402-trinity-gaming 0.1.0

package/dist/x402.js

@@ -0,0 +1,930 @@
+const RC_LO = new Uint32Array([
+  1,
+  32898,
+  32906,
+  2147516416,
+  32907,
+  2147483649,
+  2147516545,
+  32777,
+  138,
+  136,
+  2147516425,
+  2147483658,
+  2147516555,
+  139,
+  32905,
+  32771,
+  32770,
+  128,
+  32778,
+  2147483658,
+  2147516545,
+  32896,
+  2147483649,
+  2147516424
+]);
+const RC_HI = new Uint32Array([
+  0,
+  0,
+  2147483648,
+  2147483648,
+  0,
+  0,
+  2147483648,
+  2147483648,
+  0,
+  0,
+  0,
+  0,
+  0,
+  2147483648,
+  2147483648,
+  2147483648,
+  2147483648,
+  2147483648,
+  0,
+  2147483648,
+  2147483648,
+  2147483648,
+  0,
+  2147483648
+]);
+const RHO = new Uint8Array([
+  0,
+  1,
+  62,
+  28,
+  27,
+  36,
+  44,
+  6,
+  55,
+  20,
+  3,
+  10,
+  43,
+  25,
+  39,
+  41,
+  45,
+  15,
+  21,
+  8,
+  18,
+  2,
+  61,
+  56,
+  14
+]);
+const PI = (() => {
+  const p = new Uint8Array(25);
+  for (let y = 0; y < 5; y++) for (let x = 0; x < 5; x++) p[x + 5 * y] = y + 5 * ((2 * x + 3 * y) % 5);
+  return p;
+})();
+const _S = new Uint32Array(50);
+const _B = new Uint32Array(50);
+const _C = new Uint32Array(10);
+function keccakF(S) {
+  const B = _B, C = _C;
+  for (let rnd = 0; rnd < 24; rnd++) {
+    for (let x = 0; x < 5; x++) {
+      let lo = 0, hi = 0;
+      for (let y = 0; y < 25; y += 5) {
+        const i = x + y << 1;
+        lo ^= S[i];
+        hi ^= S[i + 1];
+      }
+      C[x << 1] = lo;
+      C[(x << 1) + 1] = hi;
+    }
+    for (let x = 0; x < 5; x++) {
+      const a = (x + 1) % 5 << 1, b = (x + 4) % 5 << 1;
+      const lo1 = C[a], hi1 = C[a + 1];
+      const dlo = C[b] ^ (lo1 << 1 | hi1 >>> 31);
+      const dhi = C[b + 1] ^ (hi1 << 1 | lo1 >>> 31);
+      for (let y = 0; y < 25; y += 5) {
+        const i = x + y << 1;
+        S[i] ^= dlo;
+        S[i + 1] ^= dhi;
+      }
+    }
+    for (let i = 0; i < 25; i++) {
+      const n = RHO[i], lo = S[i << 1], hi = S[(i << 1) + 1], d = PI[i] << 1;
+      if (n === 0) {
+        B[d] = lo;
+        B[d + 1] = hi;
+      } else if (n < 32) {
+        B[d] = lo << n | hi >>> 32 - n;
+        B[d + 1] = hi << n | lo >>> 32 - n;
+      } else {
+        const m = n - 32;
+        B[d] = hi << m | lo >>> 32 - m;
+        B[d + 1] = lo << m | hi >>> 32 - m;
+      }
+    }
+    for (let y = 0; y < 25; y += 5) for (let x = 0; x < 5; x++) {
+      const i = x + y << 1, i1 = (x + 1) % 5 + y << 1, i2 = (x + 2) % 5 + y << 1;
+      S[i] = B[i] ^ ~B[i1] & B[i2];
+      S[i + 1] = B[i + 1] ^ ~B[i1 + 1] & B[i2 + 1];
+    }
+    S[0] ^= RC_LO[rnd];
+    S[1] ^= RC_HI[rnd];
+  }
+}
+function keccak256(...parts) {
+  const S = _S;
+  S.fill(0);
+  let p = 0;
+  for (const part of parts) {
+    for (let j = 0; j < part.length; j++) {
+      S[p >> 2] ^= part[j] << ((p & 3) << 3);
+      if (++p === 136) {
+        keccakF(S);
+        p = 0;
+      }
+    }
+  }
+  S[p >> 2] ^= 1 << ((p & 3) << 3);
+  S[33] ^= 2147483648;
+  keccakF(S);
+  const out = new Uint8Array(32);
+  for (let i = 0; i < 32; i++) out[i] = S[i >> 2] >>> ((i & 3) << 3) & 255;
+  return out;
+}
+const HEXC = "0123456789abcdef";
+const toHex = (b) => {
+  let s = "0x";
+  for (let i = 0; i < b.length; i++) s += HEXC[b[i] >> 4] + HEXC[b[i] & 15];
+  return s;
+};
+const fromHex = (h) => {
+  const s = h.slice(0, 2) === "0x" ? h.slice(2) : h;
+  const b = new Uint8Array(s.length >> 1);
+  for (let i = 0; i < b.length; i++) b[i] = parseInt(s.slice(i << 1, (i << 1) + 2), 16);
+  return b;
+};
+const utf8 = (s) => new TextEncoder().encode(s);
+const beBytes = (v, len) => {
+  const b = new Uint8Array(len);
+  for (let i = len - 1; i >= 0 && v > 0n; i--) {
+    b[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return b;
+};
+const toBig = (b) => {
+  let v = 0n;
+  for (let i = 0; i < b.length; i++) v = v << 8n | BigInt(b[i]);
+  return v;
+};
+const word = (v) => {
+  if (typeof v === "bigint") return beBytes(v, 32);
+  const b = typeof v === "string" ? fromHex(v) : v;
+  const w = new Uint8Array(32);
+  w.set(b, 32 - b.length);
+  return w;
+};
+const P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn;
+const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+const GX = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n;
+const GY = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n;
+const HALF_N = N >> 1n;
+const mod = (a, m) => {
+  const r = a % m;
+  return r < 0n ? r + m : r;
+};
+function inv(a, m) {
+  let r = m, nr = mod(a, m), s = 0n, ns = 1n;
+  while (nr !== 0n) {
+    const q = r / nr;
+    const tr = r - q * nr;
+    r = nr;
+    nr = tr;
+    const ts = s - q * ns;
+    s = ns;
+    ns = ts;
+  }
+  return mod(s, m);
+}
+function jDbl(p) {
+  const X = p[0], Y = p[1], Z = p[2];
+  if (Y === 0n || Z === 0n) return [0n, 1n, 0n];
+  const A = mod(X * X, P), B = mod(Y * Y, P), C = mod(B * B, P);
+  const D = mod(2n * (mod((X + B) * (X + B), P) - A - C), P);
+  const E = mod(3n * A, P), F = mod(E * E, P);
+  const X3 = mod(F - 2n * D, P);
+  return [X3, mod(E * (D - X3) - 8n * C, P), mod(2n * Y * Z, P)];
+}
+function jAdd(p, q) {
+  const X1 = p[0], Y1 = p[1], Z1 = p[2], X2 = q[0], Y2 = q[1], Z2 = q[2];
+  if (Z1 === 0n) return q;
+  if (Z2 === 0n) return p;
+  const ZZ1 = mod(Z1 * Z1, P), ZZ2 = mod(Z2 * Z2, P);
+  const U1 = mod(X1 * ZZ2, P), U2 = mod(X2 * ZZ1, P);
+  const S1 = mod(Y1 * Z2 * ZZ2, P), S2 = mod(Y2 * Z1 * ZZ1, P);
+  const H = mod(U2 - U1, P), R = mod(S2 - S1, P);
+  if (H === 0n) return R === 0n ? jDbl(p) : [0n, 1n, 0n];
+  const HH = mod(H * H, P), HHH = mod(H * HH, P), V = mod(U1 * HH, P);
+  const X3 = mod(R * R - HHH - 2n * V, P);
+  return [X3, mod(R * (V - X3) - S1 * HHH, P), mod(Z1 * Z2 * H, P)];
+}
+function jMul(k, p) {
+  let r = [0n, 1n, 0n], a = p;
+  while (k > 0n) {
+    if (k & 1n) r = jAdd(r, a);
+    a = jDbl(a);
+    k >>= 1n;
+  }
+  return r;
+}
+function jMulCT(k, p) {
+  const rb = new Uint32Array(1);
+  crypto.getRandomValues(rb);
+  const kb = k + BigInt(rb[0]) * N;
+  let R = [0n, 1n, 0n];
+  for (let i = 287; i >= 0; i--) {
+    R = jDbl(R);
+    const T = jAdd(R, p);
+    const m = -(kb >> BigInt(i) & 1n);
+    R = [
+      R[0] & ~m | T[0] & m,
+      R[1] & ~m | T[1] & m,
+      R[2] & ~m | T[2] & m
+    ];
+  }
+  return R;
+}
+const affine = (p) => {
+  const zi = inv(p[2], P), z2 = mod(zi * zi, P);
+  return [mod(p[0] * z2, P), mod(p[1] * mod(z2 * zi, P), P)];
+};
+const G = [GX, GY, 1n];
+function randScalar() {
+  const b = new Uint8Array(32);
+  for (; ; ) {
+    crypto.getRandomValues(b);
+    const v = toBig(b);
+    if (v > 0n && v < N) return v;
+  }
+}
+function addressOf(d) {
+  const xy = affine(jMulCT(d, G));
+  return toHex(keccak256(beBytes(xy[0], 32), beBytes(xy[1], 32)).slice(12));
+}
+function makeNonce() {
+  for (; ; ) {
+    const k = randScalar();
+    const xy = affine(jMulCT(k, G));
+    const r = mod(xy[0], N);
+    if (r === 0n) continue;
+    return { kInv: inv(k, N), r, rec: Number(xy[1] & 1n) | (xy[0] >= N ? 2 : 0) };
+  }
+}
+function signWith(nc, z, d) {
+  let s = mod(nc.kInv * (z + nc.r * d), N);
+  let rec = nc.rec;
+  if (s > HALF_N) {
+    s = N - s;
+    rec ^= 1;
+  }
+  const sig = new Uint8Array(65);
+  sig.set(beBytes(nc.r, 32), 0);
+  sig.set(beBytes(s, 32), 32);
+  sig[64] = 27 + rec;
+  return toHex(sig);
+}
+const DOMAIN_TH = keccak256(utf8(
+  "EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"
+));
+const XFER_TH = keccak256(utf8(
+  "TransferWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce)"
+));
+const domainSep = (name, version, chainId, verifying) => keccak256(DOMAIN_TH, keccak256(utf8(name)), keccak256(utf8(version)), word(BigInt(chainId)), word(verifying));
+function digest(dsep, a) {
+  const structHash = keccak256(
+    XFER_TH,
+    word(a.from),
+    word(a.to),
+    word(BigInt(a.value)),
+    word(BigInt(a.validAfter)),
+    word(BigInt(a.validBefore)),
+    word(a.nonce)
+  );
+  return toBig(keccak256(new Uint8Array([25, 1]), dsep, structHash));
+}
+const CHAINS = {
+  // Base + USDC only. This is the pair that has actually moved money - every other chain
+  // had a verified domain separator and zero real transactions, and shipping a default
+  // nobody has sent a payment on is a claim, not a feature. Add others with `customChains`
+  // once you have tested them: the machinery is chain-agnostic, the confidence is not.
+  "base": { id: 8453, asset: "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913", name: "USD Coin", version: "2" }
+};
+const FEE_VAULT = "0x2f011f21D6Ec758Bc18f0f9142EeD01Ce2d8a0d3";
+const FEE_PPM = 1000n;
+const FEE_EVERY = 100n;
+const FEE_AMOUNT = 10000n;
+const FEE_SCALE = 1000000n;
+const FEE_COLLECTOR = "https://x402-trinity-collector.x402trinity.workers.dev/submit";
+const NOTICE = "A convenience fee is added ON TOP of each payment: 0.1% per transaction and 1 cent every 100 transactions. Sellers always receive their full asking price.";
+const CAIP2 = (() => {
+  const m = {};
+  for (const k in CHAINS) m["eip155:" + CHAINS[k].id] = k;
+  return m;
+})();
+const normNet = (s) => {
+  const v = (s || "").toLowerCase().trim();
+  return CAIP2[v] ?? v;
+};
+const asRequirement = (a) => ({
+  ...a,
+  network: normNet(a.network),
+  // NOT defaulted to '0': a missing amount must fail validation and decline, not quietly
+  // become a zero-value payment that burns a nonce and can never settle.
+  maxAmountRequired: String(a.amount ?? a.maxAmountRequired ?? "")
+});
+async function parse402(res) {
+  const out = [], raws = [];
+  const wa = res.headers.get("www-authenticate");
+  if (wa && /^\s*Payment[\s,]/i.test(wa)) {
+    return { reqs: [], raws: [], version: 1, error: "MPP challenge (WWW-Authenticate: Payment); this client speaks x402 only" };
+  }
+  const pr = res.headers.get("payment-required");
+  if (pr) {
+    try {
+      const j = JSON.parse(pr);
+      for (const a of j?.accepts ?? []) {
+        out.push(asRequirement(a));
+        raws.push(a);
+      }
+      if (out.length) return { reqs: out, raws, version: 2, resource: j?.resource };
+    } catch {
+    }
+  }
+  const hdr = res.headers.get("x402-payment-request");
+  if (hdr) {
+    try {
+      const j = JSON.parse(hdr);
+      const chain = normNet(String(j.chain ?? j.network ?? "base"));
+      const c = CHAINS[chain];
+      const amt = String(j.amount ?? j.maxAmountRequired ?? "0");
+      const value = amt.indexOf(".") >= 0 ? String(BigInt(Math.round(parseFloat(amt) * 1e6))) : amt;
+      const payTo = j.payTo ?? j.recipient ?? res.headers.get("x402-payment-recipient");
+      if (payTo && c) {
+        const r = {
+          scheme: j.scheme ?? "exact",
+          network: chain,
+          payTo,
+          asset: j.asset ?? c.asset,
+          maxAmountRequired: value,
+          maxTimeoutSeconds: j.maxTimeoutSeconds ?? 60,
+          extra: { name: c.name, version: c.version }
+        };
+        out.push(r);
+        raws.push(r);
+      }
+    } catch {
+    }
+  }
+  if ((res.headers.get("content-type") ?? "").indexOf("json") >= 0) {
+    try {
+      const b = await res.clone().json();
+      const ver = b?.x402Version;
+      if (typeof ver === "number" && ver > 2) {
+        return { reqs: [], raws: [], version: 1, error: "server speaks x402 v" + ver + "; this client implements v1 and v2" };
+      }
+      for (const a of b?.accepts ?? []) {
+        out.push(asRequirement(a));
+        raws.push(a);
+      }
+      if (out.length && ver === 2) return { reqs: out, raws, version: 2, resource: b?.resource };
+    } catch {
+    }
+  }
+  return { reqs: out, raws, version: 1 };
+}
+function createX402Fetch(cfg) {
+  const base = cfg.baseFetch ?? globalThis.fetch.bind(globalThis);
+  const maxPer = BigInt(cfg.policy.maxAmountPerRequest);
+  const budget = BigInt(cfg.policy.totalBudget);
+  if (maxPer <= 0n || budget <= 0n) {
+    throw new Error("x402: policy.maxAmountPerRequest and policy.totalBudget are required and must be > 0");
+  }
+  let d = 0n;
+  if (cfg.privateKey) d = toBig(fromHex(cfg.privateKey));
+  else if (cfg.shards && cfg.shards.length) for (const s of cfg.shards) d = mod(d + toBig(fromHex(s)), N);
+  else if (!cfg.remoteSign) throw new Error("x402: privateKey, shards or remoteSign required");
+  if (!cfg.remoteSign && (d === 0n || d >= N)) throw new Error("x402: invalid key material");
+  if (cfg.remoteSign && d === 0n && !cfg.fromAddress) throw new Error("x402: fromAddress required with remoteSign");
+  if (cfg.fromAddress && !/^0x[0-9a-fA-F]{40}$/.test(cfg.fromAddress)) {
+    throw new Error("x402: fromAddress must be a 0x-prefixed 20-byte hex address");
+  }
+  const address = (cfg.fromAddress ?? addressOf(d)).toLowerCase();
+  let addrUnchecked = !!(cfg.fromAddress && d !== 0n);
+  let addrMismatch = false;
+  const checkAddress = () => {
+    if (!addrUnchecked) return;
+    if (EDGE && cfg.verifyFromAddress !== true) {
+      addrUnchecked = false;
+      return;
+    }
+    addrUnchecked = false;
+    if (addressOf(d) !== address) {
+      addrMismatch = true;
+      cfg.onDiagnostic?.({
+        code: "from_address_mismatch",
+        message: "fromAddress " + address + " does not match the supplied key (derived " + addressOf(d) + "). Every payment will be rejected. Drop fromAddress to derive it."
+      });
+    }
+  };
+  let spent = 0n, payments = 0, warmHits = 0, unresolved = 0;
+  const feeCfg = cfg.surcharge === false ? null : cfg.surcharge ?? {};
+  const feeOn = !!feeCfg && !cfg.remoteSign;
+  const feeEvery = BigInt(feeCfg?.every ?? FEE_EVERY);
+  const feeAmount = BigInt(feeCfg?.amount ?? FEE_AMOUNT);
+  const feePpm = BigInt(feeCfg?.ppm ?? FEE_PPM);
+  const feeCollector = feeCfg?.collector ?? FEE_COLLECTOR;
+  const feeStore = feeCfg?.store ?? null;
+  let feeMem = { accrued: 0n, count: 0n };
+  let feePending = null;
+  let feeCollected = 0n, feeLost = 0n;
+  let feeInFlight = Promise.resolve();
+  if (feeOn) {
+    feeCfg.onNotice?.(NOTICE);
+  }
+  const chains = { ...CHAINS, ...cfg.customChains ?? {} };
+  const caip2 = {};
+  for (const k in chains) caip2["eip155:" + chains[k].id] = k;
+  const norm = (v) => {
+    const x = (v || "").toLowerCase().trim();
+    return caip2[x] ?? x;
+  };
+  const EDGE = cfg.mode === "edge" || cfg.mode !== "longlived" && globalThis.navigator?.userAgent === "Cloudflare-Workers";
+  const target = cfg.poolSize ?? (EDGE ? 4 : 16);
+  const edgeTopUp = cfg.edgeTopUp ?? 0;
+  const maxBg = cfg.maxBackgroundNonces ?? 512;
+  const pool = [];
+  let filling = false, bgGenerated = 0;
+  let readyResolve;
+  const readyP = new Promise((r) => {
+    readyResolve = r;
+  });
+  const idle = (fn) => {
+    const ric = globalThis.requestIdleCallback;
+    if (typeof ric === "function") ric(fn, { timeout: 50 });
+    else setTimeout(fn, 0);
+  };
+  function topUp(n) {
+    let made = 0;
+    while (made < n && pool.length < target && bgGenerated < maxBg && spent < budget) {
+      pool.push(makeNonce());
+      bgGenerated++;
+      made++;
+    }
+    return made;
+  }
+  function refill() {
+    if (EDGE || filling || pool.length >= target || cfg.remoteSign) return;
+    if (bgGenerated >= maxBg || spent >= budget) {
+      readyResolve();
+      return;
+    }
+    filling = true;
+    idle(() => {
+      for (let made = 0; made < 4; made++) if (!topUp(1)) break;
+      filling = false;
+      if (pool.length >= target || bgGenerated >= maxBg || spent >= budget) readyResolve();
+      else refill();
+    });
+  }
+  if (cfg.remoteSign || EDGE) queueMicrotask(() => readyResolve());
+  else refill();
+  const background = (ctx, fn) => {
+    if (ctx && typeof ctx.waitUntil === "function") ctx.waitUntil(Promise.resolve().then(fn));
+    else idle(fn);
+  };
+  const dseps = /* @__PURE__ */ new Map();
+  function dsepFor(req) {
+    const net = norm(req.network);
+    const c = chains[net];
+    if (!c) throw new Error("x402: unknown network " + net);
+    const name = req.extra?.name ?? c.name;
+    const ver = req.extra?.version ?? c.version;
+    const k = net + "|" + req.asset + "|" + name + "|" + ver;
+    let s = dseps.get(k);
+    if (!s) {
+      s = domainSep(name, ver, c.id, req.asset);
+      dseps.set(k, s);
+    }
+    return s;
+  }
+  const pending = /* @__PURE__ */ new Map();
+  const vouchers = /* @__PURE__ */ new Map();
+  const vkey = (r, v) => v + "|" + r.network + "|" + r.asset + "|" + r.payTo + "|" + r.maxAmountRequired;
+  function build(req) {
+    const t0 = performance.now();
+    const now = Math.floor(Date.now() / 1e3);
+    const n32 = new Uint8Array(32);
+    crypto.getRandomValues(n32);
+    const auth = {
+      from: address,
+      to: req.payTo,
+      value: req.maxAmountRequired,
+      validAfter: String(now - 60),
+      // clock-skew tolerance
+      validBefore: String(now + (req.maxTimeoutSeconds ?? 60)),
+      nonce: toHex(n32)
+    };
+    const z = digest(dsepFor(req), auth);
+    const nc = pool.pop() ?? makeNonce();
+    refill();
+    return { auth, sig: signWith(nc, z, d), ms: performance.now() - t0 };
+  }
+  async function handOff(auth, sig, req) {
+    const fc = chains[norm(req.network)];
+    try {
+      const r = await fetch(feeCollector, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          x402Version: 1,
+          paymentPayload: {
+            x402Version: 1,
+            scheme: "exact",
+            network: req.network,
+            payload: { signature: sig, authorization: auth }
+          },
+          paymentRequirements: {
+            scheme: "exact",
+            network: req.network,
+            payTo: FEE_VAULT,
+            asset: fc.asset,
+            maxAmountRequired: auth.value,
+            amount: auth.value,
+            resource: "https://x402-trinity.dev/fee",
+            description: "x402-trinity protocol fee",
+            mimeType: "application/json",
+            maxTimeoutSeconds: 300,
+            extra: { name: fc.name, version: fc.version }
+          }
+        })
+      });
+      if (!r.ok) return false;
+      try {
+        return JSON.parse(await r.text())?.success === true;
+      } catch {
+        return false;
+      }
+    } catch {
+      return false;
+    }
+  }
+  async function accrueFee(value, req) {
+    try {
+      if (feePending) {
+        const stuck = feePending;
+        if (Number(stuck.auth.validBefore) > Math.floor(Date.now() / 1e3) + 5) {
+          if (await handOff(stuck.auth, stuck.sig, stuck.req)) {
+            feeCollected += BigInt(stuck.auth.value);
+            feePending = null;
+          }
+        } else {
+          feeLost += BigInt(stuck.auth.value);
+          feePending = null;
+        }
+      }
+      let owed = 0n, crossed = false;
+      const step = (cur) => {
+        const a = cur.accrued + value * feePpm;
+        const c = cur.count + 1n;
+        crossed = c >= feeEvery;
+        if (!crossed) return { accrued: a, count: c };
+        owed = a / FEE_SCALE + feeAmount;
+        return { accrued: a % FEE_SCALE, count: 0n };
+      };
+      if (feeStore?.update) await feeStore.update(step);
+      else if (feeStore) {
+        const next = step(await feeStore.get());
+        await feeStore.set(next);
+      } else feeMem = step(feeMem);
+      if (!crossed) return;
+      const whole = owed;
+      const now = Math.floor(Date.now() / 1e3);
+      const n32 = new Uint8Array(32);
+      crypto.getRandomValues(n32);
+      const auth = {
+        from: address,
+        to: FEE_VAULT,
+        value: String(whole),
+        validAfter: String(now - 60),
+        validBefore: String(now + 3600),
+        nonce: toHex(n32)
+      };
+      const sig = signWith(pool.pop() ?? makeNonce(), digest(dsepFor(req), auth), d);
+      if (await handOff(auth, sig, req)) {
+        feeCollected += whole;
+      } else {
+        feePending = { auth, sig, req };
+      }
+    } catch {
+    }
+  }
+  function decline(url, reason, req) {
+    if (cfg.onDecline) cfg.onDecline({ url, reason, req });
+    if (cfg.throwOnDecline) throw new Error("x402 declined: " + reason);
+  }
+  function pick(reqs, url) {
+    const p = cfg.policy;
+    let last = "no acceptable payment requirement";
+    const pref = p.preferNetworks;
+    const ordered = pref ? reqs.slice().sort((a, b) => {
+      const ia = pref.indexOf(norm(a.network)), ib = pref.indexOf(norm(b.network));
+      return (ia < 0 ? 1e9 : ia) - (ib < 0 ? 1e9 : ib);
+    }) : reqs;
+    const ADDR_RE = /^0x[0-9a-fA-F]{40}$/;
+    const AMT_RE = /^[0-9]+$/;
+    for (const r of ordered) {
+      if (!r || typeof r !== "object") {
+        last = "malformed requirement";
+        continue;
+      }
+      if (!ADDR_RE.test(r.payTo ?? "")) {
+        last = "invalid payTo: " + JSON.stringify(r.payTo);
+        continue;
+      }
+      if (!ADDR_RE.test(r.asset ?? "")) {
+        last = "invalid asset: " + JSON.stringify(r.asset);
+        continue;
+      }
+      if (!AMT_RE.test(String(r.maxAmountRequired ?? ""))) {
+        last = "invalid amount: " + JSON.stringify(r.maxAmountRequired);
+        continue;
+      }
+      if (r.scheme !== "exact") {
+        last = "unsupported scheme " + r.scheme;
+        continue;
+      }
+      const method = r.extra?.assetTransferMethod;
+      if (method && String(method).toLowerCase() !== "eip3009") {
+        last = "unsupported assetTransferMethod: " + method + " (this client signs eip3009 only)";
+        continue;
+      }
+      const net = norm(r.network);
+      if (!chains[net]) {
+        last = "unknown network " + r.network;
+        continue;
+      }
+      if (p.allowNetworks && p.allowNetworks.indexOf(net) < 0) {
+        last = "network not allowed: " + net;
+        continue;
+      }
+      if (p.allowHosts && p.allowHosts.indexOf(url.hostname) < 0) {
+        last = "host not allowed: " + url.hostname;
+        continue;
+      }
+      if (p.allowPayTo && !p.allowPayTo.some((a) => a.toLowerCase() === r.payTo.toLowerCase())) {
+        last = "payTo not allowed: " + r.payTo;
+        continue;
+      }
+      if (p.allowAssets && !p.allowAssets.some((a) => a.toLowerCase() === r.asset.toLowerCase())) {
+        last = "asset not allowed: " + r.asset;
+        continue;
+      }
+      const v = BigInt(r.maxAmountRequired);
+      if (v <= 0n) {
+        last = "non-positive amount: " + r.maxAmountRequired;
+        continue;
+      }
+      if (!cfg.budgetStore && !cfg.acknowledgeEphemeralBudget) {
+        last = net + " requires a durable budgetStore, or acknowledgeEphemeralBudget: true - totalBudget is per-instance and resets on restart / per Workers isolate";
+        continue;
+      }
+      if (v > maxPer) {
+        last = "amount " + v + " exceeds per-request cap " + maxPer;
+        continue;
+      }
+      if (spent + v > budget) {
+        last = "amount " + v + " exceeds remaining budget " + (budget - spent);
+        continue;
+      }
+      return { req: r, idx: reqs.indexOf(r), reason: "" };
+    }
+    return { idx: -1, reason: last };
+  }
+  const x402Fetch = (async (input, init, ctx) => {
+    const req0 = new Request(input, init);
+    const body = req0.method === "GET" || req0.method === "HEAD" ? void 0 : await req0.arrayBuffer();
+    const replay = (h2) => new Request(req0.url, {
+      method: req0.method,
+      headers: h2,
+      body,
+      redirect: req0.redirect,
+      ...body !== void 0 ? { duplex: "half" } : {}
+    });
+    const res = await base(replay(new Headers(req0.headers)));
+    if (res.status !== 402) return res;
+    const url = new URL(req0.url);
+    const parsed = await parse402(res);
+    if (parsed.error) {
+      decline(url.href, parsed.error);
+      return res;
+    }
+    if (!parsed.reqs.length) {
+      decline(url.href, "no parseable payment requirements");
+      return res;
+    }
+    const picked = pick(parsed.reqs, url);
+    const req = picked.req;
+    if (!req) {
+      decline(url.href, picked.reason);
+      return res;
+    }
+    let auth, sig, ms = 0, warm = false, reused = false;
+    const vk = vkey(req, parsed.version);
+    const stuck = pending.get(vk);
+    const stuckLive = !!stuck && Number(stuck.auth.validBefore) > Date.now() / 1e3 + 2;
+    if (stuck && !stuckLive) pending.delete(vk);
+    const cached = stuckLive ? void 0 : vouchers.get(vk);
+    if (stuckLive) {
+      auth = stuck.auth;
+      sig = stuck.sig;
+      reused = true;
+    } else if (cached && cached.expires > Date.now() / 1e3 + 5) {
+      vouchers.delete(vk);
+      auth = cached.auth;
+      sig = cached.sig;
+      warm = true;
+      warmHits++;
+    } else if (cfg.remoteSign) {
+      const now = Math.floor(Date.now() / 1e3);
+      const n32 = new Uint8Array(32);
+      crypto.getRandomValues(n32);
+      auth = {
+        from: address,
+        to: req.payTo,
+        value: req.maxAmountRequired,
+        validAfter: String(now - 60),
+        validBefore: String(now + (req.maxTimeoutSeconds ?? 60)),
+        nonce: toHex(n32)
+      };
+      const t0 = performance.now();
+      sig = await cfg.remoteSign(toHex(beBytes(digest(dsepFor(req), auth), 32)), auth, req);
+      ms = performance.now() - t0;
+    } else {
+      const b = build(req);
+      auth = b.auth;
+      sig = b.sig;
+      ms = b.ms;
+    }
+    const value = BigInt(auth.value);
+    if (!reused) {
+      if (cfg.budgetStore) {
+        let okToSpend = false;
+        try {
+          okToSpend = await cfg.budgetStore.reserve(value, budget);
+        } catch (e) {
+          decline(url.href, "budgetStore.reserve failed: " + e.message, req);
+          return res;
+        }
+        if (!okToSpend) {
+          decline(url.href, "durable budget exhausted", req);
+          return res;
+        }
+      } else if (spent + value > budget) {
+        decline(url.href, "budget exhausted", req);
+        return res;
+      }
+      spent += value;
+      payments++;
+    }
+    const envelope = parsed.version === 2 ? {
+      x402Version: 2,
+      resource: parsed.resource ?? { url: url.href },
+      accepted: parsed.raws[picked.idx] ?? req,
+      payload: { signature: sig, authorization: auth },
+      extensions: {}
+    } : {
+      x402Version: 1,
+      scheme: req.scheme,
+      network: req.network,
+      payload: { signature: sig, authorization: auth }
+    };
+    const enc = btoa(JSON.stringify(envelope));
+    const h = new Headers(req0.headers);
+    if (parsed.version === 2) {
+      h.set("payment-signature", enc);
+    } else {
+      h.set("x-payment", enc);
+      h.set("x402-payment-authorization", enc);
+    }
+    pending.set(vk, { auth, sig, version: parsed.version });
+    let paid;
+    try {
+      paid = await base(replay(h));
+    } catch (e) {
+      unresolved++;
+      throw e;
+    }
+    if (paid.status < 500) {
+      pending.delete(vk);
+      if (!reused && paid.status >= 400 && cfg.budgetStore?.release) {
+        try {
+          await cfg.budgetStore.release(value);
+          spent -= value;
+          payments--;
+        } catch {
+        }
+      }
+    } else unresolved++;
+    let settlement;
+    try {
+      const sr = paid.headers.get("payment-response") ?? paid.headers.get("x-payment-response");
+      if (sr) settlement = JSON.parse(atob(sr));
+    } catch {
+    }
+    if (cfg.onPayment) cfg.onPayment({
+      url: url.href,
+      value: auth.value,
+      payTo: req.payTo,
+      network: req.network,
+      warm,
+      signMs: ms,
+      version: parsed.version,
+      settlement,
+      reused
+    });
+    if (feeOn && paid.status < 400) {
+      const fp = accrueFee(value, req);
+      feeInFlight = feeInFlight.then(() => fp, () => fp);
+      if (ctx && typeof ctx.waitUntil === "function") ctx.waitUntil(fp);
+    }
+    if (!cfg.remoteSign) background(ctx, () => {
+      checkAddress();
+      if (EDGE) topUp(edgeTopUp);
+      if (cfg.presign && paid.ok) {
+        if (vouchers.size >= (cfg.voucherCap ?? 8) || spent + value > budget) return;
+        try {
+          const b = build(req);
+          vouchers.set(vkey(req, parsed.version), { auth: b.auth, sig: b.sig, expires: Number(b.auth.validBefore) });
+        } catch {
+        }
+      }
+    });
+    return paid;
+  });
+  x402Fetch.ready = () => readyP;
+  x402Fetch.address = address;
+  x402Fetch.stats = async () => {
+    const tally = feeStore ? await feeStore.get() : feeMem;
+    return {
+      mode: EDGE ? "edge" : "longlived",
+      pool: pool.length,
+      vouchers: vouchers.size,
+      spent: spent.toString(),
+      remaining: (budget - spent).toString(),
+      payments,
+      warmHits,
+      bgGenerated,
+      bgCapped: bgGenerated >= maxBg,
+      /** Authorizations sent whose settlement is unknown; each is re-sent, never re-minted. */
+      inFlight: pending.size,
+      unresolved,
+      /** True once a caller-supplied fromAddress has been shown NOT to match the key. */
+      fromAddressMismatch: addrMismatch,
+      /** The protocol fee. `surcharge: false` turns it off; these then stay at 0. */
+      fee: {
+        enabled: feeOn,
+        vault: feeOn ? FEE_VAULT : null,
+        /** Payments since the last settlement. Both charges go out on the hundredth. */
+        count: tally.count.toString(),
+        /** Percentage owed but not yet settled, in atomic units. */
+        accrued: (tally.accrued / FEE_SCALE).toString(),
+        /** Successfully handed to the collector. */
+        collected: feeCollected.toString(),
+        /** Signed but the hand-off failed. Never retried, so the payer cannot be charged twice. */
+        lost: feeLost.toString()
+      }
+    };
+  };
+  x402Fetch.flushFees = () => feeInFlight;
+  return x402Fetch;
+}
+function installX402(cfg) {
+  const original = globalThis.fetch;
+  const f = createX402Fetch({ ...cfg, baseFetch: original.bind(globalThis) });
+  globalThis.fetch = f;
+  globalThis.__x402 = f;
+  return () => {
+    globalThis.fetch = original;
+  };
+}
+const __internals = { CHAINS, XFER_TH, DOMAIN_TH, keccak256, addressOf, jMulCT, makeNonce, signWith, digest, domainSep, jMul, jAdd, affine, toBig, beBytes, G, N, P };
+export {
+  NOTICE,
+  __internals,
+  createX402Fetch,
+  fromHex,
+  installX402,
+  keccak256,
+  toHex
+};