xytara 3.1.3 → 3.1.5

package/lib/payment_config.js

@@ -1,242 +1,253 @@
-"use strict";
-
-const fs = require("fs");
-const {
-  buildBsvTeranodeTreasuryDestination,
-  normalizeSettlementMode
-} = require("./settlement_bsv_teranode");
-
-function safeParseJson(text, fallback) {
-  try {
-    return JSON.parse(text);
-  } catch (_) {
-    return fallback;
-  }
-}
-
-function readJsonFromEnvOrPath(jsonValue, pathValue, fallback) {
-  if (typeof jsonValue === "string" && jsonValue.trim()) {
-    return safeParseJson(jsonValue, fallback);
-  }
-  if (typeof pathValue === "string" && pathValue.trim()) {
-    try {
-      return safeParseJson(fs.readFileSync(pathValue, "utf8"), fallback);
-    } catch (_) {
-      return fallback;
-    }
-  }
-  return fallback;
-}
-
-function loadWalletRegistry() {
-  const raw = readJsonFromEnvOrPath(
-    process.env.XYTARA_WALLET_REGISTRY_JSON,
-    process.env.XYTARA_WALLET_REGISTRY_PATH,
-    []
-  );
-  const entries = Array.isArray(raw)
-    ? raw
-    : Array.isArray(raw && raw.wallets) ? raw.wallets : [];
-  const byWalletId = new Map();
-  for (const entry of entries) {
-    if (!entry || typeof entry !== "object") continue;
-    const walletId = typeof entry.wallet_id === "string" ? entry.wallet_id.trim() : "";
-    const secret = typeof entry.secret === "string" ? entry.secret : "";
-    if (!walletId || !secret) continue;
-    byWalletId.set(walletId, {
-      wallet_id: walletId,
-      secret,
-      account_id: typeof entry.account_id === "string" && entry.account_id.trim() ? entry.account_id.trim() : null,
-      enabled: entry.enabled !== false
-    });
-  }
-  return byWalletId;
-}
-
-function loadTreasuryDestinationMap() {
-  const raw = readJsonFromEnvOrPath(
-    process.env.XYTARA_TREASURY_DESTINATIONS_JSON,
-    process.env.XYTARA_TREASURY_DESTINATIONS_PATH,
-    {}
-  );
-  const input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-  const normalized = {};
-  for (const [settlementMode, entry] of Object.entries(input)) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
-    normalized[normalizeSettlementMode(settlementMode)] = {
-      destination_id: typeof entry.destination_id === "string" && entry.destination_id.trim()
-        ? entry.destination_id.trim()
-        : null,
-      destination_kind: typeof entry.destination_kind === "string" && entry.destination_kind.trim()
-        ? entry.destination_kind.trim()
-        : null,
-      account_id: typeof entry.account_id === "string" && entry.account_id.trim()
-        ? entry.account_id.trim()
-        : null,
-      external_ref: typeof entry.external_ref === "string" && entry.external_ref.trim()
-        ? entry.external_ref.trim()
-        : null,
-      custody_ref: typeof entry.custody_ref === "string" && entry.custody_ref.trim()
-        ? entry.custody_ref.trim()
-        : null,
-      reporting_ref: typeof entry.reporting_ref === "string" && entry.reporting_ref.trim()
-        ? entry.reporting_ref.trim()
-        : null,
-      wallet_ref: typeof entry.wallet_ref === "string" && entry.wallet_ref.trim()
-        ? entry.wallet_ref.trim()
-        : null,
-      provider_ref: typeof entry.provider_ref === "string" && entry.provider_ref.trim()
-        ? entry.provider_ref.trim()
-        : null,
-      network: typeof entry.network === "string" && entry.network.trim()
-        ? entry.network.trim()
-        : null,
-      chain_id: typeof entry.chain_id === "string" && entry.chain_id.trim()
-        ? entry.chain_id.trim()
-        : null,
-      asset_symbol: typeof entry.asset_symbol === "string" && entry.asset_symbol.trim()
-        ? entry.asset_symbol.trim()
-        : null,
-      policy_scope: typeof entry.policy_scope === "string" && entry.policy_scope.trim()
-        ? entry.policy_scope.trim()
-        : null,
-      storage_class: typeof entry.storage_class === "string" && entry.storage_class.trim()
-        ? entry.storage_class.trim()
-        : null,
-      enabled: entry.enabled !== false,
-      accept_inbound: entry.accept_inbound !== false
-    };
-  }
-  return normalized;
-}
-
-function loadPaymentConfig() {
-  // Default is fail-closed: signed payment acceptance. "presence" (accept any non-empty payment header)
-  // must now be opted into explicitly and is only appropriate for local development.
-  const verificationModeInput = String(process.env.XYTARA_PAYMENT_VERIFICATION_MODE || "local_signed").trim() || "local_signed";
-  const verificationMode = verificationModeInput === "signed" ? "local_signed" : verificationModeInput;
-  const maxAgeSeconds = Number(process.env.XYTARA_PAYMENT_MAX_AGE_SECONDS || 300);
-  return {
-    verification_mode: verificationMode,
-    verification_mode_input: verificationModeInput,
-    payment_max_age_seconds: Number.isFinite(maxAgeSeconds) && maxAgeSeconds > 0 ? maxAgeSeconds : 300,
-    wallet_registry: loadWalletRegistry(),
-    x402: loadX402FacilitatorConfig(),
-    treasury_destination_id: String(process.env.XYTARA_TREASURY_DESTINATION_ID || "").trim() || null,
-    treasury_destination_kind: String(process.env.XYTARA_TREASURY_DESTINATION_KIND || "").trim() || null,
-    treasury_account_id: String(process.env.XYTARA_TREASURY_ACCOUNT_ID || "").trim() || null,
-    treasury_external_ref: String(process.env.XYTARA_TREASURY_EXTERNAL_REF || "").trim() || null,
-    treasury_destinations_by_settlement_mode: loadTreasuryDestinationMap()
-  };
-}
-
-// Configuration for the x402_facilitator verification mode: the on-chain, trustless
-// pay-per-call path. The advertised accepts tell a buyer how to pay; the facilitator
-// verifies and settles the signed payment before any work runs.
-function loadX402FacilitatorConfig() {
-  let accepts = [];
-  const rawAccepts = String(process.env.XYTARA_X402_ACCEPTS_JSON || "").trim();
-  if (rawAccepts) {
-    try {
-      const parsed = JSON.parse(rawAccepts);
-      if (Array.isArray(parsed)) {
-        accepts = parsed
-          .map((entry) => ({
-            scheme: String((entry && entry.scheme) || "exact").trim(),
-            network: String((entry && entry.network) || "").trim(),
-            asset: String((entry && entry.asset) || "").trim(),
-            amount: String((entry && entry.amount) || "").trim(),
-            payTo: String((entry && entry.payTo) || "").trim(),
-            ...(entry && entry.extra && typeof entry.extra === "object" ? { extra: entry.extra } : {}),
-            ...(Number(entry && entry.maxTimeoutSeconds) > 0 ? { maxTimeoutSeconds: Number(entry.maxTimeoutSeconds) } : {})
-          }))
-          .filter((entry) => entry.network && entry.asset && entry.amount && entry.payTo);
-      }
-    } catch (_) {
-      accepts = [];
-    }
-  }
-  let headers = {};
-  const rawHeaders = String(process.env.XYTARA_X402_FACILITATOR_HEADERS_JSON || "").trim();
-  if (rawHeaders) {
-    try {
-      const parsed = JSON.parse(rawHeaders);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) headers = parsed;
-    } catch (_) {
-      headers = {};
-    }
-  }
-  return {
-    accepts,
-    facilitator_url: String(process.env.XYTARA_X402_FACILITATOR_URL || "https://x402.org/facilitator").trim().replace(/\/$/, ""),
-    facilitator_headers: headers,
-    facilitator_timeout_ms: Math.max(1000, Number(process.env.XYTARA_X402_FACILITATOR_TIMEOUT_MS || 15000) || 15000),
-    settle: String(process.env.XYTARA_X402_SETTLE || "true").trim().toLowerCase() !== "false",
-    // Credit units a single self-serve x402 top-up grants, unless the matched accepts
-    // entry carries its own `extra.credits`.
-    topup_units_default: Math.max(0, Number(process.env.XYTARA_X402_TOPUP_UNITS || 1000) || 0)
-  };
-}
-
-function buildConfiguredTreasuryDestination(accountId, settlementMode) {
-  const config = loadPaymentConfig();
-  const normalizedSettlementMode = normalizeSettlementMode(settlementMode);
-  const mapEntry = normalizedSettlementMode && config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
-    ? config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
-    : null;
-  const destinationId = mapEntry && typeof mapEntry.destination_id === "string" && mapEntry.destination_id.trim()
-    ? mapEntry.destination_id.trim()
-    : config.treasury_destination_id;
-  if (!destinationId) {
-    return buildBsvTeranodeTreasuryDestination(accountId, normalizedSettlementMode);
-  }
-  return {
-    destination_id: destinationId,
-    destination_kind:
-      (mapEntry && typeof mapEntry.destination_kind === "string" && mapEntry.destination_kind.trim())
-      || config.treasury_destination_kind
-      || "merchant_treasury",
-    account_id:
-      (mapEntry && typeof mapEntry.account_id === "string" && mapEntry.account_id.trim())
-      || config.treasury_account_id
-      || accountId
-      || null,
-    settlement_mode: normalizedSettlementMode || null,
-    external_ref:
-      (mapEntry && typeof mapEntry.external_ref === "string" && mapEntry.external_ref.trim())
-      || config.treasury_external_ref
-      || null,
-    custody_ref: mapEntry && typeof mapEntry.custody_ref === "string" && mapEntry.custody_ref.trim()
-      ? mapEntry.custody_ref.trim()
-      : null,
-    reporting_ref: mapEntry && typeof mapEntry.reporting_ref === "string" && mapEntry.reporting_ref.trim()
-      ? mapEntry.reporting_ref.trim()
-      : null,
-    wallet_ref: mapEntry && typeof mapEntry.wallet_ref === "string" && mapEntry.wallet_ref.trim()
-      ? mapEntry.wallet_ref.trim()
-      : null,
-    provider_ref: mapEntry && typeof mapEntry.provider_ref === "string" && mapEntry.provider_ref.trim()
-      ? mapEntry.provider_ref.trim()
-      : null,
-    network: mapEntry && typeof mapEntry.network === "string" && mapEntry.network.trim()
-      ? mapEntry.network.trim()
-      : null,
-    chain_id: mapEntry && typeof mapEntry.chain_id === "string" && mapEntry.chain_id.trim()
-      ? mapEntry.chain_id.trim()
-      : null,
-    asset_symbol: mapEntry && typeof mapEntry.asset_symbol === "string" && mapEntry.asset_symbol.trim()
-      ? mapEntry.asset_symbol.trim()
-      : null,
-    policy_scope: mapEntry && typeof mapEntry.policy_scope === "string" && mapEntry.policy_scope.trim()
-      ? mapEntry.policy_scope.trim()
-      : null,
-    storage_class: mapEntry && typeof mapEntry.storage_class === "string" && mapEntry.storage_class.trim()
-      ? mapEntry.storage_class.trim()
-      : null
-  };
-}
-
-module.exports = {
-  buildConfiguredTreasuryDestination,
-  loadPaymentConfig
-};
+"use strict";
+
+const fs = require("fs");
+const {
+  buildBsvTeranodeTreasuryDestination,
+  normalizeSettlementMode
+} = require("./settlement_bsv_teranode");
+
+function safeParseJson(text, fallback) {
+  try {
+    return JSON.parse(text);
+  } catch (_) {
+    return fallback;
+  }
+}
+
+function readJsonFromEnvOrPath(jsonValue, pathValue, fallback) {
+  if (typeof jsonValue === "string" && jsonValue.trim()) {
+    return safeParseJson(jsonValue, fallback);
+  }
+  if (typeof pathValue === "string" && pathValue.trim()) {
+    try {
+      return safeParseJson(fs.readFileSync(pathValue, "utf8"), fallback);
+    } catch (_) {
+      return fallback;
+    }
+  }
+  return fallback;
+}
+
+function loadWalletRegistry() {
+  const raw = readJsonFromEnvOrPath(
+    process.env.XYTARA_WALLET_REGISTRY_JSON,
+    process.env.XYTARA_WALLET_REGISTRY_PATH,
+    []
+  );
+  const entries = Array.isArray(raw)
+    ? raw
+    : Array.isArray(raw && raw.wallets) ? raw.wallets : [];
+  const byWalletId = new Map();
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object") continue;
+    const walletId = typeof entry.wallet_id === "string" ? entry.wallet_id.trim() : "";
+    const secret = typeof entry.secret === "string" ? entry.secret : "";
+    if (!walletId || !secret) continue;
+    byWalletId.set(walletId, {
+      wallet_id: walletId,
+      secret,
+      account_id: typeof entry.account_id === "string" && entry.account_id.trim() ? entry.account_id.trim() : null,
+      enabled: entry.enabled !== false
+    });
+  }
+  return byWalletId;
+}
+
+function loadTreasuryDestinationMap() {
+  const raw = readJsonFromEnvOrPath(
+    process.env.XYTARA_TREASURY_DESTINATIONS_JSON,
+    process.env.XYTARA_TREASURY_DESTINATIONS_PATH,
+    {}
+  );
+  const input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  const normalized = {};
+  for (const [settlementMode, entry] of Object.entries(input)) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    normalized[normalizeSettlementMode(settlementMode)] = {
+      destination_id: typeof entry.destination_id === "string" && entry.destination_id.trim()
+        ? entry.destination_id.trim()
+        : null,
+      destination_kind: typeof entry.destination_kind === "string" && entry.destination_kind.trim()
+        ? entry.destination_kind.trim()
+        : null,
+      account_id: typeof entry.account_id === "string" && entry.account_id.trim()
+        ? entry.account_id.trim()
+        : null,
+      external_ref: typeof entry.external_ref === "string" && entry.external_ref.trim()
+        ? entry.external_ref.trim()
+        : null,
+      custody_ref: typeof entry.custody_ref === "string" && entry.custody_ref.trim()
+        ? entry.custody_ref.trim()
+        : null,
+      reporting_ref: typeof entry.reporting_ref === "string" && entry.reporting_ref.trim()
+        ? entry.reporting_ref.trim()
+        : null,
+      wallet_ref: typeof entry.wallet_ref === "string" && entry.wallet_ref.trim()
+        ? entry.wallet_ref.trim()
+        : null,
+      provider_ref: typeof entry.provider_ref === "string" && entry.provider_ref.trim()
+        ? entry.provider_ref.trim()
+        : null,
+      network: typeof entry.network === "string" && entry.network.trim()
+        ? entry.network.trim()
+        : null,
+      chain_id: typeof entry.chain_id === "string" && entry.chain_id.trim()
+        ? entry.chain_id.trim()
+        : null,
+      asset_symbol: typeof entry.asset_symbol === "string" && entry.asset_symbol.trim()
+        ? entry.asset_symbol.trim()
+        : null,
+      policy_scope: typeof entry.policy_scope === "string" && entry.policy_scope.trim()
+        ? entry.policy_scope.trim()
+        : null,
+      storage_class: typeof entry.storage_class === "string" && entry.storage_class.trim()
+        ? entry.storage_class.trim()
+        : null,
+      enabled: entry.enabled !== false,
+      accept_inbound: entry.accept_inbound !== false
+    };
+  }
+  return normalized;
+}
+
+function loadPaymentConfig() {
+  // Default is fail-closed: signed payment acceptance. "presence" (accept any non-empty payment header)
+  // must now be opted into explicitly and is only appropriate for local development.
+  const verificationModeInput = String(process.env.XYTARA_PAYMENT_VERIFICATION_MODE || "local_signed").trim() || "local_signed";
+  const verificationMode = verificationModeInput === "signed" ? "local_signed" : verificationModeInput;
+  const maxAgeSeconds = Number(process.env.XYTARA_PAYMENT_MAX_AGE_SECONDS || 300);
+  return {
+    verification_mode: verificationMode,
+    verification_mode_input: verificationModeInput,
+    payment_max_age_seconds: Number.isFinite(maxAgeSeconds) && maxAgeSeconds > 0 ? maxAgeSeconds : 300,
+    wallet_registry: loadWalletRegistry(),
+    x402: loadX402FacilitatorConfig(),
+    treasury_destination_id: String(process.env.XYTARA_TREASURY_DESTINATION_ID || "").trim() || null,
+    treasury_destination_kind: String(process.env.XYTARA_TREASURY_DESTINATION_KIND || "").trim() || null,
+    treasury_account_id: String(process.env.XYTARA_TREASURY_ACCOUNT_ID || "").trim() || null,
+    treasury_external_ref: String(process.env.XYTARA_TREASURY_EXTERNAL_REF || "").trim() || null,
+    treasury_destinations_by_settlement_mode: loadTreasuryDestinationMap()
+  };
+}
+
+// Configuration for the x402_facilitator verification mode: the on-chain, trustless
+// pay-per-call path. The advertised accepts tell a buyer how to pay; the facilitator
+// verifies and settles the signed payment before any work runs.
+function loadX402FacilitatorConfig() {
+  let accepts = [];
+  const rawAccepts = String(process.env.XYTARA_X402_ACCEPTS_JSON || "").trim();
+  if (rawAccepts) {
+    try {
+      const parsed = JSON.parse(rawAccepts);
+      if (Array.isArray(parsed)) {
+        accepts = parsed
+          .map((entry) => ({
+            scheme: String((entry && entry.scheme) || "exact").trim(),
+            network: String((entry && entry.network) || "").trim(),
+            asset: String((entry && entry.asset) || "").trim(),
+            amount: String((entry && entry.amount) || "").trim(),
+            payTo: String((entry && entry.payTo) || "").trim(),
+            ...(entry && entry.extra && typeof entry.extra === "object" ? { extra: entry.extra } : {}),
+            ...(Number(entry && entry.maxTimeoutSeconds) > 0 ? { maxTimeoutSeconds: Number(entry.maxTimeoutSeconds) } : {})
+          }))
+          .filter((entry) => entry.network && entry.asset && entry.amount && entry.payTo);
+      }
+    } catch (_) {
+      accepts = [];
+    }
+  }
+  let headers = {};
+  const rawHeaders = String(process.env.XYTARA_X402_FACILITATOR_HEADERS_JSON || "").trim();
+  if (rawHeaders) {
+    try {
+      const parsed = JSON.parse(rawHeaders);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) headers = parsed;
+    } catch (_) {
+      headers = {};
+    }
+  }
+  return {
+    accepts,
+    facilitator_url: String(process.env.XYTARA_X402_FACILITATOR_URL || "https://x402.org/facilitator").trim().replace(/\/$/, ""),
+    facilitator_headers: headers,
+    facilitator_timeout_ms: Math.max(1000, Number(process.env.XYTARA_X402_FACILITATOR_TIMEOUT_MS || 15000) || 15000),
+    settle: String(process.env.XYTARA_X402_SETTLE || "true").trim().toLowerCase() !== "false",
+    // Credit units a single self-serve x402 top-up grants, unless the matched accepts
+    // entry carries its own `extra.credits`.
+    topup_units_default: Math.max(0, Number(process.env.XYTARA_X402_TOPUP_UNITS || 1000) || 0),
+    // Optional Coinbase CDP auth for the CDP-hosted facilitator (Base mainnet). When both a
+    // key id and secret are present, the facilitator client mints a fresh EdDSA Bearer JWT
+    // per request. Accepts the CDP-standard env names or XYTARA_X402_CDP_* overrides.
+    cdp: loadCdpFacilitatorAuth()
+  };
+}
+
+function loadCdpFacilitatorAuth() {
+  const keyId = String(process.env.XYTARA_X402_CDP_KEY_ID || process.env.CDP_API_KEY_ID || "").trim();
+  const keySecret = String(process.env.XYTARA_X402_CDP_KEY_SECRET || process.env.CDP_API_KEY_SECRET || "").trim();
+  if (!keyId || !keySecret) return null;
+  return { key_id: keyId, key_secret: keySecret };
+}
+
+function buildConfiguredTreasuryDestination(accountId, settlementMode) {
+  const config = loadPaymentConfig();
+  const normalizedSettlementMode = normalizeSettlementMode(settlementMode);
+  const mapEntry = normalizedSettlementMode && config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
+    ? config.treasury_destinations_by_settlement_mode[normalizedSettlementMode]
+    : null;
+  const destinationId = mapEntry && typeof mapEntry.destination_id === "string" && mapEntry.destination_id.trim()
+    ? mapEntry.destination_id.trim()
+    : config.treasury_destination_id;
+  if (!destinationId) {
+    return buildBsvTeranodeTreasuryDestination(accountId, normalizedSettlementMode);
+  }
+  return {
+    destination_id: destinationId,
+    destination_kind:
+      (mapEntry && typeof mapEntry.destination_kind === "string" && mapEntry.destination_kind.trim())
+      || config.treasury_destination_kind
+      || "merchant_treasury",
+    account_id:
+      (mapEntry && typeof mapEntry.account_id === "string" && mapEntry.account_id.trim())
+      || config.treasury_account_id
+      || accountId
+      || null,
+    settlement_mode: normalizedSettlementMode || null,
+    external_ref:
+      (mapEntry && typeof mapEntry.external_ref === "string" && mapEntry.external_ref.trim())
+      || config.treasury_external_ref
+      || null,
+    custody_ref: mapEntry && typeof mapEntry.custody_ref === "string" && mapEntry.custody_ref.trim()
+      ? mapEntry.custody_ref.trim()
+      : null,
+    reporting_ref: mapEntry && typeof mapEntry.reporting_ref === "string" && mapEntry.reporting_ref.trim()
+      ? mapEntry.reporting_ref.trim()
+      : null,
+    wallet_ref: mapEntry && typeof mapEntry.wallet_ref === "string" && mapEntry.wallet_ref.trim()
+      ? mapEntry.wallet_ref.trim()
+      : null,
+    provider_ref: mapEntry && typeof mapEntry.provider_ref === "string" && mapEntry.provider_ref.trim()
+      ? mapEntry.provider_ref.trim()
+      : null,
+    network: mapEntry && typeof mapEntry.network === "string" && mapEntry.network.trim()
+      ? mapEntry.network.trim()
+      : null,
+    chain_id: mapEntry && typeof mapEntry.chain_id === "string" && mapEntry.chain_id.trim()
+      ? mapEntry.chain_id.trim()
+      : null,
+    asset_symbol: mapEntry && typeof mapEntry.asset_symbol === "string" && mapEntry.asset_symbol.trim()
+      ? mapEntry.asset_symbol.trim()
+      : null,
+    policy_scope: mapEntry && typeof mapEntry.policy_scope === "string" && mapEntry.policy_scope.trim()
+      ? mapEntry.policy_scope.trim()
+      : null,
+    storage_class: mapEntry && typeof mapEntry.storage_class === "string" && mapEntry.storage_class.trim()
+      ? mapEntry.storage_class.trim()
+      : null
+  };
+}
+
+module.exports = {
+  buildConfiguredTreasuryDestination,
+  loadPaymentConfig
+};