@dvmkit/sdk 0.0.0 → 0.1.0-rc.1

package/dist/x402-35VLYFKZ.js

@@ -0,0 +1,1272 @@
+import {
+  CONFIG_AUDIT_FILE,
+  CONFIG_BACKUP_FILE,
+  CONFIG_FILE,
+  CONFIG_PINNED_FILE,
+  DvmError,
+  X402_CHANNELS_FILE,
+  X402_DEFAULT_FACILITATOR,
+  X402_DEFAULT_NETWORK,
+  X402_NETWORKS,
+  X402_V1_VERSION,
+  X402_VERSION,
+  assertSupportedX402Network,
+  buildPaymentRequiredV2,
+  buildPaymentRequirements,
+  caip2ToX402Network,
+  chainIdFromCaip2,
+  costAnchor,
+  createX402FacilitatorAuthHeaders,
+  decodePayment,
+  decodePaymentRequiredHeader,
+  encodePayment,
+  encodePaymentRequiredHeader,
+  encodeSettleResponseHeader,
+  ensureConfigDir,
+  exactEvmAuthorization,
+  fetchBtcUsdRate,
+  formatStaleness,
+  formatUsd,
+  getLastKnownBtcRate,
+  msatsToUsdc,
+  paymentRequiredV2FromV1,
+  resolveRpcHttpTransportOptions,
+  resolveRpcOverride,
+  settleWithFacilitator,
+  usdcContractByCaip2,
+  usdcContractFor,
+  usdcDomainNameFor,
+  usdcDomainVersionFor,
+  usdcToMsats,
+  verifyWithFacilitator,
+  x402NetworkByCaip2,
+  x402NetworkLabel,
+  x402NetworkListForCopy,
+  x402NetworkToCaip2,
+  x402SupportedNetworksHint
+} from "./chunk-DCNT4PJS.js";
+import {
+  callerLoggers,
+  redactUrl,
+  redactUrlsInText
+} from "./chunk-KXWROQGK.js";
+import "./chunk-AT6V3SY7.js";
+
+// src/lib/x402/asset.ts
+function resolveX402Asset(network = X402_DEFAULT_NETWORK) {
+  const spec = x402NetworkByCaip2(network);
+  if (!spec) return null;
+  return {
+    address: spec.usdc,
+    symbol: "USDC",
+    // "native" is the load-bearing word: every contract in the table is
+    // Circle's own USDC, and the dollars that read as zero here are the
+    // bridged ones.
+    label: "native USDC",
+    unit: "USDC",
+    networkLabel: spec.label,
+    confusable: spec.confusable
+  };
+}
+function x402WrongAssetHint(asset) {
+  const wrongToken = asset.confusable ? `Another dollar on ${asset.networkLabel} \u2014 ${asset.confusable}, the legacy bridged dollar, or any other stablecoin \u2014 is a different contract and will never show up here, however much of it your wallet says you hold.` : `Another dollar on ${asset.networkLabel} is a different contract and will never show up here, however much of it your wallet says you hold.`;
+  return `This rail reads only ${asset.label} (${asset.address}) on ${asset.networkLabel}. ${wrongToken} USDC on a different chain is invisible here too \u2014 this wallet reads ${asset.networkLabel} alone. If you funded the wrong one, swap it to ${asset.label} on ${asset.networkLabel}, or bridge the funds across to ${asset.networkLabel}; either way they land where this rail can spend them.`;
+}
+
+// src/lib/x402/client.ts
+import { randomBytes } from "crypto";
+
+// src/lib/output.ts
+import { writeSync } from "fs";
+function info(msg) {
+  writeAllSync(2, msg + "\n");
+}
+function writeAllSync(fd, text) {
+  const buf = Buffer.from(text, "utf8");
+  let offset = 0;
+  while (offset < buf.length) {
+    try {
+      offset += writeSync(fd, buf, offset, buf.length - offset);
+    } catch (err) {
+      const code = err.code;
+      if (code === "EAGAIN" || code === "EINTR") continue;
+      throw err;
+    }
+  }
+}
+
+// src/lib/btc-rate.ts
+async function resolveBtcUsdRate(purpose) {
+  try {
+    return { rate: await fetchBtcUsdRate(), stale: false };
+  } catch {
+    const cached = getLastKnownBtcRate();
+    if (cached) {
+      warnStaleRate(cached.cachedAt);
+      return { rate: cached.rate, stale: true, cachedAt: cached.cachedAt };
+    }
+    throw rateUnavailable(purpose);
+  }
+}
+var warnedStale = false;
+function warnStaleRate(cachedAt) {
+  if (warnedStale) return;
+  warnedStale = true;
+  info(
+    `Warning: the BTC/USD rate provider is unreachable \u2014 using the last rate this machine saw (cached ${formatStaleness(cachedAt)}). Dollar figures may have drifted.`
+  );
+}
+function rateUnavailable(purpose) {
+  const outcome = purpose === "payment" ? "nothing was paid" : "no conversion was performed";
+  const noun = purpose === "payment" ? "payment" : "conversion";
+  const capped = outcome.charAt(0).toUpperCase() + outcome.slice(1);
+  return new DvmError(
+    "rate_unavailable",
+    `Could not price this ${noun}: the BTC/USD rate provider is unreachable and no cached rate is available.`,
+    `${capped}. The rate provider (CoinGecko) is rate-limiting or down, and this machine has never cached a rate. Retry in a minute; if it keeps failing, check network access to api.coingecko.com.${purpose === "payment" ? " Budgets are denominated in dollars, so a payment cannot be authorised without a rate." : ""}`,
+    {
+      display: `BTC/USD rate unavailable \u2014 ${outcome}.`,
+      anchor: "rate_unavailable",
+      purpose,
+      provider: "coingecko",
+      retryable: true
+    }
+  );
+}
+
+// src/lib/payment-authorization-bounds.ts
+var X402_EXACT_AUTHORIZATION_TTL_SECONDS = 600;
+var X402_REFUSAL_TRANSACTION_DISCOVERY_WINDOW_MS = 15 * 6e4;
+
+// src/lib/payment-rails/types.ts
+var ADVERTISED_AMOUNT_TOLERANCE_BPS = 1000n;
+function maxAdvertisedMicro(localMicro) {
+  return localMicro * (10000n + ADVERTISED_AMOUNT_TOLERANCE_BPS) / 10000n;
+}
+function withinAdvertisedTolerance(advertisedMicro, localMicro) {
+  return advertisedMicro * 10000n <= localMicro * (10000n + ADVERTISED_AMOUNT_TOLERANCE_BPS);
+}
+
+// src/lib/evm-private-key.ts
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { hexToBytes } from "@noble/hashes/utils.js";
+var EVM_PRIVATE_KEY_RE = /^0x[0-9a-fA-F]{64}$/;
+function isValidEvmPrivateKey(value) {
+  return EVM_PRIVATE_KEY_RE.test(value) && secp256k1.utils.isValidSecretKey(hexToBytes(value.slice(2)));
+}
+
+// src/lib/identity.ts
+import lockfile from "proper-lockfile";
+
+// src/lib/config-mutation.ts
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+var PROTECTED_CONFIG_FIELDS = ["nwcUri", "defaultIdentity", "tempo", "x402"];
+var ProtectedFieldAuthorization = class {
+  /** Targets this authorization covers. A field also covers its own leaves. */
+  targets;
+  /** Prefer {@link authorizeProtectedRemoval}; this exists for it to call. */
+  constructor(targets) {
+    this.targets = [...targets];
+  }
+  /**
+   * True when `target` is one this authorization names. Naming a field covers
+   * the leaves under it; naming a leaf covers only that leaf, so a command
+   * entitled to clear `tempo.apiKey` still cannot take the whole `tempo` block.
+   */
+  covers(target) {
+    if (this.targets.includes(target)) return true;
+    const field = target.split(".")[0];
+    return target !== field && this.targets.includes(field);
+  }
+};
+function authorizeProtectedRemoval(...targets) {
+  return new ProtectedFieldAuthorization(targets);
+}
+function applyConfigPatch(base, patch) {
+  if (!isPlainObject(patch))
+    throw patchShapeError("A change must be an object with `set` and/or `unset`.");
+  if (patch.set !== void 0 && !isPlainObject(patch.set)) {
+    throw patchShapeError("A change's `set` must be an object of fields to write.");
+  }
+  if (patch.unset !== void 0 && !Array.isArray(patch.unset)) {
+    throw patchShapeError("A change's `unset` must be an array of field names.");
+  }
+  const set = patch.set ?? {};
+  const unset = patch.unset ?? [];
+  for (const [field, value] of Object.entries(set)) {
+    if (value !== void 0) continue;
+    throw new DvmError(
+      "config_patch_invalid",
+      `Config field '${field}' was declared with no value.`,
+      "Give the field a value, or name it in the change's `unset` list to remove it. An undefined value is how a field gets dropped without anyone deciding to drop it."
+    );
+  }
+  for (const field of unset) {
+    if (typeof field !== "string" || field.length === 0) {
+      throw patchShapeError("Every entry in a change's `unset` must be a field name.");
+    }
+    if (!Object.hasOwn(set, field)) continue;
+    throw new DvmError(
+      "config_patch_invalid",
+      `Config field '${field}' is both written and removed by the same change.`,
+      "Declare each field once: in `set` with its new value, or in `unset` to remove it."
+    );
+  }
+  const merged = { ...base, ...set };
+  const removing = new Set(unset);
+  return Object.fromEntries(
+    Object.entries(merged).filter(([field]) => !removing.has(field))
+  );
+}
+function deepFreezeConfig(config) {
+  freezeDeep(config);
+  return config;
+}
+function protectedRemovals(before, after) {
+  const previous = before;
+  const next = after;
+  const removed = [];
+  for (const field of PROTECTED_CONFIG_FIELDS) {
+    const held = previous[field];
+    if (!isPresentValue(held)) continue;
+    const kept = next[field];
+    if (!isPresentValue(kept)) {
+      removed.push(field);
+      continue;
+    }
+    const spec = PROTECTED_FIELDS[field];
+    if (spec.credentialLeaves.length === 0) continue;
+    if (!isPlainObject(held)) continue;
+    if (!isPlainObject(kept)) {
+      removed.push(field);
+      continue;
+    }
+    for (const leaf of spec.credentialLeaves) {
+      if (!isPresentValue(held[leaf]) || isPresentValue(kept[leaf])) continue;
+      removed.push(`${field}.${leaf}`);
+    }
+  }
+  return removed;
+}
+function supersededProtectedSecrets(before, after) {
+  const previous = before;
+  const next = after;
+  const superseded = [];
+  for (const field of PROTECTED_CONFIG_FIELDS) {
+    const spec = PROTECTED_FIELDS[field];
+    if (!spec.secret) continue;
+    const held = previous[field];
+    const kept = next[field];
+    if (spec.credentialLeaves.length === 0) {
+      if (isPresentValue(held) && isPresentValue(kept) && held !== kept) superseded.push(field);
+      continue;
+    }
+    if (!isPlainObject(held) || !isPlainObject(kept)) continue;
+    for (const leaf of spec.credentialLeaves) {
+      const was = held[leaf];
+      const now = kept[leaf];
+      if (!isPresentValue(was) || !isPresentValue(now) || was === now) continue;
+      superseded.push(`${field}.${leaf}`);
+    }
+  }
+  return superseded;
+}
+function changedConfigPaths(before, after) {
+  const found = /* @__PURE__ */ new Set();
+  collectChangedPaths(
+    before,
+    after,
+    CONFIG_PATH_SHAPE,
+    "",
+    found
+  );
+  return [...found].sort();
+}
+function assertValidConfig(config, fields) {
+  if (!isPlainObject(config)) {
+    throw new DvmError(
+      "config_invalid",
+      "The caller configuration is not a JSON object.",
+      `Expected an object at ${CONFIG_FILE}.${rollbackSuffix()}`
+    );
+  }
+  const record = config;
+  const scope = fields ? new Set(fields) : null;
+  for (const [field, kind] of Object.entries(CONFIG_FIELD_TYPES)) {
+    if (scope && !scope.has(field)) continue;
+    const value = record[field];
+    if (value === void 0) continue;
+    if (!matchesKind(value, kind)) throw invalidFieldError(field, kind);
+  }
+  for (const [path, kind] of Object.entries(CONFIG_LEAF_TYPES)) {
+    const [field, leaf] = path.split(".");
+    if (scope && !scope.has(field)) continue;
+    const owner = record[field];
+    if (!isPlainObject(owner)) continue;
+    const value = owner[leaf];
+    if (value === void 0 || !matchesKind(value, kind)) throw invalidFieldError(path, kind);
+  }
+}
+function readRawConfig() {
+  if (!existsSync(CONFIG_FILE)) return null;
+  try {
+    return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+  } catch {
+    throw new DvmError(
+      "config_corrupt",
+      "Config file is corrupt.",
+      // Not "delete it": those bytes are the only copy on this machine of the
+      // NWC connection string and both private keys, however badly they parse.
+      `Run 'dvm config rollback' to restore a stored copy, or move ${CONFIG_FILE} aside yourself and run 'dvm init'.${rollbackSuffix()}`
+    );
+  }
+}
+function writeConfigFile(config) {
+  writeJsonAtomic(CONFIG_FILE, config);
+}
+var CONFIG_SNAPSHOT_SLOTS = ["backup", "pinned"];
+function configSnapshotPath(slot) {
+  return slot === "pinned" ? CONFIG_PINNED_FILE : CONFIG_BACKUP_FILE;
+}
+function describeConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  try {
+    if (!existsSync(path)) return null;
+    const stat = statSync(path);
+    const posix = process.platform !== "win32";
+    const mode = stat.mode & 511;
+    return {
+      path,
+      slot,
+      bytes: stat.size,
+      modifiedAt: stat.mtime.toISOString(),
+      modeOctal: posix ? toOctal(mode) : null,
+      ownerOnly: !posix || (mode & 63) === 0
+    };
+  } catch {
+    return null;
+  }
+}
+function readConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  if (!existsSync(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return isPlainObject(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function retainConfigBackup(slot = "backup") {
+  if (!existsSync(CONFIG_FILE)) return false;
+  ensureConfigDir();
+  const path = configSnapshotPath(slot);
+  const tmp = `${path}.tmp`;
+  writeFileSync(tmp, readFileSync(CONFIG_FILE), { mode: 384 });
+  chmodSync(tmp, 384);
+  commitTmp(tmp, path);
+  return true;
+}
+function writeConfigBackup(config, slot = "backup") {
+  writeJsonAtomic(configSnapshotPath(slot), config);
+}
+function removeConfigBackup(slot = "backup") {
+  const path = configSnapshotPath(slot);
+  if (!existsSync(path)) return false;
+  unlinkSync(path);
+  return true;
+}
+function protectedTargetValue(config, target) {
+  const [field, named] = target.split(".");
+  const held = config[field];
+  const leaves = PROTECTED_FIELDS[field].credentialLeaves;
+  const leaf = named ?? (leaves.length > 0 ? leaves[0] : void 0);
+  if (leaf === void 0) return held;
+  return isPlainObject(held) ? held[leaf] : void 0;
+}
+function protectedValuesMatch(target, left, right) {
+  const normalized = comparableProtectedValue(target, left);
+  return normalized !== void 0 && normalized === comparableProtectedValue(target, right);
+}
+function isSecretProtectedTarget(target) {
+  return PROTECTED_FIELDS[target.split(".")[0]].secret;
+}
+function withoutProtectedTargets(config, targets) {
+  const dropping = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    const field = target.split(".")[0];
+    dropping.add(field);
+    for (const alias of PROTECTED_FIELDS[field].aliases) dropping.add(alias);
+  }
+  return Object.fromEntries(
+    Object.entries(config).filter(([field]) => !dropping.has(field))
+  );
+}
+function appendConfigAudit(record) {
+  try {
+    ensureConfigDir();
+    appendFileSync(CONFIG_AUDIT_FILE, JSON.stringify(record) + "\n", { mode: 384 });
+    chmodSync(CONFIG_AUDIT_FILE, 384);
+  } catch {
+  }
+}
+function protectedRemovalError(targets, reason) {
+  const named = targets.join(", ");
+  const one = targets.length === 1;
+  return new DvmError(
+    "config_protected_field",
+    `The '${reason}' change would remove ${named} from the local configuration.`,
+    `Nothing was written. ${named} ${one ? "is a credential or identity pointer" : "are credentials or identity pointers"} nothing else on this machine records, so only a command that names ${one ? "it" : "them"} explicitly may remove ${one ? "it" : "them"} \u2014 'dvm wallet disconnect', 'dvm wallet tempo-disconnect' and 'dvm wallet x402-disconnect' are those commands.`,
+    { fields: targets }
+  );
+}
+var PROTECTED_FIELDS = {
+  nwcUri: { aliases: [], credentialLeaves: [], secret: true, hexCredential: false },
+  // A pointer at a key, not a key: worth protecting from removal, and never
+  // worth stripping out of a stored copy — that is recovery lost for nothing.
+  defaultIdentity: { aliases: [], credentialLeaves: [], secret: false, hexCredential: false },
+  // `mpp` is the pre-internal-review name; a caller who has not run a mutating command
+  // since the rename still has their private key under it.
+  tempo: { aliases: ["mpp"], credentialLeaves: ["apiKey"], secret: true, hexCredential: true },
+  x402: { aliases: [], credentialLeaves: ["privateKey"], secret: true, hexCredential: true }
+};
+var CONFIG_PATH_SHAPE = {
+  float: { statedBudget: {}, connectedAt: {}, alias: {}, methods: {} },
+  x402: { privateKey: {}, network: {} },
+  tempo: { method: {}, accountId: {}, apiKey: {} },
+  credit: {
+    targetJobs: {},
+    posture: {},
+    tier0Cap: {},
+    tier1Cap: {},
+    pocketTarget: {},
+    fundingRail: {},
+    perDvm: { "*": { targetJobs: {}, posture: {}, fundingRail: {}, dvmId: {}, builderPubkey: {} } },
+    trustOverrides: { "*": {} }
+  },
+  feedback: { posture: {} }
+};
+var CONFIG_FIELD_TYPES = {
+  nwcUri: "string",
+  float: "object",
+  defaultBudget: "string",
+  autoPayThreshold: "string",
+  defaultMaxPayments: "number",
+  cashuMints: "string[]",
+  x402: "object",
+  tempo: "object",
+  defaultRail: "string",
+  defaultIdentity: "string",
+  credit: "object",
+  feedback: "object"
+};
+var CONFIG_LEAF_TYPES = {
+  "float.connectedAt": "string",
+  "x402.privateKey": "string",
+  "tempo.method": "string"
+};
+function collectChangedPaths(before, after, shape, prefix, found) {
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
+    const held = before[key];
+    const kept = after[key];
+    if (deepEqual(held, kept)) continue;
+    const known = shape !== void 0 && Object.hasOwn(shape, key);
+    const wildcard = !known && shape !== void 0 && Object.hasOwn(shape, "*");
+    const child = known ? shape[key] : wildcard ? shape["*"] : void 0;
+    const path = prefix ? `${prefix}.${wildcard ? "*" : key}` : key;
+    const descendable = child !== void 0 && Object.keys(child).length > 0 && (held === void 0 || isPlainObject(held)) && (kept === void 0 || isPlainObject(kept));
+    if (descendable) {
+      collectChangedPaths(
+        isPlainObject(held) ? held : {},
+        isPlainObject(kept) ? kept : {},
+        child,
+        path,
+        found
+      );
+    } else {
+      found.add(path);
+    }
+  }
+}
+function invalidFieldError(path, kind) {
+  return new DvmError(
+    "config_invalid",
+    `Config field '${path}' must be ${describeKind(kind)}.`,
+    `Nothing was written. Correct the field in ${CONFIG_FILE}, or run 'dvm doctor' for the full picture.${rollbackSuffix()}`
+  );
+}
+function describeKind(kind) {
+  switch (kind) {
+    case "string":
+      return "a string";
+    case "number":
+      return "a number";
+    case "object":
+      return "an object";
+    case "string[]":
+      return "an array of strings";
+  }
+}
+function matchesKind(value, kind) {
+  switch (kind) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && Number.isFinite(value);
+    case "object":
+      return isPlainObject(value);
+    case "string[]":
+      return Array.isArray(value) && value.every((item) => typeof item === "string");
+  }
+}
+function rollbackSuffix() {
+  const stored = describeConfigBackup() ?? describeConfigBackup("pinned");
+  return stored === null ? "" : ` A stored copy of the previous configuration is at ${stored.path}.`;
+}
+function writeJsonAtomic(path, value) {
+  ensureConfigDir();
+  const tmp = `${path}.tmp`;
+  writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+  chmodSync(tmp, 384);
+  commitTmp(tmp, path);
+}
+function commitTmp(tmp, path) {
+  try {
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, index) => deepEqual(item, b[index]));
+  }
+  if (!isPlainObject(a) || !isPlainObject(b)) return false;
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])) {
+    if (!deepEqual(a[key], b[key])) return false;
+  }
+  return true;
+}
+function isPresentValue(value) {
+  if (value === void 0 || value === null) return false;
+  return typeof value !== "string" || value.trim().length > 0;
+}
+function comparableProtectedValue(target, value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return void 0;
+  const field = target.split(".")[0];
+  return PROTECTED_FIELDS[field].hexCredential ? trimmed.toLowerCase() : trimmed;
+}
+function patchShapeError(message) {
+  return new DvmError(
+    "config_patch_invalid",
+    message,
+    "A change declares `set` (fields to write) and `unset` (field names to remove). Anything else cannot be applied, and nothing was written."
+  );
+}
+function freezeDeep(value) {
+  if (typeof value !== "object" || value === null || Object.isFrozen(value)) return;
+  Object.freeze(value);
+  for (const nested of Object.values(value)) freezeDeep(nested);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toOctal(mode) {
+  return "0" + mode.toString(8).padStart(3, "0");
+}
+
+// src/lib/identity.ts
+function migrateCreditConfig(config) {
+  const credit = config.credit;
+  if (!credit) return config;
+  const migrateLayer = (layer) => {
+    const railed = migrateFundingRail(layer);
+    if (!("disabled" in railed)) return railed;
+    const { disabled, ...rest } = railed;
+    const migrated = { ...rest };
+    if (migrated.posture === void 0 && disabled === true) migrated.posture = "off";
+    return migrated;
+  };
+  const perDvm = credit.perDvm;
+  return {
+    ...config,
+    credit: {
+      ...migrateLayer(credit),
+      ...perDvm ? {
+        perDvm: Object.fromEntries(
+          Object.entries(perDvm).map(([endpoint, per]) => [endpoint, migrateLayer(per)])
+        )
+      } : {}
+    }
+  };
+}
+function migrateFundingRail(layer) {
+  const loose = layer;
+  if (loose.fundingRail !== "mpp") return layer;
+  return { ...layer, fundingRail: "tempo" };
+}
+function migrateTempoWalletKey(config) {
+  const loose = config;
+  if (!loose.mpp || loose.tempo) return config;
+  const { mpp, ...rest } = loose;
+  return { ...rest, tempo: mpp };
+}
+function migrateConfig(config) {
+  return migrateCreditConfig(migrateTempoWalletKey(config));
+}
+function loadConfig() {
+  const raw = readRawConfig();
+  return raw === null ? null : migrateConfig(raw);
+}
+async function updateConfig(update) {
+  return withConfigLock(async () => {
+    const raw = readRawConfig();
+    const snapshot = raw === null ? {} : structuredClone(raw);
+    const base = raw === null ? null : migrateConfig(structuredClone(raw));
+    const handed = raw === null ? null : deepFreezeConfig(migrateConfig(structuredClone(raw)));
+    const next = applyConfigPatch(base ?? {}, await runPatch(update, handed));
+    const changed = changedConfigPaths(snapshot, next);
+    if (changed.length === 0) {
+      return {
+        config: base ?? {},
+        previous: base,
+        changed: [],
+        written: false,
+        backup: describeConfigBackup()
+      };
+    }
+    const removals = protectedRemovals(base ?? {}, next);
+    const unauthorized = removals.filter((target) => update.authorize?.covers(target) !== true);
+    if (unauthorized.length > 0) throw protectedRemovalError(unauthorized, update.reason);
+    assertValidConfig(
+      next,
+      changed.map((path) => path.split(".")[0])
+    );
+    const superseded = supersededProtectedSecrets(base ?? {}, next);
+    const stripped = [
+      .../* @__PURE__ */ new Set([...removals, ...superseded, ...update.sanitizeBackup ?? []])
+    ].filter(isSecretProtectedTarget);
+    const sweeping = update.sweepSlots ?? CONFIG_SNAPSHOT_SLOTS;
+    const swept = [];
+    if (raw !== null) {
+      if (stripped.length > 0) {
+        writeConfigBackup(withoutProtectedTargets(raw, stripped));
+        swept.push("backup");
+      } else {
+        retainConfigBackup();
+      }
+    }
+    if (stripped.length > 0 && sweeping.includes("pinned")) {
+      if (sweepPinnedSnapshot(stripped, base ?? {}, update.reason)) swept.push("pinned");
+    }
+    const backup = describeConfigBackup();
+    writeConfigFile(next);
+    appendConfigAudit({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      event: "update",
+      reason: update.reason,
+      fields: changed,
+      ...removals.length > 0 ? { removed: removals } : {},
+      ...superseded.length > 0 ? { superseded } : {},
+      ...swept.length > 0 ? { sweptSlots: swept } : {},
+      backup: backup !== null,
+      pid: process.pid
+    });
+    return { config: next, previous: base, changed, written: true, backup };
+  });
+}
+async function withConfigLock(fn) {
+  ensureConfigDir();
+  let release;
+  try {
+    release = await lockfile.lock(CONFIG_FILE, {
+      lockfilePath: `${CONFIG_FILE}.lock`,
+      realpath: false,
+      stale: 3e4,
+      retries: { retries: 10, factor: 1, minTimeout: 100, maxTimeout: 100 }
+    });
+  } catch {
+    throw new DvmError(
+      "config_locked",
+      "Another dvm process is updating the local configuration.",
+      "Wait a moment and retry."
+    );
+  }
+  try {
+    return await fn();
+  } finally {
+    await release().catch(() => void 0);
+  }
+}
+async function runPatch(update, current) {
+  try {
+    return await update.patch(current);
+  } catch (err) {
+    if (err instanceof TypeError && /read only|not extensible|frozen|cannot delete property|cannot add property/i.test(
+      err.message
+    )) {
+      throw new DvmError(
+        "config_patch_invalid",
+        `The '${update.reason}' change tried to modify the configuration it was handed.`,
+        "Nothing was written. A change declares what it wants through its `set` and `unset` lists; editing the current config in place bypasses the protected-field gate, so the object is frozen."
+      );
+    }
+    throw err;
+  }
+}
+function sweepPinnedSnapshot(targets, departing, reason) {
+  if (describeConfigBackup("pinned") === null) return false;
+  const pinned = readConfigBackup("pinned");
+  if (pinned === null) {
+    return retireSlot(`${reason}:unreadable_pin`, "pinned");
+  }
+  const migrated = migrateConfig(structuredClone(pinned));
+  const matching = targets.filter(
+    (target) => protectedValuesMatch(
+      target,
+      protectedTargetValue(departing, target),
+      protectedTargetValue(migrated, target)
+    )
+  );
+  if (matching.length === 0) return false;
+  const sanitized = withoutProtectedTargets(pinned, matching);
+  const changed = changedConfigPaths(pinned, sanitized);
+  if (changed.length === 0) return false;
+  writeConfigBackup(sanitized, "pinned");
+  appendConfigAudit({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "backup_sanitized",
+    reason,
+    fields: changed,
+    removed: matching,
+    slot: "pinned",
+    backup: describeConfigBackup() !== null,
+    pid: process.pid
+  });
+  return true;
+}
+function retireSlot(reason, slot) {
+  if (!removeConfigBackup(slot)) return false;
+  appendConfigAudit({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "backup_retired",
+    reason,
+    fields: [],
+    slot,
+    backup: describeConfigBackup() !== null,
+    pid: process.pid
+  });
+  return true;
+}
+
+// src/lib/x402/channel-store.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { existsSync as existsSync2, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "fs";
+import lockfile3 from "proper-lockfile";
+
+// src/lib/credit-store.ts
+import lockfile2 from "proper-lockfile";
+
+// src/lib/x402/channel-store.ts
+var X402_PENDING_STALE_MS = 24 * 60 * 60 * 1e3;
+var EMPTY = { version: 1, channels: {}, pending: [], exact: [] };
+var x402LockOwner = new AsyncLocalStorage();
+async function withX402ChannelLock(operation) {
+  if (x402LockOwner.getStore()?.active) return operation();
+  ensureX402ChannelFile();
+  const release = await lockfile3.lock(X402_CHANNELS_FILE, {
+    realpath: false,
+    retries: { retries: 20, minTimeout: 25, maxTimeout: 250 }
+  });
+  const owner = { active: true };
+  try {
+    return await x402LockOwner.run(owner, operation);
+  } finally {
+    owner.active = false;
+    await release();
+  }
+}
+function ensureX402ChannelFile() {
+  ensureConfigDir();
+  if (existsSync2(X402_CHANNELS_FILE)) return;
+  try {
+    writeFileSync2(X402_CHANNELS_FILE, `${JSON.stringify(EMPTY, null, 2)}
+`, {
+      mode: 384,
+      flag: "wx"
+    });
+  } catch {
+  }
+}
+
+// src/lib/x402/wallet.ts
+function loadX402Wallet() {
+  const config = loadConfig();
+  const x402 = config?.x402;
+  const privateKey = x402?.privateKey;
+  if (!privateKey || !isValidEvmPrivateKey(privateKey)) return null;
+  return {
+    privateKey,
+    address: "",
+    network: x402.network ?? X402_DEFAULT_NETWORK
+  };
+}
+async function ensureAddress(wallet) {
+  if (!isValidEvmPrivateKey(wallet.privateKey)) throw invalidX402PrivateKey();
+  if (wallet.address) return wallet;
+  const { privateKeyToAccount } = await import("viem/accounts");
+  const account = privateKeyToAccount(wallet.privateKey);
+  return { ...wallet, address: account.address };
+}
+async function connectedX402Payer() {
+  const wallet = loadX402Wallet();
+  if (!wallet) return null;
+  return (await ensureAddress(wallet)).address;
+}
+async function generateX402PrivateKey() {
+  const { generatePrivateKey } = await import("viem/accounts");
+  return generatePrivateKey();
+}
+async function repinX402WalletNetwork(network) {
+  assertSupportedX402Network(network);
+  return withX402ChannelLock(async () => {
+    const { previous } = await updateConfig({
+      reason: "x402_wallet_repin",
+      patch: (current) => {
+        if (!current) throw new DvmError("no_config", "No config found.", "Run: dvm init");
+        const privateKey = current.x402?.privateKey;
+        if (privateKey === void 0) throw x402WalletMissingError();
+        if (!isValidEvmPrivateKey(privateKey)) throw invalidX402PrivateKey();
+        return { set: { x402: { privateKey, network } } };
+      }
+    });
+    const stored = previous?.x402;
+    if (stored === void 0) throw x402WalletMissingError();
+    if (!isValidEvmPrivateKey(stored.privateKey)) throw invalidX402PrivateKey();
+    const { privateKeyToAccount } = await import("viem/accounts");
+    return {
+      address: privateKeyToAccount(stored.privateKey).address,
+      previousNetwork: stored.network ?? X402_DEFAULT_NETWORK,
+      network
+    };
+  });
+}
+async function saveX402Wallet(privateKey, network) {
+  if (network !== void 0) assertSupportedX402Network(network);
+  if (!isValidEvmPrivateKey(privateKey)) throw invalidX402PrivateKey();
+  const { privateKeyToAccount } = await import("viem/accounts");
+  const account = privateKeyToAccount(privateKey);
+  let resolved;
+  await updateConfig({
+    reason: "x402_wallet_connect",
+    patch: (current) => {
+      resolved = network ?? current?.x402?.network;
+      return {
+        set: { x402: resolved === void 0 ? { privateKey } : { privateKey, network: resolved } }
+      };
+    }
+  });
+  return { address: account.address, network: resolved ?? X402_DEFAULT_NETWORK };
+}
+async function removeX402Wallet() {
+  await updateConfig({
+    reason: "x402_wallet_disconnect",
+    authorize: authorizeProtectedRemoval("x402"),
+    patch: () => ({ unset: ["x402"] })
+  });
+}
+function invalidX402PrivateKey() {
+  return new DvmError(
+    "invalid_key",
+    "Invalid secp256k1 private key.",
+    "Reconnect with `dvm wallet x402-connect --key-file <path>`, set DVM_X402_KEY, or pipe a valid 0x-prefixed 32-byte secp256k1 private key through stdin."
+  );
+}
+function x402WalletMissingError() {
+  return new DvmError(
+    "x402_wallet_missing",
+    "No x402 wallet is connected.",
+    "Run 'dvm wallet x402-connect' to create one, or add --key-file <path> to import a key you already hold."
+  );
+}
+async function getX402Balance(wallet) {
+  const w = await ensureAddress(wallet);
+  const spec = x402NetworkByCaip2(w.network);
+  if (!spec) {
+    throw new DvmError(
+      "x402_unsupported_network",
+      `The x402 wallet is configured for ${w.network}, a chain this rail can't settle on.`,
+      `${x402SupportedNetworksHint()} Re-pin the connected wallet without handling its key: 'dvm wallet x402-network ${X402_DEFAULT_NETWORK}'.`
+    );
+  }
+  const chains = await import("viem/chains");
+  const { createPublicClient, http, erc20Abi } = await import("viem");
+  const chain = chains[spec.viemChain];
+  const { url: rpcUrl, source: rpcSource } = resolveRpcOverride(
+    process.env.DVM_X402_RPC_URL,
+    chain?.rpcUrls.default.http[0]
+  );
+  try {
+    const transportOptions = resolveRpcHttpTransportOptions(
+      rpcSource,
+      process.env.DVM_X402_RPC_HEADERS_JSON
+    );
+    const client = createPublicClient({
+      chain,
+      transport: transportOptions ? http(rpcUrl, transportOptions) : http(rpcUrl)
+    });
+    const balance = await client.readContract({
+      address: spec.usdc,
+      abi: erc20Abi,
+      functionName: "balanceOf",
+      args: [w.address]
+    });
+    return {
+      address: w.address,
+      usdc: Number(balance) / 1e6,
+      network: w.network,
+      tokenAddress: spec.usdc,
+      // internal-review: redacted here rather than at a display surface, so the clear
+      // endpoint never leaves this function on the success path either.
+      rpcUrlRedacted: rpcUrl ? redactUrl(rpcUrl) : void 0,
+      rpcSource
+    };
+  } catch (err) {
+    const cause = redactUrlsInText(err instanceof Error ? err.message : String(err));
+    throw new DvmError(
+      "x402_rpc_error",
+      `x402 USDC balance lookup on ${spec.label} failed: ${cause}`,
+      // A caller who set the override doesn't need to be told to set it. Which
+      // knob is theirs to turn depends on whose endpoint this was.
+      rpcSource === "override" ? `DVM_X402_RPC_URL sent this read to ${redactUrl(rpcUrl)}. Correct it, or unset it to fall back to ${spec.label}'s bundled endpoint.` : `Verify connectivity to ${spec.label}'s bundled endpoint${rpcUrl ? ` (${redactUrl(rpcUrl)})` : ""}, or send the read somewhere else with DVM_X402_RPC_URL.`
+    );
+  }
+}
+
+// src/lib/x402/client.ts
+async function tryX402Payment(request, wallet) {
+  const selection = selectPaymentRequirement(request);
+  let networkSlug;
+  let networkCaip2;
+  let chainId;
+  let usdc;
+  try {
+    networkCaip2 = x402NetworkToCaip2(selection.network);
+    const mapped = x402NetworkByCaip2(networkCaip2);
+    networkSlug = mapped?.slug ?? selection.network;
+    chainId = chainIdFromCaip2(networkCaip2);
+    usdc = usdcContractFor(networkSlug);
+  } catch (err) {
+    throw new DvmError(
+      "x402_build_failed",
+      `Could not resolve x402 network from '${selection.network}': ${err instanceof Error ? err.message : String(err)}`,
+      "Check that the DVM's advertised x402.network is a CAIP-2 chain id (e.g. 'eip155:8453' for Base)."
+    );
+  }
+  if (!usdc) return null;
+  const rate = await priceableRate(request.btcRate);
+  if (rate === null) return null;
+  const localUsdcMicro = BigInt(msatsToUsdc(request.amountMsats, rate));
+  const requiredUsdcMicro = resolveRequiredUsdcMicro(selection.amount, localUsdcMicro);
+  const signedAmountMsats = usdcToMsats(Number(requiredUsdcMicro) / 1e6, rate);
+  try {
+    const w = await ensureAddress(wallet);
+    const validAfter = 0n;
+    const validBefore = BigInt(
+      Math.floor(Date.now() / 1e3) + X402_EXACT_AUTHORIZATION_TTL_SECONDS
+    );
+    const nonce = request.nonce ?? `0x${randomBytes(32).toString("hex")}`;
+    const domainName = selectedDomainField(selection.accepted?.extra?.name, "name") ?? usdcDomainNameFor(networkSlug) ?? "USD Coin";
+    const domainVersion = selectedDomainField(selection.accepted?.extra?.version, "version") ?? usdcDomainVersionFor(networkSlug) ?? "2";
+    const { signTypedData } = await import("viem/accounts");
+    const signature = await signTypedData({
+      privateKey: w.privateKey,
+      domain: {
+        name: domainName,
+        version: domainVersion,
+        chainId,
+        verifyingContract: usdc
+      },
+      types: {
+        TransferWithAuthorization: [
+          { name: "from", type: "address" },
+          { name: "to", type: "address" },
+          { name: "value", type: "uint256" },
+          { name: "validAfter", type: "uint256" },
+          { name: "validBefore", type: "uint256" },
+          { name: "nonce", type: "bytes32" }
+        ]
+      },
+      primaryType: "TransferWithAuthorization",
+      message: {
+        from: w.address,
+        to: selection.payTo,
+        value: requiredUsdcMicro,
+        validAfter,
+        validBefore,
+        nonce
+      }
+    });
+    const exactPayload = {
+      signature,
+      payload: {
+        authorization: {
+          from: w.address,
+          to: selection.payTo,
+          value: requiredUsdcMicro.toString(),
+          validAfter: validAfter.toString(),
+          validBefore: validBefore.toString(),
+          nonce
+        }
+      }
+    };
+    const payload = selection.version === X402_V1_VERSION ? {
+      x402Version: X402_V1_VERSION,
+      scheme: "exact",
+      network: networkSlug,
+      payload: { signature: exactPayload.signature, ...exactPayload.payload }
+    } : {
+      x402Version: X402_VERSION,
+      ...selection.resource ? { resource: selection.resource } : {},
+      accepted: selection.accepted ?? buildPaymentRequirements({
+        x402Config: {
+          payTo: selection.payTo,
+          network: networkCaip2,
+          ...selection.asset ? { asset: selection.asset } : {}
+        },
+        requiredUsdcMicro,
+        resource: selection.resource?.url ?? "",
+        version: X402_VERSION
+      }),
+      payload: { signature: exactPayload.signature, ...exactPayload.payload },
+      extensions: selection.extensions ?? {}
+    };
+    return {
+      paymentHeader: encodePayment(payload),
+      x402Version: selection.version,
+      amountUsdcMicro: requiredUsdcMicro.toString(),
+      amountMsats: signedAmountMsats,
+      btcRate: rate
+    };
+  } catch (err) {
+    throw new DvmError(
+      "x402_build_failed",
+      `Failed to build x402 payment: ${err instanceof Error ? err.message : String(err)}`,
+      "Check the configured x402 private key and RPC reachability for the target chain."
+    );
+  }
+}
+function isSignableExactRequirement(requirement) {
+  const transferMethod = requirement.extra?.assetTransferMethod;
+  return requirement.scheme === "exact" && (transferMethod === void 0 || transferMethod === "eip3009");
+}
+function selectPaymentRequirement(request) {
+  const challenge = request.paymentRequired;
+  if (challenge?.x402Version === X402_VERSION) {
+    const accepted = challenge.accepts.find(isSignableExactRequirement);
+    if (!accepted) {
+      throw invalidChallenge("The DVM's v2 x402 challenge has no exact EIP-3009 requirement.");
+    }
+    return {
+      version: X402_VERSION,
+      network: accepted.network,
+      amount: accepted.amount,
+      payTo: accepted.payTo,
+      asset: accepted.asset,
+      accepted,
+      resource: challenge.resource,
+      extensions: challenge.extensions
+    };
+  }
+  if (challenge?.x402Version === X402_V1_VERSION) {
+    const accepted = challenge.accepts.find((candidate) => candidate.scheme === "exact");
+    if (!accepted) throw invalidChallenge("The DVM's v1 x402 challenge has no exact requirement.");
+    return {
+      version: X402_V1_VERSION,
+      network: accepted.network,
+      amount: accepted.maxAmountRequired,
+      payTo: accepted.payTo,
+      asset: accepted.asset
+    };
+  }
+  return {
+    version: request.x402Version ?? X402_V1_VERSION,
+    network: request.network,
+    amount: request.requiredUsdcMicro,
+    payTo: request.payTo,
+    asset: request.asset,
+    resource: request.resource
+  };
+}
+function invalidChallenge(message) {
+  return new DvmError(
+    "x402_build_failed",
+    message,
+    "Ask the DVM operator to advertise an exact x402 payment requirement."
+  );
+}
+function selectedDomainField(value, field) {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value === "string" && value.length > 0) return value;
+  throw invalidChallenge(`The DVM advertised an invalid x402 ${field}.`);
+}
+function resolveRequiredUsdcMicro(advertised, localUsdcMicro) {
+  if (advertised === void 0) return localUsdcMicro;
+  if (!/^[1-9]\d*$/.test(advertised)) {
+    throw new DvmError(
+      "x402_amount_invalid",
+      `The DVM advertised an invalid x402 maxAmountRequired: '${advertised}'.`,
+      "Do not sign this payment. Ask the DVM operator to return a positive integer number of USDC micro-units."
+    );
+  }
+  const required = BigInt(advertised);
+  if (withinAdvertisedTolerance(required, localUsdcMicro)) return required;
+  const advertisedUsd = Number(required) / 1e6;
+  const localUsd = Number(localUsdcMicro) / 1e6;
+  throw new DvmError(
+    "x402_amount_exceeds_limit",
+    `The DVM's x402 charge ($${formatUsd(advertisedUsd)} USDC) is more than 10% above the caller's local price ($${formatUsd(localUsd)} USDC).`,
+    "The payment was not signed. Refresh the quote or ask the DVM operator to check its BTC/USD rate.",
+    {
+      advertised_usdc_microunits: required.toString(),
+      local_usdc_microunits: localUsdcMicro.toString(),
+      max_usdc_microunits: maxAdvertisedMicro(localUsdcMicro).toString(),
+      anchor: costAnchor(advertisedUsd),
+      display: `Payment refused: $${formatUsd(advertisedUsd)} USDC exceeds the 10% safety margin over the caller's $${formatUsd(localUsd)} USDC estimate.`
+    }
+  );
+}
+async function priceableRate(btcRate) {
+  if (btcRate && btcRate > 0) return btcRate;
+  try {
+    return (await resolveBtcUsdRate("payment")).rate;
+  } catch (err) {
+    if (err instanceof DvmError && err.code === "rate_unavailable") {
+      info(
+        "Skipping the x402 rail: it prices in USDC and the BTC/USD rate is unavailable (no cached rate on this machine). Trying the remaining rails."
+      );
+      return null;
+    }
+    throw err;
+  }
+}
+
+// src/lib/x402/verify.ts
+async function verifyX402Payment(paymentHeader, config, requiredUsdcMicro, resource, btcUsdRate, exactVersions = { v1: true, v2: true }) {
+  return callerLoggers.x402.span(
+    "x402.verify_payment",
+    {
+      resource,
+      required_usdc_micro: Number(requiredUsdcMicro),
+      facilitator_url: config.facilitator
+    },
+    async () => {
+      let payload;
+      try {
+        payload = decodePayment(paymentHeader);
+      } catch {
+        return { verified: false, amountMsats: 0, invalidReason: "decode_failed" };
+      }
+      if (payload.x402Version === 1 && !exactVersions.v1 || payload.x402Version === 2 && !exactVersions.v2) {
+        return { verified: false, amountMsats: 0, invalidReason: "unsupported_version" };
+      }
+      const requirementOpts = { x402Config: config, requiredUsdcMicro, resource };
+      const requirements = payload.x402Version === 1 ? buildPaymentRequirements({ ...requirementOpts, version: 1 }) : buildPaymentRequirements({ ...requirementOpts, version: 2 });
+      const createAuthHeaders = createX402FacilitatorAuthHeaders(config);
+      const verifyRes = await verifyWithFacilitator(
+        payload,
+        requirements,
+        config,
+        createAuthHeaders
+      );
+      if (!verifyRes.isValid) {
+        return {
+          verified: false,
+          amountMsats: 0,
+          invalidReason: verifyRes.invalidReason ?? "verify_failed"
+        };
+      }
+      const settleRes = await settleWithFacilitator(
+        payload,
+        requirements,
+        config,
+        createAuthHeaders
+      );
+      if (!settleRes.success) {
+        return {
+          verified: false,
+          amountMsats: 0,
+          invalidReason: settleRes.errorReason ?? "settle_failed"
+        };
+      }
+      const amountUsdcMicro = Number.parseInt(exactEvmAuthorization(payload).value, 10);
+      const amountMsats = usdcToMsats(amountUsdcMicro / 1e6, btcUsdRate);
+      callerLoggers.x402.info("x402.verify_payment.result", {
+        verified: true,
+        tx_hash: settleRes.transaction,
+        amount_msats: amountMsats
+      });
+      return {
+        verified: true,
+        amountMsats,
+        amountUsdcMicro,
+        txHash: settleRes.transaction,
+        settleResponseHeader: encodeSettleResponseHeader(settleRes)
+      };
+    }
+  );
+}
+export {
+  X402_DEFAULT_FACILITATOR,
+  X402_DEFAULT_NETWORK,
+  X402_NETWORKS,
+  X402_V1_VERSION,
+  X402_VERSION,
+  assertSupportedX402Network,
+  buildPaymentRequiredV2,
+  buildPaymentRequirements,
+  caip2ToX402Network,
+  chainIdFromCaip2,
+  connectedX402Payer,
+  decodePayment,
+  decodePaymentRequiredHeader,
+  encodePayment,
+  encodePaymentRequiredHeader,
+  encodeSettleResponseHeader,
+  ensureAddress,
+  exactEvmAuthorization,
+  generateX402PrivateKey,
+  getX402Balance,
+  loadX402Wallet,
+  paymentRequiredV2FromV1,
+  removeX402Wallet,
+  repinX402WalletNetwork,
+  resolveX402Asset,
+  saveX402Wallet,
+  tryX402Payment,
+  usdcContractByCaip2,
+  verifyX402Payment,
+  x402NetworkByCaip2,
+  x402NetworkLabel,
+  x402NetworkListForCopy,
+  x402NetworkToCaip2,
+  x402SupportedNetworksHint,
+  x402WrongAssetHint
+};