mppx 0.8.18 → 0.9.0

package/dist/cli/sessions/Manager.js

@@ -10,16 +10,14 @@ function assertCloseChallengeScope(challenge, channel) {
     const chainId = challenge.request.methodDetails?.chainId;
     if (chainId !== undefined && chainId !== channel.chainId)
         throw new Error('Close challenge changed the session chain.');
-    if (resolveEscrow(challenge, channel.escrow).toLowerCase() !== channel.escrow.toLowerCase())
-        throw new Error('Close challenge changed the session escrow.');
-    const payee = channel.paymentScope?.payee ?? channel.descriptor.payee;
-    const token = channel.paymentScope?.token ?? channel.descriptor.token;
     if (typeof challenge.request.recipient !== 'string' ||
-        challenge.request.recipient.toLowerCase() !== payee.toLowerCase())
+        challenge.request.recipient.toLowerCase() !== channel.descriptor.payee.toLowerCase())
         throw new Error('Close challenge changed the session payee.');
     if (typeof challenge.request.currency !== 'string' ||
-        challenge.request.currency.toLowerCase() !== token.toLowerCase())
+        challenge.request.currency.toLowerCase() !== channel.descriptor.token.toLowerCase())
         throw new Error('Close challenge changed the session token.');
+    if (resolveEscrow(challenge, channel.escrow).toLowerCase() !== channel.escrow.toLowerCase())
+        throw new Error('Close challenge changed the session escrow.');
     const snapshot = getSessionSnapshot(challenge);
     if (snapshot && snapshot.channelId.toLowerCase() !== channel.channelId.toLowerCase())
         throw new Error('Close challenge changed the session channel.');

package/dist/cli/sessions/commands.d.ts

@@ -31,6 +31,6 @@ declare const sessions: Cli.Cli<{
             yes: boolean;
         };
     };
-}, undefined, undefined, undefined>;
+}, undefined, undefined, undefined, "sessions">;
 export default sessions;
 //# sourceMappingURL=commands.d.ts.map

package/dist/cli/sessions/store.js

@@ -48,10 +48,6 @@ const storedChannelSchema = z.object({
     escrow: z.address(),
     chainId: z.number(),
     opened: z.boolean(),
-    paymentScope: z.optional(z.object({
-        payee: z.address(),
-        token: z.address(),
-    })),
 });
 const accountSchema = z.object({
     name: z.optional(z.string()),
@@ -118,8 +114,8 @@ export function sessionScopeKey(scope) {
 export function sessionScope(channel) {
     return {
         payer: channel.descriptor.payer,
-        payee: channel.paymentScope?.payee ?? channel.descriptor.payee,
-        token: channel.paymentScope?.token ?? channel.descriptor.token,
+        payee: channel.descriptor.payee,
+        token: channel.descriptor.token,
         escrow: channel.escrow,
         chainId: channel.chainId,
     };
@@ -185,9 +181,9 @@ export function createSessionRegistry(options = {}) {
         const file = channelFile(paths, normalizedId);
         const previousValue = await readJson(file);
         const previous = previousValue === undefined ? undefined : parseStoredSession(previousValue, file);
-        const challenge = parseSessionChallenge(input.challenge, file);
         if (previous)
             assertSameSession(previous, input, file);
+        const challenge = parseSessionChallenge(input.challenge, file);
         assertChallengeMatchesChannel(challenge, channel, file);
         const receipt = input.receipt
             ? sanitizeReceipt(input.receipt, channel.channelId, file)
@@ -536,12 +532,6 @@ function channelIdentity(channel) {
         ])),
         escrow: channel.escrow.toLowerCase(),
         chainId: channel.chainId,
-        paymentScope: channel.paymentScope
-            ? {
-                payee: channel.paymentScope.payee.toLowerCase(),
-                token: channel.paymentScope.token.toLowerCase(),
-            }
-            : undefined,
     };
 }
 function assertChallengeMatchesChannel(challenge, channel, file) {
@@ -554,7 +544,10 @@ function assertChallengeMatchesChannel(challenge, channel, file) {
         throw stateError(file, 'Session channel ID does not match its descriptor.');
     const payee = normalizeAddress(challenge.request.recipient, 'challenge recipient', file);
     const token = normalizeAddress(challenge.request.currency, 'challenge currency', file);
-    const scope = normalizeScope(sessionScope(channel));
+    if (payee !== channel.descriptor.payee.toLowerCase())
+        throw stateError(file, 'Session challenge payee does not match the channel.');
+    if (token !== channel.descriptor.token.toLowerCase())
+        throw stateError(file, 'Session challenge token does not match the channel.');
     if (resolveEscrow(challenge, channel.escrow).toLowerCase() !== channel.escrow.toLowerCase())
         throw stateError(file, 'Session challenge escrow does not match the channel.');
     if (isObject(challenge.request.methodDetails)) {
@@ -562,13 +555,14 @@ function assertChallengeMatchesChannel(challenge, channel, file) {
         if (methodDetails.chainId !== undefined && methodDetails.chainId !== channel.chainId)
             throw stateError(file, 'Session challenge chain does not match the channel.');
     }
-    if (payee !== scope.payee)
-        throw stateError(file, 'Session challenge payee does not match the channel.');
-    if (token !== scope.token)
-        throw stateError(file, 'Session challenge token does not match the channel.');
 }
 function assertChannelScope(channel, scope, file) {
-    if (sessionScopeKey(sessionScope(channel)) !== sessionScopeKey(scope))
+    const normalized = normalizeScope(scope);
+    if (channel.descriptor.payer.toLowerCase() !== normalized.payer ||
+        channel.descriptor.payee.toLowerCase() !== normalized.payee ||
+        channel.descriptor.token.toLowerCase() !== normalized.token ||
+        channel.escrow.toLowerCase() !== normalized.escrow ||
+        channel.chainId !== normalized.chainId)
         throw stateError(file, 'Session channel does not match the selected payment scope.');
 }
 function selectLatestReceipt(previous, next) {

package/dist/cli/validate/index.d.ts

@@ -1,6 +1,6 @@
 import { Cli } from 'incur';
 declare const validate: Cli.Cli<{
-    [x: string]: {
+    validate: {
         args: {
             url: string;
         };
@@ -14,6 +14,6 @@ declare const validate: Cli.Cli<{
             outputJson: boolean;
         };
     };
-}, undefined, undefined, undefined>;
+}, undefined, undefined, undefined, "validate">;
 export default validate;
 //# sourceMappingURL=index.d.ts.map

package/dist/client/Mppx.d.ts

@@ -7,6 +7,23 @@ import * as Fetch from './internal/Fetch.js';
 import * as Transport from './Transport.js';
 export type Methods = readonly (Method.AnyClient | readonly Method.AnyClient[])[];
 type EventResponseOf<transport extends Transport.AnyTransport> = Response | Transport.ResponseOf<transport>;
+/**
+ * A selected payment that can be inspected before its credential is created.
+ *
+ * Prepared payments retain transport-local protocol state and are not serializable.
+ */
+export type PreparedPayment<methods extends readonly Method.AnyClient[] = readonly Method.AnyClient[], transport extends Transport.AnyTransport = Transport.Transport> = Readonly<{
+    /** The selected payment challenge. */
+    challenge: Challenge.Challenge;
+    /** All supported payment challenges extracted from the response. */
+    challenges: readonly Challenge.Challenge[];
+    /** Creates the selected challenge's credential at most once. */
+    createCredential: (context?: AnyContextFor<methods> | undefined) => Promise<string>;
+    /** The configured client method selected for the challenge. */
+    method: methods[number];
+    /** Attaches a credential using the protocol that produced the selected challenge. */
+    setCredential: (request: Transport.RequestOf<transport>, credential: string) => Transport.RequestOf<transport>;
+}>;
 /**
  * Client-side payment handler.
  */
@@ -19,8 +36,22 @@ export type Mppx<methods extends Methods = Methods, transport extends Transport.
     methods: FlattenMethods<methods>;
     /** The transport used. */
     transport: transport;
+    /**
+     * Selects a payment challenge without creating its credential.
+     *
+     * @example
+     * ```ts
+     * const request = { method: 'POST' }
+     * const response = await mppx.rawFetch('/resource', request)
+     * const payment = await mppx.preparePayment(response, { request })
+     * inspect(payment.challenge)
+     * const credential = await payment.createCredential()
+     * const init = payment.setCredential(request, credential)
+     * ```
+     */
+    preparePayment: (response: Transport.ResponseOf<transport>, options?: preparePayment.Options<FlattenMethods<methods>, transport> | undefined) => Promise<PreparedPayment<FlattenMethods<methods>, transport>>;
     /** Creates a credential from a payment-required response by routing to the correct method. */
-    createCredential: (response: Transport.ResponseOf<transport>, context?: AnyContextFor<FlattenMethods<methods>> | undefined, options?: createCredential.Options<FlattenMethods<methods>> | undefined) => Promise<string>;
+    createCredential: (response: Transport.ResponseOf<transport>, context?: AnyContextFor<FlattenMethods<methods>> | undefined, options?: createCredential.Options<FlattenMethods<methods>, transport> | undefined) => Promise<string>;
     /** Register a client event handler by canonical event name. */
     on<name extends Fetch.ClientEventName<FlattenMethods<methods>, EventResponseOf<transport>>>(name: name, handler: Fetch.ClientEventHandler<FlattenMethods<methods>, name, EventResponseOf<transport>>): Fetch.Unsubscribe;
     /** Register a handler for received payment challenges. */
@@ -54,12 +85,18 @@ export type Mppx<methods extends Methods = Methods, transport extends Transport.
  * ```
  */
 export declare function create<const methods extends Methods, const transport extends Transport.Transport<any, any> = Transport.Transport<RequestInit, Response>>(config: create.Config<methods, transport>): Mppx<methods, transport>;
+export declare namespace preparePayment {
+    /** Options for selecting a payment without creating its credential. */
+    type Options<methods extends readonly Method.AnyClient[] = readonly Method.AnyClient[], transport extends Transport.AnyTransport = Transport.Transport> = createCredential.Options<methods, transport>;
+}
 export declare namespace createCredential {
-    type Options<methods extends readonly Method.AnyClient[] = readonly Method.AnyClient[]> = {
+    type Options<methods extends readonly Method.AnyClient[] = readonly Method.AnyClient[], transport extends Transport.AnyTransport = Transport.Transport> = {
         /** Request-local Accept-Payment override for manual rawFetch + createCredential flows. */
         acceptPayment?: string | readonly AcceptPayment.Entry[] | undefined;
         /** Request-local challenge filtering and sorting. */
         orderChallenges?: AcceptPayment.OrderChallenges<methods> | undefined;
+        /** Request that produced the response, when challenge extraction depends on both values. */
+        request?: Transport.RequestOf<transport> | undefined;
     };
 }
 /**

package/dist/client/Mppx.js

@@ -62,6 +62,83 @@ export function create(config) {
     function onPaymentResponse(handler) {
         return events.on('payment.response', handler);
     }
+    async function preparePayment(response, options) {
+        const eventResponse = snapshotResponse(response);
+        const challenges = await transport.getChallenges(response, options?.request);
+        const challengeSnapshots = Object.freeze(challenges.map((candidate) => snapshotValue(candidate)));
+        const preferences = resolveChallengePreferences(acceptPayment.entries, options?.acceptPayment);
+        let challenge;
+        let mi;
+        try {
+            const candidates = AcceptPayment.selectChallengeCandidates(challenges, methods, preferences);
+            const orderedCandidates = await resolveChallengeOrder(candidates, options?.orderChallenges ?? orderChallenges);
+            const selected = orderedCandidates[0];
+            if (!selected)
+                throw new Error(`No method found for challenges: ${challenges.map((challenge) => `${challenge.method}.${challenge.intent}`).join(', ')}. Available: ${methods.map((m) => `${m.name}.${m.intent}`).join(', ')}`);
+            // Signing must use what the caller inspects, while attachment needs the adapter's original
+            // object identity to retain protocol provenance.
+            const transportChallenge = selected.challenge;
+            challenge = challengeSnapshots[selected.index];
+            mi = selected.method;
+            if (challenge.expires)
+                Expires.assert(challenge.expires, challenge.id);
+            const selectedChallenge = challenge;
+            const selectedMethod = mi;
+            const createPreparedCredential = memoizeCreateCredential(async (context) => {
+                try {
+                    if (selectedChallenge.expires)
+                        Expires.assert(selectedChallenge.expires, selectedChallenge.id);
+                    const createCredential = memoizeCreateCredential((overrideContext) => createCredentialForMethod(selectedChallenge, selectedMethod, overrideContext ?? context));
+                    const eventCredential = await events.emit('challenge.received', createChallengeReceivedPayload({
+                        challenge: selectedChallenge,
+                        challenges,
+                        createCredential,
+                        method: selectedMethod,
+                        response: eventResponse,
+                    }));
+                    const credential = eventCredential ?? (await createCredential());
+                    Fetch.validateCredentialHeaderValue(credential);
+                    await events.emit('credential.created', createCredentialCreatedPayload({
+                        challenge: selectedChallenge,
+                        credential,
+                        method: selectedMethod,
+                        response: eventResponse,
+                    }));
+                    return credential;
+                }
+                catch (error) {
+                    await events.emit('payment.failed', createPaymentFailedPayload({
+                        challenge: selectedChallenge,
+                        challenges,
+                        error,
+                        method: selectedMethod,
+                        response: eventResponse,
+                    }));
+                    throw error;
+                }
+            });
+            return Object.freeze({
+                challenge: selectedChallenge,
+                challenges: challengeSnapshots,
+                createCredential: createPreparedCredential,
+                method: snapshotMethod(selectedMethod),
+                setCredential(request, credential) {
+                    Fetch.validateCredentialHeaderValue(credential);
+                    return transport.setCredential(request, credential, { challenge: transportChallenge });
+                },
+            });
+        }
+        catch (error) {
+            await events.emit('payment.failed', createPaymentFailedPayload({
+                challenge,
+                challenges,
+                error,
+                method: mi,
+                response: eventResponse,
+            }));
+            throw error;
+        }
+    }
     return {
         fetch,
         rawFetch,
@@ -72,50 +149,10 @@ export function create(config) {
         onCredentialCreated,
         onPaymentFailed,
         onPaymentResponse,
+        preparePayment,
         async createCredential(response, context, options) {
-            const challenges = await transport.getChallenges(response);
-            const preferences = resolveChallengePreferences(acceptPayment.entries, options?.acceptPayment);
-            let challenge;
-            let mi;
-            try {
-                const candidates = AcceptPayment.selectChallengeCandidates(challenges, methods, preferences);
-                const orderedCandidates = await resolveChallengeOrder(candidates, options?.orderChallenges ?? orderChallenges);
-                const selected = orderedCandidates[0];
-                if (!selected)
-                    throw new Error(`No method found for challenges: ${challenges.map((challenge) => `${challenge.method}.${challenge.intent}`).join(', ')}. Available: ${methods.map((m) => `${m.name}.${m.intent}`).join(', ')}`);
-                const selectedChallenge = selected.challenge;
-                challenge = selectedChallenge;
-                mi = selected.method;
-                if (challenge.expires)
-                    Expires.assert(challenge.expires, challenge.id);
-                const createCredential = memoizeCreateCredential((overrideContext) => createCredentialForMethod(selectedChallenge, mi, overrideContext ?? context));
-                const eventCredential = await events.emit('challenge.received', createChallengeReceivedPayload({
-                    challenge: selectedChallenge,
-                    challenges,
-                    createCredential,
-                    method: mi,
-                    response,
-                }));
-                const credential = eventCredential ?? (await createCredential());
-                Fetch.validateCredentialHeaderValue(credential);
-                await events.emit('credential.created', createCredentialCreatedPayload({
-                    challenge: selectedChallenge,
-                    credential,
-                    method: mi,
-                    response,
-                }));
-                return credential;
-            }
-            catch (error) {
-                await events.emit('payment.failed', createPaymentFailedPayload({
-                    challenge,
-                    challenges,
-                    error,
-                    method: mi,
-                    response,
-                }));
-                throw error;
-            }
+            const prepared = await preparePayment(response, options);
+            return prepared.createCredential(context);
         },
     };
 }
@@ -181,13 +218,32 @@ function snapshotMethod(method) {
     return freezeSnapshot(Object.assign({}, method));
 }
 function snapshotResponse(response) {
-    if (response instanceof Response)
-        return response.clone();
+    if (response instanceof Response) {
+        try {
+            return response.clone();
+        }
+        catch {
+            // A consumed body cannot be cloned, but status and headers are sufficient for event context.
+            return new Response(null, {
+                headers: response.headers,
+                status: response.status,
+                statusText: response.statusText,
+            });
+        }
+    }
     return snapshotValue(response);
 }
 function snapshotValue(value) {
     try {
-        return deepFreeze(structuredClone(value));
+        const snapshot = structuredClone(value);
+        // Protocol adapters may attach non-enumerable symbol metadata to otherwise plain challenges.
+        if (value && snapshot && typeof value === 'object' && typeof snapshot === 'object')
+            for (const symbol of Object.getOwnPropertySymbols(value)) {
+                const descriptor = Object.getOwnPropertyDescriptor(value, symbol);
+                if (descriptor)
+                    Object.defineProperty(snapshot, symbol, descriptor);
+            }
+        return deepFreeze(snapshot);
     }
     catch {
         return freezeSnapshot(value);

package/dist/client/Transport.js

@@ -64,7 +64,7 @@ export function http() {
             const fallback = protocols[0];
             if (!protocol && !fallback)
                 throw new Error('No protocol to attach the credential.');
-            return (protocol ?? fallback).setCredential(request, credential);
+            return (protocol ?? fallback).setCredential(request, credential, options);
         },
     });
 }

package/dist/client/internal/protocols/Mpp.d.ts

@@ -1,4 +1,4 @@
 import type { Protocol } from './Protocol.js';
-/** MPP — the native HTTP scheme: a 402 carrying a `WWW-Authenticate` challenge, paid back in `Authorization`. */
+/** MPP — native HTTP Payment authentication. */
 export declare function mpp(): Protocol;
 //# sourceMappingURL=Mpp.d.ts.map

package/dist/client/internal/protocols/Mpp.js

@@ -1,7 +1,7 @@
 import * as Challenge from '../../../Challenge.js';
 import * as Constants from '../../../Constants.js';
 import { paymentRequiredStatus, setCredentialHeader } from './Shared.js';
-/** MPP — the native HTTP scheme: a 402 carrying a `WWW-Authenticate` challenge, paid back in `Authorization`. */
+/** MPP — native HTTP Payment authentication. */
 export function mpp() {
     return {
         getChallenges(response) {
@@ -10,8 +10,10 @@ export function mpp() {
                 return [];
             return Challenge.fromResponseList(response);
         },
-        setCredential(request, credential) {
-            return setCredentialHeader(request, Constants.Headers.authorization, credential);
+        setCredential(request, credential, options) {
+            return setCredentialHeader(request, options?.challenge
+                ? Challenge.credentialHeader(options.challenge)
+                : Constants.Headers.authorization, credential);
         },
     };
 }

package/dist/client/internal/protocols/Protocol.d.ts

@@ -5,6 +5,8 @@ export type Protocol = {
     /** This protocol's challenges from a response; `[]` when the response isn't its concern. */
     getChallenges: (response: Response, request?: RequestInit) => MaybePromise<Challenge.Challenge[]>;
     /** Attaches this protocol's credential to a retry request. */
-    setCredential: (request: RequestInit, credential: string) => RequestInit;
+    setCredential: (request: RequestInit, credential: string, options?: {
+        challenge?: Challenge.Challenge | undefined;
+    }) => RequestInit;
 };
 //# sourceMappingURL=Protocol.d.ts.map

package/dist/client/internal/protocols/Shared.js

@@ -12,8 +12,12 @@ const credentialHeaders = [
 /** Attaches `credential` under `header`, clearing any stale credential headers first. */
 export function setCredentialHeader(request, header, credential) {
     const headers = new Headers(request.headers);
-    for (const stale of credentialHeaders)
+    for (const stale of credentialHeaders) {
+        // Never erase ordinary application credentials from Authorization.
+        if (stale === Constants.Headers.authorization && !headers.get(stale)?.startsWith('Payment '))
+            continue;
         headers.delete(stale);
+    }
     headers.set(header, credential);
     return { ...request, headers };
 }

package/dist/integrations/x402/Evm.d.ts

@@ -0,0 +1,29 @@
+import type { HTTPRequestContext, x402ResourceServer } from '@x402/core/server';
+import type { PaymentRequired, PaymentRequirements } from '@x402/core/types';
+/** Configuration shared by the x402 compatibility integrations. */
+export type Config = {
+    /** Realm used in MPP challenges. Defaults using the normal mppx realm resolution. */
+    realm?: string | undefined;
+    /** Secret used to bind MPP challenge IDs to their contents. Must contain at least 32 bytes. */
+    secretKey: string;
+    /** Existing x402 resource server used for requirement metadata, verification, and settlement. */
+    server: x402ResourceServer;
+};
+/** Creates a native MPP handler backed by a compatible x402 EVM requirement. */
+export declare function createHandler(parameters: {
+    config: Config;
+    context: HTTPRequestContext;
+    paymentRequired: PaymentRequired;
+}): ((request: Request) => Promise<{
+    payment: {
+        challenge: Response;
+        status: 402;
+    } | {
+        status: 200;
+        withReceipt: import("../../server/Transport.js").WithReceipt<import("../../server/Transport.js").Http>;
+    };
+    skipHandlerResponse: Response | undefined;
+}>) | undefined;
+/** Selects an extension-free EIP-3009 requirement that can be represented without semantic loss. */
+export declare function selectRequirement(paymentRequired: PaymentRequired, server: x402ResourceServer): PaymentRequirements | undefined;
+//# sourceMappingURL=Evm.d.ts.map

package/dist/integrations/x402/Evm.js

@@ -0,0 +1,150 @@
+import { formatUnits, getAddress, isAddress } from 'viem';
+import { VerificationFailedError } from '../../Errors.js';
+import { evm } from '../../evm/server/Methods.js';
+import { eip3009 } from '../../evm/Types.js';
+import * as Expires from '../../Expires.js';
+import * as Mppx from '../../server/Mppx.js';
+import { tempo } from '../../tempo/server/Methods.js';
+import * as Types from '../../x402/Types.js';
+/** Creates a native MPP handler backed by a compatible x402 EVM requirement. */
+export function createHandler(parameters) {
+    const requirement = selectRequirement(parameters.paymentRequired, parameters.config.server);
+    if (!requirement)
+        return undefined;
+    const chainId = parseChainId(requirement.network);
+    if (chainId === undefined)
+        return undefined;
+    let skipHandlerResponse;
+    const decimals = parameters.config.server.getAssetDecimalsForRequirements(requirement);
+    const evmMethod = evm.charge({
+        authorization: {
+            name: requirement.extra.name,
+            version: requirement.extra.version,
+        },
+        chainId,
+        currency: normalizeAddress(requirement.asset),
+        decimals,
+        recipient: normalizeAddress(requirement.payTo),
+        settle: async ({ payload }) => {
+            const result = await settle({
+                context: parameters.context,
+                payload,
+                paymentRequired: parameters.paymentRequired,
+                requirement,
+                server: parameters.config.server,
+            });
+            skipHandlerResponse = result.skipHandlerResponse;
+            return { reference: result.reference };
+        },
+    });
+    const payment = Mppx.create({
+        methods: [tempo.charge({ recipient: normalizeAddress(requirement.payTo) }), evmMethod],
+        ...(parameters.config.realm ? { realm: parameters.config.realm } : {}),
+        secretKey: parameters.config.secretKey,
+    });
+    const options = {
+        amount: formatUnits(BigInt(requirement.amount), decimals),
+        ...(parameters.paymentRequired.resource.description
+            ? { description: parameters.paymentRequired.resource.description }
+            : {}),
+        expires: Expires.seconds(requirement.maxTimeoutSeconds),
+        scope: parameters.paymentRequired.resource.url,
+    };
+    const handler = payment.compose([payment.tempo.charge, options], [payment.evm.charge, options]);
+    return async (request) => ({
+        payment: await handler(request),
+        skipHandlerResponse,
+    });
+}
+/** Selects an extension-free EIP-3009 requirement that can be represented without semantic loss. */
+export function selectRequirement(paymentRequired, server) {
+    if (paymentRequired.extensions && Object.keys(paymentRequired.extensions).length > 0)
+        return undefined;
+    return paymentRequired.accepts.find((requirement) => {
+        if (requirement.scheme !== 'exact')
+            return false;
+        if (parseChainId(requirement.network) === undefined)
+            return false;
+        const assetTransferMethod = requirement.extra?.assetTransferMethod ??
+            server.getRegisteredScheme(requirement.network, requirement.scheme)
+                ?.defaultAssetTransferMethod;
+        if (assetTransferMethod !== eip3009)
+            return false;
+        if (!isAddress(requirement.asset, { strict: false }))
+            return false;
+        if (!isAddress(requirement.payTo, { strict: false }))
+            return false;
+        return (typeof requirement.extra?.name === 'string' &&
+            typeof requirement.extra?.version === 'string' &&
+            /^\d+$/.test(requirement.amount));
+    });
+}
+function normalizeAddress(address) {
+    return getAddress(address.toLowerCase());
+}
+/** Verifies and settles an MPP authorization through the official x402 resource server. */
+async function settle(parameters) {
+    const paymentPayload = toPaymentPayload(parameters);
+    const transportContext = { request: parameters.context };
+    const verified = await parameters.server.verifyPayment(paymentPayload, parameters.requirement, parameters.paymentRequired.extensions, transportContext);
+    if (!verified.isValid)
+        throw new VerificationFailedError({
+            reason: verified.invalidMessage ?? verified.invalidReason ?? 'x402 verification failed',
+        });
+    const settled = await parameters.server.settlePayment(paymentPayload, parameters.requirement, parameters.paymentRequired.extensions, transportContext);
+    if (!settled.success)
+        throw new VerificationFailedError({
+            reason: settled.errorMessage ?? settled.errorReason ?? 'x402 settlement failed',
+        });
+    return {
+        reference: settled.transaction,
+        ...(verified.skipHandler
+            ? { skipHandlerResponse: responseFromSkipHandler(verified.skipHandler) }
+            : {}),
+    };
+}
+/** Converts an MPP EIP-3009 authorization to the x402 facilitator payload shape. */
+function toPaymentPayload(parameters) {
+    return {
+        accepted: parameters.requirement,
+        payload: {
+            authorization: {
+                from: parameters.payload.from,
+                nonce: parameters.payload.nonce,
+                to: parameters.payload.to,
+                validAfter: parameters.payload.validAfter,
+                validBefore: parameters.payload.validBefore,
+                value: parameters.payload.value,
+            },
+            signature: parameters.payload.signature,
+        },
+        resource: parameters.paymentRequired.resource,
+        x402Version: 2,
+    };
+}
+function responseFromSkipHandler(directive) {
+    const contentType = directive.contentType ?? 'application/json';
+    const value = directive.body ?? {};
+    const body = contentType.toLowerCase().includes('json')
+        ? JSON.stringify(value)
+        : value;
+    return new Response(body, {
+        headers: {
+            'Cache-Control': 'private, no-store',
+            'Content-Type': contentType,
+        },
+        status: 200,
+    });
+}
+function parseChainId(network) {
+    if (!network.startsWith(Types.evmNetworkPrefix))
+        return undefined;
+    const reference = network.slice(Types.evmNetworkPrefix.length);
+    if (!/^\d+$/.test(reference))
+        return undefined;
+    const chainId = Number(reference);
+    if (!Number.isSafeInteger(chainId) || chainId <= 0)
+        return undefined;
+    return chainId;
+}
+//# sourceMappingURL=Evm.js.map

package/dist/integrations/x402/Negotiator.d.ts

@@ -0,0 +1,36 @@
+import type { HTTPRequestContext, PaywallConfig, RoutesConfig } from '@x402/core/server';
+import { x402HTTPResourceServer } from '@x402/core/server';
+import * as Evm from './Evm.js';
+/** Configuration for MPP negotiation over an existing x402 route table. */
+export type Config = Evm.Config & {
+    /** Optional x402 paywall configuration used while resolving payment requirements. */
+    paywallConfig?: PaywallConfig | undefined;
+    /** Existing x402 route configuration. */
+    routes: RoutesConfig;
+};
+/** Decision produced before an official x402 framework adapter runs. */
+export type Result = {
+    status: 'handled';
+    response: Response;
+} | {
+    status: 'paid';
+    withReceipt(response: Response): Response;
+} | {
+    status: 'unprotected';
+} | {
+    status: 'x402';
+};
+/** Shared negotiator used by the x402 compatibility integrations. */
+export type Negotiator = {
+    /** x402 HTTP server passed through to official framework adapters. */
+    httpServer: x402HTTPResourceServer;
+    /** Selects MPP, x402, or an immediate response for a request. */
+    negotiate(request: Request, context: HTTPRequestContext): Promise<Result>;
+};
+/** Creates the native MPP side of an x402 compatibility integration. */
+export declare function create(config: Config): Negotiator;
+/** Reads a current or legacy x402 payment credential. */
+export declare function getX402Credential(request: Request): string | undefined;
+/** Converts a Fetch request to the context consumed by x402 core. */
+export declare function createContext(request: Request, body?: unknown): HTTPRequestContext;
+//# sourceMappingURL=Negotiator.d.ts.map