Pay x402 gateways when an audit meets one

lib/onion.ts

@@ -2,6 +2,7 @@ import tls from "node:tls";
 import { Agent, type buildConnector, type Dispatcher } from "undici";
 import { SocksClient } from "socks";
 import { env } from "./env";
+import { paidFetch } from "./paid-fetch";
 
 // Tor routing for .onion targets. Onion addresses don't resolve via DNS, so any
 // fetch to one must go through a Tor SOCKS5 proxy (socks5h — the proxy resolves
@@ -58,7 +59,9 @@ function torDispatcher(): Dispatcher {
 // Fetch that transparently routes .onion targets through Tor and everything
 // else through the normal stack. Callers pass their usual RequestInit.
 export async function smartFetch(url: string, init?: RequestInit): Promise<Response> {
-  if (!isOnion(url)) return fetch(url, init);
+  // The clearnet path pays an x402 gateway when a key is configured; Tor
+  // keeps the plain fetch, since the pass and the proof are clearnet things.
+  if (!isOnion(url)) return paidFetch(url, init);
   if (!torConfigured()) {
     throw new Error(
       "This is a .onion address; set TOR_SOCKS_URL and run a Tor proxy to reach it.",

lib/paid-fetch.ts

@@ -0,0 +1,26 @@
+/**
+ * The fetch the audit reaches a customer's site with — paying when asked.
+ *
+ * A site behind an x402 gateway answers a crawler with 402 and an offer. With
+ * `X402_PRIVATE_KEY` set, the client signs the offer with the shared crawler
+ * wallet, buys the pass, files it by origin and presents it on every later
+ * request to that site, so an audit of a gated site reads the site rather
+ * than the sales page. Without the key this is the global fetch, unchanged.
+ *
+ * Only the page fetch goes through here. Link-status probes and uptime pings
+ * touch many third-party domains per run, and paying a dollar to learn a
+ * link's status would be waste; those stay on the plain fetch.
+ *
+ * Capped at five dollars a payment. The key is read through a non-literal
+ * accessor because Next inlines `process.env.NAME` at build time.
+ */
+
+import { createClient } from "@profullstack/x402-client";
+
+const key = process.env[["X402", "PRIVATE_KEY"].join("_")];
+
+export const x402 = key ? createClient({ key, maxUsd: 5 }) : null;
+
+export const paidFetch: typeof fetch = x402
+  ? (input, init) => x402.fetch(input, init)
+  : (input, init) => fetch(input, init);

package.json

@@ -28,6 +28,7 @@
     "@profullstack/autoblog": "github:profullstack/autoblog#75e54af",
     "@profullstack/referrals": "^0.1.0",
     "@profullstack/stack": "^0.1.3",
+    "@profullstack/x402-client": "^0.2.0",
     "@supabase/ssr": "^0.10.3",
     "@supabase/supabase-js": "^2.105.4",
     "@types/nodemailer": "^8.0.0",