@parallel-protocol/x402 0.9.0 → 0.10.1

package/dist/{chunk-TH77IB3T.cjs → chunk-AYMDIX7A.cjs}

@@ -1,7 +1,8 @@
 'use strict';
 
-var chunkKZZY5LS6_cjs = require('./chunk-KZZY5LS6.cjs');
+var chunk4CEMNRCZ_cjs = require('./chunk-4CEMNRCZ.cjs');
 var chains = require('@parallel-protocol/chains');
+var paymentCore = require('@parallel-protocol/payment-core');
 var zod = require('zod');
 
 var PARALLEL_TOKENS = {
@@ -35,6 +36,9 @@ var PARALLEL_TOKENS = {
     sUSDe: "0x211Cc4DD073734dA055fbF44a2b4667d5E5fE5d2"
   }
 };
+var USDC_EIP712_DOMAIN = {
+  base: { name: "USD Coin", version: "2" }
+};
 function getDefaultAcceptedTokens(network) {
   const entry = PARALLEL_TOKENS[network];
   if (!entry) return void 0;
@@ -48,6 +52,12 @@ function getMeteredAcceptedTokens(network) {
 function getTokenDecimals(network, address) {
   return chains.getTokenDecimals(network, address);
 }
+function hasMixedDecimals(network, tokens) {
+  const decimals = new Set(
+    tokens?.map((token) => chains.getTokenDecimals(network, token))
+  );
+  return decimals.size > 1;
+}
 
 // src/utils.ts
 var EIP155_NETWORKS = {
@@ -106,18 +116,252 @@ function encodeBase64(obj) {
 function decodeBase64(str) {
   return JSON.parse(Buffer.from(str, "base64").toString("utf8"));
 }
-function matchRoute(path, routes) {
-  if (routes[path]) return routes[path];
+var CONDITIONAL_HEADERS = [
+  "if-match",
+  "if-none-match",
+  "if-modified-since",
+  "if-unmodified-since"
+];
+function dropConditionalHeaders(headers) {
+  for (const name of CONDITIONAL_HEADERS) delete headers[name];
+}
+var UTF8 = new TextDecoder();
+var DECODE_ROUNDS = 8;
+function decodePercent(path) {
+  try {
+    return decodeURIComponent(path);
+  } catch {
+    return path.replace(
+      /(?:%[\da-f]{2})+/gi,
+      (run) => UTF8.decode(
+        Uint8Array.from(
+          run.slice(1).split("%"),
+          (hex) => Number.parseInt(hex, 16)
+        )
+      )
+    );
+  }
+}
+function hasLongMarkRun(segment) {
+  for (const [run] of segment.matchAll(/\p{M}+/gu))
+    if (run.length > 8) return true;
+  return false;
+}
+function foldCase(segment) {
+  const composed = hasLongMarkRun(segment) ? segment : segment.normalize("NFC");
+  return composed.toLowerCase().toUpperCase().toLowerCase();
+}
+function pathSegments(path) {
+  let decoded = path;
+  for (let round = 0; round < DECODE_ROUNDS && decoded.includes("%"); round++) {
+    const next = decodePercent(decoded);
+    if (next === decoded) break;
+    decoded = next;
+  }
+  const target = decoded.replaceAll("\\", "/").replace(/^[a-z][\d+.a-z-]*:\/\/[^/]*/i, "").split(/[?#]/, 1)[0] ?? "";
+  return target.split("/").map((segment) => foldCase(segment).split(";", 1)[0] ?? "").filter((segment) => segment !== "");
+}
+function resolveDots(segments) {
+  const resolved = [];
+  for (const segment of segments) {
+    if (segment === "..") resolved.pop();
+    else if (segment !== ".") resolved.push(segment);
+  }
+  return resolved;
+}
+function normalizeRoutePath(path) {
+  return `/${resolveDots(pathSegments(path)).join("/")}`;
+}
+function routeTable(routes) {
+  return Object.entries(routes).map(([key, route]) => [
+    normalizeRoutePath(key),
+    route
+  ]);
+}
+function longestMatch(target, table) {
   let bestMatch;
   let bestLength = 0;
-  for (const [pattern, config] of Object.entries(routes)) {
-    if (path.startsWith(`${pattern}/`) && pattern.length > bestLength) {
-      bestMatch = config;
-      bestLength = pattern.length;
+  for (const [key, route] of table) {
+    if (key === target) return route;
+    if (target.startsWith(`${key}/`) && key.length > bestLength) {
+      bestMatch = route;
+      bestLength = key.length;
     }
   }
   return bestMatch;
 }
+function findRoute(path, table) {
+  const segments = pathSegments(path);
+  const dotSegments = segments.some(
+    (segment) => segment === "." || segment === ".."
+  );
+  const routePath = `/${resolveDots(segments).join("/")}`;
+  const route = longestMatch(routePath, table) ?? (dotSegments ? longestMatch(`/${segments.join("/")}`, table) : void 0);
+  return { route, dotSegments, routePath };
+}
+function isPreflightHeader(name) {
+  return /^(?:access-control-|vary$|allow$)/i.test(String(name));
+}
+function preflightHeaders(headers) {
+  if (Array.isArray(headers)) {
+    if (Array.isArray(headers[0]))
+      return headers.filter((pair) => isPreflightHeader(pair[0]));
+    return headers.flatMap(
+      (item, i) => i % 2 === 0 && isPreflightHeader(item) ? [item, headers[i + 1]] : []
+    );
+  }
+  if (headers !== null && typeof headers === "object")
+    return Object.fromEntries(
+      Object.entries(headers).filter(([name]) => isPreflightHeader(name))
+    );
+  return headers;
+}
+function answerAsPreflight(res) {
+  const writeHead = res.writeHead.bind(res);
+  const end = res.end.bind(res);
+  const callbackOf = (args) => args.find((arg) => typeof arg === "function");
+  const dropOtherHeaders = () => {
+    for (const name of res.getHeaderNames())
+      if (!isPreflightHeader(name)) res.removeHeader(name);
+  };
+  res.writeHead = ((statusCode, ...rest) => {
+    dropOtherHeaders();
+    res.statusMessage = "";
+    const headers = rest.find((arg) => typeof arg !== "string");
+    return headers === void 0 ? writeHead(statusCode) : writeHead(statusCode, preflightHeaders(headers));
+  });
+  res.write = ((...args) => {
+    const done = callbackOf(args);
+    if (done) queueMicrotask(done);
+    return true;
+  });
+  res.end = ((...args) => {
+    if (!res.headersSent) dropOtherHeaders();
+    const done = callbackOf(args);
+    return done ? end(done) : end();
+  });
+  res.addTrailers = () => {
+  };
+  res.writeEarlyHints = ((_hints, done) => {
+    if (done) queueMicrotask(done);
+  });
+}
+function preflightInit(res) {
+  res.body?.cancel().catch(() => {
+  });
+  const headers = new Headers();
+  for (const [name, value] of res.headers)
+    if (isPreflightHeader(name)) headers.append(name, value);
+  return { status: res.status, headers };
+}
+function permit2Extra(network, asset) {
+  const domain = USDC_EIP712_DOMAIN[network];
+  const escrow = chains.getUptoEscrowAddress(network);
+  if (!domain || !escrow) return void 0;
+  const usdc = PARALLEL_TOKENS[network].usdc;
+  if (usdc.toLowerCase() !== asset.toLowerCase()) return void 0;
+  return { ...domain, facilitatorAddress: escrow };
+}
+var EIP2612_GAS_SPONSORING_EXTENSION = {
+  eip2612GasSponsoring: {
+    info: {
+      description: "The facilitator accepts EIP-2612 gasless Permit to `Permit2` canonical contract.",
+      version: "1"
+    },
+    schema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        from: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]{40}$",
+          description: "The address of the sender."
+        },
+        asset: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]{40}$",
+          description: "The address of the ERC-20 token contract."
+        },
+        spender: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]{40}$",
+          description: "The address of the spender (Canonical Permit2)."
+        },
+        amount: {
+          type: "string",
+          pattern: "^[0-9]+$",
+          description: "The amount to approve (uint256). Typically MaxUint."
+        },
+        nonce: {
+          type: "string",
+          pattern: "^[0-9]+$",
+          description: "The current nonce of the sender."
+        },
+        deadline: {
+          type: "string",
+          pattern: "^[0-9]+$",
+          description: "The timestamp at which the signature expires."
+        },
+        signature: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]+$",
+          description: "The 65-byte concatenated signature (r, s, v) as a hex string."
+        },
+        version: {
+          type: "string",
+          pattern: "^[0-9]+(\\.[0-9]+)*$",
+          description: "Schema version identifier."
+        }
+      },
+      required: [
+        "from",
+        "asset",
+        "spender",
+        "amount",
+        "nonce",
+        "deadline",
+        "signature",
+        "version"
+      ]
+    }
+  }
+};
+function signedPermit(info = {}) {
+  const { amount, deadline, signature } = info;
+  return typeof amount === "string" && typeof deadline === "string" && typeof signature === "string" ? { value: amount, deadline, signature } : void 0;
+}
+function isStandardPermit2Payment(decoded) {
+  const payment = decoded;
+  return typeof payment?.payload?.permit2Authorization === "object" && payment.payload.permit2Authorization !== null && payment.accepted?.scheme === "upto";
+}
+function toFacilitatorPayload(decoded, network) {
+  if (!isStandardPermit2Payment(decoded)) return decoded;
+  const { signature, permit2Authorization: auth } = decoded.payload;
+  const permit = signedPermit(decoded.extensions?.eip2612GasSponsoring?.info);
+  return {
+    scheme: "upto",
+    network,
+    method: "uptoPermit2",
+    tokenIn: auth.permitted.token,
+    payload: {
+      signature,
+      authorization: {
+        from: auth.from,
+        to: auth.witness.to,
+        value: auth.permitted.amount,
+        validAfter: auth.witness.validAfter,
+        validBefore: auth.deadline,
+        nonce: paymentCore.permit2NonceToBytes32(auth.nonce)
+      },
+      ...permit && { permit2612: permit }
+    },
+    uptoParams: { payTo: auth.witness.to },
+    permit2Params: {
+      spender: auth.spender,
+      facilitator: auth.witness.facilitator
+    }
+  };
+}
 var ethereumAddressSchema = zod.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "Invalid Ethereum address");
 var txHashSchema = zod.z.string().regex(/^0x[0-9a-fA-F]{64}$/);
 var priceSchema = zod.z.union([
@@ -152,6 +396,7 @@ var routeConfigSchema = zod.z.object({
   description: zod.z.string().optional(),
   scheme: zod.z.enum(["exact", "upto"]).optional(),
   maxTimeoutSeconds: zod.z.number().int().positive().optional(),
+  decimals: zod.z.number().int().nonnegative().optional(),
   meter: zod.z.custom(
     (value) => typeof value === "function",
     "meter must be a function of the response"
@@ -173,12 +418,37 @@ var routeConfigSchema = zod.z.object({
   const usdp = PARALLEL_TOKENS[route.network]?.usdp;
   if (!usdp) return true;
   return route.acceptedTokens.every(
-    (token) => token.toLowerCase() === usdp.toLowerCase()
+    (token) => token.toLowerCase() === usdp.toLowerCase() || permit2Extra(route.network, token) !== void 0
   );
-}, "acceptedTokens on an upto route may only list the network's USDp");
+}, "acceptedTokens on an upto route may only list the network's USDp, and its USDC where the escrow takes Permit2 payments").refine(
+  (route) => route.scheme !== "upto" || !hasMixedDecimals(route.network, route.acceptedTokens) || typeof route.price !== "bigint" && route.decimals === void 0,
+  'An upto route that accepts tokens with different decimals needs a price like "0.01", not a bigint or an explicit decimals'
+);
+function sameValue(a, b) {
+  if (Object.is(a, b)) return true;
+  if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+  const entries = Object.entries(a);
+  return Array.isArray(a) === Array.isArray(b) && entries.length === Object.keys(b).length && entries.every(
+    ([key, value]) => sameValue(value, b[key])
+  );
+}
+function consistentRoutePaths(routes, ctx) {
+  const keyByPath = /* @__PURE__ */ new Map();
+  for (const [key, route] of Object.entries(routes)) {
+    const path = normalizeRoutePath(key);
+    const other = keyByPath.get(path);
+    if (other === void 0) keyByPath.set(path, key);
+    else if (!sameValue(routes[other], route))
+      ctx.addIssue({
+        code: "custom",
+        path: [key],
+        message: `Same path as "${other}" once normalized, with another config: keep one of the two routes`
+      });
+  }
+}
 var paymentMiddlewareConfigSchema = zod.z.object({
   facilitator: facilitatorConfigSchema,
-  routes: zod.z.record(zod.z.string(), routeConfigSchema).refine((r) => Object.keys(r).length > 0, "At least one route is required")
+  routes: zod.z.record(zod.z.string(), routeConfigSchema).refine((r) => Object.keys(r).length > 0, "At least one route is required").superRefine(consistentRoutePaths)
 });
 var facilitatorResponseSchema = zod.z.discriminatedUnion("success", [
   zod.z.object({
@@ -212,6 +482,9 @@ var settleSuccessSchema = zod.z.object({
   gasSponsored: zod.z.boolean(),
   // Metered routes: the amount actually charged (smallest unit).
   amountSettled: zod.z.string().optional(),
+  // A standard x402 Permit2 payment: the USDp the merchant received for
+  // amountSettled (smallest unit), when the facilitator read it.
+  amountDelivered: zod.z.string().optional(),
   // The facilitator answered from a recorded outcome, nothing was broadcast.
   alreadySettled: zod.z.boolean().optional()
 });
@@ -246,17 +519,21 @@ function throwIfRedirect(response) {
   if (!redirected) return;
   response.body?.cancel().catch(() => {
   });
-  throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE, {
+  throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE, {
     status: response.status
   });
 }
-function decodePaymentHeader(paymentHeader) {
+function decodePaymentHeader(paymentHeader, network) {
   try {
-    return decodeBase64(paymentHeader);
+    return toFacilitatorPayload(decodeBase64(paymentHeader), network);
   } catch {
-    throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.INVALID_PAYMENT);
+    throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.INVALID_PAYMENT);
   }
 }
+function payerOf(paymentPayload) {
+  const from = paymentPayload?.payload?.authorization?.from;
+  return typeof from === "string" ? from : void 0;
+}
 var FacilitatorClient = class {
   // Checked and kept when the client is built: a config changed afterwards
   // does not move the calls elsewhere.
@@ -265,7 +542,7 @@ var FacilitatorClient = class {
   constructor(config) {
     const url = facilitatorUrlSchema.safeParse(config.url);
     if (!url.success) {
-      throw new chunkKZZY5LS6_cjs.X402ConfigError(
+      throw new chunk4CEMNRCZ_cjs.X402ConfigError(
         url.error.issues[0]?.message ?? "Invalid facilitator URL",
         url.error
       );
@@ -274,7 +551,10 @@ var FacilitatorClient = class {
     this.apiKey = config.apiKey;
   }
   async verify(paymentHeader, paymentRequirements) {
-    const paymentPayload = decodePaymentHeader(paymentHeader);
+    const paymentPayload = decodePaymentHeader(
+      paymentHeader,
+      paymentRequirements.network
+    );
     let json;
     try {
       const response = await fetch(`${this.url}/x402/verify`, {
@@ -287,8 +567,8 @@ var FacilitatorClient = class {
       throwIfRedirect(response);
       if (!response.ok) {
         const body = await readErrorBody(response);
-        throw new chunkKZZY5LS6_cjs.X402RuntimeError(
-          body.error ?? chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE,
+        throw new chunk4CEMNRCZ_cjs.X402RuntimeError(
+          body.error ?? chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE,
           {
             detail: body.message,
             status: response.status,
@@ -298,18 +578,21 @@ var FacilitatorClient = class {
       }
       json = await response.json();
     } catch (e) {
-      if (e instanceof chunkKZZY5LS6_cjs.X402RuntimeError) throw e;
-      throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
+      if (e instanceof chunk4CEMNRCZ_cjs.X402RuntimeError) throw e;
+      throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
     }
     try {
       const { settleToken } = verifyResponseSchema.parse(json);
       return { settleToken };
     } catch {
-      throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE);
+      throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE);
     }
   }
   async settle(paymentHeader, paymentRequirements, options) {
-    const paymentPayload = decodePaymentHeader(paymentHeader);
+    const paymentPayload = decodePaymentHeader(
+      paymentHeader,
+      paymentRequirements.network
+    );
     let json;
     try {
       const response = await fetch(`${this.url}/x402/settle`, {
@@ -334,7 +617,7 @@ var FacilitatorClient = class {
       if (!response.ok) {
         const body = await readErrorBody(response);
         if (body.error === void 0) {
-          throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE, {
+          throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE, {
             status: response.status
           });
         }
@@ -351,26 +634,36 @@ var FacilitatorClient = class {
       }
       json = await response.json();
     } catch (e) {
-      if (e instanceof chunkKZZY5LS6_cjs.X402RuntimeError) throw e;
+      if (e instanceof chunk4CEMNRCZ_cjs.X402RuntimeError) throw e;
       if (e instanceof Error && e.name === "TimeoutError") {
-        throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.SETTLE_TIMEOUT);
+        throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.SETTLE_TIMEOUT);
       }
-      throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
+      throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
     }
     try {
       const parsed = settleResponseSchema.parse(json);
       if ("txHash" in parsed) {
+        const txHash = parsed.txHash;
+        const networkId = toEip155Network(paymentRequirements.network);
+        const payer = payerOf(paymentPayload);
         return {
           success: true,
-          txHash: parsed.txHash,
+          txHash,
           route: parsed.route,
           chain: paymentRequirements.network,
           gasSponsored: parsed.gasSponsored,
-          networkId: toEip155Network(paymentRequirements.network),
+          networkId,
           ...parsed.amountSettled !== void 0 && {
             amountSettled: parsed.amountSettled
           },
-          ...parsed.alreadySettled && { alreadySettled: true }
+          ...parsed.amountDelivered !== void 0 && {
+            amountDelivered: parsed.amountDelivered
+          },
+          ...parsed.alreadySettled && { alreadySettled: true },
+          transaction: txHash,
+          network: networkId,
+          amount: parsed.amountSettled ?? paymentRequirements.maxAmountRequired,
+          ...payer && { payer }
         };
       }
       return {
@@ -378,7 +671,7 @@ var FacilitatorClient = class {
         error: { code: parsed.error, message: parsed.message }
       };
     } catch {
-      throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE);
+      throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE);
     }
   }
   /**
@@ -398,17 +691,17 @@ var FacilitatorClient = class {
       });
       throwIfRedirect(response);
       if (!response.ok) {
-        throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
+        throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
       }
       json = await response.json();
     } catch (e) {
-      if (e instanceof chunkKZZY5LS6_cjs.X402RuntimeError) throw e;
-      throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
+      if (e instanceof chunk4CEMNRCZ_cjs.X402RuntimeError) throw e;
+      throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE);
     }
     try {
       return facilitatorResponseSchema.parse(json);
     } catch {
-      throw new chunkKZZY5LS6_cjs.X402RuntimeError(chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE);
+      throw new chunk4CEMNRCZ_cjs.X402RuntimeError(chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE);
     }
   }
   buildHeaders() {
@@ -440,36 +733,42 @@ async function raceTimeout(promise, ms = HANDLER_TIMEOUT_MS) {
 
 // src/middleware.ts
 var PRICE_FORMAT = /^\d+(?:\.\d+)?$/;
-async function requestContext(adapter) {
+async function requestContext(adapter, routePath) {
   return {
     method: adapter.getMethod(),
     path: adapter.getPath(),
+    routePath,
     url: adapter.getUrl(),
     header: (name) => adapter.getHeader(name),
     body: adapter.getBody ? await adapter.getBody() : void 0
   };
 }
-async function resolvePrice(config, ctx) {
+async function resolvePrice(config, ctx, tokens) {
   if (typeof config.price !== "function") return config.price;
-  if (!ctx) throw new chunkKZZY5LS6_cjs.X402ConfigError("A price function needs the request");
+  if (!ctx) throw new chunk4CEMNRCZ_cjs.X402ConfigError("A price function needs the request");
   let price;
   try {
     price = await config.price(ctx);
   } catch (cause) {
-    if (chunkKZZY5LS6_cjs.isPriceRejection(cause)) throw cause;
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    if (chunk4CEMNRCZ_cjs.isPriceRejection(cause)) throw cause;
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `The price function of route "${config.network}${ctx.path}" threw`,
       cause
     );
   }
   const valid = typeof price === "bigint" ? price > 0n : typeof price === "string" && PRICE_FORMAT.test(price) && Number(price) > 0;
   if (!valid) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `The price function of route "${config.network}${ctx.path}" returned ${JSON.stringify(
         typeof price === "bigint" ? price.toString() : price
       )} \u2014 expected a positive amount like "0.01" or a bigint`
     );
   }
+  if (typeof price === "bigint" && config.scheme === "upto" && hasMixedDecimals(config.network, tokens)) {
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
+      `The price function of route "${config.network}${ctx.path}" returned a bigint, but the route accepts tokens with different decimals: return a price like "0.01"`
+    );
+  }
   return price;
 }
 var SETTLE_AMOUNT_HEADER = "payment-settle-amount";
@@ -521,11 +820,22 @@ function invalidSettleAmountResponse(reason) {
     reason === "meter" ? INVALID_METER_RESPONSE : INVALID_SETTLE_AMOUNT_RESPONSE
   );
 }
+function refusingBigints(meter) {
+  return async (ctx) => {
+    const amount = await meter(ctx);
+    if (typeof amount === "bigint") {
+      throw new chunk4CEMNRCZ_cjs.X402ConfigError(
+        'The meter returned a bigint, but the route accepts tokens with different decimals: return an amount like "0.75"'
+      );
+    }
+    return amount;
+  };
+}
 var AMOUNT_FORMAT = /^\d+(?:\.\d+)?$/;
 async function resolveCharge(verified, settleHeader, response) {
   if (verified.meter) {
     if (!verified.request) {
-      throw new chunkKZZY5LS6_cjs.X402ConfigError(
+      throw new chunk4CEMNRCZ_cjs.X402ConfigError(
         "A metered payment carries a meter but no request context"
       );
     }
@@ -576,14 +886,14 @@ function resolveAcceptedTokens(config) {
   }
   const defaults = config.scheme === "upto" ? getMeteredAcceptedTokens(config.network) : getDefaultAcceptedTokens(config.network);
   if (defaults) return defaults;
-  throw new chunkKZZY5LS6_cjs.X402ConfigError(
+  throw new chunk4CEMNRCZ_cjs.X402ConfigError(
     `acceptedTokens is required for network "${config.network}" \u2014 no defaults available for this chain`
   );
 }
 function resolveDecimals(config, asset) {
   const decimals = config.decimals ?? getTokenDecimals(config.network, asset);
   if (decimals === void 0) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `Unknown decimals for token ${asset} on "${config.network}" \u2014 add it to the @parallel-protocol/chains catalog or set the route's \`decimals\` explicitly`
     );
   }
@@ -592,7 +902,7 @@ function resolveDecimals(config, asset) {
 function priceInUnits(price, decimals, asset) {
   const units = parsePrice(price, decimals);
   if (units === 0n) {
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `Price ${typeof price === "bigint" ? price.toString() : `"${price}"`} is below the precision of token ${asset} (${decimals} decimals)`
     );
   }
@@ -600,18 +910,27 @@ function priceInUnits(price, decimals, asset) {
 }
 function buildPaymentRequired(url, config, resolvedTokens, price) {
   const network = toEip155Network(config.network);
-  const accepts = resolvedTokens.map((asset) => {
+  const scheme = config.scheme ?? "exact";
+  const entries = resolvedTokens.map((asset) => {
     const decimals = resolveDecimals(config, asset);
     return {
-      scheme: config.scheme ?? "exact",
+      scheme,
       network,
       asset,
       amount: priceInUnits(price, decimals, asset),
       payTo: config.payTo,
       maxTimeoutSeconds: config.maxTimeoutSeconds ?? DEFAULT_MAX_TIMEOUT_SECONDS,
-      extra: { decimals }
+      extra: {
+        decimals,
+        ...scheme === "upto" && permit2Extra(config.network, asset)
+      }
     };
   });
+  const viaPermit2 = (entry) => "facilitatorAddress" in entry.extra;
+  const accepts = [
+    ...entries.filter(viaPermit2),
+    ...entries.filter((entry) => !viaPermit2(entry))
+  ];
   return {
     x402Version: 2,
     resource: {
@@ -619,13 +938,17 @@ function buildPaymentRequired(url, config, resolvedTokens, price) {
       description: config.description,
       mimeType: "application/json"
     },
-    accepts
+    accepts,
+    ...accepts.some(viaPermit2) && {
+      extensions: EIP2612_GAS_SPONSORING_EXTENSION
+    }
   };
 }
-function decodePaymentPayload(header) {
+function decodePaymentPayload(header, network) {
   try {
-    const parsed = JSON.parse(
-      Buffer.from(header, "base64").toString("utf8")
+    const parsed = toFacilitatorPayload(
+      JSON.parse(Buffer.from(header, "base64").toString("utf8")),
+      network
     );
     return typeof parsed === "object" && parsed !== null ? parsed : void 0;
   } catch {
@@ -644,7 +967,7 @@ function deliveredToken(payload, chainTokens) {
   return payload.tokenIn ?? chainTokens?.usdp;
 }
 function resolveDeliveredAsset(header, config, resolvedTokens) {
-  const payload = decodePaymentPayload(header);
+  const payload = decodePaymentPayload(header, config.network);
   const target = payload ? deliveredToken(
     payload,
     PARALLEL_TOKENS[config.network]
@@ -687,7 +1010,7 @@ function paymentRequiredResponse(url, config, resolvedTokens, price, refusal) {
     price
   );
   if (refusal) {
-    paymentRequired.error = shapedCode(refusal.code) ?? chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE;
+    paymentRequired.error = shapedCode(refusal.code) ?? chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE;
     const message = boundedMessage(refusal.detail);
     if (message) paymentRequired.message = message;
   }
@@ -704,24 +1027,39 @@ function createPaymentGate(config) {
   if (!checked.success) {
     const issue = checked.error.issues[0];
     const where = issue?.path.length ? ` at ${issue.path.join(".")}` : "";
-    throw new chunkKZZY5LS6_cjs.X402ConfigError(
+    throw new chunk4CEMNRCZ_cjs.X402ConfigError(
       `Invalid paymentMiddleware config${where}: ${issue?.message ?? "check your routes, facilitator URL and payTo addresses"}`,
       checked.error
     );
   }
   const client = new FacilitatorClient(config.facilitator);
+  const routes = routeTable(config.routes);
   return async (adapter) => {
-    if (adapter.getMethod().toUpperCase() === "OPTIONS")
-      return { type: "pass" };
-    const routeConfig = matchRoute(adapter.getPath(), config.routes);
+    const path = adapter.getPath();
+    const fullPath = adapter.getFullPath?.();
+    let match = findRoute(path, routes);
+    if (!match.route && fullPath !== void 0 && fullPath !== path)
+      match = findRoute(fullPath, routes);
+    const { route: routeConfig, dotSegments, routePath } = match;
     if (!routeConfig) return { type: "pass" };
+    if (dotSegments) {
+      return {
+        type: "error",
+        result: jsonResult(400, {
+          error: chunk4CEMNRCZ_cjs.X402_ERROR_CODES.INVALID_PATH,
+          message: "A paid route is not served on a path with . or .. segments: send the path resolved"
+        })
+      };
+    }
+    if (adapter.getMethod().toUpperCase() === "OPTIONS")
+      return { type: "pass", preflight: true };
     const resolvedTokens = resolveAcceptedTokens(routeConfig);
-    let request = typeof routeConfig.price === "function" ? await requestContext(adapter) : void 0;
+    let request = typeof routeConfig.price === "function" ? await requestContext(adapter, routePath) : void 0;
     let price;
     try {
-      price = await resolvePrice(routeConfig, request);
+      price = await resolvePrice(routeConfig, request, resolvedTokens);
     } catch (err) {
-      if (!chunkKZZY5LS6_cjs.isPriceRejection(err)) throw err;
+      if (!chunk4CEMNRCZ_cjs.isPriceRejection(err)) throw err;
       const status = Number.isInteger(err.status) && err.status >= 400 && err.status <= 599 ? err.status : 400;
       return {
         type: "error",
@@ -758,7 +1096,7 @@ function createPaymentGate(config) {
     try {
       ({ settleToken } = await client.verify(paymentHeader, requirements));
     } catch (e) {
-      const refusal = e instanceof chunkKZZY5LS6_cjs.X402RuntimeError ? { code: e.code, detail: e.detail, retryAfter: e.retryAfter } : { code: chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE };
+      const refusal = e instanceof chunk4CEMNRCZ_cjs.X402RuntimeError ? { code: e.code, detail: e.detail, retryAfter: e.retryAfter } : { code: chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE };
       return {
         type: "error",
         result: paymentRequiredResponse(
@@ -770,7 +1108,8 @@ function createPaymentGate(config) {
         )
       };
     }
-    if (routeConfig.meter && !request) request = await requestContext(adapter);
+    const meter = routeConfig.meter && hasMixedDecimals(routeConfig.network, resolvedTokens) ? refusingBigints(routeConfig.meter) : routeConfig.meter;
+    if (meter && !request) request = await requestContext(adapter, routePath);
     return {
       type: "verified",
       scheme: routeConfig.scheme ?? "exact",
@@ -778,7 +1117,7 @@ function createPaymentGate(config) {
       decimals: resolveDecimals(routeConfig, asset),
       handlerTimeoutMs: handlerTimeoutFor(routeConfig),
       settle: (options) => client.settle(paymentHeader, requirements, { ...options, settleToken }),
-      ...routeConfig.meter && { meter: routeConfig.meter, request }
+      ...meter && { meter, request }
     };
   };
 }
@@ -786,9 +1125,9 @@ var DEFAULT_SETTLEMENT_MESSAGE = "The payment could not be settled.";
 var MERCHANT_SETTLEMENT_MESSAGE = "The merchant could not complete the settlement of this payment. The payment was not taken: do not sign another payment for this request before checking with the merchant.";
 var UNAVAILABLE_SETTLEMENT_MESSAGE = "The facilitator could not settle the payment for now. It may still settle until its authorization expires, or an earlier attempt may already have settled it: do not sign another payment for this request before checking with the merchant.";
 var AGENT_MESSAGES = {
-  [chunkKZZY5LS6_cjs.X402_ERROR_CODES.SETTLE_TIMEOUT]: "The facilitator did not confirm the settlement in time. The payment may still settle: do not sign another payment for this request before checking with the merchant.",
-  [chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE]: "The facilitator could not be reached to settle the payment. It may still have settled: do not sign another payment for this request before checking with the merchant.",
-  [chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE]: "The facilitator answered the settlement with an unexpected response. The payment may have settled: do not sign another payment for this request before checking with the merchant.",
+  [chunk4CEMNRCZ_cjs.X402_ERROR_CODES.SETTLE_TIMEOUT]: "The facilitator did not confirm the settlement in time. The payment may still settle: do not sign another payment for this request before checking with the merchant.",
+  [chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE]: "The facilitator could not be reached to settle the payment. It may still have settled: do not sign another payment for this request before checking with the merchant.",
+  [chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_INVALID_RESPONSE]: "The facilitator answered the settlement with an unexpected response. The payment may have settled: do not sign another payment for this request before checking with the merchant.",
   SETTLE_IN_PROGRESS: "The facilitator is still settling this payment. Do not sign another payment for this request before checking with the merchant.",
   RECEIPT_UNAVAILABLE: "The facilitator sent the transaction but could not read its confirmation. The payment may have settled: do not sign another payment for this request before checking with the merchant.",
   SETTLE_TOKEN_INVALID: MERCHANT_SETTLEMENT_MESSAGE,
@@ -813,8 +1152,8 @@ function settlementFailure(code, failure) {
   };
 }
 var RETRY_ONCE_CODES = /* @__PURE__ */ new Set([
-  chunkKZZY5LS6_cjs.X402_ERROR_CODES.SETTLE_TIMEOUT,
-  chunkKZZY5LS6_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE
+  chunk4CEMNRCZ_cjs.X402_ERROR_CODES.SETTLE_TIMEOUT,
+  chunk4CEMNRCZ_cjs.X402_ERROR_CODES.FACILITATOR_UNAVAILABLE
 ]);
 async function settleVerified(verified, options) {
   let response;
@@ -822,7 +1161,7 @@ async function settleVerified(verified, options) {
     try {
       response = await verified.settle(options);
     } catch (e) {
-      const code = e instanceof chunkKZZY5LS6_cjs.X402RuntimeError ? e.code : "UNKNOWN";
+      const code = e instanceof chunk4CEMNRCZ_cjs.X402RuntimeError ? e.code : "UNKNOWN";
       if (attempt > 0 || !RETRY_ONCE_CODES.has(code)) {
         return settlementFailure(code);
       }
@@ -852,7 +1191,8 @@ function createPaymentMiddleware(config) {
   const gate = createPaymentGate(config);
   return async (adapter) => {
     const gateResult = await gate(adapter);
-    if (gateResult.type === "pass") return { pass: true };
+    if (gateResult.type === "pass")
+      return gateResult.preflight ? { pass: true, preflight: true } : { pass: true };
     if (gateResult.type === "error") return gateResult.result;
     let handlerResult;
     try {
@@ -908,19 +1248,24 @@ exports.FacilitatorClient = FacilitatorClient;
 exports.HANDLER_TIMEOUT = HANDLER_TIMEOUT;
 exports.PARALLEL_TOKENS = PARALLEL_TOKENS;
 exports.SETTLE_AMOUNT_HEADER = SETTLE_AMOUNT_HEADER;
+exports.answerAsPreflight = answerAsPreflight;
 exports.createPaymentGate = createPaymentGate;
 exports.createPaymentMiddleware = createPaymentMiddleware;
+exports.dropConditionalHeaders = dropConditionalHeaders;
 exports.encodeBase64 = encodeBase64;
+exports.findRoute = findRoute;
 exports.getDefaultAcceptedTokens = getDefaultAcceptedTokens;
 exports.invalidSettleAmountResponse = invalidSettleAmountResponse;
 exports.isJsonContentType = isJsonContentType;
 exports.jsonFromResponse = jsonFromResponse;
-exports.matchRoute = matchRoute;
+exports.normalizeRoutePath = normalizeRoutePath;
 exports.parseJsonBody = parseJsonBody;
 exports.parsePrice = parsePrice;
+exports.preflightInit = preflightInit;
 exports.raceTimeout = raceTimeout;
 exports.resolveCharge = resolveCharge;
 exports.resolveSettleAmount = resolveSettleAmount;
+exports.routeTable = routeTable;
 exports.settleVerified = settleVerified;
 exports.settlementFailureResponse = settlementFailureResponse;
 exports.toEip155Network = toEip155Network;