Agent calls API  →  HTTP 402  →  Conto pre-authorizes  →  Agent pays & retries  →  Conto records

const CONTO_API_BASE = 'https://conto.finance';
const contoApiKey = process.env.CONTO_API_KEY;

type PreAuthorizeResponse = {
  authorized: boolean;
  reasons: string[];
  wallet?: { id: string; chainId: string; address: string };
};

async function postConto<T>(path: string, body: unknown): Promise<T> {
  if (!contoApiKey) {
    throw new Error('CONTO_API_KEY is required');
  }

  const response = await fetch(`${CONTO_API_BASE}${path}`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${contoApiKey}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(body),
  });

  if (!response.ok) {
    throw new Error(`Conto ${path} failed: ${await response.text()}`);
  }

  return response.json() as Promise<T>;
}

async function callPaidApi(url: string) {
  // Step 1: Call the API
  const response = await fetch(url);

  if (response.status !== 402) {
    return response.json(); // No payment needed
  }

  // Step 2: Parse the 402 payment challenge
  const paymentHeader = response.headers.get('X-Payment');
  if (!paymentHeader) {
    throw new Error('Missing X-Payment header');
  }

  const { amount, recipient, facilitator, paymentId } = JSON.parse(paymentHeader) as {
    amount: number;
    recipient: string;
    facilitator?: string;
    paymentId?: string;
  };

  // Step 3: Pre-authorize through Conto
  const auth = await postConto<PreAuthorizeResponse>('/api/sdk/x402/pre-authorize', {
    amount,
    recipientAddress: recipient,
    resourceUrl: url,
    facilitator,
    scheme: 'exact',
    paymentId,
  });

  if (!auth.authorized || !auth.wallet) {
    console.error('Policy denied x402 payment:', auth.reasons);
    throw new Error(`x402 denied: ${auth.reasons.join(', ')}`);
  }

  // Step 4: Sign and pay (via your wallet provider)
  const { txHash } = await walletProvider.signX402Payment({
    amount,
    recipient,
    facilitator,
  });

  // Step 5: Retry the API call with payment proof
  const paidResponse = await fetch(url, {
    headers: { 'X-Payment-Signature': txHash },
  });

  // Step 6: Record in Conto
  await postConto('/api/sdk/x402/record', {
    amount,
    recipientAddress: recipient,
    txHash,
    resourceUrl: url,
    facilitator,
    scheme: 'exact',
    paymentId,
    walletId: auth.wallet.id,
    chainId: auth.wallet.chainId,
  });

  return paidResponse.json();
}