uvd-x402-sdk 2.95.0 → 2.97.0

package/dist/react/index.mjs

@@ -1,5 +1,8 @@
 import { ethers } from 'ethers';
 import { createContext, useMemo, useRef, useCallback, useState, useEffect, useContext } from 'react';
+import { ed25519 } from '@noble/curves/ed25519';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
 import { jsxs, jsx } from 'react/jsx-runtime';
 
 var __defProp = Object.defineProperty;
@@ -803,7 +806,8 @@ var init_chains = __esm({
       // Pinned by src/arc-testnet.test.ts.
       //
       // Mainnet (5042) and testnet (5042002) were verified independently against
-      // their official RPCs on 2026-09-16. EURC domains checked on 2026-09-17; live payments pending.
+      // their official RPCs on 2026-09-16. EURC domains checked on 2026-09-17; funded EURC payments settled on Arc mainnet on
+      // 2026-09-22 (x402 v1/v2, docs/networks/arc.md); testnet pending.
       arc: {
         chainId: 5042,
         chainIdHex: "0x13b2",
@@ -1803,6 +1807,151 @@ var init_solana = __esm({
     solana_default = SVMProvider;
   }
 });
+var RECEIPT_ISSUER = "https://facilitator.ultravioletadao.xyz";
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var digest = (value) => bytesToHex(sha256(value));
+function canonicalReceiptJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return String(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalReceiptJson).join(",")}]`;
+  if (typeof value === "object" && value) {
+    const object = value;
+    const keys = Object.keys(object).sort();
+    if (keys.some((key) => !/^[\x00-\x7f]*$/.test(key))) throw new Error("non-ASCII canonical key");
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalReceiptJson(object[key])}`).join(",")}}`;
+  }
+  throw new Error("unsupported canonical value");
+}
+function receiptCommitment(domain, value) {
+  return digest(encoder.encode(`${domain}
+${canonicalReceiptJson(value)}`));
+}
+function encode64(bytes) {
+  if (typeof Buffer !== "undefined") return Buffer.from(bytes).toString("base64");
+  return btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join(""));
+}
+function decode64(value) {
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(value) || value.length % 4 !== 0) throw new Error("invalid base64");
+  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64"));
+  return Uint8Array.from(atob(value), (c) => c.charCodeAt(0));
+}
+function decodeUrl64(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  return decode64(padded + "=".repeat((4 - padded.length % 4) % 4));
+}
+function parseFacilitatorReceipt(value) {
+  if (value === null || value === void 0) return null;
+  const r = value;
+  if (r.schemaVersion !== 1 || !["verified", "pending", "confirmed", "rejected", "unknown"].includes(r.status)) throw new Error("unsupported receipt version or state");
+  for (const key of ["receiptId", "issuer", "operation", "network", "scheme", "asset", "amount", "payTo", "paymentRequestHash", "authorizationId"]) {
+    if (typeof r[key] !== "string" || !r[key]) throw new Error(`invalid receipt ${key}`);
+  }
+  if (!Number.isSafeInteger(r.revision) || r.revision < 1 || !r.request || !r.retry) throw new Error("incomplete receipt");
+  if (r.requestHashVersion !== "uvd-x402-request-v1" || r.requestHash !== receiptCommitment(r.requestHashVersion, r.request)) throw new Error("receipt request hash mismatch");
+  for (const key of ["network", "scheme", "asset", "amount", "payTo", "purchaseId"]) {
+    if (r[key] !== r.request[key]) throw new Error("receipt terms mismatch");
+  }
+  if (!/^[0-9]+$/.test(r.amount)) throw new Error("receipt amount must be an atomic integer string");
+  if (r.status === "confirmed" && (r.operation !== "settle" || !r.settlement?.id)) throw new Error("confirmation has no settlement");
+  return r;
+}
+function verifyFacilitatorReceipt(receipt, jwks, issuer = RECEIPT_ISSUER) {
+  try {
+    parseFacilitatorReceipt(receipt);
+    if (receipt.issuer !== issuer || receipt.proof?.type !== "jws" || !receipt.proof.jws) return false;
+    const parts = receipt.proof.jws.split(".");
+    if (parts.length !== 3) return false;
+    const [protectedHeader, payload, signature] = parts;
+    const header = JSON.parse(decoder.decode(decodeUrl64(protectedHeader)));
+    if (header.alg !== "EdDSA" || header.typ !== "uvd-facilitator-receipt+jws") return false;
+    const keys = jwks.keys.filter((k) => k.kid === header.kid && k.kty === "OKP" && k.crv === "Ed25519");
+    if (keys.length !== 1 || !keys[0].x) return false;
+    if (decoder.decode(decodeUrl64(payload)) !== canonicalReceiptJson({ ...receipt, proof: null })) return false;
+    return ed25519.verify(decodeUrl64(signature), encoder.encode(`${protectedHeader}.${payload}`), decodeUrl64(keys[0].x));
+  } catch {
+    return false;
+  }
+}
+function purchaseContextHeader(context) {
+  return encode64(encoder.encode(canonicalReceiptJson({
+    purchaseId: context.purchaseId,
+    accessToken: context.accessToken,
+    method: context.method,
+    url: context.url,
+    bodySha256: context.bodySha256
+  })));
+}
+function receiptFromResponse(response) {
+  const values = [response.headers.get("PAYMENT-RESPONSE"), response.headers.get("X-PAYMENT-RESPONSE")].filter((v) => v !== null);
+  if (!values.length) return null;
+  if (new Set(values).size !== 1 || values[0].includes(",") || values[0].length > 32768) throw new Error("ambiguous or oversized payment response header");
+  return parseFacilitatorReceipt(JSON.parse(decoder.decode(decode64(values[0]))).receipt);
+}
+async function fetchWithReceipt(fetchClient, url, options) {
+  const { context, persist, trustedKeys, issuer = RECEIPT_ISSUER } = options;
+  const transport = options.fetchImpl || globalThis.fetch;
+  const method = (options.method || "GET").toUpperCase();
+  const request = new Request(url, { ...options.init, method });
+  const bytes = new Uint8Array(await request.arrayBuffer());
+  const bodyHash = digest(bytes);
+  if (context.method && (context.method !== method || context.url !== request.url || context.bodySha256 !== bodyHash)) throw new Error("purchase context cannot be reused for another HTTP request");
+  context.method = method;
+  context.url = request.url;
+  context.bodySha256 = bodyHash;
+  const init = { ...options.init, method, headers: new Headers(request.headers), body: ["GET", "HEAD"].includes(method) ? void 0 : bytes };
+  let receipt = parseFacilitatorReceipt(context.receipt);
+  let transportError;
+  const persistCopy = async () => {
+    await persist(JSON.parse(JSON.stringify(context)));
+  };
+  const send = async (input, sendOptions) => {
+    const headers = new Headers(sendOptions?.headers);
+    const paid = headers.get("X-PAYMENT") || headers.get("PAYMENT-SIGNATURE");
+    if (paid) {
+      const paymentHeaders = {};
+      for (const name of ["X-PAYMENT", "PAYMENT-SIGNATURE"]) {
+        const value = headers.get(name);
+        if (value) paymentHeaders[name] = value;
+      }
+      if (context.paymentHeaders && JSON.stringify(context.paymentHeaders) !== JSON.stringify(paymentHeaders)) throw new Error("refusing a new authorization for an existing purchase");
+      context.paymentHeaders = paymentHeaders;
+      headers.set("X-UVD-Purchase", purchaseContextHeader(context));
+      await persistCopy();
+    }
+    try {
+      return await transport(input, { ...sendOptions, headers });
+    } catch (error) {
+      transportError = error;
+      throw error;
+    }
+  };
+  try {
+    let response;
+    if (context.paymentHeaders) {
+      const headers = new Headers(init.headers);
+      for (const [name, value] of Object.entries(context.paymentHeaders)) headers.set(name, value);
+      response = await send(request.url, { ...init, headers });
+    } else {
+      response = await fetchClient(request.url, { ...options, method, init, fetchImpl: send });
+    }
+    const incoming = receiptFromResponse(response);
+    if (incoming) {
+      if (incoming.issuer !== issuer || Object.entries({ purchaseId: context.purchaseId, method, url: context.url, bodySha256: bodyHash }).some(([key, value]) => incoming.request[key] !== value)) throw new Error("receipt does not bind this purchase");
+      if (receipt?.operation === "settle" && (incoming.receiptId !== receipt.receiptId || incoming.revision < receipt.revision)) throw new Error("receipt revision conflict");
+      if (trustedKeys && !verifyFacilitatorReceipt(incoming, trustedKeys, issuer)) throw new Error("receipt signature verification failed");
+      receipt = incoming;
+      context.receipt = incoming;
+      await persistCopy();
+    }
+    const proofVerified = !!(receipt && trustedKeys && verifyFacilitatorReceipt(receipt, trustedKeys, issuer));
+    if (receipt && trustedKeys && !proofVerified) throw new Error("receipt signature verification failed");
+    return { response, receipt, paymentState: receipt ? receipt.status : context.paymentHeaders ? "unknown" : "not_required", context, proofVerified };
+  } catch (error) {
+    if (!transportError) throw error;
+    return { response: null, receipt, paymentState: "unknown", context, proofVerified: false, error };
+  }
+}
 
 // src/client/X402Client.ts
 init_types();
@@ -2435,6 +2584,9 @@ var X402Client = class _X402Client {
    * const data = await res.json();
    * ```
    */
+  async fetchWithReceipt(url, options) {
+    return fetchWithReceipt((target, init) => this.fetch(target, init), url, options);
+  }
   async fetch(url, options = {}) {
     if (!this.connectedAddress) {
       throw new X402Error("Wallet not connected", "WALLET_NOT_CONNECTED");