@piprail/sdk 2.8.0 → 2.10.0

package/CHANGELOG.md

@@ -4,6 +4,130 @@ All notable changes to `@piprail/sdk` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 versions follow [Semantic Versioning](https://semver.org/).
 
+## [2.10.0] — 2026-06-20 — x402 parity: verifiable receipts · the `upto` metered rail · A2A transport
+
+Four ratified-x402 capabilities, all **additive and opt-in** — omit the new options and the 402, the
+200, and the pay path are byte-identical to 2.9.0.
+
+- **feat(receipts): verifiable receipts — chain-grounded (no key) + optional EIP-712 attestation.**
+  `receipts: true` on a gate emits a self-contained `PipRailReceipt` on every settled payment, in a
+  byte-compatible `extensions['offer-receipt'].info` block. **Anyone** re-verifies it against the chain
+  with only an RPC: `PipRailClient.verifyReceipt(receipt)` re-reads the settlement tx and re-derives
+  `payTo`/`asset`/`payer`, **ignoring the receipt's claims** (never throws; `amount` is a verified lower
+  bound; `payer` genuinely re-derived). `client.lastReceipt()` captures it after a paid `fetch`. The new
+  additive wire field is `X402Receipt.nonce?` (required to re-verify the five memo-bound families:
+  Stellar/XRPL/NEAR/Algorand/TON). **Tier 2 (EVM-only):** `receipts: { attest: { wallet } }` also signs
+  the official x402 offer-receipt EIP-712 `RECEIPT_TYPES` with the merchant's existing `payTo` wallet —
+  attesting the one thing the chain can't (that the resource was *served*); verify with
+  `PipRailClient.verifyAttestation`. `includeTxHash` defaults **true** (PipRail-default verifiability — a
+  deliberate, documented divergence from the reference privacy-default; flip to `false` for the §5.3
+  empty-string privacy path). New exports: `buildReceiptExtension`, `parseReceiptExtension`,
+  `PipRailReceipt`, `SignedReceipt`, `ReceiptInput`, `ReceiptOption`, `ReceiptVerification`.
+- **feat(upto): the ratified `upto` (metered / variable-amount) rail — EVM-Permit2, self-settle.** The
+  buyer signs a Permit2 authorization for a **maximum**; the merchant serves, meters, then self-settles
+  the **actual** (`≤ max`) from its own relayer through the on-chain `x402UptoPermit2Proxy` — backendless,
+  no fee. Opt in with `upto: { relayer, settleAmount }` and meter inside `settleAmount` on a direct
+  `gate.verify()` call (`requirePayment` throws for `upto` — it settles before the handler serves). A
+  zero charge settles nothing on-chain. New `X402UptoAcceptEntry` / `Permit2UptoAuthorization` types +
+  `parseUptoPaymentHeader` / `buildUptoSignatureHeader` codecs.
+- **feat(transport): A2A — `gate.verifyObject()` + the A2A seller handler.** `gate.verifyObject(payload)`
+  verifies a raw-JSON payment object (not just a base64 HTTP header), and `createA2APaymentHandler(gate)`
+  maps a gate onto Google's A2A JSON-RPC Task/Message metadata — **sharing one replay set with HTTP**.
+  Backendless, zero `@a2a` dependency. The parser cores `parseSignatureObject`/`parseExactObject` are now
+  exported. *(The A2A buyer, AP2 carriage, and the live-Google-interop emit-version finalization trail.)*
+- **feat(agent/mcp): an 8th tool — `piprail_verify_receipt`** (read-only, key-less) re-verifies a receipt
+  against the chain; `piprail_pay_request` now surfaces the `verifiableReceipt`.
+- **fix:** a batch of correctness hardening from an adversarial multi-agent audit — require the replay
+  store's `isUsed`/`markUsed` as a pair (a lone one silently disabled double-spend protection); the read
+  methods (`planPayment`/`canAfford`/`estimateCost`) degrade instead of throwing on a malformed accept;
+  Sui coin pagination; Stellar custom-asset decimals; Tron native safe-integer; and more.
+- **fix:** a second adversarial multi-agent conformance pass (vs the cloned x402 spec) hardened the new
+  surfaces — **upto cumulative caps are now merchant-proof:** the budget debits the authorized **MAX**
+  (a merchant that under-reports its settled `amount` can no longer loosen `maxTotal`/`maxTotalPerDenom`/
+  `windowTotal`); the metered actual is surfaced on `SpendRecord.settledBase`. The `upto` driver now
+  enforces **strict** `permitted.amount === advertised max` at verify time (an over-permit is rejected —
+  x402 `scheme_upto_evm` §Phase 3). `describe()` now projects the upto rail's mandatory
+  `extra.facilitatorAddress` (+ the exact rail's EIP-712 domain) so a discovered rail is reconstructable.
+  A2A conformance: a rejected proof re-challenges as `payment-rejected` (the spec status that pairs with
+  the retryable `input-required`, not the terminal `payment-failed`) carrying a failure receipt with
+  `network` + `transaction:''`. The agent guide + `paymentTools` JSDoc now document the upto rail and the
+  8th tool.
+- **fix:** a third verification pass (regression-focused) caught two **doc copy-paste bugs** that would
+  brick a user's code — the `upto` seller + Tier-2 receipt examples used the pre-v2 `{ privateKey }`
+  wallet field (which throws `WrongFamilyError`) instead of the unified `{ key }`. Also: the A2A
+  terminal-`failed` receipt now carries the attempted `network`; the A2A `fulfill` doc/example returns a
+  structurally valid artifact (`{ name, parts }`); the MCP config docs + registry `server.json` now list
+  `upto`; and a **regression test** locks the merchant-proof cumulative leash (a sequence of
+  under-reporting `upto` payments is refused by `maxTotal`/`maxTotalPerDenom`/`windowTotal`).
+- **fix:** a fourth, end-to-end pass (every flow traced hop-by-hop + a clean-room standards sign-off,
+  which came back **CONFORMANT on all four wire formats**, and a live MCP-pays-the-`upto`-rail proof)
+  found only doc-accuracy gaps + one low edge case: A2A failure receipts now attribute `network` from
+  the buyer's submitted payload (covering multi-network gates + v1-flat exact payloads), and the whole
+  docs-site is updated to the **8-tool** surface (the new `piprail_verify_receipt`) with the 2.10.0
+  receipts/upto/A2A APIs documented in the reference. No SDK behavior change beyond the A2A edge fix.
+
+## [2.9.0] — 2026-06-19 — Cross-token grand total · payment-count caps · durable budget · richer spend observability
+
+Spend controls grow up — a single budget across every token and chain, caps on the *number* of
+payments, a budget that can survive a restart, and first-class decline/threshold events. Everything
+is **additive and opt-in**: omit the new fields and behaviour is byte-identical to 2.8.0.
+
+- **feat(policy): `maxTotalPerDenom` — the cross-token GRAND TOTAL.** Cap "$20 total across every
+  stablecoin and chain, full stop" with one number: `policy: { maxTotalPerDenom: { USD: '20.00', EUR: '5.00' } }`.
+  The SDK sums the human value of every token of that denomination (USDC/USDT/USD1/FDUSD/RLUSD → `USD`,
+  EURC → `EUR`; extend via `denomFor`) and refuses the payment that would breach it
+  (`reasonCode: 'BUDGET'`). **Not a price oracle** — PipRail still reads no market and never prices a
+  volatile coin; it's a user-declared unit-of-account sum (each token counted 1:1), and native/unknown
+  tokens are never in a bucket. Coexists with the per-asset `maxTotal`; the stricter cap wins. Exported
+  helpers: `denomOf`, `BUILTIN_DENOMS`, `DENOM_PRECISION`.
+- **feat(policy): payment-COUNT caps.** `maxPayments` (lifetime) and `maxPaymentsPerWindow`
+  (+ `windowSeconds`) cap the *number* of payments across every chain + token — a rate limit that
+  needs no oracle. (`windowSeconds` is now the shared width for the money window AND the count window.)
+- **feat(client): durable budget via a pluggable `spendStore`.** Pass `spendStore` and the spend
+  ledger hydrates at construction + persists every settle, so `maxTotal` / `maxTotalPerDenom` / the
+  count caps **survive a restart** — with no PipRail backend (you own the store, like the gate's
+  replay set). Ships `memorySpendStore` (from `@piprail/sdk`) and **`fileSpendStore(path)` from the new
+  `@piprail/sdk/node` entry** (a one-line local JSONL log; kept out of the browser bundle). `SpendLedger`
+  is now exported so several single-chain clients can SHARE one — `MultiChainPayer.fromWallets` does this
+  for you, making the grand total + count caps span every chain as ONE budget (also `spendStore` on its options).
+- **feat(client): richer spend observability.** New constructor option `onSpend(record, budget)` —
+  the ergonomic "log my spend locally" hook, fired after each settle. Two new additive `PipRailEvent`
+  kinds: **`payment-declined`** (the rich decline — typed `reasonCode`, fine `PolicyDenyCode`, the quote,
+  and a budget snapshot; `payment-failed` still fires too for back-compat) and **`budget-threshold`**
+  (an early warning the first time spend crosses `policy.warnAtFraction` of any cap).
+- **feat(client): budget surface extended (additive).** `client.budget()` now also returns
+  `byDenom: DenomRemaining[]` (the grand-total leash, previewable *before* any spend) and
+  `counts: CountStatus`; new reads `client.denomRemaining()`, `client.countStatus()`, and
+  `client.policy()` (the configured leash read back, also on `MultiChainPayer` + the `PayingClient`
+  interface). `client.spent()` / `SpendSummary` gains `byDenom: SpendDenomTotal[]`; `SpendRecord` now
+  carries `decimals` + `denom`. `formatSpendReport` appends the grand total when present.
+- **New deny codes** on `PolicyDenyCode`: `MAX_TOTAL_DENOM`, `MAX_PAYMENTS`, `WINDOW_COUNT` (the
+  coarse `DeclineReasonCode` set is unchanged — they map to `BUDGET` / `BUDGET` / `OUTSIDE_WINDOW`).
+- **New package entry `@piprail/sdk/node`** (`exports["./node"]`) for the Node-only `fileSpendStore`;
+  the core `@piprail/sdk` bundle stays browser-safe (no static `node:fs`).
+- **Hardened against an adversarial review** (38-agent fuzz of the new surface). Fixes shipped
+  before release — see [Internals & hardening](https://docs.piprail.com/spend-controls/internals/):
+  - **OOM/DoS:** an absurd server-stated `decimals` (e.g. `1e9`) is rejected by a new `MAX_DECIMALS`
+    (100) bound at the envelope + the `assertValidDecimals` chokepoint (no multi-GB string).
+  - **Grand-total bypass (fund safety):** a token labelled `USDC` with `decimals` in `(24, 100]`
+    once **escaped** `maxTotalPerDenom`. `DENOM_PRECISION` is now pinned to `MAX_DECIMALS` and the
+    denom check **fails closed** (refuses an unscalable capped token, never skips it).
+  - **Strictest-cap-wins:** case-variant / whitespace / duplicate denomination keys (`{ USD, usd }`,
+    `" USD "`, a repeated CSV denom) now enforce the SMALLEST cap, never silently relax the leash.
+  - **Native never bucketed:** a native coin can't be summed into a USD/EUR total even if its symbol
+    matches a stablecoin.
+  - **Poisoned-store crash-safety:** the ledger validates + skips un-tallyable hydrated records
+    (non-numeric/negative `amountBase`, out-of-range `decimals`), so a corrupt store line can't crash
+    construction or make `budget()`/`spent()`/`summary()` throw; an unparseable `at` fails closed.
+  - **Loud validation:** `expiresAt` (must be a representable epoch-ms), a non-plain-object
+    `maxTotalPerDenom`, and a non-string `denomFor` value are all rejected at construction (the last
+    would otherwise throw at PAY time, after settlement).
+  - **Poisoned `denom` (final-pass fix):** a hydrated store record with a non-string `denom` is
+    coerced to "no denomination" (it still tallies per-asset) rather than throwing
+    `denom.toUpperCase()` out of construction/reads — completing the crash-safety guarantee.
+  - **`budget-threshold` dedup is ledger-scoped:** on a shared cross-chain ledger
+    (`MultiChainPayer.fromWallets`) a threshold now fires ONCE for the whole budget, not once per chain.
+
 ## [2.8.0] — 2026-06-19 — Solana exact SPL-Memo conformance · TON canonical CAIP-2 (`tvm:-239`) · Toncoin→Gram
 
 - **chore(ton): native coin symbol `TON` → `GRAM` (Toncoin → Gram rebrand).** A TON community

package/README.md

@@ -53,7 +53,9 @@ const payer = MultiChainPayer.fromWallets({
     solana: { key: process.env.SOLANA_KEY },
     xrpl:   { key: process.env.XRPL_SEED },
   },
-  policy: { maxAmount: '1.00', maxTotal: '10.00', tokens: ['USDC', 'USDT'] }, // one budget, every chain
+  // ONE budget across every chain: $20 total + at most 100 payments. `maxTotalPerDenom`
+  // sums every USD stablecoin on every chain (not a price oracle — a 1:1 unit sum).
+  policy: { maxAmount: '1.00', maxTotalPerDenom: { USD: '20.00' }, maxPayments: 100 },
 })
 
 await payer.planPayment(url) // read-only: every chain ranked, payable-first in your listed order
@@ -61,7 +63,7 @@ const res = await payer.get(url) // pays on the first chain that can settle —
 ```
 
 Built on `planAcross` / `fetchAcross` (the same composable primitives, for when you
-already hold an array of clients). See [`examples/multi-chain`](../examples/multi-chain).
+already hold an array of clients). See [`examples/basics/multi-chain`](../examples/basics/multi-chain).
 
 The same app can **take** payments and **make** them. → [Making payments](https://docs.piprail.com/making-payments/piprail-client/)
 
@@ -72,9 +74,10 @@ The same app can **take** payments and **make** them. → [Making payments](http
 | | |
 |---|---|
 | **[Getting started](https://docs.piprail.com/getting-started/introduction/)** | Install · quickstart · how it works |
-| **[Accepting payments](https://docs.piprail.com/accepting-payments/require-payment-and-gate/)** | `requirePayment` · `createPaymentGate` · the `exact` rail |
+| **[Accepting payments](https://docs.piprail.com/accepting-payments/require-payment-and-gate/)** | `requirePayment` · `createPaymentGate` · the `exact` rail · the `upto` metered rail |
 | **[Making payments](https://docs.piprail.com/making-payments/piprail-client/)** | `PipRailClient` · `quote` · `estimateCost` · `planPayment` · auto-route · `MultiChainPayer` |
-| **[Spend controls](https://docs.piprail.com/spend-controls/payment-policy/)** | Budgets · time envelope · the spend ledger |
+| **[Verifiable receipts](https://docs.piprail.com/accepting-payments/verifiable-receipts/)** | Chain-grounded, anyone-verifiable receipts (no key) · optional EIP-712 attestation |
+| **[Spend controls](https://docs.piprail.com/spend-controls/payment-policy/)** | Per-token + cross-token grand total · payment-count caps · time envelope · durable budget · the spend ledger |
 | **[Agent toolkit](https://docs.piprail.com/agent-toolkit/payment-tools/)** | `paymentTools` · the agent guide · NL renderers |
 | **[Discovery](https://docs.piprail.com/discovery/discover-and-register/)** | Find & be found on the open x402 indexes ($0, no backend) |
 | **[Chains & tokens](https://docs.piprail.com/chains/overview/)** | Every chain, per-family setup & caveats |

package/dist/{algorand-WJL6VRXW.js → algorand-AA3WXKW4.js}

@@ -10,7 +10,7 @@ import {
   nativeCost,
   rejectForeignToken,
   toInsufficientFundsError
-} from "./chunk-W3HOMXOF.js";
+} from "./chunk-SC2ZYDHD.js";
 
 // src/drivers/algorand/index.ts
 import algosdk3 from "algosdk";

package/dist/{algorand-EKD34T4Q.cjs → algorand-FCEECDG6.cjs}

@@ -10,7 +10,7 @@
 
 
 
-var _chunkVPENSVOIcjs = require('./chunk-VPENSVOI.cjs');
+var _chunkMWBT7MCEcjs = require('./chunk-MWBT7MCE.cjs');
 
 // src/drivers/algorand/index.ts
 var _algosdk = require('algosdk'); var _algosdk2 = _interopRequireDefault(_algosdk);
@@ -58,13 +58,13 @@ async function payAlgorand(params) {
   } catch (err) {
     const mapped = mapAlgorandError(err, accept.payTo);
     if (mapped) throw mapped;
-    throw _nullishCoalesce(_chunkVPENSVOIcjs.toInsufficientFundsError.call(void 0, err), () => ( err));
+    throw _nullishCoalesce(_chunkMWBT7MCEcjs.toInsufficientFundsError.call(void 0, err), () => ( err));
   }
 }
 function mapAlgorandError(err, payTo) {
   const m = err instanceof Error ? err.message : String(err);
   if (/must optin/i.test(m) || /missing from/i.test(m) && m.includes(payTo)) {
-    return new (0, _chunkVPENSVOIcjs.RecipientNotReadyError)(
+    return new (0, _chunkMWBT7MCEcjs.RecipientNotReadyError)(
       `Algorand recipient ${payTo} hasn't opted into this asset \u2014 it must opt in (a 0-amount asset transfer to itself) before it can receive. (Algorand: ${firstLine(m)})`,
       { cause: err }
     );
@@ -72,7 +72,7 @@ function mapAlgorandError(err, payTo) {
   if (/overspend|below min|min(imum)? balance|tried to spend|balance \d+ below|asset \d+ missing from|insufficient|underflow/i.test(
     m
   )) {
-    return new (0, _chunkVPENSVOIcjs.InsufficientFundsError)(
+    return new (0, _chunkMWBT7MCEcjs.InsufficientFundsError)(
       `Algorand payment failed: the sender can't cover it \u2014 token balance, ALGO for fees, the 0.1-ALGO minimum balance, or a missing asset opt-in on the sender. (Algorand: ${firstLine(m)})`,
       { cause: err }
     );
@@ -99,33 +99,33 @@ function isSet(addr) {
 function randomNote() {
   const g = globalThis.crypto;
   if (!_optionalChain([g, 'optionalAccess', _ => _.getRandomValues])) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)("Algorand exact: no Web Crypto CSPRNG available to generate a unique note.");
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)("Algorand exact: no Web Crypto CSPRNG available to generate a unique note.");
   }
   return g.getRandomValues(new Uint8Array(32));
 }
 async function payExactAlgorand(input) {
   const { suggestedParams, sk, sender, accept } = input;
   if (accept.asset === "native") {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
       "Algorand exact is ASA-only (an asset transfer); native ALGO is not exact-payable. Pay via onchain-proof."
     );
   }
   const feePayer = accept.extra.feePayer;
   if (!feePayer) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)("Algorand exact rail must advertise extra.feePayer (the fee sponsor address).");
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)("Algorand exact rail must advertise extra.feePayer (the fee sponsor address).");
   }
   const assetId = parseAlgorandAssetId(accept.asset);
   if (assetId === null) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(`Algorand exact rail asset "${accept.asset}" must be a numeric ASA id.`);
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(`Algorand exact rail asset "${accept.asset}" must be a numeric ASA id.`);
   }
   if (!_algosdk2.default.isValidAddress(feePayer)) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(`Algorand exact: extra.feePayer "${feePayer}" is not a valid Algorand address.`);
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(`Algorand exact: extra.feePayer "${feePayer}" is not a valid Algorand address.`);
   }
   if (!_algosdk2.default.isValidAddress(accept.payTo)) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(`Algorand exact: payTo "${accept.payTo}" is not a valid Algorand address.`);
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(`Algorand exact: payTo "${accept.payTo}" is not a valid Algorand address.`);
   }
   if (feePayer === sender) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
       "Algorand exact: the fee payer must differ from the payer \u2014 the buyer must pay ZERO ALGO (the sponsor pays the pooled fee)."
     );
   }
@@ -172,13 +172,13 @@ function decodeElement(bytes) {
 async function verifyAndSettleExactAlgorand(input) {
   const { client, feePayerSk, feePayerAddr, payload, accept } = input;
   const railFeePayer = accept.extra.feePayer;
-  if (!railFeePayer) throw new (0, _chunkVPENSVOIcjs.SettlementError)("Algorand exact: rail is missing extra.feePayer.");
+  if (!railFeePayer) throw new (0, _chunkMWBT7MCEcjs.SettlementError)("Algorand exact: rail is missing extra.feePayer.");
   if (railFeePayer !== feePayerAddr) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)("Algorand exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)("Algorand exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
   }
   const assetId = parseAlgorandAssetId(accept.asset);
-  if (assetId === null) throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Algorand exact: rail asset "${accept.asset}" is not a numeric ASA id.`);
-  if (!_algosdk2.default.isValidAddress(accept.payTo)) throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Algorand exact: rail payTo "${accept.payTo}" is invalid.`);
+  if (assetId === null) throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Algorand exact: rail asset "${accept.asset}" is not a numeric ASA id.`);
+  if (!_algosdk2.default.isValidAddress(accept.payTo)) throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Algorand exact: rail payTo "${accept.payTo}" is invalid.`);
   const { paymentIndex, paymentGroup } = payload;
   if (paymentGroup.length !== GROUP_SIZE) {
     return fail("signature_invalid", `Algorand exact expects a ${GROUP_SIZE}-transaction group (payment + fee), got ${paymentGroup.length}.`);
@@ -244,7 +244,7 @@ async function verifyAndSettleExactAlgorand(input) {
   try {
     feeSigned = fee.signTxn(feePayerSk);
   } catch (err) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Algorand exact settle: the gate could not sign the fee transaction (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Algorand exact settle: the gate could not sign the fee transaction (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
   }
   const signedGroup = elements.map((el, i) => i === paymentIndex ? payElement.raw : feeSigned);
   try {
@@ -266,7 +266,7 @@ async function verifyAndSettleExactAlgorand(input) {
     if (/signature|sig|auth|malformed/i.test(m)) return fail("signature_invalid", `Settle rejected \u2014 bad signature: ${shorten(m)}.`);
     if (/already in ledger|already committed|duplicate/i.test(m)) return fail("tx_already_used", `This payment was already settled: ${shorten(m)}.`);
     if (/\bround\b|expired|lifetime|stale|validity/i.test(m)) return fail("payment_expired", `Settle rejected \u2014 validity window expired: ${shorten(m)}.`);
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(
       `Algorand exact settle: the group failed to submit (${shorten(m)}). The buyer's signed transaction is still valid \u2014 fund/fix the fee payer (${railFeePayer}) and the buyer can re-present it.`,
       { cause: err }
     );
@@ -275,10 +275,10 @@ async function verifyAndSettleExactAlgorand(input) {
   try {
     round = await client.waitForConfirmation(buyerTxid);
   } catch (err) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
   }
   if (round === null) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Algorand exact settle: submitted ${buyerTxid} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
   }
   return {
     ok: true,
@@ -373,13 +373,13 @@ function rpcFailed(nonce) {
 
 function assertAlgorandWallet(wallet, network) {
   if (typeof wallet !== "object" || wallet === null) {
-    throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+    throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
       `chain ${network} is Algorand; wallet must be { key } (25-word mnemonic) or { account }.`
     );
   }
-  _chunkVPENSVOIcjs.assertNoLegacyWalletKey.call(void 0, wallet, "Algorand");
+  _chunkMWBT7MCEcjs.assertNoLegacyWalletKey.call(void 0, wallet, "Algorand");
   if (!("key" in wallet) && !("account" in wallet)) {
-    throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+    throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
       `chain ${network} is Algorand; wallet must be { key } (25-word mnemonic) or { account }.`
     );
   }
@@ -394,13 +394,13 @@ function resolveAlgorandWallet(config) {
       const { addr, sk } = _algosdk2.default.mnemonicToSecretKey(config.key);
       return { addr: addr.toString(), sk };
     } catch (cause) {
-      throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+      throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
         "Algorand wallet { key } is not a valid 25-word Algorand mnemonic.",
         { cause }
       );
     }
   }
-  throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)("Algorand wallet needs { key } (25-word mnemonic) or { account }.");
+  throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)("Algorand wallet needs { key } (25-word mnemonic) or { account }.");
 }
 
 // src/drivers/algorand/index.ts
@@ -471,16 +471,16 @@ function makeAlgorandNetwork(preset, algodUrl) {
         const info = preset.tokens[token.toUpperCase()];
         if (!info) {
           const known = Object.keys(preset.tokens).join(", ") || "(none built in)";
-          throw new (0, _chunkVPENSVOIcjs.UnknownTokenError)(
+          throw new (0, _chunkMWBT7MCEcjs.UnknownTokenError)(
             `token "${token}" isn't built in for Algorand (known: ${known}). Pass { assetId, decimals } for a custom ASA, or use 'native'.`
           );
         }
         return { asset: algorandAssetId(info.assetId), decimals: info.decimals, symbol: info.symbol };
       }
-      _chunkVPENSVOIcjs.rejectForeignToken.call(void 0, token, "algorand", network);
+      _chunkMWBT7MCEcjs.rejectForeignToken.call(void 0, token, "algorand", network);
       const t = token;
       if (typeof t.assetId !== "number" || typeof t.decimals !== "number") {
-        throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+        throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
           `chain ${network} is Algorand; a custom token must be { assetId, decimals }.`
         );
       }
@@ -501,12 +501,12 @@ function makeAlgorandNetwork(preset, algodUrl) {
     },
     assertValidPayTo(payTo) {
       if (payTo.startsWith("0x")) {
-        throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+        throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
           `chain ${network} is Algorand, but payTo "${payTo}" looks like an EVM address.`
         );
       }
       if (!_algosdk2.default.isValidAddress(payTo)) {
-        throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+        throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
           `chain ${network} is Algorand, but payTo "${payTo}" is not a valid Algorand address.`
         );
       }
@@ -523,14 +523,14 @@ function makeAlgorandNetwork(preset, algodUrl) {
         const info = await _algosdk2.default.waitForConfirmation(algod, ref, 10);
         return { height: String(_nullishCoalesce(info.confirmedRound, () => ( 0))) };
       } catch (err) {
-        throw new (0, _chunkVPENSVOIcjs.ConfirmationTimeoutError)(`Algorand tx ${ref} did not confirm in time.`, {
+        throw new (0, _chunkMWBT7MCEcjs.ConfirmationTimeoutError)(`Algorand tx ${ref} did not confirm in time.`, {
           cause: err
         });
       }
     },
     async estimateCost(accept) {
       if (accept.scheme === "exact") {
-        return _chunkVPENSVOIcjs.nativeCost.call(void 0, {
+        return _chunkMWBT7MCEcjs.nativeCost.call(void 0, {
           symbol: ALGO_SYMBOL,
           decimals: ALGO_DECIMALS,
           fee: 0n,
@@ -538,7 +538,7 @@ function makeAlgorandNetwork(preset, algodUrl) {
           detail: "gasless \u2014 the fee payer (facilitator/relayer) pools the group fee; the buyer pays 0 ALGO"
         });
       }
-      return _chunkVPENSVOIcjs.nativeCost.call(void 0, {
+      return _chunkMWBT7MCEcjs.nativeCost.call(void 0, {
         symbol: ALGO_SYMBOL,
         decimals: ALGO_DECIMALS,
         fee: 1000n,

package/dist/{aptos-CVHLVMAF.cjs → aptos-GHJPO6JJ.cjs}

@@ -9,7 +9,7 @@
 
 
 
-var _chunkVPENSVOIcjs = require('./chunk-VPENSVOI.cjs');
+var _chunkMWBT7MCEcjs = require('./chunk-MWBT7MCE.cjs');
 
 // src/drivers/aptos/index.ts
 var _tssdk = require('@aptos-labs/ts-sdk');
@@ -58,14 +58,14 @@ async function payAptos(params) {
     const res = await client.signSubmit({ signer, transaction });
     return res.hash;
   } catch (err) {
-    if (err instanceof _chunkVPENSVOIcjs.InsufficientFundsError) throw err;
+    if (err instanceof _chunkMWBT7MCEcjs.InsufficientFundsError) throw err;
     if (isAptosAffordability(err)) {
-      throw new (0, _chunkVPENSVOIcjs.InsufficientFundsError)(
+      throw new (0, _chunkMWBT7MCEcjs.InsufficientFundsError)(
         err instanceof Error ? err.message : "Insufficient APT/token balance for the payment.",
         { cause: err }
       );
     }
-    throw _nullishCoalesce(_chunkVPENSVOIcjs.toInsufficientFundsError.call(void 0, err), () => ( err));
+    throw _nullishCoalesce(_chunkMWBT7MCEcjs.toInsufficientFundsError.call(void 0, err), () => ( err));
   }
 }
 function isAptosAffordability(err) {
@@ -103,24 +103,24 @@ function parseAddr(addr) {
 async function payExactAptos(input) {
   const { client, sender, accept } = input;
   if (accept.asset === "native") {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
       "Aptos exact is Fungible-Asset only (a primary_fungible_store transfer); native APT is not exact-payable. Pay via onchain-proof."
     );
   }
   const feePayer = accept.extra.feePayer;
   if (!feePayer) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)("Aptos exact rail must advertise extra.feePayer (the gas sponsor address).");
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)("Aptos exact rail must advertise extra.feePayer (the gas sponsor address).");
   }
   const feePayerAddr = parseAddr(feePayer);
-  if (!feePayerAddr) throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(`Aptos exact: extra.feePayer "${feePayer}" is not a valid Aptos address.`);
+  if (!feePayerAddr) throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(`Aptos exact: extra.feePayer "${feePayer}" is not a valid Aptos address.`);
   const payToAddr = parseAddr(accept.payTo);
-  if (!payToAddr) throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(`Aptos exact: payTo "${accept.payTo}" is not a valid Aptos address.`);
+  if (!payToAddr) throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(`Aptos exact: payTo "${accept.payTo}" is not a valid Aptos address.`);
   const metadataAddr = parseAddr(accept.asset);
-  if (!metadataAddr) throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(`Aptos exact: asset "${accept.asset}" is not a valid FA metadata address.`);
+  if (!metadataAddr) throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(`Aptos exact: asset "${accept.asset}" is not a valid FA metadata address.`);
   const senderAddr = parseAddr(sender);
-  if (!senderAddr) throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(`Aptos exact: payer "${sender}" is not a valid Aptos address.`);
+  if (!senderAddr) throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(`Aptos exact: payer "${sender}" is not a valid Aptos address.`);
   if (feePayerAddr.equals(senderAddr)) {
-    throw new (0, _chunkVPENSVOIcjs.UnsupportedSchemeError)(
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
       "Aptos exact: the fee payer must differ from the payer \u2014 the buyer must pay ZERO APT (the sponsor pays gas)."
     );
   }
@@ -158,16 +158,16 @@ function argBytes(arg) {
 async function verifyAndSettleExactAptos(input) {
   const { client, feePayerAddr, payload, accept } = input;
   const railFeePayer = accept.extra.feePayer;
-  if (!railFeePayer) throw new (0, _chunkVPENSVOIcjs.SettlementError)("Aptos exact: rail is missing extra.feePayer.");
+  if (!railFeePayer) throw new (0, _chunkMWBT7MCEcjs.SettlementError)("Aptos exact: rail is missing extra.feePayer.");
   if (railFeePayer !== feePayerAddr) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)("Aptos exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)("Aptos exact: the gate relayer address does not match the rail extra.feePayer \u2014 misconfigured rail.");
   }
-  if (accept.asset === "native") throw new (0, _chunkVPENSVOIcjs.SettlementError)("Aptos exact: native APT is not exact-payable (misconfigured rail).");
+  if (accept.asset === "native") throw new (0, _chunkMWBT7MCEcjs.SettlementError)("Aptos exact: native APT is not exact-payable (misconfigured rail).");
   const railFeePayerAddr = parseAddr(railFeePayer);
   const railPayTo = parseAddr(accept.payTo);
   const railMetadata = parseAddr(accept.asset);
   if (!railFeePayerAddr || !railPayTo || !railMetadata) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)("Aptos exact: rail feePayer/payTo/asset is not a valid Aptos address (misconfigured rail).");
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)("Aptos exact: rail feePayer/payTo/asset is not a valid Aptos address (misconfigured rail).");
   }
   let tx;
   let senderAuth;
@@ -241,7 +241,7 @@ async function verifyAndSettleExactAptos(input) {
   try {
     feePayerAuth = client.signAsFeePayer({ transaction: tx });
   } catch (err) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Aptos exact settle: the gate could not sign as fee payer (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Aptos exact settle: the gate could not sign as fee payer (${shorten(err instanceof Error ? err.message : String(err))}).`, { cause: err });
   }
   if (senderAuth instanceof _tssdk.AccountAuthenticatorEd25519) {
     try {
@@ -264,7 +264,7 @@ async function verifyAndSettleExactAptos(input) {
     if (/signature|invalid.*auth|INVALID_SIGNATURE/i.test(m)) return fail("signature_invalid", `Settle rejected \u2014 bad signature: ${shorten(m)}.`);
     if (/SEQUENCE_NUMBER_TOO_OLD|already.*(committed|ledger)|duplicate/i.test(m)) return fail("tx_already_used", `This payment was already settled: ${shorten(m)}.`);
     if (/EXPIRED|expired|TOO_NEW/i.test(m)) return fail("payment_expired", `Settle rejected \u2014 expired/stale: ${shorten(m)}.`);
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(
       `Aptos exact settle: the transaction failed to submit (${shorten(m)}). The buyer's signed transaction is still valid \u2014 fund/fix the fee payer (${railFeePayer}) and the buyer can re-present it.`,
       { cause: err }
     );
@@ -273,10 +273,10 @@ async function verifyAndSettleExactAptos(input) {
   try {
     confirmed = await client.waitForConfirmation(hash);
   } catch (err) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Aptos exact settle: submitted ${hash} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Aptos exact settle: submitted ${hash} but confirmation read failed (${shorten(err instanceof Error ? err.message : String(err))}). It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`, { cause: err });
   }
   if (confirmed === null) {
-    throw new (0, _chunkVPENSVOIcjs.SettlementError)(`Aptos exact settle: submitted ${hash} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(`Aptos exact settle: submitted ${hash} but it did not confirm in time. It likely landed \u2014 re-verify before re-presenting; do NOT re-pay.`);
   }
   if (!confirmed.success) {
     return fail("tx_reverted", `Settle tx ${hash} reverted on-chain (a post-simulate race).`);
@@ -371,13 +371,13 @@ function txNotFound(hash) {
 
 function assertAptosWallet(wallet, network) {
   if (typeof wallet !== "object" || wallet === null) {
-    throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+    throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
       `chain ${network} is Aptos; wallet must be { key } (ed25519-priv-0x\u2026) or { account }.`
     );
   }
-  _chunkVPENSVOIcjs.assertNoLegacyWalletKey.call(void 0, wallet, "Aptos");
+  _chunkMWBT7MCEcjs.assertNoLegacyWalletKey.call(void 0, wallet, "Aptos");
   if (!("key" in wallet) && !("account" in wallet)) {
-    throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+    throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
       `chain ${network} is Aptos; wallet must be { key } (ed25519-priv-0x\u2026) or { account }.`
     );
   }
@@ -389,13 +389,13 @@ function resolveAptosAccount(config) {
     try {
       return _tssdk.Account.fromPrivateKey({ privateKey: new (0, _tssdk.Ed25519PrivateKey)(config.key) });
     } catch (cause) {
-      throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+      throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
         "Aptos wallet { key } is not a valid ed25519 secret (ed25519-priv-0x\u2026 or 0x\u2026 hex).",
         { cause }
       );
     }
   }
-  throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)("Aptos wallet needs { key } (ed25519-priv-0x\u2026) or { account }.");
+  throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)("Aptos wallet needs { key } (ed25519-priv-0x\u2026) or { account }.");
 }
 
 // src/drivers/aptos/index.ts
@@ -467,16 +467,16 @@ function makeAptosNetwork(preset, rpcUrl) {
         const info = preset.tokens[token.toUpperCase()];
         if (!info) {
           const known = Object.keys(preset.tokens).join(", ") || "(none built in)";
-          throw new (0, _chunkVPENSVOIcjs.UnknownTokenError)(
+          throw new (0, _chunkMWBT7MCEcjs.UnknownTokenError)(
             `token "${token}" isn't built in for Aptos (known: ${known}). Pass { metadata, decimals } for a custom Fungible Asset, or use 'native'.`
           );
         }
         return { asset: info.metadata, decimals: info.decimals, symbol: info.symbol };
       }
-      _chunkVPENSVOIcjs.rejectForeignToken.call(void 0, token, "aptos", network);
+      _chunkMWBT7MCEcjs.rejectForeignToken.call(void 0, token, "aptos", network);
       const t = token;
       if (!t.metadata || typeof t.decimals !== "number") {
-        throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+        throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
           `chain ${network} is Aptos; a custom token must be { metadata, decimals }.`
         );
       }
@@ -503,7 +503,7 @@ function makeAptosNetwork(preset, rpcUrl) {
         valid = false;
       }
       if (!valid || evmLike) {
-        throw new (0, _chunkVPENSVOIcjs.WrongFamilyError)(
+        throw new (0, _chunkMWBT7MCEcjs.WrongFamilyError)(
           `chain ${network} is Aptos, but payTo "${payTo}" is not a valid Aptos address (0x + 32 bytes).`
         );
       }
@@ -525,12 +525,12 @@ function makeAptosNetwork(preset, rpcUrl) {
         const tx = await aptos.waitForTransaction({ transactionHash: ref });
         return { height: String(_nullishCoalesce(tx.version, () => ( "0"))) };
       } catch (err) {
-        throw new (0, _chunkVPENSVOIcjs.ConfirmationTimeoutError)(`Aptos tx ${ref} did not finalize in time.`, { cause: err });
+        throw new (0, _chunkMWBT7MCEcjs.ConfirmationTimeoutError)(`Aptos tx ${ref} did not finalize in time.`, { cause: err });
       }
     },
     async estimateCost(accept) {
       if (accept.scheme === "exact") {
-        return _chunkVPENSVOIcjs.nativeCost.call(void 0, {
+        return _chunkMWBT7MCEcjs.nativeCost.call(void 0, {
           symbol: APT_SYMBOL,
           decimals: APT_DECIMALS,
           fee: 0n,
@@ -538,7 +538,7 @@ function makeAptosNetwork(preset, rpcUrl) {
           detail: "gasless \u2014 the fee payer (facilitator/relayer) sponsors gas; the buyer pays 0 APT"
         });
       }
-      return _chunkVPENSVOIcjs.nativeCost.call(void 0, {
+      return _chunkMWBT7MCEcjs.nativeCost.call(void 0, {
         symbol: APT_SYMBOL,
         decimals: APT_DECIMALS,
         fee: 100000n,

package/dist/{aptos-WMPFEASY.js → aptos-LY67Q6QF.js}

@@ -9,7 +9,7 @@ import {
   nativeCost,
   rejectForeignToken,
   toInsufficientFundsError
-} from "./chunk-W3HOMXOF.js";
+} from "./chunk-SC2ZYDHD.js";
 
 // src/drivers/aptos/index.ts
 import { Aptos, AptosConfig, Network, AccountAddress as AccountAddress2 } from "@aptos-labs/ts-sdk";