@naulon/wayfarer 0.1.2 → 0.3.0

package/dist/gateway.js

@@ -20,7 +20,7 @@
  * deposits via the SDK `GatewayClient` for backwards compatibility.
  */
 import {} from "viem";
-import { activeNetwork, getConfig } from "@naulon/shared";
+import { activeNetwork, arcPreviewHeaders, getConfig } from "@naulon/shared";
 import { classifyPaymentError, classifySignerRefusal, probe, } from "./buyer.js";
 import { runPaidFetch } from "./paidFetch.js";
 function envAccountKey() {
@@ -85,8 +85,7 @@ export function gatewayBuyer(signer) {
             // reported the "0x" placeholder until the first pay — agent.ts logs `wallet ${address}`
             // BEFORE init(), so an operator saw `wallet 0x` instead of the real derived address.
             await getSigner();
-            const { GatewayClient } = await import("@circle-fin/x402-batching/client");
-            const client = new GatewayClient({ chain: activeNetwork().chainName, privateKey: envAccountKey() });
+            const client = await newGatewayClient(activeNetwork().chainName, envAccountKey());
             console.log(`  depositing ${cfg.DEPOSIT_AMOUNT_USDC} USDC into the Gateway Wallet...`);
             const result = await client.deposit(cfg.DEPOSIT_AMOUNT_USDC);
             console.log(`  deposit tx ${result.depositTxHash}`);
@@ -116,6 +115,30 @@ export function gatewayBuyer(signer) {
         },
     };
 }
+/**
+ * The `GatewayClient` constructor config for a chain + key. Pure + exported for direct
+ * unit testing, the same discipline as tollgate's `facilitatorHeaders` — the six SDK call
+ * sites below all build their client through `newGatewayClient`, so this IS the config
+ * that runs, not a parallel copy.
+ *
+ * `headers` is the load-bearing part. SDK 3.2.0 turned the Arc private-mainnet header on
+ * by itself (`config.arcPrivateMainnet ?? config.chain === "arc"`); 3.3.0 deleted that
+ * default along with the whole `arcPrivateMainnet` option, so a client built with only
+ * `{chain, privateKey}` now sends nothing. Passing it explicitly keeps Arc-mainnet
+ * funding calls behaving exactly as they did on 3.2.0, and — unlike the old default —
+ * says so out loud at a spot a reader can find.
+ */
+export function gatewayClientConfig(chain, privateKey) {
+    return { chain, privateKey, headers: arcPreviewHeaders(chain) };
+}
+/** One owner for every `GatewayClient` construction in this module: the lazy SDK import
+ *  (so the mock/memo paths never pull the SDK in) plus `gatewayClientConfig`. Six wrappers
+ *  used to repeat both, which is how the deleted 3.3.0 default would have gone missing in
+ *  six places at once. */
+async function newGatewayClient(chain, privateKey) {
+    const { GatewayClient } = await import("@circle-fin/x402-batching/client");
+    return new GatewayClient(gatewayClientConfig(chain, privateKey));
+}
 /**
  * Out-of-band, custody-free deposit into the Circle Gateway Wallet — the non-custodial contract that
  * holds the buyer's unified balance (Circle infra, buyer-controlled; naulon custodies nothing). The
@@ -125,17 +148,33 @@ export function gatewayBuyer(signer) {
  * script/operator calls. SDK loaded lazily so the mock/memo paths never pull it in.
  */
 export async function gatewayDeposit(opts) {
-    const { GatewayClient } = await import("@circle-fin/x402-batching/client");
-    const client = new GatewayClient({ chain: opts.chain, privateKey: opts.privateKey });
+    const client = await newGatewayClient(opts.chain, opts.privateKey);
     return client.deposit(opts.amountUsdc);
 }
+/**
+ * Withdraw from the Gateway unified balance back to a normal address. Same-chain by
+ * construction — `withdraw()` to the source chain is instant (no 7-day delay); the
+ * trustless initiate/complete pair is emergency-only, for a Circle API outage. `chain`
+ * is passed explicitly even though `withdraw()` already defaults to the source chain
+ * when `options.chain` is omitted — the same-chain intent is the whole point of this
+ * wrapper, so it stays legible and testable rather than inherited from a default.
+ * `maxFee` is left at the SDK default (2.01 USDC) — inventing a fee ceiling at this
+ * layer is a product decision this wrapper hasn't been given.
+ * NOTE: `transfer()` is a one-line deprecated alias for this same call
+ * (`transfer(amount, chain, recipient) => withdraw(amount, { chain, recipient })`) —
+ * don't "helpfully" switch back to it.
+ * SDK lazy, so the mock/memo paths never pull it in — same discipline as `gatewayDeposit`.
+ */
+export async function gatewayWithdraw(opts) {
+    const client = await newGatewayClient(opts.chain, opts.privateKey);
+    return client.withdraw(opts.amountUsdc, { chain: opts.chain, recipient: opts.to });
+}
 /** Read the wallet + Gateway balances for a key — the preflight a deposit script shows before it moves
  *  funds, and the check the buyer uses to see if its unified balance covers a toll. Pass `address` to
  *  read ANOTHER account's balances (e.g. confirm the AUTHOR received a settle) — the client key only
  *  authenticates the read, it needn't own the address. SDK loaded lazily. */
 export async function gatewayBalances(opts) {
-    const { GatewayClient } = await import("@circle-fin/x402-batching/client");
-    return new GatewayClient({ chain: opts.chain, privateKey: opts.privateKey }).getBalances(opts.address);
+    return (await newGatewayClient(opts.chain, opts.privateKey)).getBalances(opts.address);
 }
 /**
  * Look up a single Gateway transfer (a settlement) by its Circle id — the `settlementRef` a gateway
@@ -144,8 +183,7 @@ export async function gatewayBalances(opts) {
  * correct "did the settle land?" check — pair `status` with `classifyGatewaySettlement`. SDK lazy.
  */
 export async function gatewayTransferStatus(opts) {
-    const { GatewayClient } = await import("@circle-fin/x402-batching/client");
-    return new GatewayClient({ chain: opts.chain, privateKey: opts.privateKey }).getTransferById(opts.id);
+    return (await newGatewayClient(opts.chain, opts.privateKey)).getTransferById(opts.id);
 }
 /**
  * Search Gateway transfers with optional filters (`to`/`from`/`status`/`network`/date range). Use to
@@ -154,8 +192,7 @@ export async function gatewayTransferStatus(opts) {
  */
 export async function gatewayTransfers(opts) {
     const { chain, privateKey, ...params } = opts;
-    const { GatewayClient } = await import("@circle-fin/x402-batching/client");
-    return new GatewayClient({ chain, privateKey }).searchTransfers(params);
+    return (await newGatewayClient(chain, privateKey)).searchTransfers(params);
 }
 /**
  * Classify a Circle Gateway transfer `status` into settled / pending / failed. This is the CODE form

package/dist/gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAgD,MAAM,MAAM,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAW1D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,GAKN,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA4B9C,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2BAA2B,aAAa,EAAE,CAAC,SAAS,2CAA2C;YAC7F,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,iBAAiB,EAAE,CAAkB,CAAC;AAC1H,CAAC;AAED;;;wFAGwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,MAAc,EACd,WAAmB;IAEnB,6FAA6F;IAC7F,2FAA2F;IAC3F,8FAA8F;IAC9F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,2EAA2E;IAC3E,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,IAAI,CAAC,MAAM,4BAA4B;YACtF,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAoC,CAAC;IACjE,gGAAgG;IAChG,IAAI,YAAY,CAAC,KAAK,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,6FAA6F;YAC3F,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,YAAqB,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,6FAA6F;IAC7F,mFAAmF;IACnF,IAAI,QAAQ,GAAyB,MAAM,IAAI,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,IAA4B,EAAE;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,GAAG,mBAAmB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,aAA2C,IAAI,IAAI,CAAC,CAAC;IAE7G,OAAO;QACL,IAAI,OAAO;YACT,OAAO,QAAQ,EAAE,OAAO,IAAI,eAAe,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,IAAI;YACR,qFAAqF;YACrF,sFAAsF;YACtF,kFAAkF;YAClF,IAAI,MAAM;gBAAE,OAAO;YACnB,qFAAqF;YACrF,oFAAoF;YACpF,wFAAwF;YACxF,qFAAqF;YACrF,MAAM,SAAS,EAAE,CAAC;YAClB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,mBAAmB,kCAAkC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,IAAI;YACb,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAgB;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAwB,CAAC;YAC9C,2FAA2F;YAC3F,4FAA4F;YAC5F,sFAAsF;YACtF,6FAA6F;YAC7F,4FAA4F;YAC5F,OAAO,YAAY,CACjB,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,oFAAoF;gBACpF,qFAAqF;gBACrF,yDAAyD;gBACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjE,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;gBACR,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC7C,OAAO,OAAO;oBACZ,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;oBAClC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,CAAC,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuE;IAEvE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,OAAO,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAgE;IAEhE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,OAAO,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAA4E;IAE5E,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,OAAO,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAKD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAsB;IAC9D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,+EAA+E;YAC/E,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,WAAW,GAAU,MAAM,CAAC;YAClC,KAAK,WAAW,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAgD,MAAM,MAAM,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAY7E,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,GAKN,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA4B9C,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2BAA2B,aAAa,EAAE,CAAC,SAAS,2CAA2C;YAC7F,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,iBAAiB,EAAE,CAAkB,CAAC;AAC1H,CAAC;AAED;;;wFAGwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,MAAc,EACd,WAAmB;IAEnB,6FAA6F;IAC7F,2FAA2F;IAC3F,8FAA8F;IAC9F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,2EAA2E;IAC3E,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,IAAI,CAAC,MAAM,4BAA4B;YACtF,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAoC,CAAC;IACjE,gGAAgG;IAChG,IAAI,YAAY,CAAC,KAAK,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,6FAA6F;YAC3F,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,YAAqB,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,6FAA6F;IAC7F,mFAAmF;IACnF,IAAI,QAAQ,GAAyB,MAAM,IAAI,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,IAA4B,EAAE;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,GAAG,mBAAmB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,aAA2C,IAAI,IAAI,CAAC,CAAC;IAE7G,OAAO;QACL,IAAI,OAAO;YACT,OAAO,QAAQ,EAAE,OAAO,IAAI,eAAe,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,IAAI;YACR,qFAAqF;YACrF,sFAAsF;YACtF,kFAAkF;YAClF,IAAI,MAAM;gBAAE,OAAO;YACnB,qFAAqF;YACrF,oFAAoF;YACpF,wFAAwF;YACxF,qFAAqF;YACrF,MAAM,SAAS,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,mBAAmB,kCAAkC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,IAAI;YACb,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAgB;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAwB,CAAC;YAC9C,2FAA2F;YAC3F,4FAA4F;YAC5F,sFAAsF;YACtF,6FAA6F;YAC7F,4FAA4F;YAC5F,OAAO,YAAY,CACjB,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,oFAAoF;gBACpF,qFAAqF;gBACrF,yDAAyD;gBACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjE,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;gBACR,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC7C,OAAO,OAAO;oBACZ,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;oBAClC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,CAAC,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAyB,EACzB,UAAe;IAEf,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;0BAG0B;AAC1B,KAAK,UAAU,gBAAgB,CAAC,KAAyB,EAAE,UAAe;IACxE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,OAAO,IAAI,aAAa,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AACnE,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAMrC;IACC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuE;IAEvE,OAAO,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAgE;IAEhE,OAAO,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAA4E;IAE5E,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9C,OAAO,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAKD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAsB;IAC9D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,+EAA+E;YAC/E,2EAA2E;YAC3E,4EAA4E;YAC5E,MAAM,WAAW,GAAU,MAAM,CAAC;YAClC,KAAK,WAAW,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib.d.ts

@@ -13,19 +13,21 @@
  */
 export { run } from "./agent.ts";
 export type { Logger, RunOptions } from "./agent.ts";
-export { tollgateBase, articleUrl, fetchJwks, verifyAgainst } from "./agent.ts";
+export { tollgateBase, articleUrl, fetchJwks, verifyAgainst, licenseIdentityFor } from "./agent.ts";
 export { discover } from "./discover.ts";
-export { appraise } from "./appraise.ts";
+export { resolvedDiscoverySourceUrl } from "./discovery.ts";
+export { appraise, buildAppraisePrompt, evidenceLine, parseRelevance } from "./appraise.ts";
+export type { AppraisalSubject, AppraisePromptOptions } from "./appraise.ts";
 export { probe, probePrice, probeFailure, assemblePayment, rereadWithLicense, selectBuyer, quotedTotalAtomic, tollMovedOrNull, classifyPaymentError, } from "./buyer.ts";
 export type { Buyer, Quoted, LegRequirements, Fetched, FetchErrorCode, PayGuard, ProbeOutcome } from "./buyer.ts";
 export { mockBuyer } from "./pay.ts";
-export { gatewayBuyer, gatewayDeposit, gatewayBalances, gatewayTransferStatus, gatewayTransfers, classifyGatewaySettlement, } from "./gateway.ts";
+export { gatewayBuyer, gatewayDeposit, gatewayWithdraw, gatewayBalances, gatewayTransferStatus, gatewayTransfers, classifyGatewaySettlement, } from "./gateway.ts";
 export type { GatewaySigner, GatewayDepositOpts, GatewaySettlementState } from "./gateway.ts";
-export { memoBuyer, signMemoPayment } from "./memo.ts";
-export type { MemoSigner } from "./memo.ts";
+export { memoBuyer, signMemoPayment, assembleMemoPayment } from "./memo.ts";
+export type { MemoSigner, MemoTypedData } from "./memo.ts";
 export { railBuyer } from "./rail.ts";
 export type { RailSigners } from "./rail.ts";
-export { decide, DEFAULT_POLICY, spendGate } from "./decide.ts";
+export { decide, DEFAULT_POLICY, payHostOf, spendGate } from "./decide.ts";
 export type { DecisionPolicy, DecideContext, SpendVerdict } from "./decide.ts";
 export { authorizeOrigin } from "./origin-policy.ts";
 export type { OriginRequest, OriginVerdict, PayableTarget } from "./origin-policy.ts";

package/dist/lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKrD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhF,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,OAAO,EACL,KAAK,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACvD,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3G,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,YAAY,EACV,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,GACV,MAAM,YAAY,CAAC"}
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMrD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGpG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5F,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAG7E,OAAO,EACL,KAAK,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC5E,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3E,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3G,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,YAAY,EACV,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,GACV,MAAM,YAAY,CAAC"}

package/dist/lib.js

@@ -14,21 +14,23 @@
 // ── pipeline entry ──────────────────────────────────────────────────────────
 export { run } from "./agent.js";
 // Pipeline primitives a second consumer (the MCP server) reuses to resolve an
-// article URL from a slug against the configured gate, and to verify a captured
+// article URL from a slug against the configured gate, to derive the gate's
+// canonical license identity from a paid-into URL, and to verify a captured
 // license against the gate's JWKS — single-sourced here so the two can't drift.
-export { tollgateBase, articleUrl, fetchJwks, verifyAgainst } from "./agent.js";
+export { tollgateBase, articleUrl, fetchJwks, verifyAgainst, licenseIdentityFor } from "./agent.js";
 // ── discover ────────────────────────────────────────────────────────────────
 export { discover } from "./discover.js";
+export { resolvedDiscoverySourceUrl } from "./discovery.js";
 // ── appraise ────────────────────────────────────────────────────────────────
-export { appraise } from "./appraise.js";
+export { appraise, buildAppraisePrompt, evidenceLine, parseRelevance } from "./appraise.js";
 // ── quote + pay (the Buyer seam) ────────────────────────────────────────────
 export { probe, probePrice, probeFailure, assemblePayment, rereadWithLicense, selectBuyer, quotedTotalAtomic, tollMovedOrNull, classifyPaymentError, } from "./buyer.js";
 export { mockBuyer } from "./pay.js";
-export { gatewayBuyer, gatewayDeposit, gatewayBalances, gatewayTransferStatus, gatewayTransfers, classifyGatewaySettlement, } from "./gateway.js";
-export { memoBuyer, signMemoPayment } from "./memo.js";
+export { gatewayBuyer, gatewayDeposit, gatewayWithdraw, gatewayBalances, gatewayTransferStatus, gatewayTransfers, classifyGatewaySettlement, } from "./gateway.js";
+export { memoBuyer, signMemoPayment, assembleMemoPayment } from "./memo.js";
 export { railBuyer } from "./rail.js";
 // ── decide (policy) ─────────────────────────────────────────────────────────
-export { decide, DEFAULT_POLICY, spendGate } from "./decide.js";
+export { decide, DEFAULT_POLICY, payHostOf, spendGate } from "./decide.js";
 // ── origin policy (whose origin may money touch) ─────────────────────────────
 // The one answer to that question; `spendGate` above stays the one answer to "how
 // much". `PayableTarget` is mintable only by `authorizeOrigin`, so a pay path that

package/dist/lib.js.map

@@ -1 +1 @@
-{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+EAA+E;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAGjC,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhF,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,+EAA+E;AAC/E,OAAO,EACL,KAAK,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,+EAA+E;AAC/E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGhE,gFAAgF;AAChF,kFAAkF;AAClF,mFAAmF;AACnF,wEAAwE;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,gFAAgF;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,+EAA+E;AAC/E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,+EAA+E;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+EAA+E;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAGjC,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEpG,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG5F,+EAA+E;AAC/E,OAAO,EACL,KAAK,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAE5E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,+EAA+E;AAC/E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG3E,gFAAgF;AAChF,kFAAkF;AAClF,mFAAmF;AACnF,wEAAwE;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,gFAAgF;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,+EAA+E;AAC/E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,+EAA+E;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/memo.d.ts

@@ -1,5 +1,5 @@
 import { type TypedDataDomain } from "viem";
-import { TRANSFER_WITH_AUTHORIZATION_TYPES, type MemoAuthorization } from "@naulon/shared";
+import { TRANSFER_WITH_AUTHORIZATION_TYPES, type MemoAuthorization, type SettlementNetwork } from "@naulon/shared";
 import { type Buyer, type LegRequirements, type Quoted } from "./buyer.ts";
 /**
  * The signer seam (BUY-2). By default the memo buyer signs each EIP-3009 leg with the local
@@ -11,19 +11,33 @@ import { type Buyer, type LegRequirements, type Quoted } from "./buyer.ts";
  */
 export interface MemoSigner {
     address: `0x${string}`;
-    signTypedData(args: {
-        domain: TypedDataDomain;
-        types: typeof TRANSFER_WITH_AUTHORIZATION_TYPES;
-        primaryType: "TransferWithAuthorization";
-        message: {
-            from: `0x${string}`;
-            to: `0x${string}`;
-            value: bigint;
-            validAfter: bigint;
-            validBefore: bigint;
-            nonce: `0x${string}`;
-        };
-    }): Promise<`0x${string}`>;
+    signTypedData(args: MemoTypedData): Promise<`0x${string}`>;
+    /**
+     * OPTIONAL batch sign — sign EVERY leg of a multi-leg toll (operator fee, co-author split) in ONE
+     * call, so a batch-capable host can RESERVE them atomically (all-or-nothing, no stranded sibling
+     * leg). Returns one signature per input, index-aligned.
+     *
+     * A signer WITHOUT this method (a local env-key `PrivateKeyAccount`, the OSS self-host path, or a mock)
+     * falls back to per-leg signing via {@link assembleMemoPayment} — safe there precisely because those
+     * paths take no host-side reserve (mock) or never carry a multi-leg quote through a hosted grant. Only
+     * an injected cloud signer that reserves needs the atomicity, and only it implements this.
+     */
+    signTypedDataBatch?(argsList: MemoTypedData[]): Promise<`0x${string}`[]>;
+}
+/** The EIP-3009 `TransferWithAuthorization` typed data a memo leg signs — one shape for the single and
+ *  batch signer methods so a leg is signed identically however it is batched. */
+export interface MemoTypedData {
+    domain: TypedDataDomain;
+    types: typeof TRANSFER_WITH_AUTHORIZATION_TYPES;
+    primaryType: "TransferWithAuthorization";
+    message: {
+        from: `0x${string}`;
+        to: `0x${string}`;
+        value: bigint;
+        validAfter: bigint;
+        validBefore: bigint;
+        nonce: `0x${string}`;
+    };
 }
 /** Sign a raw USDC EIP-3009 `TransferWithAuthorization` against the active network's USDC
  *  EIP-712 domain and return the base64 `{authorization, signature}` payload the gate's
@@ -35,9 +49,19 @@ export declare function signMemoPayment(requirements: Quoted["requirements"], no
  *  per-leg primitive `assemblePayment` calls once per advertised leg (mirrors the gate's
  *  `memoLegPayload` → `buildMemoSignatures`). The memo id is NOT signed (the relayer
  *  attaches it at submit), so each leg needs nothing beyond its own authorization. */
-export declare function memoLegPayload(requirements: LegRequirements, nowMs: number, signer?: MemoSigner, net?: import("@naulon/shared").SettlementNetwork): Promise<{
+export declare function memoLegPayload(requirements: LegRequirements, nowMs: number, signer?: MemoSigner, net?: SettlementNetwork): Promise<{
     authorization: MemoAuthorization;
     signature: `0x${string}`;
 }>;
+/**
+ * Assemble the memo rail's base64 `payment-signature`. For a multi-leg toll signed by a BATCH-capable
+ * injected signer, build every leg's authorization, sign them ALL in ONE call (so the host reserves them
+ * atomically — a sibling leg that trips a ceiling can never strand an already-debited author leg), and
+ * frame the leg array (author first) exactly as {@link assemblePayment} does. Every OTHER case — a
+ * single-leg toll, the local env-key signer, or an injected signer WITHOUT a batch method — falls
+ * straight through to the per-leg path, byte-identical to before this seam existed. The multi-leg-only
+ * batch means a non-fee read and every non-hosted path are provably untouched.
+ */
+export declare function assembleMemoPayment(quoted: Quoted, nowMs: number, signer?: MemoSigner, net?: SettlementNetwork): Promise<string>;
 export declare function memoBuyer(signer?: MemoSigner): Buyer;
 //# sourceMappingURL=memo.d.ts.map

package/dist/memo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memo.d.ts","sourceRoot":"","sources":["../src/memo.ts"],"names":[],"mappings":"AAeA,OAAO,EAAS,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,EAIL,iCAAiC,EACjC,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,KAAK,EAEV,KAAK,eAAe,EAEpB,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AAGpB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,eAAe,CAAC;QACxB,KAAK,EAAE,OAAO,iCAAiC,CAAC;QAChD,WAAW,EAAE,2BAA2B,CAAC;QACzC,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACpB,EAAE,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,MAAM,CAAC;YACnB,WAAW,EAAE,MAAM,CAAC;YACpB,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;SACtB,CAAC;KACH,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;CAC5B;AAaD;;;8FAG8F;AAC9F,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;sFAIsF;AACtF,wBAAsB,cAAc,CAClC,YAAY,EAAE,eAAe,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,UAAU,EACnB,GAAG,6CAAkB,GACpB,OAAO,CAAC;IAAE,aAAa,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,CAAC,CAoCzE;AAED,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,CA+BpD"}
+{"version":3,"file":"memo.d.ts","sourceRoot":"","sources":["../src/memo.ts"],"names":[],"mappings":"AAeA,OAAO,EAAS,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,EAIL,iCAAiC,EACjC,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,KAAK,EAEV,KAAK,eAAe,EAEpB,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AAGpB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,kBAAkB,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;CAC1E;AAED;iFACiF;AACjF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,OAAO,iCAAiC,CAAC;IAChD,WAAW,EAAE,2BAA2B,CAAC;IACzC,OAAO,EAAE;QACP,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QACpB,EAAE,EAAE,KAAK,MAAM,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;KACtB,CAAC;CACH;AAaD;;;8FAG8F;AAC9F,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;sFAIsF;AACtF,wBAAsB,cAAc,CAClC,YAAY,EAAE,eAAe,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,UAAU,EACnB,GAAG,oBAAkB,GACpB,OAAO,CAAC;IAAE,aAAa,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,CAAC,CAQzE;AA6CD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,UAAU,EACnB,GAAG,GAAE,iBAAmC,GACvC,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,CA+BpD"}

package/dist/memo.js

@@ -38,17 +38,27 @@ export async function signMemoPayment(requirements, nowMs) {
  *  `memoLegPayload` → `buildMemoSignatures`). The memo id is NOT signed (the relayer
  *  attaches it at submit), so each leg needs nothing beyond its own authorization. */
 export async function memoLegPayload(requirements, nowMs, signer, net = activeNetwork()) {
-    const cfg = getConfig();
     // Default path resolves the local key; an injected signer NEVER reads BUYER_PRIVATE_KEY (the whole
     // point of the cloud wallet — the key lives in the grant-checked BFF, not this process).
     const envAccount = signer ? undefined : privateKeyToAccount(buyerKey());
     const from = (signer?.address ?? envAccount.address);
-    // Stamp validity at PAY time (nowMs is `Date.now()` from fetch, not quote time) with a
-    // MARGIN: floor the window to WAYFARER_MIN_VALIDITY_SECONDS so a gate advertising a
-    // too-short maxTimeoutSeconds can't make the authorization expire before the relay
-    // submits it (the facilitator's `authorization_validity_too_short` — the Keryx ~1-day
-    // lesson; see memory `x402-validity-window-floor`). The window only widens, never
-    // shrinks — a long gate window is honored as-is.
+    const { authorization, typedData } = buildMemoLeg(requirements, nowMs, from, net);
+    const signature = signer ? await signer.signTypedData(typedData) : await envAccount.signTypedData(typedData);
+    return { authorization, signature };
+}
+/**
+ * Build ONE leg's EIP-3009 authorization + the typed data to sign, WITHOUT signing — the pure half of
+ * {@link memoLegPayload}, shared by the per-leg and batch paths so both stamp the identical validity
+ * window and USDC domain. `from` is the already-resolved signer address.
+ *
+ * Stamps validity at PAY time (`nowMs` is `Date.now()` from fetch, not quote time) with a MARGIN: floor
+ * the window to WAYFARER_MIN_VALIDITY_SECONDS so a gate advertising a too-short maxTimeoutSeconds can't
+ * make the authorization expire before the relay submits it (the facilitator's
+ * `authorization_validity_too_short` — the Keryx ~1-day lesson; see memory `x402-validity-window-floor`).
+ * The window only widens, never shrinks — a long gate window is honored as-is.
+ */
+function buildMemoLeg(requirements, nowMs, from, net) {
+    const cfg = getConfig();
     const window = Math.max(requirements.maxTimeoutSeconds, cfg.WAYFARER_MIN_VALIDITY_SECONDS);
     const authorization = {
         from,
@@ -71,8 +81,35 @@ export async function memoLegPayload(requirements, nowMs, signer, net = activeNe
             nonce: authorization.nonce,
         },
     };
-    const signature = signer ? await signer.signTypedData(typedData) : await envAccount.signTypedData(typedData);
-    return { authorization, signature };
+    return { authorization, typedData };
+}
+/**
+ * Assemble the memo rail's base64 `payment-signature`. For a multi-leg toll signed by a BATCH-capable
+ * injected signer, build every leg's authorization, sign them ALL in ONE call (so the host reserves them
+ * atomically — a sibling leg that trips a ceiling can never strand an already-debited author leg), and
+ * frame the leg array (author first) exactly as {@link assemblePayment} does. Every OTHER case — a
+ * single-leg toll, the local env-key signer, or an injected signer WITHOUT a batch method — falls
+ * straight through to the per-leg path, byte-identical to before this seam existed. The multi-leg-only
+ * batch means a non-fee read and every non-hosted path are provably untouched.
+ */
+export async function assembleMemoPayment(quoted, nowMs, signer, net = activeNetwork()) {
+    if (quoted.legs && quoted.legs.length > 1 && signer?.signTypedDataBatch) {
+        // Build every leg first (fresh nonce + validity), then one atomic batch sign. The from is the
+        // injected signer's address — the batch path only exists for a hosted signer, which never reads the
+        // env key. Leg order (author first) is preserved into the framed array, matching assemblePayment.
+        const built = quoted.legs.map((leg) => buildMemoLeg({ ...quoted.requirements, payTo: leg.payTo, amount: leg.amount }, nowMs, signer.address, net));
+        const signatures = await signer.signTypedDataBatch(built.map((b) => b.typedData));
+        // A count mismatch means the host signed a different set than we sent — never frame a partial or
+        // misaligned payment. Fail loud; the caller's onSignError turns it into a typed, non-signed result.
+        if (signatures.length !== built.length) {
+            throw new Error(`batch signer returned ${signatures.length} signatures for ${built.length} legs`);
+        }
+        const payloads = built.map((b, i) => ({ authorization: b.authorization, signature: signatures[i] }));
+        return Buffer.from(JSON.stringify(payloads)).toString("base64");
+    }
+    // Single leg, the env-key signer, or a signer without batch: today's per-leg framing (mock/OSS/gateway
+    // paths are unaffected — assemblePayment signs one leg, or Promise.all's the legs, exactly as before).
+    return assemblePayment(quoted, (req) => memoLegPayload(req, nowMs, signer, net));
 }
 export function memoBuyer(signer) {
     const address = signer ? signer.address : privateKeyToAccount(buyerKey()).address;
@@ -90,7 +127,7 @@ export function memoBuyer(signer) {
             // single-author quote stays the bare object, byte-identical to before. The shared loop owns
             // probe→moved-guard→paid-GET→classify; the memo rail supplies only how it signs and how it
             // types a sign refusal (grant exhausted/expired/no session → typed; else a transient origin throw).
-            return runPaidFetch(url, kind, address, guard, (quoted, nowMs) => assemblePayment(quoted, (req) => memoLegPayload(req, nowMs, signer)), (error) => {
+            return runPaidFetch(url, kind, address, guard, (quoted, nowMs) => assembleMemoPayment(quoted, nowMs, signer), (error) => {
                 const refusal = classifySignerRefusal(error);
                 return refusal
                     ? { ok: false, error, ...refusal }

package/dist/memo.js.map

@@ -1 +1 @@
-{"version":3,"file":"memo.js","sourceRoot":"","sources":["../src/memo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,KAAK,EAAwB,MAAM,MAAM,CAAC;AACnD,OAAO,EACL,aAAa,EACb,SAAS,EACT,UAAU,EACV,iCAAiC,GAElC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA2B9C,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2BAA2B,aAAa,EAAE,CAAC,SAAS,0CAA0C;YAC5F,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,iBAAiB,EAAE,CAAkB,CAAC;AAC1H,CAAC;AAED;;;8FAG8F;AAC9F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoC,EACpC,KAAa;IAEb,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,YAA6B,EAC7B,KAAa,EACb,MAAmB,EACnB,GAAG,GAAG,aAAa,EAAE;IAErB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,mGAAmG;IACnG,yFAAyF;IACzF,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,UAAW,CAAC,OAAO,CAAkB,CAAC;IACvE,uFAAuF;IACvF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,iDAAiD;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAsB;QACvC,IAAI;QACJ,EAAE,EAAE,YAAY,CAAC,KAAsB;QACvC,KAAK,EAAE,YAAY,CAAC,MAAM;QAC1B,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACtD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;KACzD,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC;QAC7C,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,2BAAoC;QACjD,OAAO,EAAE;YACP,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAClC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YAC5C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;YAC9C,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B;KACF,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,UAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9G,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAmB;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;IAClF,OAAO;QACL,OAAO;QACP,KAAK,CAAC,IAAI;YACR,iFAAiF;YACjF,wFAAwF;QAC1F,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,IAAI;YACb,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAgB;YACrC,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,oGAAoG;YACpG,OAAO,YAAY,CACjB,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EACvF,CAAC,KAAK,EAAE,EAAE;gBACR,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC7C,OAAO,OAAO;oBACZ,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;oBAClC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACvE,CAAC,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"memo.js","sourceRoot":"","sources":["../src/memo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,KAAK,EAAwB,MAAM,MAAM,CAAC;AACnD,OAAO,EACL,aAAa,EACb,SAAS,EACT,UAAU,EACV,iCAAiC,GAGlC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA0C9C,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2BAA2B,aAAa,EAAE,CAAC,SAAS,0CAA0C;YAC5F,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,iBAAiB,EAAE,CAAkB,CAAC;AAC1H,CAAC;AAED;;;8FAG8F;AAC9F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoC,EACpC,KAAa;IAEb,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,YAA6B,EAC7B,KAAa,EACb,MAAmB,EACnB,GAAG,GAAG,aAAa,EAAE;IAErB,mGAAmG;IACnG,yFAAyF;IACzF,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,UAAW,CAAC,OAAO,CAAkB,CAAC;IACvE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,UAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9G,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CACnB,YAA6B,EAC7B,KAAa,EACb,IAAmB,EACnB,GAAsB;IAEtB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAsB;QACvC,IAAI;QACJ,EAAE,EAAE,YAAY,CAAC,KAAsB;QACvC,KAAK,EAAE,YAAY,CAAC,MAAM;QAC1B,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACtD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;KACzD,CAAC;IACF,MAAM,SAAS,GAAkB;QAC/B,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC;QAC7C,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE;YACP,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAClC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YAC5C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;YAC9C,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B;KACF,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAa,EACb,MAAmB,EACnB,MAAyB,aAAa,EAAE;IAExC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxE,8FAA8F;QAC9F,oGAAoG;QACpG,kGAAkG;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACpC,YAAY,CAAC,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAC3G,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,iGAAiG;QACjG,oGAAoG;QACpG,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,CAAC,MAAM,mBAAmB,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC;QACtG,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IACD,uGAAuG;IACvG,uGAAuG;IACvG,OAAO,eAAe,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAmB;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;IAClF,OAAO;QACL,OAAO;QACP,KAAK,CAAC,IAAI;YACR,iFAAiF;YACjF,wFAAwF;QAC1F,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,IAAI;YACb,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAgB;YACrC,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,oGAAoG;YACpG,OAAO,YAAY,CACjB,GAAG,EACH,IAAI,EACJ,OAAO,EACP,KAAK,EACL,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAC7D,CAAC,KAAK,EAAE,EAAE;gBACR,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC7C,OAAO,OAAO;oBACZ,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;oBAClC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACvE,CAAC,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/origin-policy.d.ts

@@ -15,7 +15,7 @@
  * the configured gate, because a different port is a different service and must not
  * satisfy the pin. That is the whole of its authority.
  *
- * It does NOT own domain policy. An allowlist names domains ("inneraxiom.com"), and
+ * It does NOT own domain policy. An allowlist names domains ("publisher.example"), and
  * which of them are payable — along with deny lists, per-domain caps, the kill switch
  * and human approval — belongs to `spendGate`, the one shared evaluator. Stating an
  * allowlist therefore REPLACES the gate pin rather than stacking with it: the operator

package/dist/origin-policy.js

@@ -15,7 +15,7 @@
  * the configured gate, because a different port is a different service and must not
  * satisfy the pin. That is the whole of its authority.
  *
- * It does NOT own domain policy. An allowlist names domains ("inneraxiom.com"), and
+ * It does NOT own domain policy. An allowlist names domains ("publisher.example"), and
  * which of them are payable — along with deny lists, per-domain caps, the kill switch
  * and human approval — belongs to `spendGate`, the one shared evaluator. Stating an
  * allowlist therefore REPLACES the gate pin rather than stacking with it: the operator

package/dist/paidFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paidFetch.d.ts","sourceRoot":"","sources":["../src/paidFetch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,oBAAoB,EACpB,qBAAqB,EAKrB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AAGpB,qGAAqG;AACrG,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,2FAA2F;AAC3F,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAErD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,KAAK,EAAE,QAAQ,GAAG,SAAS,EAC3B,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,OAAO,CAAC,CA2ElB;AAID,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"paidFetch.d.ts","sourceRoot":"","sources":["../src/paidFetch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,oBAAoB,EACpB,qBAAqB,EAMrB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,MAAM,EACZ,MAAM,YAAY,CAAC;AAGpB,qGAAqG;AACrG,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,2FAA2F;AAC3F,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAErD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,OAAO,EAAE,KAAK,MAAM,EAAE,EACtB,KAAK,EAAE,QAAQ,GAAG,SAAS,EAC3B,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,OAAO,CAAC,CAqFlB;AAID,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/paidFetch.js

@@ -4,7 +4,7 @@
  * from memoBuyer/gatewayBuyer so a third buyer (railBuyer) reuses it without a third copy of
  * the loop. Behaviour is byte-identical to the two originals (their suites are the regression).
  */
-import { AGENT_UA, classifyPaymentError, classifySignerRefusal, probe, probeFailure, quotedTotalAtomic, tollMovedOrNull, } from "./buyer.js";
+import { AGENT_UA, classifyPaymentError, classifySignerRefusal, probe, probeFailure, payeeRefusedOrNull, quotedTotalAtomic, tollMovedOrNull, } from "./buyer.js";
 import { agentFetch } from "./sign.js";
 export async function runPaidFetch(url, kind, address, guard, buildPayment, onSignError) {
     const outcome = await probe(url, kind, address);
@@ -15,6 +15,11 @@ export async function runPaidFetch(url, kind, address, guard, buildPayment, onSi
     const moved = tollMovedOrNull(quoted, guard);
     if (moved)
         return moved;
+    // Payee identity: refuse a payTo no owner authorized for this origin, BEFORE signing (nothing paid).
+    // Checked on the SAME leg set assemblePayment signs, so check == sign. Opt-in (no authorizePayee ⇒ null).
+    const refused = await payeeRefusedOrNull(quoted, guard);
+    if (refused)
+        return refused;
     // Signing and the paid fetch are wrapped SEPARATELY, because their non-spend failures classify
     // differently: a build/sign throw is rail-specific (a hosted session signer THROWS a coded grant
     // refusal → needs_topup; a config/payload fault → the rail's fallback, memo→origin_error,
@@ -46,13 +51,18 @@ export async function runPaidFetch(url, kind, address, guard, buildPayment, onSi
         const error = err instanceof Error ? err.message : String(err);
         return { ok: false, error, errorCode: "origin_error", retryable: true };
     }
+    // Both branches below hold a COMPLETE response from a gate that did not serve, so nothing settled
+    // and `unpaid` records that as knowledge. The throw paths above and the body-read failure below
+    // stay silent on it: once the request is on the wire, "it never settled" and "it settled and I
+    // lost the answer" are the same observation from here.
     if (res.status === 402) {
         const body = (await res.json().catch(() => ({})));
         const error = body.error ?? "payment rejected";
-        return { ok: false, error, ...classifyPaymentError(error) };
+        return { ok: false, error, unpaid: true, ...classifyPaymentError(error) };
+    }
+    if (!res.ok) {
+        return { ok: false, error: `origin returned ${res.status}`, errorCode: "origin_error", retryable: true, unpaid: true };
     }
-    if (!res.ok)
-        return { ok: false, error: `origin returned ${res.status}`, errorCode: "origin_error", retryable: true };
     let settlementRef;
     const respHeader = res.headers.get("payment-response");
     if (respHeader) {

package/dist/paidFetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"paidFetch.js","sourceRoot":"","sources":["../src/paidFetch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,EACL,YAAY,EACZ,iBAAiB,EACjB,eAAe,GAIhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,IAAyB,EACzB,OAAsB,EACtB,KAA2B,EAC3B,YAA0B,EAC1B,WAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,gFAAgF;IAChF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,+FAA+F;IAC/F,iGAAiG;IACjG,0FAA0F;IAC1F,2FAA2F;IAC3F,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,8CAA8C;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,GAA2C,CAAC;IAChD,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE;gBACP,YAAY,EAAE,QAAQ;gBACtB,gBAAgB,EAAE,OAAO;gBACzB,eAAe,EAAE,IAAI;gBACrB,mBAAmB,EAAE,gBAAgB;aACtC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtH,IAAI,aAAiC,CAAC;IACtC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,aAAa,GAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC,WAAW,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACjE,uFAAuF;IACvF,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,0FAA0F;IAC1F,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,sBAAsB;YACjC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,yFAAyF,KAAK,wFAAwF;SAC9L,CAAC;IACJ,CAAC;IACD,0FAA0F;IAC1F,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,8FAA8F;AAC9F,wFAAwF;AACxF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"paidFetch.js","sourceRoot":"","sources":["../src/paidFetch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,EACL,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAIhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,IAAyB,EACzB,OAAsB,EACtB,KAA2B,EAC3B,YAA0B,EAC1B,WAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,gFAAgF;IAChF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,qGAAqG;IACrG,0GAA0G;IAC1G,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,+FAA+F;IAC/F,iGAAiG;IACjG,0FAA0F;IAC1F,2FAA2F;IAC3F,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,8CAA8C;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,GAA2C,CAAC;IAChD,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE;gBACP,YAAY,EAAE,QAAQ;gBACtB,gBAAgB,EAAE,OAAO;gBACzB,eAAe,EAAE,IAAI;gBACrB,mBAAmB,EAAE,gBAAgB;aACtC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,uDAAuD;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,aAAiC,CAAC;IACtC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,aAAa,GAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC,WAAW,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACjE,uFAAuF;IACvF,yFAAyF;IACzF,yFAAyF;IACzF,yFAAyF;IACzF,0FAA0F;IAC1F,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,sBAAsB;YACjC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,yFAAyF,KAAK,wFAAwF;SAC9L,CAAC;IACJ,CAAC;IACD,0FAA0F;IAC1F,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,8FAA8F;AAC9F,wFAAwF;AACxF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/pay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pay.d.ts","sourceRoot":"","sources":["../src/pay.ts"],"names":[],"mappings":"AAQA,OAAO,EASL,KAAK,KAAK,EAIX,MAAM,YAAY,CAAC;AAEpB,wBAAgB,SAAS,IAAI,KAAK,CAoEjC"}
+{"version":3,"file":"pay.d.ts","sourceRoot":"","sources":["../src/pay.ts"],"names":[],"mappings":"AAQA,OAAO,EAUL,KAAK,KAAK,EAIX,MAAM,YAAY,CAAC;AAEpB,wBAAgB,SAAS,IAAI,KAAK,CAuEjC"}

package/dist/pay.js

@@ -6,7 +6,7 @@
  */
 import { agentFetch } from "./sign.js";
 import { getWallet } from "./wallet.js";
-import { AGENT_UA, assemblePayment, classifyPaymentError, probe, probeFailure, probePrice, quotedTotalAtomic, tollMovedOrNull, } from "./buyer.js";
+import { AGENT_UA, assemblePayment, classifyPaymentError, payeeRefusedOrNull, probe, probeFailure, probePrice, quotedTotalAtomic, tollMovedOrNull, } from "./buyer.js";
 export function mockBuyer() {
     const wallet = getWallet();
     return {
@@ -26,6 +26,10 @@ export function mockBuyer() {
             const moved = tollMovedOrNull(quoted, guard);
             if (moved)
                 return moved;
+            // Payee identity: refuse a payTo no owner authorized, before signing (parity with runPaidFetch).
+            const refused = await payeeRefusedOrNull(quoted, guard);
+            if (refused)
+                return refused;
             // One offline signature per advertised leg (operator fee → 2-leg array); a stock
             // single-author quote stays the bare object assemblePayment emits for one leg.
             const paymentSignature = await assemblePayment(quoted, (req, nonce) => ({

package/dist/pay.js.map

@@ -1 +1 @@
-{"version":3,"file":"pay.js","sourceRoot":"","sources":["../src/pay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,QAAQ,EACR,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,eAAe,GAKhB,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,CAAC,IAAI;YACR,6BAA6B;QAC/B,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,IAAI;YACb,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAgB;YACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,gFAAgF;YAChF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,iFAAiF;YACjF,+EAA+E;YAC/E,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtE,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK;aACN,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE;oBACP,YAAY,EAAE,QAAQ;oBACtB,gBAAgB,EAAE,MAAM,CAAC,OAAO;oBAChC,eAAe,EAAE,IAAI;oBACrB,mBAAmB,EAAE,gBAAgB;iBACtC;aACF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;gBACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;gBAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACtH,IAAI,aAAiC,CAAC;YACtC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,aAAa,GAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC,WAAW,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;YACjE,mFAAmF;YACnF,mFAAmF;YACnF,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,sBAAsB;oBACjC,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,iEAAiE,KAAK,wBAAwB;iBACtG,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pay.js","sourceRoot":"","sources":["../src/pay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,QAAQ,EACR,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,EACL,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,eAAe,GAKhB,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,CAAC,IAAI;YACR,6BAA6B;QAC/B,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,IAAI;YACb,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAgB;YACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,gFAAgF;YAChF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,iGAAiG;YACjG,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,iFAAiF;YACjF,+EAA+E;YAC/E,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtE,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK;aACN,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE;oBACP,YAAY,EAAE,QAAQ;oBACtB,gBAAgB,EAAE,MAAM,CAAC,OAAO;oBAChC,eAAe,EAAE,IAAI;oBACrB,mBAAmB,EAAE,gBAAgB;iBACtC;aACF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;gBACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;gBAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACtH,IAAI,aAAiC,CAAC;YACtC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,aAAa,GAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC,WAAW,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;YACjE,mFAAmF;YACnF,mFAAmF;YACnF,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,SAAS,EAAE,sBAAsB;oBACjC,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,iEAAiE,KAAK,wBAAwB;iBACtG,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pop.d.ts

@@ -2,7 +2,17 @@ import type { HeldLicense } from "./licenseStore.ts";
 import type { AgentWallet } from "./wallet.ts";
 /**
  * Build a proof-of-possession header for a held license, or null if the wallet
- * can't sign (no key) — in which case the caller must fall back to paying.
+ * can't sign (no key, or the signer itself failed) — in which case the caller
+ * must fall back to paying.
+ *
+ * `wallet.signMessage` is a real op on the hosted path — `cloudPopSigner`
+ * (wayfarer-mcp/cloud-signer.ts) POSTs to `/_naulon/buyer-wallet/sign-pop` and
+ * THROWS a `SignerError` on any non-2xx (network blip, expired session, 5xx).
+ * A held-license re-read is a best-effort free path, exactly like the re-read
+ * fetch itself (A1) — so a signing failure here must degrade to the same "can't
+ * sign" null, not propagate an uncaught rejection through every caller (run()'s
+ * cache branch, naulon_read_held) and crash the whole operation over one
+ * skippable decision (FU-A1b).
  */
 export declare function buildPopProof(held: HeldLicense, wallet: AgentWallet, now: number): Promise<string | null>;
 //# sourceMappingURL=pop.d.ts.map

package/dist/pop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pop.d.ts","sourceRoot":"","sources":["../src/pop.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;GAGG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxB"}
+{"version":3,"file":"pop.d.ts","sourceRoot":"","sources":["../src/pop.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB"}

package/dist/pop.js

@@ -11,7 +11,17 @@ import { randomBytes } from "node:crypto";
 import { popMessage } from "@naulon/shared";
 /**
  * Build a proof-of-possession header for a held license, or null if the wallet
- * can't sign (no key) — in which case the caller must fall back to paying.
+ * can't sign (no key, or the signer itself failed) — in which case the caller
+ * must fall back to paying.
+ *
+ * `wallet.signMessage` is a real op on the hosted path — `cloudPopSigner`
+ * (wayfarer-mcp/cloud-signer.ts) POSTs to `/_naulon/buyer-wallet/sign-pop` and
+ * THROWS a `SignerError` on any non-2xx (network blip, expired session, 5xx).
+ * A held-license re-read is a best-effort free path, exactly like the re-read
+ * fetch itself (A1) — so a signing failure here must degrade to the same "can't
+ * sign" null, not propagate an uncaught rejection through every caller (run()'s
+ * cache branch, naulon_read_held) and crash the whole operation over one
+ * skippable decision (FU-A1b).
  */
 export async function buildPopProof(held, wallet, now) {
     if (!wallet.signMessage)
@@ -19,7 +29,13 @@ export async function buildPopProof(held, wallet, now) {
     const ts = Math.floor(now / 1000);
     const nonce = randomBytes(16).toString("hex");
     const message = popMessage({ aud: held.aud, jti: held.jti, slug: held.slug, ts, nonce });
-    const sig = await wallet.signMessage(message);
+    let sig;
+    try {
+        sig = await wallet.signMessage(message);
+    }
+    catch {
+        return null;
+    }
     return `${ts}.${nonce}.${sig}`;
 }
 //# sourceMappingURL=pop.js.map