paygate

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

paygate - npm Package Compare versions

Comparing version

5.5.0

5.6.0

+74

dist/manifest.d.ts

		/**
		* Capability manifest (`/.well-known/arispay.json`) — build + validate.
		*
		* The canonical shape is docs/paygate-v2.md §9, serialized by apps/api's
		* `buildCapabilityManifest` for hosted merchants. This module mirrors that
		* contract for ACCOUNT-FREE sellers (`paygate wrap`): the seller hosts its
		* own manifest on its own origin. The shape is mirrored, not imported —
		* paygate ships without workspace deps.
		*
		* v1 manifests are UNSIGNED. Signing rides the S1 artifact envelope
		* (docs/specs/artifact-signing-v1.md) and lands with the discovery session;
		* no seller keypair is generated here (M2M security invariant: no new
		* payment-key generation, and no signing key until a spec needs one).
		*/
		export declare const USDC_BASE_MAINNET = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
		export declare const USDC_BASE_SEPOLIA = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
		export declare const EURC_BASE_MAINNET_ADDR = "0x60a3E35Cc302bFA44Cb288Bc5a4F316Fdb1adb42";
		export interface ManifestRail {
		scheme: "x402";
		/** CAIP-2, e.g. "eip155:8453". */
		network: string;
		/** Token contract address. */
		asset: string;
		assetName: string;
		payTo: string;
		facilitator: string;
		}
		export interface ManifestProduct {
		path: string;
		method: string;
		priceCents: number;
		description?: string;
		}
		export interface CapabilityManifestV1 {
		version: "1";
		merchant: {
		slug: string;
		name: string;
		};
		trust: {
		minTier: "any" \| "payagent-verified";
		};
		rails: ManifestRail[];
		products?: ManifestProduct[];
		updated: string;
		}
		export interface BuildSellerManifestOptions {
		slug: string;
		name: string;
		wallet: string;
		/** CAIP-2 network. */
		network: string;
		asset: string;
		assetName: string;
		facilitator: string;
		products: ManifestProduct[];
		/** Injected for reproducible builds; defaults to now. */
		updated?: Date;
		}
		export declare function buildSellerManifest(opts: BuildSellerManifestOptions): CapabilityManifestV1;
		export type ManifestValidation = {
		ok: true;
		manifest: CapabilityManifestV1;
		} \| {
		ok: false;
		errors: string[];
		};
		/**
		* Strict structural validation against the canonical §9 contract. Unknown
		* extra fields are tolerated (the hosted builder may add fields additively);
		* required fields and shapes are not negotiable.
		*/
		export declare function validateCapabilityManifest(value: unknown): ManifestValidation;
		//# sourceMappingURL=manifest.d.ts.map

+1

dist/manifest.d.ts.map

{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,iBAAiB,+CAA+C,CAAC;AAC9E,eAAO,MAAM,iBAAiB,+CAA+C,CAAC;AAC9E,eAAO,MAAM,sBAAsB,+CAA+C,CAAC;AAKnF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,GAAG,CAAC;IACb,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,GAAG,mBAAmB,CAAA;KAAE,CAAC;IAChD,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,yDAAyD;IACzD,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,oBAAoB,CAkB1F;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,oBAAoB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpC;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA+E7E"}

+125

dist/manifest.js

		/**
		* Capability manifest (`/.well-known/arispay.json`) — build + validate.
		*
		* The canonical shape is docs/paygate-v2.md §9, serialized by apps/api's
		* `buildCapabilityManifest` for hosted merchants. This module mirrors that
		* contract for ACCOUNT-FREE sellers (`paygate wrap`): the seller hosts its
		* own manifest on its own origin. The shape is mirrored, not imported —
		* paygate ships without workspace deps.
		*
		* v1 manifests are UNSIGNED. Signing rides the S1 artifact envelope
		* (docs/specs/artifact-signing-v1.md) and lands with the discovery session;
		* no seller keypair is generated here (M2M security invariant: no new
		* payment-key generation, and no signing key until a spec needs one).
		*/
		export const USDC_BASE_MAINNET = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
		export const USDC_BASE_SEPOLIA = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
		export const EURC_BASE_MAINNET_ADDR = "0x60a3E35Cc302bFA44Cb288Bc5a4F316Fdb1adb42";
		const WALLET_RE = /^0x[0-9a-fA-F]{40}$/;
		const CAIP2_RE = /^eip155:\d+$/;
		export function buildSellerManifest(opts) {
		return {
		version: "1",
		merchant: { slug: opts.slug, name: opts.name },
		trust: { minTier: "any" },
		rails: [
		{
		scheme: "x402",
		network: opts.network,
		asset: opts.asset,
		assetName: opts.assetName,
		payTo: opts.wallet,
		facilitator: opts.facilitator,
		},
		],
		products: opts.products,
		updated: (opts.updated ?? new Date()).toISOString(),
		};
		}
		/**
		* Strict structural validation against the canonical §9 contract. Unknown
		* extra fields are tolerated (the hosted builder may add fields additively);
		* required fields and shapes are not negotiable.
		*/
		export function validateCapabilityManifest(value) {
		const errors = [];
		const m = value;
		if (!m \|\| typeof m !== "object")
		return { ok: false, errors: ["manifest is not a JSON object"] };
		if (m.version !== "1")
		errors.push(`version must be "1" (got ${JSON.stringify(m.version)})`);
		if (!m.merchant \|\| typeof m.merchant !== "object") {
		errors.push("merchant is required");
		}
		else {
		if (typeof m.merchant.slug !== "string" \|\| m.merchant.slug.length === 0) {
		errors.push("merchant.slug must be a non-empty string");
		}
		if (typeof m.merchant.name !== "string" \|\| m.merchant.name.length === 0) {
		errors.push("merchant.name must be a non-empty string");
		}
		}
		if (!m.trust \|\| typeof m.trust !== "object") {
		errors.push("trust is required");
		}
		else if (m.trust.minTier !== "any" && m.trust.minTier !== "payagent-verified") {
		errors.push(`trust.minTier must be "any" or "payagent-verified"`);
		}
		if (!Array.isArray(m.rails) \|\| m.rails.length === 0) {
		errors.push("rails must be a non-empty array");
		}
		else {
		m.rails.forEach((rail, i) => {
		if (!rail \|\| typeof rail !== "object") {
		errors.push(`rails[${i}] must be an object`);
		return;
		}
		if (rail.scheme !== "x402")
		errors.push(`rails[${i}].scheme must be "x402"`);
		if (typeof rail.network !== "string" \|\| !CAIP2_RE.test(rail.network)) {
		errors.push(`rails[${i}].network must be CAIP-2 (eip155:<chainId>)`);
		}
		if (typeof rail.asset !== "string" \|\| !WALLET_RE.test(rail.asset)) {
		errors.push(`rails[${i}].asset must be a 0x40-hex contract address`);
		}
		if (typeof rail.assetName !== "string" \|\| rail.assetName.length === 0) {
		errors.push(`rails[${i}].assetName must be a non-empty string`);
		}
		if (typeof rail.payTo !== "string" \|\| !WALLET_RE.test(rail.payTo)) {
		errors.push(`rails[${i}].payTo must be a 0x40-hex address`);
		}
		if (typeof rail.facilitator !== "string" \|\| !/^https:\/\//.test(rail.facilitator)) {
		errors.push(`rails[${i}].facilitator must be an https URL`);
		}
		});
		}
		if (m.products !== undefined) {
		if (!Array.isArray(m.products)) {
		errors.push("products, when present, must be an array");
		}
		else {
		m.products.forEach((p, i) => {
		if (!p \|\| typeof p !== "object") {
		errors.push(`products[${i}] must be an object`);
		return;
		}
		if (typeof p.path !== "string" \|\| !p.path.startsWith("/")) {
		errors.push(`products[${i}].path must start with "/"`);
		}
		if (typeof p.method !== "string" \|\| p.method.length === 0) {
		errors.push(`products[${i}].method is required`);
		}
		if (!Number.isInteger(p.priceCents) \|\| p.priceCents < 1) {
		errors.push(`products[${i}].priceCents must be an integer >= 1 (integer cents, never floats)`);
		}
		});
		}
		}
		if (typeof m.updated !== "string" \|\| Number.isNaN(Date.parse(m.updated))) {
		errors.push("updated must be an ISO-8601 timestamp");
		}
		if (errors.length > 0)
		return { ok: false, errors };
		return { ok: true, manifest: m };
		}
		//# sourceMappingURL=manifest.js.map

+1

dist/manifest.js.map

+30

dist/register.d.ts

		/**
		* `paygate register <url>` — announce a deployed, publicly-reachable gated
		* endpoint to the facilitator's discovery catalog.
		*
		* Thin client of the facilitator's `POST /discovery/register`: the
		* facilitator itself probes the URL (single unpaid GET) and catalogs only a
		* live, well-formed 402 — so registration is structurally impossible before
		* deploy. Errors pass through S2-structured.
		*/
		export interface RegisterIO {
		stdout: (s: string) => void;
		stderr: (s: string) => void;
		}
		export interface RegisterResult {
		ok: boolean;
		facilitator: string;
		resource: string;
		status?: number;
		catalogKey?: string;
		checks?: string[];
		error?: {
		code: string;
		message: string;
		retryable: boolean;
		};
		}
		export declare const REGISTER_HELP_TEXT = "paygate register <https-url> [--facilitator <url>] [--json]\n\nRegisters a DEPLOYED gated endpoint with the facilitator's discovery catalog.\nThe facilitator probes the URL (one unpaid GET, never a payment) and lists it\nonly if it serves a valid x402 challenge. Ordering: wrap \u2192 deploy \u2192 register\n\u2192 verify.\n";
		export declare function registerResource(resource: string, facilitator: string, fetchImpl?: typeof fetch): Promise<RegisterResult>;
		export declare function runRegister(argv: string[], io?: RegisterIO, fetchImpl?: typeof fetch): Promise<number>;
		//# sourceMappingURL=register.d.ts.map

+1

dist/register.d.ts.map

{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/D;AAED,eAAO,MAAM,kBAAkB,0UAM9B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,cAAc,CAAC,CAwCzB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,GAAE,UAA+F,EACnG,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

+86

dist/register.js

		/**
		* `paygate register <url>` — announce a deployed, publicly-reachable gated
		* endpoint to the facilitator's discovery catalog.
		*
		* Thin client of the facilitator's `POST /discovery/register`: the
		* facilitator itself probes the URL (single unpaid GET) and catalogs only a
		* live, well-formed 402 — so registration is structurally impossible before
		* deploy. Errors pass through S2-structured.
		*/
		const DEFAULT_FACILITATOR = "https://facilitator.arispay.app";
		export const REGISTER_HELP_TEXT = `paygate register <https-url> [--facilitator <url>] [--json]

		Registers a DEPLOYED gated endpoint with the facilitator's discovery catalog.
		The facilitator probes the URL (one unpaid GET, never a payment) and lists it
		only if it serves a valid x402 challenge. Ordering: wrap → deploy → register
		→ verify.
		`;
		export async function registerResource(resource, facilitator, fetchImpl = fetch) {
		const base = facilitator.replace(/\/$/, "");
		try {
		const res = await fetchImpl(`${base}/discovery/register`, {
		method: "POST",
		headers: { "content-type": "application/json", accept: "application/json" },
		body: JSON.stringify({ resource }),
		signal: AbortSignal.timeout(30_000),
		});
		const body = (await res.json().catch(() => null));
		if (res.ok && body?.ok === true) {
		return {
		ok: true,
		facilitator: base,
		resource,
		status: res.status,
		catalogKey: typeof body.catalogKey === "string" ? body.catalogKey : undefined,
		checks: Array.isArray(body.checks) ? body.checks : undefined,
		};
		}
		const err = (body?.error ?? {});
		return {
		ok: false,
		facilitator: base,
		resource,
		status: res.status,
		error: {
		code: typeof err.code === "string" ? err.code : "REGISTER_REJECTED",
		message: typeof err.message === "string" ? err.message : `facilitator returned ${res.status}`,
		retryable: err.retryable === true \|\| res.status === 429 \|\| res.status >= 500,
		},
		};
		}
		catch (error) {
		return {
		ok: false,
		facilitator: base,
		resource,
		error: { code: "FACILITATOR_UNREACHABLE", message: String(error), retryable: true },
		};
		}
		}
		export async function runRegister(argv, io = { stdout: (s) => process.stdout.write(s), stderr: (s) => process.stderr.write(s) }, fetchImpl = fetch) {
		if (argv.includes("--help") \|\| argv.includes("-h")) {
		io.stdout(REGISTER_HELP_TEXT);
		return 0;
		}
		const json = argv.includes("--json");
		const facIdx = argv.indexOf("--facilitator");
		const facilitator = facIdx >= 0 ? argv[facIdx + 1] : undefined;
		const positional = argv.filter((v, i) => !v.startsWith("-") && i !== facIdx + 1);
		const url = positional[0];
		if (!url \|\| (facIdx >= 0 && !facilitator)) {
		io.stderr(`${JSON.stringify({ error: { code: "MISSING_URL", message: "usage: paygate register <https-url> [--facilitator <url>] [--json]", retryable: false } })}\n`);
		return 1;
		}
		const result = await registerResource(url, facilitator ?? DEFAULT_FACILITATOR, fetchImpl);
		if (json) {
		io.stdout(`${JSON.stringify(result, null, 2)}\n`);
		}
		else if (result.ok) {
		io.stdout(`Registered with ${result.facilitator}: ${result.resource}\n${(result.checks ?? []).map((c) => ` PASS ${c}`).join("\n")}\nNext: npx paygate verify ${result.resource}\n`);
		}
		else {
		io.stderr(`register failed [${result.error?.code}]: ${result.error?.message}${result.error?.retryable ? " (retryable)" : ""}\n`);
		}
		return result.ok ? 0 : 1;
		}
		//# sourceMappingURL=register.js.map

+1

dist/register.js.map

{"version":3,"file":"register.js","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAiB9D,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;CAMjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,WAAmB,EACnB,YAA0B,KAAK;IAE/B,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,qBAAqB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;YAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,WAAW,EAAE,IAAI;gBACjB,QAAQ;gBACR,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBAC7E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,MAAmB,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAA4B,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,IAAI;YACjB,QAAQ;YACR,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;gBACnE,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE;gBAC7F,SAAS,EAAE,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;aAC7E;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,IAAI;YACjB,QAAQ;YACR,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;SACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,KAAiB,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EACnG,YAA0B,KAAK;IAE/B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oEAAoE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACtK,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,WAAW,IAAI,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAC1F,IAAI,IAAI,EAAE,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACrB,EAAE,CAAC,MAAM,CAAC,mBAAmB,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvL,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,oBAAoB,MAAM,CAAC,KAAK,EAAE,IAAI,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}

+44

dist/verify.d.ts

		/**
		* `paygate verify <url>` — the onboarding acceptance check + receipt.
		*
		* Read-only, network-agnostic (unlike `doctor`, which is a Base-mainnet
		* readiness check): it validates whatever network the challenge declares.
		* Four checks:
		* 1. live-402 — unpaid GET answers a parseable x402 challenge
		* 2. terms — the challenge carries scheme/network/payTo/amount
		* 3. manifest — origin serves a VALID /.well-known/arispay.json
		* 4. catalog — the facilitator's /discovery/resources lists the URL
		* The receipt is a machine artifact: JSON to stdout (--json) and to
		* --receipt <file> (default paygate-verify-receipt.json in cwd).
		*/
		export interface VerifyCheck {
		id: "live-402" \| "terms" \| "manifest" \| "catalog";
		ok: boolean;
		message: string;
		}
		export interface VerifyReceipt {
		ok: boolean;
		url: string;
		facilitator: string;
		verifiedAt: string;
		checks: VerifyCheck[];
		terms?: {
		scheme?: string;
		network?: string;
		payTo?: string;
		amount?: string;
		asset?: string;
		};
		manifest?: {
		slug?: string;
		products?: number;
		};
		}
		export interface VerifyIO {
		stdout: (s: string) => void;
		stderr: (s: string) => void;
		}
		export declare function verifyUrl(url: string, facilitator: string, fetchImpl?: typeof fetch, now?: () => Date): Promise<VerifyReceipt>;
		export declare const VERIFY_HELP_TEXT = "paygate verify <https-url> [--facilitator <url>] [--receipt <file>] [--json]\n\nRead-only onboarding acceptance check. Validates: live 402 \u00B7 complete terms \u00B7\nvalid /.well-known/arispay.json manifest \u00B7 facilitator catalog listing.\nWrites a machine-readable receipt (default: paygate-verify-receipt.json).\nNever sends payment or auth headers.\n";
		export declare function runVerify(argv: string[], io?: VerifyIO, fetchImpl?: typeof fetch): Promise<number>;
		//# sourceMappingURL=verify.d.ts.map

+1

dist/verify.d.ts.map

{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IAClD,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/F,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjD;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAwBD,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,EAC/B,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,aAAa,CAAC,CA6HxB;AAED,eAAO,MAAM,gBAAgB,6WAM5B,CAAC;AAEF,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,GAAE,QAA6F,EACjG,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

+200

dist/verify.js

		/**
		* `paygate verify <url>` — the onboarding acceptance check + receipt.
		*
		* Read-only, network-agnostic (unlike `doctor`, which is a Base-mainnet
		* readiness check): it validates whatever network the challenge declares.
		* Four checks:
		* 1. live-402 — unpaid GET answers a parseable x402 challenge
		* 2. terms — the challenge carries scheme/network/payTo/amount
		* 3. manifest — origin serves a VALID /.well-known/arispay.json
		* 4. catalog — the facilitator's /discovery/resources lists the URL
		* The receipt is a machine artifact: JSON to stdout (--json) and to
		* --receipt <file> (default paygate-verify-receipt.json in cwd).
		*/
		import * as fs from "node:fs";
		import { validateCapabilityManifest } from "./manifest.js";
		const DEFAULT_FACILITATOR = "https://facilitator.arispay.app";
		function decodeHeaderChallenge(value) {
		const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
		return JSON.parse(Buffer.from(normalized, "base64").toString("utf8"));
		}
		async function fetchJson(fetchImpl, url) {
		try {
		const res = await fetchImpl(url, {
		headers: { accept: "application/json" },
		redirect: "manual",
		signal: AbortSignal.timeout(15_000),
		});
		const body = await res.json().catch(() => null);
		return { status: res.status, body, headers: res.headers };
		}
		catch (error) {
		return { error: String(error) };
		}
		}
		export async function verifyUrl(url, facilitator, fetchImpl = fetch, now = () => new Date()) {
		const base = facilitator.replace(/\/$/, "");
		const checks = [];
		let terms;
		let manifestInfo;
		// 1+2 — live 402 + terms.
		const res = await fetchJson(fetchImpl, url);
		if ("error" in res) {
		checks.push({ id: "live-402", ok: false, message: `fetch failed: ${res.error}` });
		}
		else {
		let challenge = res.body;
		if (!challenge \|\| !Array.isArray(challenge.accepts)) {
		const header = res.headers.get("payment-required") ?? res.headers.get("x-payment-required");
		if (header) {
		try {
		challenge = decodeHeaderChallenge(header);
		}
		catch {
		/* fall through to the checks below */
		}
		}
		}
		const accepts = Array.isArray(challenge?.accepts)
		? challenge?.accepts
		: [];
		checks.push({
		id: "live-402",
		ok: res.status === 402 && accepts.length > 0,
		message: res.status === 402
		? accepts.length > 0
		? "unpaid GET answered a parseable x402 challenge"
		: "402 returned but the challenge has no accepts[]"
		: `expected HTTP 402, got ${res.status}`,
		});
		const first = accepts[0];
		const amount = typeof first?.amount === "string"
		? first.amount
		: typeof first?.maxAmountRequired === "string"
		? first.maxAmountRequired
		: undefined;
		const termsOk = typeof first?.scheme === "string" &&
		typeof first?.network === "string" &&
		typeof first?.payTo === "string" &&
		typeof amount === "string";
		if (first) {
		terms = {
		scheme: first.scheme,
		network: first.network,
		payTo: first.payTo,
		asset: first.asset,
		amount,
		};
		}
		checks.push({
		id: "terms",
		ok: Boolean(termsOk),
		message: termsOk
		? `terms complete: ${terms?.scheme} on ${terms?.network}, ${amount} base units to ${terms?.payTo}`
		: "challenge is missing scheme/network/payTo/amount",
		});
		}
		// 3 — manifest at the origin.
		let origin;
		try {
		origin = new URL(url).origin;
		}
		catch {
		/* live-402 already failed on an unparseable URL */
		}
		if (origin) {
		const man = await fetchJson(fetchImpl, `${origin}/.well-known/arispay.json`);
		if ("error" in man \|\| man.status !== 200) {
		checks.push({
		id: "manifest",
		ok: false,
		message: `no manifest at ${origin}/.well-known/arispay.json (${"error" in man ? man.error : `HTTP ${man.status}`})`,
		});
		}
		else {
		const validation = validateCapabilityManifest(man.body);
		checks.push({
		id: "manifest",
		ok: validation.ok,
		message: validation.ok
		? `manifest valid (slug "${validation.manifest.merchant.slug}", ${validation.manifest.products?.length ?? 0} product(s))`
		: `manifest invalid: ${validation.errors.slice(0, 3).join("; ")}`,
		});
		if (validation.ok) {
		manifestInfo = {
		slug: validation.manifest.merchant.slug,
		products: validation.manifest.products?.length ?? 0,
		};
		}
		}
		}
		// 4 — facilitator catalog listing.
		const cat = await fetchJson(fetchImpl, `${base}/discovery/resources?q=${encodeURIComponent(url)}`);
		if ("error" in cat) {
		checks.push({ id: "catalog", ok: false, message: `catalog query failed: ${cat.error}` });
		}
		else {
		const items = Array.isArray(cat.body?.items)
		? (cat.body.items)
		: [];
		const listed = items.some((item) => item.resource === url);
		checks.push({
		id: "catalog",
		ok: listed,
		message: listed
		? `listed in ${base}/discovery/resources`
		: `not listed at ${base} — run: npx paygate register ${url}`,
		});
		}
		return {
		ok: checks.every((c) => c.ok),
		url,
		facilitator: base,
		verifiedAt: now().toISOString(),
		checks,
		...(terms ? { terms } : {}),
		...(manifestInfo ? { manifest: manifestInfo } : {}),
		};
		}
		export const VERIFY_HELP_TEXT = `paygate verify <https-url> [--facilitator <url>] [--receipt <file>] [--json]

		Read-only onboarding acceptance check. Validates: live 402 · complete terms ·
		valid /.well-known/arispay.json manifest · facilitator catalog listing.
		Writes a machine-readable receipt (default: paygate-verify-receipt.json).
		Never sends payment or auth headers.
		`;
		export async function runVerify(argv, io = { stdout: (s) => process.stdout.write(s), stderr: (s) => process.stderr.write(s) }, fetchImpl = fetch) {
		if (argv.includes("--help") \|\| argv.includes("-h")) {
		io.stdout(VERIFY_HELP_TEXT);
		return 0;
		}
		const json = argv.includes("--json");
		const facIdx = argv.indexOf("--facilitator");
		const recIdx = argv.indexOf("--receipt");
		const skipIdx = new Set([facIdx + 1, recIdx + 1].filter((i) => i > 0));
		const positional = argv.filter((v, i) => !v.startsWith("-") && !skipIdx.has(i));
		const url = positional[0];
		if (!url) {
		io.stderr(`${JSON.stringify({ error: { code: "MISSING_URL", message: "usage: paygate verify <https-url> [--facilitator <url>] [--receipt <file>] [--json]", retryable: false } })}\n`);
		return 1;
		}
		const receipt = await verifyUrl(url, (facIdx >= 0 && argv[facIdx + 1]) \|\| DEFAULT_FACILITATOR, fetchImpl);
		const receiptPath = (recIdx >= 0 && argv[recIdx + 1]) \|\| "paygate-verify-receipt.json";
		try {
		fs.writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`, "utf8");
		}
		catch (error) {
		io.stderr(`warning: could not write receipt to ${receiptPath}: ${String(error)}\n`);
		}
		if (json) {
		io.stdout(`${JSON.stringify(receipt, null, 2)}\n`);
		}
		else {
		io.stdout(`Paygate verify: ${url}\n`);
		for (const c of receipt.checks)
		io.stdout(`${c.ok ? "PASS" : "FAIL"} [${c.id}] ${c.message}\n`);
		io.stdout(`${receipt.ok ? "\nVerified" : "\nNot verified"}. Receipt: ${receiptPath}\n`);
		}
		return receipt.ok ? 0 : 1;
		}
		//# sourceMappingURL=verify.js.map

+1

dist/verify.js.map

+42

dist/wrap-templates.d.ts

		/**
		* `paygate wrap` — template generation. Pure functions, no filesystem.
		*
		* Wrap gates an EXISTING upstream API: the generated project is an Express
		* reverse proxy that (1) answers x402 402 challenges on the gated routes,
		* (2) forwards paid (and ungated) traffic to UPSTREAM_URL, (3) serves the
		* capability manifest at /.well-known/arispay.json and an agent-readable
		* /llms.txt. Same account-free family as `paygate init` (upstream @x402/*
		* packages, wallet receives funds directly, no ArisPay account).
		*
		* Determinism rule: every generated file is byte-deterministic for the same
		* inputs, so idempotent re-runs diff cleanly (checkWritePlan). The manifest
		* `updated` timestamp is therefore injected by the generated server at boot
		* (last-deploy semantics), never baked into the file.
		*/
		import { type GeneratedFile, type InitCurrency, type InitNetwork } from "./init-templates.js";
		export interface WrapRoute {
		method: "GET" \| "POST" \| "PUT" \| "DELETE";
		/** Express-style path (OpenAPI `{param}` already converted to `:param`). */
		path: string;
		priceCents: number;
		description?: string;
		}
		export interface WrapOptions {
		upstream: string;
		wallet: string;
		network: InitNetwork;
		currency: InitCurrency;
		routes: WrapRoute[];
		projectName: string;
		slug: string;
		/** Documented OpenAPI JSON (with 402 responses injected), when --from-openapi was used. */
		openapiDocumented?: string;
		}
		export declare function assetFor(network: InitNetwork, currency: InitCurrency): {
		address: string;
		name: string;
		};
		/** Manifest file content — NO `updated` field (the server injects it at boot). */
		export declare function wrapManifestBase(opts: WrapOptions): string;
		export declare function generateWrapFiles(opts: WrapOptions): GeneratedFile[];
		//# sourceMappingURL=wrap-templates.d.ts.map

+1

dist/wrap-templates.d.ts.map

{"version":3,"file":"wrap-templates.d.ts","sourceRoot":"","sources":["../src/wrap-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAIjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,GAAG;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAKA;AAuCD,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAwB1D;AAmKD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,aAAa,EAAE,CAuCpE"}

+277

dist/wrap-templates.js

		/**
		* `paygate wrap` — template generation. Pure functions, no filesystem.
		*
		* Wrap gates an EXISTING upstream API: the generated project is an Express
		* reverse proxy that (1) answers x402 402 challenges on the gated routes,
		* (2) forwards paid (and ungated) traffic to UPSTREAM_URL, (3) serves the
		* capability manifest at /.well-known/arispay.json and an agent-readable
		* /llms.txt. Same account-free family as `paygate init` (upstream @x402/*
		* packages, wallet receives funds directly, no ArisPay account).
		*
		* Determinism rule: every generated file is byte-deterministic for the same
		* inputs, so idempotent re-runs diff cleanly (checkWritePlan). The manifest
		* `updated` timestamp is therefore injected by the generated server at boot
		* (last-deploy semantics), never baked into the file.
		*/
		import { CAIP2, EURC_BASE_MAINNET, centsToAtomic, centsToMoneyString, defaultFacilitatorFor, } from "./init-templates.js";
		import { USDC_BASE_MAINNET, USDC_BASE_SEPOLIA } from "./manifest.js";
		export function assetFor(network, currency) {
		if (currency === "EUR")
		return { address: EURC_BASE_MAINNET, name: "EURC" };
		return network === "base"
		? { address: USDC_BASE_MAINNET, name: "USDC" }
		: { address: USDC_BASE_SEPOLIA, name: "USDC" };
		}
		function priceExpr(route, currency) {
		if (currency === "EUR") {
		return `{ asset: '${EURC_BASE_MAINNET}', amount: '${centsToAtomic(route.priceCents)}', extra: { name: 'EURC', version: '2' } }`;
		}
		return `'${centsToMoneyString(route.priceCents)}'`;
		}
		function routeMapJs(opts) {
		return opts.routes
		.map((route) => {
		const desc = (route.description ?? `Paid ${route.method} ${route.path}`).replace(/'/g, "");
		// The bazaar extension MUST declare the method — the facilitator's
		// register/catalog probe rejects method-less declarations. Query-style
		// methods (GET/DELETE) and body-carrying methods (POST/PUT) use the
		// extension's two declaration families.
		const bodyMethod = route.method === "POST" \|\| route.method === "PUT";
		const declare = bodyMethod
		? `declareDiscoveryExtension({ method: '${route.method}', bodyType: 'json', output: { example: { ok: true } } })`
		: `declareDiscoveryExtension({ method: '${route.method}', output: { example: { ok: true } } })`;
		return [
		` '${route.method} ${route.path}': {`,
		` accepts: {`,
		` scheme: 'exact',`,
		` price: ${priceExpr(route, opts.currency)},`,
		` network: NETWORK_CAIP2,`,
		` payTo: PAY_TO_ADDRESS,`,
		` maxTimeoutSeconds: 60,`,
		` },`,
		` description: '${desc}',`,
		` mimeType: 'application/json',`,
		` extensions: ${declare},`,
		` },`,
		].join("\n");
		})
		.join("\n");
		}
		/** Manifest file content — NO `updated` field (the server injects it at boot). */
		export function wrapManifestBase(opts) {
		const asset = assetFor(opts.network, opts.currency);
		const doc = {
		version: "1",
		merchant: { slug: opts.slug, name: opts.projectName },
		trust: { minTier: "any" },
		rails: [
		{
		scheme: "x402",
		network: CAIP2[opts.network],
		asset: asset.address,
		assetName: asset.name,
		payTo: opts.wallet,
		facilitator: defaultFacilitatorFor(opts.network),
		},
		],
		products: opts.routes.map((route) => ({
		path: route.path,
		method: route.method,
		priceCents: route.priceCents,
		...(route.description ? { description: route.description } : {}),
		})),
		};
		return `${JSON.stringify(doc, null, 2)}\n`;
		}
		function llmsTxt(opts) {
		const lines = [
		`# ${opts.projectName}`,
		``,
		`x402-payable API gateway (generated by \`npx paygate wrap\`). Paid routes`,
		`answer HTTP 402 with machine-readable payment requirements; pay with any`,
		`x402 client (e.g. \`npx payagent pay <url>\`).`,
		``,
		`## Machine-readable surfaces`,
		`- /.well-known/arispay.json — capability manifest (prices, payTo, facilitator)`,
		`- /health — unpaid liveness`,
		``,
		`## Paid routes (integer cents)`,
		...opts.routes.map((r) => `- ${r.method} ${r.path} — ${r.priceCents}¢ ${opts.currency}`),
		``,
		];
		return `${lines.join("\n")}\n`;
		}
		function serverJs(opts) {
		return `/**
		* x402 gateway for ${opts.upstream} — generated by \`npx paygate wrap\`.
		*
		* Unpaid surfaces: /health, /.well-known/arispay.json, /llms.txt.
		* Every other route proxies to UPSTREAM_URL; the routes listed in the
		* payment map below require a valid X-PAYMENT first.
		*/
		import { readFileSync } from 'node:fs';
		import express from 'express';
		import { paymentMiddleware, x402ResourceServer } from '@x402/express';
		import { HTTPFacilitatorClient } from '@x402/core/server';
		import { ExactEvmScheme } from '@x402/evm/exact/server';
		import { declareDiscoveryExtension } from '@x402/extensions/bazaar';

		const PAY_TO_ADDRESS = process.env.PAY_TO_ADDRESS;
		const UPSTREAM_URL = (process.env.UPSTREAM_URL \|\| '${opts.upstream}').replace(/\\/$/, '');
		const FACILITATOR_URL = process.env.FACILITATOR_URL \|\| '${defaultFacilitatorFor(opts.network)}';
		const NETWORK = process.env.NETWORK \|\| '${opts.network}';
		const PORT = parseInt(process.env.PORT \|\| '3000', 10);

		if (!PAY_TO_ADDRESS \|\| !/^0x[0-9a-fA-F]{40}$/.test(PAY_TO_ADDRESS)) {
		console.error('PAY_TO_ADDRESS env var is required and must be a 0x-prefixed EVM address');
		process.exit(1);
		}

		const NETWORK_TO_CAIP2 = { 'base-sepolia': '${CAIP2["base-sepolia"]}', base: '${CAIP2.base}' };
		const NETWORK_CAIP2 = NETWORK_TO_CAIP2[NETWORK] \|\| NETWORK;
		const SERVER_STARTED_AT = new Date().toISOString();

		// Manifest: deterministic base file + boot-time \`updated\` (last deploy).
		const manifestBase = JSON.parse(readFileSync(new URL('./arispay.manifest.json', import.meta.url), 'utf8'));
		const manifest = { ...manifestBase, updated: SERVER_STARTED_AT };

		const facilitatorClient = new HTTPFacilitatorClient({ url: FACILITATOR_URL });
		const resourceServer = new x402ResourceServer(facilitatorClient).register(
		NETWORK_CAIP2,
		new ExactEvmScheme(),
		);

		const app = express();
		app.set('trust proxy', 1);
		app.disable('x-powered-by');

		app.get('/health', (_req, res) => {
		res.json({ ok: true, upstream: UPSTREAM_URL, network: NETWORK, facilitator: FACILITATOR_URL });
		});
		app.get('/.well-known/arispay.json', (_req, res) => {
		res.set('cache-control', 'public, max-age=3600').json(manifest);
		});
		app.get('/llms.txt', (_req, res) => {
		res.type('text/plain').send(readFileSync(new URL('./llms.txt', import.meta.url), 'utf8'));
		});

		// Paywall — requests matching this map must carry a valid X-PAYMENT header.
		app.use(
		paymentMiddleware(
		{
		${routeMapJs(opts)}
		},
		resourceServer,
		),
		);

		// Reverse proxy — reached unpaid for ungated routes, post-payment for gated
		// ones. Streams the upstream response; hop-by-hop headers are dropped.
		const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'host', 'content-length']);
		app.use(async (req, res) => {
		try {
		const headers = {};
		for (const [key, value] of Object.entries(req.headers)) {
		if (!HOP_BY_HOP.has(key.toLowerCase()) && typeof value === 'string') headers[key] = value;
		}
		const hasBody = !['GET', 'HEAD'].includes(req.method);
		const upstream = await fetch(\`\${UPSTREAM_URL}\${req.originalUrl}\`, {
		method: req.method,
		headers,
		...(hasBody ? { body: req, duplex: 'half' } : {}),
		redirect: 'manual',
		});
		res.status(upstream.status);
		upstream.headers.forEach((value, key) => {
		if (!HOP_BY_HOP.has(key)) res.set(key, value);
		});
		res.send(Buffer.from(await upstream.arrayBuffer()));
		} catch (err) {
		res.status(502).json({
		error: { code: 'UPSTREAM_UNREACHABLE', message: String(err), retryable: true },
		});
		}
		});

		app.listen(PORT, () => {
		console.log(\`x402 gateway listening on :\${PORT} → \${UPSTREAM_URL}\`);
		console.log(\`network=\${NETWORK} payTo=\${PAY_TO_ADDRESS} facilitator=\${FACILITATOR_URL}\`);
		});
		`;
		}
		const GITIGNORE = "node_modules/\n.env\n";
		function envExample(opts) {
		return [
		`# ${opts.projectName} — generated by paygate wrap`,
		`PAY_TO_ADDRESS=${opts.wallet}`,
		`UPSTREAM_URL=${opts.upstream}`,
		`FACILITATOR_URL=${defaultFacilitatorFor(opts.network)}`,
		`NETWORK=${opts.network}`,
		`PORT=3000`,
		``,
		].join("\n");
		}
		function readme(opts) {
		return [
		`# ${opts.projectName}`,
		``,
		`x402 payment gateway in front of \`${opts.upstream}\`, generated by`,
		`\`npx paygate wrap\`. Account-free: the wallet in \`PAY_TO_ADDRESS\``,
		`receives funds directly.`,
		``,
		"```bash",
		`npm install`,
		`cp .env.example .env`,
		`npm start`,
		"```",
		``,
		`Then, once this gateway is publicly reachable over HTTPS:`,
		``,
		"```bash",
		`npx paygate register https://<your-domain>${opts.routes[0]?.path ?? "/"}`,
		`npx paygate verify https://<your-domain>${opts.routes[0]?.path ?? "/"}`,
		"```",
		``,
		`Ordering matters: wrap → deploy → register → verify. The facilitator`,
		`probes the URL before cataloging, so register only after deploy.`,
		``,
		].join("\n");
		}
		const X402_EXPRESS_RANGE = "^2.8.0";
		export function generateWrapFiles(opts) {
		const files = [
		{
		path: "package.json",
		content: `${JSON.stringify({
		name: opts.projectName,
		version: "0.1.0",
		private: true,
		type: "module",
		description: `x402 gateway for ${opts.upstream} generated by paygate wrap`,
		scripts: {
		start: "node --env-file=.env server.js",
		dev: "node --env-file=.env --watch server.js",
		},
		engines: { node: ">=20.6" },
		dependencies: {
		"@x402/core": X402_EXPRESS_RANGE,
		"@x402/evm": X402_EXPRESS_RANGE,
		"@x402/express": X402_EXPRESS_RANGE,
		"@x402/extensions": X402_EXPRESS_RANGE,
		express: "^4.21.2",
		},
		}, null, 2)}\n`,
		},
		{ path: "server.js", content: serverJs(opts) },
		{ path: "arispay.manifest.json", content: wrapManifestBase(opts) },
		{ path: "llms.txt", content: llmsTxt(opts) },
		{ path: ".env.example", content: envExample(opts) },
		{ path: ".gitignore", content: GITIGNORE },
		{ path: "README.md", content: readme(opts) },
		];
		if (opts.openapiDocumented) {
		files.push({ path: "openapi.json", content: opts.openapiDocumented });
		}
		return files;
		}
		//# sourceMappingURL=wrap-templates.js.map

+1

dist/wrap-templates.js.map

+81

dist/wrap.d.ts

		/**
		* `paygate wrap` — gate an EXISTING upstream API behind x402, unattended.
		*
		* Flow (the M2M onboarding ordering): wrap → deploy → register → verify.
		* This command does step 1 only: it derives the gating config (from flags or
		* --from-openapi), and writes a deployable gateway project + manifest.
		*
		* Machine contract: zero prompts ever (unlike init there is no TTY prompt
		* path — wrap is agent-first); all failures are S2-structured with --json
		* (`{ error: { code, message, retryable } }`); re-runs are idempotent, and
		* conflicting files produce a diff summary instead of silent refusal.
		*/
		import { type WrapOptions, type WrapRoute } from "./wrap-templates.js";
		export interface WrapError {
		code: string;
		message: string;
		retryable: boolean;
		}
		export interface WrapIO {
		stdout: (s: string) => void;
		stderr: (s: string) => void;
		}
		export interface OpenApiDerivation {
		routes: WrapRoute[];
		/** The spec with 402 responses documented on every gated operation. */
		documented: string;
		}
		/**
		* Derive gated routes from an OpenAPI 3.x JSON document and document the
		* 402 response into each gated operation. Per-operation price override via
		* the `x-arispay-price-cents` extension (integer cents); default otherwise.
		*/
		export declare function deriveFromOpenApi(raw: string, defaultPriceCents: number): {
		ok: true;
		value: OpenApiDerivation;
		} \| {
		ok: false;
		error: WrapError;
		};
		export interface WrapArgs {
		upstream?: string;
		wallet?: string;
		price?: string;
		currency?: string;
		network?: string;
		scheme?: string;
		asset?: string;
		route?: string;
		method?: string;
		fromOpenapi?: string;
		directory?: string;
		name?: string;
		json: boolean;
		dryRun: boolean;
		help: boolean;
		}
		export declare function parseWrapArgv(argv: string[]): {
		ok: true;
		args: WrapArgs;
		} \| {
		ok: false;
		error: WrapError;
		};
		export declare function validateWrapArgs(args: WrapArgs, openapiRoutes?: WrapRoute[]): {
		ok: true;
		options: WrapOptions & {
		directory: string;
		dryRun: boolean;
		};
		} \| {
		ok: false;
		error: WrapError;
		};
		/** First-differing-line summary per conflicting file — the re-run diff. */
		export declare function diffSummary(directory: string, files: Array<{
		path: string;
		content: string;
		}>, conflicts: string[]): string;
		export declare const WRAP_HELP_TEXT = "paygate wrap \u2014 put an x402 paywall in front of an existing API.\n\nZero prompts, agent-first. Ordering: wrap \u2192 deploy \u2192 register \u2192 verify.\n\nUsage:\n npx paygate wrap --upstream https://api.example.com --wallet 0xYourAddress [options]\n\nOptions:\n --upstream <url> The API to gate (required; https, or http://localhost)\n --wallet <0x...> Receiving EVM address (required; public info, no key is generated)\n --price <cents> Default price per request in INTEGER cents (default: 1)\n --currency <cur> USD \| EUR (default USD; EUR requires --network base)\n --network <net> base \| base-sepolia (default base-sepolia)\n --scheme <s> x402 scheme; only \"exact\" is supported\n --asset <0x...> Override the settlement asset contract (advanced)\n --route <path> Single gated route (default: /* \u2014 gate everything)\n --method <verb> Method for --route (default GET)\n --from-openapi <src> Derive gated routes from an OpenAPI 3.x JSON URL or\n file; documents 402 responses into ./openapi.json.\n Per-op price override: x-arispay-price-cents.\n --directory <dir> Target directory (default ./<derived-name>)\n --name <name> Project/manifest name (default derived from upstream host)\n --json Machine output (S2 errors + result JSON)\n --dry-run Print the file plan, write nothing\n";
		export declare function runWrap(argv: string[], io?: WrapIO, fetchImpl?: typeof fetch): Promise<number>;
		//# sourceMappingURL=wrap.d.ts.map

+1

dist/wrap.d.ts.map

{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../src/wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAQD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,iBAAiB,EAAE,MAAM,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CA8E1E;AAID,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf;AAuBD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAmB5G;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,EACd,aAAa,CAAC,EAAE,SAAS,EAAE,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CA2E/G;AAID,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAiB3H;AAID,eAAO,MAAM,cAAc,i8CAwB1B,CAAC;AAEF,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,GAAE,MAA2F,EAC/F,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,CA0FjB"}

+358

dist/wrap.js

		/**
		* `paygate wrap` — gate an EXISTING upstream API behind x402, unattended.
		*
		* Flow (the M2M onboarding ordering): wrap → deploy → register → verify.
		* This command does step 1 only: it derives the gating config (from flags or
		* --from-openapi), and writes a deployable gateway project + manifest.
		*
		* Machine contract: zero prompts ever (unlike init there is no TTY prompt
		* path — wrap is agent-first); all failures are S2-structured with --json
		* (`{ error: { code, message, retryable } }`); re-runs are idempotent, and
		* conflicting files produce a diff summary instead of silent refusal.
		*/
		import * as fs from "node:fs";
		import * as path from "node:path";
		import { WALLET_RE, checkWritePlan, writeFiles } from "./init.js";
		import { generateWrapFiles, } from "./wrap-templates.js";
		const NETWORKS = ["base", "base-sepolia"];
		const CURRENCIES = ["USD", "EUR"];
		const METHODS = new Set(["GET", "POST", "PUT", "DELETE"]);
		const MAX_OPENAPI_ROUTES = 200;
		const MAX_OPENAPI_BYTES = 2 * 1024 * 1024;
		function fail(code, message, retryable = false) {
		return { code, message, retryable };
		}
		/**
		* Derive gated routes from an OpenAPI 3.x JSON document and document the
		* 402 response into each gated operation. Per-operation price override via
		* the `x-arispay-price-cents` extension (integer cents); default otherwise.
		*/
		export function deriveFromOpenApi(raw, defaultPriceCents) {
		if (Buffer.byteLength(raw, "utf8") > MAX_OPENAPI_BYTES) {
		return { ok: false, error: fail("OPENAPI_TOO_LARGE", `spec exceeds ${MAX_OPENAPI_BYTES} bytes`) };
		}
		let spec;
		try {
		spec = JSON.parse(raw);
		}
		catch {
		return {
		ok: false,
		error: fail("OPENAPI_INVALID_JSON", "spec is not valid JSON (YAML specs are not supported in v1 — convert to JSON)"),
		};
		}
		const paths = spec.paths;
		if (!paths \|\| typeof paths !== "object") {
		return { ok: false, error: fail("OPENAPI_NO_PATHS", "spec has no paths object") };
		}
		const routes = [];
		const documented = structuredClone(spec);
		const docPaths = documented.paths;
		for (const [rawPath, ops] of Object.entries(paths)) {
		if (typeof ops !== "object" \|\| ops === null)
		continue;
		for (const [verb, op] of Object.entries(ops)) {
		const method = verb.toUpperCase();
		if (!METHODS.has(method) \|\| typeof op !== "object" \|\| op === null)
		continue;
		const override = op["x-arispay-price-cents"];
		let priceCents = defaultPriceCents;
		if (override !== undefined) {
		if (!Number.isInteger(override) \|\| override < 1) {
		return {
		ok: false,
		error: fail("OPENAPI_BAD_PRICE", `${method} ${rawPath}: x-arispay-price-cents must be an integer >= 1 (integer cents, never floats)`),
		};
		}
		priceCents = override;
		}
		const expressPath = rawPath.replace(/\{([^}/]+)\}/g, ":$1");
		if (!/^\/[A-Za-z0-9._~/:-]*$/.test(expressPath) \|\| expressPath.includes("..")) {
		return { ok: false, error: fail("OPENAPI_BAD_PATH", `unsupported path characters in ${rawPath}`) };
		}
		const summary = op.summary;
		routes.push({
		method: method,
		path: expressPath,
		priceCents,
		description: typeof summary === "string" ? summary.slice(0, 200) : undefined,
		});
		// Document the 402 into the spec copy.
		const docOp = docPaths[rawPath]?.[verb];
		if (docOp) {
		const responses = (docOp.responses ?? {});
		responses["402"] = {
		description: "Payment Required (x402). The body and the payment-required header carry machine-readable payment requirements; retry with a valid X-PAYMENT header.",
		};
		docOp.responses = responses;
		}
		if (routes.length > MAX_OPENAPI_ROUTES) {
		return {
		ok: false,
		error: fail("OPENAPI_TOO_MANY_ROUTES", `more than ${MAX_OPENAPI_ROUTES} operations; gate a subset with --route`),
		};
		}
		}
		}
		if (routes.length === 0) {
		return { ok: false, error: fail("OPENAPI_NO_OPERATIONS", "spec has no gateable operations") };
		}
		documented["x-arispay"] = {
		generator: "paygate wrap",
		note: "402 responses documented per operation; see /.well-known/arispay.json for live terms",
		};
		return { ok: true, value: { routes, documented: `${JSON.stringify(documented, null, 2)}\n` } };
		}
		const VALUE_FLAGS = {
		"--upstream": "upstream",
		"--wallet": "wallet",
		"--price": "price",
		"--currency": "currency",
		"--network": "network",
		"--scheme": "scheme",
		"--asset": "asset",
		"--route": "route",
		"--method": "method",
		"--from-openapi": "fromOpenapi",
		"--directory": "directory",
		"--name": "name",
		};
		const BOOL_FLAGS = {
		"--json": "json",
		"--dry-run": "dryRun",
		"--help": "help",
		"-h": "help",
		};
		export function parseWrapArgv(argv) {
		const args = { json: false, dryRun: false, help: false };
		for (let i = 0; i < argv.length; i++) {
		const token = argv[i];
		const eq = token.indexOf("=");
		const flag = eq > 0 ? token.slice(0, eq) : token;
		if (BOOL_FLAGS[flag]) {
		args[BOOL_FLAGS[flag]] = true;
		continue;
		}
		const key = VALUE_FLAGS[flag];
		if (!key)
		return { ok: false, error: fail("UNKNOWN_FLAG", `unknown flag ${flag}`) };
		const value = eq > 0 ? token.slice(eq + 1) : argv[++i];
		if (value === undefined \|\| value.startsWith("--")) {
		return { ok: false, error: fail("MISSING_VALUE", `${flag} requires a value`) };
		}
		args[key] = value;
		}
		return { ok: true, args };
		}
		export function validateWrapArgs(args, openapiRoutes) {
		if (!args.upstream) {
		return { ok: false, error: fail("MISSING_UPSTREAM", "--upstream is required (the URL of the API to gate)") };
		}
		let upstream;
		try {
		upstream = new URL(args.upstream);
		}
		catch {
		return { ok: false, error: fail("BAD_UPSTREAM", `--upstream is not a valid URL: ${args.upstream}`) };
		}
		const localhost = upstream.hostname === "localhost" \|\| upstream.hostname === "127.0.0.1";
		if (upstream.protocol !== "https:" && !(upstream.protocol === "http:" && localhost)) {
		return { ok: false, error: fail("BAD_UPSTREAM", "--upstream must be https (http allowed for localhost only)") };
		}
		if (!args.wallet \|\| !WALLET_RE.test(args.wallet)) {
		return { ok: false, error: fail("MISSING_WALLET", "--wallet is required: the 0x EVM address that receives funds (no key generation — bring a receiving address)") };
		}
		if (args.scheme !== undefined && args.scheme !== "exact") {
		return { ok: false, error: fail("UNSUPPORTED_SCHEME", `only scheme "exact" is supported (got "${args.scheme}")`) };
		}
		const network = (args.network ?? "base-sepolia");
		if (!NETWORKS.includes(network)) {
		return { ok: false, error: fail("BAD_NETWORK", `--network must be base or base-sepolia (got "${args.network}")`) };
		}
		const currency = (args.currency ?? "USD").toUpperCase();
		if (!CURRENCIES.includes(currency)) {
		return { ok: false, error: fail("BAD_CURRENCY", `--currency must be USD or EUR (got "${args.currency}")`) };
		}
		if (currency === "EUR" && network !== "base") {
		return { ok: false, error: fail("EUR_REQUIRES_MAINNET", "--currency EUR requires --network base (no EURC testnet path)") };
		}
		if (args.asset !== undefined && !WALLET_RE.test(args.asset)) {
		return { ok: false, error: fail("BAD_ASSET", "--asset must be a 0x40-hex token contract address") };
		}
		const rawPrice = args.price ?? "1";
		if (!/^\d+$/.test(rawPrice.trim())) {
		return { ok: false, error: fail("BAD_PRICE", `--price must be INTEGER cents (got "${rawPrice}"): for $0.10 pass --price 10 — never floats, never dollar strings`) };
		}
		const priceCents = Number.parseInt(rawPrice.trim(), 10);
		if (priceCents < 1) {
		return { ok: false, error: fail("BAD_PRICE", "--price must be >= 1 cent") };
		}
		let routes;
		if (openapiRoutes) {
		routes = openapiRoutes;
		}
		else {
		const routePath = args.route ?? "/*";
		if (!/^\/[A-Za-z0-9._~/:-]$/.test(routePath) \|\| routePath.includes("..")) {
		return { ok: false, error: fail("BAD_ROUTE", `--route must start with "/" and use URL-path characters (got "${routePath}")`) };
		}
		const method = (args.method ?? "GET").toUpperCase();
		if (!METHODS.has(method)) {
		return { ok: false, error: fail("BAD_METHOD", `--method must be GET\|POST\|PUT\|DELETE (got "${args.method}")`) };
		}
		routes = [{ method: method, path: routePath, priceCents }];
		}
		const projectName = args.name ?? `x402-gateway-${upstream.hostname.replace(/[^a-z0-9-]/gi, "-").toLowerCase()}`;
		const slug = projectName.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").slice(0, 60);
		return {
		ok: true,
		options: {
		upstream: upstream.href.replace(/\/$/, ""),
		wallet: args.wallet,
		network,
		currency,
		routes,
		projectName,
		slug,
		directory: args.directory ?? `./${projectName}`,
		dryRun: args.dryRun,
		},
		};
		}
		// ── Diff output for idempotent re-runs ─────────────────────────────────
		/** First-differing-line summary per conflicting file — the re-run diff. */
		export function diffSummary(directory, files, conflicts) {
		const lines = [];
		for (const conflictPath of conflicts) {
		const planned = files.find((f) => f.path === conflictPath);
		if (!planned)
		continue;
		const existing = fs.readFileSync(path.join(directory, conflictPath), "utf8");
		const a = existing.split("\n");
		const b = planned.content.split("\n");
		let firstDiff = 0;
		while (firstDiff < Math.min(a.length, b.length) && a[firstDiff] === b[firstDiff])
		firstDiff++;
		lines.push(` ${conflictPath}: differs from line ${firstDiff + 1} (existing ${a.length} lines / planned ${b.length} lines)`, ` - ${a[firstDiff]?.slice(0, 120) ?? "<eof>"}`, ` + ${b[firstDiff]?.slice(0, 120) ?? "<eof>"}`);
		}
		return lines.join("\n");
		}
		// ── Entry point ────────────────────────────────────────────────────────
		export const WRAP_HELP_TEXT = `paygate wrap — put an x402 paywall in front of an existing API.

		Zero prompts, agent-first. Ordering: wrap → deploy → register → verify.

		Usage:
		npx paygate wrap --upstream https://api.example.com --wallet 0xYourAddress [options]

		Options:
		--upstream <url> The API to gate (required; https, or http://localhost)
		--wallet <0x...> Receiving EVM address (required; public info, no key is generated)
		--price <cents> Default price per request in INTEGER cents (default: 1)
		--currency <cur> USD \| EUR (default USD; EUR requires --network base)
		--network <net> base \| base-sepolia (default base-sepolia)
		--scheme <s> x402 scheme; only "exact" is supported
		--asset <0x...> Override the settlement asset contract (advanced)
		--route <path> Single gated route (default: /* — gate everything)
		--method <verb> Method for --route (default GET)
		--from-openapi <src> Derive gated routes from an OpenAPI 3.x JSON URL or
		file; documents 402 responses into ./openapi.json.
		Per-op price override: x-arispay-price-cents.
		--directory <dir> Target directory (default ./<derived-name>)
		--name <name> Project/manifest name (default derived from upstream host)
		--json Machine output (S2 errors + result JSON)
		--dry-run Print the file plan, write nothing
		`;
		export async function runWrap(argv, io = { stdout: (s) => process.stdout.write(s), stderr: (s) => process.stderr.write(s) }, fetchImpl = fetch) {
		const emitError = (json, error) => {
		const payload = `${JSON.stringify({ error }, null, json ? 2 : 0)}\n`;
		if (json)
		io.stdout(payload);
		else
		io.stderr(`error [${error.code}]: ${error.message}\n`);
		return 1;
		};
		const parsed = parseWrapArgv(argv);
		if (!parsed.ok)
		return emitError(argv.includes("--json"), parsed.error);
		const args = parsed.args;
		if (args.help) {
		io.stdout(WRAP_HELP_TEXT);
		return 0;
		}
		// --from-openapi: URL or local file, JSON only.
		let openapi;
		if (args.fromOpenapi) {
		let raw;
		if (/^https?:\/\//.test(args.fromOpenapi)) {
		try {
		const res = await fetchImpl(args.fromOpenapi, {
		headers: { accept: "application/json" },
		redirect: "manual",
		signal: AbortSignal.timeout(15_000),
		});
		if (!res.ok) {
		return emitError(args.json, fail("OPENAPI_FETCH_FAILED", `GET ${args.fromOpenapi} returned ${res.status}`, true));
		}
		raw = await res.text();
		}
		catch (err) {
		return emitError(args.json, fail("OPENAPI_FETCH_FAILED", `fetch failed: ${String(err)}`, true));
		}
		}
		else {
		try {
		raw = fs.readFileSync(args.fromOpenapi, "utf8");
		}
		catch (err) {
		return emitError(args.json, fail("OPENAPI_READ_FAILED", `cannot read ${args.fromOpenapi}: ${String(err)}`));
		}
		}
		const derived = deriveFromOpenApi(raw, Number.parseInt(args.price ?? "1", 10) \|\| 1);
		if (!derived.ok)
		return emitError(args.json, derived.error);
		openapi = derived.value;
		}
		const validated = validateWrapArgs(args, openapi?.routes);
		if (!validated.ok)
		return emitError(args.json, validated.error);
		const options = validated.options;
		if (openapi)
		options.openapiDocumented = openapi.documented;
		const files = generateWrapFiles(options);
		if (options.dryRun) {
		const plan = files.map((f) => ({ path: f.path, bytes: Buffer.byteLength(f.content, "utf8") }));
		io.stdout(args.json
		? `${JSON.stringify({ dryRun: true, directory: options.directory, files: plan, routes: options.routes }, null, 2)}\n`
		: `${plan.map((f) => `${f.path} (${f.bytes} bytes)`).join("\n")}\nDry run — nothing written. ${options.routes.length} gated route(s).\n`);
		return 0;
		}
		const plan = checkWritePlan(options.directory, files);
		if (plan.conflicts.length > 0) {
		const diff = diffSummary(options.directory, files, plan.conflicts);
		if (args.json) {
		io.stdout(`${JSON.stringify({ error: fail("WRITE_CONFLICT", `${plan.conflicts.length} file(s) differ from the plan`), conflicts: plan.conflicts }, null, 2)}\n`);
		}
		else {
		io.stderr(`Refusing to overwrite files that differ from the plan (re-running over an identical scaffold is fine):\n${diff}\n`);
		}
		return 1;
		}
		writeFiles(options.directory, plan.create);
		const result = {
		directory: options.directory,
		created: plan.create.map((f) => f.path),
		identical: plan.identical,
		routes: options.routes,
		manifest: "/.well-known/arispay.json",
		nextSteps: [
		`cd ${options.directory} && npm install && cp .env.example .env && npm start`,
		"deploy publicly over HTTPS",
		"npx paygate register <public-url-of-a-gated-route>",
		"npx paygate verify <public-url-of-a-gated-route>",
		],
		};
		io.stdout(args.json ? `${JSON.stringify(result, null, 2)}\n` : `Created ${plan.create.length} file(s) in ${options.directory}${plan.identical.length ? ` (${plan.identical.length} already up to date)` : ""}.\nGated ${options.routes.length} route(s); manifest at /.well-known/arispay.json.\nNext: ${result.nextSteps.join(" → ")}\n`);
		return 0;
		}
		//# sourceMappingURL=wrap.js.map

+1

dist/wrap.js.map

+5

-1

dist/cli.d.ts

		@@ -6,7 +6,11 @@ #!/usr/bin/env node
		* npx paygate init [flags] scaffold a working x402 seller
		* npx paygate wrap [flags] gate an EXISTING upstream API (agent-first)
		* npx paygate register <url> announce a deployed endpoint to the facilitator
		* npx paygate verify <url> onboarding acceptance check + receipt
		* npx paygate doctor <url> validate Base mainnet readiness
		*
		* Zero runtime deps — see init.ts for the implementation.
		* Onboarding ordering: wrap → deploy → register → verify.
		* Zero runtime deps — see init.ts / wrap.ts for the implementation.
		*/
		export {};
		//# sourceMappingURL=cli.d.ts.map

+1

-1

dist/cli.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG"}
		{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG"}

+18

-2

dist/cli.js

		@@ -6,8 +6,15 @@ #!/usr/bin/env node
		* npx paygate init [flags] scaffold a working x402 seller
		* npx paygate wrap [flags] gate an EXISTING upstream API (agent-first)
		* npx paygate register <url> announce a deployed endpoint to the facilitator
		* npx paygate verify <url> onboarding acceptance check + receipt
		* npx paygate doctor <url> validate Base mainnet readiness
		*
		* Zero runtime deps — see init.ts for the implementation.
		* Onboarding ordering: wrap → deploy → register → verify.
		* Zero runtime deps — see init.ts / wrap.ts for the implementation.
		*/
		import { runDoctor } from "./doctor.js";
		import { HELP_TEXT, runInit } from "./init.js";
		import { runRegister } from "./register.js";
		import { runVerify } from "./verify.js";
		import { runWrap } from "./wrap.js";
		async function main() {
		@@ -18,2 +25,11 @@ const [command, ...rest] = process.argv.slice(2);
		}
		if (command === "wrap") {
		return runWrap(rest);
		}
		if (command === "register") {
		return runRegister(rest);
		}
		if (command === "verify") {
		return runVerify(rest);
		}
		if (command === "doctor" \|\| command === "check") {
		@@ -23,3 +39,3 @@ return runDoctor(rest);
		if (command === undefined \|\| command === "--help" \|\| command === "-h" \|\| command === "help") {
		process.stdout.write(`paygate — make your API payable in one command.\n\nCommands:\n init scaffold a working x402 seller\n doctor\|check validate an unpaid Base mainnet x402 endpoint\n\n${HELP_TEXT}`);
		process.stdout.write(`paygate — make your API payable in one command.\n\nCommands:\n init scaffold a working x402 seller\n wrap gate an EXISTING upstream API (agent-first, zero prompts)\n register announce a deployed endpoint to the facilitator catalog\n verify onboarding acceptance check (402 + manifest + catalog) + receipt\n doctor\|check validate an unpaid Base mainnet x402 endpoint\n\nOnboarding ordering: wrap → deploy → register → verify.\n\n${HELP_TEXT}`);
		return command === undefined ? 1 : 0;
		@@ -26,0 +42,0 @@ }

+1

-1

dist/cli.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/C,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kLAAkL,SAAS,EAAE,CAC9L,CAAC;QACF,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,uCAAuC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}
		{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mdAAmd,SAAS,EAAE,CAC/d,CAAC;QACF,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,uCAAuC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

+6

-0

dist/index.d.ts

		@@ -29,2 +29,8 @@ /**
		export type { GhostPayPartnerConfig, GhostPaymentLink, GhostWebhookPayload, } from "./ghost-partner.js";
		export { buildSellerManifest, validateCapabilityManifest, } from "./manifest.js";
		export type { CapabilityManifestV1, ManifestProduct, ManifestRail, ManifestValidation, } from "./manifest.js";
		export { registerResource } from "./register.js";
		export type { RegisterResult } from "./register.js";
		export { verifyUrl } from "./verify.js";
		export type { VerifyCheck, VerifyReceipt } from "./verify.js";
		//# sourceMappingURL=index.d.ts.map

+1

-1

dist/index.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAChF,YAAY,EACV,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,wBAAwB,GACzB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC"}
		{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAChF,YAAY,EACV,aAAa,EACb,eAAe,EACf,UAAU,EACV,aAAa,EACb,wBAAwB,GACzB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

+5

-0

dist/index.js

		@@ -31,2 +31,7 @@ /**
		export { GhostPayPartner } from "./ghost-partner.js";
		// Machine-executable onboarding (M2M Session 2): manifest utilities +
		// programmatic register/verify. CLI verbs: wrap / register / verify.
		export { buildSellerManifest, validateCapabilityManifest, } from "./manifest.js";
		export { registerResource } from "./register.js";
		export { verifyUrl } from "./verify.js";
		//# sourceMappingURL=index.js.map

+1

-1

dist/index.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAShF,UAAU;AACV,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAE/D,oCAAoC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAShF,UAAU;AACV,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAE/D,oCAAoC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAOrD,sEAAsE;AACtE,qEAAqE;AACrE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

+8

-9

package.json

		{
		"name": "paygate",
		"version": "5.5.0",
		"version": "5.6.0",
		"description": "Accept payment from AI agents in two lines of code. Gate any Express or Fastify route with an x402 paywall — USD (USDC) or EUR (EURC) pricing, settled on Base mainnet via ArisPay's facilitator.",
		@@ -25,9 +25,2 @@ "type": "module",
		},
		"scripts": {
		"build": "tsc && chmod +x dist/cli.js",
		"dev": "tsc --watch",
		"type-check": "tsc --noEmit",
		"test": "vitest run --root ../.. packages/paygate/src/",
		"prepublishOnly": "pnpm build"
		},
		"dependencies": {},
		@@ -99,3 +92,9 @@ "peerDependencies": {
		"url": "https://github.com/arispay-inc/arispay-x402/issues"
		},
		"scripts": {
		"build": "tsc && chmod +x dist/cli.js",
		"dev": "tsc --watch",
		"type-check": "tsc --noEmit",
		"test": "vitest run --root ../.. packages/paygate/src/"
		}
		}
		}

paygate - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics