powertools-x402 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Allen Helton
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,185 @@
+# powertools-x402
+
+Paid API routes for [AWS Lambda Powertools Event Handler](https://docs.powertools.aws.dev/lambda/typescript/latest/features/event-handler/api-gateway/) using the [x402 payment protocol](https://x402.org).
+
+## Install
+
+```bash
+npm install powertools-x402
+```
+
+Requires Node 18+. `@aws-lambda-powertools/event-handler` is a peer dependency, so npm will grab it automatically if your app doesn't already have it.
+
+## What it does
+
+`x402.paid()` is route middleware that turns any route into a paid endpoint. The route owns the price. Your handler stays pure business logic.
+
+- No payment attached? The caller gets a 402 with signed payment requirements
+- Payment attached? It gets verified with a facilitator before your handler runs
+- Settlement happens after your handler succeeds. If it throws or returns an error status, the caller is never charged
+- Verified payment details (payer, amount, network) are available in the request store
+
+## Usage
+
+### Charge for a route
+
+```ts
+import { Router } from '@aws-lambda-powertools/event-handler/http';
+import type { Context } from 'aws-lambda';
+import { createX402, type X402Environment } from 'powertools-x402';
+
+const app = new Router<X402Environment>();
+
+const x402 = createX402({
+  facilitator: 'https://x402.org/facilitator',
+  network: 'eip155:84532', // Base Sepolia
+  payTo: process.env.PAY_TO!,
+});
+
+app.get('/health', async () => ({ status: 'ok' }));
+
+app.post(
+  '/summarize',
+  [x402.paid({ price: '$0.01', description: 'Summarize some text' })],
+  async (reqCtx) => {
+    const { text } = (await reqCtx.req.json()) as { text: string };
+    return { summary: text.slice(0, 80) };
+  }
+);
+
+export const handler = (event: unknown, context: Context) => app.resolve(event, context);
+```
+
+### Read payment details in the handler
+
+```ts
+app.post('/generate', [x402.paid({ price: '$0.05' })], async (reqCtx) => {
+  const payment = reqCtx.get('payment');
+  // { network: 'eip155:84532', scheme: 'exact', asset: '0x...', amount: '50000', payer: '0x...' }
+  return { result: 'expensive thing', paidBy: payment?.payer };
+});
+```
+
+### Emit CloudWatch metrics
+
+```ts
+const x402 = createX402({
+  facilitator: 'https://x402.org/facilitator',
+  network: 'eip155:84532',
+  payTo: process.env.PAY_TO!,
+  enableMetrics: true, // defaults to false
+  logger: new Logger(), // optional, any Powertools Logger works
+});
+```
+
+This emits `PaymentRequired`, `PaymentRejected`, `PaymentVerified`, `PaymentSettled`, `PaymentCancelled`, and `SettlementFailed` counts under the `x402` namespace. Metrics publish immediately, so there's no `publishStoredMetrics()` call to remember. Pass your own `metrics` instance if you want a different namespace.
+
+### Use an authenticated facilitator
+
+```ts
+const x402 = createX402({
+  facilitator: {
+    url: 'https://facilitator.example.com',
+    createAuthHeaders: async () => {
+      const headers = { Authorization: `Bearer ${token}` };
+      return { verify: headers, settle: headers, supported: headers };
+    },
+  },
+  network: 'eip155:8453', // Base mainnet
+  payTo: process.env.PAY_TO!,
+});
+```
+
+### Accept multiple payment options on one route
+
+```ts
+x402.paid({
+  accepts: [
+    { scheme: 'exact', network: 'eip155:8453', payTo: evmAddress, price: '$0.05' },
+    { scheme: 'exact', network: 'eip155:84532', payTo: evmAddress, price: '$0.01' },
+  ],
+});
+```
+
+Want to take payments on non-EVM networks? Register additional schemes with the `schemes` option on `createX402`.
+
+### Let some callers through free
+
+```ts
+x402.paid({
+  price: '$0.01',
+  onProtectedRequest: async (ctx) => {
+    if (ctx.adapter.getHeader('x-api-key') === trustedKey) return { grantAccess: true };
+  },
+});
+```
+
+### Customize the 402 response
+
+```ts
+x402.paid({
+  price: '$0.01',
+  resource: 'https://api.example.com/summarize', // canonical URL behind custom domains
+  unpaidResponseBody: async () => ({
+    contentType: 'application/json',
+    body: { preview: 'The first 10 words are free...' },
+  }),
+});
+```
+
+### Test your routes without a network
+
+The `facilitator` option takes any object with `verify`, `settle`, and `getSupported`, so your tests never touch the network:
+
+```ts
+const facilitator = {
+  getSupported: async () => ({
+    kinds: [{ x402Version: 2, scheme: 'exact', network: 'eip155:84532' }],
+    extensions: [],
+    signers: {},
+  }),
+  verify: async () => ({ isValid: true, payer: '0xPayer' }),
+  settle: async () => ({ success: true, transaction: '0xTx', network: 'eip155:84532' }),
+};
+
+const x402 = createX402({ facilitator, network: 'eip155:84532', payTo: '0xYou' });
+```
+
+Drive your router with API Gateway events through `app.resolve(event, context)`. Check out [test/middleware.test.ts](test/middleware.test.ts) for full round trips, including client-side payment signing.
+
+### Pay for a request (client side)
+
+In the paying app, install `@x402/core`, `@x402/evm`, and `viem`:
+
+```ts
+import { x402Client, x402HTTPClient } from '@x402/core/client';
+import { registerExactEvmScheme } from '@x402/evm/exact/client';
+import { privateKeyToAccount } from 'viem/accounts';
+
+const client = new x402HTTPClient(
+  registerExactEvmScheme(new x402Client(), { signer: privateKeyToAccount(privateKey) })
+);
+
+// 1. Call without payment -> 402 with a PAYMENT-REQUIRED header
+const challenge = await fetch(url, { method: 'POST', body });
+
+// 2. Sign a payment for one of the offered options
+const paymentRequired = client.getPaymentRequiredResponse((name) => challenge.headers.get(name));
+const payment = await client.createPaymentPayload(paymentRequired);
+
+// 3. Retry with the PAYMENT-SIGNATURE header -> 200 + settlement receipt
+const paid = await fetch(url, { method: 'POST', headers: client.encodePaymentSignatureHeader(payment), body });
+const receipt = client.getPaymentSettleResponse((name) => paid.headers.get(name));
+```
+
+Need testnet USDC? Grab some from the [Circle faucet](https://faucet.circle.com/).
+
+## Examples
+
+- [example/handler.ts](example/handler.ts) - lambdalith with free and paid routes
+- [example/client.ts](example/client.ts) - paying client, step by step
+- [example/template.yaml](example/template.yaml) - SAM deploy (esbuild, ESM, HTTP API)
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,233 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CachingFacilitatorClient: () => CachingFacilitatorClient,
+  PowertoolsAdapter: () => PowertoolsAdapter,
+  createX402: () => createX402
+});
+module.exports = __toCommonJS(index_exports);
+var import_metrics = require("@aws-lambda-powertools/metrics");
+var import_server = require("@x402/core/server");
+var import_server2 = require("@x402/evm/exact/server");
+
+// src/adapter.ts
+var PowertoolsAdapter = class {
+  constructor(request) {
+    this.request = request;
+  }
+  request;
+  getHeader(name) {
+    return this.request.headers.get(name) ?? void 0;
+  }
+  getMethod() {
+    return this.request.method;
+  }
+  getPath() {
+    return new URL(this.request.url).pathname;
+  }
+  getUrl() {
+    return this.request.url;
+  }
+  getAcceptHeader() {
+    return this.request.headers.get("accept") ?? "";
+  }
+  getUserAgent() {
+    return this.request.headers.get("user-agent") ?? "";
+  }
+  getQueryParams() {
+    const params = new URL(this.request.url).searchParams;
+    const result = {};
+    for (const key of new Set(params.keys())) {
+      const values = params.getAll(key);
+      result[key] = values.length === 1 ? values[0] : values;
+    }
+    return result;
+  }
+  getQueryParam(name) {
+    const values = new URL(this.request.url).searchParams.getAll(name);
+    if (values.length === 0) return void 0;
+    return values.length === 1 ? values[0] : values;
+  }
+  async getBody() {
+    try {
+      return await this.request.clone().json();
+    } catch {
+      return void 0;
+    }
+  }
+};
+
+// src/facilitator.ts
+var CachingFacilitatorClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  #supported;
+  verify(payload, requirements) {
+    return this.client.verify(payload, requirements);
+  }
+  settle(payload, requirements) {
+    return this.client.settle(payload, requirements);
+  }
+  getSupported() {
+    this.#supported ??= this.client.getSupported().catch((error) => {
+      this.#supported = void 0;
+      throw error;
+    });
+    return this.#supported;
+  }
+};
+
+// src/index.ts
+var toFacilitatorClient = (facilitator) => {
+  if (typeof facilitator === "string") return new import_server.HTTPFacilitatorClient({ url: facilitator });
+  if ("getSupported" in facilitator) return facilitator;
+  return new import_server.HTTPFacilitatorClient(facilitator);
+};
+var toResponse = ({ status, headers, body, isHtml }) => new Response(isHtml ? String(body ?? "") : JSON.stringify(body ?? {}), { status, headers });
+function createX402(options) {
+  const facilitator = new CachingFacilitatorClient(toFacilitatorClient(options.facilitator));
+  const resourceServer = new import_server.x402ResourceServer(facilitator);
+  for (const register of options.schemes ?? [import_server2.registerExactEvmScheme]) {
+    register(resourceServer);
+  }
+  const { logger } = options;
+  const metrics = options.enableMetrics ? options.metrics ?? new import_metrics.Metrics({ namespace: "x402" }) : void 0;
+  const count = (name) => metrics && (metrics.singleMetric?.() ?? metrics).addMetric(name, "Count", 1);
+  const payers = /* @__PURE__ */ new WeakMap();
+  resourceServer.onAfterVerify(async ({ paymentPayload, result }) => {
+    if (result.payer) payers.set(paymentPayload, result.payer);
+  });
+  function paid(route) {
+    const { price, accepts, onProtectedRequest, ...routeConfig } = route;
+    if (accepts === void 0 && price === void 0) {
+      throw new Error("paid() requires a price or an accepts configuration");
+    }
+    const httpServer = new import_server.x402HTTPResourceServer(resourceServer, {
+      ...routeConfig,
+      mimeType: routeConfig.mimeType ?? "application/json",
+      accepts: accepts ?? {
+        scheme: "exact",
+        network: options.network,
+        payTo: options.payTo,
+        price
+      }
+    });
+    if (onProtectedRequest) httpServer.onProtectedRequest(onProtectedRequest);
+    let ready;
+    const initialize = () => ready ??= httpServer.initialize().catch((error) => {
+      ready = void 0;
+      throw error;
+    });
+    return async ({ reqCtx, next }) => {
+      await initialize();
+      const adapter = new PowertoolsAdapter(reqCtx.req);
+      const context = {
+        adapter,
+        path: adapter.getPath(),
+        method: adapter.getMethod()
+      };
+      const result = await httpServer.processHTTPRequest(context, options.paywall);
+      if (result.type === "no-payment-required") {
+        await next();
+        return;
+      }
+      if (result.type === "payment-error") {
+        count(adapter.getHeader("payment-signature") ? "PaymentRejected" : "PaymentRequired");
+        logger?.debug("x402 payment not accepted", { status: result.response.status });
+        reqCtx.res = toResponse(result.response);
+        return;
+      }
+      const {
+        cancellationDispatcher,
+        beforeHandlerSettlement,
+        paymentPayload,
+        paymentRequirements,
+        declaredExtensions
+      } = result;
+      reqCtx.set("payment", {
+        network: paymentRequirements.network,
+        scheme: paymentRequirements.scheme,
+        asset: paymentRequirements.asset,
+        amount: paymentRequirements.amount,
+        payer: payers.get(paymentPayload)
+      });
+      count("PaymentVerified");
+      try {
+        await next();
+      } catch (error) {
+        await cancellationDispatcher.cancel({ reason: "handler_threw", error });
+        count("PaymentCancelled");
+        logger?.warn("x402 payment cancelled: handler threw", { path: context.path });
+        throw error;
+      }
+      if (reqCtx.res.status >= 400) {
+        await cancellationDispatcher.cancel({
+          reason: "handler_failed",
+          responseStatus: reqCtx.res.status
+        });
+        count("PaymentCancelled");
+        logger?.warn("x402 payment cancelled: handler failed", {
+          path: context.path,
+          status: reqCtx.res.status
+        });
+        return;
+      }
+      const settlement = await httpServer.processSettlement(
+        paymentPayload,
+        paymentRequirements,
+        declaredExtensions,
+        {
+          request: context,
+          responseBody: Buffer.from(await reqCtx.res.clone().arrayBuffer()),
+          responseHeaders: Object.fromEntries(reqCtx.res.headers.entries())
+        },
+        void 0,
+        beforeHandlerSettlement
+      );
+      if (!settlement.success) {
+        count("SettlementFailed");
+        logger?.error("x402 settlement failed", {
+          path: context.path,
+          errorReason: settlement.errorReason
+        });
+        reqCtx.res = toResponse(settlement.response);
+        return;
+      }
+      count("PaymentSettled");
+      logger?.debug("x402 payment settled", { path: context.path, transaction: settlement.transaction });
+      for (const [name, value] of Object.entries(settlement.headers)) {
+        reqCtx.res.headers.set(name, value);
+      }
+      const cacheControl = reqCtx.res.headers.get("cache-control");
+      reqCtx.res.headers.set("cache-control", cacheControl ? `${cacheControl}, private` : "private");
+    };
+  }
+  return { paid, resourceServer };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CachingFacilitatorClient,
+  PowertoolsAdapter,
+  createX402
+});

package/dist/index.d.cts

@@ -0,0 +1,81 @@
+import { Middleware } from '@aws-lambda-powertools/event-handler/types';
+import { HTTPAdapter, FacilitatorClient, FacilitatorConfig, x402ResourceServer, PaywallConfig, RouteConfig, ProtectedRequestHook } from '@x402/core/server';
+import { PaymentOption } from '@x402/core/http';
+import { PaymentPayload, PaymentRequirements, VerifyResponse, SettleResponse, SupportedResponse, Network, Price } from '@x402/core/types';
+
+/**
+ * Bridges the web-standard Request exposed by Powertools Event Handler
+ * to x402's framework-agnostic HTTPAdapter.
+ */
+declare class PowertoolsAdapter implements HTTPAdapter {
+    private readonly request;
+    constructor(request: Request);
+    getHeader(name: string): string | undefined;
+    getMethod(): string;
+    getPath(): string;
+    getUrl(): string;
+    getAcceptHeader(): string;
+    getUserAgent(): string;
+    getQueryParams(): Record<string, string | string[]>;
+    getQueryParam(name: string): string | string[] | undefined;
+    getBody(): Promise<unknown>;
+}
+
+/**
+ * Memoizes getSupported() so every paid route on a cold start shares one
+ * facilitator round trip instead of re-fetching per route.
+ */
+declare class CachingFacilitatorClient implements FacilitatorClient {
+    #private;
+    private readonly client;
+    constructor(client: FacilitatorClient);
+    verify(payload: PaymentPayload, requirements: PaymentRequirements): Promise<VerifyResponse>;
+    settle(payload: PaymentPayload, requirements: PaymentRequirements): Promise<SettleResponse>;
+    getSupported(): Promise<SupportedResponse>;
+}
+
+interface X402Logger {
+    debug(message: string, extra: Record<string, unknown>): void;
+    warn(message: string, extra: Record<string, unknown>): void;
+    error(message: string, extra: Record<string, unknown>): void;
+}
+interface X402Metrics {
+    addMetric(name: string, unit: 'Count', value: number): void;
+    singleMetric?(): Pick<X402Metrics, 'addMetric'>;
+}
+type SchemeRegistrar = (server: x402ResourceServer) => unknown;
+interface CreateX402Options {
+    facilitator: string | FacilitatorConfig | FacilitatorClient;
+    network: Network;
+    payTo: string;
+    schemes?: SchemeRegistrar[];
+    paywall?: PaywallConfig;
+    logger?: X402Logger;
+    enableMetrics?: boolean;
+    metrics?: X402Metrics;
+}
+interface PaidRouteOptions extends Omit<RouteConfig, 'accepts'> {
+    price?: Price;
+    accepts?: PaymentOption | PaymentOption[];
+    onProtectedRequest?: ProtectedRequestHook;
+}
+type PaymentInfo = {
+    network: Network;
+    scheme: string;
+    asset: string;
+    amount: string;
+    payer?: string;
+};
+type X402Environment = {
+    store: {
+        request: {
+            payment?: PaymentInfo;
+        };
+    };
+};
+declare function createX402(options: CreateX402Options): {
+    paid: (route: PaidRouteOptions) => Middleware<X402Environment>;
+    resourceServer: x402ResourceServer;
+};
+
+export { CachingFacilitatorClient, type CreateX402Options, type PaidRouteOptions, type PaymentInfo, PowertoolsAdapter, type SchemeRegistrar, type X402Environment, type X402Logger, type X402Metrics, createX402 };

package/dist/index.d.ts

@@ -0,0 +1,81 @@
+import { Middleware } from '@aws-lambda-powertools/event-handler/types';
+import { HTTPAdapter, FacilitatorClient, FacilitatorConfig, x402ResourceServer, PaywallConfig, RouteConfig, ProtectedRequestHook } from '@x402/core/server';
+import { PaymentOption } from '@x402/core/http';
+import { PaymentPayload, PaymentRequirements, VerifyResponse, SettleResponse, SupportedResponse, Network, Price } from '@x402/core/types';
+
+/**
+ * Bridges the web-standard Request exposed by Powertools Event Handler
+ * to x402's framework-agnostic HTTPAdapter.
+ */
+declare class PowertoolsAdapter implements HTTPAdapter {
+    private readonly request;
+    constructor(request: Request);
+    getHeader(name: string): string | undefined;
+    getMethod(): string;
+    getPath(): string;
+    getUrl(): string;
+    getAcceptHeader(): string;
+    getUserAgent(): string;
+    getQueryParams(): Record<string, string | string[]>;
+    getQueryParam(name: string): string | string[] | undefined;
+    getBody(): Promise<unknown>;
+}
+
+/**
+ * Memoizes getSupported() so every paid route on a cold start shares one
+ * facilitator round trip instead of re-fetching per route.
+ */
+declare class CachingFacilitatorClient implements FacilitatorClient {
+    #private;
+    private readonly client;
+    constructor(client: FacilitatorClient);
+    verify(payload: PaymentPayload, requirements: PaymentRequirements): Promise<VerifyResponse>;
+    settle(payload: PaymentPayload, requirements: PaymentRequirements): Promise<SettleResponse>;
+    getSupported(): Promise<SupportedResponse>;
+}
+
+interface X402Logger {
+    debug(message: string, extra: Record<string, unknown>): void;
+    warn(message: string, extra: Record<string, unknown>): void;
+    error(message: string, extra: Record<string, unknown>): void;
+}
+interface X402Metrics {
+    addMetric(name: string, unit: 'Count', value: number): void;
+    singleMetric?(): Pick<X402Metrics, 'addMetric'>;
+}
+type SchemeRegistrar = (server: x402ResourceServer) => unknown;
+interface CreateX402Options {
+    facilitator: string | FacilitatorConfig | FacilitatorClient;
+    network: Network;
+    payTo: string;
+    schemes?: SchemeRegistrar[];
+    paywall?: PaywallConfig;
+    logger?: X402Logger;
+    enableMetrics?: boolean;
+    metrics?: X402Metrics;
+}
+interface PaidRouteOptions extends Omit<RouteConfig, 'accepts'> {
+    price?: Price;
+    accepts?: PaymentOption | PaymentOption[];
+    onProtectedRequest?: ProtectedRequestHook;
+}
+type PaymentInfo = {
+    network: Network;
+    scheme: string;
+    asset: string;
+    amount: string;
+    payer?: string;
+};
+type X402Environment = {
+    store: {
+        request: {
+            payment?: PaymentInfo;
+        };
+    };
+};
+declare function createX402(options: CreateX402Options): {
+    paid: (route: PaidRouteOptions) => Middleware<X402Environment>;
+    resourceServer: x402ResourceServer;
+};
+
+export { CachingFacilitatorClient, type CreateX402Options, type PaidRouteOptions, type PaymentInfo, PowertoolsAdapter, type SchemeRegistrar, type X402Environment, type X402Logger, type X402Metrics, createX402 };

package/dist/index.js

@@ -0,0 +1,210 @@
+// src/index.ts
+import { Metrics } from "@aws-lambda-powertools/metrics";
+import {
+  HTTPFacilitatorClient,
+  x402HTTPResourceServer,
+  x402ResourceServer
+} from "@x402/core/server";
+import { registerExactEvmScheme } from "@x402/evm/exact/server";
+
+// src/adapter.ts
+var PowertoolsAdapter = class {
+  constructor(request) {
+    this.request = request;
+  }
+  request;
+  getHeader(name) {
+    return this.request.headers.get(name) ?? void 0;
+  }
+  getMethod() {
+    return this.request.method;
+  }
+  getPath() {
+    return new URL(this.request.url).pathname;
+  }
+  getUrl() {
+    return this.request.url;
+  }
+  getAcceptHeader() {
+    return this.request.headers.get("accept") ?? "";
+  }
+  getUserAgent() {
+    return this.request.headers.get("user-agent") ?? "";
+  }
+  getQueryParams() {
+    const params = new URL(this.request.url).searchParams;
+    const result = {};
+    for (const key of new Set(params.keys())) {
+      const values = params.getAll(key);
+      result[key] = values.length === 1 ? values[0] : values;
+    }
+    return result;
+  }
+  getQueryParam(name) {
+    const values = new URL(this.request.url).searchParams.getAll(name);
+    if (values.length === 0) return void 0;
+    return values.length === 1 ? values[0] : values;
+  }
+  async getBody() {
+    try {
+      return await this.request.clone().json();
+    } catch {
+      return void 0;
+    }
+  }
+};
+
+// src/facilitator.ts
+var CachingFacilitatorClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  #supported;
+  verify(payload, requirements) {
+    return this.client.verify(payload, requirements);
+  }
+  settle(payload, requirements) {
+    return this.client.settle(payload, requirements);
+  }
+  getSupported() {
+    this.#supported ??= this.client.getSupported().catch((error) => {
+      this.#supported = void 0;
+      throw error;
+    });
+    return this.#supported;
+  }
+};
+
+// src/index.ts
+var toFacilitatorClient = (facilitator) => {
+  if (typeof facilitator === "string") return new HTTPFacilitatorClient({ url: facilitator });
+  if ("getSupported" in facilitator) return facilitator;
+  return new HTTPFacilitatorClient(facilitator);
+};
+var toResponse = ({ status, headers, body, isHtml }) => new Response(isHtml ? String(body ?? "") : JSON.stringify(body ?? {}), { status, headers });
+function createX402(options) {
+  const facilitator = new CachingFacilitatorClient(toFacilitatorClient(options.facilitator));
+  const resourceServer = new x402ResourceServer(facilitator);
+  for (const register of options.schemes ?? [registerExactEvmScheme]) {
+    register(resourceServer);
+  }
+  const { logger } = options;
+  const metrics = options.enableMetrics ? options.metrics ?? new Metrics({ namespace: "x402" }) : void 0;
+  const count = (name) => metrics && (metrics.singleMetric?.() ?? metrics).addMetric(name, "Count", 1);
+  const payers = /* @__PURE__ */ new WeakMap();
+  resourceServer.onAfterVerify(async ({ paymentPayload, result }) => {
+    if (result.payer) payers.set(paymentPayload, result.payer);
+  });
+  function paid(route) {
+    const { price, accepts, onProtectedRequest, ...routeConfig } = route;
+    if (accepts === void 0 && price === void 0) {
+      throw new Error("paid() requires a price or an accepts configuration");
+    }
+    const httpServer = new x402HTTPResourceServer(resourceServer, {
+      ...routeConfig,
+      mimeType: routeConfig.mimeType ?? "application/json",
+      accepts: accepts ?? {
+        scheme: "exact",
+        network: options.network,
+        payTo: options.payTo,
+        price
+      }
+    });
+    if (onProtectedRequest) httpServer.onProtectedRequest(onProtectedRequest);
+    let ready;
+    const initialize = () => ready ??= httpServer.initialize().catch((error) => {
+      ready = void 0;
+      throw error;
+    });
+    return async ({ reqCtx, next }) => {
+      await initialize();
+      const adapter = new PowertoolsAdapter(reqCtx.req);
+      const context = {
+        adapter,
+        path: adapter.getPath(),
+        method: adapter.getMethod()
+      };
+      const result = await httpServer.processHTTPRequest(context, options.paywall);
+      if (result.type === "no-payment-required") {
+        await next();
+        return;
+      }
+      if (result.type === "payment-error") {
+        count(adapter.getHeader("payment-signature") ? "PaymentRejected" : "PaymentRequired");
+        logger?.debug("x402 payment not accepted", { status: result.response.status });
+        reqCtx.res = toResponse(result.response);
+        return;
+      }
+      const {
+        cancellationDispatcher,
+        beforeHandlerSettlement,
+        paymentPayload,
+        paymentRequirements,
+        declaredExtensions
+      } = result;
+      reqCtx.set("payment", {
+        network: paymentRequirements.network,
+        scheme: paymentRequirements.scheme,
+        asset: paymentRequirements.asset,
+        amount: paymentRequirements.amount,
+        payer: payers.get(paymentPayload)
+      });
+      count("PaymentVerified");
+      try {
+        await next();
+      } catch (error) {
+        await cancellationDispatcher.cancel({ reason: "handler_threw", error });
+        count("PaymentCancelled");
+        logger?.warn("x402 payment cancelled: handler threw", { path: context.path });
+        throw error;
+      }
+      if (reqCtx.res.status >= 400) {
+        await cancellationDispatcher.cancel({
+          reason: "handler_failed",
+          responseStatus: reqCtx.res.status
+        });
+        count("PaymentCancelled");
+        logger?.warn("x402 payment cancelled: handler failed", {
+          path: context.path,
+          status: reqCtx.res.status
+        });
+        return;
+      }
+      const settlement = await httpServer.processSettlement(
+        paymentPayload,
+        paymentRequirements,
+        declaredExtensions,
+        {
+          request: context,
+          responseBody: Buffer.from(await reqCtx.res.clone().arrayBuffer()),
+          responseHeaders: Object.fromEntries(reqCtx.res.headers.entries())
+        },
+        void 0,
+        beforeHandlerSettlement
+      );
+      if (!settlement.success) {
+        count("SettlementFailed");
+        logger?.error("x402 settlement failed", {
+          path: context.path,
+          errorReason: settlement.errorReason
+        });
+        reqCtx.res = toResponse(settlement.response);
+        return;
+      }
+      count("PaymentSettled");
+      logger?.debug("x402 payment settled", { path: context.path, transaction: settlement.transaction });
+      for (const [name, value] of Object.entries(settlement.headers)) {
+        reqCtx.res.headers.set(name, value);
+      }
+      const cacheControl = reqCtx.res.headers.get("cache-control");
+      reqCtx.res.headers.set("cache-control", cacheControl ? `${cacheControl}, private` : "private");
+    };
+  }
+  return { paid, resourceServer };
+}
+export {
+  CachingFacilitatorClient,
+  PowertoolsAdapter,
+  createX402
+};

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "powertools-x402",
+  "version": "0.1.0",
+  "description": "x402 payment middleware for AWS Lambda Powertools Event Handler",
+  "license": "MIT",
+  "author": "Allen Helton <allenheltondev@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/allenheltondev/powertools-x402.git"
+  },
+  "keywords": [
+    "x402",
+    "payments",
+    "aws-lambda",
+    "powertools",
+    "middleware",
+    "serverless"
+  ],
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage --coverage.include=src/**",
+    "prepublishOnly": "npm run typecheck && npm run test && npm run build"
+  },
+  "dependencies": {
+    "@aws-lambda-powertools/metrics": "^2.35.0",
+    "@x402/core": "^2.23.0",
+    "@x402/evm": "^2.23.0"
+  },
+  "peerDependencies": {
+    "@aws-lambda-powertools/event-handler": "^2.35.0"
+  },
+  "devDependencies": {
+    "@aws-lambda-powertools/event-handler": "^2.35.0",
+    "@aws-lambda-powertools/logger": "^2.35.0",
+    "@types/aws-lambda": "^8.10.152",
+    "@types/node": "^24.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
+    "tsup": "^8.4.0",
+    "typescript": "^5.7.0",
+    "viem": "^2.48.0",
+    "vitest": "^3.0.0"
+  }
+}