@piprail/sdk 2.15.0 → 2.16.0

package/CHANGELOG.md

@@ -4,6 +4,264 @@ All notable changes to `@piprail/sdk` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 versions follow [Semantic Versioning](https://semver.org/).
 
+## [2.16.0] — 2026-09-06 — the XRP Ledger `exact` buyer, and paying the 91% of the x402 web we could not
+
+### Added — the XRP Ledger `exact` buyer (stage 04, first family)
+
+- **A PipRail agent can now pay a standard x402 `exact` rail on the XRP Ledger** — 1,732 live rails,
+  and as far as we can tell the only open-source buyer on that chain. `drivers/xrpl/exact.ts`
+  implements `scheme_exact_xrpl.md` in both directions: the buyer signs a complete `Payment` and
+  broadcasts nothing; the gate decodes the blob, re-derives every checked field from its own trusted
+  accept, submits, and waits for a validated `tesSUCCESS`.
+
+  XRPL is the family where **the payer pays the fee** (it is a field inside the signed transaction),
+  so there is no sponsor, no co-signature, and no fee-drain guard. The scheme replaces those with a
+  list of MUST-NOTs the settler enforces — no `Memos`, no `Paths`, no `tfPartialPayment`, no
+  `Delegate`, never `Amount` and `DeliverMax` together — each of which is a way a hostile blob could
+  underdeliver, and each of which has a test.
+
+  The challenge binds through `InvoiceID = SHA-256(extra.invoiceId)`, **not** a memo: the scheme has
+  settlers reject `Memos`, which is exactly what PipRail's `onchain-proof` XRPL path uses for its
+  nonce. The two paths deliberately share no code.
+
+  **`extra.areFeesSponsored` is required by the scheme and absent from 100% of live rails**, so it is
+  read as *false unless present*. Requiring it would have rejected the entire deployed XRPL x402 web
+  — the third instance of that bug class this release cycle, and the reason it now has a test of its
+  own.
+
+  **Native XRP only, deliberately.** The two XRPL asset forms use different wire amount conventions
+  (native is an integer *drops* string, an issued currency is a *decimal* `value` — both verified
+  against live merchant challenges). The SDK prices and spend-caps in base units, so reading an
+  IOU's `"12"` as base units would understate a 12-RLUSD payment by 10^15 and slip it under any
+  policy cap while the buyer signed the real amount. Issued currencies are therefore dropped at
+  gather rather than mispriced; the RLUSD half waits until that decimal path is threaded through
+  quoting and the policy.
+
+- **`ResolvedNetwork.exactPayableAsset?(asset)`** — a new optional driver hook. The buyer's gather
+  used to hard-code "any recognised token is exact-payable, the native coin never is", which was
+  true until XRPL, where it is wrong in *both* directions. A driver that declares the hook is
+  authoritative for all of its assets; every other family omits it and behaves exactly as before.
+
+- **Three conformance fixes found by pointing the buyer at real merchants**, each of which made a
+  live XRPL rail unpayable on its own:
+  - `describeAsset` and `recipientReady` only knew the native coin as `'native'`. The XRPL x402 web
+    writes it `'XRP'` — all 863 native rails do. The first miss dropped every rail at gather ("no
+    compatible accept" on a chain we fully support); the second then demanded a **trustline** for a
+    coin that cannot have one. Both now go through one `isXrpNative()` predicate.
+  - `LastLedgerSequence` was a fixed 20-ledger window. The settler checks it is "within policy
+    window", and the merchant's policy is what `maxTimeoutSeconds` announces — so a rail offering
+    60s was getting an ~80s blob, one that outlives the merchant's own quote. Now derived, clamped.
+  - `Flags` was hard-set to `0`. `tfPartialPayment` is a different bit, so zero was never needed to
+    exclude it — but it made our transactions the only ones on the ledger without
+    `tfFullyCanonicalSig`. Now set, matching what every other XRPL client sends.
+- `extra.sourceTag` is mirrored into the transaction's `SourceTag`. Not in the scheme's `extra`
+  table, but present on **1,728 of the 1,732** live rails — it is how deployed vendors correlate a
+  payment back to their own quote.
+- Live-proven on mainnet: settle tx
+  `F673064D2E0D982481844A769E829FD8B486EB9FB7B014F866C92F1C49770505` — 0.01 XRP through our own
+  gate on the `exact` rail, payer debited 0.010012 XRP (the amount **plus its own 12-drop fee**),
+  merchant credited 0.010000, and a genuine replay of the same signed blob refused with a 402.
+- Buyer-side errors are mapped per `ERRORS.md` §9: an unactivated payer account (XRPL reports it as
+  `actNotFound`, but on that ledger "does not exist" means "unfunded") becomes
+  `InsufficientFundsError` with the base-reserve fix in the message; an `xrpl.js` validation failure
+  at signing becomes `UnsupportedSchemeError` carrying the library's reason; any other RPC failure is
+  rethrown unchanged rather than disguised as an affordability problem. All three are tested.
+- **Not proven, and it is NOT our bug: a paid round-trip against a THIRD-PARTY XRPL merchant.**
+  Two live vendors refuse our payload with `invalid_payload` — from **their own pre-check**, before
+  their facilitator ever sees it (proven by routing a v1-shaped body past that pre-check, which then
+  returned the facilitator's own schema error: it wants exactly the `{x402Version: 2, accepted,
+  payload}` envelope we already send). The decisive test: **the same client, envelope and header pay
+  one of those same gateways successfully on its Base rail** (0.001 USDC, HTTP 200). So our envelope
+  is correct and the fault is XRPL-specific on their side. Our transaction also matches, field for
+  field, a payment that merchant has accepted from another client. Working conclusion: the deployed
+  XRPL dialect has drifted from `scheme_exact_xrpl.md` — worth raising upstream.
+  **No funds were lost across ~10 refused attempts** — every vendor rejects before settling, and the
+  ledger confirms no payment ever left the wallet.
+
+
+### Fixed — the buyer required a field the spec makes optional, and so could not pay 91% of the x402 web
+
+- **`schemes: ['exact']` clients now pay the standard x402 web: 26.3% → 98.8% of the resources
+  listed on the CDP Bazaar** (15,686 resources / 40,388 `exact` rails, measured 2026-09-06 by
+  `npm run x402:coverage`; the figures live in `scripts/x402-corpus/coverage.json`, which owns
+  them). Rail-level coverage went 9.2% → 88.9%.
+
+  The buyer's gather predicate required `extra.assetTransferMethod` on every `exact` rail. The
+  ratified scheme says the opposite — `scheme_exact_evm.md`: *"If no `assetTransferMethod` is
+  specified in `PaymentRequired.extra`, clients should default to `"eip3009"`"* — and the SVM,
+  Algorand, Aptos, NEAR and Hedera schemes never define the key at all (their required extra is
+  `feePayer`). Only **9%** of live rails carry it; **79%** carry just the EIP-712 domain. So a
+  PipRail agent silently refused every Solana rail, every Arbitrum rail and 85% of Base rails —
+  including textbook canonical-USDC EIP-3009 rails it was perfectly able to sign.
+
+  This was never a pay-path bug: the EVM driver already defaulted to EIP-3009 and re-derives the
+  token's EIP-712 domain on-chain. Only the gather refused. A rail that NAMES a method we don't
+  implement (the spec's `erc7710`) is still skipped rather than signed blind.
+
+  Found by probing seven real third-party 402s and paying none of them, while 1,636 unit tests were
+  green. The tests agreed with their own hand-built fixtures; nothing checked the fixtures against
+  the world. That gap is now closed by `sdk/test/x402-corpus.test.ts` — 62 REAL challenges captured
+  from the live index, replayed through the real client.
+
+### Fixed — the Solana buyer required `extra.decimals`, which the SVM scheme never defines
+
+- **99.3% of live Solana rails planned as payable and then threw at signing time.**
+  `payExactSolana` required `extra.decimals` for the TransferChecked and raised
+  `UnsupportedSchemeError` without it — but `scheme_exact_svm.md` doesn't define `decimals` at all
+  (its one required extra is `feePayer`), and only **41 of the 5,760** live Solana rails carry it.
+  The same "we require a field the spec makes optional" mistake as `assetTransferMethod`, one layer
+  deeper, and worse because it broke the plan-vs-pay contract: the rail gathered, `planPayment`
+  said `payable`, and the payment then failed.
+
+  The decimals now come **from the mint on-chain**, which is also the safer source — a server that
+  understated them could otherwise have the buyer sign a transfer 10^n larger than the quote, and
+  TransferChecked would accept it. A rail that states decimals disagreeing with the mint is refused;
+  `extra.decimals` survives only as a fallback if the mint read fails.
+
+  Found by paying a real Solana merchant. No unit test could have caught it — every fixture in the
+  suite carried `extra.decimals`, because our own gate always emits it.
+
+### Live-proven on mainnet (2026-09-06)
+
+Real payments to real third-party merchants, one per wire shape this release unlocks:
+
+| shape | merchant | proof |
+|---|---|---|
+| v2 · Base · domain-only (no marker) | `api.onesource.io/api/chain/block-number` | 200, 0.001 USDC, `0x44e9fed18bf9…` |
+| v2 · Base · slug network | `coil.trade/api/crypto/gate` | 200, 0.001 USDC, `0xc38e6da9cbc2…` |
+| **v1** · Base · `X-PAYMENT` wire | `x402factory.ai/base/coinprice` | 200, 0.001 USDC, `eip3009-nonce:0xb6c321fa…` |
+| v2 · Solana · `feePayer`, no marker | `hypernatt.com/api/m2m/liq-radar` | 200, 0.001 USDC, `solana-nonce:3g3Wj5G6G7D…` |
+
+Every row is a real body from a real stranger's endpoint, re-run against the FINAL build of this
+release (an earlier run on the same day proved the same four shapes).
+
+Own-gate regression, also on mainnet and also re-run on the final build: Base USDC + EURC
+round-tripped gasless via EIP-3009 — payer ETH delta **0**, merchant received, **replay rejected**
+(settle `0x85dfcc2b480f…` / `0x41fa1bdf5ea1…`); Algorand settled live with the enriched receipt and
+a rejected replay (`TBRSSLNUJGCUS6…`).
+
+### Added — x402 **v1** challenges on the buyer path
+
+- **A v1 server can now be quoted and paid.** PipRail's stated posture has always been "emit strict
+  v2, accept liberal v1 + v2", and the gate honoured it — but the buyer's `isValidChallenge`
+  hard-required `x402Version === 2`, so every v1 server was an `InvalidEnvelopeError`, and no v1
+  header emitter existed to answer one with. 251 of the 15,686 catalogued resources are v1.
+  `normalizeV1Challenge` lifts a v1 body (`maxAmountRequired`, slug network, per-accept `resource`
+  string) into the standard shape, and `buildV1PaymentHeader` frames the answer on the v1 wire.
+  Probed live: a v1 server ignores `PAYMENT-SIGNATURE` and reads only `X-PAYMENT`, so the network
+  slug is echoed back exactly as the server sent it (v1 verifiers string-compare it).
+  The slug is remembered on a synthetic `wireNetwork` field, which is **stripped from every
+  outgoing `accepted` echo** — that block is documented as the merchant's rail returned verbatim,
+  and facilitators compare (some hash) it, so a key the merchant never published must not appear
+  in it.
+
+### Added — the Algorand CAIP-2 id the spec actually uses
+
+- `scheme_exact_algo.md` gives Algorand mainnet as the base64 genesis hash **truncated to 32 chars**
+  (`algorand:wGHE2Pwdvd7S12BL5FaOP20EGYesN73k`), and the deployed web follows it — 874 live rails on
+  the spec form vs 589 on the padded 44-char id PipRail binds. Both forms are now accepted on parse.
+  What PipRail *emits* is unchanged (switching that would break deployed 2.x Algorand buyers; it is
+  queued for the next major).
+
+- **The GATE now matches an echoed network id through the same canonicalisation.** It compared
+  `accepted.network` to its own rail with `===`, so a conformant buyer that canonicalised the id
+  before echoing it — the Algorand spec form, or TON's superseded `ton:-239` — had a perfectly
+  valid payment refused. All three selector sites (`onchain-proof`, `exact`, `upto`) now compare
+  through `normalizeNetwork`. This can only widen which of the gate's OWN rails is selected: payTo,
+  amount and asset are re-derived from the gate's spec either way, so a wrong network still cannot
+  redirect a payment. The Algorand driver's `supports()` accepts both spellings directly too,
+  mirroring TON.
+
+### Added — coverage is now measured, not asserted
+
+- **`npm run x402:coverage`** (`scripts/x402-corpus/audit.mjs`) pages the live CDP Bazaar, classifies
+  every rail against the SDK's own exported predicates, and writes `scripts/x402-corpus/coverage.json`.
+  Every coverage figure in this repo cites that file. `--live` runs a real read-only `quote()` against
+  live third-party 402s (8/9 quotable, the 9th a merchant whose `upto` rail omits the spec-mandated
+  `facilitatorAddress`); `--fixture` regenerates the regression corpus.
+- `PayOption.method` reports the transfer method the buyer would actually sign, appending
+  `' (default)'` when the rail named none — so the inference is visible instead of implicit.
+- New exports: `exactTransferMethod`, `isSettleableExactMethod`, `KNOWN_EXACT_TRANSFER_METHODS`,
+  `DEFAULT_EXACT_TRANSFER_METHOD`, `normalizeV1Challenge`, `buildV1PaymentHeader`.
+
+### Changed — types now admit what the wire allows
+
+- `X402ExactAcceptEntry.extra` and `extra.assetTransferMethod` are **optional**. A conformant rail may
+  ship `extra: {}` or omit the block entirely, and the type said otherwise, which is how a
+  bare-`extra` deref came to look like a real hazard. Every read on the buyer path optional-chains.
+  Defaults are unchanged: `schemes` still defaults to `['onchain-proof']`, so a zero-config client
+  behaves byte-identically.
+
+## [2.15.1] — 2026-08-28 — a dead Sui RPC, an RPC failure blamed on the token, and fuzz hardening
+
+### Fixed — Sui's shipped default RPC was dead (whole-chain outage)
+
+- **`chain: 'sui'` with no `rpcUrl` was 100% non-functional.** The preset shipped
+  `https://fullnode.mainnet.sui.io:443`, and Mysten has since **turned JSON-RPC off** on the
+  official public fullnodes — *every* method now answers `-32601 Method not found. JSON-RPC on
+  public fullnodes has been deprecated`, pointing at gRPC/GraphQL. Since `pay`, `verify`,
+  `balanceOf` and `recipientReady` all read through `SuiJsonRpcClient`, nothing on Sui worked
+  unless the caller passed their own endpoint. The default is now
+  `https://sui-rpc.publicnode.com`, verified for `suix_getBalance`, `suix_getCoinMetadata`,
+  `suix_getOwnedObjects` and `sui_getTransactionBlock`.
+  No unit test could catch this — they all mock the reader. Caught by the live wallet sweep,
+  which reads each driver's `defaultRpc` and does a real balance read; that sweep is now a
+  stage of the SDK audit so a dead default surfaces immediately.
+
+### Fixed — the gate blamed the token when the RPC was at fault
+
+- **A transient RPC failure was reported as "this token isn't EIP-3009".** `readExactDomain`
+  fails closed to `null` on two very different causes — the token genuinely isn't EIP-3009, or
+  the on-chain read failed (unreachable, rate-limited, or an HTML error page from a proxy) —
+  and the gate asserted the first. On Base USDC, which *is* EIP-3009, an unreachable RPC
+  produced `this token isn't EIP-3009 (auto-selected Permit2)`: the merchant's gasless rail
+  silently downgraded to `onchain-proof` (buyers start paying gas) and they were told to change
+  the one thing that was correct. The buyer side already retried once and named both causes;
+  the gate now does the same — a single 300 ms retry on the domain read, and a skip reason that
+  states both possibilities and how to tell them apart. Behaviour on a healthy RPC is unchanged.
+
+
+### Fixed — hardening found by a new adversarial fuzz sweep
+
+`test/fuzz-payment-paths.test.ts` generates thousands of hostile inputs per run against the
+paths that decide "was I actually paid?", seeded so a failure reproduces exactly
+(`FUZZ_SEED=<n>`). It found three things, all fixed here. No API changed; every existing
+call keeps its behaviour.
+
+- **A spent proof could be re-redeemed by padding its reference with whitespace.** The
+  gate's single-use key was case-folded (EVM hashes are case-insensitive hex) but not
+  trimmed, so ` 0xabc…`, `0xabc… ` and `\t0xabc…\n` each hashed to a *different* key than
+  `0xabc…` and unlocked the resource a second time for one payment. The ref is now
+  canonicalised at the boundary, before the claim and before the driver sees it, so the
+  built-in store **and** a caller's custom `isUsed`/`markUsed` both receive one identical
+  value. Reaching this on a live EVM gate needed an RPC that accepts a padded hash — a real
+  one rejects it — so this was defence-in-depth rather than a known live exploit; the point
+  is that at-most-once no longer depends on how strict somebody else's RPC happens to be.
+  Six regression cases in `test/server-replay.test.ts`.
+- **`parseUnits` threw a bare `Error`** on the single most likely amount mistake there is —
+  pricing at more decimal places than the token has — while its two other rejection branches
+  threw `InvalidConfigError`. A caller branching on `err instanceof PipRailError`
+  (ERRORS.md §1) missed exactly that case. Now typed, as is the malformed-amount branch of
+  `floorUnits`.
+- **The header builders threw a raw `TypeError`** when handed a value `JSON.stringify`
+  cannot serialise — a `BigInt` most obviously, and amounts are `bigint` everywhere *inside*
+  the SDK, so passing one out is a natural slip. `buildSignatureHeader`,
+  `buildExactSignatureHeader` and their siblings now throw `InvalidConfigError` with a
+  message that names the fix.
+
+### Changed — facilitator registry hygiene
+
+- **Two dead facilitators removed** (see 2.14.2): the docs, the website data and a live
+  example probe were still advertising them after the registry was corrected. A new
+  cross-surface guard (`test/facilitators-surface.test.ts`) now holds all of them to
+  `KNOWN_FACILITATORS` — a dead host may appear only inside an explanation of its removal,
+  the docs' copy-paste URL list is set-compared against the registry, and the website's
+  generated data must match the registry's networks **and URL order** (that order is what
+  `firstKeylessFacilitator` returns).
+- All **25** settlement hashes recorded in the registry's notes were re-verified on-chain on
+  2026-08-28 — 25/25 present and successful, 0 refuted — by
+  `.claude/skills/facilitator-probe/scripts/verify-tx.mjs`.
+
 ## [2.15.0] — 2026-06-24 — merchant on-ramp: presets, adapters, `gate.selfTest()`
 
 ### Added — merchant on-ramp (presets, adapters, self-test)
@@ -1852,6 +2110,8 @@ straight into your wallet. The API is small and self-contained.
   to your wallet; PipRail never holds funds.
 - `viem ^2.21` is a peer dependency. Node 20+ or a modern browser.
 
+[2.16.0]: https://www.npmjs.com/package/@piprail/sdk
+[2.15.1]: https://www.npmjs.com/package/@piprail/sdk
 [2.15.0]: https://www.npmjs.com/package/@piprail/sdk
 [2.14.0]: https://www.npmjs.com/package/@piprail/sdk
 [2.13.1]: https://www.npmjs.com/package/@piprail/sdk

package/README.md

@@ -2,7 +2,7 @@
 
 **Accept and make [x402](https://x402.org) crypto payments — on any EVM chain plus Solana, TON, Tron, NEAR, Sui, Aptos, Algorand, Stellar & the XRP Ledger — in a couple of lines.**
 
-No middleman, no database, no fee, no account. Payments settle **straight into your wallet**, verified locally against your own RPC. Gate a route to make it paid-only; point an agent at a paid URL and it pays itself.
+No middleman, no database, no fee, no account, no API key. Payments settle **straight into your wallet**, verified locally against your own RPC. Gate a route to make it paid-only; point an agent at a paid URL and it pays itself.
 
 ```bash
 npm install @piprail/sdk viem
@@ -26,7 +26,7 @@ app.get('/report',
 
 That route now costs **0.05 USDC on Base**, paid straight to your wallet. One parameter picks the chain. Add `onPaid` / `onFailed` to be notified the moment a payment settles or is rejected — both carry the same reason, and the buyer's client is notified too. → [Accepting payments](https://docs.piprail.com/accepting-payments/require-payment-and-gate/)
 
-> **Don't want to wire it by hand?** `npm create piprail@latest` scaffolds a complete, mainnet-ready, deployable merchant (node / Cloudflare / Vercel) — paste a public address, no key, no account. → [Scaffold a merchant](https://docs.piprail.com/getting-started/scaffolder/)
+> **Don't want to wire it by hand?** `npm create @piprail` scaffolds a complete, mainnet-ready, deployable merchant (node / Cloudflare / Vercel) — paste a public address, no key, no account. → [Scaffold a merchant](https://docs.piprail.com/getting-started/scaffolder/)
 
 ## Let an agent pay for it
 

package/dist/{algorand-CSEUTWNW.js → algorand-25FMBCT3.js}

@@ -1,3 +1,6 @@
+import {
+  ALGORAND_SPEC_CAIP2
+} from "./chunk-2CX7XRZK.js";
 import {
   ConfirmationTimeoutError,
   InsufficientFundsError,
@@ -10,7 +13,7 @@ import {
   nativeCost,
   rejectForeignToken,
   toInsufficientFundsError
-} from "./chunk-3ZWM3DKM.js";
+} from "./chunk-QU25LSVS.js";
 
 // src/drivers/algorand/index.ts
 import algosdk3 from "algosdk";
@@ -110,7 +113,7 @@ async function payExactAlgorand(input) {
       "Algorand exact is ASA-only (an asset transfer); native ALGO is not exact-payable. Pay via onchain-proof."
     );
   }
-  const feePayer = accept.extra.feePayer;
+  const feePayer = accept.extra?.feePayer;
   if (!feePayer) {
     throw new UnsupportedSchemeError("Algorand exact rail must advertise extra.feePayer (the fee sponsor address).");
   }
@@ -171,7 +174,7 @@ function decodeElement(bytes) {
 }
 async function verifyAndSettleExactAlgorand(input) {
   const { client, feePayerSk, feePayerAddr, payload, accept } = input;
-  const railFeePayer = accept.extra.feePayer;
+  const railFeePayer = accept.extra?.feePayer;
   if (!railFeePayer) throw new SettlementError("Algorand exact: rail is missing extra.feePayer.");
   if (railFeePayer !== feePayerAddr) {
     throw new SettlementError("Algorand exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
@@ -463,7 +466,13 @@ function makeAlgorandNetwork(preset, algodUrl) {
   return {
     family: "algorand",
     network,
-    supports: (n) => n === network,
+    // Accept our padded 44-char genesis-hash id AND the spec's 32-char truncated form
+    // (`scheme_exact_algo.md`'s Network Identifiers table — the form 874 of the 1,463 live
+    // Algorand rails use), so a caller that bypasses `normalizeNetwork` and hands the raw
+    // spec id to the driver still matches. Mirrors TON's legacy-id tolerance; the
+    // normalizeNetwork alias remains the canonical seam. We still EMIT the padded form —
+    // changing that would break every deployed PipRail 2.x buyer, so it waits for a major.
+    supports: (n) => n === network || n === ALGORAND_SPEC_CAIP2,
     resolveToken(token) {
       if (token === "native") {
         return { asset: "native", decimals: ALGO_DECIMALS, symbol: ALGO_SYMBOL };

package/dist/{algorand-I2O24RSM.cjs → algorand-Q3TUQLPK.cjs}

@@ -1,5 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
+var _chunkV2IJ5HUWcjs = require('./chunk-V2IJ5HUW.cjs');
 
 
 
@@ -10,7 +11,9 @@
 
 
 
-var _chunk3FR22M3Ocjs = require('./chunk-3FR22M3O.cjs');
+
+
+var _chunkQONQSZHJcjs = require('./chunk-QONQSZHJ.cjs');
 
 // src/drivers/algorand/index.ts
 var _algosdk = require('algosdk'); var _algosdk2 = _interopRequireDefault(_algosdk);
@@ -58,13 +61,13 @@ async function payAlgorand(params) {
   } catch (err) {
     const mapped = mapAlgorandError(err, accept.payTo);
     if (mapped) throw mapped;
-    throw _nullishCoalesce(_chunk3FR22M3Ocjs.toInsufficientFundsError.call(void 0, err), () => ( err));
+    throw _nullishCoalesce(_chunkQONQSZHJcjs.toInsufficientFundsError.call(void 0, err), () => ( err));
   }
 }
 function mapAlgorandError(err, payTo) {
   const m = err instanceof Error ? err.message : String(err);
   if (/must optin/i.test(m) || /missing from/i.test(m) && m.includes(payTo)) {
-    return new (0, _chunk3FR22M3Ocjs.RecipientNotReadyError)(
+    return new (0, _chunkQONQSZHJcjs.RecipientNotReadyError)(
       `Algorand recipient ${payTo} hasn't opted into this asset \u2014 it must opt in (a 0-amount asset transfer to itself) before it can receive. (Algorand: ${firstLine(m)})`,
       { cause: err }
     );
@@ -72,7 +75,7 @@ function mapAlgorandError(err, payTo) {
   if (/overspend|below min|min(imum)? balance|tried to spend|balance \d+ below|asset \d+ missing from|insufficient|underflow/i.test(
     m
   )) {
-    return new (0, _chunk3FR22M3Ocjs.InsufficientFundsError)(
+    return new (0, _chunkQONQSZHJcjs.InsufficientFundsError)(
       `Algorand payment failed: the sender can't cover it \u2014 token balance, ALGO for fees, the 0.1-ALGO minimum balance, or a missing asset opt-in on the sender. (Algorand: ${firstLine(m)})`,
       { cause: err }
     );
@@ -99,33 +102,33 @@ function isSet(addr) {
 function randomNote() {
   const g = globalThis.crypto;
   if (!_optionalChain([g, 'optionalAccess', _ => _.getRandomValues])) {
-    throw new (0, _chunk3FR22M3Ocjs.UnsupportedSchemeError)("Algorand exact: no Web Crypto CSPRNG available to generate a unique note.");
+    throw new (0, _chunkQONQSZHJcjs.UnsupportedSchemeError)("Algorand exact: no Web Crypto CSPRNG available to generate a unique note.");
   }
   return g.getRandomValues(new Uint8Array(32));
 }
 async function payExactAlgorand(input) {
   const { suggestedParams, sk, sender, accept } = input;
   if (accept.asset === "native") {
-    throw new (0, _chunk3FR22M3Ocjs.UnsupportedSchemeError)(
+    throw new (0, _chunkQONQSZHJcjs.UnsupportedSchemeError)(
       "Algorand exact is ASA-only (an asset transfer); native ALGO is not exact-payable. Pay via onchain-proof."
     );
   }
-  const feePayer = accept.extra.feePayer;
+  const feePayer = _optionalChain([accept, 'access', _2 => _2.extra, 'optionalAccess', _3 => _3.feePayer]);
   if (!feePayer) {
-    throw new (0, _chunk3FR22M3Ocjs.UnsupportedSchemeError)("Algorand exact rail must advertise extra.feePayer (the fee sponsor address).");
+    throw new (0, _chunkQONQSZHJcjs.UnsupportedSchemeError)("Algorand exact rail must advertise extra.feePayer (the fee sponsor address).");
   }
   const assetId = parseAlgorandAssetId(accept.asset);
   if (assetId === null) {
-    throw new (0, _chunk3FR22M3Ocjs.UnsupportedSchemeError)(`Algorand exact rail asset "${accept.asset}" must be a numeric ASA id.`);
+    throw new (0, _chunkQONQSZHJcjs.UnsupportedSchemeError)(`Algorand exact rail asset "${accept.asset}" must be a numeric ASA id.`);
   }
   if (!_algosdk2.default.isValidAddress(feePayer)) {
-    throw new (0, _chunk3FR22M3Ocjs.UnsupportedSchemeError)(`Algorand exact: extra.feePayer "${feePayer}" is not a valid Algorand address.`);
+    throw new (0, _chunkQONQSZHJcjs.UnsupportedSchemeError)(`Algorand exact: extra.feePayer "${feePayer}" is not a valid Algorand address.`);
   }
   if (!_algosdk2.default.isValidAddress(accept.payTo)) {
-    throw new (0, _chunk3FR22M3Ocjs.UnsupportedSchemeError)(`Algorand exact: payTo "${accept.payTo}" is not a valid Algorand address.`);
+    throw new (0, _chunkQONQSZHJcjs.UnsupportedSchemeError)(`Algorand exact: payTo "${accept.payTo}" is not a valid Algorand address.`);
   }
   if (feePayer === sender) {
-    throw new (0, _chunk3FR22M3Ocjs.UnsupportedSchemeError)(
+    throw new (0, _chunkQONQSZHJcjs.UnsupportedSchemeError)(
       "Algorand exact: the fee payer must differ from the payer \u2014 the buyer must pay ZERO ALGO (the sponsor pays the pooled fee)."
     );
   }
@@ -171,14 +174,14 @@ function decodeElement(bytes) {
 }
 async function verifyAndSettleExactAlgorand(input) {
   const { client, feePayerSk, feePayerAddr, payload, accept } = input;
-  const railFeePayer = accept.extra.feePayer;
-  if (!railFeePayer) throw new (0, _chunk3FR22M3Ocjs.SettlementError)("Algorand exact: rail is missing extra.feePayer.");
+  const railFeePayer = _optionalChain([accept, 'access', _4 => _4.extra, 'optionalAccess', _5 => _5.feePayer]);
+  if (!railFeePayer) throw new (0, _chunkQONQSZHJcjs.SettlementError)("Algorand exact: rail is missing extra.feePayer.");
   if (railFeePayer !== feePayerAddr) {
-    throw new (0, _chunk3FR22M3Ocjs.SettlementError)("Algorand exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
+    throw new (0, _chunkQONQSZHJcjs.SettlementError)("Algorand exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
   }
   const assetId = parseAlgorandAssetId(accept.asset);
-  if (assetId === null) throw new (0, _chunk3FR22M3Ocjs.SettlementError)(`Algorand exact: rail asset "${accept.asset}" is not a numeric ASA id.`);
-  if (!_algosdk2.default.isValidAddress(accept.payTo)) throw new (0, _chunk3FR22M3Ocjs.SettlementError)(`Algorand exact: rail payTo "${accept.payTo}" is invalid.`);
+  if (assetId === null) throw new (0, _chunkQONQSZHJcjs.SettlementError)(`Algorand exact: rail asset "${accept.asset}" is not a numeric ASA id.`);
+  if (!_algosdk2.default.isValidAddress(accept.payTo)) throw new (0, _chunkQONQSZHJcjs.SettlementError)(`Algorand exact: rail payTo "${accept.payTo}" is invalid.`);
   const { paymentIndex, paymentGroup } = payload;
   if (paymentGroup.length !== GROUP_SIZE) {
     return fail("signature_invalid", `Algorand exact expects a ${GROUP_SIZE}-transaction group (payment + fee), got ${paymentGroup.length}.`);
@@ -206,7 +209,7 @@ async function verifyAndSettleExactAlgorand(input) {
     return fail("transfer_not_found", `Transfer asset id ${at.assetIndex} \u2260 rail asset ${assetId}.`);
   }
   if (!addrEq(at.receiver, accept.payTo)) {
-    return fail("wrong_recipient", `Transfer pays ${_optionalChain([at, 'access', _2 => _2.receiver, 'optionalAccess', _3 => _3.toString, 'call', _4 => _4()])}, not payTo ${accept.payTo}.`);
+    return fail("wrong_recipient", `Transfer pays ${_optionalChain([at, 'access', _6 => _6.receiver, 'optionalAccess', _7 => _7.toString, 'call', _8 => _8()])}, not payTo ${accept.payTo}.`);
   }
   if (BigInt(at.amount) < BigInt(accept.amount)) {
     return fail("amount_too_low", `Transfer pays ${at.amount} of the ASA, required ${accept.amount}.`);
@@ -221,7 +224,7 @@ async function verifyAndSettleExactAlgorand(input) {
     return fail("signature_invalid", "The fee transaction must be a payment (pay) transaction.");
   }
   if (!addrEq(fee.sender, railFeePayer)) {
-    return fail("signature_invalid", `The fee transaction sender ${_optionalChain([fee, 'access', _5 => _5.sender, 'optionalAccess', _6 => _6.toString, 'call', _7 => _7()])} is not the rail fee payer ${railFeePayer}.`);
+    return fail("signature_invalid", `The fee transaction sender ${_optionalChain([fee, 'access', _9 => _9.sender, 'optionalAccess', _10 => _10.toString, 'call', _11 => _11()])} is not the rail fee payer ${railFeePayer}.`);
   }
   if (BigInt(fee.payment.amount) !== 0n) {
     return fail("signature_invalid", "The fee transaction must move 0 ALGO (it only pools the group fee).");
@@ -244,7 +247,7 @@ async function verifyAndSettleExactAlgorand(input) {
   try {
     feeSigned = fee.signTxn(feePayerSk);
   } catch (err) {
-    throw new (0, _chunk3FR22M3Ocjs.SettlementError)(`Algorand exact settle: the gate could not sign the fee transaction (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
+    throw new (0, _chunkQONQSZHJcjs.SettlementError)(`Algorand exact settle: the gate could not sign the fee transaction (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
   }
   const signedGroup = elements.map((el, i) => i === paymentIndex ? payElement.raw : feeSigned);
   try {
@@ -266,7 +269,7 @@ async function verifyAndSettleExactAlgorand(input) {
     if (/signature|sig|auth|malformed/i.test(m)) return fail("signature_invalid", `Settle rejected \u2014 bad signature: ${shorten(m)}.`);
     if (/already in ledger|already committed|duplicate/i.test(m)) return fail("tx_already_used", `This payment was already settled: ${shorten(m)}.`);
     if (/\bround\b|expired|lifetime|stale|validity/i.test(m)) return fail("payment_expired", `Settle rejected \u2014 validity window expired: ${shorten(m)}.`);
-    throw new (0, _chunk3FR22M3Ocjs.SettlementError)(
+    throw new (0, _chunkQONQSZHJcjs.SettlementError)(
       `Algorand exact settle: the group failed to submit (${shorten(m)}). The buyer's signed transaction is still valid \u2014 fund/fix the fee payer (${railFeePayer}) and the buyer can re-present it.`,
       { cause: err }
     );
@@ -275,10 +278,10 @@ async function verifyAndSettleExactAlgorand(input) {
   try {
     round = await client.waitForConfirmation(buyerTxid);
   } catch (err) {
-    throw new (0, _chunk3FR22M3Ocjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
+    throw new (0, _chunkQONQSZHJcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
   }
   if (round === null) {
-    throw new (0, _chunk3FR22M3Ocjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
+    throw new (0, _chunkQONQSZHJcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
   }
   return {
     ok: true,
@@ -374,13 +377,13 @@ function rpcFailed(nonce) {
 
 function assertAlgorandWallet(wallet, network) {
   if (typeof wallet !== "object" || wallet === null) {
-    throw new (0, _chunk3FR22M3Ocjs.WrongFamilyError)(
+    throw new (0, _chunkQONQSZHJcjs.WrongFamilyError)(
       `chain ${network} is Algorand; wallet must be { key } (25-word mnemonic) or { account }.`
     );
   }
-  _chunk3FR22M3Ocjs.assertNoLegacyWalletKey.call(void 0, wallet, "Algorand");
+  _chunkQONQSZHJcjs.assertNoLegacyWalletKey.call(void 0, wallet, "Algorand");
   if (!("key" in wallet) && !("account" in wallet)) {
-    throw new (0, _chunk3FR22M3Ocjs.WrongFamilyError)(
+    throw new (0, _chunkQONQSZHJcjs.WrongFamilyError)(
       `chain ${network} is Algorand; wallet must be { key } (25-word mnemonic) or { account }.`
     );
   }
@@ -395,13 +398,13 @@ function resolveAlgorandWallet(config) {
       const { addr, sk } = _algosdk2.default.mnemonicToSecretKey(config.key);
       return { addr: addr.toString(), sk };
     } catch (cause) {
-      throw new (0, _chunk3FR22M3Ocjs.WrongFamilyError)(
+      throw new (0, _chunkQONQSZHJcjs.WrongFamilyError)(
         "Algorand wallet { key } is not a valid 25-word Algorand mnemonic.",
         { cause }
       );
     }
   }
-  throw new (0, _chunk3FR22M3Ocjs.WrongFamilyError)("Algorand wallet needs { key } (25-word mnemonic) or { account }.");
+  throw new (0, _chunkQONQSZHJcjs.WrongFamilyError)("Algorand wallet needs { key } (25-word mnemonic) or { account }.");
 }
 
 // src/drivers/algorand/index.ts
@@ -447,12 +450,12 @@ function makeAlgorandNetwork(preset, algodUrl) {
   const settleClient = {
     async simulate(signedGroup) {
       const resp = await algod.simulateRawTransactions(signedGroup).do();
-      const fm = _optionalChain([resp, 'optionalAccess', _8 => _8.txnGroups, 'optionalAccess', _9 => _9[0], 'optionalAccess', _10 => _10.failureMessage]);
+      const fm = _optionalChain([resp, 'optionalAccess', _12 => _12.txnGroups, 'optionalAccess', _13 => _13[0], 'optionalAccess', _14 => _14.failureMessage]);
       return { failureMessage: fm && fm.length > 0 ? fm : null };
     },
     async submit(signedGroup) {
       const res = await algod.sendRawTransaction(signedGroup).do();
-      return _nullishCoalesce(_optionalChain([res, 'optionalAccess', _11 => _11.txid]), () => ( ""));
+      return _nullishCoalesce(_optionalChain([res, 'optionalAccess', _15 => _15.txid]), () => ( ""));
     },
     async waitForConfirmation(txid) {
       const info = await _algosdk2.default.waitForConfirmation(algod, txid, 10);
@@ -463,7 +466,13 @@ function makeAlgorandNetwork(preset, algodUrl) {
   return {
     family: "algorand",
     network,
-    supports: (n) => n === network,
+    // Accept our padded 44-char genesis-hash id AND the spec's 32-char truncated form
+    // (`scheme_exact_algo.md`'s Network Identifiers table — the form 874 of the 1,463 live
+    // Algorand rails use), so a caller that bypasses `normalizeNetwork` and hands the raw
+    // spec id to the driver still matches. Mirrors TON's legacy-id tolerance; the
+    // normalizeNetwork alias remains the canonical seam. We still EMIT the padded form —
+    // changing that would break every deployed PipRail 2.x buyer, so it waits for a major.
+    supports: (n) => n === network || n === _chunkV2IJ5HUWcjs.ALGORAND_SPEC_CAIP2,
     resolveToken(token) {
       if (token === "native") {
         return { asset: "native", decimals: ALGO_DECIMALS, symbol: ALGO_SYMBOL };
@@ -472,16 +481,16 @@ function makeAlgorandNetwork(preset, algodUrl) {
         const info = preset.tokens[token.toUpperCase()];
         if (!info) {
           const known = Object.keys(preset.tokens).join(", ") || "(none built in)";
-          throw new (0, _chunk3FR22M3Ocjs.UnknownTokenError)(
+          throw new (0, _chunkQONQSZHJcjs.UnknownTokenError)(
             `token "${token}" isn't built in for Algorand (known: ${known}). Pass { assetId, decimals } for a custom ASA, or use 'native'.`
           );
         }
         return { asset: algorandAssetId(info.assetId), decimals: info.decimals, symbol: info.symbol };
       }
-      _chunk3FR22M3Ocjs.rejectForeignToken.call(void 0, token, "algorand", network);
+      _chunkQONQSZHJcjs.rejectForeignToken.call(void 0, token, "algorand", network);
       const t = token;
       if (typeof t.assetId !== "number" || typeof t.decimals !== "number") {
-        throw new (0, _chunk3FR22M3Ocjs.WrongFamilyError)(
+        throw new (0, _chunkQONQSZHJcjs.WrongFamilyError)(
           `chain ${network} is Algorand; a custom token must be { assetId, decimals }.`
         );
       }
@@ -502,12 +511,12 @@ function makeAlgorandNetwork(preset, algodUrl) {
     },
     assertValidPayTo(payTo) {
       if (payTo.startsWith("0x")) {
-        throw new (0, _chunk3FR22M3Ocjs.WrongFamilyError)(
+        throw new (0, _chunkQONQSZHJcjs.WrongFamilyError)(
           `chain ${network} is Algorand, but payTo "${payTo}" looks like an EVM address.`
         );
       }
       if (!_algosdk2.default.isValidAddress(payTo)) {
-        throw new (0, _chunk3FR22M3Ocjs.WrongFamilyError)(
+        throw new (0, _chunkQONQSZHJcjs.WrongFamilyError)(
           `chain ${network} is Algorand, but payTo "${payTo}" is not a valid Algorand address.`
         );
       }
@@ -524,14 +533,14 @@ function makeAlgorandNetwork(preset, algodUrl) {
         const info = await _algosdk2.default.waitForConfirmation(algod, ref, 10);
         return { height: String(_nullishCoalesce(info.confirmedRound, () => ( 0))) };
       } catch (err) {
-        throw new (0, _chunk3FR22M3Ocjs.ConfirmationTimeoutError)(`Algorand tx ${ref} did not confirm in time.`, {
+        throw new (0, _chunkQONQSZHJcjs.ConfirmationTimeoutError)(`Algorand tx ${ref} did not confirm in time.`, {
           cause: err
         });
       }
     },
     async estimateCost(accept) {
       if (accept.scheme === "exact") {
-        return _chunk3FR22M3Ocjs.nativeCost.call(void 0, {
+        return _chunkQONQSZHJcjs.nativeCost.call(void 0, {
           symbol: ALGO_SYMBOL,
           decimals: ALGO_DECIMALS,
           fee: 0n,
@@ -539,7 +548,7 @@ function makeAlgorandNetwork(preset, algodUrl) {
           detail: "gasless \u2014 the fee payer (facilitator/relayer) pools the group fee; the buyer pays 0 ALGO"
         });
       }
-      return _chunk3FR22M3Ocjs.nativeCost.call(void 0, {
+      return _chunkQONQSZHJcjs.nativeCost.call(void 0, {
         symbol: ALGO_SYMBOL,
         decimals: ALGO_DECIMALS,
         fee: 1000n,
@@ -575,7 +584,7 @@ function makeAlgorandNetwork(preset, algodUrl) {
         const optedIn = (_nullishCoalesce(info.assets, () => ( []))).some((a) => Number(a.assetId) === assetId);
         return optedIn ? { ready: true } : { ready: false, reason: "NOT_OPTED_IN" };
       } catch (e) {
-        if (/does not exist|no accounts found|404|account not found/i.test(String(_nullishCoalesce(_optionalChain([e, 'optionalAccess', _12 => _12.message]), () => ( e))))) {
+        if (/does not exist|no accounts found|404|account not found/i.test(String(_nullishCoalesce(_optionalChain([e, 'optionalAccess', _16 => _16.message]), () => ( e))))) {
           return { ready: false, reason: "NOT_OPTED_IN" };
         }
         return { ready: "unknown" };