@parallel-protocol/x402 0.10.0 → 0.10.1

package/dist/{chunk-VSNDEQGS.js → chunk-CNASNROQ.js}

@@ -1,4 +1,4 @@
-import { X402_ERROR_CODES, X402ConfigError, X402RuntimeError, isPriceRejection } from './chunk-QAECRSWF.js';
+import { X402_ERROR_CODES, X402ConfigError, X402RuntimeError, isPriceRejection } from './chunk-MZCHBBUN.js';
 import { isKnownChain, isActiveParallelizerChain, ACTIVE_PARALLELIZER_CHAINS, getUptoEscrowAddress, getTokenDecimals as getTokenDecimals$1 } from '@parallel-protocol/chains';
 import { permit2NonceToBytes32 } from '@parallel-protocol/payment-core';
 import { z } from 'zod';
@@ -114,18 +114,144 @@ function encodeBase64(obj) {
 function decodeBase64(str) {
   return JSON.parse(Buffer.from(str, "base64").toString("utf8"));
 }
-function matchRoute(path, routes) {
-  if (routes[path]) return routes[path];
+var CONDITIONAL_HEADERS = [
+  "if-match",
+  "if-none-match",
+  "if-modified-since",
+  "if-unmodified-since"
+];
+function dropConditionalHeaders(headers) {
+  for (const name of CONDITIONAL_HEADERS) delete headers[name];
+}
+var UTF8 = new TextDecoder();
+var DECODE_ROUNDS = 8;
+function decodePercent(path) {
+  try {
+    return decodeURIComponent(path);
+  } catch {
+    return path.replace(
+      /(?:%[\da-f]{2})+/gi,
+      (run) => UTF8.decode(
+        Uint8Array.from(
+          run.slice(1).split("%"),
+          (hex) => Number.parseInt(hex, 16)
+        )
+      )
+    );
+  }
+}
+function hasLongMarkRun(segment) {
+  for (const [run] of segment.matchAll(/\p{M}+/gu))
+    if (run.length > 8) return true;
+  return false;
+}
+function foldCase(segment) {
+  const composed = hasLongMarkRun(segment) ? segment : segment.normalize("NFC");
+  return composed.toLowerCase().toUpperCase().toLowerCase();
+}
+function pathSegments(path) {
+  let decoded = path;
+  for (let round = 0; round < DECODE_ROUNDS && decoded.includes("%"); round++) {
+    const next = decodePercent(decoded);
+    if (next === decoded) break;
+    decoded = next;
+  }
+  const target = decoded.replaceAll("\\", "/").replace(/^[a-z][\d+.a-z-]*:\/\/[^/]*/i, "").split(/[?#]/, 1)[0] ?? "";
+  return target.split("/").map((segment) => foldCase(segment).split(";", 1)[0] ?? "").filter((segment) => segment !== "");
+}
+function resolveDots(segments) {
+  const resolved = [];
+  for (const segment of segments) {
+    if (segment === "..") resolved.pop();
+    else if (segment !== ".") resolved.push(segment);
+  }
+  return resolved;
+}
+function normalizeRoutePath(path) {
+  return `/${resolveDots(pathSegments(path)).join("/")}`;
+}
+function routeTable(routes) {
+  return Object.entries(routes).map(([key, route]) => [
+    normalizeRoutePath(key),
+    route
+  ]);
+}
+function longestMatch(target, table) {
   let bestMatch;
   let bestLength = 0;
-  for (const [pattern, config] of Object.entries(routes)) {
-    if (path.startsWith(`${pattern}/`) && pattern.length > bestLength) {
-      bestMatch = config;
-      bestLength = pattern.length;
+  for (const [key, route] of table) {
+    if (key === target) return route;
+    if (target.startsWith(`${key}/`) && key.length > bestLength) {
+      bestMatch = route;
+      bestLength = key.length;
     }
   }
   return bestMatch;
 }
+function findRoute(path, table) {
+  const segments = pathSegments(path);
+  const dotSegments = segments.some(
+    (segment) => segment === "." || segment === ".."
+  );
+  const routePath = `/${resolveDots(segments).join("/")}`;
+  const route = longestMatch(routePath, table) ?? (dotSegments ? longestMatch(`/${segments.join("/")}`, table) : void 0);
+  return { route, dotSegments, routePath };
+}
+function isPreflightHeader(name) {
+  return /^(?:access-control-|vary$|allow$)/i.test(String(name));
+}
+function preflightHeaders(headers) {
+  if (Array.isArray(headers)) {
+    if (Array.isArray(headers[0]))
+      return headers.filter((pair) => isPreflightHeader(pair[0]));
+    return headers.flatMap(
+      (item, i) => i % 2 === 0 && isPreflightHeader(item) ? [item, headers[i + 1]] : []
+    );
+  }
+  if (headers !== null && typeof headers === "object")
+    return Object.fromEntries(
+      Object.entries(headers).filter(([name]) => isPreflightHeader(name))
+    );
+  return headers;
+}
+function answerAsPreflight(res) {
+  const writeHead = res.writeHead.bind(res);
+  const end = res.end.bind(res);
+  const callbackOf = (args) => args.find((arg) => typeof arg === "function");
+  const dropOtherHeaders = () => {
+    for (const name of res.getHeaderNames())
+      if (!isPreflightHeader(name)) res.removeHeader(name);
+  };
+  res.writeHead = ((statusCode, ...rest) => {
+    dropOtherHeaders();
+    res.statusMessage = "";
+    const headers = rest.find((arg) => typeof arg !== "string");
+    return headers === void 0 ? writeHead(statusCode) : writeHead(statusCode, preflightHeaders(headers));
+  });
+  res.write = ((...args) => {
+    const done = callbackOf(args);
+    if (done) queueMicrotask(done);
+    return true;
+  });
+  res.end = ((...args) => {
+    if (!res.headersSent) dropOtherHeaders();
+    const done = callbackOf(args);
+    return done ? end(done) : end();
+  });
+  res.addTrailers = () => {
+  };
+  res.writeEarlyHints = ((_hints, done) => {
+    if (done) queueMicrotask(done);
+  });
+}
+function preflightInit(res) {
+  res.body?.cancel().catch(() => {
+  });
+  const headers = new Headers();
+  for (const [name, value] of res.headers)
+    if (isPreflightHeader(name)) headers.append(name, value);
+  return { status: res.status, headers };
+}
 function permit2Extra(network, asset) {
   const domain = USDC_EIP712_DOMAIN[network];
   const escrow = getUptoEscrowAddress(network);
@@ -296,9 +422,31 @@ var routeConfigSchema = z.object({
   (route) => route.scheme !== "upto" || !hasMixedDecimals(route.network, route.acceptedTokens) || typeof route.price !== "bigint" && route.decimals === void 0,
   'An upto route that accepts tokens with different decimals needs a price like "0.01", not a bigint or an explicit decimals'
 );
+function sameValue(a, b) {
+  if (Object.is(a, b)) return true;
+  if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+  const entries = Object.entries(a);
+  return Array.isArray(a) === Array.isArray(b) && entries.length === Object.keys(b).length && entries.every(
+    ([key, value]) => sameValue(value, b[key])
+  );
+}
+function consistentRoutePaths(routes, ctx) {
+  const keyByPath = /* @__PURE__ */ new Map();
+  for (const [key, route] of Object.entries(routes)) {
+    const path = normalizeRoutePath(key);
+    const other = keyByPath.get(path);
+    if (other === void 0) keyByPath.set(path, key);
+    else if (!sameValue(routes[other], route))
+      ctx.addIssue({
+        code: "custom",
+        path: [key],
+        message: `Same path as "${other}" once normalized, with another config: keep one of the two routes`
+      });
+  }
+}
 var paymentMiddlewareConfigSchema = z.object({
   facilitator: facilitatorConfigSchema,
-  routes: z.record(z.string(), routeConfigSchema).refine((r) => Object.keys(r).length > 0, "At least one route is required")
+  routes: z.record(z.string(), routeConfigSchema).refine((r) => Object.keys(r).length > 0, "At least one route is required").superRefine(consistentRoutePaths)
 });
 var facilitatorResponseSchema = z.discriminatedUnion("success", [
   z.object({
@@ -583,10 +731,11 @@ async function raceTimeout(promise, ms = HANDLER_TIMEOUT_MS) {
 
 // src/middleware.ts
 var PRICE_FORMAT = /^\d+(?:\.\d+)?$/;
-async function requestContext(adapter) {
+async function requestContext(adapter, routePath) {
   return {
     method: adapter.getMethod(),
     path: adapter.getPath(),
+    routePath,
     url: adapter.getUrl(),
     header: (name) => adapter.getHeader(name),
     body: adapter.getBody ? await adapter.getBody() : void 0
@@ -882,13 +1031,28 @@ function createPaymentGate(config) {
     );
   }
   const client = new FacilitatorClient(config.facilitator);
+  const routes = routeTable(config.routes);
   return async (adapter) => {
-    if (adapter.getMethod().toUpperCase() === "OPTIONS")
-      return { type: "pass" };
-    const routeConfig = matchRoute(adapter.getPath(), config.routes);
+    const path = adapter.getPath();
+    const fullPath = adapter.getFullPath?.();
+    let match = findRoute(path, routes);
+    if (!match.route && fullPath !== void 0 && fullPath !== path)
+      match = findRoute(fullPath, routes);
+    const { route: routeConfig, dotSegments, routePath } = match;
     if (!routeConfig) return { type: "pass" };
+    if (dotSegments) {
+      return {
+        type: "error",
+        result: jsonResult(400, {
+          error: X402_ERROR_CODES.INVALID_PATH,
+          message: "A paid route is not served on a path with . or .. segments: send the path resolved"
+        })
+      };
+    }
+    if (adapter.getMethod().toUpperCase() === "OPTIONS")
+      return { type: "pass", preflight: true };
     const resolvedTokens = resolveAcceptedTokens(routeConfig);
-    let request = typeof routeConfig.price === "function" ? await requestContext(adapter) : void 0;
+    let request = typeof routeConfig.price === "function" ? await requestContext(adapter, routePath) : void 0;
     let price;
     try {
       price = await resolvePrice(routeConfig, request, resolvedTokens);
@@ -943,7 +1107,7 @@ function createPaymentGate(config) {
       };
     }
     const meter = routeConfig.meter && hasMixedDecimals(routeConfig.network, resolvedTokens) ? refusingBigints(routeConfig.meter) : routeConfig.meter;
-    if (meter && !request) request = await requestContext(adapter);
+    if (meter && !request) request = await requestContext(adapter, routePath);
     return {
       type: "verified",
       scheme: routeConfig.scheme ?? "exact",
@@ -1025,7 +1189,8 @@ function createPaymentMiddleware(config) {
   const gate = createPaymentGate(config);
   return async (adapter) => {
     const gateResult = await gate(adapter);
-    if (gateResult.type === "pass") return { pass: true };
+    if (gateResult.type === "pass")
+      return gateResult.preflight ? { pass: true, preflight: true } : { pass: true };
     if (gateResult.type === "error") return gateResult.result;
     let handlerResult;
     try {
@@ -1077,4 +1242,4 @@ function createPaymentMiddleware(config) {
   };
 }
 
-export { FacilitatorClient, HANDLER_TIMEOUT, PARALLEL_TOKENS, SETTLE_AMOUNT_HEADER, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, invalidSettleAmountResponse, isJsonContentType, jsonFromResponse, matchRoute, parseJsonBody, parsePrice, raceTimeout, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };
+export { FacilitatorClient, HANDLER_TIMEOUT, PARALLEL_TOKENS, SETTLE_AMOUNT_HEADER, answerAsPreflight, createPaymentGate, createPaymentMiddleware, dropConditionalHeaders, encodeBase64, findRoute, getDefaultAcceptedTokens, invalidSettleAmountResponse, isJsonContentType, jsonFromResponse, normalizeRoutePath, parseJsonBody, parsePrice, preflightInit, raceTimeout, resolveCharge, resolveSettleAmount, routeTable, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };

package/dist/{chunk-QAECRSWF.js → chunk-MZCHBBUN.js}

@@ -3,6 +3,8 @@ var X402_ERROR_CODES = {
   FACILITATOR_UNAVAILABLE: "FACILITATOR_UNAVAILABLE",
   FACILITATOR_INVALID_RESPONSE: "FACILITATOR_INVALID_RESPONSE",
   INVALID_PAYMENT: "INVALID_PAYMENT",
+  /** A path with `.` or `..` segments on a paid route, refused with 400. */
+  INVALID_PATH: "INVALID_PATH",
   /** The facilitator did not answer a settle within the client's timeout: the payment may still settle. */
   SETTLE_TIMEOUT: "SETTLE_TIMEOUT"
 };

package/dist/express.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkMYCUOJ3H_cjs = require('./chunk-MYCUOJ3H.cjs');
-require('./chunk-KZZY5LS6.cjs');
+var chunkAYMDIX7A_cjs = require('./chunk-AYMDIX7A.cjs');
+require('./chunk-4CEMNRCZ.cjs');
 
 // src/express/adapter.ts
 function chunkBytes(args) {
@@ -56,6 +56,9 @@ var ExpressAdapter = class {
   getPath() {
     return this.req.path;
   }
+  getFullPath() {
+    return this.req.baseUrl + this.req.path;
+  }
   getUrl() {
     return `${this.req.protocol}://${this.req.headers.host}${this.req.originalUrl}`;
   }
@@ -67,9 +70,19 @@ var ExpressAdapter = class {
   async runHandler(options) {
     const res = this.res;
     const next = this.next;
+    chunkAYMDIX7A_cjs.dropConditionalHeaders(this.req.headers);
     const originalWriteHead = res.writeHead.bind(res);
     const originalWrite = res.write.bind(res);
     const originalEnd = res.end.bind(res);
+    const headersBefore = structuredClone(res.getHeaders());
+    const dropHandlerHeaders = () => {
+      for (const name of res.getHeaderNames())
+        if (!Object.hasOwn(headersBefore, name)) res.removeHeader(name);
+      for (const [name, value] of Object.entries(headersBefore))
+        if (value !== void 0) res.setHeader(name, value);
+      res.statusMessage = "";
+    };
+    const nodeWriters = Object.getPrototypeOf(res);
     const buffered = [];
     let settled = false;
     let discarded = false;
@@ -108,8 +121,8 @@ var ExpressAdapter = class {
       return originalEnd(...args);
     });
     next();
-    const outcome = await chunkMYCUOJ3H_cjs.raceTimeout(endPromise, options?.timeoutMs);
-    if (outcome === chunkMYCUOJ3H_cjs.HANDLER_TIMEOUT) {
+    const outcome = await chunkAYMDIX7A_cjs.raceTimeout(endPromise, options?.timeoutMs);
+    if (outcome === chunkAYMDIX7A_cjs.HANDLER_TIMEOUT) {
       discarded = true;
       return {
         status: 504,
@@ -121,8 +134,17 @@ var ExpressAdapter = class {
         },
         sendResponse: () => {
           if (res.headersSent) return;
-          originalWriteHead(504, { "Content-Type": "application/json" });
-          originalEnd(TIMEOUT_BODY);
+          dropHandlerHeaders();
+          nodeWriters.writeHead.call(res, 504, {
+            "Content-Type": "application/json",
+            "Content-Length": Buffer.byteLength(TIMEOUT_BODY)
+          });
+          nodeWriters.end.call(res, TIMEOUT_BODY, "utf8");
+          res.setHeader = (() => res);
+          res.setHeaders = (() => res);
+          res.appendHeader = (() => res);
+          res.removeHeader = () => {
+          };
         },
         discardResponse: () => {
         }
@@ -146,7 +168,7 @@ var ExpressAdapter = class {
           const chunk = chunkBytes(args);
           if (chunk) bytes.push(chunk);
         }
-        return chunkMYCUOJ3H_cjs.parseJsonBody(
+        return chunkAYMDIX7A_cjs.parseJsonBody(
           contentType,
           Buffer.concat(bytes).toString("utf8")
         );
@@ -162,7 +184,9 @@ var ExpressAdapter = class {
       },
       discardResponse: () => {
         settled = true;
-        restore();
+        dropHandlerHeaders();
+        for (const name of ["writeHead", "write", "end"])
+          Reflect.deleteProperty(res, name);
       }
     };
   }
@@ -170,11 +194,12 @@ var ExpressAdapter = class {
 
 // src/express/index.ts
 function paymentMiddleware(config) {
-  const middleware = chunkMYCUOJ3H_cjs.createPaymentMiddleware(config);
+  const middleware = chunkAYMDIX7A_cjs.createPaymentMiddleware(config);
   return async (req, res, next) => {
     const result = await middleware(new ExpressAdapter(req, res, next));
     if ("pass" in result) {
       if (result.handlerRan) return;
+      if (result.preflight) chunkAYMDIX7A_cjs.answerAsPreflight(res);
       return next();
     }
     for (const [key, value] of Object.entries(result.headers)) {

package/dist/express.d.cts

@@ -1,5 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
-import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-BWL9h1eY.cjs';
+import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-CRBMTQaq.cjs';
 import 'viem';
 
 declare class ExpressAdapter implements HTTPAdapter {
@@ -10,6 +10,7 @@ declare class ExpressAdapter implements HTTPAdapter {
     getHeader(name: string): string | undefined;
     getMethod(): string;
     getPath(): string;
+    getFullPath(): string;
     getUrl(): string;
     getBody(): Promise<unknown>;
     runHandler(options?: RunHandlerOptions): Promise<RunHandlerResult>;

package/dist/express.d.ts

@@ -1,5 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
-import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-BWL9h1eY.js';
+import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-CRBMTQaq.js';
 import 'viem';
 
 declare class ExpressAdapter implements HTTPAdapter {
@@ -10,6 +10,7 @@ declare class ExpressAdapter implements HTTPAdapter {
     getHeader(name: string): string | undefined;
     getMethod(): string;
     getPath(): string;
+    getFullPath(): string;
     getUrl(): string;
     getBody(): Promise<unknown>;
     runHandler(options?: RunHandlerOptions): Promise<RunHandlerResult>;

package/dist/express.js

@@ -1,5 +1,5 @@
-import { raceTimeout, HANDLER_TIMEOUT, parseJsonBody, createPaymentMiddleware } from './chunk-VSNDEQGS.js';
-import './chunk-QAECRSWF.js';
+import { dropConditionalHeaders, raceTimeout, HANDLER_TIMEOUT, parseJsonBody, createPaymentMiddleware, answerAsPreflight } from './chunk-CNASNROQ.js';
+import './chunk-MZCHBBUN.js';
 
 // src/express/adapter.ts
 function chunkBytes(args) {
@@ -54,6 +54,9 @@ var ExpressAdapter = class {
   getPath() {
     return this.req.path;
   }
+  getFullPath() {
+    return this.req.baseUrl + this.req.path;
+  }
   getUrl() {
     return `${this.req.protocol}://${this.req.headers.host}${this.req.originalUrl}`;
   }
@@ -65,9 +68,19 @@ var ExpressAdapter = class {
   async runHandler(options) {
     const res = this.res;
     const next = this.next;
+    dropConditionalHeaders(this.req.headers);
     const originalWriteHead = res.writeHead.bind(res);
     const originalWrite = res.write.bind(res);
     const originalEnd = res.end.bind(res);
+    const headersBefore = structuredClone(res.getHeaders());
+    const dropHandlerHeaders = () => {
+      for (const name of res.getHeaderNames())
+        if (!Object.hasOwn(headersBefore, name)) res.removeHeader(name);
+      for (const [name, value] of Object.entries(headersBefore))
+        if (value !== void 0) res.setHeader(name, value);
+      res.statusMessage = "";
+    };
+    const nodeWriters = Object.getPrototypeOf(res);
     const buffered = [];
     let settled = false;
     let discarded = false;
@@ -119,8 +132,17 @@ var ExpressAdapter = class {
         },
         sendResponse: () => {
           if (res.headersSent) return;
-          originalWriteHead(504, { "Content-Type": "application/json" });
-          originalEnd(TIMEOUT_BODY);
+          dropHandlerHeaders();
+          nodeWriters.writeHead.call(res, 504, {
+            "Content-Type": "application/json",
+            "Content-Length": Buffer.byteLength(TIMEOUT_BODY)
+          });
+          nodeWriters.end.call(res, TIMEOUT_BODY, "utf8");
+          res.setHeader = (() => res);
+          res.setHeaders = (() => res);
+          res.appendHeader = (() => res);
+          res.removeHeader = () => {
+          };
         },
         discardResponse: () => {
         }
@@ -160,7 +182,9 @@ var ExpressAdapter = class {
       },
       discardResponse: () => {
         settled = true;
-        restore();
+        dropHandlerHeaders();
+        for (const name of ["writeHead", "write", "end"])
+          Reflect.deleteProperty(res, name);
       }
     };
   }
@@ -173,6 +197,7 @@ function paymentMiddleware(config) {
     const result = await middleware(new ExpressAdapter(req, res, next));
     if ("pass" in result) {
       if (result.handlerRan) return;
+      if (result.preflight) answerAsPreflight(res);
       return next();
     }
     for (const [key, value] of Object.entries(result.headers)) {

package/dist/fastify.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkMYCUOJ3H_cjs = require('./chunk-MYCUOJ3H.cjs');
-require('./chunk-KZZY5LS6.cjs');
+var chunkAYMDIX7A_cjs = require('./chunk-AYMDIX7A.cjs');
+require('./chunk-4CEMNRCZ.cjs');
 var fp = require('fastify-plugin');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -37,9 +37,39 @@ var FastifyAdapter = class {
 // src/fastify/index.ts
 function payloadJson(contentType, payload) {
   const text = typeof payload === "string" ? payload : payload instanceof Uint8Array ? Buffer.from(payload).toString("utf8") : void 0;
-  return chunkMYCUOJ3H_cjs.parseJsonBody(contentType, text);
+  return chunkAYMDIX7A_cjs.parseJsonBody(contentType, text);
 }
-function refuse(reply, result) {
+function keepCookiesBefore(reply, cookies) {
+  const raw = reply.raw;
+  const writeHead = raw.writeHead;
+  raw.writeHead = ((...args) => {
+    for (const arg of args)
+      if (typeof arg === "object" && arg !== null && !Array.isArray(arg))
+        delete arg["set-cookie"];
+    raw.removeHeader("set-cookie");
+    if (cookies !== void 0) raw.setHeader("set-cookie", cookies);
+    return writeHead.apply(raw, args);
+  });
+}
+function release(payload) {
+  if (payload instanceof ReadableStream) payload.cancel().catch(() => {
+  });
+  else if (typeof payload?.destroy === "function")
+    payload.destroy();
+}
+function refuse(reply, result, before, payload) {
+  release(payload);
+  if (before) {
+    for (const name of Object.keys(reply.getHeaders()))
+      reply.removeHeader(name);
+    for (const [name, value] of Object.entries(before.headers))
+      if (value !== void 0) reply.header(name, value);
+    for (const name of before.trailers) reply.removeTrailer(name);
+    for (const name of ["writeHead", "write", "end"])
+      Reflect.deleteProperty(reply.raw, name);
+    keepCookiesBefore(reply, before.headers["set-cookie"]);
+  }
+  reply.raw.statusMessage = "";
   const json = JSON.stringify(result.body);
   reply.status(result.status);
   for (const [name, value] of Object.entries(result.headers)) {
@@ -54,35 +84,51 @@ function headerValue(value) {
 }
 function paymentMiddleware(config) {
   return fp__default.default(async (fastify) => {
-    const gate = chunkMYCUOJ3H_cjs.createPaymentGate(config);
+    const gate = chunkAYMDIX7A_cjs.createPaymentGate(config);
     const verifiedMap = /* @__PURE__ */ new WeakMap();
     const rawWriters = /* @__PURE__ */ new WeakMap();
+    const replyBefore = /* @__PURE__ */ new WeakMap();
+    const routes = chunkAYMDIX7A_cjs.routeTable(config.routes);
+    const needsBodyByRequest = /* @__PURE__ */ new WeakMap();
     const needsBody = (req) => {
-      const route = chunkMYCUOJ3H_cjs.matchRoute(
-        new FastifyAdapter(req).getPath(),
-        config.routes
-      );
-      return typeof route?.price === "function" || route?.meter !== void 0;
+      let needs = needsBodyByRequest.get(req);
+      if (needs === void 0) {
+        const { route } = chunkAYMDIX7A_cjs.findRoute(new FastifyAdapter(req).getPath(), routes);
+        needs = typeof route?.price === "function" || route?.meter !== void 0;
+        needsBodyByRequest.set(req, needs);
+      }
+      return needs;
     };
     fastify.addHook("onRequest", async (req, reply) => {
       if (needsBody(req)) return;
-      await runGate(req, reply);
+      return runGate(req, reply);
     });
     fastify.addHook("preHandler", async (req, reply) => {
       if (!needsBody(req)) return;
-      await runGate(req, reply);
+      return runGate(req, reply);
     });
     async function runGate(req, reply) {
       const gateResult = await gate(new FastifyAdapter(req));
-      if (gateResult.type === "pass") return;
+      if (gateResult.type === "pass") {
+        if (gateResult.preflight) chunkAYMDIX7A_cjs.answerAsPreflight(reply.raw);
+        return;
+      }
       if (gateResult.type === "error") {
         for (const [key, value] of Object.entries(gateResult.result.headers)) {
           reply.header(key, value);
         }
-        reply.status(gateResult.result.status).send(gateResult.result.body);
-        return;
+        return reply.status(gateResult.result.status).send(gateResult.result.body);
       }
       verifiedMap.set(req, gateResult);
+      chunkAYMDIX7A_cjs.dropConditionalHeaders(req.headers);
+      const trailers = /* @__PURE__ */ new Set();
+      const headers = structuredClone(reply.getHeaders());
+      replyBefore.set(req, { headers, trailers });
+      const trailer = reply.trailer.bind(reply);
+      reply.trailer = ((name, fn) => {
+        trailers.add(name.toLowerCase());
+        return trailer(name, fn);
+      });
       const raw = reply.raw;
       rawWriters.set(req, {
         write: raw.write,
@@ -111,29 +157,39 @@ function paymentMiddleware(config) {
       if (!verified) return payload;
       let raw;
       if (verified.scheme === "upto") {
-        raw = headerValue(reply.getHeader(chunkMYCUOJ3H_cjs.SETTLE_AMOUNT_HEADER));
-        reply.removeHeader(chunkMYCUOJ3H_cjs.SETTLE_AMOUNT_HEADER);
+        raw = headerValue(reply.getHeader(chunkAYMDIX7A_cjs.SETTLE_AMOUNT_HEADER));
+        reply.removeHeader(chunkAYMDIX7A_cjs.SETTLE_AMOUNT_HEADER);
       }
       if (reply.statusCode < 200 || reply.statusCode >= 300) {
         return payload;
       }
       let settleOptions;
       if (verified.scheme === "upto") {
-        const resolved = await chunkMYCUOJ3H_cjs.resolveCharge(verified, raw, {
+        const resolved = await chunkAYMDIX7A_cjs.resolveCharge(verified, raw, {
           status: reply.statusCode,
           header: (name) => headerValue(reply.getHeader(name)),
           body: async () => payloadJson(headerValue(reply.getHeader("content-type")), payload)
         });
         if (resolved.kind === "invalid") {
-          return refuse(reply, chunkMYCUOJ3H_cjs.invalidSettleAmountResponse(resolved.reason));
+          return refuse(
+            reply,
+            chunkAYMDIX7A_cjs.invalidSettleAmountResponse(resolved.reason),
+            replyBefore.get(req),
+            payload
+          );
         }
         if (resolved.kind === "skip") return payload;
         settleOptions = { amount: resolved.amount };
       }
-      const outcome = await chunkMYCUOJ3H_cjs.settleVerified(verified, settleOptions);
+      const outcome = await chunkAYMDIX7A_cjs.settleVerified(verified, settleOptions);
       if (!outcome.settled)
-        return refuse(reply, chunkMYCUOJ3H_cjs.settlementFailureResponse(outcome));
-      reply.header("payment-response", chunkMYCUOJ3H_cjs.encodeBase64(outcome.confirmation));
+        return refuse(
+          reply,
+          chunkAYMDIX7A_cjs.settlementFailureResponse(outcome),
+          replyBefore.get(req),
+          payload
+        );
+      reply.header("payment-response", chunkAYMDIX7A_cjs.encodeBase64(outcome.confirmation));
       reply.header("access-control-expose-headers", "payment-response");
       return payload;
     });

package/dist/fastify.d.cts

@@ -1,5 +1,5 @@
 import { FastifyRequest, FastifyPluginAsync } from 'fastify';
-import { H as HTTPAdapter, P as PaymentMiddlewareConfig } from './types-BWL9h1eY.cjs';
+import { H as HTTPAdapter, P as PaymentMiddlewareConfig } from './types-CRBMTQaq.cjs';
 import 'viem';
 
 declare class FastifyAdapter implements HTTPAdapter {

package/dist/fastify.d.ts

@@ -1,5 +1,5 @@
 import { FastifyRequest, FastifyPluginAsync } from 'fastify';
-import { H as HTTPAdapter, P as PaymentMiddlewareConfig } from './types-BWL9h1eY.js';
+import { H as HTTPAdapter, P as PaymentMiddlewareConfig } from './types-CRBMTQaq.js';
 import 'viem';
 
 declare class FastifyAdapter implements HTTPAdapter {