x402z-facilitator 0.0.4 → 0.0.5

package/README.md

@@ -17,6 +17,8 @@ Set env vars:
 - `FACILITATOR_EVM_CHAIN_ID` (default 11155111)
 - `FACILITATOR_NETWORKS` (default `eip155:11155111`)
 - `FACILITATOR_PORT` (default 8040)
+- `FACILITATOR_BATCHER_ADDRESS` (optional FHETokenBatcher address)
+- `FACILITATOR_GAS_MULTIPLIER` (optional, e.g. `2` to double estimated gas)
 
 Then run:
 
@@ -29,3 +31,4 @@ node packages/x402z-facilitator/dist/bootstrap.js
 
 - This service receives `/verify` and `/settle` HTTP calls from the server.
 - It submits `confidentialTransferWithAuthorization` transactions on-chain.
+- When `FACILITATOR_BATCHER_ADDRESS` is set, it uses the batcher contract and validates the per-item result from batch events.

package/dist/bootstrap.js

@@ -83,6 +83,63 @@ function createFacilitatorService(config) {
 // src/scheme.ts
 var import_viem = require("viem");
 var import_x402z_shared = require("x402z-shared");
+var batcherAbi = [
+  {
+    inputs: [
+      { internalType: "address", name: "token", type: "address" },
+      {
+        components: [
+          {
+            components: [
+              { internalType: "address", name: "holder", type: "address" },
+              { internalType: "address", name: "payee", type: "address" },
+              { internalType: "uint256", name: "maxClearAmount", type: "uint256" },
+              { internalType: "bytes32", name: "resourceHash", type: "bytes32" },
+              { internalType: "uint48", name: "validAfter", type: "uint48" },
+              { internalType: "uint48", name: "validBefore", type: "uint48" },
+              { internalType: "bytes32", name: "nonce", type: "bytes32" },
+              { internalType: "bytes32", name: "encryptedAmountHash", type: "bytes32" }
+            ],
+            internalType: "struct IFHEToken.ConfidentialPayment",
+            name: "p",
+            type: "tuple"
+          },
+          { internalType: "externalEuint64", name: "encryptedAmountInput", type: "bytes32" },
+          { internalType: "bytes", name: "inputProof", type: "bytes" },
+          { internalType: "bytes", name: "sig", type: "bytes" }
+        ],
+        internalType: "struct FHETokenBatcher.Request[]",
+        name: "requests",
+        type: "tuple[]"
+      }
+    ],
+    name: "batchConfidentialTransferWithAuthorization",
+    outputs: [
+      { internalType: "bool[]", name: "successes", type: "bool[]" },
+      { internalType: "bytes32[]", name: "transferredHandles", type: "bytes32[]" }
+    ],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      { indexed: true, internalType: "uint256", name: "index", type: "uint256" },
+      { indexed: false, internalType: "bytes32", name: "transferredHandle", type: "bytes32" }
+    ],
+    name: "BatchItemSuccess",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      { indexed: true, internalType: "uint256", name: "index", type: "uint256" },
+      { indexed: false, internalType: "bytes", name: "reason", type: "bytes" }
+    ],
+    name: "BatchItemFailure",
+    type: "event"
+  }
+];
 var ConfidentialEvmFacilitator = class {
   constructor(config) {
     this.config = config;
@@ -219,8 +276,25 @@ var ConfidentialEvmFacilitator = class {
         network: requirements.network
       };
     }
-    const txHash = await this.config.signer.writeContract({
-      address: (0, import_viem.getAddress)(requirements.asset),
+    const tokenAddress = (0, import_viem.getAddress)(requirements.asset);
+    const batcherAddress = this.config.batcherAddress ? (0, import_viem.getAddress)(this.config.batcherAddress) : void 0;
+    const txRequest = batcherAddress ? {
+      address: batcherAddress,
+      abi: batcherAbi,
+      functionName: "batchConfidentialTransferWithAuthorization",
+      args: [
+        tokenAddress,
+        [
+          {
+            p: confidentialPayload.authorization,
+            encryptedAmountInput: confidentialPayload.encryptedAmountInput,
+            inputProof: confidentialPayload.inputProof,
+            sig: confidentialPayload.signature
+          }
+        ]
+      ]
+    } : {
+      address: tokenAddress,
       abi: import_x402z_shared.confidentialTokenAbi,
       functionName: "confidentialTransferWithAuthorization",
       args: [
@@ -229,10 +303,20 @@ var ConfidentialEvmFacilitator = class {
         confidentialPayload.inputProof,
         confidentialPayload.signature
       ]
-    });
+    };
+    if (process.env.X402Z_DEBUG === "1") {
+      console.debug("[x402z-facilitator] settle tx", {
+        batcherAddress,
+        tokenAddress,
+        functionName: txRequest.functionName,
+        to: txRequest.address
+      });
+    }
+    const txHash = await this.config.signer.writeContract(txRequest);
     if (process.env.X402Z_DEBUG === "1") {
       console.debug("[x402z-facilitator] tx submitted", txHash);
     }
+    let batchResult;
     if (this.waitForReceipt) {
       const receipt = await this.config.signer.waitForTransactionReceipt({
         hash: txHash
@@ -249,12 +333,90 @@ var ConfidentialEvmFacilitator = class {
           network: requirements.network
         };
       }
+      if (batcherAddress) {
+        let batchSucceeded = false;
+        const logs = "logs" in receipt ? receipt.logs ?? [] : [];
+        for (const log of logs) {
+          if (!log || !("address" in log) || !log.address) {
+            continue;
+          }
+          if (!(0, import_viem.isAddressEqual)((0, import_viem.getAddress)(log.address), batcherAddress)) {
+            continue;
+          }
+          const decoded = (0, import_viem.decodeEventLog)({
+            abi: batcherAbi,
+            data: log.data,
+            topics: log.topics
+          });
+          if (process.env.X402Z_DEBUG === "1") {
+            console.debug("[x402z-facilitator] batch log", decoded);
+          }
+          if (decoded.eventName === "BatchItemSuccess") {
+            const args = decoded.args;
+            if (Number(args.index) === 0) {
+              batchSucceeded = true;
+              batchResult = {
+                index: Number(args.index),
+                success: true,
+                transferredHandle: args.transferredHandle
+              };
+              break;
+            }
+          }
+          if (decoded.eventName === "BatchItemFailure") {
+            const args = decoded.args;
+            if (Number(args.index) === 0) {
+              batchResult = {
+                index: Number(args.index),
+                success: false,
+                failureReason: args.reason
+              };
+              if (process.env.X402Z_DEBUG === "1") {
+                try {
+                  await this.config.signer.readContract({
+                    address: tokenAddress,
+                    abi: import_x402z_shared.confidentialTokenAbi,
+                    functionName: "confidentialTransferWithAuthorization",
+                    args: [
+                      confidentialPayload.authorization,
+                      confidentialPayload.encryptedAmountInput,
+                      confidentialPayload.inputProof,
+                      confidentialPayload.signature
+                    ]
+                  });
+                } catch (innerError) {
+                  console.debug("[x402z-facilitator] batch fallback call failed", innerError);
+                }
+              }
+              return {
+                success: false,
+                errorReason: "settlement_failed",
+                payer: confidentialPayload.authorization.holder,
+                transaction: txHash,
+                network: requirements.network,
+                ...batchResult ? { batch: batchResult } : {}
+              };
+            }
+          }
+        }
+        if (!batchSucceeded) {
+          return {
+            success: false,
+            errorReason: "settlement_failed",
+            payer: confidentialPayload.authorization.holder,
+            transaction: txHash,
+            network: requirements.network,
+            ...batchResult ? { batch: batchResult } : {}
+          };
+        }
+      }
     }
     return {
       success: true,
       payer: confidentialPayload.authorization.holder,
       transaction: txHash,
-      network: requirements.network
+      network: requirements.network,
+      ...batchResult ? { batch: batchResult } : {}
     };
   }
 };
@@ -273,9 +435,11 @@ function createConfidentialFacilitatorFromEnv() {
   const rpcUrl = requireEnv("FACILITATOR_EVM_RPC_URL");
   const networks = (process.env.FACILITATOR_NETWORKS ?? "eip155:11155111").split(",").map((network) => network.trim()).filter(Boolean);
   const waitForReceipt = (process.env.FACILITATOR_WAIT_FOR_RECEIPT ?? "true") === "true";
+  const batcherAddress = process.env.FACILITATOR_BATCHER_ADDRESS;
   const receiptTimeoutMs = process.env.FACILITATOR_RECEIPT_TIMEOUT_MS ? Number(process.env.FACILITATOR_RECEIPT_TIMEOUT_MS) : void 0;
   const receiptConfirmations = process.env.FACILITATOR_RECEIPT_CONFIRMATIONS ? Number(process.env.FACILITATOR_RECEIPT_CONFIRMATIONS) : void 0;
   const receiptPollingIntervalMs = process.env.FACILITATOR_RECEIPT_POLLING_INTERVAL_MS ? Number(process.env.FACILITATOR_RECEIPT_POLLING_INTERVAL_MS) : void 0;
+  const gasMultiplier = process.env.FACILITATOR_GAS_MULTIPLIER ? Number(process.env.FACILITATOR_GAS_MULTIPLIER) : void 0;
   const debugEnabled = process.env.X402Z_DEBUG === "1";
   const account = (0, import_accounts.privateKeyToAccount)(privateKey);
   if (debugEnabled) {
@@ -284,6 +448,8 @@ function createConfidentialFacilitatorFromEnv() {
       networks,
       rpcUrl,
       waitForReceipt,
+      batcherAddress,
+      gasMultiplier,
       receipt: {
         confirmations: receiptConfirmations,
         timeoutMs: receiptTimeoutMs,
@@ -310,11 +476,32 @@ function createConfidentialFacilitatorFromEnv() {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     }),
     verifyTypedData: (args) => client.verifyTypedData(args),
-    writeContract: (args) => client.writeContract({
-      ...args,
-      args: args.args || []
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    }),
+    writeContract: async (args) => {
+      let gas;
+      if (gasMultiplier && gasMultiplier > 0) {
+        try {
+          const estimated = await client.estimateContractGas({
+            ...args,
+            args: args.args || [],
+            account
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          });
+          const scale = BigInt(Math.round(gasMultiplier * 1e3));
+          const scaled = estimated * scale / 1000n;
+          gas = scaled > estimated ? scaled : estimated;
+        } catch (error) {
+          if (debugEnabled) {
+            console.debug("[x402z-facilitator] gas estimate failed", error);
+          }
+        }
+      }
+      return client.writeContract({
+        ...args,
+        args: args.args || [],
+        ...gas ? { gas } : {}
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      });
+    },
     sendTransaction: (args) => (
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       client.sendTransaction({ to: args.to, data: args.data })
@@ -329,6 +516,7 @@ function createConfidentialFacilitatorFromEnv() {
       new ConfidentialEvmFacilitator({
         signer,
         waitForReceipt,
+        batcherAddress,
         receipt: {
           confirmations: receiptConfirmations,
           timeoutMs: receiptTimeoutMs,

package/dist/bootstrap.mjs

@@ -1,7 +1,7 @@
 import {
   createConfidentialFacilitatorFromEnv,
   startConfidentialFacilitator
-} from "./chunk-H6QEA2EB.mjs";
+} from "./chunk-4UDK7NYX.mjs";
 export {
   createConfidentialFacilitatorFromEnv,
   startConfidentialFacilitator

package/dist/chunk-4UDK7NYX.mjs

@@ -0,0 +1,540 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/bootstrap.ts
+import { x402Facilitator } from "@x402/core/facilitator";
+import { toFacilitatorEvmSigner } from "@x402/evm";
+import { createWalletClient, http, publicActions } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+
+// src/service.ts
+import { createServer } from "http";
+async function readJson(req) {
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  const body = Buffer.concat(chunks).toString("utf8");
+  return JSON.parse(body);
+}
+function sendJson(res, status, payload) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(payload));
+}
+function createFacilitatorService(config) {
+  const server = createServer(async (req, res) => {
+    try {
+      const method = req.method ?? "GET";
+      const url = req.url ?? "/";
+      if (process.env.X402Z_DEBUG === "1") {
+        console.debug(`[x402z-facilitator] ${method} ${url}`);
+      }
+      if (!req.url) {
+        sendJson(res, 404, { error: "not_found" });
+        return;
+      }
+      if (req.method === "GET" && req.url === "/supported") {
+        sendJson(res, 200, config.facilitator.getSupported());
+        return;
+      }
+      if (req.method === "POST" && req.url === "/verify") {
+        const body = await readJson(req);
+        const result = await config.facilitator.verify(body.paymentPayload, body.paymentRequirements);
+        sendJson(res, 200, result);
+        return;
+      }
+      if (req.method === "POST" && req.url === "/settle") {
+        const body = await readJson(req);
+        const result = await config.facilitator.settle(body.paymentPayload, body.paymentRequirements);
+        sendJson(res, 200, result);
+        return;
+      }
+      sendJson(res, 404, { error: "not_found" });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "internal_error";
+      sendJson(res, 500, { error: message });
+    }
+  });
+  return server;
+}
+function startFacilitatorService(config) {
+  const port = config.port ?? 8040;
+  const server = createFacilitatorService(config);
+  server.listen(port);
+  return { port };
+}
+
+// src/scheme.ts
+import { decodeEventLog, getAddress, isAddressEqual } from "viem";
+import {
+  confidentialPaymentTypes,
+  confidentialTokenAbi,
+  hashEncryptedAmountInput
+} from "x402z-shared";
+var batcherAbi = [
+  {
+    inputs: [
+      { internalType: "address", name: "token", type: "address" },
+      {
+        components: [
+          {
+            components: [
+              { internalType: "address", name: "holder", type: "address" },
+              { internalType: "address", name: "payee", type: "address" },
+              { internalType: "uint256", name: "maxClearAmount", type: "uint256" },
+              { internalType: "bytes32", name: "resourceHash", type: "bytes32" },
+              { internalType: "uint48", name: "validAfter", type: "uint48" },
+              { internalType: "uint48", name: "validBefore", type: "uint48" },
+              { internalType: "bytes32", name: "nonce", type: "bytes32" },
+              { internalType: "bytes32", name: "encryptedAmountHash", type: "bytes32" }
+            ],
+            internalType: "struct IFHEToken.ConfidentialPayment",
+            name: "p",
+            type: "tuple"
+          },
+          { internalType: "externalEuint64", name: "encryptedAmountInput", type: "bytes32" },
+          { internalType: "bytes", name: "inputProof", type: "bytes" },
+          { internalType: "bytes", name: "sig", type: "bytes" }
+        ],
+        internalType: "struct FHETokenBatcher.Request[]",
+        name: "requests",
+        type: "tuple[]"
+      }
+    ],
+    name: "batchConfidentialTransferWithAuthorization",
+    outputs: [
+      { internalType: "bool[]", name: "successes", type: "bool[]" },
+      { internalType: "bytes32[]", name: "transferredHandles", type: "bytes32[]" }
+    ],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      { indexed: true, internalType: "uint256", name: "index", type: "uint256" },
+      { indexed: false, internalType: "bytes32", name: "transferredHandle", type: "bytes32" }
+    ],
+    name: "BatchItemSuccess",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      { indexed: true, internalType: "uint256", name: "index", type: "uint256" },
+      { indexed: false, internalType: "bytes", name: "reason", type: "bytes" }
+    ],
+    name: "BatchItemFailure",
+    type: "event"
+  }
+];
+var ConfidentialEvmFacilitator = class {
+  constructor(config) {
+    this.config = config;
+    this.scheme = "erc7984-mind-v1";
+    this.caipFamily = "eip155:*";
+    this.hashFn = config.hashEncryptedAmountInput ?? hashEncryptedAmountInput;
+    this.clock = config.clock ?? (() => Math.floor(Date.now() / 1e3));
+    this.checkUsedNonces = config.checkUsedNonces ?? true;
+    this.waitForReceipt = config.waitForReceipt ?? true;
+    this.receiptOptions = config.receipt;
+  }
+  getExtra(_) {
+    return void 0;
+  }
+  getSigners(_) {
+    return [...this.config.signer.getAddresses()];
+  }
+  async verify(payload, requirements) {
+    const confidentialPayload = payload.payload;
+    if (payload.accepted.scheme !== this.scheme || requirements.scheme !== this.scheme) {
+      return {
+        isValid: false,
+        invalidReason: "unsupported_scheme",
+        payer: confidentialPayload?.authorization?.holder
+      };
+    }
+    if (payload.accepted.network !== requirements.network) {
+      return {
+        isValid: false,
+        invalidReason: "network_mismatch",
+        payer: confidentialPayload.authorization.holder
+      };
+    }
+    const extra = requirements.extra;
+    const eip712 = extra?.eip712;
+    if (!eip712?.name || !eip712?.version) {
+      return {
+        isValid: false,
+        invalidReason: "missing_eip712_domain",
+        payer: confidentialPayload.authorization.holder
+      };
+    }
+    const now = this.clock();
+    const validAfter = Number(confidentialPayload.authorization.validAfter);
+    const validBefore = Number(confidentialPayload.authorization.validBefore);
+    if (Number.isNaN(validAfter) || Number.isNaN(validBefore)) {
+      return {
+        isValid: false,
+        invalidReason: "invalid_validity_window",
+        payer: confidentialPayload.authorization.holder
+      };
+    }
+    if (now < validAfter || now > validBefore) {
+      return {
+        isValid: false,
+        invalidReason: "authorization_expired",
+        payer: confidentialPayload.authorization.holder
+      };
+    }
+    if (!isAddressEqual(getAddress(confidentialPayload.authorization.payee), getAddress(requirements.payTo))) {
+      return {
+        isValid: false,
+        invalidReason: "recipient_mismatch",
+        payer: confidentialPayload.authorization.holder
+      };
+    }
+    const computedHash = this.hashFn(confidentialPayload.encryptedAmountInput);
+    if (computedHash !== confidentialPayload.authorization.encryptedAmountHash) {
+      return {
+        isValid: false,
+        invalidReason: "encrypted_amount_mismatch",
+        payer: confidentialPayload.authorization.holder
+      };
+    }
+    const chainId = parseInt(requirements.network.split(":")[1]);
+    const isValidSignature = await this.config.signer.verifyTypedData({
+      address: confidentialPayload.authorization.holder,
+      domain: {
+        name: eip712.name,
+        version: eip712.version,
+        chainId,
+        verifyingContract: getAddress(requirements.asset)
+      },
+      types: confidentialPaymentTypes,
+      primaryType: "ConfidentialPayment",
+      message: {
+        holder: getAddress(confidentialPayload.authorization.holder),
+        payee: getAddress(confidentialPayload.authorization.payee),
+        maxClearAmount: BigInt(confidentialPayload.authorization.maxClearAmount),
+        resourceHash: confidentialPayload.authorization.resourceHash,
+        validAfter: BigInt(confidentialPayload.authorization.validAfter),
+        validBefore: BigInt(confidentialPayload.authorization.validBefore),
+        nonce: confidentialPayload.authorization.nonce,
+        encryptedAmountHash: confidentialPayload.authorization.encryptedAmountHash
+      },
+      signature: confidentialPayload.signature
+    });
+    if (!isValidSignature) {
+      return {
+        isValid: false,
+        invalidReason: "invalid_signature",
+        payer: confidentialPayload.authorization.holder
+      };
+    }
+    if (this.checkUsedNonces) {
+      const used = await this.config.signer.readContract({
+        address: getAddress(requirements.asset),
+        abi: confidentialTokenAbi,
+        functionName: "usedNonces",
+        args: [confidentialPayload.authorization.holder, confidentialPayload.authorization.nonce]
+      });
+      if (used) {
+        return {
+          isValid: false,
+          invalidReason: "nonce_already_used",
+          payer: confidentialPayload.authorization.holder
+        };
+      }
+    }
+    return {
+      isValid: true,
+      payer: confidentialPayload.authorization.holder
+    };
+  }
+  async settle(payload, requirements) {
+    const valid = await this.verify(payload, requirements);
+    const confidentialPayload = payload.payload;
+    if (!valid.isValid) {
+      return {
+        success: false,
+        errorReason: valid.invalidReason ?? "invalid_payment",
+        payer: confidentialPayload.authorization.holder,
+        transaction: "",
+        network: requirements.network
+      };
+    }
+    const tokenAddress = getAddress(requirements.asset);
+    const batcherAddress = this.config.batcherAddress ? getAddress(this.config.batcherAddress) : void 0;
+    const txRequest = batcherAddress ? {
+      address: batcherAddress,
+      abi: batcherAbi,
+      functionName: "batchConfidentialTransferWithAuthorization",
+      args: [
+        tokenAddress,
+        [
+          {
+            p: confidentialPayload.authorization,
+            encryptedAmountInput: confidentialPayload.encryptedAmountInput,
+            inputProof: confidentialPayload.inputProof,
+            sig: confidentialPayload.signature
+          }
+        ]
+      ]
+    } : {
+      address: tokenAddress,
+      abi: confidentialTokenAbi,
+      functionName: "confidentialTransferWithAuthorization",
+      args: [
+        confidentialPayload.authorization,
+        confidentialPayload.encryptedAmountInput,
+        confidentialPayload.inputProof,
+        confidentialPayload.signature
+      ]
+    };
+    if (process.env.X402Z_DEBUG === "1") {
+      console.debug("[x402z-facilitator] settle tx", {
+        batcherAddress,
+        tokenAddress,
+        functionName: txRequest.functionName,
+        to: txRequest.address
+      });
+    }
+    const txHash = await this.config.signer.writeContract(txRequest);
+    if (process.env.X402Z_DEBUG === "1") {
+      console.debug("[x402z-facilitator] tx submitted", txHash);
+    }
+    let batchResult;
+    if (this.waitForReceipt) {
+      const receipt = await this.config.signer.waitForTransactionReceipt({
+        hash: txHash
+      });
+      if (process.env.X402Z_DEBUG === "1") {
+        console.debug("[x402z-facilitator] tx receipt", receipt);
+      }
+      if (receipt.status !== "success") {
+        return {
+          success: false,
+          errorReason: "settlement_failed",
+          payer: confidentialPayload.authorization.holder,
+          transaction: txHash,
+          network: requirements.network
+        };
+      }
+      if (batcherAddress) {
+        let batchSucceeded = false;
+        const logs = "logs" in receipt ? receipt.logs ?? [] : [];
+        for (const log of logs) {
+          if (!log || !("address" in log) || !log.address) {
+            continue;
+          }
+          if (!isAddressEqual(getAddress(log.address), batcherAddress)) {
+            continue;
+          }
+          const decoded = decodeEventLog({
+            abi: batcherAbi,
+            data: log.data,
+            topics: log.topics
+          });
+          if (process.env.X402Z_DEBUG === "1") {
+            console.debug("[x402z-facilitator] batch log", decoded);
+          }
+          if (decoded.eventName === "BatchItemSuccess") {
+            const args = decoded.args;
+            if (Number(args.index) === 0) {
+              batchSucceeded = true;
+              batchResult = {
+                index: Number(args.index),
+                success: true,
+                transferredHandle: args.transferredHandle
+              };
+              break;
+            }
+          }
+          if (decoded.eventName === "BatchItemFailure") {
+            const args = decoded.args;
+            if (Number(args.index) === 0) {
+              batchResult = {
+                index: Number(args.index),
+                success: false,
+                failureReason: args.reason
+              };
+              if (process.env.X402Z_DEBUG === "1") {
+                try {
+                  await this.config.signer.readContract({
+                    address: tokenAddress,
+                    abi: confidentialTokenAbi,
+                    functionName: "confidentialTransferWithAuthorization",
+                    args: [
+                      confidentialPayload.authorization,
+                      confidentialPayload.encryptedAmountInput,
+                      confidentialPayload.inputProof,
+                      confidentialPayload.signature
+                    ]
+                  });
+                } catch (innerError) {
+                  console.debug("[x402z-facilitator] batch fallback call failed", innerError);
+                }
+              }
+              return {
+                success: false,
+                errorReason: "settlement_failed",
+                payer: confidentialPayload.authorization.holder,
+                transaction: txHash,
+                network: requirements.network,
+                ...batchResult ? { batch: batchResult } : {}
+              };
+            }
+          }
+        }
+        if (!batchSucceeded) {
+          return {
+            success: false,
+            errorReason: "settlement_failed",
+            payer: confidentialPayload.authorization.holder,
+            transaction: txHash,
+            network: requirements.network,
+            ...batchResult ? { batch: batchResult } : {}
+          };
+        }
+      }
+    }
+    return {
+      success: true,
+      payer: confidentialPayload.authorization.holder,
+      transaction: txHash,
+      network: requirements.network,
+      ...batchResult ? { batch: batchResult } : {}
+    };
+  }
+};
+
+// src/bootstrap.ts
+function requireEnv(key) {
+  const value = process.env[key];
+  if (!value) {
+    throw new Error(`Missing required env var: ${key}`);
+  }
+  return value;
+}
+function createConfidentialFacilitatorFromEnv() {
+  const privateKey = requireEnv("FACILITATOR_EVM_PRIVATE_KEY");
+  const chainId = Number(process.env.FACILITATOR_EVM_CHAIN_ID ?? "11155111");
+  const rpcUrl = requireEnv("FACILITATOR_EVM_RPC_URL");
+  const networks = (process.env.FACILITATOR_NETWORKS ?? "eip155:11155111").split(",").map((network) => network.trim()).filter(Boolean);
+  const waitForReceipt = (process.env.FACILITATOR_WAIT_FOR_RECEIPT ?? "true") === "true";
+  const batcherAddress = process.env.FACILITATOR_BATCHER_ADDRESS;
+  const receiptTimeoutMs = process.env.FACILITATOR_RECEIPT_TIMEOUT_MS ? Number(process.env.FACILITATOR_RECEIPT_TIMEOUT_MS) : void 0;
+  const receiptConfirmations = process.env.FACILITATOR_RECEIPT_CONFIRMATIONS ? Number(process.env.FACILITATOR_RECEIPT_CONFIRMATIONS) : void 0;
+  const receiptPollingIntervalMs = process.env.FACILITATOR_RECEIPT_POLLING_INTERVAL_MS ? Number(process.env.FACILITATOR_RECEIPT_POLLING_INTERVAL_MS) : void 0;
+  const gasMultiplier = process.env.FACILITATOR_GAS_MULTIPLIER ? Number(process.env.FACILITATOR_GAS_MULTIPLIER) : void 0;
+  const debugEnabled = process.env.X402Z_DEBUG === "1";
+  const account = privateKeyToAccount(privateKey);
+  if (debugEnabled) {
+    console.debug("[x402z-facilitator] config", {
+      chainId,
+      networks,
+      rpcUrl,
+      waitForReceipt,
+      batcherAddress,
+      gasMultiplier,
+      receipt: {
+        confirmations: receiptConfirmations,
+        timeoutMs: receiptTimeoutMs,
+        pollingIntervalMs: receiptPollingIntervalMs
+      },
+      address: account.address
+    });
+  }
+  const client = createWalletClient({
+    account,
+    chain: {
+      id: chainId,
+      name: "custom",
+      nativeCurrency: { name: "native", symbol: "NATIVE", decimals: 18 },
+      rpcUrls: { default: { http: [rpcUrl] } }
+    },
+    transport: http(rpcUrl)
+  }).extend(publicActions);
+  const signer = toFacilitatorEvmSigner({
+    address: account.address,
+    readContract: (args) => client.readContract({
+      ...args,
+      args: args.args || []
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    }),
+    verifyTypedData: (args) => client.verifyTypedData(args),
+    writeContract: async (args) => {
+      let gas;
+      if (gasMultiplier && gasMultiplier > 0) {
+        try {
+          const estimated = await client.estimateContractGas({
+            ...args,
+            args: args.args || [],
+            account
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          });
+          const scale = BigInt(Math.round(gasMultiplier * 1e3));
+          const scaled = estimated * scale / 1000n;
+          gas = scaled > estimated ? scaled : estimated;
+        } catch (error) {
+          if (debugEnabled) {
+            console.debug("[x402z-facilitator] gas estimate failed", error);
+          }
+        }
+      }
+      return client.writeContract({
+        ...args,
+        args: args.args || [],
+        ...gas ? { gas } : {}
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      });
+    },
+    sendTransaction: (args) => (
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      client.sendTransaction({ to: args.to, data: args.data })
+    ),
+    waitForTransactionReceipt: (args) => client.waitForTransactionReceipt(args),
+    getCode: (args) => client.getCode(args)
+  });
+  const facilitator = new x402Facilitator();
+  for (const network of networks) {
+    facilitator.register(
+      network,
+      new ConfidentialEvmFacilitator({
+        signer,
+        waitForReceipt,
+        batcherAddress,
+        receipt: {
+          confirmations: receiptConfirmations,
+          timeoutMs: receiptTimeoutMs,
+          pollingIntervalMs: receiptPollingIntervalMs
+        }
+      })
+    );
+  }
+  return facilitator;
+}
+function startConfidentialFacilitator() {
+  const facilitator = createConfidentialFacilitatorFromEnv();
+  const port = Number(process.env.FACILITATOR_PORT ?? "8040");
+  const server = createFacilitatorService({ facilitator, port });
+  server.listen(port);
+  return { port };
+}
+if (__require.main === module) {
+  const { port } = startConfidentialFacilitator();
+  console.log(`Confidential facilitator listening on :${port}`);
+}
+
+export {
+  createFacilitatorService,
+  startFacilitatorService,
+  ConfidentialEvmFacilitator,
+  createConfidentialFacilitatorFromEnv,
+  startConfidentialFacilitator
+};

package/dist/index.d.mts

@@ -7,6 +7,7 @@ export { startConfidentialFacilitator } from './bootstrap.mjs';
 
 type ConfidentialFacilitatorConfig = {
     signer: FacilitatorEvmSigner;
+    batcherAddress?: `0x${string}`;
     hashEncryptedAmountInput?: (encryptedAmountInput: `0x${string}`) => `0x${string}`;
     checkUsedNonces?: boolean;
     clock?: () => number;

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { startConfidentialFacilitator } from './bootstrap.js';
 
 type ConfidentialFacilitatorConfig = {
     signer: FacilitatorEvmSigner;
+    batcherAddress?: `0x${string}`;
     hashEncryptedAmountInput?: (encryptedAmountInput: `0x${string}`) => `0x${string}`;
     checkUsedNonces?: boolean;
     clock?: () => number;

package/dist/index.js

@@ -31,6 +31,63 @@ module.exports = __toCommonJS(index_exports);
 // src/scheme.ts
 var import_viem = require("viem");
 var import_x402z_shared = require("x402z-shared");
+var batcherAbi = [
+  {
+    inputs: [
+      { internalType: "address", name: "token", type: "address" },
+      {
+        components: [
+          {
+            components: [
+              { internalType: "address", name: "holder", type: "address" },
+              { internalType: "address", name: "payee", type: "address" },
+              { internalType: "uint256", name: "maxClearAmount", type: "uint256" },
+              { internalType: "bytes32", name: "resourceHash", type: "bytes32" },
+              { internalType: "uint48", name: "validAfter", type: "uint48" },
+              { internalType: "uint48", name: "validBefore", type: "uint48" },
+              { internalType: "bytes32", name: "nonce", type: "bytes32" },
+              { internalType: "bytes32", name: "encryptedAmountHash", type: "bytes32" }
+            ],
+            internalType: "struct IFHEToken.ConfidentialPayment",
+            name: "p",
+            type: "tuple"
+          },
+          { internalType: "externalEuint64", name: "encryptedAmountInput", type: "bytes32" },
+          { internalType: "bytes", name: "inputProof", type: "bytes" },
+          { internalType: "bytes", name: "sig", type: "bytes" }
+        ],
+        internalType: "struct FHETokenBatcher.Request[]",
+        name: "requests",
+        type: "tuple[]"
+      }
+    ],
+    name: "batchConfidentialTransferWithAuthorization",
+    outputs: [
+      { internalType: "bool[]", name: "successes", type: "bool[]" },
+      { internalType: "bytes32[]", name: "transferredHandles", type: "bytes32[]" }
+    ],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      { indexed: true, internalType: "uint256", name: "index", type: "uint256" },
+      { indexed: false, internalType: "bytes32", name: "transferredHandle", type: "bytes32" }
+    ],
+    name: "BatchItemSuccess",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      { indexed: true, internalType: "uint256", name: "index", type: "uint256" },
+      { indexed: false, internalType: "bytes", name: "reason", type: "bytes" }
+    ],
+    name: "BatchItemFailure",
+    type: "event"
+  }
+];
 var ConfidentialEvmFacilitator = class {
   constructor(config) {
     this.config = config;
@@ -167,8 +224,25 @@ var ConfidentialEvmFacilitator = class {
         network: requirements.network
       };
     }
-    const txHash = await this.config.signer.writeContract({
-      address: (0, import_viem.getAddress)(requirements.asset),
+    const tokenAddress = (0, import_viem.getAddress)(requirements.asset);
+    const batcherAddress = this.config.batcherAddress ? (0, import_viem.getAddress)(this.config.batcherAddress) : void 0;
+    const txRequest = batcherAddress ? {
+      address: batcherAddress,
+      abi: batcherAbi,
+      functionName: "batchConfidentialTransferWithAuthorization",
+      args: [
+        tokenAddress,
+        [
+          {
+            p: confidentialPayload.authorization,
+            encryptedAmountInput: confidentialPayload.encryptedAmountInput,
+            inputProof: confidentialPayload.inputProof,
+            sig: confidentialPayload.signature
+          }
+        ]
+      ]
+    } : {
+      address: tokenAddress,
       abi: import_x402z_shared.confidentialTokenAbi,
       functionName: "confidentialTransferWithAuthorization",
       args: [
@@ -177,10 +251,20 @@ var ConfidentialEvmFacilitator = class {
         confidentialPayload.inputProof,
         confidentialPayload.signature
       ]
-    });
+    };
+    if (process.env.X402Z_DEBUG === "1") {
+      console.debug("[x402z-facilitator] settle tx", {
+        batcherAddress,
+        tokenAddress,
+        functionName: txRequest.functionName,
+        to: txRequest.address
+      });
+    }
+    const txHash = await this.config.signer.writeContract(txRequest);
     if (process.env.X402Z_DEBUG === "1") {
       console.debug("[x402z-facilitator] tx submitted", txHash);
     }
+    let batchResult;
     if (this.waitForReceipt) {
       const receipt = await this.config.signer.waitForTransactionReceipt({
         hash: txHash
@@ -197,12 +281,90 @@ var ConfidentialEvmFacilitator = class {
           network: requirements.network
         };
       }
+      if (batcherAddress) {
+        let batchSucceeded = false;
+        const logs = "logs" in receipt ? receipt.logs ?? [] : [];
+        for (const log of logs) {
+          if (!log || !("address" in log) || !log.address) {
+            continue;
+          }
+          if (!(0, import_viem.isAddressEqual)((0, import_viem.getAddress)(log.address), batcherAddress)) {
+            continue;
+          }
+          const decoded = (0, import_viem.decodeEventLog)({
+            abi: batcherAbi,
+            data: log.data,
+            topics: log.topics
+          });
+          if (process.env.X402Z_DEBUG === "1") {
+            console.debug("[x402z-facilitator] batch log", decoded);
+          }
+          if (decoded.eventName === "BatchItemSuccess") {
+            const args = decoded.args;
+            if (Number(args.index) === 0) {
+              batchSucceeded = true;
+              batchResult = {
+                index: Number(args.index),
+                success: true,
+                transferredHandle: args.transferredHandle
+              };
+              break;
+            }
+          }
+          if (decoded.eventName === "BatchItemFailure") {
+            const args = decoded.args;
+            if (Number(args.index) === 0) {
+              batchResult = {
+                index: Number(args.index),
+                success: false,
+                failureReason: args.reason
+              };
+              if (process.env.X402Z_DEBUG === "1") {
+                try {
+                  await this.config.signer.readContract({
+                    address: tokenAddress,
+                    abi: import_x402z_shared.confidentialTokenAbi,
+                    functionName: "confidentialTransferWithAuthorization",
+                    args: [
+                      confidentialPayload.authorization,
+                      confidentialPayload.encryptedAmountInput,
+                      confidentialPayload.inputProof,
+                      confidentialPayload.signature
+                    ]
+                  });
+                } catch (innerError) {
+                  console.debug("[x402z-facilitator] batch fallback call failed", innerError);
+                }
+              }
+              return {
+                success: false,
+                errorReason: "settlement_failed",
+                payer: confidentialPayload.authorization.holder,
+                transaction: txHash,
+                network: requirements.network,
+                ...batchResult ? { batch: batchResult } : {}
+              };
+            }
+          }
+        }
+        if (!batchSucceeded) {
+          return {
+            success: false,
+            errorReason: "settlement_failed",
+            payer: confidentialPayload.authorization.holder,
+            transaction: txHash,
+            network: requirements.network,
+            ...batchResult ? { batch: batchResult } : {}
+          };
+        }
+      }
     }
     return {
       success: true,
       payer: confidentialPayload.authorization.holder,
       transaction: txHash,
-      network: requirements.network
+      network: requirements.network,
+      ...batchResult ? { batch: batchResult } : {}
     };
   }
 };
@@ -292,9 +454,11 @@ function createConfidentialFacilitatorFromEnv() {
   const rpcUrl = requireEnv("FACILITATOR_EVM_RPC_URL");
   const networks = (process.env.FACILITATOR_NETWORKS ?? "eip155:11155111").split(",").map((network) => network.trim()).filter(Boolean);
   const waitForReceipt = (process.env.FACILITATOR_WAIT_FOR_RECEIPT ?? "true") === "true";
+  const batcherAddress = process.env.FACILITATOR_BATCHER_ADDRESS;
   const receiptTimeoutMs = process.env.FACILITATOR_RECEIPT_TIMEOUT_MS ? Number(process.env.FACILITATOR_RECEIPT_TIMEOUT_MS) : void 0;
   const receiptConfirmations = process.env.FACILITATOR_RECEIPT_CONFIRMATIONS ? Number(process.env.FACILITATOR_RECEIPT_CONFIRMATIONS) : void 0;
   const receiptPollingIntervalMs = process.env.FACILITATOR_RECEIPT_POLLING_INTERVAL_MS ? Number(process.env.FACILITATOR_RECEIPT_POLLING_INTERVAL_MS) : void 0;
+  const gasMultiplier = process.env.FACILITATOR_GAS_MULTIPLIER ? Number(process.env.FACILITATOR_GAS_MULTIPLIER) : void 0;
   const debugEnabled = process.env.X402Z_DEBUG === "1";
   const account = (0, import_accounts.privateKeyToAccount)(privateKey);
   if (debugEnabled) {
@@ -303,6 +467,8 @@ function createConfidentialFacilitatorFromEnv() {
       networks,
       rpcUrl,
       waitForReceipt,
+      batcherAddress,
+      gasMultiplier,
       receipt: {
         confirmations: receiptConfirmations,
         timeoutMs: receiptTimeoutMs,
@@ -329,11 +495,32 @@ function createConfidentialFacilitatorFromEnv() {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     }),
     verifyTypedData: (args) => client.verifyTypedData(args),
-    writeContract: (args) => client.writeContract({
-      ...args,
-      args: args.args || []
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    }),
+    writeContract: async (args) => {
+      let gas;
+      if (gasMultiplier && gasMultiplier > 0) {
+        try {
+          const estimated = await client.estimateContractGas({
+            ...args,
+            args: args.args || [],
+            account
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          });
+          const scale = BigInt(Math.round(gasMultiplier * 1e3));
+          const scaled = estimated * scale / 1000n;
+          gas = scaled > estimated ? scaled : estimated;
+        } catch (error) {
+          if (debugEnabled) {
+            console.debug("[x402z-facilitator] gas estimate failed", error);
+          }
+        }
+      }
+      return client.writeContract({
+        ...args,
+        args: args.args || [],
+        ...gas ? { gas } : {}
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      });
+    },
     sendTransaction: (args) => (
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       client.sendTransaction({ to: args.to, data: args.data })
@@ -348,6 +535,7 @@ function createConfidentialFacilitatorFromEnv() {
       new ConfidentialEvmFacilitator({
         signer,
         waitForReceipt,
+        batcherAddress,
         receipt: {
           confirmations: receiptConfirmations,
           timeoutMs: receiptTimeoutMs,

package/dist/index.mjs

@@ -3,7 +3,7 @@ import {
   createFacilitatorService,
   startConfidentialFacilitator,
   startFacilitatorService
-} from "./chunk-H6QEA2EB.mjs";
+} from "./chunk-4UDK7NYX.mjs";
 
 // src/register.ts
 function registerConfidentialEvmScheme(facilitator, config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402z-facilitator",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
@@ -11,7 +11,7 @@
     "@x402/core": "^2.0.0",
     "@x402/evm": "^2.0.0",
     "viem": "^2.39.3",
-    "x402z-shared": "0.0.3"
+    "x402z-shared": "0.0.4"
   },
   "devDependencies": {
     "jest": "^29.7.0",