT_NEEDED_HEADER] = alipayChallenge.paymentNeededHeader;
+    }
+    res.writeHead(402, headers);
     res.end(JSON.stringify({
       error: "Payment required",
       message: `Service requires $${config.price} ${config.currency}`,
@@ -2019,7 +2734,7 @@ var MoltsPayServer = class {
     }
     const scheme = payment.accepted?.scheme || payment.scheme;
     const network = payment.accepted?.network || payment.network || this.networkId;
-    if (scheme !== "exact") {
+    if (scheme !== "exact" && scheme !== "permit") {
       return { valid: false, error: `Unsupported scheme: ${scheme}` };
     }
     if (!this.isNetworkAccepted(network)) {
@@ -2041,8 +2756,10 @@ var MoltsPayServer = class {
     const tokenAddresses = TOKEN_ADDRESSES[selectedNetwork] || {};
     const tokenAddress = tokenAddresses[selectedToken];
     const tokenDomain = getTokenDomain(selectedNetwork, selectedToken);
+    const isTempo = selectedNetwork === "eip155:42431";
+    const scheme = isTempo ? "permit" : "exact";
     const requirements = {
-      scheme: "exact",
+      scheme,
       network: selectedNetwork,
       asset: tokenAddress,
       amount: amountInUnits,
@@ -2070,6 +2787,16 @@ var MoltsPayServer = class {
         };
       }
     }
+    if (isTempo) {
+      const tempoFacilitator = this.registry.get("tempo");
+      const tempoSpender = tempoFacilitator?.getSpenderAddress?.();
+      if (tempoSpender) {
+        requirements.extra = {
+          ...requirements.extra || {},
+          tempoSpender
+        };
+      }
+    }
     return requirements;
   }
   /**
@@ -2096,12 +2823,12 @@ var MoltsPayServer = class {
     return accepted.includes(token);
   }
   async readBody(req) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let body = "";
       req.on("data", (chunk) => body += chunk);
       req.on("end", () => {
         try {
-          resolve(body ? JSON.parse(body) : {});
+          resolve2(body ? JSON.parse(body) : {});
         } catch {
           reject(new Error("Invalid JSON"));
         }
@@ -2204,7 +2931,7 @@ var MoltsPayServer = class {
     }
     const scheme = payment.accepted?.scheme || payment.scheme;
     const network = payment.accepted?.network || payment.network;
-    if (scheme !== "exact") {
+    if (scheme !== "exact" && scheme !== "permit") {
       return this.sendJson(res, 402, { error: `Unsupported scheme: ${scheme}` });
     }
     const expectedNetwork = chain ? CHAIN_TO_NETWORK[chain] || this.networkId : this.networkId;
@@ -2359,7 +3086,7 @@ var MoltsPayServer = class {
       };
       const mppRequestEncoded = Buffer.from(JSON.stringify(mppRequest)).toString("base64");
       const expiresAt = new Date(Date.now() + 5 * 60 * 1e3).toISOString();
-      const wwwAuth = `Payment id="${challengeId}", realm="MoltsPay Proxy", method="tempo", intent="charge", request="${mppRequestEncoded}", description="${config.name}", expires="${expiresAt}"`;
+      const wwwAuth = `Payment id="${challengeId}", realm="MoltsPay Proxy", method="tempo", intent="charge", request="${mppRequestEncoded}", description="${headerSafe(config.name)}", expires="${expiresAt}"`;
       res.writeHead(402, {
         "Content-Type": "application/problem+json",
         [MPP_WWW_AUTH_HEADER]: wwwAuth