@parallel-protocol/x402 0.10.0 → 0.10.1

package/dist/fastify.js

@@ -1,5 +1,5 @@
-import { createPaymentGate, SETTLE_AMOUNT_HEADER, resolveCharge, invalidSettleAmountResponse, settleVerified, settlementFailureResponse, encodeBase64, matchRoute, parseJsonBody } from './chunk-VSNDEQGS.js';
-import './chunk-QAECRSWF.js';
+import { createPaymentGate, routeTable, answerAsPreflight, dropConditionalHeaders, SETTLE_AMOUNT_HEADER, resolveCharge, invalidSettleAmountResponse, settleVerified, settlementFailureResponse, encodeBase64, findRoute, parseJsonBody } from './chunk-CNASNROQ.js';
+import './chunk-MZCHBBUN.js';
 import fp from 'fastify-plugin';
 
 // src/fastify/adapter.ts
@@ -33,7 +33,37 @@ function payloadJson(contentType, payload) {
   const text = typeof payload === "string" ? payload : payload instanceof Uint8Array ? Buffer.from(payload).toString("utf8") : void 0;
   return parseJsonBody(contentType, text);
 }
-function refuse(reply, result) {
+function keepCookiesBefore(reply, cookies) {
+  const raw = reply.raw;
+  const writeHead = raw.writeHead;
+  raw.writeHead = ((...args) => {
+    for (const arg of args)
+      if (typeof arg === "object" && arg !== null && !Array.isArray(arg))
+        delete arg["set-cookie"];
+    raw.removeHeader("set-cookie");
+    if (cookies !== void 0) raw.setHeader("set-cookie", cookies);
+    return writeHead.apply(raw, args);
+  });
+}
+function release(payload) {
+  if (payload instanceof ReadableStream) payload.cancel().catch(() => {
+  });
+  else if (typeof payload?.destroy === "function")
+    payload.destroy();
+}
+function refuse(reply, result, before, payload) {
+  release(payload);
+  if (before) {
+    for (const name of Object.keys(reply.getHeaders()))
+      reply.removeHeader(name);
+    for (const [name, value] of Object.entries(before.headers))
+      if (value !== void 0) reply.header(name, value);
+    for (const name of before.trailers) reply.removeTrailer(name);
+    for (const name of ["writeHead", "write", "end"])
+      Reflect.deleteProperty(reply.raw, name);
+    keepCookiesBefore(reply, before.headers["set-cookie"]);
+  }
+  reply.raw.statusMessage = "";
   const json = JSON.stringify(result.body);
   reply.status(result.status);
   for (const [name, value] of Object.entries(result.headers)) {
@@ -51,32 +81,48 @@ function paymentMiddleware(config) {
     const gate = createPaymentGate(config);
     const verifiedMap = /* @__PURE__ */ new WeakMap();
     const rawWriters = /* @__PURE__ */ new WeakMap();
+    const replyBefore = /* @__PURE__ */ new WeakMap();
+    const routes = routeTable(config.routes);
+    const needsBodyByRequest = /* @__PURE__ */ new WeakMap();
     const needsBody = (req) => {
-      const route = matchRoute(
-        new FastifyAdapter(req).getPath(),
-        config.routes
-      );
-      return typeof route?.price === "function" || route?.meter !== void 0;
+      let needs = needsBodyByRequest.get(req);
+      if (needs === void 0) {
+        const { route } = findRoute(new FastifyAdapter(req).getPath(), routes);
+        needs = typeof route?.price === "function" || route?.meter !== void 0;
+        needsBodyByRequest.set(req, needs);
+      }
+      return needs;
     };
     fastify.addHook("onRequest", async (req, reply) => {
       if (needsBody(req)) return;
-      await runGate(req, reply);
+      return runGate(req, reply);
     });
     fastify.addHook("preHandler", async (req, reply) => {
       if (!needsBody(req)) return;
-      await runGate(req, reply);
+      return runGate(req, reply);
     });
     async function runGate(req, reply) {
       const gateResult = await gate(new FastifyAdapter(req));
-      if (gateResult.type === "pass") return;
+      if (gateResult.type === "pass") {
+        if (gateResult.preflight) answerAsPreflight(reply.raw);
+        return;
+      }
       if (gateResult.type === "error") {
         for (const [key, value] of Object.entries(gateResult.result.headers)) {
           reply.header(key, value);
         }
-        reply.status(gateResult.result.status).send(gateResult.result.body);
-        return;
+        return reply.status(gateResult.result.status).send(gateResult.result.body);
       }
       verifiedMap.set(req, gateResult);
+      dropConditionalHeaders(req.headers);
+      const trailers = /* @__PURE__ */ new Set();
+      const headers = structuredClone(reply.getHeaders());
+      replyBefore.set(req, { headers, trailers });
+      const trailer = reply.trailer.bind(reply);
+      reply.trailer = ((name, fn) => {
+        trailers.add(name.toLowerCase());
+        return trailer(name, fn);
+      });
       const raw = reply.raw;
       rawWriters.set(req, {
         write: raw.write,
@@ -119,14 +165,24 @@ function paymentMiddleware(config) {
           body: async () => payloadJson(headerValue(reply.getHeader("content-type")), payload)
         });
         if (resolved.kind === "invalid") {
-          return refuse(reply, invalidSettleAmountResponse(resolved.reason));
+          return refuse(
+            reply,
+            invalidSettleAmountResponse(resolved.reason),
+            replyBefore.get(req),
+            payload
+          );
         }
         if (resolved.kind === "skip") return payload;
         settleOptions = { amount: resolved.amount };
       }
       const outcome = await settleVerified(verified, settleOptions);
       if (!outcome.settled)
-        return refuse(reply, settlementFailureResponse(outcome));
+        return refuse(
+          reply,
+          settlementFailureResponse(outcome),
+          replyBefore.get(req),
+          payload
+        );
       reply.header("payment-response", encodeBase64(outcome.confirmation));
       reply.header("access-control-expose-headers", "payment-response");
       return payload;

package/dist/hono.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkMYCUOJ3H_cjs = require('./chunk-MYCUOJ3H.cjs');
-require('./chunk-KZZY5LS6.cjs');
+var chunkAYMDIX7A_cjs = require('./chunk-AYMDIX7A.cjs');
+require('./chunk-4CEMNRCZ.cjs');
 
 // src/hono/adapter.ts
 var TIMEOUT_BODY = JSON.stringify({
@@ -30,7 +30,7 @@ var HonoAdapter = class {
   // Hono caches the parsed body on the request, so the handler can still read
   // it after the price function did.
   async getBody() {
-    if (!chunkMYCUOJ3H_cjs.isJsonContentType(this.c.req.header("content-type"))) return void 0;
+    if (!chunkAYMDIX7A_cjs.isJsonContentType(this.c.req.header("content-type"))) return void 0;
     try {
       return await this.c.req.json();
     } catch {
@@ -38,8 +38,15 @@ var HonoAdapter = class {
     }
   }
   async runHandler(options) {
-    const outcome = await chunkMYCUOJ3H_cjs.raceTimeout(this.next(), options?.timeoutMs);
-    if (outcome === chunkMYCUOJ3H_cjs.HANDLER_TIMEOUT) {
+    const headersBefore = new Headers(this.c.res.headers);
+    const replace = (body, status) => {
+      const headers = new Headers(headersBefore);
+      if (body !== null) headers.set("Content-Type", "application/json");
+      this.c.res = void 0;
+      this.c.res = new Response(body, { status, headers });
+    };
+    const outcome = await chunkAYMDIX7A_cjs.raceTimeout(this.next(), options?.timeoutMs);
+    if (outcome === chunkAYMDIX7A_cjs.HANDLER_TIMEOUT) {
       return {
         status: 504,
         setResponseHeader: () => {
@@ -47,12 +54,7 @@ var HonoAdapter = class {
         getResponseHeader: () => void 0,
         removeResponseHeader: () => {
         },
-        sendResponse: () => {
-          this.c.res = new Response(TIMEOUT_BODY, {
-            status: 504,
-            headers: { "Content-Type": "application/json" }
-          });
-        },
+        sendResponse: () => replace(TIMEOUT_BODY, 504),
         discardResponse: () => {
         }
       };
@@ -64,7 +66,7 @@ var HonoAdapter = class {
       getResponseHeader: (name) => res.headers.get(name) ?? void 0,
       removeResponseHeader: (name) => res.headers.delete(name),
       // Read from a clone: the response body streams once, to the client.
-      getResponseBody: () => chunkMYCUOJ3H_cjs.jsonFromResponse(res),
+      getResponseBody: () => chunkAYMDIX7A_cjs.jsonFromResponse(res),
       sendResponse: () => {
       },
       // The response is replaced: release its body (and whatever upstream
@@ -72,6 +74,7 @@ var HonoAdapter = class {
       discardResponse: () => {
         res.body?.cancel().catch(() => {
         });
+        replace(null);
       }
     };
   }
@@ -79,15 +82,20 @@ var HonoAdapter = class {
 
 // src/hono/index.ts
 function paymentMiddleware(config) {
-  const middleware = chunkMYCUOJ3H_cjs.createPaymentMiddleware(config);
+  const middleware = chunkAYMDIX7A_cjs.createPaymentMiddleware(config);
   return async (c, next) => {
     const result = await middleware(new HonoAdapter(c, next));
     if ("pass" in result) {
       if (result.handlerRan) return;
       await next();
+      if (result.preflight) {
+        const init = chunkAYMDIX7A_cjs.preflightInit(c.res);
+        c.res = void 0;
+        c.res = new Response(null, init);
+      }
       return;
     }
-    return new Response(JSON.stringify(result.body), {
+    c.res = new Response(JSON.stringify(result.body), {
       status: result.status,
       headers: { ...result.headers, "Content-Type": "application/json" }
     });

package/dist/hono.d.cts

@@ -1,5 +1,5 @@
 import { Context, Next, MiddlewareHandler } from 'hono';
-import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-BWL9h1eY.cjs';
+import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-CRBMTQaq.cjs';
 import 'viem';
 
 declare class HonoAdapter implements HTTPAdapter {

package/dist/hono.d.ts

@@ -1,5 +1,5 @@
 import { Context, Next, MiddlewareHandler } from 'hono';
-import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-BWL9h1eY.js';
+import { H as HTTPAdapter, R as RunHandlerOptions, a as RunHandlerResult, P as PaymentMiddlewareConfig } from './types-CRBMTQaq.js';
 import 'viem';
 
 declare class HonoAdapter implements HTTPAdapter {

package/dist/hono.js

@@ -1,5 +1,5 @@
-import { isJsonContentType, raceTimeout, HANDLER_TIMEOUT, jsonFromResponse, createPaymentMiddleware } from './chunk-VSNDEQGS.js';
-import './chunk-QAECRSWF.js';
+import { isJsonContentType, raceTimeout, HANDLER_TIMEOUT, jsonFromResponse, createPaymentMiddleware, preflightInit } from './chunk-CNASNROQ.js';
+import './chunk-MZCHBBUN.js';
 
 // src/hono/adapter.ts
 var TIMEOUT_BODY = JSON.stringify({
@@ -36,6 +36,13 @@ var HonoAdapter = class {
     }
   }
   async runHandler(options) {
+    const headersBefore = new Headers(this.c.res.headers);
+    const replace = (body, status) => {
+      const headers = new Headers(headersBefore);
+      if (body !== null) headers.set("Content-Type", "application/json");
+      this.c.res = void 0;
+      this.c.res = new Response(body, { status, headers });
+    };
     const outcome = await raceTimeout(this.next(), options?.timeoutMs);
     if (outcome === HANDLER_TIMEOUT) {
       return {
@@ -45,12 +52,7 @@ var HonoAdapter = class {
         getResponseHeader: () => void 0,
         removeResponseHeader: () => {
         },
-        sendResponse: () => {
-          this.c.res = new Response(TIMEOUT_BODY, {
-            status: 504,
-            headers: { "Content-Type": "application/json" }
-          });
-        },
+        sendResponse: () => replace(TIMEOUT_BODY, 504),
         discardResponse: () => {
         }
       };
@@ -70,6 +72,7 @@ var HonoAdapter = class {
       discardResponse: () => {
         res.body?.cancel().catch(() => {
         });
+        replace(null);
       }
     };
   }
@@ -83,9 +86,14 @@ function paymentMiddleware(config) {
     if ("pass" in result) {
       if (result.handlerRan) return;
       await next();
+      if (result.preflight) {
+        const init = preflightInit(c.res);
+        c.res = void 0;
+        c.res = new Response(null, init);
+      }
       return;
     }
-    return new Response(JSON.stringify(result.body), {
+    c.res = new Response(JSON.stringify(result.body), {
       status: result.status,
       headers: { ...result.headers, "Content-Type": "application/json" }
     });

package/dist/index.cjs

@@ -1,83 +1,87 @@
 'use strict';
 
-var chunkMYCUOJ3H_cjs = require('./chunk-MYCUOJ3H.cjs');
-var chunkKZZY5LS6_cjs = require('./chunk-KZZY5LS6.cjs');
+var chunkAYMDIX7A_cjs = require('./chunk-AYMDIX7A.cjs');
+var chunk4CEMNRCZ_cjs = require('./chunk-4CEMNRCZ.cjs');
 
 
 
 Object.defineProperty(exports, "FacilitatorClient", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.FacilitatorClient; }
+  get: function () { return chunkAYMDIX7A_cjs.FacilitatorClient; }
 });
 Object.defineProperty(exports, "PARALLEL_TOKENS", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.PARALLEL_TOKENS; }
+  get: function () { return chunkAYMDIX7A_cjs.PARALLEL_TOKENS; }
 });
 Object.defineProperty(exports, "SETTLE_AMOUNT_HEADER", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.SETTLE_AMOUNT_HEADER; }
+  get: function () { return chunkAYMDIX7A_cjs.SETTLE_AMOUNT_HEADER; }
 });
 Object.defineProperty(exports, "createPaymentGate", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.createPaymentGate; }
+  get: function () { return chunkAYMDIX7A_cjs.createPaymentGate; }
 });
 Object.defineProperty(exports, "createPaymentMiddleware", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.createPaymentMiddleware; }
+  get: function () { return chunkAYMDIX7A_cjs.createPaymentMiddleware; }
 });
 Object.defineProperty(exports, "encodeBase64", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.encodeBase64; }
+  get: function () { return chunkAYMDIX7A_cjs.encodeBase64; }
 });
 Object.defineProperty(exports, "getDefaultAcceptedTokens", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.getDefaultAcceptedTokens; }
+  get: function () { return chunkAYMDIX7A_cjs.getDefaultAcceptedTokens; }
+});
+Object.defineProperty(exports, "normalizeRoutePath", {
+  enumerable: true,
+  get: function () { return chunkAYMDIX7A_cjs.normalizeRoutePath; }
 });
 Object.defineProperty(exports, "parsePrice", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.parsePrice; }
+  get: function () { return chunkAYMDIX7A_cjs.parsePrice; }
 });
 Object.defineProperty(exports, "resolveCharge", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.resolveCharge; }
+  get: function () { return chunkAYMDIX7A_cjs.resolveCharge; }
 });
 Object.defineProperty(exports, "resolveSettleAmount", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.resolveSettleAmount; }
+  get: function () { return chunkAYMDIX7A_cjs.resolveSettleAmount; }
 });
 Object.defineProperty(exports, "settleVerified", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.settleVerified; }
+  get: function () { return chunkAYMDIX7A_cjs.settleVerified; }
 });
 Object.defineProperty(exports, "settlementFailureResponse", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.settlementFailureResponse; }
+  get: function () { return chunkAYMDIX7A_cjs.settlementFailureResponse; }
 });
 Object.defineProperty(exports, "toEip155Network", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.toEip155Network; }
+  get: function () { return chunkAYMDIX7A_cjs.toEip155Network; }
 });
 Object.defineProperty(exports, "validateAddress", {
   enumerable: true,
-  get: function () { return chunkMYCUOJ3H_cjs.validateAddress; }
+  get: function () { return chunkAYMDIX7A_cjs.validateAddress; }
 });
 Object.defineProperty(exports, "X402ConfigError", {
   enumerable: true,
-  get: function () { return chunkKZZY5LS6_cjs.X402ConfigError; }
+  get: function () { return chunk4CEMNRCZ_cjs.X402ConfigError; }
 });
 Object.defineProperty(exports, "X402PriceRejectedError", {
   enumerable: true,
-  get: function () { return chunkKZZY5LS6_cjs.X402PriceRejectedError; }
+  get: function () { return chunk4CEMNRCZ_cjs.X402PriceRejectedError; }
 });
 Object.defineProperty(exports, "X402RuntimeError", {
   enumerable: true,
-  get: function () { return chunkKZZY5LS6_cjs.X402RuntimeError; }
+  get: function () { return chunk4CEMNRCZ_cjs.X402RuntimeError; }
 });
 Object.defineProperty(exports, "X402_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkKZZY5LS6_cjs.X402_ERROR_CODES; }
+  get: function () { return chunk4CEMNRCZ_cjs.X402_ERROR_CODES; }
 });
 Object.defineProperty(exports, "isPriceRejection", {
   enumerable: true,
-  get: function () { return chunkKZZY5LS6_cjs.isPriceRejection; }
+  get: function () { return chunk4CEMNRCZ_cjs.isPriceRejection; }
 });

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FacilitatorConfig, b as FacilitatorPaymentRequirements, V as VerifyResult, c as FacilitatorSettleOptions, d as FacilitatorResponse, e as PaymentConfirmation, P as PaymentMiddlewareConfig, H as HTTPAdapter, f as PaymentGateResult, M as MiddlewareResult, g as PassResult, h as VerifiedPayment, S as SettleOptions } from './types-BWL9h1eY.cjs';
-export { i as MeterContext, j as MeterFunction, k as PaymentFailure, l as PaymentRequired, m as PaymentRequirements, n as PriceContext, o as PriceFunction, p as ResourceInfo, q as RouteConfig, R as RunHandlerOptions, a as RunHandlerResult } from './types-BWL9h1eY.cjs';
+import { F as FacilitatorConfig, b as FacilitatorPaymentRequirements, V as VerifyResult, c as FacilitatorSettleOptions, d as FacilitatorResponse, e as PaymentConfirmation, P as PaymentMiddlewareConfig, H as HTTPAdapter, f as PaymentGateResult, M as MiddlewareResult, g as PassResult, h as VerifiedPayment, S as SettleOptions } from './types-CRBMTQaq.cjs';
+export { i as MeterContext, j as MeterFunction, k as PaymentFailure, l as PaymentRequired, m as PaymentRequirements, n as PriceContext, o as PriceFunction, p as ResourceInfo, q as RouteConfig, R as RunHandlerOptions, a as RunHandlerResult } from './types-CRBMTQaq.cjs';
 import { Address } from 'viem';
 
 declare class FacilitatorClient {
@@ -20,6 +20,8 @@ declare const X402_ERROR_CODES: {
     readonly FACILITATOR_UNAVAILABLE: "FACILITATOR_UNAVAILABLE";
     readonly FACILITATOR_INVALID_RESPONSE: "FACILITATOR_INVALID_RESPONSE";
     readonly INVALID_PAYMENT: "INVALID_PAYMENT";
+    /** A path with `.` or `..` segments on a paid route, refused with 400. */
+    readonly INVALID_PATH: "INVALID_PATH";
     /** The facilitator did not answer a settle within the client's timeout: the payment may still settle. */
     readonly SETTLE_TIMEOUT: "SETTLE_TIMEOUT";
 };
@@ -59,7 +61,7 @@ declare class X402PriceRejectedError extends Error {
  */
 declare function isPriceRejection(error: unknown): error is X402PriceRejectedError;
 
-type GateAdapter = Pick<HTTPAdapter, "getHeader" | "getPath" | "getUrl" | "getMethod" | "getBody">;
+type GateAdapter = Pick<HTTPAdapter, "getHeader" | "getPath" | "getFullPath" | "getUrl" | "getMethod" | "getBody">;
 /**
  * Response header a handler on a metered (`upto`) route sets to the amount it
  * actually charges, in whole token units like `price` ("0.75"). Read and
@@ -156,5 +158,7 @@ declare function parsePrice(price: string | bigint, decimals?: number): bigint;
 declare function validateAddress(address: string): address is Address;
 declare function toEip155Network(network: string): string;
 declare function encodeBase64(obj: unknown): string;
+/** The form routes are matched on: `"/API//Data/"` becomes `"/api/data"`. */
+declare function normalizeRoutePath(path: string): string;
 
-export { type ChargeResponse, FacilitatorClient, FacilitatorConfig, FacilitatorPaymentRequirements, FacilitatorResponse, FacilitatorSettleOptions, HTTPAdapter, MiddlewareResult, PARALLEL_TOKENS, type ParallelNetwork, PassResult, PaymentConfirmation, PaymentGateResult, PaymentMiddlewareConfig, SETTLE_AMOUNT_HEADER, type SettleAmountResolution, SettleOptions, type SettlementFailure, type SettlementFailureBody, type SettlementOutcome, VerifiedPayment, VerifyResult, X402ConfigError, type X402ErrorCode, X402PriceRejectedError, X402RuntimeError, X402_ERROR_CODES, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, isPriceRejection, parsePrice, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };
+export { type ChargeResponse, FacilitatorClient, FacilitatorConfig, FacilitatorPaymentRequirements, FacilitatorResponse, FacilitatorSettleOptions, HTTPAdapter, MiddlewareResult, PARALLEL_TOKENS, type ParallelNetwork, PassResult, PaymentConfirmation, PaymentGateResult, PaymentMiddlewareConfig, SETTLE_AMOUNT_HEADER, type SettleAmountResolution, SettleOptions, type SettlementFailure, type SettlementFailureBody, type SettlementOutcome, VerifiedPayment, VerifyResult, X402ConfigError, type X402ErrorCode, X402PriceRejectedError, X402RuntimeError, X402_ERROR_CODES, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, isPriceRejection, normalizeRoutePath, parsePrice, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FacilitatorConfig, b as FacilitatorPaymentRequirements, V as VerifyResult, c as FacilitatorSettleOptions, d as FacilitatorResponse, e as PaymentConfirmation, P as PaymentMiddlewareConfig, H as HTTPAdapter, f as PaymentGateResult, M as MiddlewareResult, g as PassResult, h as VerifiedPayment, S as SettleOptions } from './types-BWL9h1eY.js';
-export { i as MeterContext, j as MeterFunction, k as PaymentFailure, l as PaymentRequired, m as PaymentRequirements, n as PriceContext, o as PriceFunction, p as ResourceInfo, q as RouteConfig, R as RunHandlerOptions, a as RunHandlerResult } from './types-BWL9h1eY.js';
+import { F as FacilitatorConfig, b as FacilitatorPaymentRequirements, V as VerifyResult, c as FacilitatorSettleOptions, d as FacilitatorResponse, e as PaymentConfirmation, P as PaymentMiddlewareConfig, H as HTTPAdapter, f as PaymentGateResult, M as MiddlewareResult, g as PassResult, h as VerifiedPayment, S as SettleOptions } from './types-CRBMTQaq.js';
+export { i as MeterContext, j as MeterFunction, k as PaymentFailure, l as PaymentRequired, m as PaymentRequirements, n as PriceContext, o as PriceFunction, p as ResourceInfo, q as RouteConfig, R as RunHandlerOptions, a as RunHandlerResult } from './types-CRBMTQaq.js';
 import { Address } from 'viem';
 
 declare class FacilitatorClient {
@@ -20,6 +20,8 @@ declare const X402_ERROR_CODES: {
     readonly FACILITATOR_UNAVAILABLE: "FACILITATOR_UNAVAILABLE";
     readonly FACILITATOR_INVALID_RESPONSE: "FACILITATOR_INVALID_RESPONSE";
     readonly INVALID_PAYMENT: "INVALID_PAYMENT";
+    /** A path with `.` or `..` segments on a paid route, refused with 400. */
+    readonly INVALID_PATH: "INVALID_PATH";
     /** The facilitator did not answer a settle within the client's timeout: the payment may still settle. */
     readonly SETTLE_TIMEOUT: "SETTLE_TIMEOUT";
 };
@@ -59,7 +61,7 @@ declare class X402PriceRejectedError extends Error {
  */
 declare function isPriceRejection(error: unknown): error is X402PriceRejectedError;
 
-type GateAdapter = Pick<HTTPAdapter, "getHeader" | "getPath" | "getUrl" | "getMethod" | "getBody">;
+type GateAdapter = Pick<HTTPAdapter, "getHeader" | "getPath" | "getFullPath" | "getUrl" | "getMethod" | "getBody">;
 /**
  * Response header a handler on a metered (`upto`) route sets to the amount it
  * actually charges, in whole token units like `price` ("0.75"). Read and
@@ -156,5 +158,7 @@ declare function parsePrice(price: string | bigint, decimals?: number): bigint;
 declare function validateAddress(address: string): address is Address;
 declare function toEip155Network(network: string): string;
 declare function encodeBase64(obj: unknown): string;
+/** The form routes are matched on: `"/API//Data/"` becomes `"/api/data"`. */
+declare function normalizeRoutePath(path: string): string;
 
-export { type ChargeResponse, FacilitatorClient, FacilitatorConfig, FacilitatorPaymentRequirements, FacilitatorResponse, FacilitatorSettleOptions, HTTPAdapter, MiddlewareResult, PARALLEL_TOKENS, type ParallelNetwork, PassResult, PaymentConfirmation, PaymentGateResult, PaymentMiddlewareConfig, SETTLE_AMOUNT_HEADER, type SettleAmountResolution, SettleOptions, type SettlementFailure, type SettlementFailureBody, type SettlementOutcome, VerifiedPayment, VerifyResult, X402ConfigError, type X402ErrorCode, X402PriceRejectedError, X402RuntimeError, X402_ERROR_CODES, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, isPriceRejection, parsePrice, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };
+export { type ChargeResponse, FacilitatorClient, FacilitatorConfig, FacilitatorPaymentRequirements, FacilitatorResponse, FacilitatorSettleOptions, HTTPAdapter, MiddlewareResult, PARALLEL_TOKENS, type ParallelNetwork, PassResult, PaymentConfirmation, PaymentGateResult, PaymentMiddlewareConfig, SETTLE_AMOUNT_HEADER, type SettleAmountResolution, SettleOptions, type SettlementFailure, type SettlementFailureBody, type SettlementOutcome, VerifiedPayment, VerifyResult, X402ConfigError, type X402ErrorCode, X402PriceRejectedError, X402RuntimeError, X402_ERROR_CODES, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, isPriceRejection, normalizeRoutePath, parsePrice, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };

package/dist/index.js

@@ -1,2 +1,2 @@
-export { FacilitatorClient, PARALLEL_TOKENS, SETTLE_AMOUNT_HEADER, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, parsePrice, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress } from './chunk-VSNDEQGS.js';
-export { X402ConfigError, X402PriceRejectedError, X402RuntimeError, X402_ERROR_CODES, isPriceRejection } from './chunk-QAECRSWF.js';
+export { FacilitatorClient, PARALLEL_TOKENS, SETTLE_AMOUNT_HEADER, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, normalizeRoutePath, parsePrice, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress } from './chunk-CNASNROQ.js';
+export { X402ConfigError, X402PriceRejectedError, X402RuntimeError, X402_ERROR_CODES, isPriceRejection } from './chunk-MZCHBBUN.js';

package/dist/llm.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkKZZY5LS6_cjs = require('./chunk-KZZY5LS6.cjs');
+var chunk4CEMNRCZ_cjs = require('./chunk-4CEMNRCZ.cjs');
 
 // src/llm/estimate.ts
 function estimateTokens(text) {
@@ -71,7 +71,7 @@ function lookup(table, model) {
 function staticPrices(table) {
   for (const [model, price] of Object.entries(table)) {
     if (!isValidPrice(price)) {
-      throw new chunkKZZY5LS6_cjs.X402ConfigError(
+      throw new chunk4CEMNRCZ_cjs.X402ConfigError(
         `Invalid price for model "${model}": expected { input, output } in USD per million tokens`
       );
     }
@@ -106,13 +106,13 @@ function shortName(value) {
 function parseDuration(value) {
   if (typeof value === "number") {
     if (!Number.isFinite(value) || value < 0) {
-      throw new chunkKZZY5LS6_cjs.X402ConfigError(`Invalid duration: ${value}`);
+      throw new chunk4CEMNRCZ_cjs.X402ConfigError(`Invalid duration: ${value}`);
     }
     return value;
   }
   const match = value.trim().match(/^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/i);
   if (!match) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `Invalid duration "${value}": expected a number of milliseconds or a value like "24h", "30m", "10s"`
     );
   }
@@ -180,7 +180,7 @@ function openRouterPrices(options = {}) {
         if (canRetry()) await load().catch(() => {
         });
         if (!table) {
-          throw new chunkKZZY5LS6_cjs.X402PriceRejectedError(
+          throw new chunk4CEMNRCZ_cjs.X402PriceRejectedError(
             "PRICING_UNAVAILABLE",
             "Model prices are not available right now, retry shortly",
             503
@@ -197,7 +197,7 @@ function openRouterPrices(options = {}) {
         });
       }
       if (inflight) {
-        throw new chunkKZZY5LS6_cjs.X402PriceRejectedError(
+        throw new chunk4CEMNRCZ_cjs.X402PriceRejectedError(
           "UNKNOWN_MODEL",
           `No price known for model "${shortName(model)}" yet. The price list is being refreshed, retry in a few seconds.`
         );
@@ -210,7 +210,7 @@ function openRouterPrices(options = {}) {
 // src/llm/cap.ts
 var DEFAULT_MARGIN = 0;
 function reject(code, message) {
-  throw new chunkKZZY5LS6_cjs.X402PriceRejectedError(code, message);
+  throw new chunk4CEMNRCZ_cjs.X402PriceRejectedError(code, message);
 }
 function isTextOnly(modalities) {
   return Array.isArray(modalities) && modalities.every((modality) => modality === "text");
@@ -222,17 +222,17 @@ function chatCompletionCap(options) {
   const allowed = options.models ? new Set(options.models) : void 0;
   const estimate = options.estimateInputTokens ?? estimateInputTokens;
   if (positiveInteger(maxOutputTokens) === void 0) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `chatCompletionCap: maxOutputTokens must be a positive integer, got ${maxOutputTokens}`
     );
   }
   if (!Number.isFinite(margin) || margin < 0) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `chatCompletionCap: margin must be a non-negative number, got ${margin}`
     );
   }
   if (allowed?.size === 0) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError("chatCompletionCap: models must not be empty");
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError("chatCompletionCap: models must not be empty");
   }
   return async (ctx) => {
     const raw = ctx.body;
@@ -295,7 +295,7 @@ function chatCompletionCap(options) {
       reject("UNKNOWN_MODEL", `No price known for model "${shortName(model)}"`);
     }
     if (!isValidPrice(price)) {
-      throw new chunkKZZY5LS6_cjs.X402ConfigError(
+      throw new chunk4CEMNRCZ_cjs.X402ConfigError(
         `chatCompletionCap: the price source returned an invalid price for model "${shortName(model)}"`
       );
     }
@@ -343,13 +343,13 @@ var failure = (status, error, message) => ({
 });
 async function forwardChatCompletion(body, options) {
   if (typeof options.baseUrl !== "string" || !URL.canParse(options.baseUrl)) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `forwardChatCompletion: baseUrl must be a URL, got ${JSON.stringify(options.baseUrl)}`
     );
   }
   const maxOutputTokens = options.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
   if (positiveInteger(maxOutputTokens) === void 0) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `forwardChatCompletion: maxOutputTokens must be a positive integer, got ${maxOutputTokens}`
     );
   }

package/dist/llm.d.cts

@@ -1,4 +1,4 @@
-import { o as PriceFunction, j as MeterFunction } from './types-BWL9h1eY.cjs';
+import { o as PriceFunction, j as MeterFunction } from './types-CRBMTQaq.cjs';
 import 'viem';
 
 /**

package/dist/llm.d.ts

@@ -1,4 +1,4 @@
-import { o as PriceFunction, j as MeterFunction } from './types-BWL9h1eY.js';
+import { o as PriceFunction, j as MeterFunction } from './types-CRBMTQaq.js';
 import 'viem';
 
 /**

package/dist/llm.js

@@ -1,4 +1,4 @@
-import { X402ConfigError, X402PriceRejectedError } from './chunk-QAECRSWF.js';
+import { X402ConfigError, X402PriceRejectedError } from './chunk-MZCHBBUN.js';
 
 // src/llm/estimate.ts
 function estimateTokens(text) {