moltspay 2.0.0 → 2.4.0

package/dist/mcp/index.mjs

@@ -12,16 +12,17 @@ import { webcrypto } from "crypto";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/mcp/server.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 
 // src/client/node/index.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, statSync, chmodSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-import { Wallet as Wallet2, ethers as ethers2 } from "ethers";
+import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, statSync, chmodSync, readdirSync as readdirSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+import { randomUUID as randomUUID3 } from "crypto";
+import { Wallet as Wallet2, ethers as ethers3 } from "ethers";
 
 // src/chains/index.ts
 var CHAINS = {
@@ -1092,7 +1093,7 @@ var AlipayClient = class {
       if (m) media.push(m);
       else opts.onLine?.(line);
     };
-    const intentSummary = opts.intentSummary?.trim() || `\u652F\u4ED8 ${requirement.amount ?? ""} ${requirement.asset ?? "CNY"}`.trim();
+    const intentSummary = opts.intentSummary?.trim() || `Pay ${requirement.amount ?? ""} ${requirement.asset ?? "CNY"}`.trim();
     await timeStep("ensure-cli", flow, () => ensureCli(this.getVersion));
     const intentTtlMs = resolveIntentTtlMs();
     const intentKey = `${this.configDir}::${this.framework}`;
@@ -1177,10 +1178,205 @@ var AlipayClient = class {
   }
 };
 
+// src/client/wechat/index.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+var WECHAT_SCHEME = "wechatpay-native";
+var WECHAT_NETWORK = "wechat";
+var POLL_INTERVAL_MS2 = 3e3;
+var TIMEOUT_MS = 5 * 60 * 1e3;
+var WechatClient = class {
+  configDir;
+  sessionDir;
+  now;
+  constructor(options = {}) {
+    this.configDir = options.configDir || join3(homedir3(), ".moltspay");
+    this.sessionDir = join3(this.configDir, "wechat-sessions");
+    this.now = options.now ?? Date.now;
+  }
+  async pay402(opts) {
+    const session = this.start402({ ...opts });
+    const result = await this.pollSession(session.paymentSessionId, {
+      pollIntervalMs: opts.pollIntervalMs,
+      timeoutMs: opts.timeoutMs,
+      signal: opts.signal
+    });
+    if (result.status === "paid" || result.status === "completed") {
+      return {
+        body: result.resultBody ?? "",
+        status: result.lastHttpStatus ?? 200
+      };
+    }
+    throw new Error(result.lastError || `WeChat payment ended with status ${result.status}`);
+  }
+  /**
+   * Start a recoverable WeChat payment session. This returns immediately after
+   * persisting `out_trade_no`, QR payload, original request body, and context.
+   */
+  start402(opts) {
+    const extra = opts.requirement.extra ?? {};
+    const codeUrl = typeof extra.code_url === "string" ? extra.code_url : "";
+    const outTradeNo = typeof extra.out_trade_no === "string" ? extra.out_trade_no : "";
+    if (!codeUrl || !outTradeNo) {
+      throw new Error(
+        "WechatClient.pay402: wechatpay-native requirement is missing extra.code_url / extra.out_trade_no"
+      );
+    }
+    const now = new Date(this.now());
+    const timeoutMs = opts.timeoutMs ?? (opts.requirement.maxTimeoutSeconds ?? TIMEOUT_MS / 1e3) * 1e3;
+    const session = {
+      paymentSessionId: opts.paymentSessionId ?? `mpay_sess_${randomUUID2()}`,
+      status: "pending",
+      resourceUrl: opts.resourceUrl,
+      method: opts.method ?? "POST",
+      data: opts.data,
+      requirement: opts.requirement,
+      codeUrl,
+      outTradeNo,
+      createdAt: now.toISOString(),
+      updatedAt: now.toISOString(),
+      expiresAt: new Date(this.now() + timeoutMs).toISOString(),
+      context: opts.context
+    };
+    this.saveSession(session);
+    opts.onPaymentPending?.({ codeUrl, outTradeNo });
+    return session;
+  }
+  /**
+   * Query a persisted session once by replaying the original request with the
+   * stored `out_trade_no` proof. 200 means paid + fulfilled; 402 means pending.
+   */
+  async status(identifier) {
+    const session = this.loadSession(identifier);
+    if (session.status === "cancelled" || session.status === "completed") return session;
+    if (this.now() >= new Date(session.expiresAt).getTime()) {
+      return this.updateSession(session, {
+        status: "expired",
+        lastError: `WeChat payment expired at ${session.expiresAt}`
+      });
+    }
+    const xPayment = this.buildPaymentHeader(session);
+    const res = await fetch(session.resourceUrl, {
+      method: session.method,
+      headers: { "Content-Type": "application/json", "X-Payment": xPayment },
+      body: session.method === "POST" ? session.data : void 0
+    });
+    const text = await res.text().catch(() => "");
+    if (res.status === 200) {
+      return this.updateSession(session, {
+        status: "completed",
+        lastHttpStatus: res.status,
+        lastError: void 0,
+        resultBody: text
+      });
+    }
+    if (res.status === 402) {
+      return this.updateSession(session, {
+        status: "pending",
+        lastHttpStatus: res.status,
+        lastError: text.slice(0, 500) || "wechat payment pending"
+      });
+    }
+    return this.updateSession(session, {
+      status: "failed",
+      lastHttpStatus: res.status,
+      lastError: `WeChat /execute returned HTTP ${res.status}: ${text.slice(0, 500)}`
+    });
+  }
+  /** Poll a session until it completes, expires, fails, or is aborted. */
+  async pollSession(identifier, opts = {}) {
+    const first = this.loadSession(identifier);
+    const deadline = Math.min(
+      new Date(first.expiresAt).getTime(),
+      this.now() + (opts.timeoutMs ?? TIMEOUT_MS)
+    );
+    const interval = opts.pollIntervalMs ?? POLL_INTERVAL_MS2;
+    let session = first;
+    while (this.now() < deadline) {
+      if (opts.signal?.aborted) throw new Error("WeChat payment aborted");
+      session = await this.status(session.paymentSessionId);
+      if (session.status !== "pending") return session;
+      await new Promise((r) => setTimeout(r, interval));
+    }
+    return this.updateSession(session, {
+      status: "expired",
+      lastError: `WeChat payment timed out after ${Math.round((opts.timeoutMs ?? TIMEOUT_MS) / 1e3)}s (out_trade_no=${session.outTradeNo}, last status ${session.lastHttpStatus ?? 0})`
+    });
+  }
+  /** `fulfill` is an idempotent status check: paid sessions return stored body. */
+  async fulfill(identifier) {
+    const session = this.loadSession(identifier);
+    if (session.status === "completed") return session;
+    return this.status(identifier);
+  }
+  /** Mark a local session cancelled. Closing the merchant order is server-side. */
+  cancel(identifier) {
+    const session = this.loadSession(identifier);
+    return this.updateSession(session, {
+      status: "cancelled",
+      lastError: "cancelled locally"
+    });
+  }
+  listSessions() {
+    this.ensureSessionDir();
+    return readdirSync(this.sessionDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync2(join3(this.sessionDir, name), "utf-8"))).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+  }
+  buildPaymentHeader(session) {
+    const proof = {
+      x402Version: 2,
+      scheme: WECHAT_SCHEME,
+      network: WECHAT_NETWORK,
+      accepted: {
+        scheme: WECHAT_SCHEME,
+        network: WECHAT_NETWORK,
+        extra: { out_trade_no: session.outTradeNo }
+      },
+      payload: { out_trade_no: session.outTradeNo }
+    };
+    return Buffer.from(JSON.stringify(proof)).toString("base64");
+  }
+  loadSession(identifier) {
+    this.ensureSessionDir();
+    const direct = join3(this.sessionDir, `${identifier}.json`);
+    try {
+      return JSON.parse(readFileSync2(direct, "utf-8"));
+    } catch {
+      const byTradeNo = this.listSessions().find((s) => s.outTradeNo === identifier);
+      if (byTradeNo) return byTradeNo;
+      throw new Error(`WeChat payment session not found: ${identifier}`);
+    }
+  }
+  saveSession(session) {
+    this.ensureSessionDir();
+    writeFileSync2(
+      join3(this.sessionDir, `${session.paymentSessionId}.json`),
+      JSON.stringify(session, null, 2)
+    );
+  }
+  updateSession(session, updates) {
+    const next = {
+      ...session,
+      ...updates,
+      updatedAt: new Date(this.now()).toISOString()
+    };
+    this.saveSession(next);
+    return next;
+  }
+  ensureSessionDir() {
+    mkdirSync2(this.sessionDir, { recursive: true });
+  }
+};
+
 // src/client/alipay/router.ts
 var ALIPAY_RAIL = "alipay";
+var WECHAT_RAIL = "wechat";
+var BALANCE_RAIL = "balance";
 function railOf(req) {
   if (req.scheme === "alipay-aipay" || req.network === ALIPAY_RAIL) return ALIPAY_RAIL;
+  if (req.scheme === "wechatpay-native" || req.network === WECHAT_RAIL) return WECHAT_RAIL;
+  if (req.scheme === BALANCE_RAIL || req.network === BALANCE_RAIL) return BALANCE_RAIL;
   return networkToChainName(req.network) ?? req.network;
 }
 function findRail(accepts, rail) {
@@ -1220,6 +1416,14 @@ function selectRail(input) {
   return { rail: railOf(serverAccepts[0]), requirement: serverAccepts[0] };
 }
 
+// src/facilitators/balance/auth.ts
+import { ethers as ethers2 } from "ethers";
+var BALANCE_AUTH_DOMAIN = "moltspay-balance-auth:v1";
+var BALANCE_AUTH_MAX_SKEW_MS = 5 * 60 * 1e3;
+function buildDeductMessage(f) {
+  return [BALANCE_AUTH_DOMAIN, "balance-deduct", f.buyerId, f.requestId, f.service, String(f.timestamp)].join("\n");
+}
+
 // src/client/node/index.ts
 var DEFAULT_CONFIG = {
   chain: "base",
@@ -1239,7 +1443,7 @@ var MoltsPayClient = class {
   railPreference;
   alipaySessionId;
   constructor(options = {}) {
-    this.configDir = options.configDir || join3(homedir3(), ".moltspay");
+    this.configDir = options.configDir || join4(homedir4(), ".moltspay");
     this.config = this.loadConfig();
     this.railPreference = options.railPreference ?? this.config.railPreference;
     this.alipaySessionId = options.alipaySessionId;
@@ -1323,6 +1527,12 @@ var MoltsPayClient = class {
     if (options.rail === ALIPAY_RAIL) {
       return this.payViaAlipay(serverUrl, service, params, options);
     }
+    if (options.rail === WECHAT_RAIL) {
+      return this.payViaWechat(serverUrl, service, params, options);
+    }
+    if (options.rail === BALANCE_RAIL) {
+      return this.payViaBalance(serverUrl, service, params, options);
+    }
     if (!this.wallet || !this.walletData) {
       throw new Error("Client not initialized. Run: npx moltspay init");
     }
@@ -1584,6 +1794,399 @@ Please specify: --chain <chain_name>`
       return { body: result.body, payment: result.payment, media: result.media };
     }
   }
+  /**
+   * Pay for a service over the WeChat Pay Native fiat rail (2.1.0).
+   *
+   * Mirrors {@link payViaAlipay} and needs no EVM wallet. The server placed the
+   * Native order when it built the 402, so its `wechatpay-native` accepts[]
+   * entry already carries `extra.code_url` + `extra.out_trade_no`. Flow: hit the
+   * resource to get the 402, confirm the server offers the wechat rail, surface
+   * the code_url (caller renders a QR), then poll the resource with the
+   * out_trade_no proof until the server verifies the order paid and delivers.
+   */
+  async payViaWechat(serverUrl, service, params, options) {
+    const session = await this.startWechatPayment(serverUrl, service, params, options);
+    const wechat = new WechatClient({ configDir: this.configDir });
+    const result = await wechat.pollSession(session.paymentSessionId, {
+      timeoutMs: options.timeoutMs,
+      signal: options.signal
+    });
+    if (result.status !== "completed") {
+      throw new Error(result.lastError || `WeChat payment ended with status ${result.status}`);
+    }
+    try {
+      const json = JSON.parse(result.resultBody ?? "");
+      return json.result ?? json;
+    } catch {
+      return { body: result.resultBody ?? "" };
+    }
+  }
+  /**
+   * The ethers wallet used to sign balance-rail deductions: the client's EVM
+   * wallet if it has one, else a per-configDir identity key persisted at
+   * `<configDir>/balance-identity.key` (0600) so a balance-only client works
+   * without a full crypto wallet. Under `agent 统一代付`, one key spends every
+   * account the agent tops up.
+   */
+  balanceSigner() {
+    if (this.wallet) return this.wallet;
+    const p = join4(this.configDir, "balance-identity.key");
+    let pk;
+    if (existsSync2(p)) {
+      pk = readFileSync3(p, "utf-8").trim();
+    } else {
+      mkdirSync3(this.configDir, { recursive: true });
+      pk = Wallet2.createRandom().privateKey;
+      writeFileSync3(p, pk, { mode: 384 });
+    }
+    return new Wallet2(pk);
+  }
+  /** The balance-rail spending signer address (lowercase 0x…). Stable per
+   *  configDir; this is the identity the server TOFU-binds and later verifies. */
+  getBalanceSignerAddress() {
+    return this.balanceSigner().address.toLowerCase();
+  }
+  /** The buyer id for the balance rail: explicit option > persisted config. */
+  resolveBuyerId(explicit) {
+    const buyerId = explicit ?? this.config.buyerId;
+    if (!buyerId) {
+      throw new Error(
+        "Balance rail needs a buyer id. Pass { buyerId } or persist one with setBuyerId()."
+      );
+    }
+    return buyerId;
+  }
+  /**
+   * Pay via the custodial balance rail (2.2.0, password-free).
+   *
+   * No wallet, no QR: the request carries `{buyer_id, request_id}` in the
+   * X-Payment payload and the server deducts the prepaid balance atomically
+   * before running the skill. The client-generated `request_id` makes the
+   * charge idempotent — a network retry can never double-deduct.
+   */
+  async payViaBalance(serverUrl, service, params, options) {
+    const buyerId = this.resolveBuyerId(options.buyerId);
+    let attempt = await this.balanceDeduct(serverUrl, service, params, options, buyerId);
+    if (attempt.ok) return attempt.result;
+    const fundable = attempt.status === 402 && (attempt.code === "buyer_not_found" || attempt.code === "insufficient_balance" || /insufficient balance|unknown buyer|top up first/i.test(attempt.error || ""));
+    if (!fundable || options.autoTopup === false) {
+      throw new Error(attempt.error || `Balance payment failed with HTTP ${attempt.status}`);
+    }
+    if (options.topupMode === "manual") {
+      const order = await this.createBalanceTopupOrder(serverUrl, {
+        pack: options.topupPack,
+        buyerId,
+        context: { service }
+      });
+      options.onTopupRequired?.(order.pack, order.codeUrl);
+      return {
+        status: "topup_required",
+        out_trade_no: order.outTradeNo,
+        code_url: order.codeUrl,
+        pack: order.pack,
+        server_url: serverUrl
+      };
+    }
+    const credited = await this.topupBalancePack(serverUrl, {
+      pack: options.topupPack,
+      buyerId,
+      pollIntervalMs: options.topupPollIntervalMs,
+      signal: options.signal,
+      onCodeUrl: (pack, codeUrl) => options.onTopupRequired?.(pack, codeUrl)
+    });
+    options.onTopupCredited?.(credited.balance);
+    attempt = await this.balanceDeduct(serverUrl, service, params, options, buyerId);
+    if (attempt.ok) return attempt.result;
+    throw new Error(attempt.error || "Balance payment failed after top-up");
+  }
+  /** One password-free deduct attempt. Never throws on an HTTP error; the
+   *  caller inspects `{ ok, status, error }` to decide whether to auto-fund. */
+  async balanceDeduct(serverUrl, service, params, options, buyerId) {
+    let executeUrl = `${serverUrl}/execute`;
+    try {
+      const services = await this.getServices(serverUrl);
+      const svc = services.services?.find((s) => s.id === service);
+      if (svc?.endpoint) executeUrl = `${serverUrl}${svc.endpoint}`;
+    } catch {
+    }
+    const requestBody = options.rawData ? { service, ...params } : { service, params };
+    const requestId = randomUUID3();
+    const timestamp = Math.floor(Date.now() / 1e3);
+    const signature = await this.balanceSigner().signMessage(
+      buildDeductMessage({ buyerId, requestId, service, timestamp })
+    );
+    const xPayment = Buffer.from(JSON.stringify({
+      x402Version: 2,
+      scheme: BALANCE_RAIL,
+      network: BALANCE_RAIL,
+      payload: { buyer_id: buyerId, request_id: requestId, auth: { timestamp, signature } }
+    })).toString("base64");
+    const res = await fetch(executeUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Payment": xPayment },
+      body: JSON.stringify(requestBody),
+      signal: options.signal
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) return { ok: false, status: res.status, error: data.error, code: data.code };
+    return { ok: true, status: res.status, result: data.result ?? data };
+  }
+  /**
+   * Non-blocking: POST /balance/topup/order, persist a recoverable session, and
+   * return at once (no polling). Use with {@link confirmBalanceTopup} for
+   * turn-based agents; the blocking {@link topupBalancePack} is built on this.
+   */
+  async createBalanceTopupOrder(serverUrl, opts = {}) {
+    const id = this.resolveBuyerId(opts.buyerId);
+    const orderRes = await fetch(`${serverUrl}/balance/topup/order`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      // Carry the spending signer so the server binds it to the account on
+      // confirm (topup-time binding). The same key signs deductions later.
+      body: JSON.stringify({ buyer_id: id, pack: opts.pack, signer_address: this.getBalanceSignerAddress() })
+    });
+    const order = await orderRes.json().catch(() => ({}));
+    if (!orderRes.ok) throw new Error(order.error || `Top-up order failed with HTTP ${orderRes.status}`);
+    const maxTimeoutSeconds = order.max_timeout_seconds ?? 300;
+    const now = Date.now();
+    this.saveBalanceTopupSession({
+      out_trade_no: order.out_trade_no,
+      buyer_id: id,
+      pack: order.pack,
+      server_url: serverUrl,
+      code_url: order.code_url,
+      status: "pending",
+      created_at: new Date(now).toISOString(),
+      expires_at: new Date(now + maxTimeoutSeconds * 1e3).toISOString(),
+      context: opts.context
+    });
+    return { outTradeNo: order.out_trade_no, codeUrl: order.code_url, pack: order.pack, maxTimeoutSeconds };
+  }
+  /**
+   * One-shot: POST /balance/topup/confirm for a single order. No polling.
+   * Updates the persisted session on credit. `serverUrl` defaults to the one
+   * recorded in the session (recover by out_trade_no alone).
+   */
+  async confirmBalanceTopup(outTradeNo, opts = {}) {
+    const session = this.getBalanceTopupSession(outTradeNo);
+    const serverUrl = opts.serverUrl || session?.server_url;
+    if (!serverUrl) {
+      return { credited: false, reason: `No server URL for ${outTradeNo}: pass serverUrl or run topup-order first` };
+    }
+    const confRes = await fetch(`${serverUrl}/balance/topup/confirm`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ out_trade_no: outTradeNo })
+    });
+    const conf = await confRes.json().catch(() => ({}));
+    if (!confRes.ok) return { credited: false, reason: conf.error || `Confirm failed with HTTP ${confRes.status}` };
+    if (conf.credited) {
+      if (session) {
+        session.status = "credited";
+        session.tx_id = conf.tx_id;
+        session.balance = conf.balance;
+        this.saveBalanceTopupSession(session);
+      }
+      return { credited: true, balance: conf.balance, txId: conf.tx_id };
+    }
+    return { credited: false, pending: !!conf.pending, reason: conf.reason };
+  }
+  /**
+   * Blocking terminal wrapper: create the order then poll confirm until the
+   * scan is credited (or the order expires). Built on
+   * {@link createBalanceTopupOrder} + {@link confirmBalanceTopup}.
+   */
+  async topupBalancePack(serverUrl, opts = {}) {
+    const order = await this.createBalanceTopupOrder(serverUrl, { pack: opts.pack, buyerId: opts.buyerId });
+    opts.onCodeUrl?.(order.pack, order.codeUrl);
+    const interval = opts.pollIntervalMs ?? 2e3;
+    const deadline = Date.now() + order.maxTimeoutSeconds * 1e3;
+    while (Date.now() < deadline) {
+      if (opts.signal?.aborted) throw new Error("Top-up aborted");
+      const conf = await this.confirmBalanceTopup(order.outTradeNo, { serverUrl });
+      if (conf.credited) return { balance: conf.balance, outTradeNo: order.outTradeNo, txId: conf.txId };
+      await this.sleep(interval, opts.signal);
+    }
+    throw new Error("Top-up timed out before the payment was confirmed");
+  }
+  // --- Recoverable balance top-up sessions (<configDir>/balance-topup-sessions) ---
+  balanceTopupSessionDir() {
+    return join4(this.configDir, "balance-topup-sessions");
+  }
+  saveBalanceTopupSession(session) {
+    const dir = this.balanceTopupSessionDir();
+    mkdirSync3(dir, { recursive: true });
+    writeFileSync3(join4(dir, `${session.out_trade_no}.json`), JSON.stringify(session, null, 2));
+  }
+  /** Read a persisted top-up session by out_trade_no, or null. */
+  getBalanceTopupSession(outTradeNo) {
+    const p = join4(this.balanceTopupSessionDir(), `${outTradeNo}.json`);
+    if (!existsSync2(p)) return null;
+    try {
+      return JSON.parse(readFileSync3(p, "utf-8"));
+    } catch {
+      return null;
+    }
+  }
+  /** List persisted top-up sessions, newest first. */
+  listBalanceTopupSessions() {
+    const dir = this.balanceTopupSessionDir();
+    if (!existsSync2(dir)) return [];
+    return readdirSync2(dir).filter((f) => f.endsWith(".json")).map((f) => {
+      try {
+        return JSON.parse(readFileSync3(join4(dir, f), "utf-8"));
+      } catch {
+        return null;
+      }
+    }).filter((s) => s !== null).sort((a, b) => (b.created_at || "").localeCompare(a.created_at || ""));
+  }
+  /** Abortable sleep used by the top-up poll loop. */
+  sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) return reject(new Error("aborted"));
+      const t = setTimeout(resolve, ms);
+      signal?.addEventListener("abort", () => {
+        clearTimeout(t);
+        reject(new Error("aborted"));
+      }, { once: true });
+    });
+  }
+  /** Persist the buyer id used by the balance rail (bearer semantics). */
+  setBuyerId(buyerId) {
+    this.config.buyerId = buyerId;
+    this.saveConfig();
+  }
+  /** GET /balance — custodial balance, limits, and today's spend for a buyer. */
+  async getBuyerBalance(serverUrl, buyerId) {
+    const id = this.resolveBuyerId(buyerId);
+    const res = await fetch(`${serverUrl}/balance?buyer_id=${encodeURIComponent(id)}`);
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(data.error || `Balance query failed with HTTP ${res.status}`);
+    return data;
+  }
+  /**
+   * POST /balance/topup — report an externally settled payment (on-chain
+   * tx hash / Alipay trade_no / WeChat out_trade_no) so the server verifies
+   * and credits the ledger. Idempotent per reference.
+   */
+  async topupBalance(serverUrl, opts) {
+    const id = this.resolveBuyerId(opts.buyerId);
+    const res = await fetch(`${serverUrl}/balance/topup`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        buyer_id: id,
+        rail: opts.rail,
+        amount: opts.amount,
+        tx_hash: opts.txHash,
+        chain: opts.chain,
+        trade_no: opts.tradeNo,
+        out_trade_no: opts.outTradeNo
+      })
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(data.error || `Top-up failed with HTTP ${res.status}`);
+    return data;
+  }
+  /** GET /balance/transactions — ledger history for a buyer, newest first. */
+  async listBalanceTransactions(serverUrl, opts = {}) {
+    const id = this.resolveBuyerId(opts.buyerId);
+    const qs = new URLSearchParams({ buyer_id: id });
+    if (opts.limit) qs.set("limit", String(opts.limit));
+    if (opts.offset) qs.set("offset", String(opts.offset));
+    const res = await fetch(`${serverUrl}/balance/transactions?${qs}`);
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(data.error || `Transaction query failed with HTTP ${res.status}`);
+    return data;
+  }
+  /**
+   * Start a recoverable WeChat Pay Native session and return immediately with
+   * QR metadata. The SDK client persists enough context to poll/fulfill later.
+   */
+  async startWechatPayment(serverUrl, service, params, options = {}) {
+    let executeUrl = `${serverUrl}/execute`;
+    try {
+      const services = await this.getServices(serverUrl);
+      const svc = services.services?.find((s) => s.id === service);
+      if (svc?.endpoint) executeUrl = `${serverUrl}${svc.endpoint}`;
+    } catch {
+    }
+    const requestBody = options.rawData ? { service, ...params } : { service, params };
+    const bodyJson = JSON.stringify(requestBody);
+    const res = await fetch(executeUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: bodyJson
+    });
+    if (res.status !== 402) {
+      const data = await res.json().catch(() => ({}));
+      if (res.ok && data.result) return data.result;
+      throw new Error(data.error || `Expected 402, got ${res.status}`);
+    }
+    const header = res.headers.get(PAYMENT_REQUIRED_HEADER);
+    if (!header) throw new Error("Missing x-payment-required header on 402");
+    const parsed = JSON.parse(Buffer.from(header, "base64").toString("utf-8"));
+    const accepts = Array.isArray(parsed) ? parsed : parsed.accepts ?? [parsed];
+    const { requirement } = selectRail({
+      serverAccepts: accepts,
+      explicitRail: WECHAT_RAIL,
+      preference: this.railPreference,
+      availability: { evmReady: this.isInitialized }
+    });
+    const wechat = new WechatClient({ configDir: this.configDir });
+    const session = wechat.start402({
+      resourceUrl: executeUrl,
+      requirement,
+      method: "POST",
+      data: bodyJson,
+      onPaymentPending: options.onPaymentPending ? (info) => options.onPaymentPending({ paymentUrl: info.codeUrl, tradeNo: info.outTradeNo }) : void 0,
+      timeoutMs: options.timeoutMs,
+      signal: options.signal,
+      context: {
+        serverUrl,
+        service,
+        params,
+        rawData: options.rawData ?? false,
+        rail: WECHAT_RAIL
+      }
+    });
+    if (options.autoPoll || options.onWechatPaymentCompleted || options.onWechatPaymentFailed) {
+      void wechat.pollSession(session.paymentSessionId, {
+        timeoutMs: options.timeoutMs,
+        signal: options.signal
+      }).then(async (finalSession) => {
+        if (finalSession.status === "completed") {
+          await options.onWechatPaymentCompleted?.(finalSession);
+        } else {
+          await options.onWechatPaymentFailed?.(finalSession);
+        }
+      }).catch(async (error) => {
+        const failed = await wechat.fulfill(session.paymentSessionId).catch(() => ({
+          ...session,
+          status: "failed",
+          lastError: error instanceof Error ? error.message : String(error)
+        }));
+        await options.onWechatPaymentFailed?.(failed);
+      });
+    }
+    return session;
+  }
+  /** Query a persisted WeChat session once. */
+  async getWechatPaymentStatus(identifier) {
+    return new WechatClient({ configDir: this.configDir }).status(identifier);
+  }
+  /** Idempotently fulfill a paid WeChat session, returning stored or fetched result. */
+  async fulfillWechatPayment(identifier) {
+    return new WechatClient({ configDir: this.configDir }).fulfill(identifier);
+  }
+  /** Mark a local WeChat session as cancelled. */
+  cancelWechatPayment(identifier) {
+    return new WechatClient({ configDir: this.configDir }).cancel(identifier);
+  }
+  /** List persisted WeChat sessions, newest first. */
+  listWechatPaymentSessions() {
+    return new WechatClient({ configDir: this.configDir }).listSessions();
+  }
   /**
    * Handle MPP (Machine Payments Protocol) payment flow
    * Called when pay() detects WWW-Authenticate header in 402 response
@@ -1679,14 +2282,14 @@ Please specify: --chain <chain_name>`
   async handleBNBPayment(executeUrl, service, params, paymentDetails, options = {}) {
     const { to, amount, token, chainName, chain, spender } = paymentDetails;
     const tokenConfig = chain.tokens[token];
-    const provider = new ethers2.JsonRpcProvider(chain.rpc);
+    const provider = new ethers3.JsonRpcProvider(chain.rpc);
     const allowance = await this.checkAllowance(tokenConfig.address, spender, provider);
     const amountWeiCheck = BigInt(Math.floor(amount * 10 ** tokenConfig.decimals));
     if (allowance < amountWeiCheck) {
       const nativeBalance = await provider.getBalance(this.wallet.address);
-      const minGasBalance = ethers2.parseEther("0.0005");
+      const minGasBalance = ethers3.parseEther("0.0005");
       if (nativeBalance < minGasBalance) {
-        const nativeBNB = parseFloat(ethers2.formatEther(nativeBalance)).toFixed(4);
+        const nativeBNB = parseFloat(ethers3.formatEther(nativeBalance)).toFixed(4);
         const isTestnet = chainName === "bnb_testnet";
         if (isTestnet) {
           throw new Error(
@@ -1859,7 +2462,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
    * Check ERC20 allowance for a spender
    */
   async checkAllowance(tokenAddress, spender, provider) {
-    const contract = new ethers2.Contract(
+    const contract = new ethers3.Contract(
       tokenAddress,
       ["function allowance(address owner, address spender) view returns (uint256)"],
       provider
@@ -1878,7 +2481,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
   async signEIP3009(to, amount, chain, token = "USDC", domainOverride) {
     const tokenConfig = chain.tokens[token];
     const value = BigInt(Math.floor(amount * 10 ** tokenConfig.decimals)).toString();
-    const nonce = ethers2.hexlify(ethers2.randomBytes(32));
+    const nonce = ethers3.hexlify(ethers3.randomBytes(32));
     const tokenName = domainOverride?.name || tokenConfig.eip712Name || (token === "USDC" ? "USD Coin" : "Tether USD");
     const tokenVersion = domainOverride?.version || "2";
     const envelope = buildEIP3009TypedData({
@@ -1924,26 +2527,26 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
   }
   // --- Config & Wallet Management ---
   loadConfig() {
-    const configPath = join3(this.configDir, "config.json");
+    const configPath = join4(this.configDir, "config.json");
     if (existsSync2(configPath)) {
-      const content = readFileSync2(configPath, "utf-8");
+      const content = readFileSync3(configPath, "utf-8");
       return { ...DEFAULT_CONFIG, ...JSON.parse(content) };
     }
     return { ...DEFAULT_CONFIG };
   }
   saveConfig() {
-    mkdirSync2(this.configDir, { recursive: true });
-    const configPath = join3(this.configDir, "config.json");
-    writeFileSync2(configPath, JSON.stringify(this.config, null, 2));
+    mkdirSync3(this.configDir, { recursive: true });
+    const configPath = join4(this.configDir, "config.json");
+    writeFileSync3(configPath, JSON.stringify(this.config, null, 2));
   }
   /**
    * Load spending data from disk
    */
   loadSpending() {
-    const spendingPath = join3(this.configDir, "spending.json");
+    const spendingPath = join4(this.configDir, "spending.json");
     if (existsSync2(spendingPath)) {
       try {
-        const data = JSON.parse(readFileSync2(spendingPath, "utf-8"));
+        const data = JSON.parse(readFileSync3(spendingPath, "utf-8"));
         const today = (/* @__PURE__ */ new Date()).setHours(0, 0, 0, 0);
         if (data.date && data.date === today) {
           this.todaySpending = data.amount || 0;
@@ -1962,17 +2565,17 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
    * Save spending data to disk
    */
   saveSpending() {
-    mkdirSync2(this.configDir, { recursive: true });
-    const spendingPath = join3(this.configDir, "spending.json");
+    mkdirSync3(this.configDir, { recursive: true });
+    const spendingPath = join4(this.configDir, "spending.json");
     const data = {
       date: this.lastSpendingReset || (/* @__PURE__ */ new Date()).setHours(0, 0, 0, 0),
       amount: this.todaySpending,
       updatedAt: Date.now()
     };
-    writeFileSync2(spendingPath, JSON.stringify(data, null, 2));
+    writeFileSync3(spendingPath, JSON.stringify(data, null, 2));
   }
   loadWallet() {
-    const walletPath = join3(this.configDir, "wallet.json");
+    const walletPath = join4(this.configDir, "wallet.json");
     if (existsSync2(walletPath)) {
       if (process.platform !== "win32") {
         try {
@@ -1986,7 +2589,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
         } catch {
         }
       }
-      const content = readFileSync2(walletPath, "utf-8");
+      const content = readFileSync3(walletPath, "utf-8");
       return JSON.parse(content);
     }
     return null;
@@ -1995,15 +2598,15 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
    * Initialize a new wallet (called by CLI)
    */
   static init(configDir, options) {
-    mkdirSync2(configDir, { recursive: true });
+    mkdirSync3(configDir, { recursive: true });
     const wallet = Wallet2.createRandom();
     const walletData = {
       address: wallet.address,
       privateKey: wallet.privateKey,
       createdAt: Date.now()
     };
-    const walletPath = join3(configDir, "wallet.json");
-    writeFileSync2(walletPath, JSON.stringify(walletData, null, 2), { mode: 384 });
+    const walletPath = join4(configDir, "wallet.json");
+    writeFileSync3(walletPath, JSON.stringify(walletData, null, 2), { mode: 384 });
     const config = {
       chain: options.chain,
       limits: {
@@ -2011,8 +2614,8 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
         maxPerDay: options.maxPerDay
       }
     };
-    const configPath = join3(configDir, "config.json");
-    writeFileSync2(configPath, JSON.stringify(config, null, 2));
+    const configPath = join4(configDir, "config.json");
+    writeFileSync3(configPath, JSON.stringify(config, null, 2));
     return { address: wallet.address, configDir };
   }
   /**
@@ -2028,17 +2631,17 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
     } catch {
       throw new Error(`Unknown chain: ${this.config.chain}`);
     }
-    const provider = new ethers2.JsonRpcProvider(chain.rpc);
+    const provider = new ethers3.JsonRpcProvider(chain.rpc);
     const tokenAbi = ["function balanceOf(address) view returns (uint256)"];
     const [nativeBalance, usdcBalance, usdtBalance] = await Promise.all([
       provider.getBalance(this.wallet.address),
-      new ethers2.Contract(chain.tokens.USDC.address, tokenAbi, provider).balanceOf(this.wallet.address),
-      new ethers2.Contract(chain.tokens.USDT.address, tokenAbi, provider).balanceOf(this.wallet.address)
+      new ethers3.Contract(chain.tokens.USDC.address, tokenAbi, provider).balanceOf(this.wallet.address),
+      new ethers3.Contract(chain.tokens.USDT.address, tokenAbi, provider).balanceOf(this.wallet.address)
     ]);
     return {
-      usdc: parseFloat(ethers2.formatUnits(usdcBalance, chain.tokens.USDC.decimals)),
-      usdt: parseFloat(ethers2.formatUnits(usdtBalance, chain.tokens.USDT.decimals)),
-      native: parseFloat(ethers2.formatEther(nativeBalance))
+      usdc: parseFloat(ethers3.formatUnits(usdcBalance, chain.tokens.USDC.decimals)),
+      usdt: parseFloat(ethers3.formatUnits(usdtBalance, chain.tokens.USDT.decimals)),
+      native: parseFloat(ethers3.formatEther(nativeBalance))
     };
   }
   /**
@@ -2061,38 +2664,38 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
       supportedChains.map(async (chainName) => {
         try {
           const chain = getChain(chainName);
-          const provider = new ethers2.JsonRpcProvider(chain.rpc);
+          const provider = new ethers3.JsonRpcProvider(chain.rpc);
           if (chainName === "tempo_moderato") {
             const [nativeBalance, pathUSD, alphaUSD, betaUSD, thetaUSD] = await Promise.all([
               provider.getBalance(this.wallet.address),
-              new ethers2.Contract(tempoTokens.pathUSD, tokenAbi, provider).balanceOf(this.wallet.address),
-              new ethers2.Contract(tempoTokens.alphaUSD, tokenAbi, provider).balanceOf(this.wallet.address),
-              new ethers2.Contract(tempoTokens.betaUSD, tokenAbi, provider).balanceOf(this.wallet.address),
-              new ethers2.Contract(tempoTokens.thetaUSD, tokenAbi, provider).balanceOf(this.wallet.address)
+              new ethers3.Contract(tempoTokens.pathUSD, tokenAbi, provider).balanceOf(this.wallet.address),
+              new ethers3.Contract(tempoTokens.alphaUSD, tokenAbi, provider).balanceOf(this.wallet.address),
+              new ethers3.Contract(tempoTokens.betaUSD, tokenAbi, provider).balanceOf(this.wallet.address),
+              new ethers3.Contract(tempoTokens.thetaUSD, tokenAbi, provider).balanceOf(this.wallet.address)
             ]);
             results[chainName] = {
-              usdc: parseFloat(ethers2.formatUnits(pathUSD, 6)),
+              usdc: parseFloat(ethers3.formatUnits(pathUSD, 6)),
               // pathUSD as default USDC
-              usdt: parseFloat(ethers2.formatUnits(alphaUSD, 6)),
+              usdt: parseFloat(ethers3.formatUnits(alphaUSD, 6)),
               // alphaUSD as default USDT
-              native: parseFloat(ethers2.formatEther(nativeBalance)),
+              native: parseFloat(ethers3.formatEther(nativeBalance)),
               tempo: {
-                pathUSD: parseFloat(ethers2.formatUnits(pathUSD, 6)),
-                alphaUSD: parseFloat(ethers2.formatUnits(alphaUSD, 6)),
-                betaUSD: parseFloat(ethers2.formatUnits(betaUSD, 6)),
-                thetaUSD: parseFloat(ethers2.formatUnits(thetaUSD, 6))
+                pathUSD: parseFloat(ethers3.formatUnits(pathUSD, 6)),
+                alphaUSD: parseFloat(ethers3.formatUnits(alphaUSD, 6)),
+                betaUSD: parseFloat(ethers3.formatUnits(betaUSD, 6)),
+                thetaUSD: parseFloat(ethers3.formatUnits(thetaUSD, 6))
               }
             };
           } else {
             const [nativeBalance, usdcBalance, usdtBalance] = await Promise.all([
               provider.getBalance(this.wallet.address),
-              new ethers2.Contract(chain.tokens.USDC.address, tokenAbi, provider).balanceOf(this.wallet.address),
-              new ethers2.Contract(chain.tokens.USDT.address, tokenAbi, provider).balanceOf(this.wallet.address)
+              new ethers3.Contract(chain.tokens.USDC.address, tokenAbi, provider).balanceOf(this.wallet.address),
+              new ethers3.Contract(chain.tokens.USDT.address, tokenAbi, provider).balanceOf(this.wallet.address)
             ]);
             results[chainName] = {
-              usdc: parseFloat(ethers2.formatUnits(usdcBalance, chain.tokens.USDC.decimals)),
-              usdt: parseFloat(ethers2.formatUnits(usdtBalance, chain.tokens.USDT.decimals)),
-              native: parseFloat(ethers2.formatEther(nativeBalance))
+              usdc: parseFloat(ethers3.formatUnits(usdcBalance, chain.tokens.USDC.decimals)),
+              usdt: parseFloat(ethers3.formatUnits(usdtBalance, chain.tokens.USDT.decimals)),
+              native: parseFloat(ethers3.formatEther(nativeBalance))
             };
           }
         } catch (err2) {
@@ -2250,14 +2853,14 @@ function wrap(fn) {
 }
 function getPackageVersion() {
   const candidates = [
-    join4(__dirname, "../../package.json"),
-    join4(__dirname, "../package.json"),
-    join4(process.cwd(), "node_modules/moltspay/package.json")
+    join5(__dirname, "../../package.json"),
+    join5(__dirname, "../package.json"),
+    join5(process.cwd(), "node_modules/moltspay/package.json")
   ];
   for (const loc of candidates) {
     try {
       if (existsSync3(loc)) {
-        const pkg = JSON.parse(readFileSync3(loc, "utf-8"));
+        const pkg = JSON.parse(readFileSync4(loc, "utf-8"));
         if (pkg.name === "moltspay") return pkg.version;
       }
     } catch {