Charge each request with x402

npm add @sdxc/lazy-route @sdxc/result @sdxc/x402 remix

import type { Facilitator, SellerConfig } from "@sdxc/x402";

import { HTTPFacilitator, MemoryFacilitator } from "@sdxc/x402";
import { env } from "cloudflare:workers";

/** Base Sepolia USDC when `X402_ASSET` is unset locally. */
const DEFAULT_ASSET = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";

/** Base Sepolia CAIP-2 id when `X402_NETWORK` is unset locally. */
const DEFAULT_NETWORK = "eip155:84532";

/** Stand-in receive address for memory settlement. */
const DEFAULT_PAY_TO = "0x00000000000000000000000000000000000000fe";

/** Seller config the router middleware builds once per isolate. */
export function sellerConfig(): SellerConfig {
	let facilitatorUrl = readOptional("X402_FACILITATOR_URL");
	let facilitator: Facilitator = isHttpFacilitatorUrl(facilitatorUrl)
		? new HTTPFacilitator({ url: facilitatorUrl })
		: new MemoryFacilitator();

	return {
		facilitator,
		payTo: readOptional("X402_PAY_TO") ?? DEFAULT_PAY_TO,
		network: readOptional("X402_NETWORK") ?? DEFAULT_NETWORK,
		asset: readOptional("X402_ASSET") ?? DEFAULT_ASSET,
		serviceName: "shop",
	};
}

/** True when the configured facilitator is a real HTTP endpoint. */
function isHttpFacilitatorUrl(url: string | null): url is string {
	if (url === null || url === "" || url === "memory") return false;
	return /^https?:\/\//i.test(url);
}

/** Reads a secret that may be unset under Vitest's `test-<KEY>` stubs. */
function readOptional(name: keyof Cloudflare.Env): string | null {
	try {
		let value = env[name];
		if (typeof value !== "string") return null;
		let trimmed = value.trim();
		return trimmed === "" ? null : trimmed;
	} catch {
		return null;
	}
}

import { lazy } from "@sdxc/lazy-route";
import { requirePayment, x402 } from "@sdxc/x402/middleware";
import { createRouter } from "remix/router";

import { sellerConfig } from "~/app/initializers/x402";
import routes from "~/routes/api";

export function createWebRouter() {
	let router = createRouter({
		middleware: [x402(sellerConfig())],
	});

	router.map(
		routes.api.encode,
		lazy(
			() => import("~/app/http/controllers/api/encode"),
			[requirePayment({ amount: "1000", description: "Encode a QR symbol" })],
		),
	);

	return router;
}

import { createAction } from "remix/router";

import routes from "~/routes/api";

export default createAction(routes.api.encode, async (ctx) => {
	let body = (await ctx.request.json()) as { text: string };
	return Response.json({
		payment: {
			transaction: ctx.payment?.transaction,
			network: ctx.payment?.network,
			amount: ctx.payment?.amount,
		},
		result: { text: body.text, encoded: true },
	});
});

/** One sellable operation: id, price and what the 402 advertises. */
export interface Operation {
	id: string;
	amount: string;
	description: string;
}

const OPERATIONS: Operation[] = [
	{
		id: "qr.encode",
		amount: "1000",
		description: "Encode a QR symbol",
	},
	{
		id: "semver.satisfies",
		amount: "500",
		description: "Ask whether a version satisfies a range",
	},
];

/** Finds a catalog row by id, or `undefined` when the id is unknown. */
export function findOperation(id: string): Operation | undefined {
	return OPERATIONS.find((operation) => operation.id === id);
}

import type { Middleware } from "remix/router";

import { requirePayment } from "@sdxc/x402/middleware";

import { findOperation } from "~/config/catalog";

/**
 * Answers 404 for an unknown id, otherwise collects payment for that catalog row.
 */
export let requireCatalogPayment: Middleware = async (ctx, next) => {
	let id = ctx.params.id;
	if (typeof id !== "string" || id.includes("/")) {
		return Response.json({ error: "not_found" }, { status: 404 });
	}

	let operation = findOperation(id);
	if (operation === undefined) {
		return Response.json({ error: "not_found", id }, { status: 404 });
	}

	return requirePayment({
		amount: operation.amount,
		description: operation.description,
		resourceUrl: () => new URL(`/v1/${operation.id}`, ctx.url).href,
	})(ctx, next);
};

import type { Middleware } from "remix/router";

import { requirePayment } from "@sdxc/x402/middleware";

import { findOperation } from "~/config/catalog";

/** Header the Streamable HTTP transport uses to name the method. */
const MCP_METHOD = "mcp-method";

/** Header naming the tool on `tools/call`. */
const MCP_NAME = "mcp-name";

/**
 * Free MCP methods keep flowing; a priced `tools/call` answers 402 until settled.
 */
export let requireToolPayment: Middleware = async (ctx, next) => {
	if (ctx.request.headers.get(MCP_METHOD)?.toLowerCase() !== "tools/call") {
		return next();
	}

	let name = ctx.request.headers.get(MCP_NAME);
	if (name === null || name === "") return next();

	let operation = findOperation(name);
	if (operation === undefined) return next();

	return requirePayment({
		amount: operation.amount,
		description: operation.description,
		resourceUrl: () => `mcp://tool/${operation.id}`,
	})(ctx, next);
};

import type { PaymentRequired } from "@sdxc/x402";

import { isFailure } from "@sdxc/result";
import { PAYMENT_REQUIRED, PAYMENT_RESPONSE, decodeHeader } from "@sdxc/x402";
import { withMemoryPayment } from "@sdxc/x402/testing";
import { expect, test } from "vitest";

import { createWebRouter } from "~/app/initializers/router";

test("answers 402 without payment", async () => {
	let response = await createWebRouter().fetch(
		new Request("https://api.example/v1/encode", {
			method: "POST",
			headers: { "content-type": "application/json" },
			body: JSON.stringify({ text: "hello" }),
		}),
	);

	expect(response.status).toBe(402);
	expect(response.headers.get(PAYMENT_REQUIRED)).toBeTruthy();
});

test("runs after a memory payment", async () => {
	let router = createWebRouter();
	let challenge = await router.fetch(
		new Request("https://api.example/v1/encode", {
			method: "POST",
			headers: { "content-type": "application/json" },
			body: JSON.stringify({ text: "hello" }),
		}),
	);
	expect(challenge.status).toBe(402);

	let decoded = decodeHeader(challenge.headers.get(PAYMENT_REQUIRED)!);
	if (isFailure(decoded)) throw decoded.error;
	let accepts = (decoded.data as PaymentRequired).accepts;

	let paid = await router.fetch(
		new Request("https://api.example/v1/encode", {
			method: "POST",
			headers: {
				"content-type": "application/json",
				...withMemoryPayment(accepts[0]!),
			},
			body: JSON.stringify({ text: "hello" }),
		}),
	);

	expect(paid.status).toBe(200);
	expect(paid.headers.get(PAYMENT_RESPONSE)).toBeTruthy();
	let body = (await paid.json()) as { result: { encoded: boolean } };
	expect(body.result.encoded).toBe(true);
});