Sell accounts and API keys

pnpm add @zeroclickai/sellers

{ accountKey: "agent", remintPolicy: "rotating" }

{ accountKey: "accessId", remintPolicy: "additive" }

import { handleAccessRequest } from "@zeroclickai/sellers/stateful";

const options = {
  basePath: "/zeroclick/access",
  accountKey: "agent" as const,
  remintPolicy: "rotating" as const,
  secrets: {
    [process.env.ZEROCLICK_SIGNING_SECRET_KID!]:
      process.env.ZEROCLICK_SIGNING_SECRET!,
  },
  onHandlerError: (error: unknown, operation: "write" | "mint") => {
    logger.error({ error, operation }, "ZeroClick access handler failed");
  },
};

export async function handle(request: Request): Promise<Response> {
  const rawBody = new Uint8Array(await request.clone().arrayBuffer());
  const url = new URL(request.url);

  const result = await handleAccessRequest(
    {
      method: request.method,
      pathAndQuery: `${url.pathname}${url.search}`,
      rawBody,
      headers: Object.fromEntries(request.headers),
    },
    { onWrite, onMint },
    options,
  );

  // Not one of ZeroClick's two routes: let your own router handle it.
  if (result === null) return new Response("Not found", { status: 404 });

  return new Response(
    result.body === undefined ? null : JSON.stringify(result.body),
    {
      status: result.status,
      headers: {
        ...(result.body === undefined
          ? {}
          : { "content-type": "application/json" }),
        ...result.headers,
      },
    },
  );
}

import { deriveCreditDelta, shouldApply } from "@zeroclickai/sellers/stateful";
import type { WriteInput } from "@zeroclickai/sellers/stateful";

async function onWrite({ accountId, entitlement }: WriteInput) {
  await database.transaction(async (tx) => {
    const account = await tx.lockAccount(accountId);
    if (!shouldApply(account?.stateVersion, entitlement.stateVersion)) return;

    const delta = deriveCreditDelta(
      account
        ? {
            stateVersion: account.stateVersion,
            creditGrantedUsdMicros: account.creditGrantedUsdMicros,
            creditReversedUsdMicros: account.creditReversedUsdMicros,
          }
        : null,
      entitlement,
    );

    if (delta.outcome === "credit") {
      await tx.addCredit(accountId, delta.deltaUsdMicros);
      await tx.storeGrant(accountId, delta.next);
    } else if (delta.outcome === "debit") {
      // A refund or dispute clawed money back; clamp the balance at zero.
      await tx.subtractCredit(accountId, delta.deltaUsdMicros);
      await tx.storeGrant(accountId, delta.next);
    } else if (delta.outcome === "no_credit_dimension") {
      await tx.storeGrant(accountId, delta.next);
    }

    await tx.applyPlanAndPeriod(accountId, entitlement);
  });

  return { lifecycle: "active" as const };
}

import type { MintInput } from "@zeroclickai/sellers/stateful";

async function onMint({ accountId }: MintInput) {
  const plaintext = generateApiKey();
  const digest = hashApiKey(plaintext);

  const created = await database.transaction(async (tx) => {
    const account = await tx.lockActiveAccount(accountId);
    if (!account) return false;

    // Required when remintPolicy is "rotating"; skip it for additive keys.
    await tx.revokeLiveKeys(account.id);
    await tx.insertKeyHash(account.id, digest);
    return true;
  });

  return created ? { apiKey: plaintext } : { unknown: true as const };
}

https://acme.pay.zeroclick.io/extend?accessId=zacc_8h2m4x0q9k1f