@insumermodel/mppx-condition-gate 3.0.2 → 3.1.0

package/README.md

@@ -15,6 +15,8 @@ Free access requires a payer your payment method has **proven** controls the req
 5. **Pass** → free receipt returned (`reference: "condition-gate:free:{attestationId}"`)
 6. **Fail, or no proven payer** → the normal paid path runs
 
+Each credential gets free access at most once. See [Single-use credentials](#single-use-credentials) for what the gate records and the limits of that guarantee.
+
 The signed attestation is verifiable offline via [JWKS](https://insumermodel.com/.well-known/jwks.json). The adapter does not re-sign or wrap the result; the signature on the attestation is the one InsumerAPI produced. Since 2026-09-01 every attest response also carries an ML-DSA-65 post-quantum companion (`pqSig`, `pqKid`) beside `sig` and `kid`, added without changing them; the `InsumerAttestation` type declares `pqSig` and `pqKid` beside `sig` and `kid`, and `insumer-verify` 1.8.1+ reports the companion as a fifth verdict.
 
 ### Why you must supply the payer
@@ -32,18 +34,19 @@ npm install @insumermodel/mppx-condition-gate
 ## Usage
 
 ```ts
-import { Mppx, tempo } from 'mppx/server'
+import { Mppx, evm } from 'mppx/server'
 import { conditionGate } from '@insumermodel/mppx-condition-gate'
 
-const tempoCharge = tempo({
-  currency: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
-  recipient: '0xYourAddress',
+const evmCharge = evm.charge({
+  currency: evm.assets.base.USDC,
+  recipient: '0xYourAddress', // your checksummed receiving address
+  x402: { facilitator: 'https://your-facilitator.example' },
 })
 
-const gatedCharge = conditionGate(tempoCharge, {
+const gatedCharge = conditionGate(evmCharge, {
   apiKey: process.env.INSUMER_API_KEY,
   // Return only a payer this method has PROVEN for this request, else null.
-  // The argument is mppx's method-specific validation `details`.
+  // mppx's EVM charge reports the signer it recovered as `payer`.
   provenPayer: (details) => (details as { payer?: string }).payer ?? null,
   conditions: [{
     type: 'nft_ownership',
@@ -52,10 +55,69 @@ const gatedCharge = conditionGate(tempoCharge, {
   }],
 })
 
-const mppx = Mppx.create({ methods: [gatedCharge] })
+const mppx = Mppx.create({ methods: [gatedCharge], secretKey: process.env.MPP_SECRET_KEY })
+```
+
+Works with any framework (Hono, Express, Elysia, Next.js). The adapter wraps `Method.Server`, so no middleware changes needed.
+
+### Which credentials can get free access
+
+Free access needs a method that exposes mppx's `validate` hook, a resolver that returns the payer that method proved, and a credential the gate can identify. mppx added `validate` in 0.8.14 for the Tempo charge and in 0.9.3 for the EVM charge; on older versions every request pays. In mppx 0.9.3:
+
+- **EVM charge**, native and x402: EIP-3009 authorizations. The payer is the recovered signer, `details.payer`.
+- **Tempo charge, proof credentials**: the payer is `details.sender`, checked against a signature over the challenge. Tempo accepts proofs only on zero-amount challenges.
+- **Tempo hash and transaction credentials** are payments in their own right, a transfer already on chain or one waiting to be sent. They take the paid path, where the Tempo method's own replay protection applies.
+- **Stripe** exposes no `validate` hook, so it is never gated.
+
+## Single-use credentials
+
+When a payment settles, mppx spends the credential: the on-chain nonce is used, or the method records it. A free grant never settles, so the gate keeps its own record:
+
+- It records a credential when it grants free access. It also records an EIP-3009 authorization just before the paid path settles it, so a copy presented while that payment is in flight is refused.
+- A recorded credential is refused with a verification error. It is not passed on to payment, which would charge the original holder for someone else's request.
+- If settlement throws, that record is released, so the holder can retry with the same credential.
+- An EIP-3009 authorization is identified by its signer and nonce, and a Tempo proof by its challenge and payer. Neither changes when a signature is re-encoded or the challenge is rebuilt, and two users never share one. A native credential signs its challenge, so the same wallet signing the same native challenge twice (in the same millisecond, or on a route with a fixed `expires`) produces one credential, and the second is refused. x402 clients choose a fresh nonce each time.
+- A Tempo proof gets free access once, but a repeated proof is not refused, and a proof that takes the paid path is not recorded. Proofs are only accepted on zero-amount routes, which move no value, so the Tempo method and its own replay rules (its `store` option) decide whether it may be presented again.
+
+A record is kept until the credential expires, plus 60 seconds. A credential whose remaining validity is longer than `maxCredentialLifetimeSeconds` (600 by default) gets no free access and takes the paid path:
+
+- **EIP-3009 authorization:** its `validBefore`. An x402 client sets it from the route's `maxTimeoutSeconds` (300 by default), whatever the challenge expiry, but a client can sign a longer one. An x402 route whose `maxTimeoutSeconds` is above the cap gives qualifying visitors no free access unless you raise the option. A native client sets it to the challenge's `expires` (5 minutes by default), so a native route configured with an `expires` longer than the cap gives no free access unless you raise the option.
+- **Tempo proof:** the challenge's `expires`.
+
+### Limits of the guarantee
+
+Each case below allows at most one extra use of a credential:
+
+- **Settlement throws after the transfer actually happened.** The record is released, so the credential can be presented again. If its payer now meets the conditions, that presentation is free.
+- **The default store's payment records are full** (100,000 live). Later payments are not recorded, so a settled credential can come back once for free access.
+- **A caller-supplied store cannot be read or written.** The request gets no free access and pays without a record. A credential that already got free access can then be settled for a copy's request, charging its holder once, which is what bare mppx does with any credential that has not settled.
+
+Concurrent copies of one credential may each spend an attestation before one of them is granted.
+
+### The default store
+
+The default record lives in memory and is **shared by every gated route in the process**. It holds up to 100,000 live free grants, at most 5,000 per wallet, and up to 100,000 payment records. A wallet over its share, or any wallet once the free-grant capacity is full, pays instead.
+
+The default store is not a defense against someone determined to deny free access to others. Free credentials cost nothing to sign, so about 20 qualifying addresses can fill the free-grant capacity. So can one qualifying asset moved between 20 addresses, because a passing attestation is cached for `cacheTtlSeconds`. Every other qualifying visitor in that process then pays the route price until those credentials expire, up to `maxCredentialLifetimeSeconds` plus a minute. Use the default store for development and low-stakes routes.
+
+**For production traffic, or when the route runs on more than one instance, pass a shared store with its own capacity.** The store must claim atomically and remove expired entries. Options:
+
+- `Store.redis`, `Store.upstash` or `Store.cloudflare`, built from a client that exposes an atomic `update`. Confirm that your backend expires keys.
+- Any store with an atomic `tryClaim`.
+
+mppx's `Store.memory()` never removes expired entries, so use it only in tests. A store that is not atomic lets concurrent presentations through. Give the store `delete` (or `update`) so a failed payment can be released.
+
+```ts
+import { Store } from 'mppx/server'
+
+const gatedCharge = conditionGate(evmCharge, {
+  provenPayer: (details) => (details as { payer?: string }).payer ?? null,
+  conditions: [ ... ],
+  replayStore: Store.redis(atomicRedisClient), // the client must provide `update`
+})
 ```
 
-Works with any framework (Hono, Express, Elysia, Next.js) and any payment method (tempo, stripe). The adapter wraps `Method.Server`, so no middleware changes needed.
+Refusals are mppx's own `VerificationFailedError`, returned as HTTP 402. mppx is a peer dependency; if your install ends up with two copies of it, a refusal surfaces as an internal error (HTTP 500) instead.
 
 ## Condition types
 
@@ -182,6 +244,9 @@ Either way, set `INSUMER_API_KEY` as an environment variable in your runtime.
 | `matchMode` | `'any' \| 'all'` | `'any'` | Wallet must satisfy any or all conditions |
 | `cacheTtlSeconds` | `number` | `300` | In-memory cache TTL |
 | `apiBaseUrl` | `string` | `https://api.insumermodel.com` | API base URL override |
+| `provenPayer` | `(details) => ProvenPayer` | none | Returns the payer the method proved; required for free access |
+| `replayStore` | `AtomicStore` | bounded in-memory, per process | Records used credentials; must be atomic; share it across instances |
+| `maxCredentialLifetimeSeconds` | `number` | `600` | Longest remaining validity a credential may have and still get free access |
 
 ## Supported chains
 

package/dist/index.d.ts

@@ -133,6 +133,47 @@ export type ConditionGateOptions = {
      * with `format: "jwt"` directly if you need the `jwt` and `pqJwt` tokens.
      */
     jwt?: boolean;
+    /**
+     * Where the gate records credentials it has accepted, so each one gets
+     * through at most once. Defaults to a bounded in-process store.
+     *
+     * Pass a shared store when the route runs on more than one instance, or a
+     * credential used on one instance can be presented again on another. The
+     * store must claim atomically and remove expired entries: `Store.redis`,
+     * `Store.upstash` or `Store.cloudflare` from `mppx/server` built from a client
+     * that exposes an atomic `update`, or any store with an atomic `tryClaim`.
+     * mppx's `Store.memory()` never removes expired entries; use it only in tests.
+     */
+    replayStore?: ReplayStore;
+    /**
+     * Longest remaining validity, in seconds, a credential may have and still be
+     * given free access. Defaults to 600. The gate has to remember a credential
+     * until it expires, and x402 clients choose their own expiry, so longer-lived
+     * credentials take the paid path instead.
+     */
+    maxCredentialLifetimeSeconds?: number;
+};
+/**
+ * An atomic claim store. Structurally compatible with mppx's `AtomicStore`:
+ * `tryClaim` is used when present, otherwise `update`. `get`, when present,
+ * lets the gate refuse a repeat before spending an attestation on it, and
+ * `delete` (or `update`) lets it release a credential whose payment failed.
+ */
+export type ReplayStore = {
+    get?: (key: string) => unknown | Promise<unknown>;
+    delete?: (key: string) => void | Promise<void>;
+    tryClaim?: (key: string, expires: number) => boolean | Promise<boolean>;
+    update?: <result>(key: string, fn: (current: any) => {
+        op: 'noop';
+        result: result;
+    } | {
+        op: 'set';
+        value: any;
+        result: result;
+    } | {
+        op: 'delete';
+        result: result;
+    }) => Promise<result>;
 };
 export type InsumerAttestation = {
     ok: boolean;
@@ -174,7 +215,7 @@ export type InsumerAttestation = {
         creditsCharged: number;
     };
 };
-/** Clear the in-memory ownership cache. Useful in tests. */
+/** Clear the in-memory ownership cache and the default replay store. Useful in tests. */
 export declare function clearConditionGateCache(): void;
 /**
  * Extracts an EVM address from a `did:pkh:eip155:{chainId}:{address}` string.
@@ -212,6 +253,16 @@ export declare function normalizeProvenPayer(payer: ProvenPayer): {
  * credential that fails validation, conditions not met, or an attestation
  * error. There is no path from an unproven wallet to a free receipt.
  *
+ * Each credential gets free access at most once. The gate records a
+ * credential when it grants free access, and records an authorization just
+ * before the paid path settles it; a recorded credential is refused with a
+ * verification error rather than passed on to payment. A payment that fails is
+ * released, so it can be retried. See the README for the limits of this. Free access is given only to credentials the gate can identify
+ * (EIP-3009 authorizations and Tempo proofs) whose remaining validity is within
+ * `maxCredentialLifetimeSeconds`. The default store is bounded and shared by
+ * every gated route in the process; pass a shared `replayStore` for production
+ * traffic or when the route runs on more than one instance.
+ *
  * Conditions are evaluated across the 35 chains this adapter reaches (32 EVM +
  * Solana + XRPL + Bitcoin; the engine itself covers 38). Six condition types
  * are typed here: token_balance, nft_ownership, eas_attestation, farcaster_id,
@@ -226,8 +277,9 @@ export declare function normalizeProvenPayer(payer: ProvenPayer): {
  * ```ts
  * import { conditionGate } from '@insumermodel/mppx-condition-gate'
  *
- * const gated = conditionGate(tempoCharge, {
+ * const gated = conditionGate(evmCharge, {
  *   // Return only a payer this method has proven for THIS request.
+ *   // mppx's EVM charge reports the recovered signer as `payer`.
  *   provenPayer: (details) => (details as { payer?: string }).payer ?? null,
  *   conditions: [
  *     { type: 'eas_attestation', template: 'coinbase_verified_account', chainId: 8453 },

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAW,MAAM,MAAM,CAAA;AAM3C,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAE5D,4DAA4D;AAC5D,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB;;4FAEwF;IACxF,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,eAAe,CAAA;IACrB,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,2DAA2D;AAC3D,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,iBAAiB,CAAA;IACvB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,QAAQ,CAAC,EACL,2BAA2B,GAC3B,2BAA2B,GAC3B,cAAc,GACd,wBAAwB,GACxB,yBAAyB,CAAA;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,qEAAqE;AACrE,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAA;IACvB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,mGAAmG;IACnG,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAA;IACvB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,2CAA2C;AAC3C,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,CAAA;AAE1B,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACrC,IAAI,GACJ,SAAS,CAAA;AAEb,MAAM,MAAM,oBAAoB,GAAG;IACjC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;;;;;;;OAkBG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACtE,oEAAoE;IACpE,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAA;IACzB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,OAAO,CAAA;CACd,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE;QACJ,WAAW,EAAE;YACX,EAAE,EAAE,MAAM,CAAA;YACV,IAAI,EAAE,OAAO,CAAA;YACb,OAAO,EAAE,KAAK,CAAC;gBACb,SAAS,EAAE,MAAM,CAAA;gBACjB,KAAK,CAAC,EAAE,MAAM,CAAA;gBACd,IAAI,EAAE,MAAM,CAAA;gBACZ,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;gBACxB,GAAG,EAAE,OAAO,CAAA;gBACZ,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAC3C,aAAa,EAAE,MAAM,CAAA;gBACrB,WAAW,CAAC,EAAE,MAAM,CAAA;gBACpB,cAAc,CAAC,EAAE,MAAM,CAAA;gBACvB,WAAW,CAAC,EAAE,MAAM,CAAA;gBACpB,UAAU,CAAC,EAAE,MAAM,CAAA;aACpB,CAAC,CAAA;YACF,SAAS,EAAE,MAAM,CAAA;YACjB,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,SAAS,EAAE,MAAM,CAAA;SAClB,CAAA;QACD,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,+EAA+E;QAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,+FAA+F;QAC/F,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,CAAA;QACjB,gBAAgB,EAAE,MAAM,CAAA;QACxB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;CACF,CAAA;AA+BD,4DAA4D;AAC5D,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAMD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,GAAG,IAAI,CAO7D;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO1D;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAgHD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GACjB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAuB9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,SAAS,EACxB,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,SAAS,CA8FlB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAW,MAAM,MAAM,CAAA;AAO3C,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAE5D,4DAA4D;AAC5D,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,eAAe,CAAA;IACrB,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB;;4FAEwF;IACxF,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,eAAe,CAAA;IACrB,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,2DAA2D;AAC3D,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,iBAAiB,CAAA;IACvB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,QAAQ,CAAC,EACL,2BAA2B,GAC3B,2BAA2B,GAC3B,cAAc,GACd,wBAAwB,GACxB,yBAAyB,CAAA;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,qEAAqE;AACrE,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAA;IACvB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,mGAAmG;IACnG,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAA;IACvB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,2CAA2C;AAC3C,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,CAAA;AAE1B,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACrC,IAAI,GACJ,SAAS,CAAA;AAEb,MAAM,MAAM,oBAAoB,GAAG;IACjC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;;;;;;;OAkBG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACtE,oEAAoE;IACpE,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAA;IACzB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,OAAO,CAAA;IACb;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;CACtC,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,MAAM,CAAC,EAAE,CAAC,MAAM,EACd,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,KACb;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAC9B;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACzC;QAAE,EAAE,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KACjC,OAAO,CAAC,MAAM,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE;QACJ,WAAW,EAAE;YACX,EAAE,EAAE,MAAM,CAAA;YACV,IAAI,EAAE,OAAO,CAAA;YACb,OAAO,EAAE,KAAK,CAAC;gBACb,SAAS,EAAE,MAAM,CAAA;gBACjB,KAAK,CAAC,EAAE,MAAM,CAAA;gBACd,IAAI,EAAE,MAAM,CAAA;gBACZ,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;gBACxB,GAAG,EAAE,OAAO,CAAA;gBACZ,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAC3C,aAAa,EAAE,MAAM,CAAA;gBACrB,WAAW,CAAC,EAAE,MAAM,CAAA;gBACpB,cAAc,CAAC,EAAE,MAAM,CAAA;gBACvB,WAAW,CAAC,EAAE,MAAM,CAAA;gBACpB,UAAU,CAAC,EAAE,MAAM,CAAA;aACpB,CAAC,CAAA;YACF,SAAS,EAAE,MAAM,CAAA;YACjB,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,SAAS,EAAE,MAAM,CAAA;SAClB,CAAA;QACD,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,+EAA+E;QAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,+FAA+F;QAC/F,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,CAAA;QACjB,gBAAgB,EAAE,MAAM,CAAA;QACxB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;CACF,CAAA;AA+BD,yFAAyF;AACzF,wBAAgB,uBAAuB,IAAI,IAAI,CAO9C;AA+LD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,GAAG,IAAI,CAO7D;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO1D;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAgHD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GACjB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAuB9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,SAAS,EACxB,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,SAAS,CAiMlB"}

package/dist/index.js

@@ -1,3 +1,4 @@
+import { Errors } from 'mppx';
 const cache = new Map();
 function conditionSortKey(c) {
     if (c.type === 'farcaster_id')
@@ -15,9 +16,184 @@ function cacheKey(address, conditions) {
     });
     return `${address.toLowerCase()}:${JSON.stringify(sorted)}`;
 }
-/** Clear the in-memory ownership cache. Useful in tests. */
+/** Clear the in-memory ownership cache and the default replay store. Useful in tests. */
 export function clearConditionGateCache() {
     cache.clear();
+    defaultMarkers.clear();
+    freeCountByOwner.clear();
+    freeCount = 0;
+    paidCount = 0;
+    nextSweepAt = 0;
+}
+// ---------------------------------------------------------------------------
+// Single-use credentials
+// ---------------------------------------------------------------------------
+// mppx makes a credential single-use when it settles: the on-chain nonce is
+// spent, or the method claims the hash or proof in its store. `validate` is
+// non-mutating by design, so a credential that is granted free access and
+// never settled would otherwise stay usable by anyone who holds a copy.
+/** Kept this long past the credential's own expiry, to absorb clock skew. */
+const REPLAY_SKEW_MS = 60 * 1000;
+const DEFAULT_MAX_CREDENTIAL_LIFETIME_SECONDS = 600;
+/** Default store: live free grants across the process, and per wallet. */
+const DEFAULT_STORE_MAX_FREE = 100_000;
+const DEFAULT_STORE_MAX_FREE_PER_WALLET = 5_000;
+/** Default store: payments it remembers. Past this it stops recording payments. */
+const DEFAULT_STORE_MAX_PAID = 100_000;
+const DEFAULT_STORE_SWEEP_MS = 60_000;
+const defaultMarkers = new Map();
+const freeCountByOwner = new Map();
+let freeCount = 0;
+let paidCount = 0;
+let nextSweepAt = 0;
+function forgetDefault(key) {
+    const marker = defaultMarkers.get(key);
+    if (!marker)
+        return;
+    defaultMarkers.delete(key);
+    if (marker.kind === 'paid') {
+        paidCount--;
+        return;
+    }
+    freeCount--;
+    const remaining = (freeCountByOwner.get(marker.owner) ?? 1) - 1;
+    if (remaining <= 0)
+        freeCountByOwner.delete(marker.owner);
+    else
+        freeCountByOwner.set(marker.owner, remaining);
+}
+const defaultRecorder = {
+    async isTaken(key) {
+        const marker = defaultMarkers.get(key);
+        return marker !== undefined && marker.expires > Date.now();
+    },
+    async claim(key, expires, owner, kind) {
+        const now = Date.now();
+        if (now >= nextSweepAt) {
+            for (const [k, marker] of defaultMarkers)
+                if (marker.expires <= now)
+                    forgetDefault(k);
+            nextSweepAt = now + DEFAULT_STORE_SWEEP_MS;
+        }
+        const current = defaultMarkers.get(key);
+        if (current !== undefined) {
+            if (current.expires > now)
+                return false;
+            forgetDefault(key);
+        }
+        if (kind === 'free') {
+            const held = freeCountByOwner.get(owner) ?? 0;
+            if (freeCount >= DEFAULT_STORE_MAX_FREE || held >= DEFAULT_STORE_MAX_FREE_PER_WALLET) {
+                throw new Error('mppx-condition-gate: default replay store has no room for this wallet');
+            }
+            freeCount++;
+            freeCountByOwner.set(owner, held + 1);
+        }
+        else {
+            if (paidCount >= DEFAULT_STORE_MAX_PAID) {
+                throw new Error('mppx-condition-gate: default replay store is full');
+            }
+            paidCount++;
+        }
+        defaultMarkers.set(key, { expires, owner, kind });
+        return true;
+    },
+    async release(key) {
+        forgetDefault(key);
+    },
+};
+function isReplayMarker(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.expires === 'number' &&
+        value.type === 'mppx:replay');
+}
+async function tryClaim(store, key, expires) {
+    if (typeof store.tryClaim === 'function')
+        return store.tryClaim(key, expires);
+    // Same marker as mppx's Store.tryClaim. A live marker, or any other stored
+    // value, counts as taken; an empty slot or an expired marker does not.
+    return store.update(key, (current) => {
+        const empty = current === null || current === undefined || current === false;
+        const taken = !empty && (!isReplayMarker(current) || current.expires > Date.now());
+        return taken
+            ? { op: 'noop', result: false }
+            : { op: 'set', value: { expires, type: 'mppx:replay' }, result: true };
+    });
+}
+function storeRecorder(store) {
+    return {
+        async isTaken(key) {
+            // Advisory only: the atomic claim decides. Anything but a live marker reads as free.
+            if (typeof store.get !== 'function')
+                return false;
+            const current = await store.get(key);
+            return isReplayMarker(current) && current.expires > Date.now();
+        },
+        async claim(key, expires) {
+            return tryClaim(store, key, expires);
+        },
+        async release(key) {
+            if (typeof store.delete === 'function') {
+                await store.delete(key);
+                return;
+            }
+            if (typeof store.update === 'function') {
+                await store.update(key, (current) => isReplayMarker(current)
+                    ? { op: 'delete', result: undefined }
+                    : { op: 'noop', result: undefined });
+            }
+        },
+    };
+}
+function lowerHex(value) {
+    return typeof value === 'string' && /^0x[0-9a-fA-F]+$/.test(value) ? value.toLowerCase() : null;
+}
+/**
+ * One key that identifies the credential, or null when the gate cannot
+ * identify it safely, in which case it gets no free access.
+ *
+ * - EIP-3009 authorization (mppx EVM charge, native and x402): signer + nonce.
+ *   Neither changes when the signature is re-encoded or the challenge is
+ *   rebuilt, and two users never share one.
+ * - Tempo proof: challenge id + proven payer. The proof signs the challenge
+ *   id, so it cannot be moved to another challenge.
+ *
+ * Other credential types are payments in their own right (a Tempo hash is a
+ * transfer already on chain, a Tempo transaction is one waiting to be sent),
+ * so they take the paid path, where the method's own replay protection applies.
+ */
+function credentialKey(methodName, credential, payerAddress) {
+    const payload = credential?.payload;
+    if (payload === null || typeof payload !== 'object')
+        return null;
+    let id = null;
+    if (payload.type === 'authorization') {
+        const from = lowerHex(payload.from);
+        const nonce = lowerHex(payload.nonce);
+        if (from && nonce)
+            id = `authorization:${from}:${nonce}`;
+    }
+    else if (payload.type === 'proof') {
+        const challengeId = credential?.challenge?.id;
+        if (typeof challengeId === 'string' && challengeId.length > 0) {
+            id = `proof:${challengeId}:${payerAddress.toLowerCase()}`;
+        }
+    }
+    return id === null ? null : `mppx-condition-gate:${methodName}:${id}`;
+}
+/** The latest moment the credential could still be accepted, or null if unknown. */
+function credentialExpiry(credential) {
+    const payload = credential?.payload;
+    if (payload?.type === 'authorization') {
+        // An authorization is bounded by its own validBefore. For x402 the
+        // challenge is rebuilt on every request, so its expiry says nothing about
+        // the credential; a native credential's validBefore is its challenge's expiry.
+        const validBefore = Number(payload.validBefore);
+        return Number.isFinite(validBefore) && validBefore > 0 ? validBefore * 1000 : null;
+    }
+    const challengeExpires = Date.parse(credential?.challenge?.expires);
+    return Number.isFinite(challengeExpires) ? challengeExpires : null;
 }
 // ---------------------------------------------------------------------------
 // DID parsing
@@ -225,6 +401,16 @@ export function normalizeProvenPayer(payer) {
  * credential that fails validation, conditions not met, or an attestation
  * error. There is no path from an unproven wallet to a free receipt.
  *
+ * Each credential gets free access at most once. The gate records a
+ * credential when it grants free access, and records an authorization just
+ * before the paid path settles it; a recorded credential is refused with a
+ * verification error rather than passed on to payment. A payment that fails is
+ * released, so it can be retried. See the README for the limits of this. Free access is given only to credentials the gate can identify
+ * (EIP-3009 authorizations and Tempo proofs) whose remaining validity is within
+ * `maxCredentialLifetimeSeconds`. The default store is bounded and shared by
+ * every gated route in the process; pass a shared `replayStore` for production
+ * traffic or when the route runs on more than one instance.
+ *
  * Conditions are evaluated across the 35 chains this adapter reaches (32 EVM +
  * Solana + XRPL + Bitcoin; the engine itself covers 38). Six condition types
  * are typed here: token_balance, nft_ownership, eas_attestation, farcaster_id,
@@ -239,8 +425,9 @@ export function normalizeProvenPayer(payer) {
  * ```ts
  * import { conditionGate } from '@insumermodel/mppx-condition-gate'
  *
- * const gated = conditionGate(tempoCharge, {
+ * const gated = conditionGate(evmCharge, {
  *   // Return only a payer this method has proven for THIS request.
+ *   // mppx's EVM charge reports the recovered signer as `payer`.
  *   provenPayer: (details) => (details as { payer?: string }).payer ?? null,
  *   conditions: [
  *     { type: 'eas_attestation', template: 'coinbase_verified_account', chainId: 8453 },
@@ -254,6 +441,18 @@ export function normalizeProvenPayer(payer) {
  */
 export function conditionGate(server, options) {
     const { conditions, matchMode = 'any', cacheTtlSeconds = 300, provenPayer } = options;
+    const lifetimeSeconds = options.maxCredentialLifetimeSeconds ?? DEFAULT_MAX_CREDENTIAL_LIFETIME_SECONDS;
+    if (typeof lifetimeSeconds !== 'number' || !Number.isFinite(lifetimeSeconds) || lifetimeSeconds < 0) {
+        throw new Error('mppx-condition-gate: maxCredentialLifetimeSeconds must be a finite number of seconds, 0 or more.');
+    }
+    const maxLifetimeMs = lifetimeSeconds * 1000;
+    const { replayStore } = options;
+    if (replayStore !== undefined &&
+        typeof replayStore.tryClaim !== 'function' &&
+        typeof replayStore.update !== 'function') {
+        throw new Error('mppx-condition-gate: replayStore must provide an atomic tryClaim or update (an mppx AtomicStore).');
+    }
+    const recorder = replayStore ? storeRecorder(replayStore) : defaultRecorder;
     const anyServer = server;
     const originalVerify = anyServer.verify;
     const originalBroadcast = anyServer.broadcast;
@@ -263,10 +462,30 @@ export function conditionGate(server, options) {
     // without `validate` (legacy verify-only, or broadcast-without-validate) has
     // no safe pre-check, so it is never gated.
     const canGate = typeof provenPayer === 'function' && typeof originalValidate === 'function';
-    /** Returns a free receipt, or null to take the paid path. */
+    const refuse = () => new Errors.VerificationFailedError({ reason: 'this credential has already been presented' });
+    /** Attestation result for a payer, from the cache or a fresh call. Throws on API error. */
+    async function evaluate(payer) {
+        const key = cacheKey(payer.address, conditions);
+        const cached = cache.get(key);
+        if (cached && cached.expiresAt > Date.now())
+            return cached;
+        const result = await callAttest(payer.address, payer.type, conditions, options);
+        const attestation = result.data.attestation;
+        const pass = matchMode === 'all'
+            ? attestation.pass
+            : attestation.results.some((r) => r.met);
+        const entry = {
+            pass,
+            attestationId: attestation.id,
+            expiresAt: Date.now() + cacheTtlSeconds * 1000,
+        };
+        cache.set(key, entry);
+        return entry;
+    }
+    /** Decides between a free receipt and the paid path. Throws to refuse a repeat. */
     async function tryFree(params) {
         if (!canGate)
-            return null;
+            return { free: false };
         let details;
         try {
             const validation = await originalValidate(params);
@@ -274,60 +493,124 @@ export function conditionGate(server, options) {
         }
         catch {
             // Credential is not currently acceptable → let the payment method decide.
-            return null;
+            return { free: false };
         }
         let resolved;
         try {
             resolved = await provenPayer(details);
         }
         catch {
-            return null;
+            return { free: false };
         }
         const payer = normalizeProvenPayer(resolved);
         if (!payer)
-            return null;
-        const key = cacheKey(payer.address, conditions);
-        const cached = cache.get(key);
-        if (cached && cached.expiresAt > Date.now()) {
-            if (!cached.pass)
-                return null;
-            return {
-                method: server.name,
-                reference: `condition-gate:free:${cached.attestationId}`,
-                status: 'success',
-                timestamp: new Date().toISOString(),
-            };
+            return { free: false };
+        const credential = params?.credential;
+        const key = credentialKey(server.name, credential, payer.address);
+        const expiry = credentialExpiry(credential);
+        if (key === null || expiry === null)
+            return { free: false };
+        const record = {
+            key,
+            owner: payer.address.toLowerCase(),
+            expires: Math.min(expiry + REPLAY_SKEW_MS, Number.MAX_SAFE_INTEGER),
+            // Only an authorization moves value; a Tempo proof is accepted on zero-amount routes.
+            payment: credential?.payload?.type === 'authorization',
+        };
+        // A recorded credential is refused before any attestation is spent on it.
+        let taken;
+        try {
+            taken = await recorder.isTaken(key);
+        }
+        catch {
+            return { free: false, record };
+        }
+        if (taken) {
+            // A repeated Tempo proof moves no value, so the method decides; a payment is refused.
+            if (!record.payment)
+                return { free: false };
+            throw refuse();
         }
+        if (expiry - Date.now() > maxLifetimeMs)
+            return { free: false, record };
+        let evaluation;
         try {
-            const result = await callAttest(payer.address, payer.type, conditions, options);
-            const attestation = result.data.attestation;
-            const pass = matchMode === 'all'
-                ? attestation.pass
-                : attestation.results.some((r) => r.met);
-            cache.set(key, {
-                pass,
-                attestationId: attestation.id,
-                expiresAt: Date.now() + cacheTtlSeconds * 1000,
-            });
-            if (!pass)
-                return null;
-            return {
+            evaluation = await evaluate(payer);
+        }
+        catch {
+            // Attestation error → paid path.
+            return { free: false, record };
+        }
+        if (!evaluation.pass)
+            return { free: false, record };
+        let claimed;
+        try {
+            claimed = await recorder.claim(key, record.expires, record.owner, 'free');
+        }
+        catch {
+            // The store cannot record the credential, so it gets no free access.
+            return { free: false, record };
+        }
+        if (!claimed) {
+            if (!record.payment)
+                return { free: false };
+            throw refuse();
+        }
+        return {
+            free: true,
+            receipt: {
                 method: server.name,
-                reference: `condition-gate:free:${attestation.id}`,
+                reference: `condition-gate:free:${evaluation.attestationId}`,
                 status: 'success',
                 timestamp: new Date().toISOString(),
-            };
+            },
+        };
+    }
+    /** Runs the gate, then the original method on the paid path. */
+    async function gated(original, params) {
+        const attempt = await tryFree(params);
+        if (attempt.free)
+            return attempt.receipt;
+        const record = attempt.record;
+        let claimed = false;
+        // Only a payment is recorded on this path. A Tempo proof moves no value, so
+        // the method's own rules decide whether it may be presented again.
+        if (record && record.payment) {
+            // Claimed before settlement, so a copy presented while this payment is
+            // in flight is refused too. Kept until the credential itself expires.
+            let result;
+            try {
+                result = await recorder.claim(record.key, record.expires, record.owner, 'paid');
+            }
+            catch {
+                // Cannot record: pay as bare mppx would; the method's own replay protection applies.
+                result = null;
+            }
+            if (result === false)
+                throw refuse();
+            claimed = result === true;
         }
-        catch {
-            // Attestation error → paid path.
-            return null;
+        try {
+            return await original(params);
+        }
+        catch (error) {
+            // A payment that fails is released, so the holder can retry with the same credential.
+            if (claimed) {
+                try {
+                    await recorder.release(record.key);
+                }
+                catch {
+                    // Stays recorded until it expires.
+                }
+            }
+            throw error;
         }
     }
     const wrapped = { ...server };
     if (typeof originalBroadcast === 'function') {
-        wrapped.broadcast = async (params) => (await tryFree(params)) ?? originalBroadcast(params);
+        wrapped.broadcast = async (params) => gated(originalBroadcast, params);
     }
-    wrapped.verify = async (params) => (await tryFree(params)) ?? originalVerify(params);
+    wrapped.verify = async (params) => gated(originalVerify, params);
     return wrapped;
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuNA,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;AAE3C,SAAS,gBAAgB,CAAC,CAAY;IACpC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,cAAc,CAAA;IACpD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAA;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,UAAuB;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,uBAAuB;IACrC,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,OAAwB,CAAA;AACjC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AACzB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AACzB,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,mBAAmB,CAAC,UAAuB;IAClD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC9B,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACtD,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAA;YACD,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACvC,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAA;YACD,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAA;YACD,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,iCAAiC;QACjC,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAA;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,CAAA;YACpC,IAAI,CAAC,SAAS,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9E,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YACxD,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACxD,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,UAAiD,EACjD,UAAuB,EACvB,OAA4D;IAE5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+FAA+F;YAC/F,kEAAkE,CACnE,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,8BAA8B,CAAA;IAEpE,MAAM,IAAI,GAA4B;QACpC,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC;KAC5C,CAAA;IAED,IAAI,UAAU,KAAK,QAAQ;QAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAA;SAClD,IAAI,UAAU,KAAK,MAAM;QAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAA;SACnD,IAAI,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAA;;QACzD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAEzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,WAAW,EAAE,MAAM;SACpB;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAA;IACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAI,IAAY,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAA;QACtE,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkB;IAElB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC7C,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAChD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAEjD,wEAAwE;IACxE,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAwB,EACxB,OAA6B;IAE7B,MAAM,EAAE,UAAU,EAAE,SAAS,GAAG,KAAK,EAAE,eAAe,GAAG,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAErF,MAAM,SAAS,GAAG,MAIjB,CAAA;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAA;IACvC,MAAM,iBAAiB,GAAG,SAAS,CAAC,SAAS,CAAA;IAC7C,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAA;IAE3C,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,OAAO,GACX,OAAO,WAAW,KAAK,UAAU,IAAI,OAAO,gBAAgB,KAAK,UAAU,CAAA;IAE7E,6DAA6D;IAC7D,KAAK,UAAU,OAAO,CAAC,MAAW;QAChC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QAEzB,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAiB,CAAC,MAAM,CAAC,CAAA;YAClD,OAAO,GAAI,UAAgD,EAAE,OAAO,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,QAAqB,CAAA;QACzB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,WAAY,CAAC,OAAO,CAAC,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YAC7B,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,SAAS,EAAE,uBAAuB,MAAM,CAAC,aAAa,EAAE;gBACxD,MAAM,EAAE,SAAkB;gBAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAA;YAE3C,MAAM,IAAI,GACR,SAAS,KAAK,KAAK;gBACjB,CAAC,CAAC,WAAW,CAAC,IAAI;gBAClB,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YAE5C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBACb,IAAI;gBACJ,aAAa,EAAE,WAAW,CAAC,EAAE;gBAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI;aAC/C,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,SAAS,EAAE,uBAAuB,WAAW,CAAC,EAAE,EAAE;gBAClD,MAAM,EAAE,SAAkB;gBAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAwC,CAAA;IAEnE,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,CAAC,SAAS,GAAG,KAAK,EAAE,MAAW,EAAE,EAAE,CACxC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,MAAW,EAAE,EAAE,CACrC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;IAEnD,OAAO,OAAsC,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AA6P7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;AAE3C,SAAS,gBAAgB,CAAC,CAAY;IACpC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,cAAc,CAAA;IACpD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAA;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,UAAuB;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB;IACrC,KAAK,CAAC,KAAK,EAAE,CAAA;IACb,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,gBAAgB,CAAC,KAAK,EAAE,CAAA;IACxB,SAAS,GAAG,CAAC,CAAA;IACb,SAAS,GAAG,CAAC,CAAA;IACb,WAAW,GAAG,CAAC,CAAA;AACjB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AAExE,6EAA6E;AAC7E,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAA;AAChC,MAAM,uCAAuC,GAAG,GAAG,CAAA;AACnD,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,OAAO,CAAA;AACtC,MAAM,iCAAiC,GAAG,KAAK,CAAA;AAC/C,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,OAAO,CAAA;AACtC,MAAM,sBAAsB,GAAG,MAAM,CAAA;AAKrC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAA;AACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAA;AAClD,IAAI,SAAS,GAAG,CAAC,CAAA;AACjB,IAAI,SAAS,GAAG,CAAC,CAAA;AACjB,IAAI,WAAW,GAAG,CAAC,CAAA;AAEnB,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,SAAS,EAAE,CAAA;QACX,OAAM;IACR,CAAC;IACD,SAAS,EAAE,CAAA;IACX,MAAM,SAAS,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,SAAS,IAAI,CAAC;QAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;;QACpD,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;AACpD,CAAC;AAUD,MAAM,eAAe,GAAa;IAChC,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5D,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,cAAc;gBAAE,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;oBAAE,aAAa,CAAC,CAAC,CAAC,CAAA;YACrF,WAAW,GAAG,GAAG,GAAG,sBAAsB,CAAA;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,OAAO,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAA;YACvC,aAAa,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC7C,IAAI,SAAS,IAAI,sBAAsB,IAAI,IAAI,IAAI,iCAAiC,EAAE,CAAC;gBACrF,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;YAC1F,CAAC;YACD,SAAS,EAAE,CAAA;YACX,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,SAAS,IAAI,sBAAsB,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;YACtE,CAAC;YACD,SAAS,EAAE,CAAA;QACb,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,aAAa,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC;CACF,CAAA;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;QAC3D,KAA4B,CAAC,IAAI,KAAK,aAAa,CACrD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAkB,EAAE,GAAW,EAAE,OAAe;IACtE,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,OAAO,KAAK,CAAC,MAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAA;QAC5E,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAClF,OAAO,KAAK;YACV,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAC/B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAC1E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAkB;IACvC,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,qFAAqF;YACrF,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YACjD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpC,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAChE,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO;YACtB,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACvB,OAAM;YACR,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAClC,cAAc,CAAC,OAAO,CAAC;oBACrB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;oBACrC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CACtC,CAAA;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACjG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAe,EAAE,YAAoB;IAC9E,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAA;IACnC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChE,IAAI,EAAE,GAAkB,IAAI,CAAA;IAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,IAAI,IAAI,KAAK;YAAE,EAAE,GAAG,iBAAiB,IAAI,IAAI,KAAK,EAAE,CAAA;IAC1D,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,EAAE,GAAG,SAAS,WAAW,IAAI,YAAY,CAAC,WAAW,EAAE,EAAE,CAAA;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,UAAU,IAAI,EAAE,EAAE,CAAA;AACvE,CAAC;AAED,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,UAAe;IACvC,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAA;IACnC,IAAI,OAAO,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;QACtC,mEAAmE;QACnE,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACpF,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;AACpE,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,OAAwB,CAAA;AACjC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AACzB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AACzB,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,mBAAmB,CAAC,UAAuB;IAClD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC9B,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACtD,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAA;YACD,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACvC,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAA;YACD,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,GAA4B;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAA;YACD,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,iCAAiC;QACjC,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAA;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,CAAA;YACpC,IAAI,CAAC,SAAS,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9E,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;YACxD,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACxD,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,UAAiD,EACjD,UAAuB,EACvB,OAA4D;IAE5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+FAA+F;YAC/F,kEAAkE,CACnE,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,8BAA8B,CAAA;IAEpE,MAAM,IAAI,GAA4B;QACpC,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC;KAC5C,CAAA;IAED,IAAI,UAAU,KAAK,QAAQ;QAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAA;SAClD,IAAI,UAAU,KAAK,MAAM;QAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAA;SACnD,IAAI,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAA;;QACzD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAEzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,WAAW,EAAE,MAAM;SACpB;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAA;IACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAI,IAAY,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAA;QACtE,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkB;IAElB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC7C,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAChD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAEjD,wEAAwE;IACxE,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAwB,EACxB,OAA6B;IAE7B,MAAM,EAAE,UAAU,EAAE,SAAS,GAAG,KAAK,EAAE,eAAe,GAAG,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IACrF,MAAM,eAAe,GAAG,OAAO,CAAC,4BAA4B,IAAI,uCAAuC,CAAA;IACvG,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAA;IACrH,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,GAAG,IAAI,CAAA;IAE5C,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC/B,IACE,WAAW,KAAK,SAAS;QACzB,OAAO,WAAW,CAAC,QAAQ,KAAK,UAAU;QAC1C,OAAO,WAAW,CAAC,MAAM,KAAK,UAAU,EACxC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAA;IACtH,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,CAAA;IAE3E,MAAM,SAAS,GAAG,MAIjB,CAAA;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAA;IACvC,MAAM,iBAAiB,GAAG,SAAS,CAAC,SAAS,CAAA;IAC7C,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAA;IAE3C,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,OAAO,GACX,OAAO,WAAW,KAAK,UAAU,IAAI,OAAO,gBAAgB,KAAK,UAAU,CAAA;IAE7E,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,IAAI,MAAM,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC,CAAA;IAE9F,2FAA2F;IAC3F,KAAK,UAAU,QAAQ,CAAC,KAA4C;QAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAA;QAE1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAA;QAC3C,MAAM,IAAI,GACR,SAAS,KAAK,KAAK;YACjB,CAAC,CAAC,WAAW,CAAC,IAAI;YAClB,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG;YACZ,IAAI;YACJ,aAAa,EAAE,WAAW,CAAC,EAAE;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI;SAC/C,CAAA;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAMD,mFAAmF;IACnF,KAAK,UAAU,OAAO,CAAC,MAAW;QAChC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAEpC,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAiB,CAAC,MAAM,CAAC,CAAA;YAClD,OAAO,GAAI,UAAgD,EAAE,OAAO,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACxB,CAAC;QAED,IAAI,QAAqB,CAAA;QACzB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,WAAY,CAAC,OAAO,CAAC,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACxB,CAAC;QAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAElC,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,CAAA;QACrC,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAE3D,MAAM,MAAM,GAAG;YACb,GAAG;YACH,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;YAClC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACnE,sFAAsF;YACtF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,KAAK,eAAe;SACvD,CAAA;QAED,0EAA0E;QAC1E,IAAI,KAAc,CAAA;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAChC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;YAC3C,MAAM,MAAM,EAAE,CAAA;QAChB,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAEvE,IAAI,UAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;YACjC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAEpD,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;YAC3C,MAAM,MAAM,EAAE,CAAA;QAChB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,SAAS,EAAE,uBAAuB,UAAU,CAAC,aAAa,EAAE;gBAC5D,MAAM,EAAE,SAAkB;gBAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;SACF,CAAA;IACH,CAAC;IAED,gEAAgE;IAChE,KAAK,UAAU,KAAK,CAAC,QAAuC,EAAE,MAAW;QACvE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAA;QAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,4EAA4E;QAC5E,mEAAmE;QACnE,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,MAAsB,CAAA;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACjF,CAAC;YAAC,MAAM,CAAC;gBACP,qFAAqF;gBACrF,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;YACD,IAAI,MAAM,KAAK,KAAK;gBAAE,MAAM,MAAM,EAAE,CAAA;YACpC,OAAO,GAAG,MAAM,KAAK,IAAI,CAAA;QAC3B,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAO,CAAC,GAAG,CAAC,CAAA;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAwC,CAAA;IAEnE,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,CAAC,SAAS,GAAG,KAAK,EAAE,MAAW,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,MAAW,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAErE,OAAO,OAAsC,CAAA;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insumermodel/mppx-condition-gate",
-  "version": "3.0.2",
+  "version": "3.1.0",
   "description": "Condition-based access for mppx routes. Wallet auth via signed attestations. Six condition types: token balance, NFT ownership, EAS attestation, Farcaster ID, ratio_to_amount, ratio_to_supply.",
   "type": "module",
   "main": "dist/index.js",
@@ -45,16 +45,12 @@
     "url": "git+https://github.com/douglasborthwick-crypto/mppx-condition-gate.git"
   },
   "peerDependencies": {
-    "mppx": ">=0.1.0"
-  },
-  "peerDependenciesMeta": {
-    "mppx": {
-      "optional": true
-    }
+    "mppx": ">=0.8.14"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",
-    "mppx": "latest",
-    "typescript": "^5.7.0"
+    "mppx": "0.9.3",
+    "typescript": "^5.7.0",
+    "viem": "2.56.5"
   }
 }

package/src/index.ts

@@ -1,4 +1,5 @@
 import type { Method, Receipt } from 'mppx'
+import { Errors } from 'mppx'
 
 // ---------------------------------------------------------------------------
 // Types
@@ -160,6 +161,44 @@ export type ConditionGateOptions = {
    * with `format: "jwt"` directly if you need the `jwt` and `pqJwt` tokens.
    */
   jwt?: boolean
+  /**
+   * Where the gate records credentials it has accepted, so each one gets
+   * through at most once. Defaults to a bounded in-process store.
+   *
+   * Pass a shared store when the route runs on more than one instance, or a
+   * credential used on one instance can be presented again on another. The
+   * store must claim atomically and remove expired entries: `Store.redis`,
+   * `Store.upstash` or `Store.cloudflare` from `mppx/server` built from a client
+   * that exposes an atomic `update`, or any store with an atomic `tryClaim`.
+   * mppx's `Store.memory()` never removes expired entries; use it only in tests.
+   */
+  replayStore?: ReplayStore
+  /**
+   * Longest remaining validity, in seconds, a credential may have and still be
+   * given free access. Defaults to 600. The gate has to remember a credential
+   * until it expires, and x402 clients choose their own expiry, so longer-lived
+   * credentials take the paid path instead.
+   */
+  maxCredentialLifetimeSeconds?: number
+}
+
+/**
+ * An atomic claim store. Structurally compatible with mppx's `AtomicStore`:
+ * `tryClaim` is used when present, otherwise `update`. `get`, when present,
+ * lets the gate refuse a repeat before spending an attestation on it, and
+ * `delete` (or `update`) lets it release a credential whose payment failed.
+ */
+export type ReplayStore = {
+  get?: (key: string) => unknown | Promise<unknown>
+  delete?: (key: string) => void | Promise<void>
+  tryClaim?: (key: string, expires: number) => boolean | Promise<boolean>
+  update?: <result>(
+    key: string,
+    fn: (current: any) =>
+      | { op: 'noop'; result: result }
+      | { op: 'set'; value: any; result: result }
+      | { op: 'delete'; result: result },
+  ) => Promise<result>
 }
 
 export type InsumerAttestation = {
@@ -232,9 +271,199 @@ function cacheKey(address: string, conditions: Condition[]): string {
   return `${address.toLowerCase()}:${JSON.stringify(sorted)}`
 }
 
-/** Clear the in-memory ownership cache. Useful in tests. */
+/** Clear the in-memory ownership cache and the default replay store. Useful in tests. */
 export function clearConditionGateCache(): void {
   cache.clear()
+  defaultMarkers.clear()
+  freeCountByOwner.clear()
+  freeCount = 0
+  paidCount = 0
+  nextSweepAt = 0
+}
+
+// ---------------------------------------------------------------------------
+// Single-use credentials
+// ---------------------------------------------------------------------------
+
+// mppx makes a credential single-use when it settles: the on-chain nonce is
+// spent, or the method claims the hash or proof in its store. `validate` is
+// non-mutating by design, so a credential that is granted free access and
+// never settled would otherwise stay usable by anyone who holds a copy.
+
+/** Kept this long past the credential's own expiry, to absorb clock skew. */
+const REPLAY_SKEW_MS = 60 * 1000
+const DEFAULT_MAX_CREDENTIAL_LIFETIME_SECONDS = 600
+/** Default store: live free grants across the process, and per wallet. */
+const DEFAULT_STORE_MAX_FREE = 100_000
+const DEFAULT_STORE_MAX_FREE_PER_WALLET = 5_000
+/** Default store: payments it remembers. Past this it stops recording payments. */
+const DEFAULT_STORE_MAX_PAID = 100_000
+const DEFAULT_STORE_SWEEP_MS = 60_000
+
+type RecordKind = 'free' | 'paid'
+type DefaultMarker = { expires: number; owner: string; kind: RecordKind }
+
+const defaultMarkers = new Map<string, DefaultMarker>()
+const freeCountByOwner = new Map<string, number>()
+let freeCount = 0
+let paidCount = 0
+let nextSweepAt = 0
+
+function forgetDefault(key: string): void {
+  const marker = defaultMarkers.get(key)
+  if (!marker) return
+  defaultMarkers.delete(key)
+  if (marker.kind === 'paid') {
+    paidCount--
+    return
+  }
+  freeCount--
+  const remaining = (freeCountByOwner.get(marker.owner) ?? 1) - 1
+  if (remaining <= 0) freeCountByOwner.delete(marker.owner)
+  else freeCountByOwner.set(marker.owner, remaining)
+}
+
+/** What the gate needs from a store. The default store and a caller's store both sit behind it. */
+type Recorder = {
+  isTaken(key: string): Promise<boolean>
+  /** true when claimed, false when already taken; throws when it cannot record. */
+  claim(key: string, expires: number, owner: string, kind: RecordKind): Promise<boolean>
+  release(key: string): Promise<void>
+}
+
+const defaultRecorder: Recorder = {
+  async isTaken(key) {
+    const marker = defaultMarkers.get(key)
+    return marker !== undefined && marker.expires > Date.now()
+  },
+  async claim(key, expires, owner, kind) {
+    const now = Date.now()
+    if (now >= nextSweepAt) {
+      for (const [k, marker] of defaultMarkers) if (marker.expires <= now) forgetDefault(k)
+      nextSweepAt = now + DEFAULT_STORE_SWEEP_MS
+    }
+    const current = defaultMarkers.get(key)
+    if (current !== undefined) {
+      if (current.expires > now) return false
+      forgetDefault(key)
+    }
+    if (kind === 'free') {
+      const held = freeCountByOwner.get(owner) ?? 0
+      if (freeCount >= DEFAULT_STORE_MAX_FREE || held >= DEFAULT_STORE_MAX_FREE_PER_WALLET) {
+        throw new Error('mppx-condition-gate: default replay store has no room for this wallet')
+      }
+      freeCount++
+      freeCountByOwner.set(owner, held + 1)
+    } else {
+      if (paidCount >= DEFAULT_STORE_MAX_PAID) {
+        throw new Error('mppx-condition-gate: default replay store is full')
+      }
+      paidCount++
+    }
+    defaultMarkers.set(key, { expires, owner, kind })
+    return true
+  },
+  async release(key) {
+    forgetDefault(key)
+  },
+}
+
+function isReplayMarker(value: unknown): value is { expires: number; type: 'mppx:replay' } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    typeof (value as { expires?: unknown }).expires === 'number' &&
+    (value as { type?: unknown }).type === 'mppx:replay'
+  )
+}
+
+async function tryClaim(store: ReplayStore, key: string, expires: number): Promise<boolean> {
+  if (typeof store.tryClaim === 'function') return store.tryClaim(key, expires)
+  // Same marker as mppx's Store.tryClaim. A live marker, or any other stored
+  // value, counts as taken; an empty slot or an expired marker does not.
+  return store.update!(key, (current) => {
+    const empty = current === null || current === undefined || current === false
+    const taken = !empty && (!isReplayMarker(current) || current.expires > Date.now())
+    return taken
+      ? { op: 'noop', result: false }
+      : { op: 'set', value: { expires, type: 'mppx:replay' }, result: true }
+  })
+}
+
+function storeRecorder(store: ReplayStore): Recorder {
+  return {
+    async isTaken(key) {
+      // Advisory only: the atomic claim decides. Anything but a live marker reads as free.
+      if (typeof store.get !== 'function') return false
+      const current = await store.get(key)
+      return isReplayMarker(current) && current.expires > Date.now()
+    },
+    async claim(key, expires) {
+      return tryClaim(store, key, expires)
+    },
+    async release(key) {
+      if (typeof store.delete === 'function') {
+        await store.delete(key)
+        return
+      }
+      if (typeof store.update === 'function') {
+        await store.update(key, (current) =>
+          isReplayMarker(current)
+            ? { op: 'delete', result: undefined }
+            : { op: 'noop', result: undefined },
+        )
+      }
+    },
+  }
+}
+
+function lowerHex(value: unknown): string | null {
+  return typeof value === 'string' && /^0x[0-9a-fA-F]+$/.test(value) ? value.toLowerCase() : null
+}
+
+/**
+ * One key that identifies the credential, or null when the gate cannot
+ * identify it safely, in which case it gets no free access.
+ *
+ * - EIP-3009 authorization (mppx EVM charge, native and x402): signer + nonce.
+ *   Neither changes when the signature is re-encoded or the challenge is
+ *   rebuilt, and two users never share one.
+ * - Tempo proof: challenge id + proven payer. The proof signs the challenge
+ *   id, so it cannot be moved to another challenge.
+ *
+ * Other credential types are payments in their own right (a Tempo hash is a
+ * transfer already on chain, a Tempo transaction is one waiting to be sent),
+ * so they take the paid path, where the method's own replay protection applies.
+ */
+function credentialKey(methodName: string, credential: any, payerAddress: string): string | null {
+  const payload = credential?.payload
+  if (payload === null || typeof payload !== 'object') return null
+  let id: string | null = null
+  if (payload.type === 'authorization') {
+    const from = lowerHex(payload.from)
+    const nonce = lowerHex(payload.nonce)
+    if (from && nonce) id = `authorization:${from}:${nonce}`
+  } else if (payload.type === 'proof') {
+    const challengeId = credential?.challenge?.id
+    if (typeof challengeId === 'string' && challengeId.length > 0) {
+      id = `proof:${challengeId}:${payerAddress.toLowerCase()}`
+    }
+  }
+  return id === null ? null : `mppx-condition-gate:${methodName}:${id}`
+}
+
+/** The latest moment the credential could still be accepted, or null if unknown. */
+function credentialExpiry(credential: any): number | null {
+  const payload = credential?.payload
+  if (payload?.type === 'authorization') {
+    // An authorization is bounded by its own validBefore. For x402 the
+    // challenge is rebuilt on every request, so its expiry says nothing about
+    // the credential; a native credential's validBefore is its challenge's expiry.
+    const validBefore = Number(payload.validBefore)
+    return Number.isFinite(validBefore) && validBefore > 0 ? validBefore * 1000 : null
+  }
+  const challengeExpires = Date.parse(credential?.challenge?.expires)
+  return Number.isFinite(challengeExpires) ? challengeExpires : null
 }
 
 // ---------------------------------------------------------------------------
@@ -438,6 +667,16 @@ export function normalizeProvenPayer(
  * credential that fails validation, conditions not met, or an attestation
  * error. There is no path from an unproven wallet to a free receipt.
  *
+ * Each credential gets free access at most once. The gate records a
+ * credential when it grants free access, and records an authorization just
+ * before the paid path settles it; a recorded credential is refused with a
+ * verification error rather than passed on to payment. A payment that fails is
+ * released, so it can be retried. See the README for the limits of this. Free access is given only to credentials the gate can identify
+ * (EIP-3009 authorizations and Tempo proofs) whose remaining validity is within
+ * `maxCredentialLifetimeSeconds`. The default store is bounded and shared by
+ * every gated route in the process; pass a shared `replayStore` for production
+ * traffic or when the route runs on more than one instance.
+ *
  * Conditions are evaluated across the 35 chains this adapter reaches (32 EVM +
  * Solana + XRPL + Bitcoin; the engine itself covers 38). Six condition types
  * are typed here: token_balance, nft_ownership, eas_attestation, farcaster_id,
@@ -452,8 +691,9 @@ export function normalizeProvenPayer(
  * ```ts
  * import { conditionGate } from '@insumermodel/mppx-condition-gate'
  *
- * const gated = conditionGate(tempoCharge, {
+ * const gated = conditionGate(evmCharge, {
  *   // Return only a payer this method has proven for THIS request.
+ *   // mppx's EVM charge reports the recovered signer as `payer`.
  *   provenPayer: (details) => (details as { payer?: string }).payer ?? null,
  *   conditions: [
  *     { type: 'eas_attestation', template: 'coinbase_verified_account', chainId: 8453 },
@@ -470,6 +710,21 @@ export function conditionGate(
   options: ConditionGateOptions,
 ): Method.AnyServer {
   const { conditions, matchMode = 'any', cacheTtlSeconds = 300, provenPayer } = options
+  const lifetimeSeconds = options.maxCredentialLifetimeSeconds ?? DEFAULT_MAX_CREDENTIAL_LIFETIME_SECONDS
+  if (typeof lifetimeSeconds !== 'number' || !Number.isFinite(lifetimeSeconds) || lifetimeSeconds < 0) {
+    throw new Error('mppx-condition-gate: maxCredentialLifetimeSeconds must be a finite number of seconds, 0 or more.')
+  }
+  const maxLifetimeMs = lifetimeSeconds * 1000
+
+  const { replayStore } = options
+  if (
+    replayStore !== undefined &&
+    typeof replayStore.tryClaim !== 'function' &&
+    typeof replayStore.update !== 'function'
+  ) {
+    throw new Error('mppx-condition-gate: replayStore must provide an atomic tryClaim or update (an mppx AtomicStore).')
+  }
+  const recorder = replayStore ? storeRecorder(replayStore) : defaultRecorder
 
   const anyServer = server as unknown as {
     verify: (params: any) => Promise<any>
@@ -488,9 +743,37 @@ export function conditionGate(
   const canGate =
     typeof provenPayer === 'function' && typeof originalValidate === 'function'
 
-  /** Returns a free receipt, or null to take the paid path. */
-  async function tryFree(params: any): Promise<any | null> {
-    if (!canGate) return null
+  const refuse = () =>
+    new Errors.VerificationFailedError({ reason: 'this credential has already been presented' })
+
+  /** Attestation result for a payer, from the cache or a fresh call. Throws on API error. */
+  async function evaluate(payer: { address: string; type: WalletType }) {
+    const key = cacheKey(payer.address, conditions)
+    const cached = cache.get(key)
+    if (cached && cached.expiresAt > Date.now()) return cached
+
+    const result = await callAttest(payer.address, payer.type, conditions, options)
+    const attestation = result.data.attestation
+    const pass =
+      matchMode === 'all'
+        ? attestation.pass
+        : attestation.results.some((r) => r.met)
+    const entry = {
+      pass,
+      attestationId: attestation.id,
+      expiresAt: Date.now() + cacheTtlSeconds * 1000,
+    }
+    cache.set(key, entry)
+    return entry
+  }
+
+  type Attempt =
+    | { free: true; receipt: any }
+    | { free: false; record?: { key: string; expires: number; owner: string; payment: boolean } }
+
+  /** Decides between a free receipt and the paid path. Throws to refuse a repeat. */
+  async function tryFree(params: any): Promise<Attempt> {
+    if (!canGate) return { free: false }
 
     let details: unknown
     try {
@@ -498,68 +781,124 @@ export function conditionGate(
       details = (validation as { details?: unknown } | undefined)?.details
     } catch {
       // Credential is not currently acceptable → let the payment method decide.
-      return null
+      return { free: false }
     }
 
     let resolved: ProvenPayer
     try {
       resolved = await provenPayer!(details)
     } catch {
-      return null
+      return { free: false }
     }
 
     const payer = normalizeProvenPayer(resolved)
-    if (!payer) return null
+    if (!payer) return { free: false }
+
+    const credential = params?.credential
+    const key = credentialKey(server.name, credential, payer.address)
+    const expiry = credentialExpiry(credential)
+    if (key === null || expiry === null) return { free: false }
+
+    const record = {
+      key,
+      owner: payer.address.toLowerCase(),
+      expires: Math.min(expiry + REPLAY_SKEW_MS, Number.MAX_SAFE_INTEGER),
+      // Only an authorization moves value; a Tempo proof is accepted on zero-amount routes.
+      payment: credential?.payload?.type === 'authorization',
+    }
 
-    const key = cacheKey(payer.address, conditions)
-    const cached = cache.get(key)
-    if (cached && cached.expiresAt > Date.now()) {
-      if (!cached.pass) return null
-      return {
+    // A recorded credential is refused before any attestation is spent on it.
+    let taken: boolean
+    try {
+      taken = await recorder.isTaken(key)
+    } catch {
+      return { free: false, record }
+    }
+    if (taken) {
+      // A repeated Tempo proof moves no value, so the method decides; a payment is refused.
+      if (!record.payment) return { free: false }
+      throw refuse()
+    }
+
+    if (expiry - Date.now() > maxLifetimeMs) return { free: false, record }
+
+    let evaluation: CacheEntry
+    try {
+      evaluation = await evaluate(payer)
+    } catch {
+      // Attestation error → paid path.
+      return { free: false, record }
+    }
+    if (!evaluation.pass) return { free: false, record }
+
+    let claimed: boolean
+    try {
+      claimed = await recorder.claim(key, record.expires, record.owner, 'free')
+    } catch {
+      // The store cannot record the credential, so it gets no free access.
+      return { free: false, record }
+    }
+    if (!claimed) {
+      if (!record.payment) return { free: false }
+      throw refuse()
+    }
+
+    return {
+      free: true,
+      receipt: {
         method: server.name,
-        reference: `condition-gate:free:${cached.attestationId}`,
+        reference: `condition-gate:free:${evaluation.attestationId}`,
         status: 'success' as const,
         timestamp: new Date().toISOString(),
+      },
+    }
+  }
+
+  /** Runs the gate, then the original method on the paid path. */
+  async function gated(original: (params: any) => Promise<any>, params: any) {
+    const attempt = await tryFree(params)
+    if (attempt.free) return attempt.receipt
+
+    const record = attempt.record
+    let claimed = false
+    // Only a payment is recorded on this path. A Tempo proof moves no value, so
+    // the method's own rules decide whether it may be presented again.
+    if (record && record.payment) {
+      // Claimed before settlement, so a copy presented while this payment is
+      // in flight is refused too. Kept until the credential itself expires.
+      let result: boolean | null
+      try {
+        result = await recorder.claim(record.key, record.expires, record.owner, 'paid')
+      } catch {
+        // Cannot record: pay as bare mppx would; the method's own replay protection applies.
+        result = null
       }
+      if (result === false) throw refuse()
+      claimed = result === true
     }
 
     try {
-      const result = await callAttest(payer.address, payer.type, conditions, options)
-      const attestation = result.data.attestation
-
-      const pass =
-        matchMode === 'all'
-          ? attestation.pass
-          : attestation.results.some((r) => r.met)
-
-      cache.set(key, {
-        pass,
-        attestationId: attestation.id,
-        expiresAt: Date.now() + cacheTtlSeconds * 1000,
-      })
-
-      if (!pass) return null
-      return {
-        method: server.name,
-        reference: `condition-gate:free:${attestation.id}`,
-        status: 'success' as const,
-        timestamp: new Date().toISOString(),
+      return await original(params)
+    } catch (error) {
+      // A payment that fails is released, so the holder can retry with the same credential.
+      if (claimed) {
+        try {
+          await recorder.release(record!.key)
+        } catch {
+          // Stays recorded until it expires.
+        }
       }
-    } catch {
-      // Attestation error → paid path.
-      return null
+      throw error
     }
   }
 
   const wrapped = { ...server } as unknown as Record<string, unknown>
 
   if (typeof originalBroadcast === 'function') {
-    wrapped.broadcast = async (params: any) =>
-      (await tryFree(params)) ?? originalBroadcast(params)
+    wrapped.broadcast = async (params: any) => gated(originalBroadcast, params)
   }
 
-  wrapped.verify = async (params: any) =>
-    (await tryFree(params)) ?? originalVerify(params)
+  wrapped.verify = async (params: any) => gated(originalVerify, params)
 
   return wrapped as unknown as Method.AnyServer
 }