@fatstack/x402 0.1.0 → 0.1.1

package/dist/{chunk-6LSPHKJ7.js → chunk-C4BASAUA.js}

@@ -1,6 +1,10 @@
 // src/constants.ts
 var NETWORKS = {
-  base: { caip2: "eip155:8453", chainId: 8453, usdc: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" },
+  base: {
+    caip2: "eip155:8453",
+    chainId: 8453,
+    usdc: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
+  },
   "base-sepolia": {
     caip2: "eip155:84532",
     chainId: 84532,
@@ -11,6 +15,15 @@ var USDC_DECIMALS = 6;
 var NO_REFUNDS_NOTICE = "Payments are final. Once settled on-chain the transfer cannot be reversed, and there are no refunds.";
 var DOCS_URL = "https://fatstack.net/docs/payments";
 var PAYMENT_REF_HEADER = "X-Fatstack-Payment-Ref";
+var SETTLEMENT_HEADERS = ["payment-response", "x-payment-response"];
+var PAYMENT_SIGNATURE_HEADERS = ["payment-signature", "x-payment"];
+function readSettlementHeader(headers) {
+  for (const name of SETTLEMENT_HEADERS) {
+    const value = headers.get(name);
+    if (value) return value;
+  }
+  return null;
+}
 var DEFAULT_FACILITATOR_URL = "https://x402.org/facilitator";
 
 // src/errors.ts
@@ -36,6 +49,12 @@ var MissingAdapterError = class extends Error {
     super(`${pkg} is not installed. Add it to use this adapter: pnpm add ${pkg}`);
   }
 };
+var UnreadableQuoteError = class extends Error {
+  name = "UnreadableQuoteError";
+  constructor(message) {
+    super(message);
+  }
+};
 
 // src/money.ts
 var UNITS_PER_USDC = 10n ** BigInt(USDC_DECIMALS);
@@ -77,12 +96,16 @@ export {
   NO_REFUNDS_NOTICE,
   DOCS_URL,
   PAYMENT_REF_HEADER,
+  SETTLEMENT_HEADERS,
+  PAYMENT_SIGNATURE_HEADERS,
+  readSettlementHeader,
   DEFAULT_FACILITATOR_URL,
   SpendGuardError,
   NotImplementedError,
   MissingAdapterError,
+  UnreadableQuoteError,
   parseUsdc,
   formatUsdc,
   quoteToUsd
 };
-//# sourceMappingURL=chunk-6LSPHKJ7.js.map
+//# sourceMappingURL=chunk-C4BASAUA.js.map

package/dist/chunk-C4BASAUA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/errors.ts","../src/money.ts"],"sourcesContent":["/** Base networks in CAIP-2 form, which is what x402 v2 speaks. */\n/**\n * The EIP-712 domain a payer signs the EIP-3009 authorisation against is **not** listed\n * here on purpose: it differs per network (mainnet USDC is \"USD Coin\", the Sepolia\n * deployment is \"USDC\"), and the EVM scheme owns the authoritative table. Quoting a\n * dollar price lets it resolve the asset and publish that domain in the 402; naming an\n * explicit asset bypasses the lookup and emits `extra: {}`, which no payer can sign\n * against.\n */\nexport const NETWORKS = {\n  base: {\n    caip2: 'eip155:8453',\n    chainId: 8453,\n    usdc: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',\n  },\n  'base-sepolia': {\n    caip2: 'eip155:84532',\n    chainId: 84532,\n    usdc: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',\n  },\n} as const;\n\nexport type NetworkName = keyof typeof NETWORKS;\n\n/** USDC is 6 decimals on Base. */\nexport const USDC_DECIMALS = 6;\n\n/**\n * Required on every 402 body and every payment-facing doc page. A payment is a direct\n * on-chain transfer between two wallets: once settled nobody, Fatstack included, can\n * reverse it.\n */\nexport const NO_REFUNDS_NOTICE =\n  'Payments are final. Once settled on-chain the transfer cannot be reversed, and there are no refunds.';\n\nexport const DOCS_URL = 'https://fatstack.net/docs/payments';\n\n/** Correlates a settled payment with the indexer's view of the on-chain transfer. */\nexport const PAYMENT_REF_HEADER = 'X-Fatstack-Payment-Ref';\n\n/**\n * x402 v2 dropped the `X-` prefix: the settlement receipt is `PAYMENT-RESPONSE` and the\n * payer's payload is `PAYMENT-SIGNATURE`. The v1 spellings are still read so a v1 payer\n * or resource keeps working. Header names are case-insensitive; these are lowercase\n * because `Headers.get` normalises.\n */\nexport const SETTLEMENT_HEADERS = ['payment-response', 'x-payment-response'] as const;\nexport const PAYMENT_SIGNATURE_HEADERS = ['payment-signature', 'x-payment'] as const;\n\n/** First settlement receipt present on a response, in either spelling. */\nexport function readSettlementHeader(headers: Headers): string | null {\n  for (const name of SETTLEMENT_HEADERS) {\n    const value = headers.get(name);\n    if (value) return value;\n  }\n  return null;\n}\n\nexport const DEFAULT_FACILITATOR_URL = 'https://x402.org/facilitator';\n","/** Names of the spend guards an agent can set. */\nexport type GuardName = 'maxPerCall' | 'maxPerHour' | 'maxPerDay' | 'allowedHosts';\n\n/**\n * Thrown before anything is signed when a call would breach a spend guard.\n *\n * Payments are final, so the only place to stop an unwanted spend is before the\n * signature exists. Every guard raises this, and it is never thrown after a payment\n * payload has been created.\n */\nexport class SpendGuardError extends Error {\n  override readonly name = 'SpendGuardError';\n\n  constructor(\n    readonly guard: GuardName,\n    message: string,\n    readonly detail: { limitUsd?: number; attemptedUsd?: number; host?: string } = {},\n  ) {\n    super(message);\n  }\n}\n\n/** Thrown by seams that are typed and reachable but deliberately not built yet. */\nexport class NotImplementedError extends Error {\n  override readonly name = 'NotImplementedError';\n\n  constructor(feature: string) {\n    super(`${feature} is not implemented in this build.`);\n  }\n}\n\n/** Thrown when an optional framework adapter is used without its package installed. */\nexport class MissingAdapterError extends Error {\n  override readonly name = 'MissingAdapterError';\n\n  constructor(pkg: string) {\n    super(`${pkg} is not installed. Add it to use this adapter: pnpm add ${pkg}`);\n  }\n}\n\n/**\n * A 402 arrived whose payment requirements could not be read, so the call cannot be\n * priced and therefore cannot be checked against a spend cap. Refusing is the safe\n * outcome: paying blind is irreversible.\n */\nexport class UnreadableQuoteError extends Error {\n  override readonly name = 'UnreadableQuoteError';\n\n  constructor(message: string) {\n    super(message);\n  }\n}\n","import { NETWORKS, USDC_DECIMALS } from './constants.js';\n\nconst UNITS_PER_USDC = 10n ** BigInt(USDC_DECIMALS);\n\n/** \"1.25\" -> 1250000n. Rejects anything that is not a plain non-negative decimal. */\nexport function parseUsdc(input: string): bigint {\n  const match = /^(\\d+)(?:\\.(\\d{1,6}))?$/.exec(input.trim());\n  if (!match) {\n    throw new RangeError(`Not a USDC amount with at most ${USDC_DECIMALS} decimals: ${input}`);\n  }\n  const whole = BigInt(match[1] ?? '0');\n  const fraction = BigInt((match[2] ?? '').padEnd(USDC_DECIMALS, '0') || '0');\n  return whole * UNITS_PER_USDC + fraction;\n}\n\n/** 1250000n -> \"1.25\". Trailing zeros trimmed. */\nexport function formatUsdc(atomic: bigint): string {\n  if (atomic < 0n) throw new RangeError('USDC amounts are never negative');\n  const whole = atomic / UNITS_PER_USDC;\n  const fraction = (atomic % UNITS_PER_USDC).toString().padStart(USDC_DECIMALS, '0');\n  const trimmed = fraction.replace(/0+$/, '');\n  return trimmed ? `${whole}.${trimmed}` : whole.toString();\n}\n\nconst USDC_ADDRESSES = new Set(\n  Object.values(NETWORKS).map((network) => network.usdc.toLowerCase()),\n);\n\n/**\n * Converts a quoted amount to USD for guard evaluation.\n *\n * Fails closed: if the asset is not a USDC contract we recognise and the quote carries no\n * usable `decimals`, this throws rather than guessing. Guessing here would let an\n * unrecognised token slip past a spend cap, and the payment is irreversible.\n */\nexport function quoteToUsd(quote: {\n  amountAtomic: string;\n  asset: string;\n  decimals?: number | undefined;\n}): number {\n  const decimals = USDC_ADDRESSES.has(quote.asset.toLowerCase()) ? USDC_DECIMALS : quote.decimals;\n\n  if (decimals === undefined || !Number.isInteger(decimals) || decimals < 0 || decimals > 36) {\n    throw new RangeError(\n      `Cannot price asset ${quote.asset}: unknown decimals. Refusing to evaluate spend guards against an unpriceable quote.`,\n    );\n  }\n\n  if (!/^\\d+$/.test(quote.amountAtomic)) {\n    throw new RangeError(`Quoted amount is not an integer atomic value: ${quote.amountAtomic}`);\n  }\n\n  return Number(quote.amountAtomic) / 10 ** decimals;\n}\n"],"mappings":";AASO,IAAM,WAAW;AAAA,EACtB,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,EACR;AAAA,EACA,gBAAgB;AAAA,IACd,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,EACR;AACF;AAKO,IAAM,gBAAgB;AAOtB,IAAM,oBACX;AAEK,IAAM,WAAW;AAGjB,IAAM,qBAAqB;AAQ3B,IAAM,qBAAqB,CAAC,oBAAoB,oBAAoB;AACpE,IAAM,4BAA4B,CAAC,qBAAqB,WAAW;AAGnE,SAAS,qBAAqB,SAAiC;AACpE,aAAW,QAAQ,oBAAoB;AACrC,UAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;;;AChDhC,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAGzC,YACW,OACT,SACS,SAAsE,CAAC,GAChF;AACA,UAAM,OAAO;AAJJ;AAEA;AAAA,EAGX;AAAA,EALW;AAAA,EAEA;AAAA,EALO,OAAO;AAS3B;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAC3B,OAAO;AAAA,EAEzB,YAAY,SAAiB;AAC3B,UAAM,GAAG,OAAO,oCAAoC;AAAA,EACtD;AACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAC3B,OAAO;AAAA,EAEzB,YAAY,KAAa;AACvB,UAAM,GAAG,GAAG,2DAA2D,GAAG,EAAE;AAAA,EAC9E;AACF;AAOO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC5B,OAAO;AAAA,EAEzB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AAAA,EACf;AACF;;;ACjDA,IAAM,iBAAiB,OAAO,OAAO,aAAa;AAG3C,SAAS,UAAU,OAAuB;AAC/C,QAAM,QAAQ,0BAA0B,KAAK,MAAM,KAAK,CAAC;AACzD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,WAAW,kCAAkC,aAAa,cAAc,KAAK,EAAE;AAAA,EAC3F;AACA,QAAM,QAAQ,OAAO,MAAM,CAAC,KAAK,GAAG;AACpC,QAAM,WAAW,QAAQ,MAAM,CAAC,KAAK,IAAI,OAAO,eAAe,GAAG,KAAK,GAAG;AAC1E,SAAO,QAAQ,iBAAiB;AAClC;AAGO,SAAS,WAAW,QAAwB;AACjD,MAAI,SAAS,GAAI,OAAM,IAAI,WAAW,iCAAiC;AACvE,QAAM,QAAQ,SAAS;AACvB,QAAM,YAAY,SAAS,gBAAgB,SAAS,EAAE,SAAS,eAAe,GAAG;AACjF,QAAM,UAAU,SAAS,QAAQ,OAAO,EAAE;AAC1C,SAAO,UAAU,GAAG,KAAK,IAAI,OAAO,KAAK,MAAM,SAAS;AAC1D;AAEA,IAAM,iBAAiB,IAAI;AAAA,EACzB,OAAO,OAAO,QAAQ,EAAE,IAAI,CAAC,YAAY,QAAQ,KAAK,YAAY,CAAC;AACrE;AASO,SAAS,WAAW,OAIhB;AACT,QAAM,WAAW,eAAe,IAAI,MAAM,MAAM,YAAY,CAAC,IAAI,gBAAgB,MAAM;AAEvF,MAAI,aAAa,UAAa,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,IAAI;AAC1F,UAAM,IAAI;AAAA,MACR,sBAAsB,MAAM,KAAK;AAAA,IACnC;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,KAAK,MAAM,YAAY,GAAG;AACrC,UAAM,IAAI,WAAW,iDAAiD,MAAM,YAAY,EAAE;AAAA,EAC5F;AAEA,SAAO,OAAO,MAAM,YAAY,IAAI,MAAM;AAC5C;","names":[]}

package/dist/{chunk-7DVR574O.js → chunk-PY25VKHS.js}

@@ -6,9 +6,11 @@ import {
   NO_REFUNDS_NOTICE,
   NotImplementedError,
   PAYMENT_REF_HEADER,
+  SETTLEMENT_HEADERS,
   formatUsdc,
-  parseUsdc
-} from "./chunk-6LSPHKJ7.js";
+  parseUsdc,
+  readSettlementHeader
+} from "./chunk-C4BASAUA.js";
 
 // src/provider.ts
 import { decodePaymentResponseHeader } from "@x402/core/http";
@@ -99,7 +101,11 @@ function paywall(options) {
       payTo,
       // An explicit asset+amount pins USDC and the exact atomic amount, rather than
       // leaving the quote to a price feed.
-      price: { asset: network.usdc, amount: amountAtomic },
+      // A dollar price, not an explicit { asset, amount }: the EVM scheme resolves the
+      // network's default asset (USDC) and publishes its EIP-712 domain in `extra`, which
+      // the payer needs to sign the EIP-3009 authorisation. Naming the asset directly
+      // skips that lookup and emits `extra: {}`, which nobody can pay against.
+      price: `$${priceUsdc}`,
       maxTimeoutSeconds: config.maxTimeoutSeconds
     },
     description: config.description ?? `Fatstack tool ${config.toolId}`,
@@ -142,7 +148,7 @@ function paywall(options) {
         const middleware = cached;
         const result = await middleware(c, next);
         const carrier = result instanceof Response ? result : c.res;
-        const ref = paymentRef(carrier?.headers?.get("x-payment-response"));
+        const ref = paymentRef(carrier ? readSettlementHeader(carrier.headers) : null);
         if (ref) carrier.headers.set(PAYMENT_REF_HEADER, ref);
         return result;
       };
@@ -162,7 +168,7 @@ function paywall(options) {
         const originalSetHeader = response.setHeader.bind(response);
         response.setHeader = (name, value) => {
           const out = originalSetHeader(name, value);
-          if (String(name).toLowerCase() === "x-payment-response") {
+          if (SETTLEMENT_HEADERS.includes(String(name).toLowerCase())) {
             const ref = paymentRef(String(value));
             if (ref) originalSetHeader(PAYMENT_REF_HEADER, ref);
           }
@@ -185,7 +191,7 @@ function paywall(options) {
         const wrapped = cached;
         const result = await wrapped(request);
         if (result instanceof Response) {
-          const ref = paymentRef(result.headers.get("x-payment-response"));
+          const ref = paymentRef(readSettlementHeader(result.headers));
           if (ref) result.headers.set(PAYMENT_REF_HEADER, ref);
         }
         return result;
@@ -210,4 +216,4 @@ export {
   readPaywallEnv,
   paywall
 };
-//# sourceMappingURL=chunk-7DVR574O.js.map
+//# sourceMappingURL=chunk-PY25VKHS.js.map

package/dist/chunk-PY25VKHS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provider.ts","../src/env.ts","../src/fee-mode.ts"],"sourcesContent":["import { decodePaymentResponseHeader } from '@x402/core/http';\nimport { HTTPFacilitatorClient, x402ResourceServer } from '@x402/core/server';\nimport type { FacilitatorClient, RouteConfig } from '@x402/core/server';\nimport { ExactEvmScheme } from '@x402/evm/exact/server';\nimport { z } from 'zod';\n\nimport {\n  DOCS_URL,\n  NETWORKS,\n  NO_REFUNDS_NOTICE,\n  PAYMENT_REF_HEADER,\n  readSettlementHeader,\n} from './constants.js';\nimport type { NetworkName } from './constants.js';\nimport { readPaywallEnv } from './env.js';\nimport { SETTLEMENT_HEADERS } from './constants.js';\nimport { MissingAdapterError } from './errors.js';\nimport { resolvePayee } from './fee-mode.js';\nimport { formatUsdc, parseUsdc } from './money.js';\n\nconst optionsSchema = z.object({\n  /** Price per call in USD, as a decimal string: \"0.002\". */\n  price: z.string().regex(/^\\d+(?:\\.\\d{1,6})?$/, 'price must be USD with at most 6 decimals'),\n  /** The provider's own wallet. Under FEE_MODE=direct this is the sole payee. */\n  wallet: z.string().regex(/^0x[0-9a-fA-F]{40}$/, 'wallet must be a 20-byte address'),\n  toolId: z.string().min(1).max(128),\n  network: z.enum(['base', 'base-sepolia']).default('base'),\n  description: z.string().optional(),\n  docsUrl: z.string().url().default(DOCS_URL),\n  mimeType: z.string().default('application/json'),\n  maxTimeoutSeconds: z.number().int().positive().default(60),\n});\n\nexport interface PaywallOptions extends z.input<typeof optionsSchema> {\n  /** Defaults to process.env. */\n  env?: Record<string, string | undefined>;\n  /** Injects a facilitator instead of building an HTTP one. Used by tests. */\n  facilitator?: FacilitatorClient;\n}\n\n/** The 402 body an agent reads before deciding to pay. */\nexport interface UnpaidBody {\n  error: 'payment_required';\n  tool: string;\n  price: { usdc: string; amountAtomic: string; asset: string; network: string };\n  payTo: string;\n  terms: { refundable: false; notice: string };\n  docs: string;\n  message: string;\n}\n\n/** Structurally compatible with Hono's `MiddlewareHandler`, without importing hono. */\nexport interface HonoContextLike {\n  json: (body: unknown, status?: number) => Response;\n  res: Response;\n  req: { raw: Request };\n}\nexport type HonoMiddleware = (\n  c: HonoContextLike,\n  next: () => Promise<void>,\n) => Promise<Response | void>;\n\n/** Structurally compatible with an Express request handler. */\nexport interface ExpressResponseLike {\n  status: (code: number) => { json: (body: unknown) => void };\n  setHeader: (name: string, value: string | number | readonly string[]) => unknown;\n}\nexport type ExpressMiddleware = (\n  req: unknown,\n  res: ExpressResponseLike,\n  next: (err?: unknown) => void,\n) => Promise<void>;\n\nexport interface Paywall {\n  /** Hono middleware. Requires @x402/hono. */\n  hono(): HonoMiddleware;\n  /** Express middleware. Requires @x402/express. */\n  express(): ExpressMiddleware;\n  /** Wraps a Next.js route handler. Requires @x402/next (which needs Next >= 16.2.6). */\n  next<T>(handler: (request: never) => Promise<T>): (request: never) => Promise<T>;\n  /** The x402 route config, for advanced use with the official adapters directly. */\n  routeConfig: RouteConfig;\n  /** Resolved payee. Always the provider wallet while FEE_MODE=direct. */\n  payTo: string;\n}\n\n/** Minimal shapes of the optional adapter packages, so their types are not required. */\ninterface HonoAdapterModule {\n  paymentMiddleware: (routes: RouteConfig, server: x402ResourceServer) => unknown;\n}\ninterface ExpressAdapterModule {\n  paymentMiddleware: (routes: RouteConfig, server: x402ResourceServer) => unknown;\n}\ninterface NextAdapterModule {\n  withX402: (handler: unknown, routeConfig: RouteConfig, server: x402ResourceServer) => unknown;\n}\n\nconst KILLSWITCH_BODY = {\n  error: 'service_unavailable',\n  message:\n    'This tool is temporarily disabled by its operator (KILLSWITCH). No payment was taken. Try again later.',\n} as const;\n\n/**\n * Paywalls a route with x402: USDC on Base, paid directly to the provider's wallet.\n *\n * Verification and settlement are delegated to the official x402 packages against the\n * hosted facilitator — this module does not sign or verify anything itself.\n *\n * Throws immediately when FEE_MODE=splitter: there is no splitter contract in this build,\n * and silently falling back to `direct` would pay the wrong party.\n */\nexport function paywall(options: PaywallOptions): Paywall {\n  const config = optionsSchema.parse(options);\n  const env = readPaywallEnv(options.env);\n  const network = NETWORKS[config.network as NetworkName];\n\n  // Throws for FEE_MODE=splitter, at construction time rather than mid-request.\n  const { payTo } = resolvePayee(env.FEE_MODE, config.wallet);\n\n  const amountAtomic = parseUsdc(config.price).toString();\n  const priceUsdc = formatUsdc(parseUsdc(config.price));\n\n  const unpaidBody: UnpaidBody = {\n    error: 'payment_required',\n    tool: config.toolId,\n    price: {\n      usdc: priceUsdc,\n      amountAtomic,\n      asset: network.usdc,\n      network: network.caip2,\n    },\n    payTo,\n    terms: { refundable: false, notice: NO_REFUNDS_NOTICE },\n    docs: config.docsUrl,\n    message: `This call costs ${priceUsdc} USDC on ${config.network}, paid directly to the provider. ${NO_REFUNDS_NOTICE} See ${config.docsUrl}`,\n  };\n\n  const routeConfig: RouteConfig = {\n    accepts: {\n      scheme: 'exact',\n      network: network.caip2,\n      payTo,\n      // An explicit asset+amount pins USDC and the exact atomic amount, rather than\n      // leaving the quote to a price feed.\n      // A dollar price, not an explicit { asset, amount }: the EVM scheme resolves the\n      // network's default asset (USDC) and publishes its EIP-712 domain in `extra`, which\n      // the payer needs to sign the EIP-3009 authorisation. Naming the asset directly\n      // skips that lookup and emits `extra: {}`, which nobody can pay against.\n      price: `$${priceUsdc}`,\n      maxTimeoutSeconds: config.maxTimeoutSeconds,\n    },\n    description: config.description ?? `Fatstack tool ${config.toolId}`,\n    mimeType: config.mimeType,\n    unpaidResponseBody: () => ({ contentType: 'application/json', body: unpaidBody }),\n  };\n\n  const facilitator: FacilitatorClient =\n    options.facilitator ??\n    new HTTPFacilitatorClient({\n      url: env.FACILITATOR_URL,\n      ...(env.FACILITATOR_API_KEY\n        ? {\n            createAuthHeaders: async () => ({\n              verify: { authorization: `Bearer ${env.FACILITATOR_API_KEY}` },\n              settle: { authorization: `Bearer ${env.FACILITATOR_API_KEY}` },\n              supported: { authorization: `Bearer ${env.FACILITATOR_API_KEY}` },\n            }),\n          }\n        : {}),\n    });\n\n  const server = new x402ResourceServer(facilitator).register(network.caip2, new ExactEvmScheme());\n\n  const killed = env.KILLSWITCH === '1';\n\n  /** Derives the indexing reference from the settlement receipt the adapter emitted. */\n  function paymentRef(paymentResponseHeader: string | null | undefined): string | null {\n    if (!paymentResponseHeader) return null;\n    try {\n      const settled = decodePaymentResponseHeader(paymentResponseHeader);\n      const transaction = (settled as { transaction?: string }).transaction;\n      return transaction ? `${config.toolId}:${network.caip2}:${transaction}` : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return {\n    routeConfig,\n    payTo,\n\n    hono(): HonoMiddleware {\n      let cached: unknown;\n      return async (c, next) => {\n        if (killed) return c.json(KILLSWITCH_BODY, 503);\n\n        if (!cached) {\n          const mod = await importOptional<HonoAdapterModule>('@x402/hono');\n          cached = mod.paymentMiddleware(routeConfig, server);\n        }\n        const middleware = cached as (\n          ctx: HonoContextLike,\n          n: () => Promise<void>,\n        ) => Promise<Response | void>;\n        const result = await middleware(c, next);\n\n        // c.res carries the response Hono will send, whether the middleware set it or\n        // the downstream handler did.\n        const carrier = result instanceof Response ? result : c.res;\n        const ref = paymentRef(carrier ? readSettlementHeader(carrier.headers) : null);\n        if (ref) carrier.headers.set(PAYMENT_REF_HEADER, ref);\n        return result;\n      };\n    },\n\n    express(): ExpressMiddleware {\n      let cached: unknown;\n      return async (req, res, next) => {\n        const response = res;\n        if (killed) {\n          response.status(503).json(KILLSWITCH_BODY);\n          return;\n        }\n\n        if (!cached) {\n          const mod = await importOptional<ExpressAdapterModule>('@x402/express');\n          cached = mod.paymentMiddleware(routeConfig, server);\n        }\n\n        // Headers must be attached before the response flushes, so mirror the settlement\n        // receipt onto the ref header the moment the adapter sets it.\n        const originalSetHeader = response.setHeader.bind(response);\n        response.setHeader = (name, value) => {\n          const out = originalSetHeader(name, value);\n          if (SETTLEMENT_HEADERS.includes(String(name).toLowerCase() as never)) {\n            const ref = paymentRef(String(value));\n            if (ref) originalSetHeader(PAYMENT_REF_HEADER, ref);\n          }\n          return out;\n        };\n\n        const middleware = cached as (\n          q: unknown,\n          s: unknown,\n          n: (err?: unknown) => void,\n        ) => Promise<void>;\n        await middleware(req, res, next);\n      };\n    },\n\n    next<T>(handler: (request: never) => Promise<T>) {\n      let cached: unknown;\n      return async (request: never): Promise<T> => {\n        if (killed) {\n          return Response.json(KILLSWITCH_BODY, { status: 503 }) as T;\n        }\n\n        if (!cached) {\n          const mod = await importOptional<NextAdapterModule>('@x402/next');\n          cached = mod.withX402(handler as never, routeConfig, server);\n        }\n        const wrapped = cached as (r: never) => Promise<T>;\n        const result = await wrapped(request);\n\n        if (result instanceof Response) {\n          const ref = paymentRef(readSettlementHeader(result.headers));\n          if (ref) result.headers.set(PAYMENT_REF_HEADER, ref);\n        }\n        return result;\n      };\n    },\n  };\n}\n\nasync function importOptional<T>(specifier: string): Promise<T> {\n  try {\n    return (await import(/* @vite-ignore */ specifier)) as T;\n  } catch {\n    throw new MissingAdapterError(specifier);\n  }\n}\n\nexport type { FacilitatorClient, RouteConfig } from '@x402/core/server';\n","import { z } from 'zod';\n\nimport { DEFAULT_FACILITATOR_URL } from './constants.js';\n\n/**\n * Environment the paywall reads. Parsed lazily inside `paywall()`, never at module load,\n * so importing this package never throws in a build step.\n */\nexport const paywallEnvSchema = z.object({\n  /** Hosted facilitator (Coinbase CDP). Fatstack does not run its own. */\n  FACILITATOR_URL: z.string().url().default(DEFAULT_FACILITATOR_URL),\n  FACILITATOR_API_KEY: z.string().min(1).optional(),\n  /**\n   * `1` takes every paywalled route offline with a 503. Intended for an incident where\n   * continuing to take irreversible payments would be worse than being down.\n   */\n  KILLSWITCH: z.enum(['0', '1']).default('0'),\n  /**\n   * direct   = agent pays the provider wallet, 0% platform fee (the launch build)\n   * splitter = reserved for the fee-splitting contract; not implemented\n   */\n  FEE_MODE: z.enum(['direct', 'splitter']).default('direct'),\n});\n\nexport type PaywallEnv = z.infer<typeof paywallEnvSchema>;\n\nexport function readPaywallEnv(\n  source: Record<string, string | undefined> = process.env,\n): PaywallEnv {\n  return paywallEnvSchema.parse({\n    FACILITATOR_URL: source.FACILITATOR_URL,\n    FACILITATOR_API_KEY: source.FACILITATOR_API_KEY,\n    KILLSWITCH: source.KILLSWITCH,\n    FEE_MODE: source.FEE_MODE,\n  });\n}\n","import { NotImplementedError } from './errors.js';\n\nexport type FeeMode = 'direct' | 'splitter';\n\nexport interface PayeeResolution {\n  /** The single address that receives the transfer. */\n  payTo: string;\n  /** Platform fee in basis points. Always 0 while FEE_MODE=direct. */\n  feeBps: number;\n}\n\n/**\n * Resolves who is paid for a call. Under `direct` this is always, and only, the\n * provider's own wallet — the platform is never a payee and never custodies funds.\n *\n * `splitter` is a reserved seam for the fee-splitting contract. It is typed and reachable\n * so the shape is settled, but it throws: there is no splitter contract in this build.\n */\nexport function resolvePayee(mode: FeeMode, providerWallet: string): PayeeResolution {\n  switch (mode) {\n    case 'direct':\n      return { payTo: providerWallet, feeBps: 0 };\n    case 'splitter':\n      throw new NotImplementedError(\n        'FEE_MODE=splitter (no splitter contract ships in the launch build)',\n      );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB,0BAA0B;AAE1D,SAAS,sBAAsB;AAC/B,SAAS,KAAAA,UAAS;;;ACJlB,SAAS,SAAS;AAQX,IAAM,mBAAmB,EAAE,OAAO;AAAA;AAAA,EAEvC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,uBAAuB;AAAA,EACjE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhD,YAAY,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,UAAU,EAAE,KAAK,CAAC,UAAU,UAAU,CAAC,EAAE,QAAQ,QAAQ;AAC3D,CAAC;AAIM,SAAS,eACd,SAA6C,QAAQ,KACzC;AACZ,SAAO,iBAAiB,MAAM;AAAA,IAC5B,iBAAiB,OAAO;AAAA,IACxB,qBAAqB,OAAO;AAAA,IAC5B,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;;;ACjBO,SAAS,aAAa,MAAe,gBAAyC;AACnF,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,EAAE,OAAO,gBAAgB,QAAQ,EAAE;AAAA,IAC5C,KAAK;AACH,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,EACJ;AACF;;;AFPA,IAAM,gBAAgBC,GAAE,OAAO;AAAA;AAAA,EAE7B,OAAOA,GAAE,OAAO,EAAE,MAAM,uBAAuB,2CAA2C;AAAA;AAAA,EAE1F,QAAQA,GAAE,OAAO,EAAE,MAAM,uBAAuB,kCAAkC;AAAA,EAClF,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,SAASA,GAAE,KAAK,CAAC,QAAQ,cAAc,CAAC,EAAE,QAAQ,MAAM;AAAA,EACxD,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,QAAQ;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EAC/C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAC3D,CAAC;AAkED,IAAM,kBAAkB;AAAA,EACtB,OAAO;AAAA,EACP,SACE;AACJ;AAWO,SAAS,QAAQ,SAAkC;AACxD,QAAM,SAAS,cAAc,MAAM,OAAO;AAC1C,QAAM,MAAM,eAAe,QAAQ,GAAG;AACtC,QAAM,UAAU,SAAS,OAAO,OAAsB;AAGtD,QAAM,EAAE,MAAM,IAAI,aAAa,IAAI,UAAU,OAAO,MAAM;AAE1D,QAAM,eAAe,UAAU,OAAO,KAAK,EAAE,SAAS;AACtD,QAAM,YAAY,WAAW,UAAU,OAAO,KAAK,CAAC;AAEpD,QAAM,aAAyB;AAAA,IAC7B,OAAO;AAAA,IACP,MAAM,OAAO;AAAA,IACb,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,OAAO,EAAE,YAAY,OAAO,QAAQ,kBAAkB;AAAA,IACtD,MAAM,OAAO;AAAA,IACb,SAAS,mBAAmB,SAAS,YAAY,OAAO,OAAO,oCAAoC,iBAAiB,QAAQ,OAAO,OAAO;AAAA,EAC5I;AAEA,QAAM,cAA2B;AAAA,IAC/B,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,SAAS,QAAQ;AAAA,MACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,OAAO,IAAI,SAAS;AAAA,MACpB,mBAAmB,OAAO;AAAA,IAC5B;AAAA,IACA,aAAa,OAAO,eAAe,iBAAiB,OAAO,MAAM;AAAA,IACjE,UAAU,OAAO;AAAA,IACjB,oBAAoB,OAAO,EAAE,aAAa,oBAAoB,MAAM,WAAW;AAAA,EACjF;AAEA,QAAM,cACJ,QAAQ,eACR,IAAI,sBAAsB;AAAA,IACxB,KAAK,IAAI;AAAA,IACT,GAAI,IAAI,sBACJ;AAAA,MACE,mBAAmB,aAAa;AAAA,QAC9B,QAAQ,EAAE,eAAe,UAAU,IAAI,mBAAmB,GAAG;AAAA,QAC7D,QAAQ,EAAE,eAAe,UAAU,IAAI,mBAAmB,GAAG;AAAA,QAC7D,WAAW,EAAE,eAAe,UAAU,IAAI,mBAAmB,GAAG;AAAA,MAClE;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AAEH,QAAM,SAAS,IAAI,mBAAmB,WAAW,EAAE,SAAS,QAAQ,OAAO,IAAI,eAAe,CAAC;AAE/F,QAAM,SAAS,IAAI,eAAe;AAGlC,WAAS,WAAW,uBAAiE;AACnF,QAAI,CAAC,sBAAuB,QAAO;AACnC,QAAI;AACF,YAAM,UAAU,4BAA4B,qBAAqB;AACjE,YAAM,cAAe,QAAqC;AAC1D,aAAO,cAAc,GAAG,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI,WAAW,KAAK;AAAA,IAC5E,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAEA,OAAuB;AACrB,UAAI;AACJ,aAAO,OAAO,GAAG,SAAS;AACxB,YAAI,OAAQ,QAAO,EAAE,KAAK,iBAAiB,GAAG;AAE9C,YAAI,CAAC,QAAQ;AACX,gBAAM,MAAM,MAAM,eAAkC,YAAY;AAChE,mBAAS,IAAI,kBAAkB,aAAa,MAAM;AAAA,QACpD;AACA,cAAM,aAAa;AAInB,cAAM,SAAS,MAAM,WAAW,GAAG,IAAI;AAIvC,cAAM,UAAU,kBAAkB,WAAW,SAAS,EAAE;AACxD,cAAM,MAAM,WAAW,UAAU,qBAAqB,QAAQ,OAAO,IAAI,IAAI;AAC7E,YAAI,IAAK,SAAQ,QAAQ,IAAI,oBAAoB,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,UAA6B;AAC3B,UAAI;AACJ,aAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,cAAM,WAAW;AACjB,YAAI,QAAQ;AACV,mBAAS,OAAO,GAAG,EAAE,KAAK,eAAe;AACzC;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,gBAAM,MAAM,MAAM,eAAqC,eAAe;AACtE,mBAAS,IAAI,kBAAkB,aAAa,MAAM;AAAA,QACpD;AAIA,cAAM,oBAAoB,SAAS,UAAU,KAAK,QAAQ;AAC1D,iBAAS,YAAY,CAAC,MAAM,UAAU;AACpC,gBAAM,MAAM,kBAAkB,MAAM,KAAK;AACzC,cAAI,mBAAmB,SAAS,OAAO,IAAI,EAAE,YAAY,CAAU,GAAG;AACpE,kBAAM,MAAM,WAAW,OAAO,KAAK,CAAC;AACpC,gBAAI,IAAK,mBAAkB,oBAAoB,GAAG;AAAA,UACpD;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,aAAa;AAKnB,cAAM,WAAW,KAAK,KAAK,IAAI;AAAA,MACjC;AAAA,IACF;AAAA,IAEA,KAAQ,SAAyC;AAC/C,UAAI;AACJ,aAAO,OAAO,YAA+B;AAC3C,YAAI,QAAQ;AACV,iBAAO,SAAS,KAAK,iBAAiB,EAAE,QAAQ,IAAI,CAAC;AAAA,QACvD;AAEA,YAAI,CAAC,QAAQ;AACX,gBAAM,MAAM,MAAM,eAAkC,YAAY;AAChE,mBAAS,IAAI,SAAS,SAAkB,aAAa,MAAM;AAAA,QAC7D;AACA,cAAM,UAAU;AAChB,cAAM,SAAS,MAAM,QAAQ,OAAO;AAEpC,YAAI,kBAAkB,UAAU;AAC9B,gBAAM,MAAM,WAAW,qBAAqB,OAAO,OAAO,CAAC;AAC3D,cAAI,IAAK,QAAO,QAAQ,IAAI,oBAAoB,GAAG;AAAA,QACrD;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,eAAkB,WAA+B;AAC9D,MAAI;AACF,WAAQ,MAAM;AAAA;AAAA,MAA0B;AAAA;AAAA,EAC1C,QAAQ;AACN,UAAM,IAAI,oBAAoB,SAAS;AAAA,EACzC;AACF;","names":["z","z"]}

package/dist/{chunk-HCN75CTX.js → chunk-ZGVPNFNS.js}

@@ -1,11 +1,14 @@
 import {
   NETWORKS,
   SpendGuardError,
-  quoteToUsd
-} from "./chunk-6LSPHKJ7.js";
+  UnreadableQuoteError,
+  quoteToUsd,
+  readSettlementHeader
+} from "./chunk-C4BASAUA.js";
 
 // src/client.ts
 import { x402Client } from "@x402/core/client";
+import { decodePaymentRequiredHeader } from "@x402/core/http";
 import { ExactEvmScheme } from "@x402/evm/exact/client";
 import { wrapFetchWithPayment } from "@x402/fetch";
 
@@ -72,6 +75,19 @@ async function evaluateGuards(quoteUsd, guards, store, now) {
     }
   }
 }
+async function readQuotedRequirements(response) {
+  const header = response.headers.get("payment-required");
+  if (header) {
+    try {
+      const decoded = decodePaymentRequiredHeader(header);
+      if (Array.isArray(decoded.accepts) && decoded.accepts.length > 0) return decoded.accepts;
+    } catch {
+    }
+  }
+  const body = await response.clone().json().catch(() => null);
+  const accepts = body?.accepts;
+  return Array.isArray(accepts) ? accepts : [];
+}
 function quoteUsdOf(requirements) {
   const asRecord = requirements;
   const amountAtomic = asRecord.maxAmountRequired ?? asRecord.amount;
@@ -117,19 +133,21 @@ async function payFetch(url, init, options) {
   const guarded = async (input, requestInit) => {
     const response2 = await baseFetch(input, requestInit);
     if (response2.status !== 402) return response2;
-    const body = await response2.clone().json().catch(() => null);
-    const accepts = body?.accepts;
-    if (Array.isArray(accepts) && accepts.length > 0) {
-      const cheapest = accepts.map((requirement) => quoteUsdOf(requirement)).sort((a, b) => a - b)[0];
-      if (cheapest !== void 0) {
-        await evaluateGuards(cheapest, guards, store, now());
-      }
+    const accepts = await readQuotedRequirements(response2);
+    if (accepts.length === 0) {
+      throw new UnreadableQuoteError(
+        "Received a 402 with no readable payment requirements (no payment-required header, no accepts body). Refusing to pay blind."
+      );
+    }
+    const cheapest = accepts.map((requirement) => quoteUsdOf(requirement)).sort((a, b) => a - b)[0];
+    if (cheapest !== void 0) {
+      await evaluateGuards(cheapest, guards, store, now());
     }
     return response2;
   };
   const paying = wrapFetchWithPayment(guarded, client);
   const response = await paying(url, init);
-  if (response.headers.get("x-payment-response") && quotedUsd !== null) {
+  if (readSettlementHeader(response.headers) && quotedUsd !== null) {
     await store.record({ at: now(), usd: quotedUsd });
   }
   return response;
@@ -138,7 +156,8 @@ async function payFetch(url, init, options) {
 export {
   createMemorySpendStore,
   evaluateGuards,
+  readQuotedRequirements,
   quoteUsdOf,
   payFetch
 };
-//# sourceMappingURL=chunk-HCN75CTX.js.map
+//# sourceMappingURL=chunk-ZGVPNFNS.js.map

package/dist/chunk-ZGVPNFNS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts","../src/store.ts"],"sourcesContent":["import { x402Client } from '@x402/core/client';\nimport { decodePaymentRequiredHeader } from '@x402/core/http';\nimport type { PaymentRequirements } from '@x402/core/types';\nimport { ExactEvmScheme } from '@x402/evm/exact/client';\nimport { wrapFetchWithPayment } from '@x402/fetch';\n\nimport { NETWORKS, PAYMENT_REF_HEADER, readSettlementHeader } from './constants.js';\nimport type { NetworkName } from './constants.js';\nimport { SpendGuardError, UnreadableQuoteError } from './errors.js';\nimport { quoteToUsd } from './money.js';\nimport { createMemorySpendStore } from './store.js';\nimport type { SpendStore } from './store.js';\n\n/** The signer the official EVM scheme expects: address + signTypedData, no key handling. */\nexport type EvmWallet = ConstructorParameters<typeof ExactEvmScheme>[0];\n\nexport interface SpendGuards {\n  /** Hard USD ceiling for a single call. */\n  maxPerCall?: number;\n  /** Rolling 60-minute USD ceiling. */\n  maxPerHour?: number;\n  /** Rolling 24-hour USD ceiling. */\n  maxPerDay?: number;\n  /** Hostnames this agent may pay. Checked before any network call. */\n  allowedHosts?: string[];\n}\n\nexport interface PayFetchOptions {\n  wallet: EvmWallet;\n  guards?: SpendGuards;\n  /** Defaults to a process-local in-memory store. */\n  store?: SpendStore;\n  networks?: NetworkName[];\n  fetch?: typeof globalThis.fetch;\n  now?: () => number;\n}\n\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\nfunction hostOf(input: RequestInfo | URL): string | null {\n  try {\n    const raw =\n      typeof input === 'string'\n        ? input\n        : input instanceof URL\n          ? input.toString()\n          : (input as Request).url;\n    return new URL(raw).hostname.toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\n/** `example.com` in allowedHosts also authorises `tool.example.com`. */\nfunction hostAllowed(host: string, allowed: readonly string[]): boolean {\n  return allowed.some((entry) => {\n    const candidate = entry.trim().toLowerCase().replace(/^\\*\\./, '');\n    return host === candidate || host.endsWith(`.${candidate}`);\n  });\n}\n\n/**\n * Checks every guard against a quote. Returns the USD value if the call may proceed,\n * throws SpendGuardError otherwise. Called before a payment payload exists.\n */\nexport async function evaluateGuards(\n  quoteUsd: number,\n  guards: SpendGuards,\n  store: SpendStore,\n  now: number,\n): Promise<void> {\n  if (guards.maxPerCall !== undefined && quoteUsd > guards.maxPerCall) {\n    throw new SpendGuardError(\n      'maxPerCall',\n      `Call costs $${quoteUsd} which exceeds the maxPerCall limit of $${guards.maxPerCall}`,\n      { limitUsd: guards.maxPerCall, attemptedUsd: quoteUsd },\n    );\n  }\n\n  if (guards.maxPerHour !== undefined) {\n    const spent = await store.totalSince(now - HOUR_MS);\n    if (spent + quoteUsd > guards.maxPerHour) {\n      throw new SpendGuardError(\n        'maxPerHour',\n        `Call costs $${quoteUsd} and $${spent} was already spent this hour, exceeding the maxPerHour limit of $${guards.maxPerHour}`,\n        { limitUsd: guards.maxPerHour, attemptedUsd: spent + quoteUsd },\n      );\n    }\n  }\n\n  if (guards.maxPerDay !== undefined) {\n    const spent = await store.totalSince(now - DAY_MS);\n    if (spent + quoteUsd > guards.maxPerDay) {\n      throw new SpendGuardError(\n        'maxPerDay',\n        `Call costs $${quoteUsd} and $${spent} was already spent today, exceeding the maxPerDay limit of $${guards.maxPerDay}`,\n        { limitUsd: guards.maxPerDay, attemptedUsd: spent + quoteUsd },\n      );\n    }\n  }\n}\n\n/**\n * Reads the offered requirements from a 402.\n *\n * x402 v2 carries them in the base64 `payment-required` header, not the body — the body\n * is the resource's own, and may be anything. v1 put them in the body, so both are read.\n */\nexport async function readQuotedRequirements(response: Response): Promise<PaymentRequirements[]> {\n  const header = response.headers.get('payment-required');\n  if (header) {\n    try {\n      const decoded = decodePaymentRequiredHeader(header);\n      if (Array.isArray(decoded.accepts) && decoded.accepts.length > 0) return decoded.accepts;\n    } catch {\n      // Fall through to the body form.\n    }\n  }\n\n  const body: unknown = await response\n    .clone()\n    .json()\n    .catch(() => null);\n  const accepts = (body as { accepts?: PaymentRequirements[] } | null)?.accepts;\n  return Array.isArray(accepts) ? accepts : [];\n}\n\n/** Reads the quoted amount out of x402 payment requirements. */\ninterface PriceableRequirement {\n  maxAmountRequired?: string;\n  amount?: string;\n  asset?: string;\n  extra?: { decimals?: number };\n}\n\nexport function quoteUsdOf(requirements: PaymentRequirements): number {\n  const asRecord: PriceableRequirement = requirements;\n  const amountAtomic = asRecord.maxAmountRequired ?? asRecord.amount;\n  if (!amountAtomic || !asRecord.asset) {\n    throw new RangeError('Payment requirements carry no priceable amount; refusing to pay.');\n  }\n  return quoteToUsd({\n    amountAtomic,\n    asset: asRecord.asset,\n    decimals: asRecord.extra?.decimals,\n  });\n}\n\n/**\n * A `fetch` that pays for 402 responses, under spend guards.\n *\n * The 402 handling, signing and retry are the official x402 packages' work. What this adds\n * is refusal: guards are evaluated inside the payment-policy hook, which runs after the\n * quote is known and before any payload is signed, so exceeding a guard throws\n * SpendGuardError with nothing signed and nothing spent.\n */\nexport async function payFetch(\n  url: RequestInfo | URL,\n  init: RequestInit | undefined,\n  options: PayFetchOptions,\n): Promise<Response> {\n  const guards = options.guards ?? {};\n  const store = options.store ?? createMemorySpendStore();\n  const now = options.now ?? Date.now;\n  const baseFetch = options.fetch ?? globalThis.fetch;\n  const networks = options.networks ?? (['base'] as NetworkName[]);\n\n  // Host allowlist is checked first: an unauthorised host should cost no request at all.\n  if (guards.allowedHosts) {\n    const host = hostOf(url);\n    if (!host || !hostAllowed(host, guards.allowedHosts)) {\n      throw new SpendGuardError(\n        'allowedHosts',\n        `Host ${host ?? '<unparseable>'} is not in allowedHosts`,\n        { host: host ?? undefined },\n      );\n    }\n  }\n\n  let quotedUsd: number | null = null;\n\n  const client = new x402Client((_version, requirements) => {\n    // Runs before the payment payload is created. Throwing here means no signature.\n    const affordable = requirements.filter((requirement) => {\n      const usd = quoteUsdOf(requirement);\n      return guards.maxPerCall === undefined || usd <= guards.maxPerCall;\n    });\n\n    const chosen = (affordable.length > 0 ? affordable : requirements)[0];\n    if (!chosen) throw new RangeError('Resource offered no payment requirements');\n\n    quotedUsd = quoteUsdOf(chosen);\n    return chosen;\n  });\n\n  for (const name of networks) {\n    client.register(NETWORKS[name].caip2, new ExactEvmScheme(options.wallet));\n  }\n\n  const guarded: typeof globalThis.fetch = async (input, requestInit) => {\n    const response = await baseFetch(input, requestInit);\n    if (response.status !== 402) return response;\n\n    // Peek at the quote and apply guards before the wrapper signs anything.\n    const accepts = await readQuotedRequirements(response);\n    if (accepts.length === 0) {\n      // A 402 whose requirements we cannot read is a 402 we cannot price, and an\n      // unpriced call cannot be checked against a spend cap. Refuse rather than let it\n      // through unguarded.\n      throw new UnreadableQuoteError(\n        'Received a 402 with no readable payment requirements (no payment-required header, no accepts body). Refusing to pay blind.',\n      );\n    }\n\n    const cheapest = accepts.map((requirement) => quoteUsdOf(requirement)).sort((a, b) => a - b)[0];\n    if (cheapest !== undefined) {\n      await evaluateGuards(cheapest, guards, store, now());\n    }\n    return response;\n  };\n\n  const paying = wrapFetchWithPayment(guarded, client);\n  const response = await paying(url as RequestInfo, init);\n\n  // Record the spend only once a payment actually settled.\n  if (readSettlementHeader(response.headers) && quotedUsd !== null) {\n    await store.record({ at: now(), usd: quotedUsd });\n  }\n\n  return response;\n}\n\nexport { PAYMENT_REF_HEADER };\n","/** One recorded spend, in USD, at a wall-clock millisecond. */\nexport interface SpendRecord {\n  at: number;\n  usd: number;\n}\n\n/**\n * Where rolling spend totals live. The default is in-memory and per-process; swap in a\n * shared implementation (Redis, Durable Object, Postgres) when an agent runs as more\n * than one process, otherwise each process enforces its own separate budget.\n */\nexport interface SpendStore {\n  record(entry: SpendRecord): Promise<void> | void;\n  /** Total USD recorded at or after `sinceMs`. */\n  totalSince(sinceMs: number): Promise<number> | number;\n}\n\n/** Process-local store. Entries older than the longest window are dropped on write. */\nexport function createMemorySpendStore(retentionMs = 24 * 60 * 60 * 1000): SpendStore {\n  let entries: SpendRecord[] = [];\n\n  return {\n    record(entry) {\n      entries.push(entry);\n      const cutoff = entry.at - retentionMs;\n      if (entries.length > 64) entries = entries.filter((e) => e.at >= cutoff);\n    },\n    totalSince(sinceMs) {\n      let total = 0;\n      for (const entry of entries) if (entry.at >= sinceMs) total += entry.usd;\n      return total;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,mCAAmC;AAE5C,SAAS,sBAAsB;AAC/B,SAAS,4BAA4B;;;ACc9B,SAAS,uBAAuB,cAAc,KAAK,KAAK,KAAK,KAAkB;AACpF,MAAI,UAAyB,CAAC;AAE9B,SAAO;AAAA,IACL,OAAO,OAAO;AACZ,cAAQ,KAAK,KAAK;AAClB,YAAM,SAAS,MAAM,KAAK;AAC1B,UAAI,QAAQ,SAAS,GAAI,WAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,MAAM,MAAM;AAAA,IACzE;AAAA,IACA,WAAW,SAAS;AAClB,UAAI,QAAQ;AACZ,iBAAW,SAAS,QAAS,KAAI,MAAM,MAAM,QAAS,UAAS,MAAM;AACrE,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ADIA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAEpB,SAAS,OAAO,OAAyC;AACvD,MAAI;AACF,UAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,MAAkB;AAC3B,WAAO,IAAI,IAAI,GAAG,EAAE,SAAS,YAAY;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,YAAY,MAAc,SAAqC;AACtE,SAAO,QAAQ,KAAK,CAAC,UAAU;AAC7B,UAAM,YAAY,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,EAAE;AAChE,WAAO,SAAS,aAAa,KAAK,SAAS,IAAI,SAAS,EAAE;AAAA,EAC5D,CAAC;AACH;AAMA,eAAsB,eACpB,UACA,QACA,OACA,KACe;AACf,MAAI,OAAO,eAAe,UAAa,WAAW,OAAO,YAAY;AACnE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,eAAe,QAAQ,2CAA2C,OAAO,UAAU;AAAA,MACnF,EAAE,UAAU,OAAO,YAAY,cAAc,SAAS;AAAA,IACxD;AAAA,EACF;AAEA,MAAI,OAAO,eAAe,QAAW;AACnC,UAAM,QAAQ,MAAM,MAAM,WAAW,MAAM,OAAO;AAClD,QAAI,QAAQ,WAAW,OAAO,YAAY;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,eAAe,QAAQ,SAAS,KAAK,oEAAoE,OAAO,UAAU;AAAA,QAC1H,EAAE,UAAU,OAAO,YAAY,cAAc,QAAQ,SAAS;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,OAAO,cAAc,QAAW;AAClC,UAAM,QAAQ,MAAM,MAAM,WAAW,MAAM,MAAM;AACjD,QAAI,QAAQ,WAAW,OAAO,WAAW;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,eAAe,QAAQ,SAAS,KAAK,+DAA+D,OAAO,SAAS;AAAA,QACpH,EAAE,UAAU,OAAO,WAAW,cAAc,QAAQ,SAAS;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;AAQA,eAAsB,uBAAuB,UAAoD;AAC/F,QAAM,SAAS,SAAS,QAAQ,IAAI,kBAAkB;AACtD,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,UAAU,4BAA4B,MAAM;AAClD,UAAI,MAAM,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,SAAS,EAAG,QAAO,QAAQ;AAAA,IACnF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,OAAgB,MAAM,SACzB,MAAM,EACN,KAAK,EACL,MAAM,MAAM,IAAI;AACnB,QAAM,UAAW,MAAqD;AACtE,SAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC;AAC7C;AAUO,SAAS,WAAW,cAA2C;AACpE,QAAM,WAAiC;AACvC,QAAM,eAAe,SAAS,qBAAqB,SAAS;AAC5D,MAAI,CAAC,gBAAgB,CAAC,SAAS,OAAO;AACpC,UAAM,IAAI,WAAW,kEAAkE;AAAA,EACzF;AACA,SAAO,WAAW;AAAA,IAChB;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,UAAU,SAAS,OAAO;AAAA,EAC5B,CAAC;AACH;AAUA,eAAsB,SACpB,KACA,MACA,SACmB;AACnB,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,QAAM,QAAQ,QAAQ,SAAS,uBAAuB;AACtD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,QAAM,WAAW,QAAQ,YAAa,CAAC,MAAM;AAG7C,MAAI,OAAO,cAAc;AACvB,UAAM,OAAO,OAAO,GAAG;AACvB,QAAI,CAAC,QAAQ,CAAC,YAAY,MAAM,OAAO,YAAY,GAAG;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,QAAQ,eAAe;AAAA,QAC/B,EAAE,MAAM,QAAQ,OAAU;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAA2B;AAE/B,QAAM,SAAS,IAAI,WAAW,CAAC,UAAU,iBAAiB;AAExD,UAAM,aAAa,aAAa,OAAO,CAAC,gBAAgB;AACtD,YAAM,MAAM,WAAW,WAAW;AAClC,aAAO,OAAO,eAAe,UAAa,OAAO,OAAO;AAAA,IAC1D,CAAC;AAED,UAAM,UAAU,WAAW,SAAS,IAAI,aAAa,cAAc,CAAC;AACpE,QAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,0CAA0C;AAE5E,gBAAY,WAAW,MAAM;AAC7B,WAAO;AAAA,EACT,CAAC;AAED,aAAW,QAAQ,UAAU;AAC3B,WAAO,SAAS,SAAS,IAAI,EAAE,OAAO,IAAI,eAAe,QAAQ,MAAM,CAAC;AAAA,EAC1E;AAEA,QAAM,UAAmC,OAAO,OAAO,gBAAgB;AACrE,UAAMA,YAAW,MAAM,UAAU,OAAO,WAAW;AACnD,QAAIA,UAAS,WAAW,IAAK,QAAOA;AAGpC,UAAM,UAAU,MAAM,uBAAuBA,SAAQ;AACrD,QAAI,QAAQ,WAAW,GAAG;AAIxB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,QAAQ,IAAI,CAAC,gBAAgB,WAAW,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;AAC9F,QAAI,aAAa,QAAW;AAC1B,YAAM,eAAe,UAAU,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,SAAS,qBAAqB,SAAS,MAAM;AACnD,QAAM,WAAW,MAAM,OAAO,KAAoB,IAAI;AAGtD,MAAI,qBAAqB,SAAS,OAAO,KAAK,cAAc,MAAM;AAChE,UAAM,MAAM,OAAO,EAAE,IAAI,IAAI,GAAG,KAAK,UAAU,CAAC;AAAA,EAClD;AAEA,SAAO;AACT;","names":["response"]}

package/dist/{client-C8_arVa4.d.cts → client-BBsrY6gC.d.cts}

@@ -2,6 +2,14 @@ import { PaymentRequirements } from '@x402/core/types';
 import { ExactEvmScheme } from '@x402/evm/exact/client';
 
 /** Base networks in CAIP-2 form, which is what x402 v2 speaks. */
+/**
+ * The EIP-712 domain a payer signs the EIP-3009 authorisation against is **not** listed
+ * here on purpose: it differs per network (mainnet USDC is "USD Coin", the Sepolia
+ * deployment is "USDC"), and the EVM scheme owns the authoritative table. Quoting a
+ * dollar price lets it resolve the asset and publish that domain in the 402; naming an
+ * explicit asset bypasses the lookup and emits `extra: {}`, which no payer can sign
+ * against.
+ */
 declare const NETWORKS: {
     readonly base: {
         readonly caip2: "eip155:8453";
@@ -26,6 +34,16 @@ declare const NO_REFUNDS_NOTICE = "Payments are final. Once settled on-chain the
 declare const DOCS_URL = "https://fatstack.net/docs/payments";
 /** Correlates a settled payment with the indexer's view of the on-chain transfer. */
 declare const PAYMENT_REF_HEADER = "X-Fatstack-Payment-Ref";
+/**
+ * x402 v2 dropped the `X-` prefix: the settlement receipt is `PAYMENT-RESPONSE` and the
+ * payer's payload is `PAYMENT-SIGNATURE`. The v1 spellings are still read so a v1 payer
+ * or resource keeps working. Header names are case-insensitive; these are lowercase
+ * because `Headers.get` normalises.
+ */
+declare const SETTLEMENT_HEADERS: readonly ["payment-response", "x-payment-response"];
+declare const PAYMENT_SIGNATURE_HEADERS: readonly ["payment-signature", "x-payment"];
+/** First settlement receipt present on a response, in either spelling. */
+declare function readSettlementHeader(headers: Headers): string | null;
 declare const DEFAULT_FACILITATOR_URL = "https://x402.org/facilitator";
 
 /** One recorded spend, in USD, at a wall-clock millisecond. */
@@ -72,6 +90,13 @@ interface PayFetchOptions {
  * throws SpendGuardError otherwise. Called before a payment payload exists.
  */
 declare function evaluateGuards(quoteUsd: number, guards: SpendGuards, store: SpendStore, now: number): Promise<void>;
+/**
+ * Reads the offered requirements from a 402.
+ *
+ * x402 v2 carries them in the base64 `payment-required` header, not the body — the body
+ * is the resource's own, and may be anything. v1 put them in the body, so both are read.
+ */
+declare function readQuotedRequirements(response: Response): Promise<PaymentRequirements[]>;
 declare function quoteUsdOf(requirements: PaymentRequirements): number;
 /**
  * A `fetch` that pays for 402 responses, under spend guards.
@@ -83,4 +108,4 @@ declare function quoteUsdOf(requirements: PaymentRequirements): number;
  */
 declare function payFetch(url: RequestInfo | URL, init: RequestInit | undefined, options: PayFetchOptions): Promise<Response>;
 
-export { DEFAULT_FACILITATOR_URL as D, type EvmWallet as E, NETWORKS as N, PAYMENT_REF_HEADER as P, type SpendGuards as S, USDC_DECIMALS as U, DOCS_URL as a, NO_REFUNDS_NOTICE as b, type NetworkName as c, type PayFetchOptions as d, type SpendRecord as e, type SpendStore as f, createMemorySpendStore as g, evaluateGuards as h, payFetch as p, quoteUsdOf as q };
+export { DEFAULT_FACILITATOR_URL as D, type EvmWallet as E, NETWORKS as N, PAYMENT_REF_HEADER as P, SETTLEMENT_HEADERS as S, USDC_DECIMALS as U, DOCS_URL as a, NO_REFUNDS_NOTICE as b, type NetworkName as c, PAYMENT_SIGNATURE_HEADERS as d, type PayFetchOptions as e, type SpendGuards as f, type SpendRecord as g, type SpendStore as h, createMemorySpendStore as i, evaluateGuards as j, readQuotedRequirements as k, payFetch as p, quoteUsdOf as q, readSettlementHeader as r };

package/dist/{client-C8_arVa4.d.ts → client-BBsrY6gC.d.ts}

@@ -2,6 +2,14 @@ import { PaymentRequirements } from '@x402/core/types';
 import { ExactEvmScheme } from '@x402/evm/exact/client';
 
 /** Base networks in CAIP-2 form, which is what x402 v2 speaks. */
+/**
+ * The EIP-712 domain a payer signs the EIP-3009 authorisation against is **not** listed
+ * here on purpose: it differs per network (mainnet USDC is "USD Coin", the Sepolia
+ * deployment is "USDC"), and the EVM scheme owns the authoritative table. Quoting a
+ * dollar price lets it resolve the asset and publish that domain in the 402; naming an
+ * explicit asset bypasses the lookup and emits `extra: {}`, which no payer can sign
+ * against.
+ */
 declare const NETWORKS: {
     readonly base: {
         readonly caip2: "eip155:8453";
@@ -26,6 +34,16 @@ declare const NO_REFUNDS_NOTICE = "Payments are final. Once settled on-chain the
 declare const DOCS_URL = "https://fatstack.net/docs/payments";
 /** Correlates a settled payment with the indexer's view of the on-chain transfer. */
 declare const PAYMENT_REF_HEADER = "X-Fatstack-Payment-Ref";
+/**
+ * x402 v2 dropped the `X-` prefix: the settlement receipt is `PAYMENT-RESPONSE` and the
+ * payer's payload is `PAYMENT-SIGNATURE`. The v1 spellings are still read so a v1 payer
+ * or resource keeps working. Header names are case-insensitive; these are lowercase
+ * because `Headers.get` normalises.
+ */
+declare const SETTLEMENT_HEADERS: readonly ["payment-response", "x-payment-response"];
+declare const PAYMENT_SIGNATURE_HEADERS: readonly ["payment-signature", "x-payment"];
+/** First settlement receipt present on a response, in either spelling. */
+declare function readSettlementHeader(headers: Headers): string | null;
 declare const DEFAULT_FACILITATOR_URL = "https://x402.org/facilitator";
 
 /** One recorded spend, in USD, at a wall-clock millisecond. */
@@ -72,6 +90,13 @@ interface PayFetchOptions {
  * throws SpendGuardError otherwise. Called before a payment payload exists.
  */
 declare function evaluateGuards(quoteUsd: number, guards: SpendGuards, store: SpendStore, now: number): Promise<void>;
+/**
+ * Reads the offered requirements from a 402.
+ *
+ * x402 v2 carries them in the base64 `payment-required` header, not the body — the body
+ * is the resource's own, and may be anything. v1 put them in the body, so both are read.
+ */
+declare function readQuotedRequirements(response: Response): Promise<PaymentRequirements[]>;
 declare function quoteUsdOf(requirements: PaymentRequirements): number;
 /**
  * A `fetch` that pays for 402 responses, under spend guards.
@@ -83,4 +108,4 @@ declare function quoteUsdOf(requirements: PaymentRequirements): number;
  */
 declare function payFetch(url: RequestInfo | URL, init: RequestInit | undefined, options: PayFetchOptions): Promise<Response>;
 
-export { DEFAULT_FACILITATOR_URL as D, type EvmWallet as E, NETWORKS as N, PAYMENT_REF_HEADER as P, type SpendGuards as S, USDC_DECIMALS as U, DOCS_URL as a, NO_REFUNDS_NOTICE as b, type NetworkName as c, type PayFetchOptions as d, type SpendRecord as e, type SpendStore as f, createMemorySpendStore as g, evaluateGuards as h, payFetch as p, quoteUsdOf as q };
+export { DEFAULT_FACILITATOR_URL as D, type EvmWallet as E, NETWORKS as N, PAYMENT_REF_HEADER as P, SETTLEMENT_HEADERS as S, USDC_DECIMALS as U, DOCS_URL as a, NO_REFUNDS_NOTICE as b, type NetworkName as c, PAYMENT_SIGNATURE_HEADERS as d, type PayFetchOptions as e, type SpendGuards as f, type SpendRecord as g, type SpendStore as h, createMemorySpendStore as i, evaluateGuards as j, readQuotedRequirements as k, payFetch as p, quoteUsdOf as q, readSettlementHeader as r };

package/dist/client.cjs

@@ -23,16 +23,22 @@ __export(client_exports, {
   PAYMENT_REF_HEADER: () => PAYMENT_REF_HEADER,
   evaluateGuards: () => evaluateGuards,
   payFetch: () => payFetch,
-  quoteUsdOf: () => quoteUsdOf
+  quoteUsdOf: () => quoteUsdOf,
+  readQuotedRequirements: () => readQuotedRequirements
 });
 module.exports = __toCommonJS(client_exports);
 var import_client = require("@x402/core/client");
+var import_http = require("@x402/core/http");
 var import_client2 = require("@x402/evm/exact/client");
 var import_fetch = require("@x402/fetch");
 
 // src/constants.ts
 var NETWORKS = {
-  base: { caip2: "eip155:8453", chainId: 8453, usdc: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" },
+  base: {
+    caip2: "eip155:8453",
+    chainId: 8453,
+    usdc: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
+  },
   "base-sepolia": {
     caip2: "eip155:84532",
     chainId: 84532,
@@ -41,6 +47,14 @@ var NETWORKS = {
 };
 var USDC_DECIMALS = 6;
 var PAYMENT_REF_HEADER = "X-Fatstack-Payment-Ref";
+var SETTLEMENT_HEADERS = ["payment-response", "x-payment-response"];
+function readSettlementHeader(headers) {
+  for (const name of SETTLEMENT_HEADERS) {
+    const value = headers.get(name);
+    if (value) return value;
+  }
+  return null;
+}
 
 // src/errors.ts
 var SpendGuardError = class extends Error {
@@ -53,6 +67,12 @@ var SpendGuardError = class extends Error {
   detail;
   name = "SpendGuardError";
 };
+var UnreadableQuoteError = class extends Error {
+  name = "UnreadableQuoteError";
+  constructor(message) {
+    super(message);
+  }
+};
 
 // src/money.ts
 var UNITS_PER_USDC = 10n ** BigInt(USDC_DECIMALS);
@@ -135,6 +155,19 @@ async function evaluateGuards(quoteUsd, guards, store, now) {
     }
   }
 }
+async function readQuotedRequirements(response) {
+  const header = response.headers.get("payment-required");
+  if (header) {
+    try {
+      const decoded = (0, import_http.decodePaymentRequiredHeader)(header);
+      if (Array.isArray(decoded.accepts) && decoded.accepts.length > 0) return decoded.accepts;
+    } catch {
+    }
+  }
+  const body = await response.clone().json().catch(() => null);
+  const accepts = body?.accepts;
+  return Array.isArray(accepts) ? accepts : [];
+}
 function quoteUsdOf(requirements) {
   const asRecord = requirements;
   const amountAtomic = asRecord.maxAmountRequired ?? asRecord.amount;
@@ -180,19 +213,21 @@ async function payFetch(url, init, options) {
   const guarded = async (input, requestInit) => {
     const response2 = await baseFetch(input, requestInit);
     if (response2.status !== 402) return response2;
-    const body = await response2.clone().json().catch(() => null);
-    const accepts = body?.accepts;
-    if (Array.isArray(accepts) && accepts.length > 0) {
-      const cheapest = accepts.map((requirement) => quoteUsdOf(requirement)).sort((a, b) => a - b)[0];
-      if (cheapest !== void 0) {
-        await evaluateGuards(cheapest, guards, store, now());
-      }
+    const accepts = await readQuotedRequirements(response2);
+    if (accepts.length === 0) {
+      throw new UnreadableQuoteError(
+        "Received a 402 with no readable payment requirements (no payment-required header, no accepts body). Refusing to pay blind."
+      );
+    }
+    const cheapest = accepts.map((requirement) => quoteUsdOf(requirement)).sort((a, b) => a - b)[0];
+    if (cheapest !== void 0) {
+      await evaluateGuards(cheapest, guards, store, now());
     }
     return response2;
   };
   const paying = (0, import_fetch.wrapFetchWithPayment)(guarded, client);
   const response = await paying(url, init);
-  if (response.headers.get("x-payment-response") && quotedUsd !== null) {
+  if (readSettlementHeader(response.headers) && quotedUsd !== null) {
     await store.record({ at: now(), usd: quotedUsd });
   }
   return response;
@@ -202,6 +237,7 @@ async function payFetch(url, init, options) {
   PAYMENT_REF_HEADER,
   evaluateGuards,
   payFetch,
-  quoteUsdOf
+  quoteUsdOf,
+  readQuotedRequirements
 });
 //# sourceMappingURL=client.cjs.map

package/dist/client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/constants.ts","../src/errors.ts","../src/money.ts","../src/store.ts"],"sourcesContent":["import { x402Client } from '@x402/core/client';\nimport type { PaymentRequirements } from '@x402/core/types';\nimport { ExactEvmScheme } from '@x402/evm/exact/client';\nimport { wrapFetchWithPayment } from '@x402/fetch';\n\nimport { NETWORKS, PAYMENT_REF_HEADER } from './constants.js';\nimport type { NetworkName } from './constants.js';\nimport { SpendGuardError } from './errors.js';\nimport { quoteToUsd } from './money.js';\nimport { createMemorySpendStore } from './store.js';\nimport type { SpendStore } from './store.js';\n\n/** The signer the official EVM scheme expects: address + signTypedData, no key handling. */\nexport type EvmWallet = ConstructorParameters<typeof ExactEvmScheme>[0];\n\nexport interface SpendGuards {\n  /** Hard USD ceiling for a single call. */\n  maxPerCall?: number;\n  /** Rolling 60-minute USD ceiling. */\n  maxPerHour?: number;\n  /** Rolling 24-hour USD ceiling. */\n  maxPerDay?: number;\n  /** Hostnames this agent may pay. Checked before any network call. */\n  allowedHosts?: string[];\n}\n\nexport interface PayFetchOptions {\n  wallet: EvmWallet;\n  guards?: SpendGuards;\n  /** Defaults to a process-local in-memory store. */\n  store?: SpendStore;\n  networks?: NetworkName[];\n  fetch?: typeof globalThis.fetch;\n  now?: () => number;\n}\n\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\nfunction hostOf(input: RequestInfo | URL): string | null {\n  try {\n    const raw =\n      typeof input === 'string'\n        ? input\n        : input instanceof URL\n          ? input.toString()\n          : (input as Request).url;\n    return new URL(raw).hostname.toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\n/** `example.com` in allowedHosts also authorises `tool.example.com`. */\nfunction hostAllowed(host: string, allowed: readonly string[]): boolean {\n  return allowed.some((entry) => {\n    const candidate = entry.trim().toLowerCase().replace(/^\\*\\./, '');\n    return host === candidate || host.endsWith(`.${candidate}`);\n  });\n}\n\n/**\n * Checks every guard against a quote. Returns the USD value if the call may proceed,\n * throws SpendGuardError otherwise. Called before a payment payload exists.\n */\nexport async function evaluateGuards(\n  quoteUsd: number,\n  guards: SpendGuards,\n  store: SpendStore,\n  now: number,\n): Promise<void> {\n  if (guards.maxPerCall !== undefined && quoteUsd > guards.maxPerCall) {\n    throw new SpendGuardError(\n      'maxPerCall',\n      `Call costs $${quoteUsd} which exceeds the maxPerCall limit of $${guards.maxPerCall}`,\n      { limitUsd: guards.maxPerCall, attemptedUsd: quoteUsd },\n    );\n  }\n\n  if (guards.maxPerHour !== undefined) {\n    const spent = await store.totalSince(now - HOUR_MS);\n    if (spent + quoteUsd > guards.maxPerHour) {\n      throw new SpendGuardError(\n        'maxPerHour',\n        `Call costs $${quoteUsd} and $${spent} was already spent this hour, exceeding the maxPerHour limit of $${guards.maxPerHour}`,\n        { limitUsd: guards.maxPerHour, attemptedUsd: spent + quoteUsd },\n      );\n    }\n  }\n\n  if (guards.maxPerDay !== undefined) {\n    const spent = await store.totalSince(now - DAY_MS);\n    if (spent + quoteUsd > guards.maxPerDay) {\n      throw new SpendGuardError(\n        'maxPerDay',\n        `Call costs $${quoteUsd} and $${spent} was already spent today, exceeding the maxPerDay limit of $${guards.maxPerDay}`,\n        { limitUsd: guards.maxPerDay, attemptedUsd: spent + quoteUsd },\n      );\n    }\n  }\n}\n\n/** Reads the quoted amount out of x402 payment requirements. */\ninterface PriceableRequirement {\n  maxAmountRequired?: string;\n  amount?: string;\n  asset?: string;\n  extra?: { decimals?: number };\n}\n\nexport function quoteUsdOf(requirements: PaymentRequirements): number {\n  const asRecord: PriceableRequirement = requirements;\n  const amountAtomic = asRecord.maxAmountRequired ?? asRecord.amount;\n  if (!amountAtomic || !asRecord.asset) {\n    throw new RangeError('Payment requirements carry no priceable amount; refusing to pay.');\n  }\n  return quoteToUsd({\n    amountAtomic,\n    asset: asRecord.asset,\n    decimals: asRecord.extra?.decimals,\n  });\n}\n\n/**\n * A `fetch` that pays for 402 responses, under spend guards.\n *\n * The 402 handling, signing and retry are the official x402 packages' work. What this adds\n * is refusal: guards are evaluated inside the payment-policy hook, which runs after the\n * quote is known and before any payload is signed, so exceeding a guard throws\n * SpendGuardError with nothing signed and nothing spent.\n */\nexport async function payFetch(\n  url: RequestInfo | URL,\n  init: RequestInit | undefined,\n  options: PayFetchOptions,\n): Promise<Response> {\n  const guards = options.guards ?? {};\n  const store = options.store ?? createMemorySpendStore();\n  const now = options.now ?? Date.now;\n  const baseFetch = options.fetch ?? globalThis.fetch;\n  const networks = options.networks ?? (['base'] as NetworkName[]);\n\n  // Host allowlist is checked first: an unauthorised host should cost no request at all.\n  if (guards.allowedHosts) {\n    const host = hostOf(url);\n    if (!host || !hostAllowed(host, guards.allowedHosts)) {\n      throw new SpendGuardError(\n        'allowedHosts',\n        `Host ${host ?? '<unparseable>'} is not in allowedHosts`,\n        { host: host ?? undefined },\n      );\n    }\n  }\n\n  let quotedUsd: number | null = null;\n\n  const client = new x402Client((_version, requirements) => {\n    // Runs before the payment payload is created. Throwing here means no signature.\n    const affordable = requirements.filter((requirement) => {\n      const usd = quoteUsdOf(requirement);\n      return guards.maxPerCall === undefined || usd <= guards.maxPerCall;\n    });\n\n    const chosen = (affordable.length > 0 ? affordable : requirements)[0];\n    if (!chosen) throw new RangeError('Resource offered no payment requirements');\n\n    quotedUsd = quoteUsdOf(chosen);\n    return chosen;\n  });\n\n  for (const name of networks) {\n    client.register(NETWORKS[name].caip2, new ExactEvmScheme(options.wallet));\n  }\n\n  const guarded: typeof globalThis.fetch = async (input, requestInit) => {\n    const response = await baseFetch(input, requestInit);\n    if (response.status !== 402) return response;\n\n    // Peek at the quote and apply guards before the wrapper signs anything.\n    const body = await response\n      .clone()\n      .json()\n      .catch(() => null);\n    const accepts = (body as { accepts?: PaymentRequirements[] } | null)?.accepts;\n    if (Array.isArray(accepts) && accepts.length > 0) {\n      const cheapest = accepts\n        .map((requirement) => quoteUsdOf(requirement))\n        .sort((a, b) => a - b)[0];\n      if (cheapest !== undefined) {\n        await evaluateGuards(cheapest, guards, store, now());\n      }\n    }\n    return response;\n  };\n\n  const paying = wrapFetchWithPayment(guarded, client);\n  const response = await paying(url as RequestInfo, init);\n\n  // Record the spend only once a payment actually settled.\n  if (response.headers.get('x-payment-response') && quotedUsd !== null) {\n    await store.record({ at: now(), usd: quotedUsd });\n  }\n\n  return response;\n}\n\nexport { PAYMENT_REF_HEADER };\n","/** Base networks in CAIP-2 form, which is what x402 v2 speaks. */\nexport const NETWORKS = {\n  base: { caip2: 'eip155:8453', chainId: 8453, usdc: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913' },\n  'base-sepolia': {\n    caip2: 'eip155:84532',\n    chainId: 84532,\n    usdc: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',\n  },\n} as const;\n\nexport type NetworkName = keyof typeof NETWORKS;\n\n/** USDC is 6 decimals on Base. */\nexport const USDC_DECIMALS = 6;\n\n/**\n * Required on every 402 body and every payment-facing doc page. A payment is a direct\n * on-chain transfer between two wallets: once settled nobody, Fatstack included, can\n * reverse it.\n */\nexport const NO_REFUNDS_NOTICE =\n  'Payments are final. Once settled on-chain the transfer cannot be reversed, and there are no refunds.';\n\nexport const DOCS_URL = 'https://fatstack.net/docs/payments';\n\n/** Correlates a settled payment with the indexer's view of the on-chain transfer. */\nexport const PAYMENT_REF_HEADER = 'X-Fatstack-Payment-Ref';\n\nexport const DEFAULT_FACILITATOR_URL = 'https://x402.org/facilitator';\n","/** Names of the spend guards an agent can set. */\nexport type GuardName = 'maxPerCall' | 'maxPerHour' | 'maxPerDay' | 'allowedHosts';\n\n/**\n * Thrown before anything is signed when a call would breach a spend guard.\n *\n * Payments are final, so the only place to stop an unwanted spend is before the\n * signature exists. Every guard raises this, and it is never thrown after a payment\n * payload has been created.\n */\nexport class SpendGuardError extends Error {\n  override readonly name = 'SpendGuardError';\n\n  constructor(\n    readonly guard: GuardName,\n    message: string,\n    readonly detail: { limitUsd?: number; attemptedUsd?: number; host?: string } = {},\n  ) {\n    super(message);\n  }\n}\n\n/** Thrown by seams that are typed and reachable but deliberately not built yet. */\nexport class NotImplementedError extends Error {\n  override readonly name = 'NotImplementedError';\n\n  constructor(feature: string) {\n    super(`${feature} is not implemented in this build.`);\n  }\n}\n\n/** Thrown when an optional framework adapter is used without its package installed. */\nexport class MissingAdapterError extends Error {\n  override readonly name = 'MissingAdapterError';\n\n  constructor(pkg: string) {\n    super(`${pkg} is not installed. Add it to use this adapter: pnpm add ${pkg}`);\n  }\n}\n","import { NETWORKS, USDC_DECIMALS } from './constants.js';\n\nconst UNITS_PER_USDC = 10n ** BigInt(USDC_DECIMALS);\n\n/** \"1.25\" -> 1250000n. Rejects anything that is not a plain non-negative decimal. */\nexport function parseUsdc(input: string): bigint {\n  const match = /^(\\d+)(?:\\.(\\d{1,6}))?$/.exec(input.trim());\n  if (!match) {\n    throw new RangeError(`Not a USDC amount with at most ${USDC_DECIMALS} decimals: ${input}`);\n  }\n  const whole = BigInt(match[1] ?? '0');\n  const fraction = BigInt((match[2] ?? '').padEnd(USDC_DECIMALS, '0') || '0');\n  return whole * UNITS_PER_USDC + fraction;\n}\n\n/** 1250000n -> \"1.25\". Trailing zeros trimmed. */\nexport function formatUsdc(atomic: bigint): string {\n  if (atomic < 0n) throw new RangeError('USDC amounts are never negative');\n  const whole = atomic / UNITS_PER_USDC;\n  const fraction = (atomic % UNITS_PER_USDC).toString().padStart(USDC_DECIMALS, '0');\n  const trimmed = fraction.replace(/0+$/, '');\n  return trimmed ? `${whole}.${trimmed}` : whole.toString();\n}\n\nconst USDC_ADDRESSES = new Set(\n  Object.values(NETWORKS).map((network) => network.usdc.toLowerCase()),\n);\n\n/**\n * Converts a quoted amount to USD for guard evaluation.\n *\n * Fails closed: if the asset is not a USDC contract we recognise and the quote carries no\n * usable `decimals`, this throws rather than guessing. Guessing here would let an\n * unrecognised token slip past a spend cap, and the payment is irreversible.\n */\nexport function quoteToUsd(quote: {\n  amountAtomic: string;\n  asset: string;\n  decimals?: number | undefined;\n}): number {\n  const decimals = USDC_ADDRESSES.has(quote.asset.toLowerCase()) ? USDC_DECIMALS : quote.decimals;\n\n  if (decimals === undefined || !Number.isInteger(decimals) || decimals < 0 || decimals > 36) {\n    throw new RangeError(\n      `Cannot price asset ${quote.asset}: unknown decimals. Refusing to evaluate spend guards against an unpriceable quote.`,\n    );\n  }\n\n  if (!/^\\d+$/.test(quote.amountAtomic)) {\n    throw new RangeError(`Quoted amount is not an integer atomic value: ${quote.amountAtomic}`);\n  }\n\n  return Number(quote.amountAtomic) / 10 ** decimals;\n}\n","/** One recorded spend, in USD, at a wall-clock millisecond. */\nexport interface SpendRecord {\n  at: number;\n  usd: number;\n}\n\n/**\n * Where rolling spend totals live. The default is in-memory and per-process; swap in a\n * shared implementation (Redis, Durable Object, Postgres) when an agent runs as more\n * than one process, otherwise each process enforces its own separate budget.\n */\nexport interface SpendStore {\n  record(entry: SpendRecord): Promise<void> | void;\n  /** Total USD recorded at or after `sinceMs`. */\n  totalSince(sinceMs: number): Promise<number> | number;\n}\n\n/** Process-local store. Entries older than the longest window are dropped on write. */\nexport function createMemorySpendStore(retentionMs = 24 * 60 * 60 * 1000): SpendStore {\n  let entries: SpendRecord[] = [];\n\n  return {\n    record(entry) {\n      entries.push(entry);\n      const cutoff = entry.at - retentionMs;\n      if (entries.length > 64) entries = entries.filter((e) => e.at >= cutoff);\n    },\n    totalSince(sinceMs) {\n      let total = 0;\n      for (const entry of entries) if (entry.at >= sinceMs) total += entry.usd;\n      return total;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA2B;AAE3B,IAAAA,iBAA+B;AAC/B,mBAAqC;;;ACF9B,IAAM,WAAW;AAAA,EACtB,MAAM,EAAE,OAAO,eAAe,SAAS,MAAM,MAAM,6CAA6C;AAAA,EAChG,gBAAgB;AAAA,IACd,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,EACR;AACF;AAKO,IAAM,gBAAgB;AAatB,IAAM,qBAAqB;;;AChB3B,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAGzC,YACW,OACT,SACS,SAAsE,CAAC,GAChF;AACA,UAAM,OAAO;AAJJ;AAEA;AAAA,EAGX;AAAA,EALW;AAAA,EAEA;AAAA,EALO,OAAO;AAS3B;;;AClBA,IAAM,iBAAiB,OAAO,OAAO,aAAa;AAsBlD,IAAM,iBAAiB,IAAI;AAAA,EACzB,OAAO,OAAO,QAAQ,EAAE,IAAI,CAAC,YAAY,QAAQ,KAAK,YAAY,CAAC;AACrE;AASO,SAAS,WAAW,OAIhB;AACT,QAAM,WAAW,eAAe,IAAI,MAAM,MAAM,YAAY,CAAC,IAAI,gBAAgB,MAAM;AAEvF,MAAI,aAAa,UAAa,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,IAAI;AAC1F,UAAM,IAAI;AAAA,MACR,sBAAsB,MAAM,KAAK;AAAA,IACnC;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,KAAK,MAAM,YAAY,GAAG;AACrC,UAAM,IAAI,WAAW,iDAAiD,MAAM,YAAY,EAAE;AAAA,EAC5F;AAEA,SAAO,OAAO,MAAM,YAAY,IAAI,MAAM;AAC5C;;;ACnCO,SAAS,uBAAuB,cAAc,KAAK,KAAK,KAAK,KAAkB;AACpF,MAAI,UAAyB,CAAC;AAE9B,SAAO;AAAA,IACL,OAAO,OAAO;AACZ,cAAQ,KAAK,KAAK;AAClB,YAAM,SAAS,MAAM,KAAK;AAC1B,UAAI,QAAQ,SAAS,GAAI,WAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,MAAM,MAAM;AAAA,IACzE;AAAA,IACA,WAAW,SAAS;AAClB,UAAI,QAAQ;AACZ,iBAAW,SAAS,QAAS,KAAI,MAAM,MAAM,QAAS,UAAS,MAAM;AACrE,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AJGA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAEpB,SAAS,OAAO,OAAyC;AACvD,MAAI;AACF,UAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,MAAkB;AAC3B,WAAO,IAAI,IAAI,GAAG,EAAE,SAAS,YAAY;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,YAAY,MAAc,SAAqC;AACtE,SAAO,QAAQ,KAAK,CAAC,UAAU;AAC7B,UAAM,YAAY,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,EAAE;AAChE,WAAO,SAAS,aAAa,KAAK,SAAS,IAAI,SAAS,EAAE;AAAA,EAC5D,CAAC;AACH;AAMA,eAAsB,eACpB,UACA,QACA,OACA,KACe;AACf,MAAI,OAAO,eAAe,UAAa,WAAW,OAAO,YAAY;AACnE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,eAAe,QAAQ,2CAA2C,OAAO,UAAU;AAAA,MACnF,EAAE,UAAU,OAAO,YAAY,cAAc,SAAS;AAAA,IACxD;AAAA,EACF;AAEA,MAAI,OAAO,eAAe,QAAW;AACnC,UAAM,QAAQ,MAAM,MAAM,WAAW,MAAM,OAAO;AAClD,QAAI,QAAQ,WAAW,OAAO,YAAY;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,eAAe,QAAQ,SAAS,KAAK,oEAAoE,OAAO,UAAU;AAAA,QAC1H,EAAE,UAAU,OAAO,YAAY,cAAc,QAAQ,SAAS;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,OAAO,cAAc,QAAW;AAClC,UAAM,QAAQ,MAAM,MAAM,WAAW,MAAM,MAAM;AACjD,QAAI,QAAQ,WAAW,OAAO,WAAW;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,eAAe,QAAQ,SAAS,KAAK,+DAA+D,OAAO,SAAS;AAAA,QACpH,EAAE,UAAU,OAAO,WAAW,cAAc,QAAQ,SAAS;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,WAAW,cAA2C;AACpE,QAAM,WAAiC;AACvC,QAAM,eAAe,SAAS,qBAAqB,SAAS;AAC5D,MAAI,CAAC,gBAAgB,CAAC,SAAS,OAAO;AACpC,UAAM,IAAI,WAAW,kEAAkE;AAAA,EACzF;AACA,SAAO,WAAW;AAAA,IAChB;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,UAAU,SAAS,OAAO;AAAA,EAC5B,CAAC;AACH;AAUA,eAAsB,SACpB,KACA,MACA,SACmB;AACnB,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,QAAM,QAAQ,QAAQ,SAAS,uBAAuB;AACtD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,QAAM,WAAW,QAAQ,YAAa,CAAC,MAAM;AAG7C,MAAI,OAAO,cAAc;AACvB,UAAM,OAAO,OAAO,GAAG;AACvB,QAAI,CAAC,QAAQ,CAAC,YAAY,MAAM,OAAO,YAAY,GAAG;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,QAAQ,eAAe;AAAA,QAC/B,EAAE,MAAM,QAAQ,OAAU;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAA2B;AAE/B,QAAM,SAAS,IAAI,yBAAW,CAAC,UAAU,iBAAiB;AAExD,UAAM,aAAa,aAAa,OAAO,CAAC,gBAAgB;AACtD,YAAM,MAAM,WAAW,WAAW;AAClC,aAAO,OAAO,eAAe,UAAa,OAAO,OAAO;AAAA,IAC1D,CAAC;AAED,UAAM,UAAU,WAAW,SAAS,IAAI,aAAa,cAAc,CAAC;AACpE,QAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,0CAA0C;AAE5E,gBAAY,WAAW,MAAM;AAC7B,WAAO;AAAA,EACT,CAAC;AAED,aAAW,QAAQ,UAAU;AAC3B,WAAO,SAAS,SAAS,IAAI,EAAE,OAAO,IAAI,8BAAe,QAAQ,MAAM,CAAC;AAAA,EAC1E;AAEA,QAAM,UAAmC,OAAO,OAAO,gBAAgB;AACrE,UAAMC,YAAW,MAAM,UAAU,OAAO,WAAW;AACnD,QAAIA,UAAS,WAAW,IAAK,QAAOA;AAGpC,UAAM,OAAO,MAAMA,UAChB,MAAM,EACN,KAAK,EACL,MAAM,MAAM,IAAI;AACnB,UAAM,UAAW,MAAqD;AACtE,QAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAChD,YAAM,WAAW,QACd,IAAI,CAAC,gBAAgB,WAAW,WAAW,CAAC,EAC5C,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;AAC1B,UAAI,aAAa,QAAW;AAC1B,cAAM,eAAe,UAAU,QAAQ,OAAO,IAAI,CAAC;AAAA,MACrD;AAAA,IACF;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,aAAS,mCAAqB,SAAS,MAAM;AACnD,QAAM,WAAW,MAAM,OAAO,KAAoB,IAAI;AAGtD,MAAI,SAAS,QAAQ,IAAI,oBAAoB,KAAK,cAAc,MAAM;AACpE,UAAM,MAAM,OAAO,EAAE,IAAI,IAAI,GAAG,KAAK,UAAU,CAAC;AAAA,EAClD;AAEA,SAAO;AACT;","names":["import_client","response"]}
+{"version":3,"sources":["../src/client.ts","../src/constants.ts","../src/errors.ts","../src/money.ts","../src/store.ts"],"sourcesContent":["import { x402Client } from '@x402/core/client';\nimport { decodePaymentRequiredHeader } from '@x402/core/http';\nimport type { PaymentRequirements } from '@x402/core/types';\nimport { ExactEvmScheme } from '@x402/evm/exact/client';\nimport { wrapFetchWithPayment } from '@x402/fetch';\n\nimport { NETWORKS, PAYMENT_REF_HEADER, readSettlementHeader } from './constants.js';\nimport type { NetworkName } from './constants.js';\nimport { SpendGuardError, UnreadableQuoteError } from './errors.js';\nimport { quoteToUsd } from './money.js';\nimport { createMemorySpendStore } from './store.js';\nimport type { SpendStore } from './store.js';\n\n/** The signer the official EVM scheme expects: address + signTypedData, no key handling. */\nexport type EvmWallet = ConstructorParameters<typeof ExactEvmScheme>[0];\n\nexport interface SpendGuards {\n  /** Hard USD ceiling for a single call. */\n  maxPerCall?: number;\n  /** Rolling 60-minute USD ceiling. */\n  maxPerHour?: number;\n  /** Rolling 24-hour USD ceiling. */\n  maxPerDay?: number;\n  /** Hostnames this agent may pay. Checked before any network call. */\n  allowedHosts?: string[];\n}\n\nexport interface PayFetchOptions {\n  wallet: EvmWallet;\n  guards?: SpendGuards;\n  /** Defaults to a process-local in-memory store. */\n  store?: SpendStore;\n  networks?: NetworkName[];\n  fetch?: typeof globalThis.fetch;\n  now?: () => number;\n}\n\nconst HOUR_MS = 60 * 60 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\nfunction hostOf(input: RequestInfo | URL): string | null {\n  try {\n    const raw =\n      typeof input === 'string'\n        ? input\n        : input instanceof URL\n          ? input.toString()\n          : (input as Request).url;\n    return new URL(raw).hostname.toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\n/** `example.com` in allowedHosts also authorises `tool.example.com`. */\nfunction hostAllowed(host: string, allowed: readonly string[]): boolean {\n  return allowed.some((entry) => {\n    const candidate = entry.trim().toLowerCase().replace(/^\\*\\./, '');\n    return host === candidate || host.endsWith(`.${candidate}`);\n  });\n}\n\n/**\n * Checks every guard against a quote. Returns the USD value if the call may proceed,\n * throws SpendGuardError otherwise. Called before a payment payload exists.\n */\nexport async function evaluateGuards(\n  quoteUsd: number,\n  guards: SpendGuards,\n  store: SpendStore,\n  now: number,\n): Promise<void> {\n  if (guards.maxPerCall !== undefined && quoteUsd > guards.maxPerCall) {\n    throw new SpendGuardError(\n      'maxPerCall',\n      `Call costs $${quoteUsd} which exceeds the maxPerCall limit of $${guards.maxPerCall}`,\n      { limitUsd: guards.maxPerCall, attemptedUsd: quoteUsd },\n    );\n  }\n\n  if (guards.maxPerHour !== undefined) {\n    const spent = await store.totalSince(now - HOUR_MS);\n    if (spent + quoteUsd > guards.maxPerHour) {\n      throw new SpendGuardError(\n        'maxPerHour',\n        `Call costs $${quoteUsd} and $${spent} was already spent this hour, exceeding the maxPerHour limit of $${guards.maxPerHour}`,\n        { limitUsd: guards.maxPerHour, attemptedUsd: spent + quoteUsd },\n      );\n    }\n  }\n\n  if (guards.maxPerDay !== undefined) {\n    const spent = await store.totalSince(now - DAY_MS);\n    if (spent + quoteUsd > guards.maxPerDay) {\n      throw new SpendGuardError(\n        'maxPerDay',\n        `Call costs $${quoteUsd} and $${spent} was already spent today, exceeding the maxPerDay limit of $${guards.maxPerDay}`,\n        { limitUsd: guards.maxPerDay, attemptedUsd: spent + quoteUsd },\n      );\n    }\n  }\n}\n\n/**\n * Reads the offered requirements from a 402.\n *\n * x402 v2 carries them in the base64 `payment-required` header, not the body — the body\n * is the resource's own, and may be anything. v1 put them in the body, so both are read.\n */\nexport async function readQuotedRequirements(response: Response): Promise<PaymentRequirements[]> {\n  const header = response.headers.get('payment-required');\n  if (header) {\n    try {\n      const decoded = decodePaymentRequiredHeader(header);\n      if (Array.isArray(decoded.accepts) && decoded.accepts.length > 0) return decoded.accepts;\n    } catch {\n      // Fall through to the body form.\n    }\n  }\n\n  const body: unknown = await response\n    .clone()\n    .json()\n    .catch(() => null);\n  const accepts = (body as { accepts?: PaymentRequirements[] } | null)?.accepts;\n  return Array.isArray(accepts) ? accepts : [];\n}\n\n/** Reads the quoted amount out of x402 payment requirements. */\ninterface PriceableRequirement {\n  maxAmountRequired?: string;\n  amount?: string;\n  asset?: string;\n  extra?: { decimals?: number };\n}\n\nexport function quoteUsdOf(requirements: PaymentRequirements): number {\n  const asRecord: PriceableRequirement = requirements;\n  const amountAtomic = asRecord.maxAmountRequired ?? asRecord.amount;\n  if (!amountAtomic || !asRecord.asset) {\n    throw new RangeError('Payment requirements carry no priceable amount; refusing to pay.');\n  }\n  return quoteToUsd({\n    amountAtomic,\n    asset: asRecord.asset,\n    decimals: asRecord.extra?.decimals,\n  });\n}\n\n/**\n * A `fetch` that pays for 402 responses, under spend guards.\n *\n * The 402 handling, signing and retry are the official x402 packages' work. What this adds\n * is refusal: guards are evaluated inside the payment-policy hook, which runs after the\n * quote is known and before any payload is signed, so exceeding a guard throws\n * SpendGuardError with nothing signed and nothing spent.\n */\nexport async function payFetch(\n  url: RequestInfo | URL,\n  init: RequestInit | undefined,\n  options: PayFetchOptions,\n): Promise<Response> {\n  const guards = options.guards ?? {};\n  const store = options.store ?? createMemorySpendStore();\n  const now = options.now ?? Date.now;\n  const baseFetch = options.fetch ?? globalThis.fetch;\n  const networks = options.networks ?? (['base'] as NetworkName[]);\n\n  // Host allowlist is checked first: an unauthorised host should cost no request at all.\n  if (guards.allowedHosts) {\n    const host = hostOf(url);\n    if (!host || !hostAllowed(host, guards.allowedHosts)) {\n      throw new SpendGuardError(\n        'allowedHosts',\n        `Host ${host ?? '<unparseable>'} is not in allowedHosts`,\n        { host: host ?? undefined },\n      );\n    }\n  }\n\n  let quotedUsd: number | null = null;\n\n  const client = new x402Client((_version, requirements) => {\n    // Runs before the payment payload is created. Throwing here means no signature.\n    const affordable = requirements.filter((requirement) => {\n      const usd = quoteUsdOf(requirement);\n      return guards.maxPerCall === undefined || usd <= guards.maxPerCall;\n    });\n\n    const chosen = (affordable.length > 0 ? affordable : requirements)[0];\n    if (!chosen) throw new RangeError('Resource offered no payment requirements');\n\n    quotedUsd = quoteUsdOf(chosen);\n    return chosen;\n  });\n\n  for (const name of networks) {\n    client.register(NETWORKS[name].caip2, new ExactEvmScheme(options.wallet));\n  }\n\n  const guarded: typeof globalThis.fetch = async (input, requestInit) => {\n    const response = await baseFetch(input, requestInit);\n    if (response.status !== 402) return response;\n\n    // Peek at the quote and apply guards before the wrapper signs anything.\n    const accepts = await readQuotedRequirements(response);\n    if (accepts.length === 0) {\n      // A 402 whose requirements we cannot read is a 402 we cannot price, and an\n      // unpriced call cannot be checked against a spend cap. Refuse rather than let it\n      // through unguarded.\n      throw new UnreadableQuoteError(\n        'Received a 402 with no readable payment requirements (no payment-required header, no accepts body). Refusing to pay blind.',\n      );\n    }\n\n    const cheapest = accepts.map((requirement) => quoteUsdOf(requirement)).sort((a, b) => a - b)[0];\n    if (cheapest !== undefined) {\n      await evaluateGuards(cheapest, guards, store, now());\n    }\n    return response;\n  };\n\n  const paying = wrapFetchWithPayment(guarded, client);\n  const response = await paying(url as RequestInfo, init);\n\n  // Record the spend only once a payment actually settled.\n  if (readSettlementHeader(response.headers) && quotedUsd !== null) {\n    await store.record({ at: now(), usd: quotedUsd });\n  }\n\n  return response;\n}\n\nexport { PAYMENT_REF_HEADER };\n","/** Base networks in CAIP-2 form, which is what x402 v2 speaks. */\n/**\n * The EIP-712 domain a payer signs the EIP-3009 authorisation against is **not** listed\n * here on purpose: it differs per network (mainnet USDC is \"USD Coin\", the Sepolia\n * deployment is \"USDC\"), and the EVM scheme owns the authoritative table. Quoting a\n * dollar price lets it resolve the asset and publish that domain in the 402; naming an\n * explicit asset bypasses the lookup and emits `extra: {}`, which no payer can sign\n * against.\n */\nexport const NETWORKS = {\n  base: {\n    caip2: 'eip155:8453',\n    chainId: 8453,\n    usdc: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',\n  },\n  'base-sepolia': {\n    caip2: 'eip155:84532',\n    chainId: 84532,\n    usdc: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',\n  },\n} as const;\n\nexport type NetworkName = keyof typeof NETWORKS;\n\n/** USDC is 6 decimals on Base. */\nexport const USDC_DECIMALS = 6;\n\n/**\n * Required on every 402 body and every payment-facing doc page. A payment is a direct\n * on-chain transfer between two wallets: once settled nobody, Fatstack included, can\n * reverse it.\n */\nexport const NO_REFUNDS_NOTICE =\n  'Payments are final. Once settled on-chain the transfer cannot be reversed, and there are no refunds.';\n\nexport const DOCS_URL = 'https://fatstack.net/docs/payments';\n\n/** Correlates a settled payment with the indexer's view of the on-chain transfer. */\nexport const PAYMENT_REF_HEADER = 'X-Fatstack-Payment-Ref';\n\n/**\n * x402 v2 dropped the `X-` prefix: the settlement receipt is `PAYMENT-RESPONSE` and the\n * payer's payload is `PAYMENT-SIGNATURE`. The v1 spellings are still read so a v1 payer\n * or resource keeps working. Header names are case-insensitive; these are lowercase\n * because `Headers.get` normalises.\n */\nexport const SETTLEMENT_HEADERS = ['payment-response', 'x-payment-response'] as const;\nexport const PAYMENT_SIGNATURE_HEADERS = ['payment-signature', 'x-payment'] as const;\n\n/** First settlement receipt present on a response, in either spelling. */\nexport function readSettlementHeader(headers: Headers): string | null {\n  for (const name of SETTLEMENT_HEADERS) {\n    const value = headers.get(name);\n    if (value) return value;\n  }\n  return null;\n}\n\nexport const DEFAULT_FACILITATOR_URL = 'https://x402.org/facilitator';\n","/** Names of the spend guards an agent can set. */\nexport type GuardName = 'maxPerCall' | 'maxPerHour' | 'maxPerDay' | 'allowedHosts';\n\n/**\n * Thrown before anything is signed when a call would breach a spend guard.\n *\n * Payments are final, so the only place to stop an unwanted spend is before the\n * signature exists. Every guard raises this, and it is never thrown after a payment\n * payload has been created.\n */\nexport class SpendGuardError extends Error {\n  override readonly name = 'SpendGuardError';\n\n  constructor(\n    readonly guard: GuardName,\n    message: string,\n    readonly detail: { limitUsd?: number; attemptedUsd?: number; host?: string } = {},\n  ) {\n    super(message);\n  }\n}\n\n/** Thrown by seams that are typed and reachable but deliberately not built yet. */\nexport class NotImplementedError extends Error {\n  override readonly name = 'NotImplementedError';\n\n  constructor(feature: string) {\n    super(`${feature} is not implemented in this build.`);\n  }\n}\n\n/** Thrown when an optional framework adapter is used without its package installed. */\nexport class MissingAdapterError extends Error {\n  override readonly name = 'MissingAdapterError';\n\n  constructor(pkg: string) {\n    super(`${pkg} is not installed. Add it to use this adapter: pnpm add ${pkg}`);\n  }\n}\n\n/**\n * A 402 arrived whose payment requirements could not be read, so the call cannot be\n * priced and therefore cannot be checked against a spend cap. Refusing is the safe\n * outcome: paying blind is irreversible.\n */\nexport class UnreadableQuoteError extends Error {\n  override readonly name = 'UnreadableQuoteError';\n\n  constructor(message: string) {\n    super(message);\n  }\n}\n","import { NETWORKS, USDC_DECIMALS } from './constants.js';\n\nconst UNITS_PER_USDC = 10n ** BigInt(USDC_DECIMALS);\n\n/** \"1.25\" -> 1250000n. Rejects anything that is not a plain non-negative decimal. */\nexport function parseUsdc(input: string): bigint {\n  const match = /^(\\d+)(?:\\.(\\d{1,6}))?$/.exec(input.trim());\n  if (!match) {\n    throw new RangeError(`Not a USDC amount with at most ${USDC_DECIMALS} decimals: ${input}`);\n  }\n  const whole = BigInt(match[1] ?? '0');\n  const fraction = BigInt((match[2] ?? '').padEnd(USDC_DECIMALS, '0') || '0');\n  return whole * UNITS_PER_USDC + fraction;\n}\n\n/** 1250000n -> \"1.25\". Trailing zeros trimmed. */\nexport function formatUsdc(atomic: bigint): string {\n  if (atomic < 0n) throw new RangeError('USDC amounts are never negative');\n  const whole = atomic / UNITS_PER_USDC;\n  const fraction = (atomic % UNITS_PER_USDC).toString().padStart(USDC_DECIMALS, '0');\n  const trimmed = fraction.replace(/0+$/, '');\n  return trimmed ? `${whole}.${trimmed}` : whole.toString();\n}\n\nconst USDC_ADDRESSES = new Set(\n  Object.values(NETWORKS).map((network) => network.usdc.toLowerCase()),\n);\n\n/**\n * Converts a quoted amount to USD for guard evaluation.\n *\n * Fails closed: if the asset is not a USDC contract we recognise and the quote carries no\n * usable `decimals`, this throws rather than guessing. Guessing here would let an\n * unrecognised token slip past a spend cap, and the payment is irreversible.\n */\nexport function quoteToUsd(quote: {\n  amountAtomic: string;\n  asset: string;\n  decimals?: number | undefined;\n}): number {\n  const decimals = USDC_ADDRESSES.has(quote.asset.toLowerCase()) ? USDC_DECIMALS : quote.decimals;\n\n  if (decimals === undefined || !Number.isInteger(decimals) || decimals < 0 || decimals > 36) {\n    throw new RangeError(\n      `Cannot price asset ${quote.asset}: unknown decimals. Refusing to evaluate spend guards against an unpriceable quote.`,\n    );\n  }\n\n  if (!/^\\d+$/.test(quote.amountAtomic)) {\n    throw new RangeError(`Quoted amount is not an integer atomic value: ${quote.amountAtomic}`);\n  }\n\n  return Number(quote.amountAtomic) / 10 ** decimals;\n}\n","/** One recorded spend, in USD, at a wall-clock millisecond. */\nexport interface SpendRecord {\n  at: number;\n  usd: number;\n}\n\n/**\n * Where rolling spend totals live. The default is in-memory and per-process; swap in a\n * shared implementation (Redis, Durable Object, Postgres) when an agent runs as more\n * than one process, otherwise each process enforces its own separate budget.\n */\nexport interface SpendStore {\n  record(entry: SpendRecord): Promise<void> | void;\n  /** Total USD recorded at or after `sinceMs`. */\n  totalSince(sinceMs: number): Promise<number> | number;\n}\n\n/** Process-local store. Entries older than the longest window are dropped on write. */\nexport function createMemorySpendStore(retentionMs = 24 * 60 * 60 * 1000): SpendStore {\n  let entries: SpendRecord[] = [];\n\n  return {\n    record(entry) {\n      entries.push(entry);\n      const cutoff = entry.at - retentionMs;\n      if (entries.length > 64) entries = entries.filter((e) => e.at >= cutoff);\n    },\n    totalSince(sinceMs) {\n      let total = 0;\n      for (const entry of entries) if (entry.at >= sinceMs) total += entry.usd;\n      return total;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA2B;AAC3B,kBAA4C;AAE5C,IAAAA,iBAA+B;AAC/B,mBAAqC;;;ACK9B,IAAM,WAAW;AAAA,EACtB,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,EACR;AAAA,EACA,gBAAgB;AAAA,IACd,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM;AAAA,EACR;AACF;AAKO,IAAM,gBAAgB;AAatB,IAAM,qBAAqB;AAQ3B,IAAM,qBAAqB,CAAC,oBAAoB,oBAAoB;AAIpE,SAAS,qBAAqB,SAAiC;AACpE,aAAW,QAAQ,oBAAoB;AACrC,UAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;;;AC9CO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAGzC,YACW,OACT,SACS,SAAsE,CAAC,GAChF;AACA,UAAM,OAAO;AAJJ;AAEA;AAAA,EAGX;AAAA,EALW;AAAA,EAEA;AAAA,EALO,OAAO;AAS3B;AAyBO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC5B,OAAO;AAAA,EAEzB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AAAA,EACf;AACF;;;ACjDA,IAAM,iBAAiB,OAAO,OAAO,aAAa;AAsBlD,IAAM,iBAAiB,IAAI;AAAA,EACzB,OAAO,OAAO,QAAQ,EAAE,IAAI,CAAC,YAAY,QAAQ,KAAK,YAAY,CAAC;AACrE;AASO,SAAS,WAAW,OAIhB;AACT,QAAM,WAAW,eAAe,IAAI,MAAM,MAAM,YAAY,CAAC,IAAI,gBAAgB,MAAM;AAEvF,MAAI,aAAa,UAAa,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,IAAI;AAC1F,UAAM,IAAI;AAAA,MACR,sBAAsB,MAAM,KAAK;AAAA,IACnC;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,KAAK,MAAM,YAAY,GAAG;AACrC,UAAM,IAAI,WAAW,iDAAiD,MAAM,YAAY,EAAE;AAAA,EAC5F;AAEA,SAAO,OAAO,MAAM,YAAY,IAAI,MAAM;AAC5C;;;ACnCO,SAAS,uBAAuB,cAAc,KAAK,KAAK,KAAK,KAAkB;AACpF,MAAI,UAAyB,CAAC;AAE9B,SAAO;AAAA,IACL,OAAO,OAAO;AACZ,cAAQ,KAAK,KAAK;AAClB,YAAM,SAAS,MAAM,KAAK;AAC1B,UAAI,QAAQ,SAAS,GAAI,WAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,MAAM,MAAM;AAAA,IACzE;AAAA,IACA,WAAW,SAAS;AAClB,UAAI,QAAQ;AACZ,iBAAW,SAAS,QAAS,KAAI,MAAM,MAAM,QAAS,UAAS,MAAM;AACrE,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AJIA,IAAM,UAAU,KAAK,KAAK;AAC1B,IAAM,SAAS,KAAK;AAEpB,SAAS,OAAO,OAAyC;AACvD,MAAI;AACF,UAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,MAAkB;AAC3B,WAAO,IAAI,IAAI,GAAG,EAAE,SAAS,YAAY;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,YAAY,MAAc,SAAqC;AACtE,SAAO,QAAQ,KAAK,CAAC,UAAU;AAC7B,UAAM,YAAY,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,EAAE;AAChE,WAAO,SAAS,aAAa,KAAK,SAAS,IAAI,SAAS,EAAE;AAAA,EAC5D,CAAC;AACH;AAMA,eAAsB,eACpB,UACA,QACA,OACA,KACe;AACf,MAAI,OAAO,eAAe,UAAa,WAAW,OAAO,YAAY;AACnE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,eAAe,QAAQ,2CAA2C,OAAO,UAAU;AAAA,MACnF,EAAE,UAAU,OAAO,YAAY,cAAc,SAAS;AAAA,IACxD;AAAA,EACF;AAEA,MAAI,OAAO,eAAe,QAAW;AACnC,UAAM,QAAQ,MAAM,MAAM,WAAW,MAAM,OAAO;AAClD,QAAI,QAAQ,WAAW,OAAO,YAAY;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,eAAe,QAAQ,SAAS,KAAK,oEAAoE,OAAO,UAAU;AAAA,QAC1H,EAAE,UAAU,OAAO,YAAY,cAAc,QAAQ,SAAS;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,OAAO,cAAc,QAAW;AAClC,UAAM,QAAQ,MAAM,MAAM,WAAW,MAAM,MAAM;AACjD,QAAI,QAAQ,WAAW,OAAO,WAAW;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,eAAe,QAAQ,SAAS,KAAK,+DAA+D,OAAO,SAAS;AAAA,QACpH,EAAE,UAAU,OAAO,WAAW,cAAc,QAAQ,SAAS;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;AAQA,eAAsB,uBAAuB,UAAoD;AAC/F,QAAM,SAAS,SAAS,QAAQ,IAAI,kBAAkB;AACtD,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,cAAU,yCAA4B,MAAM;AAClD,UAAI,MAAM,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,SAAS,EAAG,QAAO,QAAQ;AAAA,IACnF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,OAAgB,MAAM,SACzB,MAAM,EACN,KAAK,EACL,MAAM,MAAM,IAAI;AACnB,QAAM,UAAW,MAAqD;AACtE,SAAO,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC;AAC7C;AAUO,SAAS,WAAW,cAA2C;AACpE,QAAM,WAAiC;AACvC,QAAM,eAAe,SAAS,qBAAqB,SAAS;AAC5D,MAAI,CAAC,gBAAgB,CAAC,SAAS,OAAO;AACpC,UAAM,IAAI,WAAW,kEAAkE;AAAA,EACzF;AACA,SAAO,WAAW;AAAA,IAChB;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,UAAU,SAAS,OAAO;AAAA,EAC5B,CAAC;AACH;AAUA,eAAsB,SACpB,KACA,MACA,SACmB;AACnB,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,QAAM,QAAQ,QAAQ,SAAS,uBAAuB;AACtD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,QAAM,WAAW,QAAQ,YAAa,CAAC,MAAM;AAG7C,MAAI,OAAO,cAAc;AACvB,UAAM,OAAO,OAAO,GAAG;AACvB,QAAI,CAAC,QAAQ,CAAC,YAAY,MAAM,OAAO,YAAY,GAAG;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ,QAAQ,eAAe;AAAA,QAC/B,EAAE,MAAM,QAAQ,OAAU;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAA2B;AAE/B,QAAM,SAAS,IAAI,yBAAW,CAAC,UAAU,iBAAiB;AAExD,UAAM,aAAa,aAAa,OAAO,CAAC,gBAAgB;AACtD,YAAM,MAAM,WAAW,WAAW;AAClC,aAAO,OAAO,eAAe,UAAa,OAAO,OAAO;AAAA,IAC1D,CAAC;AAED,UAAM,UAAU,WAAW,SAAS,IAAI,aAAa,cAAc,CAAC;AACpE,QAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,0CAA0C;AAE5E,gBAAY,WAAW,MAAM;AAC7B,WAAO;AAAA,EACT,CAAC;AAED,aAAW,QAAQ,UAAU;AAC3B,WAAO,SAAS,SAAS,IAAI,EAAE,OAAO,IAAI,8BAAe,QAAQ,MAAM,CAAC;AAAA,EAC1E;AAEA,QAAM,UAAmC,OAAO,OAAO,gBAAgB;AACrE,UAAMC,YAAW,MAAM,UAAU,OAAO,WAAW;AACnD,QAAIA,UAAS,WAAW,IAAK,QAAOA;AAGpC,UAAM,UAAU,MAAM,uBAAuBA,SAAQ;AACrD,QAAI,QAAQ,WAAW,GAAG;AAIxB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,QAAQ,IAAI,CAAC,gBAAgB,WAAW,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;AAC9F,QAAI,aAAa,QAAW;AAC1B,YAAM,eAAe,UAAU,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AACA,WAAOA;AAAA,EACT;AAEA,QAAM,aAAS,mCAAqB,SAAS,MAAM;AACnD,QAAM,WAAW,MAAM,OAAO,KAAoB,IAAI;AAGtD,MAAI,qBAAqB,SAAS,OAAO,KAAK,cAAc,MAAM;AAChE,UAAM,MAAM,OAAO,EAAE,IAAI,IAAI,GAAG,KAAK,UAAU,CAAC;AAAA,EAClD;AAEA,SAAO;AACT;","names":["import_client","response"]}

package/dist/client.d.cts

@@ -1,3 +1,3 @@
 import '@x402/core/types';
 import '@x402/evm/exact/client';
-export { E as EvmWallet, P as PAYMENT_REF_HEADER, d as PayFetchOptions, S as SpendGuards, h as evaluateGuards, p as payFetch, q as quoteUsdOf } from './client-C8_arVa4.cjs';
+export { E as EvmWallet, P as PAYMENT_REF_HEADER, e as PayFetchOptions, f as SpendGuards, j as evaluateGuards, p as payFetch, q as quoteUsdOf, k as readQuotedRequirements } from './client-BBsrY6gC.cjs';

package/dist/client.d.ts

@@ -1,3 +1,3 @@
 import '@x402/core/types';
 import '@x402/evm/exact/client';
-export { E as EvmWallet, P as PAYMENT_REF_HEADER, d as PayFetchOptions, S as SpendGuards, h as evaluateGuards, p as payFetch, q as quoteUsdOf } from './client-C8_arVa4.js';
+export { E as EvmWallet, P as PAYMENT_REF_HEADER, e as PayFetchOptions, f as SpendGuards, j as evaluateGuards, p as payFetch, q as quoteUsdOf, k as readQuotedRequirements } from './client-BBsrY6gC.js';