@piprail/sdk 2.13.1 → 2.14.1

package/CHANGELOG.md

@@ -4,6 +4,113 @@ All notable changes to `@piprail/sdk` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 versions follow [Semantic Versioning](https://semver.org/).
 
+## [2.14.1] — 2026-06-24 — robustness & typed-error polish from a live-artifact break-it pass
+
+A small, fully-additive patch. After 2.14.0 shipped, the published npm artifact was put through an
+adversarial **break-it** pass from the examples (10 new suites, ~1,000+ assertions, run against the
+real `npm i @piprail/sdk` — not the workspace build; see
+`examples/basics/x402-parity-sandbox/FINDINGS.md`). Every security-critical and happy-path property
+held; this release tightens the robustness/contract edges it surfaced. **No default changes, no
+settled-payment outcome changes** — safe to bump.
+
+### Fixed
+
+- **`classifyChallenge` / `describeChallenge` now honour their documented "never throws" contract.**
+  A nullish or shapeless challenge (a *foreign* 402 reaching the self-describe / landing-page path)
+  previously threw a raw `TypeError` instead of degrading to a verdict / generic pointer. Both now
+  guard `accepts` and degrade gracefully. (F-A1/F-A2)
+- **A scientific-notation `amount` is rejected, not silently 1000×'d.** `createPaymentGate({ amount:
+  '1e3' })` used to be read as **1000 tokens**; `parseUnits` no longer expands scientific notation
+  for merchant amounts (`floorUnits` still does, for RPC dust reads) and throws on it. (F-B1)
+- **Typed config errors (ERRORS.md §5).** A new **`InvalidConfigError`** (`code: 'INVALID_CONFIG'`)
+  replaces the raw `viem`/`TypeError`s thrown for an invalid `amount` (non-string or non-decimal), a
+  missing `payTo`, or a non-array `resources` in `buildWellKnownX402Manifest`. (F-C1/F-C2)
+- **`buildWellKnownX402Manifest` no longer passes a non-finite `lastUpdated` through** to serialize
+  as JSON `null` — a `NaN`/`Infinity` falls back to now. (F-D4)
+- **`DIRECTORY_INFO` is now `Object.freeze`'d** at runtime, matching its `Readonly<>` type. (F-D2)
+- **The `exports` map now exposes `./package.json`**, so `require('@piprail/sdk/package.json')` (used
+  by version-introspection tooling) no longer throws `ERR_PACKAGE_PATH_NOT_EXPORTED`. (F-D3)
+
+### Added
+
+- **`InvalidConfigError`** — exported typed error for invalid merchant gate/manifest config.
+
+### Notes (verified by-design, not changed)
+
+- `client.estimateCost(url)` still **throws `NoCompatibleAcceptError`** when the client can't pay any
+  offered rail — a deliberate "this 402 isn't for you" signal (it returns `null` only for a non-402
+  or a malformed envelope). Docs clarified. (F-A3)
+- TON's native gas symbol is **`GRAM`** (the ticker after TON's 2026-06-15 governance rebrand), not a
+  bug. (F-D1)
+
+## [2.14.0] — 2026-06-23 — x402-over-MCP transport, payment-identifier idempotency, the `.well-known/x402.json` manifest — and a deep three-pass security hardening of every chain
+
+A feature **and** hardening release. It adds the third official x402 transport, an opt-in
+idempotency extension, and a forward-compatible discovery manifest — then puts the whole SDK through
+**three independent adversarial audit passes** (90+ agents) plus **live mainnet settlements of every
+transaction type across 10+ chains**, fixing ~28 issues the audits surfaced. Every default is
+unchanged; everything new is additive/opt-in. Proven on real mainnet payments on Base, BNB, Solana,
+Sui, Aptos, Algorand, Stellar, TON, Tron, and the XRP Ledger (onchain-proof, EIP-3009 + Permit2
+`exact`, non-EVM self-settle/facilitator `exact`, `upto`, A2A **and** MCP transports, verifiable
+receipts, discovery/registration).
+
+### Added
+
+- **x402-over-MCP transport (the third official transport).** `createMcpPaymentTool` wraps a
+  `PaymentGate` as a paid **MCP tool** — the MCP analogue of `requirePayment` / `createA2APaymentHandler`.
+  A 402 is an `isError` tool result (the `PaymentRequired` in `structuredContent` + a byte-equal
+  `content[0].text`); the payment rides under `params._meta["x402/payment"]`, the settlement under
+  `_meta["x402/payment-response"]`. All verify/settle/replay runs through the gate's `verifyObject`
+  (zero new crypto, zero driver changes) so every family rides MCP for free. Ships the full pure codec
+  + buyer read/frame helpers (`toMcpPaymentRequired`/`toMcpPaymentResponse`/`fromMcpPayment*`/
+  `isMcpPaymentRequired`/`buildMcpPaymentMeta`); a fully-automatic `McpPayer` is a documented fast-follow.
+- **Opt-in `payment-identifier` idempotency extension.** `paymentIdentifier: true` advertises the
+  extension; a buyer supplies a stable `id` (16–128 chars, `[A-Za-z0-9_-]`) it can retry under,
+  deduped on the gate's existing used-proof set (`pid:<id>`, case-sensitive). Default OFF; the three
+  verify branches are untouched. Codecs `buildPaymentIdentifierAdvertisement` / `readPaymentIdentifier`.
+- **Forward-compatible `.well-known/x402.json` manifest.** `buildWellKnownX402Manifest` emits the
+  richer, V2-shaped manifest (`{ x402Version: 2, lastUpdated, items[] }`) beside the legacy flat
+  `buildWellKnownX402` breadcrumb — a self-describing item per resource (its rails + call method), so a
+  crawler enumerates an origin without hitting each 402.
+- `estimateCost` now reports the buyer-gasless `exact`/`upto` rails as fee `0` across every family
+  (NEAR included), and ships a multi-chain cost matrix in the tests.
+
+### Fixed & hardened (three adversarial audit passes + live mainnet)
+
+- **SECURITY — memo-bound double-redeem (server).** The gate keyed its replay set on the
+  client-controlled `txHash`; memo-bound families (XRPL/Stellar/TON/Algorand) + native NEAR locate the
+  tx by memo/decoded-hash and ignore the ref, so one real payment could be re-redeemed N times within
+  the recency window. The gate now binds the replay key to the **verified** `receipt.transaction`
+  (a no-op for digest-bound EVM/Solana).
+- **SECURITY — TON jetton forgery.** `verify()` now requires a successful `vm` compute for a jetton
+  credit, rejecting a forged `internal_transfer` to an undeployed merchant jetton wallet (native exempt).
+- **Recency fails CLOSED uniformly.** Every digest/memo driver (EVM/Solana/Sui/NEAR/Stellar/Algorand/
+  XRPL/Tron/**Aptos**) now returns `payment_expired` on a missing/non-finite on-chain timestamp instead
+  of skipping the age check — closing a fail-open replay-backstop bypass.
+- **MCP transport B7 (at-most-once).** A `fulfill()` throw *after* settlement still returns a success
+  `_meta` payment-response (never a re-challenge), so a serve-time hiccup never re-charges the buyer.
+- **Sponsor fee-drain guard hardened.** The Solana `exact` ComputeBudget guard is now an allowlist
+  (rejects any discriminator ≠ set-unit-limit/price), closing the deprecated `RequestUnits`
+  `additional_fee` drain.
+- **Tron `tron:`-prefix double-redeem** closed (verify reads the ref verbatim). **Sui** recipient match
+  is case/padding-insensitive (a mixed-case `payTo` is no longer paid-but-unverifiable).
+- **Never-throw reads honored.** TON `verify()` maps a transient jetton-wallet RPC failure to a
+  retryable `tx_not_found` (and no longer poison-caches the rejected promise); EVM `estimateCost`
+  optional-chains a missing `extra`; the client drops a native or `extra`-less rail from the
+  exact/upto gather so plan/autoRoute/pay stay consistent.
+- **Typed errors at the boundary.** An unknown chain name → `UnsupportedNetworkError`; an invalid EVM
+  custom-token address → `WrongFamilyError` (at config time, not a raw viem throw later).
+- `floorUnits`/`parseUnits` accept scientific notation (XRPL funded-trustline false-`null` fix);
+  Solana `balanceOf` detects the Token-2022 program (no false 0); the memo-bound verifiers scan a full
+  200-tx page; the `payment-identifier` id stays case-sensitive in the default store; legacy v1
+  `txHash`-only receipts map onto `transaction`.
+
+### Docs
+
+- New **MCP transport (seller)** page; documented the manifest, the payment-identifier extension, the
+  uniform recency fail-closed, the sponsor-drain guard, the TON jetton compute-success rule, and the
+  5-family `exact` surface — a 17-fix single-source-of-truth pass over the docs.
+
 ## [2.13.1] — 2026-06-21 — Family-correct `exact`-rail recovery hints (no EVM-only assumptions on non-EVM rails)
 
 A correctness pass on the family-agnostic `exact` buyer path: its failure/timeout messages and one
@@ -1695,6 +1802,8 @@ straight into your wallet. The API is small and self-contained.
   to your wallet; PipRail never holds funds.
 - `viem ^2.21` is a peer dependency. Node 20+ or a modern browser.
 
+[2.14.0]: https://www.npmjs.com/package/@piprail/sdk
+[2.13.1]: https://www.npmjs.com/package/@piprail/sdk
 [2.12.0]: https://www.npmjs.com/package/@piprail/sdk
 [2.11.0]: https://www.npmjs.com/package/@piprail/sdk
 [2.10.0]: https://www.npmjs.com/package/@piprail/sdk

package/dist/{algorand-AQK5EAUF.cjs → algorand-ICJNXO5V.cjs}

@@ -10,7 +10,7 @@
 
 
 
-var _chunkDCOUJZPLcjs = require('./chunk-DCOUJZPL.cjs');
+var _chunk57V5DNJTcjs = require('./chunk-57V5DNJT.cjs');
 
 // src/drivers/algorand/index.ts
 var _algosdk = require('algosdk'); var _algosdk2 = _interopRequireDefault(_algosdk);
@@ -58,13 +58,13 @@ async function payAlgorand(params) {
   } catch (err) {
     const mapped = mapAlgorandError(err, accept.payTo);
     if (mapped) throw mapped;
-    throw _nullishCoalesce(_chunkDCOUJZPLcjs.toInsufficientFundsError.call(void 0, err), () => ( err));
+    throw _nullishCoalesce(_chunk57V5DNJTcjs.toInsufficientFundsError.call(void 0, err), () => ( err));
   }
 }
 function mapAlgorandError(err, payTo) {
   const m = err instanceof Error ? err.message : String(err);
   if (/must optin/i.test(m) || /missing from/i.test(m) && m.includes(payTo)) {
-    return new (0, _chunkDCOUJZPLcjs.RecipientNotReadyError)(
+    return new (0, _chunk57V5DNJTcjs.RecipientNotReadyError)(
       `Algorand recipient ${payTo} hasn't opted into this asset \u2014 it must opt in (a 0-amount asset transfer to itself) before it can receive. (Algorand: ${firstLine(m)})`,
       { cause: err }
     );
@@ -72,7 +72,7 @@ function mapAlgorandError(err, payTo) {
   if (/overspend|below min|min(imum)? balance|tried to spend|balance \d+ below|asset \d+ missing from|insufficient|underflow/i.test(
     m
   )) {
-    return new (0, _chunkDCOUJZPLcjs.InsufficientFundsError)(
+    return new (0, _chunk57V5DNJTcjs.InsufficientFundsError)(
       `Algorand payment failed: the sender can't cover it \u2014 token balance, ALGO for fees, the 0.1-ALGO minimum balance, or a missing asset opt-in on the sender. (Algorand: ${firstLine(m)})`,
       { cause: err }
     );
@@ -99,33 +99,33 @@ function isSet(addr) {
 function randomNote() {
   const g = globalThis.crypto;
   if (!_optionalChain([g, 'optionalAccess', _ => _.getRandomValues])) {
-    throw new (0, _chunkDCOUJZPLcjs.UnsupportedSchemeError)("Algorand exact: no Web Crypto CSPRNG available to generate a unique note.");
+    throw new (0, _chunk57V5DNJTcjs.UnsupportedSchemeError)("Algorand exact: no Web Crypto CSPRNG available to generate a unique note.");
   }
   return g.getRandomValues(new Uint8Array(32));
 }
 async function payExactAlgorand(input) {
   const { suggestedParams, sk, sender, accept } = input;
   if (accept.asset === "native") {
-    throw new (0, _chunkDCOUJZPLcjs.UnsupportedSchemeError)(
+    throw new (0, _chunk57V5DNJTcjs.UnsupportedSchemeError)(
       "Algorand exact is ASA-only (an asset transfer); native ALGO is not exact-payable. Pay via onchain-proof."
     );
   }
   const feePayer = accept.extra.feePayer;
   if (!feePayer) {
-    throw new (0, _chunkDCOUJZPLcjs.UnsupportedSchemeError)("Algorand exact rail must advertise extra.feePayer (the fee sponsor address).");
+    throw new (0, _chunk57V5DNJTcjs.UnsupportedSchemeError)("Algorand exact rail must advertise extra.feePayer (the fee sponsor address).");
   }
   const assetId = parseAlgorandAssetId(accept.asset);
   if (assetId === null) {
-    throw new (0, _chunkDCOUJZPLcjs.UnsupportedSchemeError)(`Algorand exact rail asset "${accept.asset}" must be a numeric ASA id.`);
+    throw new (0, _chunk57V5DNJTcjs.UnsupportedSchemeError)(`Algorand exact rail asset "${accept.asset}" must be a numeric ASA id.`);
   }
   if (!_algosdk2.default.isValidAddress(feePayer)) {
-    throw new (0, _chunkDCOUJZPLcjs.UnsupportedSchemeError)(`Algorand exact: extra.feePayer "${feePayer}" is not a valid Algorand address.`);
+    throw new (0, _chunk57V5DNJTcjs.UnsupportedSchemeError)(`Algorand exact: extra.feePayer "${feePayer}" is not a valid Algorand address.`);
   }
   if (!_algosdk2.default.isValidAddress(accept.payTo)) {
-    throw new (0, _chunkDCOUJZPLcjs.UnsupportedSchemeError)(`Algorand exact: payTo "${accept.payTo}" is not a valid Algorand address.`);
+    throw new (0, _chunk57V5DNJTcjs.UnsupportedSchemeError)(`Algorand exact: payTo "${accept.payTo}" is not a valid Algorand address.`);
   }
   if (feePayer === sender) {
-    throw new (0, _chunkDCOUJZPLcjs.UnsupportedSchemeError)(
+    throw new (0, _chunk57V5DNJTcjs.UnsupportedSchemeError)(
       "Algorand exact: the fee payer must differ from the payer \u2014 the buyer must pay ZERO ALGO (the sponsor pays the pooled fee)."
     );
   }
@@ -172,13 +172,13 @@ function decodeElement(bytes) {
 async function verifyAndSettleExactAlgorand(input) {
   const { client, feePayerSk, feePayerAddr, payload, accept } = input;
   const railFeePayer = accept.extra.feePayer;
-  if (!railFeePayer) throw new (0, _chunkDCOUJZPLcjs.SettlementError)("Algorand exact: rail is missing extra.feePayer.");
+  if (!railFeePayer) throw new (0, _chunk57V5DNJTcjs.SettlementError)("Algorand exact: rail is missing extra.feePayer.");
   if (railFeePayer !== feePayerAddr) {
-    throw new (0, _chunkDCOUJZPLcjs.SettlementError)("Algorand exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
+    throw new (0, _chunk57V5DNJTcjs.SettlementError)("Algorand exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
   }
   const assetId = parseAlgorandAssetId(accept.asset);
-  if (assetId === null) throw new (0, _chunkDCOUJZPLcjs.SettlementError)(`Algorand exact: rail asset "${accept.asset}" is not a numeric ASA id.`);
-  if (!_algosdk2.default.isValidAddress(accept.payTo)) throw new (0, _chunkDCOUJZPLcjs.SettlementError)(`Algorand exact: rail payTo "${accept.payTo}" is invalid.`);
+  if (assetId === null) throw new (0, _chunk57V5DNJTcjs.SettlementError)(`Algorand exact: rail asset "${accept.asset}" is not a numeric ASA id.`);
+  if (!_algosdk2.default.isValidAddress(accept.payTo)) throw new (0, _chunk57V5DNJTcjs.SettlementError)(`Algorand exact: rail payTo "${accept.payTo}" is invalid.`);
   const { paymentIndex, paymentGroup } = payload;
   if (paymentGroup.length !== GROUP_SIZE) {
     return fail("signature_invalid", `Algorand exact expects a ${GROUP_SIZE}-transaction group (payment + fee), got ${paymentGroup.length}.`);
@@ -244,7 +244,7 @@ async function verifyAndSettleExactAlgorand(input) {
   try {
     feeSigned = fee.signTxn(feePayerSk);
   } catch (err) {
-    throw new (0, _chunkDCOUJZPLcjs.SettlementError)(`Algorand exact settle: the gate could not sign the fee transaction (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
+    throw new (0, _chunk57V5DNJTcjs.SettlementError)(`Algorand exact settle: the gate could not sign the fee transaction (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
   }
   const signedGroup = elements.map((el, i) => i === paymentIndex ? payElement.raw : feeSigned);
   try {
@@ -266,7 +266,7 @@ async function verifyAndSettleExactAlgorand(input) {
     if (/signature|sig|auth|malformed/i.test(m)) return fail("signature_invalid", `Settle rejected \u2014 bad signature: ${shorten(m)}.`);
     if (/already in ledger|already committed|duplicate/i.test(m)) return fail("tx_already_used", `This payment was already settled: ${shorten(m)}.`);
     if (/\bround\b|expired|lifetime|stale|validity/i.test(m)) return fail("payment_expired", `Settle rejected \u2014 validity window expired: ${shorten(m)}.`);
-    throw new (0, _chunkDCOUJZPLcjs.SettlementError)(
+    throw new (0, _chunk57V5DNJTcjs.SettlementError)(
       `Algorand exact settle: the group failed to submit (${shorten(m)}). The buyer's signed transaction is still valid \u2014 fund/fix the fee payer (${railFeePayer}) and the buyer can re-present it.`,
       { cause: err }
     );
@@ -275,10 +275,10 @@ async function verifyAndSettleExactAlgorand(input) {
   try {
     round = await client.waitForConfirmation(buyerTxid);
   } catch (err) {
-    throw new (0, _chunkDCOUJZPLcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
+    throw new (0, _chunk57V5DNJTcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
   }
   if (round === null) {
-    throw new (0, _chunkDCOUJZPLcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
+    throw new (0, _chunk57V5DNJTcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
   }
   return {
     ok: true,
@@ -304,21 +304,22 @@ async function verifyAlgorand(params) {
   const wantAssetId = parseAlgorandAssetId(accept.asset);
   let txs;
   try {
-    txs = await reader.transactionsForAccount(accept.payTo, 50);
+    txs = await reader.transactionsForAccount(accept.payTo, 200);
   } catch (e4) {
     return rpcFailed(nonce);
   }
   const tx = txs.find((t) => typeof t.note === "string" && t.note === nonce);
   if (!tx) return notFound(nonce);
-  if (typeof tx.roundTime === "number") {
-    const ageSeconds = Math.floor(Date.now() / 1e3) - tx.roundTime;
-    if (Number.isFinite(ageSeconds) && ageSeconds > accept.maxTimeoutSeconds) {
-      return {
-        ok: false,
-        error: "payment_expired",
-        detail: `Payment is ${ageSeconds}s old; max allowed is ${accept.maxTimeoutSeconds}s.`
-      };
-    }
+  if (!Number.isFinite(tx.roundTime)) {
+    return { ok: false, error: "payment_expired", detail: `Cannot bound the age of Algorand tx ${tx.id} (no/invalid round-time) \u2014 failing closed.` };
+  }
+  const ageSeconds = Math.floor(Date.now() / 1e3) - tx.roundTime;
+  if (!Number.isFinite(ageSeconds) || ageSeconds > accept.maxTimeoutSeconds) {
+    return {
+      ok: false,
+      error: "payment_expired",
+      detail: `Payment is ${ageSeconds}s old; max allowed is ${accept.maxTimeoutSeconds}s.`
+    };
   }
   const isNative = wantAssetId === null;
   const typeOk = isNative ? tx.txType === "pay" : tx.txType === "axfer";
@@ -373,13 +374,13 @@ function rpcFailed(nonce) {
 
 function assertAlgorandWallet(wallet, network) {
   if (typeof wallet !== "object" || wallet === null) {
-    throw new (0, _chunkDCOUJZPLcjs.WrongFamilyError)(
+    throw new (0, _chunk57V5DNJTcjs.WrongFamilyError)(
       `chain ${network} is Algorand; wallet must be { key } (25-word mnemonic) or { account }.`
     );
   }
-  _chunkDCOUJZPLcjs.assertNoLegacyWalletKey.call(void 0, wallet, "Algorand");
+  _chunk57V5DNJTcjs.assertNoLegacyWalletKey.call(void 0, wallet, "Algorand");
   if (!("key" in wallet) && !("account" in wallet)) {
-    throw new (0, _chunkDCOUJZPLcjs.WrongFamilyError)(
+    throw new (0, _chunk57V5DNJTcjs.WrongFamilyError)(
       `chain ${network} is Algorand; wallet must be { key } (25-word mnemonic) or { account }.`
     );
   }
@@ -394,13 +395,13 @@ function resolveAlgorandWallet(config) {
       const { addr, sk } = _algosdk2.default.mnemonicToSecretKey(config.key);
       return { addr: addr.toString(), sk };
     } catch (cause) {
-      throw new (0, _chunkDCOUJZPLcjs.WrongFamilyError)(
+      throw new (0, _chunk57V5DNJTcjs.WrongFamilyError)(
         "Algorand wallet { key } is not a valid 25-word Algorand mnemonic.",
         { cause }
       );
     }
   }
-  throw new (0, _chunkDCOUJZPLcjs.WrongFamilyError)("Algorand wallet needs { key } (25-word mnemonic) or { account }.");
+  throw new (0, _chunk57V5DNJTcjs.WrongFamilyError)("Algorand wallet needs { key } (25-word mnemonic) or { account }.");
 }
 
 // src/drivers/algorand/index.ts
@@ -471,16 +472,16 @@ function makeAlgorandNetwork(preset, algodUrl) {
         const info = preset.tokens[token.toUpperCase()];
         if (!info) {
           const known = Object.keys(preset.tokens).join(", ") || "(none built in)";
-          throw new (0, _chunkDCOUJZPLcjs.UnknownTokenError)(
+          throw new (0, _chunk57V5DNJTcjs.UnknownTokenError)(
             `token "${token}" isn't built in for Algorand (known: ${known}). Pass { assetId, decimals } for a custom ASA, or use 'native'.`
           );
         }
         return { asset: algorandAssetId(info.assetId), decimals: info.decimals, symbol: info.symbol };
       }
-      _chunkDCOUJZPLcjs.rejectForeignToken.call(void 0, token, "algorand", network);
+      _chunk57V5DNJTcjs.rejectForeignToken.call(void 0, token, "algorand", network);
       const t = token;
       if (typeof t.assetId !== "number" || typeof t.decimals !== "number") {
-        throw new (0, _chunkDCOUJZPLcjs.WrongFamilyError)(
+        throw new (0, _chunk57V5DNJTcjs.WrongFamilyError)(
           `chain ${network} is Algorand; a custom token must be { assetId, decimals }.`
         );
       }
@@ -501,12 +502,12 @@ function makeAlgorandNetwork(preset, algodUrl) {
     },
     assertValidPayTo(payTo) {
       if (payTo.startsWith("0x")) {
-        throw new (0, _chunkDCOUJZPLcjs.WrongFamilyError)(
+        throw new (0, _chunk57V5DNJTcjs.WrongFamilyError)(
           `chain ${network} is Algorand, but payTo "${payTo}" looks like an EVM address.`
         );
       }
       if (!_algosdk2.default.isValidAddress(payTo)) {
-        throw new (0, _chunkDCOUJZPLcjs.WrongFamilyError)(
+        throw new (0, _chunk57V5DNJTcjs.WrongFamilyError)(
           `chain ${network} is Algorand, but payTo "${payTo}" is not a valid Algorand address.`
         );
       }
@@ -523,14 +524,14 @@ function makeAlgorandNetwork(preset, algodUrl) {
         const info = await _algosdk2.default.waitForConfirmation(algod, ref, 10);
         return { height: String(_nullishCoalesce(info.confirmedRound, () => ( 0))) };
       } catch (err) {
-        throw new (0, _chunkDCOUJZPLcjs.ConfirmationTimeoutError)(`Algorand tx ${ref} did not confirm in time.`, {
+        throw new (0, _chunk57V5DNJTcjs.ConfirmationTimeoutError)(`Algorand tx ${ref} did not confirm in time.`, {
           cause: err
         });
       }
     },
     async estimateCost(accept) {
       if (accept.scheme === "exact") {
-        return _chunkDCOUJZPLcjs.nativeCost.call(void 0, {
+        return _chunk57V5DNJTcjs.nativeCost.call(void 0, {
           symbol: ALGO_SYMBOL,
           decimals: ALGO_DECIMALS,
           fee: 0n,
@@ -538,7 +539,7 @@ function makeAlgorandNetwork(preset, algodUrl) {
           detail: "gasless \u2014 the fee payer (facilitator/relayer) pools the group fee; the buyer pays 0 ALGO"
         });
       }
-      return _chunkDCOUJZPLcjs.nativeCost.call(void 0, {
+      return _chunk57V5DNJTcjs.nativeCost.call(void 0, {
         symbol: ALGO_SYMBOL,
         decimals: ALGO_DECIMALS,
         fee: 1000n,

package/dist/{algorand-TQCYK2XT.js → algorand-RM7MP4PK.js}

@@ -10,7 +10,7 @@ import {
   nativeCost,
   rejectForeignToken,
   toInsufficientFundsError
-} from "./chunk-O32N6MFN.js";
+} from "./chunk-NUPCFNC5.js";
 
 // src/drivers/algorand/index.ts
 import algosdk3 from "algosdk";
@@ -304,21 +304,22 @@ async function verifyAlgorand(params) {
   const wantAssetId = parseAlgorandAssetId(accept.asset);
   let txs;
   try {
-    txs = await reader.transactionsForAccount(accept.payTo, 50);
+    txs = await reader.transactionsForAccount(accept.payTo, 200);
   } catch {
     return rpcFailed(nonce);
   }
   const tx = txs.find((t) => typeof t.note === "string" && t.note === nonce);
   if (!tx) return notFound(nonce);
-  if (typeof tx.roundTime === "number") {
-    const ageSeconds = Math.floor(Date.now() / 1e3) - tx.roundTime;
-    if (Number.isFinite(ageSeconds) && ageSeconds > accept.maxTimeoutSeconds) {
-      return {
-        ok: false,
-        error: "payment_expired",
-        detail: `Payment is ${ageSeconds}s old; max allowed is ${accept.maxTimeoutSeconds}s.`
-      };
-    }
+  if (!Number.isFinite(tx.roundTime)) {
+    return { ok: false, error: "payment_expired", detail: `Cannot bound the age of Algorand tx ${tx.id} (no/invalid round-time) \u2014 failing closed.` };
+  }
+  const ageSeconds = Math.floor(Date.now() / 1e3) - tx.roundTime;
+  if (!Number.isFinite(ageSeconds) || ageSeconds > accept.maxTimeoutSeconds) {
+    return {
+      ok: false,
+      error: "payment_expired",
+      detail: `Payment is ${ageSeconds}s old; max allowed is ${accept.maxTimeoutSeconds}s.`
+    };
   }
   const isNative = wantAssetId === null;
   const typeOk = isNative ? tx.txType === "pay" : tx.txType === "axfer";

package/dist/{aptos-RYQOSFBQ.js → aptos-2FIRTMQX.js}

@@ -9,7 +9,7 @@ import {
   nativeCost,
   rejectForeignToken,
   toInsufficientFundsError
-} from "./chunk-O32N6MFN.js";
+} from "./chunk-NUPCFNC5.js";
 
 // src/drivers/aptos/index.ts
 import { Aptos, AptosConfig, Network, AccountAddress as AccountAddress2 } from "@aptos-labs/ts-sdk";
@@ -312,15 +312,16 @@ async function verifyAptos(params) {
   if (!tx.success) {
     return { ok: false, error: "tx_reverted", detail: `Aptos tx ${hash} did not succeed.` };
   }
-  if (typeof tx.timestampSeconds === "number") {
-    const ageSeconds = Math.floor(Date.now() / 1e3) - tx.timestampSeconds;
-    if (ageSeconds > accept.maxTimeoutSeconds) {
-      return {
-        ok: false,
-        error: "payment_expired",
-        detail: `Payment is ${ageSeconds}s old; max allowed is ${accept.maxTimeoutSeconds}s.`
-      };
-    }
+  if (!Number.isFinite(tx.timestampSeconds)) {
+    return { ok: false, error: "payment_expired", detail: `Cannot bound the age of Aptos tx ${hash} (no/invalid timestamp) \u2014 failing closed.` };
+  }
+  const ageSeconds = Math.floor(Date.now() / 1e3) - tx.timestampSeconds;
+  if (!Number.isFinite(ageSeconds) || ageSeconds > accept.maxTimeoutSeconds) {
+    return {
+      ok: false,
+      error: "payment_expired",
+      detail: `Payment is ${ageSeconds}s old; max allowed is ${accept.maxTimeoutSeconds}s.`
+    };
   }
   let wantStore;
   try {