HTTP 402,
Zero Knowledge.

import { request as httpRequest } from 'node:http';
import {
  createX402Authorization,
  parsePaymentRequired,
  X402_BOLYRA_CREDENTIAL_HEADER,
  X402_BOLYRA_CHALLENGE_HEADER,
} from '@bolyra/payment-protocols';
import { createHumanIdentity, createAgentCredential } from '@bolyra/sdk';

// Minimal POST helper — replace with fetch/axios in production.
function post(headers: Record<string, string> = {}) {
  return new Promise<{ status: number; headers: any; body: string }>((resolve, reject) => {
    const req = httpRequest({ host: 'localhost', port: 4402, method: 'POST', headers }, (res) => {
      let body = '';
      res.on('data', (c) => (body += c));
      res.on('end', () => resolve({ status: res.statusCode!, headers: res.headers, body }));
    });
    req.on('error', reject);
    req.end();
  });
}

// Build human + agent fixtures. See @bolyra/sdk QUICKSTART.md for full setup.
async function buildFixtures() {
  const human = await createHumanIdentity('demo-secret');
  const agent = await createAgentCredential({ /* modelHash, operatorPrivKey, perms, expiry */ } as any);
  const spendPolicy = { maxTransactionAmount: 10_000, currency: 'USD' as const };
  return { human, agent, spendPolicy };
}

// === Phase 1: unauthorized request ===
const first = await post();
// → status: 402, header Bolyra-Challenge: <hex>

const requirements   = parsePaymentRequired(JSON.parse(first.body).accepts[0]);
const bolyraChallenge = BigInt('0x' + first.headers[X402_BOLYRA_CHALLENGE_HEADER.toLowerCase()]);

// === Phase 2: build Bolyra-Credential bound to the challenge ===
const { human, agent, spendPolicy } = await buildFixtures();
const auth = await createX402Authorization(
  human, agent, spendPolicy,
  { requirements, bolyraChallenge },
);
// auth.verified: true
// auth.score:    100 (grade A)
// auth.did:      did:bolyra:base-sepolia:<commitment>

// === Phase 3: retry with credential ===
const second = await post({
  [X402_BOLYRA_CREDENTIAL_HEADER]: auth.headers[X402_BOLYRA_CREDENTIAL_HEADER],
});
// → status: 200, body.result = { tool: 'demo.echo', … }

console.log('x402 round trip OK: 402 -> 200');

import {
  verifyX402Authorization,
  type X402PaymentRequirements,
} from '@bolyra/payment-protocols';

// You provide: resolve did:bolyra:* to the registered agent credential.
// Typically a DB lookup or cache hit.
async function lookupAgent(did: string) { return null; }

// Off-chain verifier — no gas, no on-chain registry lookup.
// Use this for batch verification or pre-flight checks before
// the standard x402 PAYMENT-SIGNATURE settlement runs.
export async function verifyOffChain(
  credentialHeader: string,
  requirements: X402PaymentRequirements,
) {
  const decision = await verifyX402Authorization(
    credentialHeader,
    requirements,
    async (did) => lookupAgent(did),
  );

  if (!decision.verified || decision.score < 70) {
    throw new Error('Payment authorization rejected');
  }

  // → continue to standard x402 settlement.
  //   The merchant never learned identity, exact spend cap,
  //   or delegation chain — only that consent was valid.
  console.log({
    did:             decision.did,
    score:           decision.score,  // 0..100
    grade:           decision.grade,  // 'A' | 'B' | 'C' | 'D' | 'F'
    scopeCommitment: decision.scopeCommitment,
    sessionNonce:    decision.sessionNonce,
  });
  return decision;
}