xytara 3.1.13 → 3.1.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (68) hide show
  1. package/.env.example +38 -4
  2. package/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md +126 -126
  3. package/REAL_PAYMENT_SETUP.md +14 -7
  4. package/RELEASE_NOTES.md +9 -4
  5. package/fixtures/catalog.js +22 -0
  6. package/lib/a2a_rpc.js +287 -280
  7. package/lib/account_auth.js +585 -585
  8. package/lib/agent_identity.js +162 -162
  9. package/lib/asyncapi_contract.js +3 -3
  10. package/lib/bolt_adapter.js +187 -187
  11. package/lib/bolt_payment_front.js +224 -224
  12. package/lib/buyer_event_log.js +215 -0
  13. package/lib/buyer_safety_policy.js +132 -0
  14. package/lib/checkout_processor_adapter.js +217 -217
  15. package/lib/command_flow.js +911 -722
  16. package/lib/commerce_artifacts.js +591 -591
  17. package/lib/commerce_bridge.js +274 -274
  18. package/lib/commerce_cases.js +399 -399
  19. package/lib/commerce_client.js +7694 -7694
  20. package/lib/commerce_quotes.js +29 -0
  21. package/lib/commerce_runtime.js +322 -322
  22. package/lib/execution_dedupe.js +86 -86
  23. package/lib/external_credit_bridge.js +142 -142
  24. package/lib/http_transport.js +99 -81
  25. package/lib/l402_adapter.js +241 -241
  26. package/lib/l402_payment_front.js +265 -265
  27. package/lib/mpp_adapter.js +237 -237
  28. package/lib/openapi_contract.js +4 -0
  29. package/lib/payment_config.js +257 -253
  30. package/lib/payment_verification.js +357 -357
  31. package/lib/provider_payout_execution.js +155 -155
  32. package/lib/provider_registry.js +852 -842
  33. package/lib/rate_limiter.js +81 -81
  34. package/lib/runtime_state_store.js +495 -369
  35. package/lib/settlement_bsv_live.js +600 -600
  36. package/lib/settlement_bsv_teranode.js +117 -117
  37. package/lib/stripe_mpp_payment_front.js +258 -258
  38. package/lib/x402_facilitator.js +198 -191
  39. package/lib/x402_lane_contract.js +5 -3
  40. package/lib/x402_settlement_recovery.js +175 -0
  41. package/package.json +9 -3
  42. package/scripts/buyer_events_daily_report.js +79 -0
  43. package/scripts/state_backup_offsite.js +196 -0
  44. package/scripts/verify_a2a_rpc.js +131 -105
  45. package/scripts/verify_agent_identity.js +153 -153
  46. package/scripts/verify_all.js +1 -1
  47. package/scripts/verify_bolt_adapter.js +128 -128
  48. package/scripts/verify_buyer_event_log.js +123 -0
  49. package/scripts/verify_buyer_safety.js +141 -0
  50. package/scripts/verify_cdp_facilitator.js +110 -110
  51. package/scripts/verify_checkout_processor.js +109 -109
  52. package/scripts/verify_commerce_bridge.js +177 -177
  53. package/scripts/verify_execution_dedupe.js +189 -189
  54. package/scripts/verify_execution_surfacing.js +76 -76
  55. package/scripts/verify_final_activation.js +191 -191
  56. package/scripts/verify_l402_adapter.js +86 -86
  57. package/scripts/verify_lifecycle_spend_binding.js +88 -0
  58. package/scripts/verify_mpp_adapter.js +128 -128
  59. package/scripts/verify_production_readiness.js +268 -268
  60. package/scripts/verify_rate_limiter.js +52 -52
  61. package/scripts/verify_refund_credit.js +106 -106
  62. package/scripts/verify_release_candidate.js +81 -81
  63. package/scripts/verify_runtime_state_guard.js +117 -0
  64. package/scripts/verify_service.js +15421 -15421
  65. package/scripts/verify_verify_execute_settle.js +209 -208
  66. package/scripts/verify_x402_facilitator.js +307 -286
  67. package/scripts/verify_x402_settlement_recovery.js +153 -0
  68. package/server.js +12242 -11974
@@ -1,253 +1,257 @@
1
- "use strict";
2
-
3
- const fs = require("fs");
4
- const {
5
- buildBsvTeranodeTreasuryDestination,
6
- normalizeSettlementMode
7
- } = require("./settlement_bsv_teranode");
8
-
9
- function safeParseJson(text, fallback) {
10
- try {
11
- return JSON.parse(text);
12
- } catch (_) {
13
- return fallback;
14
- }
15
- }
16
-
17
- function readJsonFromEnvOrPath(jsonValue, pathValue, fallback) {
18
- if (typeof jsonValue === "string" && jsonValue.trim()) {
19
- return safeParseJson(jsonValue, fallback);
20
- }
21
- if (typeof pathValue === "string" && pathValue.trim()) {
22
- try {
23
- return safeParseJson(fs.readFileSync(pathValue, "utf8"), fallback);
24
- } catch (_) {
25
- return fallback;
26
- }
27
- }
28
- return fallback;
29
- }
30
-
31
- function loadWalletRegistry() {
32
- const raw = readJsonFromEnvOrPath(
33
- process.env.XYTARA_WALLET_REGISTRY_JSON,
34
- process.env.XYTARA_WALLET_REGISTRY_PATH,
35
- []
36
- );
37
- const entries = Array.isArray(raw)
38
- ? raw
39
- : Array.isArray(raw && raw.wallets) ? raw.wallets : [];
40
- const byWalletId = new Map();
41
- for (const entry of entries) {
42
- if (!entry || typeof entry !== "object") continue;
43
- const walletId = typeof entry.wallet_id === "string" ? entry.wallet_id.trim() : "";
44
- const secret = typeof entry.secret === "string" ? entry.secret : "";
45
- if (!walletId || !secret) continue;
46
- byWalletId.set(walletId, {
47
- wallet_id: walletId,
48
- secret,
49
- account_id: typeof entry.account_id === "string" && entry.account_id.trim() ? entry.account_id.trim() : null,
50
- enabled: entry.enabled !== false
51
- });
52
- }
53
- return byWalletId;
54
- }
55
-
56
- function loadTreasuryDestinationMap() {
57
- const raw = readJsonFromEnvOrPath(
58
- process.env.XYTARA_TREASURY_DESTINATIONS_JSON,
59
- process.env.XYTARA_TREASURY_DESTINATIONS_PATH,
60
- {}
61
- );
62
- const input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
63
- const normalized = {};
64
- for (const [settlementMode, entry] of Object.entries(input)) {
65
- if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
66
- normalized[normalizeSettlementMode(settlementMode)] = {
67
- destination_id: typeof entry.destination_id === "string" && entry.destination_id.trim()
68
- ? entry.destination_id.trim()
69
- : null,
70
- destination_kind: typeof entry.destination_kind === "string" && entry.destination_kind.trim()
71
- ? entry.destination_kind.trim()
72
- : null,
73
- account_id: typeof entry.account_id === "string" && entry.account_id.trim()
74
- ? entry.account_id.trim()
75
- : null,
76
- external_ref: typeof entry.external_ref === "string" && entry.external_ref.trim()
77
- ? entry.external_ref.trim()
78
- : null,
79
- custody_ref: typeof entry.custody_ref === "string" && entry.custody_ref.trim()
80
- ? entry.custody_ref.trim()
81
- : null,
82
- reporting_ref: typeof entry.reporting_ref === "string" && entry.reporting_ref.trim()
83
- ? entry.reporting_ref.trim()
84
- : null,
85
- wallet_ref: typeof entry.wallet_ref === "string" && entry.wallet_ref.trim()
86
- ? entry.wallet_ref.trim()
87
- : null,
88
- provider_ref: typeof entry.provider_ref === "string" && entry.provider_ref.trim()
89
- ? entry.provider_ref.trim()
90
- : null,
91
- network: typeof entry.network === "string" && entry.network.trim()
92
- ? entry.network.trim()
93
- : null,
94
- chain_id: typeof entry.chain_id === "string" && entry.chain_id.trim()
95
- ? entry.chain_id.trim()
96
- : null,
97
- asset_symbol: typeof entry.asset_symbol === "string" && entry.asset_symbol.trim()
98
- ? entry.asset_symbol.trim()
99
- : null,
100
- policy_scope: typeof entry.policy_scope === "string" && entry.policy_scope.trim()
101
- ? entry.policy_scope.trim()
102
- : null,
103
- storage_class: typeof entry.storage_class === "string" && entry.storage_class.trim()
104
- ? entry.storage_class.trim()
105
- : null,
106
- enabled: entry.enabled !== false,
107
- accept_inbound: entry.accept_inbound !== false
108
- };
109
- }
110
- return normalized;
111
- }
112
-
113
- function loadPaymentConfig() {
114
- // Default is fail-closed: signed payment acceptance. "presence" (accept any non-empty payment header)
115
- // must now be opted into explicitly and is only appropriate for local development.
116
- const verificationModeInput = String(process.env.XYTARA_PAYMENT_VERIFICATION_MODE || "local_signed").trim() || "local_signed";
117
- const verificationMode = verificationModeInput === "signed" ? "local_signed" : verificationModeInput;
118
- const maxAgeSeconds = Number(process.env.XYTARA_PAYMENT_MAX_AGE_SECONDS || 300);
119
- return {
120
- verification_mode: verificationMode,
121
- verification_mode_input: verificationModeInput,
122
- payment_max_age_seconds: Number.isFinite(maxAgeSeconds) && maxAgeSeconds > 0 ? maxAgeSeconds : 300,
123
- wallet_registry: loadWalletRegistry(),
124
- x402: loadX402FacilitatorConfig(),
125
- treasury_destination_id: String(process.env.XYTARA_TREASURY_DESTINATION_ID || "").trim() || null,
126
- treasury_destination_kind: String(process.env.XYTARA_TREASURY_DESTINATION_KIND || "").trim() || null,
127
- treasury_account_id: String(process.env.XYTARA_TREASURY_ACCOUNT_ID || "").trim() || null,
128
- treasury_external_ref: String(process.env.XYTARA_TREASURY_EXTERNAL_REF || "").trim() || null,
129
- treasury_destinations_by_settlement_mode: loadTreasuryDestinationMap()
130
- };
131
- }
132
-
133
- // Configuration for the x402_facilitator verification mode: the on-chain, trustless
134
- // pay-per-call path. The advertised accepts tell a buyer how to pay; the facilitator
135
- // verifies and settles the signed payment before any work runs.
136
- function loadX402FacilitatorConfig() {
137
- let accepts = [];
138
- const rawAccepts = String(process.env.XYTARA_X402_ACCEPTS_JSON || "").trim();
139
- if (rawAccepts) {
140
- try {
141
- const parsed = JSON.parse(rawAccepts);
142
- if (Array.isArray(parsed)) {
143
- accepts = parsed
144
- .map((entry) => ({
145
- scheme: String((entry && entry.scheme) || "exact").trim(),
146
- network: String((entry && entry.network) || "").trim(),
147
- asset: String((entry && entry.asset) || "").trim(),
148
- amount: String((entry && entry.amount) || "").trim(),
149
- payTo: String((entry && entry.payTo) || "").trim(),
150
- ...(entry && entry.extra && typeof entry.extra === "object" ? { extra: entry.extra } : {}),
151
- ...(Number(entry && entry.maxTimeoutSeconds) > 0 ? { maxTimeoutSeconds: Number(entry.maxTimeoutSeconds) } : {})
152
- }))
153
- .filter((entry) => entry.network && entry.asset && entry.amount && entry.payTo);
154
- }
155
- } catch (_) {
156
- accepts = [];
157
- }
158
- }
159
- let headers = {};
160
- const rawHeaders = String(process.env.XYTARA_X402_FACILITATOR_HEADERS_JSON || "").trim();
161
- if (rawHeaders) {
162
- try {
163
- const parsed = JSON.parse(rawHeaders);
164
- if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) headers = parsed;
165
- } catch (_) {
166
- headers = {};
167
- }
168
- }
169
- return {
170
- accepts,
171
- facilitator_url: String(process.env.XYTARA_X402_FACILITATOR_URL || "https://x402.org/facilitator").trim().replace(/\/$/, ""),
172
- facilitator_headers: headers,
173
- facilitator_timeout_ms: Math.max(1000, Number(process.env.XYTARA_X402_FACILITATOR_TIMEOUT_MS || 15000) || 15000),
174
- settle: String(process.env.XYTARA_X402_SETTLE || "true").trim().toLowerCase() !== "false",
175
- // Credit units a single self-serve x402 top-up grants, unless the matched accepts
176
- // entry carries its own `extra.credits`.
177
- topup_units_default: Math.max(0, Number(process.env.XYTARA_X402_TOPUP_UNITS || 1000) || 0),
178
- // Optional Coinbase CDP auth for the CDP-hosted facilitator (Base mainnet). When both a
179
- // key id and secret are present, the facilitator client mints a fresh EdDSA Bearer JWT
180
- // per request. Accepts the CDP-standard env names or XYTARA_X402_CDP_* overrides.
181
- cdp: loadCdpFacilitatorAuth()
182
- };
183
- }
184
-
185
- function loadCdpFacilitatorAuth() {
186
- const keyId = String(process.env.XYTARA_X402_CDP_KEY_ID || process.env.CDP_API_KEY_ID || "").trim();
187
- const keySecret = String(process.env.XYTARA_X402_CDP_KEY_SECRET || process.env.CDP_API_KEY_SECRET || "").trim();
188
- if (!keyId || !keySecret) return null;
189
- return { key_id: keyId, key_secret: keySecret };
190
- }
191
-
192
- function buildConfiguredTreasuryDestination(accountId, settlementMode) {
193
- const config = loadPaymentConfig();
194
- const normalizedSettlementMode = normalizeSettlementMode(settlementMode);
195
- const mapEntry = normalizedSettlementMode && config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
196
- ? config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
197
- : null;
198
- const destinationId = mapEntry && typeof mapEntry.destination_id === "string" && mapEntry.destination_id.trim()
199
- ? mapEntry.destination_id.trim()
200
- : config.treasury_destination_id;
201
- if (!destinationId) {
202
- return buildBsvTeranodeTreasuryDestination(accountId, normalizedSettlementMode);
203
- }
204
- return {
205
- destination_id: destinationId,
206
- destination_kind:
207
- (mapEntry && typeof mapEntry.destination_kind === "string" && mapEntry.destination_kind.trim())
208
- || config.treasury_destination_kind
209
- || "merchant_treasury",
210
- account_id:
211
- (mapEntry && typeof mapEntry.account_id === "string" && mapEntry.account_id.trim())
212
- || config.treasury_account_id
213
- || accountId
214
- || null,
215
- settlement_mode: normalizedSettlementMode || null,
216
- external_ref:
217
- (mapEntry && typeof mapEntry.external_ref === "string" && mapEntry.external_ref.trim())
218
- || config.treasury_external_ref
219
- || null,
220
- custody_ref: mapEntry && typeof mapEntry.custody_ref === "string" && mapEntry.custody_ref.trim()
221
- ? mapEntry.custody_ref.trim()
222
- : null,
223
- reporting_ref: mapEntry && typeof mapEntry.reporting_ref === "string" && mapEntry.reporting_ref.trim()
224
- ? mapEntry.reporting_ref.trim()
225
- : null,
226
- wallet_ref: mapEntry && typeof mapEntry.wallet_ref === "string" && mapEntry.wallet_ref.trim()
227
- ? mapEntry.wallet_ref.trim()
228
- : null,
229
- provider_ref: mapEntry && typeof mapEntry.provider_ref === "string" && mapEntry.provider_ref.trim()
230
- ? mapEntry.provider_ref.trim()
231
- : null,
232
- network: mapEntry && typeof mapEntry.network === "string" && mapEntry.network.trim()
233
- ? mapEntry.network.trim()
234
- : null,
235
- chain_id: mapEntry && typeof mapEntry.chain_id === "string" && mapEntry.chain_id.trim()
236
- ? mapEntry.chain_id.trim()
237
- : null,
238
- asset_symbol: mapEntry && typeof mapEntry.asset_symbol === "string" && mapEntry.asset_symbol.trim()
239
- ? mapEntry.asset_symbol.trim()
240
- : null,
241
- policy_scope: mapEntry && typeof mapEntry.policy_scope === "string" && mapEntry.policy_scope.trim()
242
- ? mapEntry.policy_scope.trim()
243
- : null,
244
- storage_class: mapEntry && typeof mapEntry.storage_class === "string" && mapEntry.storage_class.trim()
245
- ? mapEntry.storage_class.trim()
246
- : null
247
- };
248
- }
249
-
250
- module.exports = {
251
- buildConfiguredTreasuryDestination,
252
- loadPaymentConfig
253
- };
1
+ "use strict";
2
+
3
+ const fs = require("fs");
4
+ const {
5
+ buildBsvTeranodeTreasuryDestination,
6
+ normalizeSettlementMode
7
+ } = require("./settlement_bsv_teranode");
8
+
9
+ function safeParseJson(text, fallback) {
10
+ try {
11
+ return JSON.parse(text);
12
+ } catch (_) {
13
+ return fallback;
14
+ }
15
+ }
16
+
17
+ function readJsonFromEnvOrPath(jsonValue, pathValue, fallback) {
18
+ if (typeof jsonValue === "string" && jsonValue.trim()) {
19
+ return safeParseJson(jsonValue, fallback);
20
+ }
21
+ if (typeof pathValue === "string" && pathValue.trim()) {
22
+ try {
23
+ return safeParseJson(fs.readFileSync(pathValue, "utf8"), fallback);
24
+ } catch (_) {
25
+ return fallback;
26
+ }
27
+ }
28
+ return fallback;
29
+ }
30
+
31
+ function loadWalletRegistry() {
32
+ const raw = readJsonFromEnvOrPath(
33
+ process.env.XYTARA_WALLET_REGISTRY_JSON,
34
+ process.env.XYTARA_WALLET_REGISTRY_PATH,
35
+ []
36
+ );
37
+ const entries = Array.isArray(raw)
38
+ ? raw
39
+ : Array.isArray(raw && raw.wallets) ? raw.wallets : [];
40
+ const byWalletId = new Map();
41
+ for (const entry of entries) {
42
+ if (!entry || typeof entry !== "object") continue;
43
+ const walletId = typeof entry.wallet_id === "string" ? entry.wallet_id.trim() : "";
44
+ const secret = typeof entry.secret === "string" ? entry.secret : "";
45
+ if (!walletId || !secret) continue;
46
+ byWalletId.set(walletId, {
47
+ wallet_id: walletId,
48
+ secret,
49
+ account_id: typeof entry.account_id === "string" && entry.account_id.trim() ? entry.account_id.trim() : null,
50
+ enabled: entry.enabled !== false
51
+ });
52
+ }
53
+ return byWalletId;
54
+ }
55
+
56
+ function loadTreasuryDestinationMap() {
57
+ const raw = readJsonFromEnvOrPath(
58
+ process.env.XYTARA_TREASURY_DESTINATIONS_JSON,
59
+ process.env.XYTARA_TREASURY_DESTINATIONS_PATH,
60
+ {}
61
+ );
62
+ const input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
63
+ const normalized = {};
64
+ for (const [settlementMode, entry] of Object.entries(input)) {
65
+ if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
66
+ normalized[normalizeSettlementMode(settlementMode)] = {
67
+ destination_id: typeof entry.destination_id === "string" && entry.destination_id.trim()
68
+ ? entry.destination_id.trim()
69
+ : null,
70
+ destination_kind: typeof entry.destination_kind === "string" && entry.destination_kind.trim()
71
+ ? entry.destination_kind.trim()
72
+ : null,
73
+ account_id: typeof entry.account_id === "string" && entry.account_id.trim()
74
+ ? entry.account_id.trim()
75
+ : null,
76
+ external_ref: typeof entry.external_ref === "string" && entry.external_ref.trim()
77
+ ? entry.external_ref.trim()
78
+ : null,
79
+ custody_ref: typeof entry.custody_ref === "string" && entry.custody_ref.trim()
80
+ ? entry.custody_ref.trim()
81
+ : null,
82
+ reporting_ref: typeof entry.reporting_ref === "string" && entry.reporting_ref.trim()
83
+ ? entry.reporting_ref.trim()
84
+ : null,
85
+ wallet_ref: typeof entry.wallet_ref === "string" && entry.wallet_ref.trim()
86
+ ? entry.wallet_ref.trim()
87
+ : null,
88
+ provider_ref: typeof entry.provider_ref === "string" && entry.provider_ref.trim()
89
+ ? entry.provider_ref.trim()
90
+ : null,
91
+ network: typeof entry.network === "string" && entry.network.trim()
92
+ ? entry.network.trim()
93
+ : null,
94
+ chain_id: typeof entry.chain_id === "string" && entry.chain_id.trim()
95
+ ? entry.chain_id.trim()
96
+ : null,
97
+ asset_symbol: typeof entry.asset_symbol === "string" && entry.asset_symbol.trim()
98
+ ? entry.asset_symbol.trim()
99
+ : null,
100
+ policy_scope: typeof entry.policy_scope === "string" && entry.policy_scope.trim()
101
+ ? entry.policy_scope.trim()
102
+ : null,
103
+ storage_class: typeof entry.storage_class === "string" && entry.storage_class.trim()
104
+ ? entry.storage_class.trim()
105
+ : null,
106
+ enabled: entry.enabled !== false,
107
+ accept_inbound: entry.accept_inbound !== false
108
+ };
109
+ }
110
+ return normalized;
111
+ }
112
+
113
+ function loadPaymentConfig() {
114
+ // Default is fail-closed: signed payment acceptance. "presence" (accept any non-empty payment header)
115
+ // must now be opted into explicitly and is only appropriate for local development.
116
+ const verificationModeInput = String(process.env.XYTARA_PAYMENT_VERIFICATION_MODE || "local_signed").trim() || "local_signed";
117
+ const verificationMode = verificationModeInput === "signed" ? "local_signed" : verificationModeInput;
118
+ const maxAgeSeconds = Number(process.env.XYTARA_PAYMENT_MAX_AGE_SECONDS || 300);
119
+ return {
120
+ verification_mode: verificationMode,
121
+ verification_mode_input: verificationModeInput,
122
+ payment_max_age_seconds: Number.isFinite(maxAgeSeconds) && maxAgeSeconds > 0 ? maxAgeSeconds : 300,
123
+ wallet_registry: loadWalletRegistry(),
124
+ x402: loadX402FacilitatorConfig(),
125
+ treasury_destination_id: String(process.env.XYTARA_TREASURY_DESTINATION_ID || "").trim() || null,
126
+ treasury_destination_kind: String(process.env.XYTARA_TREASURY_DESTINATION_KIND || "").trim() || null,
127
+ treasury_account_id: String(process.env.XYTARA_TREASURY_ACCOUNT_ID || "").trim() || null,
128
+ treasury_external_ref: String(process.env.XYTARA_TREASURY_EXTERNAL_REF || "").trim() || null,
129
+ treasury_destinations_by_settlement_mode: loadTreasuryDestinationMap()
130
+ };
131
+ }
132
+
133
+ // Configuration for the x402_facilitator verification mode: the on-chain, trustless
134
+ // pay-per-call path. The advertised accepts tell a buyer how to pay; the facilitator
135
+ // verifies and settles the signed payment before any work runs.
136
+ function loadX402FacilitatorConfig() {
137
+ // A buyer signs validBefore = now + maxTimeoutSeconds. It must outlive verify + execution (up to
138
+ // the 50 s budget, plus a provider cold start) + settle, or a slow-but-successful call can't
139
+ // settle. Configured values below the floor are raised to it.
140
+ const minTimeoutSeconds = Math.max(60, Number(process.env.XYTARA_X402_MIN_TIMEOUT_SECONDS || 300) || 300);
141
+ let accepts = [];
142
+ const rawAccepts = String(process.env.XYTARA_X402_ACCEPTS_JSON || "").trim();
143
+ if (rawAccepts) {
144
+ try {
145
+ const parsed = JSON.parse(rawAccepts);
146
+ if (Array.isArray(parsed)) {
147
+ accepts = parsed
148
+ .map((entry) => ({
149
+ scheme: String((entry && entry.scheme) || "exact").trim(),
150
+ network: String((entry && entry.network) || "").trim(),
151
+ asset: String((entry && entry.asset) || "").trim(),
152
+ amount: String((entry && entry.amount) || "").trim(),
153
+ payTo: String((entry && entry.payTo) || "").trim(),
154
+ ...(entry && entry.extra && typeof entry.extra === "object" ? { extra: entry.extra } : {}),
155
+ maxTimeoutSeconds: Math.max(minTimeoutSeconds, Number(entry && entry.maxTimeoutSeconds) || 0)
156
+ }))
157
+ .filter((entry) => entry.network && entry.asset && entry.amount && entry.payTo);
158
+ }
159
+ } catch (_) {
160
+ accepts = [];
161
+ }
162
+ }
163
+ let headers = {};
164
+ const rawHeaders = String(process.env.XYTARA_X402_FACILITATOR_HEADERS_JSON || "").trim();
165
+ if (rawHeaders) {
166
+ try {
167
+ const parsed = JSON.parse(rawHeaders);
168
+ if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) headers = parsed;
169
+ } catch (_) {
170
+ headers = {};
171
+ }
172
+ }
173
+ return {
174
+ accepts,
175
+ facilitator_url: String(process.env.XYTARA_X402_FACILITATOR_URL || "https://x402.org/facilitator").trim().replace(/\/$/, ""),
176
+ facilitator_headers: headers,
177
+ facilitator_timeout_ms: Math.max(1000, Number(process.env.XYTARA_X402_FACILITATOR_TIMEOUT_MS || 15000) || 15000),
178
+ settle: String(process.env.XYTARA_X402_SETTLE || "true").trim().toLowerCase() !== "false",
179
+ // Credit units a single self-serve x402 top-up grants, unless the matched accepts
180
+ // entry carries its own `extra.credits`.
181
+ topup_units_default: Math.max(0, Number(process.env.XYTARA_X402_TOPUP_UNITS || 1000) || 0),
182
+ // Optional Coinbase CDP auth for the CDP-hosted facilitator (Base mainnet). When both a
183
+ // key id and secret are present, the facilitator client mints a fresh EdDSA Bearer JWT
184
+ // per request. Accepts the CDP-standard env names or XYTARA_X402_CDP_* overrides.
185
+ cdp: loadCdpFacilitatorAuth()
186
+ };
187
+ }
188
+
189
+ function loadCdpFacilitatorAuth() {
190
+ const keyId = String(process.env.XYTARA_X402_CDP_KEY_ID || process.env.CDP_API_KEY_ID || "").trim();
191
+ const keySecret = String(process.env.XYTARA_X402_CDP_KEY_SECRET || process.env.CDP_API_KEY_SECRET || "").trim();
192
+ if (!keyId || !keySecret) return null;
193
+ return { key_id: keyId, key_secret: keySecret };
194
+ }
195
+
196
+ function buildConfiguredTreasuryDestination(accountId, settlementMode) {
197
+ const config = loadPaymentConfig();
198
+ const normalizedSettlementMode = normalizeSettlementMode(settlementMode);
199
+ const mapEntry = normalizedSettlementMode && config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
200
+ ? config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
201
+ : null;
202
+ const destinationId = mapEntry && typeof mapEntry.destination_id === "string" && mapEntry.destination_id.trim()
203
+ ? mapEntry.destination_id.trim()
204
+ : config.treasury_destination_id;
205
+ if (!destinationId) {
206
+ return buildBsvTeranodeTreasuryDestination(accountId, normalizedSettlementMode);
207
+ }
208
+ return {
209
+ destination_id: destinationId,
210
+ destination_kind:
211
+ (mapEntry && typeof mapEntry.destination_kind === "string" && mapEntry.destination_kind.trim())
212
+ || config.treasury_destination_kind
213
+ || "merchant_treasury",
214
+ account_id:
215
+ (mapEntry && typeof mapEntry.account_id === "string" && mapEntry.account_id.trim())
216
+ || config.treasury_account_id
217
+ || accountId
218
+ || null,
219
+ settlement_mode: normalizedSettlementMode || null,
220
+ external_ref:
221
+ (mapEntry && typeof mapEntry.external_ref === "string" && mapEntry.external_ref.trim())
222
+ || config.treasury_external_ref
223
+ || null,
224
+ custody_ref: mapEntry && typeof mapEntry.custody_ref === "string" && mapEntry.custody_ref.trim()
225
+ ? mapEntry.custody_ref.trim()
226
+ : null,
227
+ reporting_ref: mapEntry && typeof mapEntry.reporting_ref === "string" && mapEntry.reporting_ref.trim()
228
+ ? mapEntry.reporting_ref.trim()
229
+ : null,
230
+ wallet_ref: mapEntry && typeof mapEntry.wallet_ref === "string" && mapEntry.wallet_ref.trim()
231
+ ? mapEntry.wallet_ref.trim()
232
+ : null,
233
+ provider_ref: mapEntry && typeof mapEntry.provider_ref === "string" && mapEntry.provider_ref.trim()
234
+ ? mapEntry.provider_ref.trim()
235
+ : null,
236
+ network: mapEntry && typeof mapEntry.network === "string" && mapEntry.network.trim()
237
+ ? mapEntry.network.trim()
238
+ : null,
239
+ chain_id: mapEntry && typeof mapEntry.chain_id === "string" && mapEntry.chain_id.trim()
240
+ ? mapEntry.chain_id.trim()
241
+ : null,
242
+ asset_symbol: mapEntry && typeof mapEntry.asset_symbol === "string" && mapEntry.asset_symbol.trim()
243
+ ? mapEntry.asset_symbol.trim()
244
+ : null,
245
+ policy_scope: mapEntry && typeof mapEntry.policy_scope === "string" && mapEntry.policy_scope.trim()
246
+ ? mapEntry.policy_scope.trim()
247
+ : null,
248
+ storage_class: mapEntry && typeof mapEntry.storage_class === "string" && mapEntry.storage_class.trim()
249
+ ? mapEntry.storage_class.trim()
250
+ : null
251
+ };
252
+ }
253
+
254
+ module.exports = {
255
+ buildConfiguredTreasuryDestination,
256
+ loadPaymentConfig
257
+ };