Agent calls API  →  HTTP 402  →  Conto pre-authorizes  →  Agent pays & retries  →  Conto records

const CONTO_API_BASE = 'https://conto.finance';
const contoApiKey = process.env.CONTO_API_KEY;

type PreAuthorizeResponse = {
  authorized: boolean;
  decision: 'approved' | 'declined' | 'review_required';
  message: string;
};

async function postConto<T>(path: string, body: unknown): Promise<T> {
  if (!contoApiKey) {
    throw new Error('CONTO_API_KEY is required');
  }

  const response = await fetch(`${CONTO_API_BASE}${path}`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${contoApiKey}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(body),
  });

  if (!response.ok) {
    throw new Error(`Conto ${path} failed: ${await response.text()}`);
  }

  return response.json() as Promise<T>;
}

async function callPaidApi(url: string) {
  const sessionId = crypto.randomUUID();

  // Step 1: Call the API
  const response = await fetch(url);

  if (response.status !== 402) {
    return response.json(); // No payment needed
  }

  // Step 2: Parse the 402 payment challenge
  const paymentHeader = response.headers.get('X-Payment');
  if (!paymentHeader) {
    throw new Error('Missing X-Payment header');
  }

  const {
    amount,
    recipient,
    facilitator,
    network,
    paymentId: challengePaymentId,
  } = JSON.parse(paymentHeader) as {
    amount: number;
    recipient: string;
    facilitator?: string;
    network: string;
    paymentId?: string;
  };
  const paymentId = challengePaymentId ?? crypto.randomUUID();
  const payerAddress = await walletProvider.getAddress();

  // Step 3: Pre-authorize through Conto
  const auth = await postConto<PreAuthorizeResponse>('/api/sdk/x402/pre-authorize', {
    amount,
    recipientAddress: recipient,
    resourceUrl: url,
    sessionId,
    paymentId,
    payerAddress,
    network,
  });

  if (!auth.authorized) {
    throw new Error(auth.message);
  }

  // Step 4: Sign and pay (via your wallet provider)
  const { txHash } = await walletProvider.signX402Payment({
    amount,
    recipient,
    facilitator,
    network,
  });

  // Step 5: Retry the API call with payment proof
  const paidResponse = await fetch(url, {
    headers: { 'X-Payment-Signature': txHash },
  });

  // Step 6: Record in Conto
  await postConto('/api/sdk/x402/record', {
    amount,
    recipientAddress: recipient,
    txHash,
    resourceUrl: url,
    paymentId,
    sessionId,
    payerAddress,
    network,
  });

  return paidResponse.json();
}