@jaw.id/cli 0.1.26 → 0.2.1

package/dist/commands/x402/pay.js

@@ -0,0 +1,2122 @@
+import { Command, Flags, Args } from '@oclif/core';
+import * as fs5 from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as crypto2 from 'crypto';
+import { randomBytes } from 'crypto';
+import { parseAbi, encodeFunctionData, maxUint256, erc20Abi, createPublicClient, isAddress, http, zeroAddress, BaseError, ContractFunctionRevertedError, formatUnits } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+import { hashTypedData, wrapTypedDataSignature } from 'viem/experimental/erc7739';
+import { polygonAmoy, polygon, baseSepolia, base } from 'viem/chains';
+import { z } from 'zod';
+
+// src/commands/x402/pay.ts
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var PATHS = {
+  root: JAW_DIR,
+  config: path.join(JAW_DIR, "config.json"),
+  session: path.join(JAW_DIR, "session.json"),
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
+};
+
+// src/lib/config.ts
+function ensureDir(dir) {
+  fs5.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs5.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
+function loadConfig() {
+  if (!fs5.existsSync(PATHS.config)) {
+    return {};
+  }
+  const raw = fs5.readFileSync(PATHS.config, "utf-8");
+  try {
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
+  } catch {
+    throw new Error(
+      `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
+    );
+  }
+}
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs5.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+
+// src/lib/output.ts
+function formatOutput(data, format) {
+  if (format === "json") {
+    return JSON.stringify(data, replaceBigInt, 2);
+  }
+  return formatHuman(data);
+}
+function replaceBigInt(_key, value) {
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return value;
+}
+function formatHuman(data, indent = 0) {
+  if (data === null || data === void 0) {
+    return "null";
+  }
+  if (typeof data === "string" || typeof data === "number" || typeof data === "boolean" || typeof data === "bigint") {
+    return String(data);
+  }
+  if (Array.isArray(data)) {
+    if (data.length === 0) return "(empty)";
+    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join("\n");
+  }
+  if (typeof data === "object") {
+    const entries = Object.entries(data);
+    if (entries.length === 0) return "(empty)";
+    const pad = " ".repeat(indent);
+    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+    return entries.map(([key, val]) => {
+      const paddedKey = key.padEnd(maxKeyLen);
+      const valStr = typeof val === "object" && val !== null ? "\n" + formatHuman(val, indent + 2) : String(val);
+      return `${pad}${paddedKey}  ${valStr}`;
+    }).join("\n");
+  }
+  return String(data);
+}
+
+// src/base-command.ts
+var BaseCommand = class extends Command {
+  static baseFlags = {
+    output: Flags.string({
+      char: "o",
+      description: "Output format",
+      options: ["json", "human"],
+      default: "human",
+      env: "JAW_OUTPUT"
+    }),
+    chain: Flags.integer({
+      char: "c",
+      description: "Chain ID",
+      env: "JAW_CHAIN_ID"
+    }),
+    "api-key": Flags.string({
+      description: "JAW API key",
+      env: "JAW_API_KEY"
+    }),
+    yes: Flags.boolean({
+      char: "y",
+      description: "Skip confirmations (for AI agents)",
+      default: false
+    }),
+    quiet: Flags.boolean({
+      char: "q",
+      description: "Suppress non-essential output",
+      default: false
+    })
+  };
+  resolveApiKey(flags) {
+    const apiKey = flags["api-key"] ?? loadConfig().apiKey;
+    if (!apiKey) {
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
+    }
+    return apiKey;
+  }
+  resolveChainId(flags) {
+    const chainId = flags.chain ?? loadConfig().defaultChain;
+    if (!chainId) {
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
+    }
+    return chainId;
+  }
+  outputResult(data, format) {
+    const output = formatOutput(data, format);
+    this.log(output);
+  }
+};
+function isLegacySession(config) {
+  return config.mode !== "eip7702";
+}
+function loadSessionConfig() {
+  if (!fs5.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs5.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+function tryLoadSessionConfig() {
+  try {
+    return loadSessionConfig();
+  } catch {
+    return null;
+  }
+}
+function loadSessionKey() {
+  if (!fs5.existsSync(PATHS.keystore)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const contents = fs5.readFileSync(PATHS.keystore, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    throw new Error(`Keystore at ${PATHS.keystore} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+  return parsed.privateKey;
+}
+function keystoreExists() {
+  return fs5.existsSync(PATHS.keystore);
+}
+
+// src/x402/asset-registry.ts
+var USDC_BY_NETWORK = {
+  "eip155:8453": {
+    address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    chainId: 8453,
+    wireNetwork: "eip155:8453",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:84532": {
+    address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+    chainId: 84532,
+    wireNetwork: "eip155:84532",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:137": {
+    address: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
+    chainId: 137,
+    wireNetwork: "eip155:137",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:80002": {
+    address: "0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582",
+    chainId: 80002,
+    wireNetwork: "eip155:80002",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  }
+};
+function usdcForNetwork(network) {
+  return Object.hasOwn(USDC_BY_NETWORK, network) ? USDC_BY_NETWORK[network] : void 0;
+}
+
+// src/x402/permit2.ts
+var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var X402_UPTO_PROXY_ADDRESS = "0x4020A4f3b7b90ccA423B9fabCc0CE57C6C240002";
+var UPTO_VERIFIED_CHAIN_IDS = [8453, 84532];
+var PERMIT_WITNESS_TRANSFER_FROM_TYPES = {
+  PermitWitnessTransferFrom: [
+    { name: "permitted", type: "TokenPermissions" },
+    { name: "spender", type: "address" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" },
+    { name: "witness", type: "Witness" }
+  ],
+  TokenPermissions: [
+    { name: "token", type: "address" },
+    { name: "amount", type: "uint256" }
+  ],
+  Witness: [
+    { name: "to", type: "address" },
+    { name: "facilitator", type: "address" },
+    { name: "validAfter", type: "uint256" }
+  ]
+};
+function permit2Domain(chainId) {
+  return { name: "Permit2", chainId, verifyingContract: PERMIT2_ADDRESS };
+}
+
+// src/lib/session-bridge.ts
+var JAW_ERC20_PAYMASTER_URL = "https://api.justaname.id/proxy/v1/rpc/erc20-paymaster";
+function resolvePaymaster(options) {
+  if (options.paymasterUrl) {
+    return { paymasterUrl: options.paymasterUrl, paymasterContext: options.paymasterContext };
+  }
+  const configured = loadConfig().paymasters?.[options.chainId];
+  if (configured) {
+    return { paymasterUrl: configured.url, paymasterContext: configured.context };
+  }
+  if (!options.apiKey) return {};
+  const asset = usdcForNetwork(`eip155:${options.chainId}`);
+  if (!asset) {
+    console.warn(
+      `[jaw] No USDC in the x402 asset registry for chain ${options.chainId}, so no ERC-20 paymaster can be engaged. Gas will come out of the account\u2019s native balance. Set \`paymasters\` in your config to sponsor this chain.`
+    );
+    return {};
+  }
+  const url = new URL(JAW_ERC20_PAYMASTER_URL);
+  url.searchParams.set("chainId", String(options.chainId));
+  url.searchParams.set("api-key", options.apiKey);
+  return { paymasterUrl: url.toString(), paymasterContext: { token: asset.address } };
+}
+function explainUnchargeableSender(err, sessionAddress) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (!message.includes("Could not size the ERC-20 paymaster approval")) return err;
+  return new Error(
+    `${message}
+
+If ${sessionAddress} holds no USDC, that is why: it pays for its own gas and cannot be charged with an empty balance. Send it 0.1 USDC, or run \`jaw session setup\` again.`,
+    { cause: err }
+  );
+}
+var SessionBridge = class {
+  options;
+  session = null;
+  constructor(options) {
+    this.options = { ...options, ...resolvePaymaster(options) };
+  }
+  async getSession() {
+    if (this.session) {
+      this.checkExpiry(this.session.config);
+      return this.session;
+    }
+    const config = loadSessionConfig();
+    this.checkExpiry(config);
+    if (isLegacySession(config)) {
+      throw new Error(
+        "This session was created by an older CLI and uses a session address separate from the session key. Run `jaw session setup` to recreate it, which offers to revoke the old permission first. `jaw session status` still shows the old session, and `jaw session revoke` still revokes it."
+      );
+    }
+    if (config.chainId !== this.options.chainId) {
+      throw new Error(
+        `Session was created for chain ${config.chainId}, but --chain ${this.options.chainId} was requested. Run \`jaw session setup --chain ${this.options.chainId}\` to create a session for that chain.`
+      );
+    }
+    let privateKeyHex = loadSessionKey();
+    const { privateKeyToAccount: privateKeyToAccount2 } = await import('viem/accounts');
+    const localAccount = privateKeyToAccount2(privateKeyHex);
+    privateKeyHex = null;
+    const { Account } = await import('@jaw.id/core');
+    const account = await Account.fromLocalAccount(
+      {
+        chainId: this.options.chainId,
+        apiKey: this.options.apiKey,
+        paymasterUrl: this.options.paymasterUrl,
+        paymasterContext: this.options.paymasterContext
+      },
+      localAccount,
+      { eip7702: true }
+    );
+    if (account.address.toLowerCase() !== config.sessionAddress.toLowerCase()) {
+      throw new Error(
+        `Session key derives ${account.address}, but the stored session address is ${config.sessionAddress}. The keystore and session config are out of sync. Run \`jaw session setup\` to recreate the session.`
+      );
+    }
+    this.session = { account, config };
+    return this.session;
+  }
+  checkExpiry(config) {
+    if (config.expiry <= Date.now() / 1e3) {
+      const expiryDate = new Date(config.expiry * 1e3).toISOString();
+      throw new Error(`Session expired on ${expiryDate}. Run \`jaw session setup\` to create a new session.`);
+    }
+  }
+  /**
+   * Approve Permit2 to move one of the payer's tokens, and return the batch id.
+   *
+   * The only call this session sends outside its permission, and the only one
+   * that can be: `JustaPermissionManager` checks every call's selector against
+   * the grant, and the x402 grant permits `transfer` alone, so an approval
+   * routed through the permission reverts before anything else happens. Sent by
+   * the session on its own balance it never reaches the manager at all, whose
+   * approval revocation and Permit2 lockdown act on the granting account and
+   * only within their own execution.
+   *
+   * Being outside the permission is exactly why it is not a general send. It
+   * takes a token and nothing else: the spender is Permit2 and the amount is
+   * the maximum, neither reachable by a caller, and the token has to be the
+   * registry's USDC for this session's chain. There is no shape of argument
+   * that turns this into an arbitrary transfer, which matters because an agent
+   * reaches the tools that reach this.
+   */
+  async approvePermit2(token) {
+    const { account, config } = await this.getSession();
+    const usdc = usdcForNetwork(`eip155:${config.chainId}`);
+    if (!usdc || token.toLowerCase() !== usdc.address.toLowerCase()) {
+      throw new Error(
+        `Refusing to approve Permit2 for ${token}: only the registry USDC on chain ${config.chainId} is allowed.`
+      );
+    }
+    const data = encodeFunctionData({
+      abi: erc20Abi,
+      functionName: "approve",
+      args: [PERMIT2_ADDRESS, maxUint256]
+    });
+    try {
+      const sent = await account.sendCalls([{ to: usdc.address, data }]);
+      const id = typeof sent === "string" ? sent : sent?.id;
+      if (!id) throw new Error("approval submitted but no call id was returned");
+      return id;
+    } catch (err) {
+      throw explainUnchargeableSender(err, config.sessionAddress);
+    }
+  }
+  async request(method, params) {
+    const { account, config } = await this.getSession();
+    switch (method) {
+      case "eth_requestAccounts":
+      case "eth_accounts":
+        return [config.sessionAddress];
+      case "wallet_sendCalls": {
+        const payload = Array.isArray(params) ? params[0] : params;
+        const { calls } = payload;
+        const sendOptions = { permissionId: config.permissionId };
+        try {
+          return await account.sendCalls(calls, sendOptions);
+        } catch (err) {
+          throw explainUnchargeableSender(err, config.sessionAddress);
+        }
+      }
+      case "wallet_getCallsStatus": {
+        const batchId = Array.isArray(params) ? params[0] : params;
+        return account.getCallStatus(batchId);
+      }
+      // Refused rather than absent, so the reason is on screen instead of a
+      // caller reading "not supported in auto mode" and looking for a flag. See
+      // `supportsSessionMode` in rpc-classifier.ts for why.
+      case "personal_sign":
+      case "eth_signTypedData_v4":
+        throw new Error(
+          `${method} is not available in auto mode: a signature the session makes is not a call, so it never reaches the spend caps or the ledger. Run it through the browser instead.`
+        );
+      case "wallet_grantPermissions":
+        throw new Error("Requires browser \u2014 run `jaw session setup`.");
+      case "wallet_revokePermissions":
+        throw new Error("Requires browser \u2014 run `jaw session revoke`.");
+      default:
+        throw new Error(`Method ${method} is not supported in auto mode.`);
+    }
+  }
+  close() {
+  }
+};
+var isPayableAddress = (value) => typeof value === "string" && isAddress(value);
+var isHexShaped = (value) => typeof value === "string" && /^0x[0-9a-fA-F]{40}$/.test(value);
+var isZeroAddress = (value) => /^0x0{40}$/.test(value);
+
+// src/x402/scheme-exact-evm.ts
+var TRANSFER_WITH_AUTHORIZATION_TYPES = {
+  TransferWithAuthorization: [
+    { name: "from", type: "address" },
+    { name: "to", type: "address" },
+    { name: "value", type: "uint256" },
+    { name: "validAfter", type: "uint256" },
+    { name: "validBefore", type: "uint256" },
+    { name: "nonce", type: "bytes32" }
+  ]
+};
+async function buildExactPayment(requirement, from, sign, opts = {}) {
+  if (requirement.scheme !== "exact") {
+    throw new Error(`Not an exact requirement: ${requirement.scheme}`);
+  }
+  const asset = usdcForNetwork(requirement.network);
+  if (!asset) throw new Error(`Unsupported x402 network: ${requirement.network}`);
+  if (requirement.asset.toLowerCase() !== asset.address.toLowerCase()) {
+    throw new Error(
+      `x402 asset mismatch on ${requirement.network}: server asked for ${requirement.asset}, known USDC is ${asset.address}`
+    );
+  }
+  for (const [field, value] of [
+    ["asset", requirement.asset],
+    ["payTo", requirement.payTo]
+  ]) {
+    if (!isPayableAddress(value)) {
+      throw new Error(`x402 ${field} is not a readable address on ${requirement.network}: ${value}`);
+    }
+  }
+  if (isZeroAddress(requirement.payTo)) {
+    throw new Error(`x402 payTo is the zero address on ${requirement.network}`);
+  }
+  const verifyingContract = asset.address;
+  const name = typeof requirement.extra?.["name"] === "string" ? requirement.extra["name"] : asset.usdcName;
+  const version = typeof requirement.extra?.["version"] === "string" ? requirement.extra["version"] : asset.usdcVersion;
+  const nowSec = opts.now ?? Math.floor(Date.now() / 1e3);
+  const validAfter = "0";
+  const SETTLEMENT_WINDOW_FLOOR2 = 600;
+  const window = Math.max(requirement.maxTimeoutSeconds || 0, SETTLEMENT_WINDOW_FLOOR2);
+  const validBefore = String(nowSec + window);
+  const nonce = opts.nonce ?? `0x${randomBytes(32).toString("hex")}`;
+  const authorization = {
+    from,
+    to: requirement.payTo,
+    value: requirement.amount,
+    validAfter,
+    validBefore,
+    nonce
+  };
+  const signature = await sign({
+    domain: { name, version, chainId: asset.chainId, verifyingContract },
+    types: TRANSFER_WITH_AUTHORIZATION_TYPES,
+    primaryType: "TransferWithAuthorization",
+    message: {
+      from,
+      to: requirement.payTo,
+      value: BigInt(requirement.amount),
+      validAfter: BigInt(validAfter),
+      validBefore: BigInt(validBefore),
+      nonce
+    }
+  });
+  return { x402Version: 2, accepted: requirement, payload: { signature, authorization } };
+}
+function encodePaymentPayload(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64");
+}
+var SETTLEMENT_WINDOW_FLOOR = 600;
+var SETTLEMENT_WINDOW_CEILING = 3600;
+var VALID_AFTER_SLACK = 60;
+async function buildUptoPayment(requirement, from, sign, opts = {}) {
+  if (requirement.scheme !== "upto") {
+    throw new Error(`Not an upto requirement: ${requirement.scheme}`);
+  }
+  const asset = usdcForNetwork(requirement.network);
+  if (!asset) throw new Error(`Unsupported x402 network: ${requirement.network}`);
+  if (!UPTO_VERIFIED_CHAIN_IDS.includes(asset.chainId)) {
+    throw new Error(
+      `x402 upto is not available on ${requirement.network}: the settlement proxy is only verified on chain ids ${UPTO_VERIFIED_CHAIN_IDS.join(", ")}`
+    );
+  }
+  if (requirement.asset.toLowerCase() !== asset.address.toLowerCase()) {
+    throw new Error(
+      `x402 asset mismatch on ${requirement.network}: server asked for ${requirement.asset}, known USDC is ${asset.address}`
+    );
+  }
+  for (const [field, value] of [
+    ["asset", requirement.asset],
+    ["payTo", requirement.payTo]
+  ]) {
+    if (!isPayableAddress(value)) {
+      throw new Error(`x402 ${field} is not a readable address on ${requirement.network}: ${value}`);
+    }
+  }
+  if (isZeroAddress(requirement.payTo)) {
+    throw new Error(`x402 payTo is the zero address on ${requirement.network}`);
+  }
+  const advertisedFacilitator = requirement.extra?.["facilitatorAddress"];
+  if (!isHexShaped(advertisedFacilitator) || isZeroAddress(advertisedFacilitator)) {
+    throw new Error(
+      `x402 upto needs a settling facilitator in extra.facilitatorAddress on ${requirement.network}, got ${JSON.stringify(advertisedFacilitator)}`
+    );
+  }
+  if (!isPayableAddress(advertisedFacilitator)) {
+    throw new Error(
+      `x402 extra.facilitatorAddress is not a readable address on ${requirement.network}: ${advertisedFacilitator}`
+    );
+  }
+  const nowSec = opts.now ?? Math.floor(Date.now() / 1e3);
+  const window = Math.min(
+    Math.max(requirement.maxTimeoutSeconds || 0, SETTLEMENT_WINDOW_FLOOR),
+    SETTLEMENT_WINDOW_CEILING
+  );
+  const deadline = BigInt(nowSec + window);
+  const validAfter = BigInt(Math.max(nowSec - VALID_AFTER_SLACK, 0));
+  const nonce = opts.nonce ?? `0x${randomBytes(32).toString("hex")}`;
+  const message = {
+    permitted: { token: asset.address, amount: BigInt(requirement.amount) },
+    spender: X402_UPTO_PROXY_ADDRESS,
+    nonce: BigInt(nonce),
+    deadline,
+    witness: { to: requirement.payTo, facilitator: advertisedFacilitator, validAfter }
+  };
+  const signature = await sign({
+    domain: permit2Domain(asset.chainId),
+    types: PERMIT_WITNESS_TRANSFER_FROM_TYPES,
+    primaryType: "PermitWitnessTransferFrom",
+    message
+  });
+  const permit2Authorization = {
+    permitted: { token: requirement.asset, amount: message.permitted.amount.toString() },
+    from,
+    spender: message.spender,
+    nonce,
+    deadline: deadline.toString(),
+    witness: { to: requirement.payTo, facilitator: advertisedFacilitator, validAfter: validAfter.toString() }
+  };
+  return { x402Version: 2, accepted: requirement, payload: { signature, permit2Authorization } };
+}
+var JAW_RPC_URL = "https://api.justaname.id/proxy/v1/rpc";
+var CHAINS = {
+  [base.id]: base,
+  [baseSepolia.id]: baseSepolia,
+  [polygon.id]: polygon,
+  [polygonAmoy.id]: polygonAmoy
+};
+for (const chainId of Object.values(USDC_BY_NETWORK).map((a) => a.chainId)) {
+  if (!CHAINS[chainId]) {
+    throw new Error(
+      `x402 balance: USDC registry has chain ${chainId} but no viem chain is mapped for it in balance.ts`
+    );
+  }
+}
+var clients = /* @__PURE__ */ new Map();
+function rpcTransport(chainId, apiKey) {
+  if (!apiKey) return http();
+  return http(`${JAW_RPC_URL}?chainId=${chainId}&api-key=${apiKey}`);
+}
+function publicClientFor(chainId) {
+  const chain = CHAINS[chainId];
+  if (!chain) throw new Error(`x402: no viem chain configured for chainId ${chainId}`);
+  const apiKey = loadConfig().apiKey;
+  const key = `${chainId}:${apiKey ?? ""}`;
+  let client = clients.get(key);
+  if (!client) {
+    client = createPublicClient({ chain, transport: rpcTransport(chainId, apiKey) });
+    clients.set(key, client);
+  }
+  return client;
+}
+var readOnChain = (asset, owner) => publicClientFor(asset.chainId).readContract({
+  address: asset.address,
+  abi: erc20Abi,
+  functionName: "balanceOf",
+  args: [owner]
+});
+async function usdcBalance(network, owner, read = readOnChain) {
+  const asset = usdcForNetwork(network);
+  if (!asset) throw new Error(`Unsupported x402 network: ${network}`);
+  const raw = await read(asset, owner);
+  return { network, asset: asset.address, raw: raw.toString(), formatted: formatUnits(raw, asset.decimals) };
+}
+
+// src/x402/payer.ts
+var EIP7702_CODE_PREFIX = "0xef0100";
+var ERC20_ALLOWANCE_ABI = parseAbi(["function allowance(address owner, address spender) view returns (uint256)"]);
+var EIP712_DOMAIN_ABI = parseAbi([
+  "function eip712Domain() view returns (bytes1 fields, string name, string version, uint256 chainId, address verifyingContract, bytes32 salt, uint256[] extensions)"
+]);
+var Eip3009EoaPayer = class _Eip3009EoaPayer {
+  address;
+  signTypedData;
+  signHash;
+  /**
+   * eip712Domain() of the delegate, cached per chain after the first wrapped
+   * payment there. Keyed by chainId: the domain embeds block.chainid, so a
+   * domain read on one chain must never sign an envelope for another.
+   */
+  accountDomainByChain = /* @__PURE__ */ new Map();
+  constructor(address, signTypedData, signHash) {
+    this.address = address;
+    this.signTypedData = signTypedData;
+    this.signHash = signHash;
+  }
+  /** Load the session key from the keystore and build a pull-mode payer. */
+  static fromSessionKey() {
+    if (!keystoreExists()) {
+      throw new Error("No session key. Run `jaw session setup` to enable autonomous payments.");
+    }
+    const account = privateKeyToAccount(loadSessionKey());
+    const signTypedData = (typedData) => account.signTypedData(typedData);
+    const signHash = (hash) => account.sign({ hash });
+    return new _Eip3009EoaPayer(account.address, signTypedData, signHash);
+  }
+  async pay(requirement, opts) {
+    const sign = await this.isDelegated(requirement.network) ? this.wrappedSigner() : this.signTypedData;
+    if (requirement.scheme === "upto") {
+      await this.assertPermit2Approved(requirement, opts?.permit2Allowance);
+      return buildUptoPayment(requirement, this.address, sign, opts);
+    }
+    return buildExactPayment(requirement, this.address, sign, opts);
+  }
+  /**
+   * Refuse an `upto` payment the payer has not enabled, before signing it.
+   *
+   * Permit2 moves tokens through the canonical ERC-20 allowance, so a payer that
+   * never approved it produces an authorization the proxy cannot execute. The
+   * settlement then fails, and by the ledger's rule a failed attempt reserves its
+   * whole ceiling against the cap, which spends the user's budget on a payment
+   * that could never have worked. This is the same trade the delegation check
+   * above already makes: refusing before signing costs a retry, guessing costs
+   * the budget.
+   *
+   * The approval is granted once per chain and is not automatic yet.
+   *
+   * `known` is the figure the funder already read. It is taken only when it
+   * covers this payment, so the check can be satisfied early but never talked
+   * down: anything short falls through to the chain. The read stays for every
+   * caller that arrives without one, since a payer signing outside the funding
+   * hook has nothing else between it and an unsettleable signature.
+   */
+  async assertPermit2Approved(requirement, known) {
+    const asset = usdcForNetwork(requirement.network);
+    if (!asset) return;
+    const needed = BigInt(requirement.amount);
+    if (known !== void 0 && known >= needed) return;
+    const allowance = await this.permit2Allowance(asset);
+    if (allowance < needed) {
+      throw new Error(
+        `The payer ${this.address} has approved Permit2 for ${allowance} of ${asset.address} on ${requirement.network}, and this payment authorizes up to ${needed}. Permit2 moves the token through that allowance, so the payment could not settle. Approve Permit2 once on this chain and retry.`
+      );
+    }
+  }
+  permit2Allowance(asset) {
+    return publicClientFor(asset.chainId).readContract({
+      address: asset.address,
+      abi: ERC20_ALLOWANCE_ABI,
+      functionName: "allowance",
+      args: [this.address, PERMIT2_ADDRESS]
+    });
+  }
+  /**
+   * True once the EOA carries an EIP-7702 delegation designator on-chain, which
+   * decides whether USDC will route this signature through ecrecover or
+   * EIP-1271, and so which of the two signatures to produce.
+   *
+   * Throws rather than guessing when the chain cannot be read. Guessing raw was
+   * the old default, from when a session was usually never delegated; a session
+   * is delegated from its first userOp now, so the guess is wrong nearly every
+   * time it is made. And the guess is not free: a raw signature against a
+   * delegated account is refused by the settlement endpoint, which reads as a
+   * failed payment, and a failed payment counts against the session cap on the
+   * grounds that the facilitator may have broadcast it anyway. It cannot have,
+   * since USDC rejects the signature, so guessing spends the user's budget on a
+   * payment that could never have settled. Refusing before signing costs a
+   * retry instead.
+   */
+  async isDelegated(network) {
+    const asset = usdcForNetwork(network);
+    if (!asset) return false;
+    const code = await publicClientFor(asset.chainId).getCode({ address: this.address });
+    return (code ?? "0x").toLowerCase().startsWith(EIP7702_CODE_PREFIX);
+  }
+  /**
+   * ERC-7739 wrapped signer for the delegated (EIP-1271) validation path.
+   *
+   * JustanAccount answers 1271 with Solady's ERC-7739 validation, which rejects
+   * raw signatures from on-chain callers by design (anti cross-account replay).
+   * So the key signs a nested TypedDataSign envelope carrying the account's own
+   * domain, and ships a blob the account unwraps. USDC v2.2 accepts
+   * arbitrary-length `bytes` signatures, so it travels on the normal x402 wire.
+   *
+   * The envelope and the blob come from viem, which derives the contents type
+   * from the typed data instead of taking a hand-written string, so the type
+   * cannot drift from what is being signed. `erc7739.vectors.test.ts` pins the
+   * bytes both produce against a payment that settled on chain.
+   */
+  wrappedSigner() {
+    return async (typedData) => {
+      const verifierDomain = await this.readAccountDomain(typedData.domain.chainId);
+      const digest = hashTypedData({ ...typedData, verifierDomain });
+      const signature = await this.signHash(digest);
+      return wrapTypedDataSignature({ ...typedData, signature });
+    };
+  }
+  /** Read (once per chain) the delegate's EIP-712 domain from the account. */
+  async readAccountDomain(chainId) {
+    const cached = this.accountDomainByChain.get(chainId);
+    if (cached) return cached;
+    const [, name, version, domainChainId, verifyingContract, salt] = await publicClientFor(chainId).readContract({
+      address: this.address,
+      abi: EIP712_DOMAIN_ABI,
+      functionName: "eip712Domain"
+    });
+    const domain = { name, version, chainId: domainChainId, verifyingContract, salt };
+    this.accountDomainByChain.set(chainId, domain);
+    return domain;
+  }
+};
+
+// src/lib/errors.ts
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/x402/amount.ts
+function parseBigInt(value) {
+  if (value === void 0 || value === null || value === "") return null;
+  try {
+    return BigInt(value);
+  } catch {
+    return null;
+  }
+}
+function parseNonNegativeBigInt(value) {
+  const parsed = parseBigInt(value);
+  return parsed !== null && parsed >= 0n ? parsed : void 0;
+}
+
+// src/x402/period.ts
+var PERIOD_UNITS = ["minute", "hour", "day", "week", "month", "forever"];
+function isPeriodUnit(value) {
+  return typeof value === "string" && PERIOD_UNITS.includes(value);
+}
+function normalizePeriod(unit, multiplier) {
+  const m = Math.max(1, Math.floor(multiplier ?? 1));
+  if (unit === "year") return { unit: "month", multiplier: m * 12 };
+  if (isPeriodUnit(unit)) return { unit, multiplier: m };
+  return void 0;
+}
+var FIXED_UNIT_SECONDS = {
+  minute: 60,
+  hour: 3600,
+  day: 86400,
+  week: 604800
+};
+function addMonths(unixSeconds, months) {
+  const d = new Date(unixSeconds * 1e3);
+  const day = d.getUTCDate();
+  const target = new Date(
+    Date.UTC(d.getUTCFullYear(), d.getUTCMonth() + months, 1, d.getUTCHours(), d.getUTCMinutes(), d.getUTCSeconds())
+  );
+  const daysInTarget = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
+  target.setUTCDate(Math.min(day, daysInTarget));
+  return Math.floor(target.getTime() / 1e3);
+}
+function currentPeriodWindow(input) {
+  const { anchor, unit, now, permissionEnd } = input;
+  const multiplier = Math.max(1, Math.floor(input.multiplier ?? 1));
+  if (unit === "forever") {
+    return { start: anchor, end: permissionEnd };
+  }
+  let start;
+  let end;
+  if (unit === "month") {
+    let index = 0;
+    let cursor = anchor;
+    let next = addMonths(anchor, multiplier);
+    while (next <= now) {
+      index += 1;
+      cursor = next;
+      next = addMonths(anchor, (index + 1) * multiplier);
+    }
+    start = cursor;
+    end = next;
+  } else {
+    const duration = FIXED_UNIT_SECONDS[unit] * multiplier;
+    const elapsed = Math.max(0, now - anchor);
+    const index = Math.floor(elapsed / duration);
+    start = anchor + index * duration;
+    end = start + duration;
+  }
+  return { start, end: Math.min(end, permissionEnd) };
+}
+function describePeriod(unit, multiplier) {
+  if (unit === "forever") return "the whole permission";
+  return describeSpendPeriod(unit, multiplier);
+}
+function describeSpendPeriod(unit, multiplier) {
+  const n = Math.max(1, Math.floor(multiplier ?? 1));
+  return n === 1 ? unit : `${n} ${unit}s`;
+}
+
+// src/x402/types.ts
+var X402_SCHEMES = ["exact", "upto"];
+function isX402Scheme(value) {
+  return typeof value === "string" && X402_SCHEMES.includes(value);
+}
+var X402_HEADERS = {
+  required: "PAYMENT-REQUIRED",
+  signature: "PAYMENT-SIGNATURE",
+  response: "PAYMENT-RESPONSE"
+};
+
+// src/x402/policy.ts
+var DEFAULT_X402_POLICY = {
+  maxAmountPerPayment: "1000000",
+  // 1 USDC per payment
+  maxTotalPerSession: "10000000",
+  // 10 USDC per process
+  allowedAssets: Object.values(USDC_BY_NETWORK).map((asset) => asset.address),
+  allowedNetworks: Object.keys(USDC_BY_NETWORK)
+};
+function policyFromPermission(permission, chainId) {
+  if (!permission) return {};
+  const usdc = Object.values(USDC_BY_NETWORK).find((asset) => asset.chainId === chainId);
+  if (!usdc) return {};
+  const forToken = permission.spends.filter((spend) => spend.token.toLowerCase() === usdc.address.toLowerCase());
+  if (forToken.length === 0) return {};
+  const start = new Date(permission.start * 1e3);
+  if (Number.isNaN(start.getTime())) return {};
+  const anchor = start.toISOString();
+  const perPeriod = [];
+  for (const spend of forToken) {
+    let allowance;
+    try {
+      const parsed = BigInt(spend.allowance);
+      if (parsed < 0n) continue;
+      allowance = parsed.toString();
+    } catch {
+      continue;
+    }
+    const period = normalizePeriod(spend.unit, spend.multiplier);
+    if (!period) continue;
+    perPeriod.push({ allowance, unit: period.unit, multiplier: period.multiplier, anchor });
+  }
+  if (perPeriod.length === 0) return {};
+  return {
+    // The registry's canonical address, not the permission's literal string:
+    // they match case-insensitively and this seeds an allowlist compared that
+    // way.
+    allowedAssets: [usdc.address],
+    allowedNetworks: [usdc.wireNetwork],
+    perPeriod
+  };
+}
+function resolveX402Policy(configPolicy, grantPolicy) {
+  const merged = { ...DEFAULT_X402_POLICY, ...grantPolicy ?? {}, ...configPolicy ?? {} };
+  if (grantPolicy?.perPeriod !== void 0 && configPolicy?.maxTotalPerSession === void 0) {
+    delete merged.maxTotalPerSession;
+  }
+  return merged;
+}
+function resolveSessionX402Policy(configPolicy, session) {
+  return resolveX402Policy(configPolicy, policyFromPermission(session?.permission, session?.chainId ?? 0));
+}
+function sameLimit(a, b) {
+  return a.unit === b.unit && a.multiplier === b.multiplier && a.allowance === b.allowance;
+}
+function topUpCeiling(policy, used = {}) {
+  const left = (cap, alreadyUsed = 0n) => {
+    const parsed = parseNonNegativeBigInt(cap);
+    if (parsed === void 0) return void 0;
+    return parsed > alreadyUsed ? parsed - alreadyUsed : 0n;
+  };
+  const caps = [
+    // Every limit the policy holds, not every entry the caller built. The
+    // contract charges all of them, so a refill sized against any single one
+    // can still be refused by another, and a limit whose usage could not be
+    // computed still bounds the pull at its full width rather than vanishing.
+    // An allowance that cannot be read bounds at zero rather than dropping out.
+    // `checkPolicy` refuses outright on the same input, and letting it vanish
+    // here is the shape this set out to remove: with the session default
+    // deleted by a seeded grant, nothing local would bound the pull.
+    ...(policy.perPeriod ?? []).map(
+      (limit) => left(limit.allowance, (used.periodUsage ?? []).find((entry) => sameLimit(entry, limit))?.toppedUp) ?? 0n
+    ),
+    left(policy.maxTotalPerSession, used.spentThisSession)
+  ].filter((cap) => cap !== void 0);
+  return caps.length > 0 ? caps.reduce((a, b) => a < b ? a : b) : void 0;
+}
+var has = (list) => Array.isArray(list) && list.length > 0;
+var eqAddr = (a, b) => a.toLowerCase() === b.toLowerCase();
+var asks = (requirement) => requirement.scheme === "upto" ? `up to ${requirement.amount}` : requirement.amount;
+function checkPolicy(requirement, policy, ctx = {}) {
+  if (!isX402Scheme(requirement.scheme)) {
+    return { ok: false, reason: `unsupported scheme: ${String(requirement.scheme)}` };
+  }
+  if (requirement.scheme === "upto") {
+    const asset = usdcForNetwork(requirement.network);
+    if (!asset) {
+      return { ok: false, reason: `unsupported x402 network: ${requirement.network}` };
+    }
+    if (!UPTO_VERIFIED_CHAIN_IDS.includes(asset.chainId)) {
+      return {
+        ok: false,
+        reason: `x402 upto is not available on ${requirement.network}: the settlement proxy is only verified on chain ids ${UPTO_VERIFIED_CHAIN_IDS.join(", ")}`
+      };
+    }
+    const facilitator = requirement.extra?.["facilitatorAddress"];
+    if (!isHexShaped(facilitator) || isZeroAddress(facilitator)) {
+      return {
+        ok: false,
+        reason: `x402 upto needs a settling facilitator in extra.facilitatorAddress on ${requirement.network}, got ${JSON.stringify(facilitator)}`
+      };
+    }
+    if (!isPayableAddress(facilitator)) {
+      return {
+        ok: false,
+        reason: `extra.facilitatorAddress is not a readable address on ${requirement.network}: ${facilitator}`
+      };
+    }
+  }
+  for (const [field, value] of [
+    ["asset", requirement.asset],
+    ["payTo", requirement.payTo]
+  ]) {
+    if (!isPayableAddress(value)) {
+      return { ok: false, reason: `${field} is not a readable address on ${requirement.network}: ${value}` };
+    }
+  }
+  if (isZeroAddress(requirement.payTo)) {
+    return { ok: false, reason: `payTo is the zero address on ${requirement.network}` };
+  }
+  if (has(policy.allowedNetworks) && !policy.allowedNetworks.includes(requirement.network)) {
+    return { ok: false, reason: `network not allowed: ${requirement.network}` };
+  }
+  if (has(policy.allowedAssets) && !policy.allowedAssets.some((a) => eqAddr(a, requirement.asset))) {
+    return { ok: false, reason: `asset not allowed: ${requirement.asset}` };
+  }
+  if (has(policy.allowedPayTo) && !policy.allowedPayTo.some((a) => eqAddr(a, requirement.payTo))) {
+    return { ok: false, reason: `payTo not allowed: ${requirement.payTo}` };
+  }
+  if (has(policy.allowedHosts) && (!ctx.host || !policy.allowedHosts.includes(ctx.host))) {
+    return { ok: false, reason: `host not allowed: ${ctx.host ?? "(unknown)"}` };
+  }
+  const amount = parseBigInt(requirement.amount);
+  if (amount === null) {
+    return { ok: false, reason: `invalid amount: ${requirement.amount}` };
+  }
+  if (amount < 0n) {
+    return { ok: false, reason: `negative amount: ${requirement.amount}` };
+  }
+  if (policy.maxAmountPerPayment !== void 0) {
+    const cap = parseBigInt(policy.maxAmountPerPayment);
+    if (cap === null) {
+      return { ok: false, reason: `invalid maxAmountPerPayment in config: ${policy.maxAmountPerPayment}` };
+    }
+    if (amount > cap) {
+      return {
+        ok: false,
+        reason: `amount ${asks(requirement)} exceeds maxAmountPerPayment ${policy.maxAmountPerPayment}`
+      };
+    }
+  }
+  const exceeded = [];
+  for (const limit of policy.perPeriod ?? []) {
+    const cap = parseBigInt(limit.allowance);
+    if (cap === null) {
+      return { ok: false, reason: `invalid allowance from grant: ${limit.allowance}` };
+    }
+    const usage = (ctx.periodUsage ?? []).find((entry) => sameLimit(entry, limit));
+    const spent = usage?.spent ?? 0n;
+    if (spent + amount > cap) exceeded.push({ limit, usage });
+  }
+  if (exceeded.length > 0) {
+    const latest = exceeded.reduce(
+      (a, b) => (a.usage?.endsAt?.getTime() ?? 0) >= (b.usage?.endsAt?.getTime() ?? 0) ? a : b
+    );
+    const others = exceeded.length - 1;
+    const window = describePeriod(latest.limit.unit, latest.limit.multiplier);
+    const resets = latest.usage ? `, which resets ${latest.usage.endsAt.toISOString()}` : "";
+    return {
+      ok: false,
+      reason: `payment ${asks(requirement)} would exceed the granted ${latest.limit.allowance} per ${window}${resets}` + (others > 0 ? ` (${others} other limit${others === 1 ? "" : "s"} also applies)` : "")
+    };
+  }
+  if (policy.maxTotalPerSession !== void 0) {
+    const cap = parseBigInt(policy.maxTotalPerSession);
+    if (cap === null) {
+      return { ok: false, reason: `invalid maxTotalPerSession in config: ${policy.maxTotalPerSession}` };
+    }
+    const spent = ctx.spentThisSession ?? 0n;
+    if (spent + amount > cap) {
+      return {
+        ok: false,
+        reason: `payment ${asks(requirement)} would exceed maxTotalPerSession ${policy.maxTotalPerSession} (already spent ${spent} since the session was created; raise it with \`jaw config set x402.maxTotalPerSession <base units>\`)`
+      };
+    }
+  }
+  return { ok: true };
+}
+
+// src/x402/http.ts
+var b64json = (header) => {
+  if (!header) return null;
+  try {
+    return JSON.parse(Buffer.from(header, "base64").toString());
+  } catch {
+    return null;
+  }
+};
+function paymentNonceOf(payload) {
+  const inner = payload.payload;
+  return "authorization" in inner ? inner.authorization.nonce : inner.permit2Authorization.nonce;
+}
+function paymentDeadlineOf(payload) {
+  const inner = payload.payload;
+  return "authorization" in inner ? inner.authorization.validBefore : inner.permit2Authorization.deadline;
+}
+function settledAmountOf(receipt, scheme, authorized) {
+  if (scheme !== "upto") return authorized;
+  if (receipt?.success !== true || !settledTxHash(receipt)) return authorized;
+  const reported = parseBigInt(receipt.amount ?? "");
+  if (reported === null || reported < 0n) return authorized;
+  const ceiling = parseBigInt(authorized);
+  return ceiling !== null && reported > ceiling ? authorized : reported.toString();
+}
+function settledTxHash(receipt) {
+  const tx = receipt?.transaction;
+  return tx && /^0x[0-9a-fA-F]{64}$/.test(tx) ? tx : void 0;
+}
+var MAX_BODY_BYTES = 2 * 1024 * 1024;
+async function readBody(res) {
+  const reader2 = res.body?.getReader();
+  if (!reader2) {
+    const text2 = await res.text();
+    if (text2.length === 0) return {};
+    try {
+      return JSON.parse(text2);
+    } catch {
+      return text2;
+    }
+  }
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader2.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > MAX_BODY_BYTES) {
+        await reader2.cancel();
+        return { error: `response body exceeded ${MAX_BODY_BYTES} bytes` };
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader2.releaseLock?.();
+  }
+  if (total === 0) return {};
+  const text = Buffer.concat(chunks).toString("utf-8");
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+var FETCH_TIMEOUT_MS = 3e4;
+async function fetchWithTimeout(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, { ...init, signal: controller.signal });
+    let body;
+    try {
+      body = await readBody(res);
+    } catch (err) {
+      if (!controller.signal.aborted) throw err;
+      body = { error: `response body timed out after ${FETCH_TIMEOUT_MS}ms` };
+    }
+    return { status: res.status, url: res.url, headers: res.headers, body };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return void 0;
+  }
+}
+function isPaymentUrlSecure(url) {
+  try {
+    const { protocol, hostname } = new URL(url);
+    if (protocol === "https:") return true;
+    if (protocol === "http:") return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+    return false;
+  } catch {
+    return false;
+  }
+}
+function idempotencyKey() {
+  return `jaw-${randomBytes(6).toString("hex")}`;
+}
+var hexAddress = z.string().regex(/^0x[0-9a-fA-F]{40}$/, "must be a 20-byte hex address");
+var requirementSchema = z.object({
+  scheme: z.string(),
+  // CAIP-2 (`namespace:reference`). Left as a free string, an unknown
+  // network flowed verbatim into the refusal reason, the ledger, and every
+  // later `x402 log`. Constrained at the boundary so it cannot carry a
+  // payload at all, which is cheaper than trusting each sink to disarm it.
+  network: z.string().regex(/^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$/, "must be a CAIP-2 network id"),
+  amount: z.string().regex(/^\d+$/, "amount must be a base-10 integer string"),
+  asset: hexAddress,
+  payTo: hexAddress,
+  // int + finite: a server sending Infinity/NaN/float here would otherwise
+  // reach BigInt(validBefore) in the signer and throw an obscure error.
+  maxTimeoutSeconds: z.number().int().nonnegative().finite().optional(),
+  extra: z.record(z.unknown()).optional()
+}).passthrough();
+function selectRequirement(accepts, opts, ctx) {
+  const policy = opts.policy ?? {};
+  let reason = "no acceptable payment option in the 402 challenge";
+  let best;
+  let bestAmount = 0n;
+  for (const raw of accepts) {
+    const parsed = requirementSchema.safeParse(raw);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0];
+      reason = `malformed payment option${issue ? ` (${issue.path.join(".")}: ${issue.message})` : ""}`;
+      continue;
+    }
+    const req = parsed.data;
+    if (!isX402Scheme(req.scheme)) {
+      reason = `unsupported scheme: ${String(req.scheme)}`;
+      continue;
+    }
+    if (opts.network && req.network !== opts.network) {
+      reason = `network ${req.network} does not match requested ${opts.network}`;
+      continue;
+    }
+    if (opts.asset && req.asset.toLowerCase() !== opts.asset.toLowerCase()) {
+      reason = `asset ${req.asset} does not match requested ${opts.asset}`;
+      continue;
+    }
+    const amount = parseBigInt(req.amount);
+    if (amount === null) {
+      reason = `invalid amount: ${req.amount}`;
+      continue;
+    }
+    if (opts.maxAmount !== void 0) {
+      const cap = parseBigInt(opts.maxAmount);
+      if (cap === null) {
+        reason = `invalid maxAmount: ${opts.maxAmount}`;
+        continue;
+      }
+      if (amount > cap) {
+        reason = `amount ${asks(req)} exceeds maxAmount ${opts.maxAmount}`;
+        continue;
+      }
+    }
+    const verdict = checkPolicy(req, policy, ctx);
+    if (!verdict.ok) {
+      reason = verdict.reason ?? reason;
+      continue;
+    }
+    const cheaper = !best || amount < bestAmount;
+    const fixedPriceTie = !!best && amount === bestAmount && best.scheme === "upto" && req.scheme === "exact";
+    if (cheaper || fixedPriceTie) {
+      best = req;
+      bestAmount = amount;
+    }
+  }
+  return best ? { requirement: best } : { reason };
+}
+async function payAndFetch(url, payer, opts = {}) {
+  const method = opts.method ?? "GET";
+  const baseHeaders = { Accept: "application/json", ...opts.headers ?? {} };
+  const first = await fetchWithTimeout(url, { method, headers: baseHeaders, body: opts.body });
+  if (first.status !== 402) {
+    return { status: first.status, body: first.body, paid: false, payer: payer.address };
+  }
+  const refusal = (refusedReason, extra) => ({
+    status: 402,
+    body: first.body,
+    payer: payer.address,
+    refusedReason,
+    ...extra,
+    // After the spread, never from it. Both front ends decide whether to write a
+    // settled row in the ledger from this field, and the ledger is what the caps
+    // are rebuilt from, so a refusal must not be able to claim a payment.
+    paid: false
+  });
+  const resource = first.url || url;
+  if (!isPaymentUrlSecure(resource)) {
+    return refusal("refusing to sign a payment over a non-HTTPS URL (use https, or localhost for testing)");
+  }
+  const challenge = b64json(first.headers.get(X402_HEADERS.required));
+  if (!challenge || !Array.isArray(challenge.accepts)) {
+    return refusal("missing or malformed PAYMENT-REQUIRED challenge");
+  }
+  const ctx = {
+    host: hostOf(resource),
+    spentThisSession: opts.spentThisSession,
+    periodUsage: opts.periodUsage
+  };
+  const { requirement, reason } = selectRequirement(challenge.accepts, opts, ctx);
+  if (!requirement) {
+    return refusal(reason);
+  }
+  if (opts.dryRun) {
+    return {
+      status: 402,
+      body: first.body,
+      paid: false,
+      payer: payer.address,
+      wouldPay: {
+        scheme: requirement.scheme,
+        amount: requirement.amount,
+        authorized: requirement.amount,
+        asset: requirement.asset,
+        network: requirement.network,
+        payTo: requirement.payTo
+      }
+    };
+  }
+  let topUp;
+  let permit2Approval;
+  let permit2Allowance;
+  if (opts.ensureFunds) {
+    let funded;
+    try {
+      funded = await opts.ensureFunds(requirement, payer.address);
+    } catch (err) {
+      return refusal(`payer funding failed: ${errorMessage(err)}`);
+    }
+    if (!funded.ok) {
+      return refusal(funded.reason ?? "payer funding failed", {
+        ...funded.amount || funded.batchId ? { topUp: { amount: funded.amount, batchId: funded.batchId } } : {},
+        ...funded.approvalBatchId ? { permit2Approval: { batchId: funded.approvalBatchId } } : {}
+      });
+    }
+    if (funded.approvalBatchId) {
+      permit2Approval = { batchId: funded.approvalBatchId };
+    }
+    permit2Allowance = funded.permit2Allowance;
+    if (!funded.skipped) {
+      topUp = { amount: funded.amount, batchId: funded.batchId };
+    }
+  }
+  let payload;
+  try {
+    payload = await payer.pay(requirement, { permit2Allowance });
+  } catch (err) {
+    return refusal(`payment signing failed: ${errorMessage(err)}`, { topUp, permit2Approval });
+  }
+  const details = {
+    scheme: requirement.scheme,
+    // The ceiling until a receipt says otherwise, which is the conservative
+    // reading for `upto` and the exact figure for `exact`.
+    amount: requirement.amount,
+    authorized: requirement.amount,
+    deadline: paymentDeadlineOf(payload),
+    asset: requirement.asset,
+    network: requirement.network,
+    payTo: requirement.payTo,
+    nonce: paymentNonceOf(payload)
+  };
+  const proof = encodePaymentPayload(payload);
+  const retryHeaders = {
+    ...baseHeaders,
+    [X402_HEADERS.signature]: proof,
+    "Idempotency-Key": idempotencyKey()
+  };
+  let paid;
+  try {
+    paid = await fetchWithTimeout(resource, {
+      method,
+      headers: retryHeaders,
+      body: opts.body,
+      redirect: "manual"
+    });
+  } catch (err) {
+    return refusal(`payment sent but the response never arrived: ${errorMessage(err)}`, {
+      body: "",
+      attemptedPayment: details,
+      topUp,
+      permit2Approval
+    });
+  }
+  if (paid.status >= 300 && paid.status < 400) {
+    return {
+      status: paid.status,
+      body: paid.body,
+      paid: false,
+      payer: payer.address,
+      attemptedPayment: details,
+      topUp,
+      permit2Approval,
+      refusedReason: `settlement endpoint attempted a redirect (${paid.status}); not following it with the signed proof`
+    };
+  }
+  const receipt = b64json(paid.headers.get(X402_HEADERS.response));
+  const body = paid.body;
+  if (paid.status >= 400) {
+    const reChallenge = b64json(paid.headers.get(X402_HEADERS.required));
+    return {
+      status: paid.status,
+      body,
+      paid: false,
+      payer: payer.address,
+      // The payment was signed and sent; surface it so an ambiguous settlement
+      // (facilitator may have broadcast) can be reconciled by nonce.
+      attemptedPayment: details,
+      topUp,
+      permit2Approval,
+      refusedReason: receipt?.errorReason ?? reChallenge?.error ?? `settlement failed with status ${paid.status}`
+    };
+  }
+  return {
+    status: paid.status,
+    body,
+    paid: true,
+    topUp,
+    permit2Approval,
+    payer: payer.address,
+    payment: {
+      ...details,
+      amount: settledAmountOf(receipt, requirement.scheme, details.authorized),
+      txHash: settledTxHash(receipt)
+    }
+  };
+}
+function appendX402Log(entry) {
+  try {
+    ensureDir(PATHS.root);
+    fs5.appendFileSync(PATHS.x402Log, "\n" + JSON.stringify(entry), { encoding: "utf-8", mode: 384 });
+  } catch (err) {
+    const msg = errorMessage(err);
+    process.stderr.write(`[jaw] warning: failed to write x402 ledger (${msg}); spend audit/cap may undercount
+`);
+  }
+}
+function readX402Log(limit) {
+  let raw;
+  try {
+    raw = fs5.readFileSync(PATHS.x402Log, "utf-8");
+  } catch {
+    return [];
+  }
+  const entries = raw.split("\n").filter((line) => line.trim().length > 0).map((line) => {
+    try {
+      return JSON.parse(line);
+    } catch {
+      return null;
+    }
+  }).filter((e) => e !== null);
+  return limit && limit > 0 ? entries.slice(-limit) : entries;
+}
+function spendFigureOf(entry) {
+  if (entry.status !== "paid" && entry.status !== "failed") return 0n;
+  const parse = (value) => {
+    if (!value) return 0n;
+    try {
+      const parsed = BigInt(value);
+      return parsed > 0n ? parsed : 0n;
+    } catch {
+      return 0n;
+    }
+  };
+  if (entry.status === "paid") return parse(entry.amount);
+  const ceiling = parse(entry.authorized);
+  const charge = parse(entry.amount);
+  return ceiling > charge ? ceiling : charge;
+}
+function sumSpentSince(payerAddress, since) {
+  const payer = payerAddress.toLowerCase();
+  return readX402Log().reduce((total, entry) => {
+    if (entry.payer?.toLowerCase() !== payer) return total;
+    if (since && entry.at < since) return total;
+    return total + spendFigureOf(entry);
+  }, 0n);
+}
+function sumToppedUpSince(payerAddress, since) {
+  const payer = payerAddress.toLowerCase();
+  return readX402Log().reduce((total, entry) => {
+    if (!entry.topUpAmount) return total;
+    if (entry.payer?.toLowerCase() !== payer) return total;
+    if (since && entry.at < since) return total;
+    try {
+      return total + BigInt(entry.topUpAmount);
+    } catch {
+      return total;
+    }
+  }, 0n);
+}
+var PERMISSION_MANAGER_ABI = parseAbi([
+  "struct CallPermission { address target; bytes4 selector; address checker; }",
+  "struct SpendLimit { address token; uint160 allowance; uint8 unit; uint16 multiplier; }",
+  "struct Permission { address account; address spender; uint48 start; uint48 end; uint256 salt; CallPermission[] calls; SpendLimit[] spends; }",
+  "struct PeriodSpend { uint48 start; uint48 end; uint160 spend; }",
+  "function getHash(Permission permission) view returns (bytes32)",
+  "function isApproved(Permission permission) view returns (bool)",
+  "function isRevoked(Permission permission) view returns (bool)",
+  "function getCurrentPeriod(Permission permission, SpendLimit spendLimit) view returns (PeriodSpend)",
+  // Carried so the two time-bound reverts can be told apart from a node that
+  // did not answer. Everything else the manager can revert with decodes to an
+  // unnamed error, which is treated as unavailable rather than guessed at.
+  "error JustaPermissionManager_BeforePermissionStart(uint48 currentTimestamp, uint48 start)",
+  "error JustaPermissionManager_AfterPermissionEnd(uint48 currentTimestamp, uint48 end)"
+]);
+var TIME_BOUND_ERRORS = /* @__PURE__ */ new Set([
+  "JustaPermissionManager_BeforePermissionStart",
+  "JustaPermissionManager_AfterPermissionEnd"
+]);
+var PERIOD_UNIT_ENUM = {
+  minute: 0,
+  hour: 1,
+  day: 2,
+  week: 3,
+  month: 4,
+  forever: 5
+};
+function toContractSpendLimit(spend) {
+  const unit = spend.unit === "year" ? "month" : spend.unit;
+  const multiplier = spend.unit === "year" ? spend.multiplier * 12 : spend.multiplier;
+  if (!Object.hasOwn(PERIOD_UNIT_ENUM, unit)) return null;
+  return {
+    token: spend.token,
+    allowance: BigInt(spend.allowance),
+    unit: PERIOD_UNIT_ENUM[unit],
+    multiplier
+  };
+}
+function toContractPermission(permission) {
+  const spends = [];
+  for (const spend of permission.spends) {
+    const converted = toContractSpendLimit(spend);
+    if (!converted) return null;
+    spends.push(converted);
+  }
+  let salt;
+  try {
+    salt = BigInt(permission.salt);
+  } catch {
+    return null;
+  }
+  return {
+    account: permission.account,
+    spender: permission.spender,
+    start: permission.start,
+    end: permission.end,
+    salt,
+    calls: permission.calls.map((call) => ({
+      target: call.target,
+      selector: call.selector,
+      checker: zeroAddress
+    })),
+    spends
+  };
+}
+var DEFAULT_TIMEOUT_MS = 5e3;
+async function within(work, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  let timer;
+  try {
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("timed out")), timeoutMs);
+    });
+    return await Promise.race([work, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function managerAddress(override) {
+  if (override) return override;
+  const { PERMISSIONS_MANAGER_ADDRESS } = await import('@jaw.id/core');
+  return PERMISSIONS_MANAGER_ADDRESS;
+}
+function reader(chainId, deps) {
+  if (deps.readContract) return deps.readContract;
+  try {
+    const client = publicClientFor(chainId);
+    return (args) => client.readContract(args);
+  } catch {
+    return null;
+  }
+}
+async function readCurrentPeriods(target, deps = {}) {
+  if (!target.permission) return [];
+  const permission = toContractPermission(target.permission);
+  if (!permission) return [];
+  const granted = target.permission.spends;
+  const indexes = granted.map((spend, index) => ({ spend, index })).filter(({ spend }) => spend.token.toLowerCase() === target.token.toLowerCase());
+  if (indexes.length === 0) return [];
+  const unreadable = indexes.map(({ spend }) => ({ ...spend, period: { status: "unavailable" } }));
+  const read = reader(target.chainId, deps);
+  if (!read) return unreadable;
+  try {
+    const address = await managerAddress(deps.manager);
+    const settled = await within(
+      Promise.allSettled([
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "getHash", args: [permission] }),
+        ...indexes.map(
+          ({ index }) => read({
+            address,
+            abi: PERMISSION_MANAGER_ABI,
+            functionName: "getCurrentPeriod",
+            args: [permission, permission.spends[index]]
+          })
+        )
+      ]),
+      deps.timeoutMs
+    );
+    const [hashed, ...counters] = settled;
+    const hash = hashed.status === "fulfilled" ? hashed.value : null;
+    if (typeof hash !== "string" || hash.toLowerCase() !== target.permissionId.toLowerCase()) {
+      return unreadable;
+    }
+    return indexes.map(({ spend }, i) => {
+      const result = counters[i];
+      if (result.status === "rejected") {
+        return {
+          ...spend,
+          period: isTimeBoundRevert(result.reason) ? { status: "outside-window" } : { status: "unavailable" }
+        };
+      }
+      const period = result.value;
+      return {
+        ...spend,
+        period: period ? {
+          status: "ok",
+          start: Number(period.start),
+          end: Number(period.end),
+          spend: BigInt(period.spend)
+        } : { status: "unavailable" }
+      };
+    });
+  } catch {
+    return unreadable;
+  }
+}
+function isTimeBoundRevert(err) {
+  if (!(err instanceof BaseError)) return false;
+  const revert = err.walk((e) => e instanceof ContractFunctionRevertedError);
+  return revert instanceof ContractFunctionRevertedError && TIME_BOUND_ERRORS.has(revert.data?.errorName ?? "");
+}
+
+// src/x402/spend-window.ts
+function currentLimitUsage(policy, payerAddress, session, now = /* @__PURE__ */ new Date()) {
+  if (!session || !policy.perPeriod) return [];
+  const usage = [];
+  for (const limit of policy.perPeriod) {
+    const anchorMs = Date.parse(limit.anchor);
+    if (Number.isNaN(anchorMs)) continue;
+    const window = currentPeriodWindow({
+      anchor: Math.floor(anchorMs / 1e3),
+      unit: limit.unit,
+      multiplier: limit.multiplier,
+      now: Math.floor(now.getTime() / 1e3),
+      permissionEnd: session.expiry
+    });
+    const since = new Date(window.start * 1e3).toISOString();
+    usage.push({
+      ...limit,
+      spent: sumSpentSince(payerAddress, since),
+      toppedUp: sumToppedUpSince(payerAddress, since),
+      endsAt: new Date(window.end * 1e3),
+      source: "ledger"
+    });
+  }
+  return usage;
+}
+async function currentLimitUsageOnChain(policy, payerAddress, session, now = /* @__PURE__ */ new Date(), deps = {}) {
+  const local = currentLimitUsage(policy, payerAddress, session, now);
+  if (!session || local.length === 0) return local;
+  const asset = Object.values(USDC_BY_NETWORK).find((a) => a.chainId === session.chainId);
+  if (!asset) return local;
+  const onChain = await readCurrentPeriods(
+    {
+      chainId: session.chainId,
+      permissionId: session.permissionId,
+      permission: session.permission,
+      token: asset.address
+    },
+    deps
+  );
+  if (onChain.length === 0) return local;
+  return local.map((limit) => {
+    const match = onChain.find((candidate) => {
+      const normalized = normalizePeriod(candidate.unit, candidate.multiplier);
+      if (normalized?.unit !== limit.unit || normalized.multiplier !== limit.multiplier) return false;
+      const a = parseBigInt(candidate.allowance);
+      const b = parseBigInt(limit.allowance);
+      return a !== null && b !== null && a === b;
+    });
+    if (!match || match.period.status !== "ok") return limit;
+    const since = new Date(match.period.start * 1e3).toISOString();
+    const fromLedger = sumToppedUpSince(payerAddress, since);
+    const metered = match.period.spend >= fromLedger;
+    return {
+      ...limit,
+      spent: sumSpentSince(payerAddress, since),
+      toppedUp: metered ? match.period.spend : fromLedger,
+      endsAt: new Date(match.period.end * 1e3),
+      source: metered ? "chain" : "ledger"
+    };
+  });
+}
+
+// src/x402/gas-reserve.ts
+function gasReserve(asset) {
+  return 10n ** BigInt(asset.decimals) / 10n;
+}
+function firstOperationCost(asset) {
+  return 10n ** BigInt(asset.decimals) / 100n;
+}
+
+// src/x402/topup.ts
+var readAllowance = (asset, owner, spender) => publicClientFor(asset.chainId).readContract({
+  address: asset.address,
+  abi: erc20Abi,
+  functionName: "allowance",
+  args: [owner, spender]
+});
+function isFinalStatus(s) {
+  if (!s) return "pending";
+  const v = s.status;
+  if (v === 200 || v === "200" || v === "CONFIRMED") return "ok";
+  if (v === 100 || v === "100" || v === "PENDING" || v === void 0) return "pending";
+  return "failed";
+}
+async function ensurePayerFunds(requirement, payerAddress, executor, opts = {}) {
+  const asset = usdcForNetwork(requirement.network);
+  if (!asset) {
+    return { ok: true, skipped: true };
+  }
+  if (requirement.asset && requirement.asset.toLowerCase() !== asset.address.toLowerCase()) {
+    return { ok: true, skipped: true };
+  }
+  if (opts.sessionChainId !== void 0 && opts.sessionChainId !== asset.chainId) {
+    return {
+      ok: false,
+      reason: `session is on chain ${opts.sessionChainId} but the payment needs chain ${asset.chainId}; run \`jaw session setup --chain ${asset.chainId}\` to pay on this network`
+    };
+  }
+  const price = parseBigInt(requirement.amount);
+  if (price === null) {
+    return { ok: false, reason: `non-numeric payment amount: ${requirement.amount}` };
+  }
+  let grantApproval = null;
+  let permit2Allowance;
+  if (requirement.scheme === "upto") {
+    const status = await permit2ApprovalStatus(asset, payerAddress, price, executor, opts);
+    if (!status.ok) return { ok: false, reason: status.reason };
+    grantApproval = status.grant;
+    permit2Allowance = grantApproval ? void 0 : status.allowance;
+  }
+  const read = opts.balanceReader;
+  const balance = read ? await read(asset, payerAddress) : BigInt((await usdcBalance(requirement.network, payerAddress)).raw);
+  const needed = grantApproval ? price + gasReserve(asset) : price;
+  if (balance >= needed) {
+    if (grantApproval) {
+      const granted = await grantPermit2Allowance(asset, payerAddress, price, grantApproval, executor, opts);
+      if (!granted.ok) return { ok: false, reason: granted.reason, approvalBatchId: granted.batchId };
+      return { ok: true, skipped: true, approvalBatchId: granted.batchId, permit2Allowance: granted.allowance };
+    }
+    return { ok: true, skipped: true, permit2Allowance };
+  }
+  const shortfall = needed - balance;
+  const feePerOp = firstOperationCost(asset);
+  if (opts.maxTopUp !== void 0 && opts.maxTopUp < shortfall + feePerOp) {
+    return {
+      ok: false,
+      reason: `the tightest spend cap has ${opts.maxTopUp} base units left and this payment needs ${shortfall + feePerOp} topped up (${shortfall} short, plus the fee the payer is charged for the refill itself); wait for the period to reset, or raise the cap.`
+    };
+  }
+  const target = opts.floatTarget !== void 0 && opts.floatTarget > needed ? opts.floatTarget : needed;
+  let amount = (target - balance > shortfall ? target - balance : shortfall) + gasReserve(asset);
+  if (opts.maxTopUp !== void 0 && amount > opts.maxTopUp) {
+    amount = opts.maxTopUp;
+  }
+  const data = encodeFunctionData({
+    abi: erc20Abi,
+    functionName: "transfer",
+    args: [payerAddress, amount]
+  });
+  let batchId;
+  try {
+    const sent = await executor.request("wallet_sendCalls", [{ calls: [{ to: asset.address, data }] }]);
+    const id = typeof sent === "string" ? sent : sent?.id;
+    if (!id) {
+      return {
+        ok: false,
+        reason: "top-up submitted but no call id returned; cannot confirm it",
+        amount: amount.toString()
+      };
+    }
+    batchId = id;
+  } catch (err) {
+    const msg = errorMessage(err);
+    return {
+      ok: false,
+      reason: `top-up refused on-chain (${msg}). The session permission must allow a USDC transfer to the payer and still have spend allowance this period; check the grant from \`jaw session setup\` or the remaining cap.`
+    };
+  }
+  const confirmed = await awaitCall(executor, batchId, opts, {
+    subject: "top-up",
+    onChainFailure: "top-up transaction failed on-chain (spending cap reached, or permission expired/revoked)"
+  });
+  if (!confirmed.ok) {
+    return { ok: false, reason: confirmed.reason, amount: amount.toString(), batchId };
+  }
+  let approvalBatchId;
+  if (grantApproval) {
+    const granted = await grantPermit2Allowance(asset, payerAddress, price, grantApproval, executor, opts);
+    approvalBatchId = granted.batchId;
+    if (!granted.ok) {
+      return { ok: false, reason: granted.reason, amount: amount.toString(), batchId, approvalBatchId };
+    }
+    permit2Allowance = granted.allowance;
+  }
+  return { ok: true, amount: amount.toString(), batchId, approvalBatchId, permit2Allowance };
+}
+async function permit2ApprovalStatus(asset, payerAddress, needed, executor, opts) {
+  const read = opts.allowanceReader ?? readAllowance;
+  let allowance;
+  try {
+    allowance = await read(asset, payerAddress, PERMIT2_ADDRESS);
+  } catch (err) {
+    return { ok: false, reason: `could not read the payer's Permit2 allowance: ${errorMessage(err)}` };
+  }
+  if (allowance >= needed) return { ok: true, grant: null, allowance };
+  const grant = executor.approvePermit2?.bind(executor);
+  if (!grant) {
+    return {
+      ok: false,
+      reason: `the payer has not approved Permit2 to move ${asset.address}, and this session cannot grant it. Approve Permit2 once on this chain to pay upto challenges.`
+    };
+  }
+  return { ok: true, grant, allowance };
+}
+async function grantPermit2Allowance(asset, payerAddress, needed, grant, executor, opts) {
+  let batchId;
+  try {
+    batchId = await grant(asset.address);
+  } catch (err) {
+    return { ok: false, reason: `Permit2 approval refused: ${errorMessage(err)}` };
+  }
+  const confirmed = await awaitCall(executor, batchId, opts, {
+    subject: "Permit2 approval",
+    onChainFailure: `Permit2 approval failed on-chain (batch ${batchId})`
+  });
+  if (!confirmed.ok) return { ok: false, reason: confirmed.reason, batchId };
+  const visible = await allowanceVisible(asset, payerAddress, needed, opts);
+  if (visible === null) {
+    return {
+      ok: false,
+      batchId,
+      reason: `the Permit2 approval confirmed (batch ${batchId}) but the allowance is not visible yet on this chain; retry the payment in a moment, the approval does not need to be sent again.`
+    };
+  }
+  return { ok: true, batchId, allowance: visible };
+}
+var ALLOWANCE_VISIBILITY_ATTEMPTS = 3;
+async function allowanceVisible(asset, payerAddress, needed, opts) {
+  const read = opts.allowanceReader ?? readAllowance;
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const pollMs = opts.pollMs ?? 2e3;
+  for (let attempt = 0; attempt < ALLOWANCE_VISIBILITY_ATTEMPTS; attempt++) {
+    if (attempt > 0) await sleep2(pollMs);
+    try {
+      const seen = await read(asset, payerAddress, PERMIT2_ADDRESS);
+      if (seen >= needed) return seen;
+    } catch {
+    }
+  }
+  return null;
+}
+async function awaitCall(executor, batchId, opts, labels) {
+  const now = opts.now ?? Date.now;
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const pollMs = opts.pollMs ?? 2e3;
+  const timeoutMs = opts.timeoutMs ?? 9e4;
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    let status;
+    let timer;
+    try {
+      const remaining = Math.max(deadline - now(), 0);
+      const expired = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`status check timed out after ${timeoutMs}ms`)), remaining);
+      });
+      status = await Promise.race([executor.request("wallet_getCallsStatus", batchId), expired]);
+    } catch (err) {
+      return { ok: false, reason: `${labels.subject} status check failed: ${errorMessage(err)}` };
+    } finally {
+      clearTimeout(timer);
+    }
+    const final = isFinalStatus(status);
+    if (final === "ok") return { ok: true };
+    if (final === "failed") return { ok: false, reason: labels.onChainFailure };
+    if (now() >= deadline) {
+      return { ok: false, reason: `${labels.subject} not confirmed after ${timeoutMs}ms` };
+    }
+    await sleep2(pollMs);
+  }
+}
+
+// src/lib/terminal.ts
+var INVISIBLE_AND_BIDI = /[\u200B-\u200F\u2028\u2029\u202A-\u202E\u2066-\u2069\uFEFF]/g;
+var BLOCK_CONTROLS = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g;
+var LINE_CONTROLS = /[\u0000-\u001F\u007F-\u009F]/g;
+var REPLACEMENT = "\uFFFD";
+var DEFAULT_LINE_LENGTH = 200;
+function bound(text, maxLength) {
+  if (text.length <= maxLength) return text;
+  return `${text.slice(0, maxLength)}\u2026 (${text.length - maxLength} more characters)`;
+}
+function sanitizeLine(value, maxLength = DEFAULT_LINE_LENGTH) {
+  const text = typeof value === "string" ? value : String(value);
+  return bound(text.replace(LINE_CONTROLS, REPLACEMENT).replace(INVISIBLE_AND_BIDI, REPLACEMENT), maxLength);
+}
+function sanitizeBlock(value) {
+  const text = typeof value === "string" ? value : String(value);
+  return text.replace(BLOCK_CONTROLS, REPLACEMENT).replace(INVISIBLE_AND_BIDI, REPLACEMENT);
+}
+
+// src/x402/status-report.ts
+function formatUsdc(base2, decimals) {
+  if (base2 === void 0) return "unlimited";
+  const value = parseBigInt(base2);
+  if (value === null) return `${sanitizeLine(base2, 32)} (invalid)`;
+  const scale = 10n ** BigInt(decimals);
+  const whole = value / scale;
+  const frac = (value % scale).toString().padStart(decimals, "0").replace(/0+$/, "");
+  return `${whole}${frac ? `.${frac}` : ""} USDC`;
+}
+var STALE_AFTER_MS = 3e5;
+var DEFAULT_ACQUIRE_TIMEOUT_MS = 12e4;
+var POLL_INTERVAL_MS = 100;
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function readLock() {
+  try {
+    const parsed = JSON.parse(fs5.readFileSync(PATHS.paymentLock, "utf-8"));
+    if (typeof parsed?.pid !== "number" || typeof parsed?.at !== "number") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+var TORN_GRACE_MS = 2e3;
+function unreadableLockIsTorn() {
+  try {
+    return Date.now() - fs5.statSync(PATHS.paymentLock).mtimeMs > TORN_GRACE_MS;
+  } catch {
+    return true;
+  }
+}
+function isStale(lock, staleAfterMs) {
+  if (!lock) return unreadableLockIsTorn();
+  if (!isAlive(lock.pid)) return true;
+  return Date.now() - lock.at > staleAfterMs;
+}
+function breakLock(observed) {
+  const current = readLock();
+  const sameLock = observed === null && current === null || observed !== null && current !== null && current.token === observed.token && current.at === observed.at;
+  if (!sameLock && current !== null) return;
+  if (current === null && !unreadableLockIsTorn()) return;
+  try {
+    fs5.unlinkSync(PATHS.paymentLock);
+  } catch {
+  }
+}
+async function withPaymentLock(fn, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_ACQUIRE_TIMEOUT_MS;
+  const staleAfterMs = options.staleAfterMs ?? STALE_AFTER_MS;
+  const token = crypto2.randomBytes(16).toString("hex");
+  const deadline = Date.now() + timeoutMs;
+  ensureDir(PATHS.root);
+  let notified = false;
+  for (; ; ) {
+    try {
+      const fd = fs5.openSync(PATHS.paymentLock, "wx", 384);
+      try {
+        fs5.writeFileSync(fd, JSON.stringify({ pid: process.pid, token, at: Date.now() }));
+      } finally {
+        fs5.closeSync(fd);
+      }
+      break;
+    } catch (err) {
+      if (err?.code !== "EEXIST") throw err;
+      const holder = readLock();
+      if (isStale(holder, staleAfterMs)) {
+        breakLock(holder);
+      } else if (!notified && holder) {
+        notified = true;
+        options.onWait?.(holder.pid);
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `Another payment has been running for ${Math.round((Date.now() - (holder?.at ?? Date.now())) / 1e3)}s (pid ${holder?.pid ?? "unknown"}). Refusing rather than paying past the session cap. Retry once it finishes, or remove ${PATHS.paymentLock} if that process is gone.`
+        );
+      }
+      await sleep(POLL_INTERVAL_MS);
+    }
+  }
+  const releaseOnExit = () => release(token);
+  process.once("exit", releaseOnExit);
+  try {
+    return await fn();
+  } finally {
+    process.removeListener("exit", releaseOnExit);
+    release(token);
+  }
+}
+function release(token) {
+  const current = readLock();
+  if (current?.token !== token) return;
+  try {
+    fs5.unlinkSync(PATHS.paymentLock);
+  } catch {
+  }
+}
+
+// src/commands/x402/pay.ts
+var X402Pay = class _X402Pay extends BaseCommand {
+  static description = "Fetch a URL, paying an x402 challenge with the session key. Dry run by default: pass --pay to actually spend.";
+  static examples = [
+    "<%= config.bin %> x402 pay https://api.example.com/resource",
+    "<%= config.bin %> x402 pay https://api.example.com/resource --pay",
+    "<%= config.bin %> x402 pay https://api.example.com/resource --pay --max-amount 50000"
+  ];
+  static args = {
+    url: Args.string({ description: "Resource URL to fetch", required: true })
+  };
+  static flags = {
+    ...BaseCommand.baseFlags,
+    pay: Flags.boolean({
+      description: "Actually sign and send the payment. Without this the command stops before spending.",
+      default: false
+    }),
+    "max-amount": Flags.string({
+      description: "Hard ceiling in base units for this call, on top of the configured policy."
+    }),
+    method: Flags.string({ description: "HTTP method (default GET)." }),
+    body: Flags.string({ description: "Request body." })
+  };
+  async run() {
+    const { args, flags } = await this.parse(_X402Pay);
+    const format = flags.output;
+    const config = loadConfig();
+    const payer = Eip3009EoaPayer.fromSessionKey();
+    const session = tryLoadSessionConfig();
+    const policy = resolveSessionX402Policy(config.x402, session);
+    const spent = sumSpentSince(payer.address, session?.createdAt);
+    if (flags.pay && (!session || !config.apiKey)) {
+      this.warn(
+        session ? "No apiKey configured, so a short payer cannot be topped up. Paying from its own balance." : "No session, so a short payer cannot be topped up through a permission. Paying from its own balance."
+      );
+    }
+    const run = async () => {
+      const periodUsage = await currentLimitUsageOnChain(policy, payer.address, session);
+      const spentThisSession = flags.pay ? sumSpentSince(payer.address, session?.createdAt) : spent;
+      let ensureFunds;
+      if (flags.pay && session && config.apiKey) {
+        const bridge = new SessionBridge({ apiKey: config.apiKey, chainId: session.chainId });
+        const floatTarget = parseNonNegativeBigInt(config.x402?.topUpFloat);
+        const maxTopUp = topUpCeiling(policy, { periodUsage, spentThisSession });
+        ensureFunds = (requirement, payerAddress) => ensurePayerFunds(requirement, payerAddress, bridge, {
+          floatTarget,
+          maxTopUp,
+          sessionChainId: session.chainId
+        });
+      }
+      const outcome = await payAndFetch(args.url, payer, {
+        method: flags.method,
+        body: flags.body,
+        policy,
+        ensureFunds,
+        spentThisSession,
+        periodUsage,
+        maxAmount: flags["max-amount"],
+        dryRun: !flags.pay
+      });
+      if (flags.pay) {
+        const settled = outcome.payment ?? outcome.attemptedPayment;
+        const isPaymentEvent = outcome.paid || !!outcome.attemptedPayment || outcome.status === 402 && !!outcome.refusedReason;
+        if (isPaymentEvent) {
+          appendX402Log({
+            at: (/* @__PURE__ */ new Date()).toISOString(),
+            url: args.url,
+            payer: outcome.payer,
+            status: outcome.paid ? "paid" : outcome.attemptedPayment ? "failed" : "refused",
+            amount: settled?.amount,
+            authorized: settled?.authorized,
+            deadline: settled?.deadline,
+            asset: settled?.asset,
+            network: settled?.network,
+            payTo: settled?.payTo,
+            nonce: settled?.nonce,
+            txHash: outcome.payment?.txHash,
+            topUpAmount: outcome.topUp?.amount,
+            topUpBatchId: outcome.topUp?.batchId,
+            approvalBatchId: outcome.permit2Approval?.batchId,
+            reason: outcome.refusedReason
+          });
+        }
+      }
+      return outcome;
+    };
+    const result = flags.pay ? await withPaymentLock(run, {
+      onWait: (pid) => this.warn(`Waiting for another payment to finish (pid ${pid})...`)
+    }) : await run();
+    if (format === "json") {
+      this.outputResult({ ...result, dryRun: !flags.pay }, format);
+      if (result.refusedReason) this.exit(1);
+      return;
+    }
+    const priceDecimals = (network) => (network ? usdcForNetwork(network)?.decimals : void 0) ?? 6;
+    const topUpDecimals = Object.values(USDC_BY_NETWORK).find((a) => a.chainId === session?.chainId)?.decimals ?? 6;
+    if (result.refusedReason) {
+      this.log(`Refused.
+
+  ${sanitizeLine(result.refusedReason)}`);
+      if (result.topUp) {
+        const where = result.topUp.batchId ? ` (${result.topUp.batchId})` : " (no call id returned to confirm it)";
+        this.log(`
+  A top-up of ${formatUsdc(result.topUp.amount, topUpDecimals)} was sent first${where}.`);
+      }
+      if (result.permit2Approval) {
+        this.log(`
+  A Permit2 approval was sent first (${result.permit2Approval.batchId}).`);
+      }
+      const held = result.attemptedPayment;
+      if (held) {
+        const figure = formatUsdc(held.authorized, priceDecimals(held.network));
+        this.log(`
+  ${figure} stays authorized until it expires, and your caps count it as spent until then.`);
+      }
+      this.exit(1);
+    }
+    if (result.wouldPay) {
+      this.log("Would pay.\n");
+      const label = result.wouldPay.scheme === "upto" ? "up to  " : "price  ";
+      this.log(
+        `  ${label}  ${formatUsdc(result.wouldPay.amount, priceDecimals(result.wouldPay.network))} on ${sanitizeLine(result.wouldPay.network, 64)}`
+      );
+      this.log(`  payTo    ${result.wouldPay.payTo}`);
+      this.log(`  from     ${payer.address}`);
+      if (result.wouldPay.scheme === "upto") {
+        this.log("\n  The server charges anything up to that and decides after the work is done.");
+        this.log("  Your caps are measured against the ceiling, since the charge is not knowable yet.");
+      }
+      this.log("\nNothing was signed or spent. Re-run with --pay to go through with it.");
+      return;
+    }
+    if (!result.paid) {
+      this.log(`${result.status} (no payment required)`);
+      this.logBody(result.body);
+      return;
+    }
+    this.log("Paid.\n");
+    this.log(
+      `  amount   ${formatUsdc(result.payment?.amount, priceDecimals(result.payment?.network))} on ${sanitizeLine(result.payment?.network, 64)}`
+    );
+    if (result.payment?.scheme === "upto" && BigInt(result.payment.authorized) !== BigInt(result.payment.amount)) {
+      this.log(`  of up to ${formatUsdc(result.payment.authorized, priceDecimals(result.payment.network))} authorized`);
+    }
+    this.log(`  payTo    ${result.payment?.payTo}`);
+    if (result.topUp) {
+      this.log(`  top-up   ${formatUsdc(result.topUp.amount, topUpDecimals)} pulled from the owner account`);
+    }
+    if (result.permit2Approval) {
+      this.log(`  approval ${result.permit2Approval.batchId} granted Permit2 the allowance upto settles through`);
+    }
+    if (result.payment?.txHash) {
+      this.log(`  tx       ${result.payment.txHash}`);
+    }
+    this.log(`
+${result.status} OK`);
+    this.logBody(result.body);
+  }
+  logBody(body) {
+    if (body === void 0 || body === null || body === "") return;
+    this.log("");
+    this.log(sanitizeBlock(typeof body === "string" ? body : JSON.stringify(body, null, 2)));
+  }
+};
+
+export { X402Pay as default };
+//# sourceMappingURL=pay.js.map
+//# sourceMappingURL=pay.js.map