@parallel-protocol/x402 0.9.0 → 0.10.1

package/dist/{chunk-G7HSURPM.js → chunk-CNASNROQ.js}

@@ -1,5 +1,6 @@
-import { X402_ERROR_CODES, X402ConfigError, X402RuntimeError, isPriceRejection } from './chunk-QAECRSWF.js';
-import { isKnownChain, isActiveParallelizerChain, ACTIVE_PARALLELIZER_CHAINS, getTokenDecimals as getTokenDecimals$1 } from '@parallel-protocol/chains';
+import { X402_ERROR_CODES, X402ConfigError, X402RuntimeError, isPriceRejection } from './chunk-MZCHBBUN.js';
+import { isKnownChain, isActiveParallelizerChain, ACTIVE_PARALLELIZER_CHAINS, getUptoEscrowAddress, getTokenDecimals as getTokenDecimals$1 } from '@parallel-protocol/chains';
+import { permit2NonceToBytes32 } from '@parallel-protocol/payment-core';
 import { z } from 'zod';
 
 var PARALLEL_TOKENS = {
@@ -33,6 +34,9 @@ var PARALLEL_TOKENS = {
     sUSDe: "0x211Cc4DD073734dA055fbF44a2b4667d5E5fE5d2"
   }
 };
+var USDC_EIP712_DOMAIN = {
+  base: { name: "USD Coin", version: "2" }
+};
 function getDefaultAcceptedTokens(network) {
   const entry = PARALLEL_TOKENS[network];
   if (!entry) return void 0;
@@ -46,6 +50,12 @@ function getMeteredAcceptedTokens(network) {
 function getTokenDecimals(network, address) {
   return getTokenDecimals$1(network, address);
 }
+function hasMixedDecimals(network, tokens) {
+  const decimals = new Set(
+    tokens?.map((token) => getTokenDecimals$1(network, token))
+  );
+  return decimals.size > 1;
+}
 
 // src/utils.ts
 var EIP155_NETWORKS = {
@@ -104,18 +114,252 @@ function encodeBase64(obj) {
 function decodeBase64(str) {
   return JSON.parse(Buffer.from(str, "base64").toString("utf8"));
 }
-function matchRoute(path, routes) {
-  if (routes[path]) return routes[path];
+var CONDITIONAL_HEADERS = [
+  "if-match",
+  "if-none-match",
+  "if-modified-since",
+  "if-unmodified-since"
+];
+function dropConditionalHeaders(headers) {
+  for (const name of CONDITIONAL_HEADERS) delete headers[name];
+}
+var UTF8 = new TextDecoder();
+var DECODE_ROUNDS = 8;
+function decodePercent(path) {
+  try {
+    return decodeURIComponent(path);
+  } catch {
+    return path.replace(
+      /(?:%[\da-f]{2})+/gi,
+      (run) => UTF8.decode(
+        Uint8Array.from(
+          run.slice(1).split("%"),
+          (hex) => Number.parseInt(hex, 16)
+        )
+      )
+    );
+  }
+}
+function hasLongMarkRun(segment) {
+  for (const [run] of segment.matchAll(/\p{M}+/gu))
+    if (run.length > 8) return true;
+  return false;
+}
+function foldCase(segment) {
+  const composed = hasLongMarkRun(segment) ? segment : segment.normalize("NFC");
+  return composed.toLowerCase().toUpperCase().toLowerCase();
+}
+function pathSegments(path) {
+  let decoded = path;
+  for (let round = 0; round < DECODE_ROUNDS && decoded.includes("%"); round++) {
+    const next = decodePercent(decoded);
+    if (next === decoded) break;
+    decoded = next;
+  }
+  const target = decoded.replaceAll("\\", "/").replace(/^[a-z][\d+.a-z-]*:\/\/[^/]*/i, "").split(/[?#]/, 1)[0] ?? "";
+  return target.split("/").map((segment) => foldCase(segment).split(";", 1)[0] ?? "").filter((segment) => segment !== "");
+}
+function resolveDots(segments) {
+  const resolved = [];
+  for (const segment of segments) {
+    if (segment === "..") resolved.pop();
+    else if (segment !== ".") resolved.push(segment);
+  }
+  return resolved;
+}
+function normalizeRoutePath(path) {
+  return `/${resolveDots(pathSegments(path)).join("/")}`;
+}
+function routeTable(routes) {
+  return Object.entries(routes).map(([key, route]) => [
+    normalizeRoutePath(key),
+    route
+  ]);
+}
+function longestMatch(target, table) {
   let bestMatch;
   let bestLength = 0;
-  for (const [pattern, config] of Object.entries(routes)) {
-    if (path.startsWith(`${pattern}/`) && pattern.length > bestLength) {
-      bestMatch = config;
-      bestLength = pattern.length;
+  for (const [key, route] of table) {
+    if (key === target) return route;
+    if (target.startsWith(`${key}/`) && key.length > bestLength) {
+      bestMatch = route;
+      bestLength = key.length;
     }
   }
   return bestMatch;
 }
+function findRoute(path, table) {
+  const segments = pathSegments(path);
+  const dotSegments = segments.some(
+    (segment) => segment === "." || segment === ".."
+  );
+  const routePath = `/${resolveDots(segments).join("/")}`;
+  const route = longestMatch(routePath, table) ?? (dotSegments ? longestMatch(`/${segments.join("/")}`, table) : void 0);
+  return { route, dotSegments, routePath };
+}
+function isPreflightHeader(name) {
+  return /^(?:access-control-|vary$|allow$)/i.test(String(name));
+}
+function preflightHeaders(headers) {
+  if (Array.isArray(headers)) {
+    if (Array.isArray(headers[0]))
+      return headers.filter((pair) => isPreflightHeader(pair[0]));
+    return headers.flatMap(
+      (item, i) => i % 2 === 0 && isPreflightHeader(item) ? [item, headers[i + 1]] : []
+    );
+  }
+  if (headers !== null && typeof headers === "object")
+    return Object.fromEntries(
+      Object.entries(headers).filter(([name]) => isPreflightHeader(name))
+    );
+  return headers;
+}
+function answerAsPreflight(res) {
+  const writeHead = res.writeHead.bind(res);
+  const end = res.end.bind(res);
+  const callbackOf = (args) => args.find((arg) => typeof arg === "function");
+  const dropOtherHeaders = () => {
+    for (const name of res.getHeaderNames())
+      if (!isPreflightHeader(name)) res.removeHeader(name);
+  };
+  res.writeHead = ((statusCode, ...rest) => {
+    dropOtherHeaders();
+    res.statusMessage = "";
+    const headers = rest.find((arg) => typeof arg !== "string");
+    return headers === void 0 ? writeHead(statusCode) : writeHead(statusCode, preflightHeaders(headers));
+  });
+  res.write = ((...args) => {
+    const done = callbackOf(args);
+    if (done) queueMicrotask(done);
+    return true;
+  });
+  res.end = ((...args) => {
+    if (!res.headersSent) dropOtherHeaders();
+    const done = callbackOf(args);
+    return done ? end(done) : end();
+  });
+  res.addTrailers = () => {
+  };
+  res.writeEarlyHints = ((_hints, done) => {
+    if (done) queueMicrotask(done);
+  });
+}
+function preflightInit(res) {
+  res.body?.cancel().catch(() => {
+  });
+  const headers = new Headers();
+  for (const [name, value] of res.headers)
+    if (isPreflightHeader(name)) headers.append(name, value);
+  return { status: res.status, headers };
+}
+function permit2Extra(network, asset) {
+  const domain = USDC_EIP712_DOMAIN[network];
+  const escrow = getUptoEscrowAddress(network);
+  if (!domain || !escrow) return void 0;
+  const usdc = PARALLEL_TOKENS[network].usdc;
+  if (usdc.toLowerCase() !== asset.toLowerCase()) return void 0;
+  return { ...domain, facilitatorAddress: escrow };
+}
+var EIP2612_GAS_SPONSORING_EXTENSION = {
+  eip2612GasSponsoring: {
+    info: {
+      description: "The facilitator accepts EIP-2612 gasless Permit to `Permit2` canonical contract.",
+      version: "1"
+    },
+    schema: {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      type: "object",
+      properties: {
+        from: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]{40}$",
+          description: "The address of the sender."
+        },
+        asset: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]{40}$",
+          description: "The address of the ERC-20 token contract."
+        },
+        spender: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]{40}$",
+          description: "The address of the spender (Canonical Permit2)."
+        },
+        amount: {
+          type: "string",
+          pattern: "^[0-9]+$",
+          description: "The amount to approve (uint256). Typically MaxUint."
+        },
+        nonce: {
+          type: "string",
+          pattern: "^[0-9]+$",
+          description: "The current nonce of the sender."
+        },
+        deadline: {
+          type: "string",
+          pattern: "^[0-9]+$",
+          description: "The timestamp at which the signature expires."
+        },
+        signature: {
+          type: "string",
+          pattern: "^0x[a-fA-F0-9]+$",
+          description: "The 65-byte concatenated signature (r, s, v) as a hex string."
+        },
+        version: {
+          type: "string",
+          pattern: "^[0-9]+(\\.[0-9]+)*$",
+          description: "Schema version identifier."
+        }
+      },
+      required: [
+        "from",
+        "asset",
+        "spender",
+        "amount",
+        "nonce",
+        "deadline",
+        "signature",
+        "version"
+      ]
+    }
+  }
+};
+function signedPermit(info = {}) {
+  const { amount, deadline, signature } = info;
+  return typeof amount === "string" && typeof deadline === "string" && typeof signature === "string" ? { value: amount, deadline, signature } : void 0;
+}
+function isStandardPermit2Payment(decoded) {
+  const payment = decoded;
+  return typeof payment?.payload?.permit2Authorization === "object" && payment.payload.permit2Authorization !== null && payment.accepted?.scheme === "upto";
+}
+function toFacilitatorPayload(decoded, network) {
+  if (!isStandardPermit2Payment(decoded)) return decoded;
+  const { signature, permit2Authorization: auth } = decoded.payload;
+  const permit = signedPermit(decoded.extensions?.eip2612GasSponsoring?.info);
+  return {
+    scheme: "upto",
+    network,
+    method: "uptoPermit2",
+    tokenIn: auth.permitted.token,
+    payload: {
+      signature,
+      authorization: {
+        from: auth.from,
+        to: auth.witness.to,
+        value: auth.permitted.amount,
+        validAfter: auth.witness.validAfter,
+        validBefore: auth.deadline,
+        nonce: permit2NonceToBytes32(auth.nonce)
+      },
+      ...permit && { permit2612: permit }
+    },
+    uptoParams: { payTo: auth.witness.to },
+    permit2Params: {
+      spender: auth.spender,
+      facilitator: auth.witness.facilitator
+    }
+  };
+}
 var ethereumAddressSchema = z.string().regex(/^0x[0-9a-fA-F]{40}$/, "Invalid Ethereum address");
 var txHashSchema = z.string().regex(/^0x[0-9a-fA-F]{64}$/);
 var priceSchema = z.union([
@@ -150,6 +394,7 @@ var routeConfigSchema = z.object({
   description: z.string().optional(),
   scheme: z.enum(["exact", "upto"]).optional(),
   maxTimeoutSeconds: z.number().int().positive().optional(),
+  decimals: z.number().int().nonnegative().optional(),
   meter: z.custom(
     (value) => typeof value === "function",
     "meter must be a function of the response"
@@ -171,12 +416,37 @@ var routeConfigSchema = z.object({
   const usdp = PARALLEL_TOKENS[route.network]?.usdp;
   if (!usdp) return true;
   return route.acceptedTokens.every(
-    (token) => token.toLowerCase() === usdp.toLowerCase()
+    (token) => token.toLowerCase() === usdp.toLowerCase() || permit2Extra(route.network, token) !== void 0
+  );
+}, "acceptedTokens on an upto route may only list the network's USDp, and its USDC where the escrow takes Permit2 payments").refine(
+  (route) => route.scheme !== "upto" || !hasMixedDecimals(route.network, route.acceptedTokens) || typeof route.price !== "bigint" && route.decimals === void 0,
+  'An upto route that accepts tokens with different decimals needs a price like "0.01", not a bigint or an explicit decimals'
+);
+function sameValue(a, b) {
+  if (Object.is(a, b)) return true;
+  if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+  const entries = Object.entries(a);
+  return Array.isArray(a) === Array.isArray(b) && entries.length === Object.keys(b).length && entries.every(
+    ([key, value]) => sameValue(value, b[key])
   );
-}, "acceptedTokens on an upto route may only list the network's USDp");
+}
+function consistentRoutePaths(routes, ctx) {
+  const keyByPath = /* @__PURE__ */ new Map();
+  for (const [key, route] of Object.entries(routes)) {
+    const path = normalizeRoutePath(key);
+    const other = keyByPath.get(path);
+    if (other === void 0) keyByPath.set(path, key);
+    else if (!sameValue(routes[other], route))
+      ctx.addIssue({
+        code: "custom",
+        path: [key],
+        message: `Same path as "${other}" once normalized, with another config: keep one of the two routes`
+      });
+  }
+}
 var paymentMiddlewareConfigSchema = z.object({
   facilitator: facilitatorConfigSchema,
-  routes: z.record(z.string(), routeConfigSchema).refine((r) => Object.keys(r).length > 0, "At least one route is required")
+  routes: z.record(z.string(), routeConfigSchema).refine((r) => Object.keys(r).length > 0, "At least one route is required").superRefine(consistentRoutePaths)
 });
 var facilitatorResponseSchema = z.discriminatedUnion("success", [
   z.object({
@@ -210,6 +480,9 @@ var settleSuccessSchema = z.object({
   gasSponsored: z.boolean(),
   // Metered routes: the amount actually charged (smallest unit).
   amountSettled: z.string().optional(),
+  // A standard x402 Permit2 payment: the USDp the merchant received for
+  // amountSettled (smallest unit), when the facilitator read it.
+  amountDelivered: z.string().optional(),
   // The facilitator answered from a recorded outcome, nothing was broadcast.
   alreadySettled: z.boolean().optional()
 });
@@ -248,13 +521,17 @@ function throwIfRedirect(response) {
     status: response.status
   });
 }
-function decodePaymentHeader(paymentHeader) {
+function decodePaymentHeader(paymentHeader, network) {
   try {
-    return decodeBase64(paymentHeader);
+    return toFacilitatorPayload(decodeBase64(paymentHeader), network);
   } catch {
     throw new X402RuntimeError(X402_ERROR_CODES.INVALID_PAYMENT);
   }
 }
+function payerOf(paymentPayload) {
+  const from = paymentPayload?.payload?.authorization?.from;
+  return typeof from === "string" ? from : void 0;
+}
 var FacilitatorClient = class {
   // Checked and kept when the client is built: a config changed afterwards
   // does not move the calls elsewhere.
@@ -272,7 +549,10 @@ var FacilitatorClient = class {
     this.apiKey = config.apiKey;
   }
   async verify(paymentHeader, paymentRequirements) {
-    const paymentPayload = decodePaymentHeader(paymentHeader);
+    const paymentPayload = decodePaymentHeader(
+      paymentHeader,
+      paymentRequirements.network
+    );
     let json;
     try {
       const response = await fetch(`${this.url}/x402/verify`, {
@@ -307,7 +587,10 @@ var FacilitatorClient = class {
     }
   }
   async settle(paymentHeader, paymentRequirements, options) {
-    const paymentPayload = decodePaymentHeader(paymentHeader);
+    const paymentPayload = decodePaymentHeader(
+      paymentHeader,
+      paymentRequirements.network
+    );
     let json;
     try {
       const response = await fetch(`${this.url}/x402/settle`, {
@@ -358,17 +641,27 @@ var FacilitatorClient = class {
     try {
       const parsed = settleResponseSchema.parse(json);
       if ("txHash" in parsed) {
+        const txHash = parsed.txHash;
+        const networkId = toEip155Network(paymentRequirements.network);
+        const payer = payerOf(paymentPayload);
         return {
           success: true,
-          txHash: parsed.txHash,
+          txHash,
           route: parsed.route,
           chain: paymentRequirements.network,
           gasSponsored: parsed.gasSponsored,
-          networkId: toEip155Network(paymentRequirements.network),
+          networkId,
           ...parsed.amountSettled !== void 0 && {
             amountSettled: parsed.amountSettled
           },
-          ...parsed.alreadySettled && { alreadySettled: true }
+          ...parsed.amountDelivered !== void 0 && {
+            amountDelivered: parsed.amountDelivered
+          },
+          ...parsed.alreadySettled && { alreadySettled: true },
+          transaction: txHash,
+          network: networkId,
+          amount: parsed.amountSettled ?? paymentRequirements.maxAmountRequired,
+          ...payer && { payer }
         };
       }
       return {
@@ -438,16 +731,17 @@ async function raceTimeout(promise, ms = HANDLER_TIMEOUT_MS) {
 
 // src/middleware.ts
 var PRICE_FORMAT = /^\d+(?:\.\d+)?$/;
-async function requestContext(adapter) {
+async function requestContext(adapter, routePath) {
   return {
     method: adapter.getMethod(),
     path: adapter.getPath(),
+    routePath,
     url: adapter.getUrl(),
     header: (name) => adapter.getHeader(name),
     body: adapter.getBody ? await adapter.getBody() : void 0
   };
 }
-async function resolvePrice(config, ctx) {
+async function resolvePrice(config, ctx, tokens) {
   if (typeof config.price !== "function") return config.price;
   if (!ctx) throw new X402ConfigError("A price function needs the request");
   let price;
@@ -468,6 +762,11 @@ async function resolvePrice(config, ctx) {
       )} \u2014 expected a positive amount like "0.01" or a bigint`
     );
   }
+  if (typeof price === "bigint" && config.scheme === "upto" && hasMixedDecimals(config.network, tokens)) {
+    throw new X402ConfigError(
+      `The price function of route "${config.network}${ctx.path}" returned a bigint, but the route accepts tokens with different decimals: return a price like "0.01"`
+    );
+  }
   return price;
 }
 var SETTLE_AMOUNT_HEADER = "payment-settle-amount";
@@ -519,6 +818,17 @@ function invalidSettleAmountResponse(reason) {
     reason === "meter" ? INVALID_METER_RESPONSE : INVALID_SETTLE_AMOUNT_RESPONSE
   );
 }
+function refusingBigints(meter) {
+  return async (ctx) => {
+    const amount = await meter(ctx);
+    if (typeof amount === "bigint") {
+      throw new X402ConfigError(
+        'The meter returned a bigint, but the route accepts tokens with different decimals: return an amount like "0.75"'
+      );
+    }
+    return amount;
+  };
+}
 var AMOUNT_FORMAT = /^\d+(?:\.\d+)?$/;
 async function resolveCharge(verified, settleHeader, response) {
   if (verified.meter) {
@@ -598,18 +908,27 @@ function priceInUnits(price, decimals, asset) {
 }
 function buildPaymentRequired(url, config, resolvedTokens, price) {
   const network = toEip155Network(config.network);
-  const accepts = resolvedTokens.map((asset) => {
+  const scheme = config.scheme ?? "exact";
+  const entries = resolvedTokens.map((asset) => {
     const decimals = resolveDecimals(config, asset);
     return {
-      scheme: config.scheme ?? "exact",
+      scheme,
       network,
       asset,
       amount: priceInUnits(price, decimals, asset),
       payTo: config.payTo,
       maxTimeoutSeconds: config.maxTimeoutSeconds ?? DEFAULT_MAX_TIMEOUT_SECONDS,
-      extra: { decimals }
+      extra: {
+        decimals,
+        ...scheme === "upto" && permit2Extra(config.network, asset)
+      }
     };
   });
+  const viaPermit2 = (entry) => "facilitatorAddress" in entry.extra;
+  const accepts = [
+    ...entries.filter(viaPermit2),
+    ...entries.filter((entry) => !viaPermit2(entry))
+  ];
   return {
     x402Version: 2,
     resource: {
@@ -617,13 +936,17 @@ function buildPaymentRequired(url, config, resolvedTokens, price) {
       description: config.description,
       mimeType: "application/json"
     },
-    accepts
+    accepts,
+    ...accepts.some(viaPermit2) && {
+      extensions: EIP2612_GAS_SPONSORING_EXTENSION
+    }
   };
 }
-function decodePaymentPayload(header) {
+function decodePaymentPayload(header, network) {
   try {
-    const parsed = JSON.parse(
-      Buffer.from(header, "base64").toString("utf8")
+    const parsed = toFacilitatorPayload(
+      JSON.parse(Buffer.from(header, "base64").toString("utf8")),
+      network
     );
     return typeof parsed === "object" && parsed !== null ? parsed : void 0;
   } catch {
@@ -642,7 +965,7 @@ function deliveredToken(payload, chainTokens) {
   return payload.tokenIn ?? chainTokens?.usdp;
 }
 function resolveDeliveredAsset(header, config, resolvedTokens) {
-  const payload = decodePaymentPayload(header);
+  const payload = decodePaymentPayload(header, config.network);
   const target = payload ? deliveredToken(
     payload,
     PARALLEL_TOKENS[config.network]
@@ -708,16 +1031,31 @@ function createPaymentGate(config) {
     );
   }
   const client = new FacilitatorClient(config.facilitator);
+  const routes = routeTable(config.routes);
   return async (adapter) => {
-    if (adapter.getMethod().toUpperCase() === "OPTIONS")
-      return { type: "pass" };
-    const routeConfig = matchRoute(adapter.getPath(), config.routes);
+    const path = adapter.getPath();
+    const fullPath = adapter.getFullPath?.();
+    let match = findRoute(path, routes);
+    if (!match.route && fullPath !== void 0 && fullPath !== path)
+      match = findRoute(fullPath, routes);
+    const { route: routeConfig, dotSegments, routePath } = match;
     if (!routeConfig) return { type: "pass" };
+    if (dotSegments) {
+      return {
+        type: "error",
+        result: jsonResult(400, {
+          error: X402_ERROR_CODES.INVALID_PATH,
+          message: "A paid route is not served on a path with . or .. segments: send the path resolved"
+        })
+      };
+    }
+    if (adapter.getMethod().toUpperCase() === "OPTIONS")
+      return { type: "pass", preflight: true };
     const resolvedTokens = resolveAcceptedTokens(routeConfig);
-    let request = typeof routeConfig.price === "function" ? await requestContext(adapter) : void 0;
+    let request = typeof routeConfig.price === "function" ? await requestContext(adapter, routePath) : void 0;
     let price;
     try {
-      price = await resolvePrice(routeConfig, request);
+      price = await resolvePrice(routeConfig, request, resolvedTokens);
     } catch (err) {
       if (!isPriceRejection(err)) throw err;
       const status = Number.isInteger(err.status) && err.status >= 400 && err.status <= 599 ? err.status : 400;
@@ -768,7 +1106,8 @@ function createPaymentGate(config) {
         )
       };
     }
-    if (routeConfig.meter && !request) request = await requestContext(adapter);
+    const meter = routeConfig.meter && hasMixedDecimals(routeConfig.network, resolvedTokens) ? refusingBigints(routeConfig.meter) : routeConfig.meter;
+    if (meter && !request) request = await requestContext(adapter, routePath);
     return {
       type: "verified",
       scheme: routeConfig.scheme ?? "exact",
@@ -776,7 +1115,7 @@ function createPaymentGate(config) {
       decimals: resolveDecimals(routeConfig, asset),
       handlerTimeoutMs: handlerTimeoutFor(routeConfig),
       settle: (options) => client.settle(paymentHeader, requirements, { ...options, settleToken }),
-      ...routeConfig.meter && { meter: routeConfig.meter, request }
+      ...meter && { meter, request }
     };
   };
 }
@@ -850,7 +1189,8 @@ function createPaymentMiddleware(config) {
   const gate = createPaymentGate(config);
   return async (adapter) => {
     const gateResult = await gate(adapter);
-    if (gateResult.type === "pass") return { pass: true };
+    if (gateResult.type === "pass")
+      return gateResult.preflight ? { pass: true, preflight: true } : { pass: true };
     if (gateResult.type === "error") return gateResult.result;
     let handlerResult;
     try {
@@ -902,4 +1242,4 @@ function createPaymentMiddleware(config) {
   };
 }
 
-export { FacilitatorClient, HANDLER_TIMEOUT, PARALLEL_TOKENS, SETTLE_AMOUNT_HEADER, createPaymentGate, createPaymentMiddleware, encodeBase64, getDefaultAcceptedTokens, invalidSettleAmountResponse, isJsonContentType, jsonFromResponse, matchRoute, parseJsonBody, parsePrice, raceTimeout, resolveCharge, resolveSettleAmount, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };
+export { FacilitatorClient, HANDLER_TIMEOUT, PARALLEL_TOKENS, SETTLE_AMOUNT_HEADER, answerAsPreflight, createPaymentGate, createPaymentMiddleware, dropConditionalHeaders, encodeBase64, findRoute, getDefaultAcceptedTokens, invalidSettleAmountResponse, isJsonContentType, jsonFromResponse, normalizeRoutePath, parseJsonBody, parsePrice, preflightInit, raceTimeout, resolveCharge, resolveSettleAmount, routeTable, settleVerified, settlementFailureResponse, toEip155Network, validateAddress };

package/dist/{chunk-QAECRSWF.js → chunk-MZCHBBUN.js}

@@ -3,6 +3,8 @@ var X402_ERROR_CODES = {
   FACILITATOR_UNAVAILABLE: "FACILITATOR_UNAVAILABLE",
   FACILITATOR_INVALID_RESPONSE: "FACILITATOR_INVALID_RESPONSE",
   INVALID_PAYMENT: "INVALID_PAYMENT",
+  /** A path with `.` or `..` segments on a paid route, refused with 400. */
+  INVALID_PATH: "INVALID_PATH",
   /** The facilitator did not answer a settle within the client's timeout: the payment may still settle. */
   SETTLE_TIMEOUT: "SETTLE_TIMEOUT"
 };