@piprail/sdk 2.9.0 → 2.10.0

package/dist/index.cjs

@@ -1,8 +1,11 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } async function _asyncOptionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = await fn(value); } else if (op === 'call' || op === 'optionalCall') { value = await fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } async function _asyncOptionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = await fn(value); } else if (op === 'call' || op === 'optionalCall') { value = await fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3;
 
 var _chunkO4UQOZ4Zcjs = require('./chunk-O4UQOZ4Z.cjs');
 
 
+var _chunkCQQI5IJXcjs = require('./chunk-CQQI5IJX.cjs');
+
+
 
 
 
@@ -1357,6 +1360,361 @@ async function verifyAndSettlePermit2Evm(input) {
   };
 }
 
+// src/drivers/evm/upto.ts
+
+
+
+
+var X402_UPTO_PERMIT2_PROXY = "0x4020A4f3b7b90ccA423B9fabCc0CE57C6C240002";
+var UPTO_PROXY_CHAIN_IDS = /* @__PURE__ */ new Set([
+  1,
+  // Ethereum
+  8453,
+  // Base
+  42161,
+  // Arbitrum
+  10,
+  // Optimism
+  137,
+  // Polygon
+  56
+  // BNB
+]);
+function isUptoProxyChain(chainId) {
+  return UPTO_PROXY_CHAIN_IDS.has(chainId);
+}
+var PERMIT2_UPTO_WITNESS_TYPES = {
+  PermitWitnessTransferFrom: PERMIT2_WITNESS_TYPES.PermitWitnessTransferFrom,
+  TokenPermissions: PERMIT2_WITNESS_TYPES.TokenPermissions,
+  Witness: [
+    { name: "to", type: "address" },
+    { name: "facilitator", type: "address" },
+    { name: "validAfter", type: "uint256" }
+  ]
+};
+var x402UptoProxyAbi = [
+  {
+    type: "function",
+    name: "settle",
+    stateMutability: "nonpayable",
+    outputs: [],
+    inputs: [
+      {
+        name: "permit",
+        type: "tuple",
+        components: [
+          {
+            name: "permitted",
+            type: "tuple",
+            components: [
+              { name: "token", type: "address" },
+              { name: "amount", type: "uint256" }
+            ]
+          },
+          { name: "nonce", type: "uint256" },
+          { name: "deadline", type: "uint256" }
+        ]
+      },
+      { name: "amount", type: "uint256" },
+      { name: "owner", type: "address" },
+      {
+        name: "witness",
+        type: "tuple",
+        components: [
+          { name: "to", type: "address" },
+          { name: "facilitator", type: "address" },
+          { name: "validAfter", type: "uint256" }
+        ]
+      },
+      { name: "signature", type: "bytes" }
+    ]
+  }
+];
+function shorten3(msg) {
+  const oneLine = msg.replace(/\s+/g, " ").trim();
+  return oneLine.length > 200 ? `${oneLine.slice(0, 200)}\u2026` : oneLine;
+}
+function randomPermit2Nonce2() {
+  const g = globalThis.crypto;
+  if (!_optionalChain([g, 'optionalAccess', _9 => _9.getRandomValues])) {
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
+      "this runtime lacks Web Crypto (globalThis.crypto.getRandomValues); the upto rail needs a CSPRNG nonce."
+    );
+  }
+  const raw = new Uint8Array(32);
+  g.getRandomValues(raw);
+  return BigInt(`0x${[...raw].map((b) => b.toString(16).padStart(2, "0")).join("")}`);
+}
+async function payUptoEvm(input) {
+  const { publicClient, walletClient, account, chainId, chain, accept } = input;
+  let code;
+  try {
+    code = await publicClient.getCode({ address: account.address });
+  } catch (e16) {
+    code = void 0;
+  }
+  if (code && code !== "0x") {
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
+      `upto buyer rail requires an EOA signer; ${account.address} is a contract / EIP-1271 / EIP-7702-delegated account. Pay via onchain-proof.`
+    );
+  }
+  const facilitatorAddress = _optionalChain([accept, 'access', _10 => _10.extra, 'optionalAccess', _11 => _11.facilitatorAddress]);
+  if (typeof facilitatorAddress !== "string" || facilitatorAddress.length === 0) {
+    throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
+      `upto: the rail carries no extra.facilitatorAddress to bind into witness.facilitator \u2014 refusing to sign.`
+    );
+  }
+  const token = _viem.getAddress.call(void 0, accept.asset);
+  const payTo = _viem.getAddress.call(void 0, accept.payTo);
+  const facilitator = _viem.getAddress.call(void 0, facilitatorAddress);
+  const value = BigInt(accept.amount);
+  const approvalTx = await ensurePermit2Allowance({
+    publicClient,
+    walletClient,
+    account,
+    chain,
+    token,
+    amount: value
+  });
+  const nonce = randomPermit2Nonce2();
+  const deadline = BigInt(Math.floor(Date.now() / 1e3) + accept.maxTimeoutSeconds);
+  const validAfter = 0n;
+  const spender = _viem.getAddress.call(void 0, X402_UPTO_PERMIT2_PROXY);
+  const from = account.address;
+  const signature = await walletClient.signTypedData({
+    account,
+    domain: { name: "Permit2", chainId, verifyingContract: PERMIT2_ADDRESS },
+    types: PERMIT2_UPTO_WITNESS_TYPES,
+    primaryType: "PermitWitnessTransferFrom",
+    message: {
+      permitted: { token, amount: value },
+      spender,
+      nonce,
+      deadline,
+      witness: { to: payTo, facilitator, validAfter }
+    }
+  });
+  const permit2Authorization = {
+    permitted: { token, amount: value.toString() },
+    from,
+    spender,
+    nonce: nonce.toString(),
+    deadline: deadline.toString(),
+    witness: { to: payTo, facilitator, validAfter: validAfter.toString() }
+  };
+  return {
+    payload: { signature, permit2Authorization },
+    payerFrom: from,
+    nonce: nonce.toString(),
+    ...approvalTx ? { approvalTx } : {}
+  };
+}
+function resolveUptoRailEvm(input) {
+  const { asset, relayerAddress, proxySupported, domain } = input;
+  if (asset === "native") return null;
+  if (!proxySupported()) return null;
+  const extra = { facilitatorAddress: _viem.getAddress.call(void 0, relayerAddress) };
+  if (domain) {
+    extra.name = domain.name;
+    extra.version = domain.version;
+  }
+  return { method: "permit2-upto", extra };
+}
+async function verifyAndSettleUptoEvm(input) {
+  const { publicClient, walletClient, account, chain, payload, accept, settleAmount } = input;
+  const token = _viem.getAddress.call(void 0, accept.asset);
+  const payTo = _viem.getAddress.call(void 0, accept.payTo);
+  const maxAmount = BigInt(accept.amount);
+  const proxy = _viem.getAddress.call(void 0, X402_UPTO_PERMIT2_PROXY);
+  const relayerAddress = _viem.getAddress.call(void 0, account.address);
+  let from;
+  let spender;
+  let permittedToken;
+  let witnessTo;
+  let witnessFacilitator;
+  let permittedAmount;
+  let nonce;
+  let deadline;
+  let validAfter;
+  const signature = payload.signature;
+  try {
+    const pa = payload.permit2Authorization;
+    from = _viem.getAddress.call(void 0, pa.from);
+    spender = _viem.getAddress.call(void 0, pa.spender);
+    permittedToken = _viem.getAddress.call(void 0, pa.permitted.token);
+    witnessTo = _viem.getAddress.call(void 0, pa.witness.to);
+    witnessFacilitator = _viem.getAddress.call(void 0, pa.witness.facilitator);
+    permittedAmount = BigInt(pa.permitted.amount);
+    nonce = BigInt(pa.nonce);
+    deadline = BigInt(pa.deadline);
+    validAfter = BigInt(pa.witness.validAfter);
+    if (!/^0x[0-9a-fA-F]+$/.test(signature)) throw new Error("signature must be hex");
+  } catch (err) {
+    return {
+      ok: false,
+      error: "signature_invalid",
+      detail: `Malformed upto authorization: ${err instanceof Error ? err.message : String(err)}.`
+    };
+  }
+  if (witnessTo !== payTo) {
+    return { ok: false, error: "wrong_recipient", detail: `Authorization pays witness.to ${witnessTo}, not ${payTo}.` };
+  }
+  if (permittedToken !== token) {
+    return { ok: false, error: "signature_invalid", detail: `Authorization permits token ${permittedToken}, not the rail's ${token}.` };
+  }
+  if (spender !== proxy) {
+    return { ok: false, error: "signature_invalid", detail: `Authorization spender ${spender} is not the x402UptoPermit2Proxy ${proxy}; it can't be settled here.` };
+  }
+  if (witnessFacilitator !== relayerAddress) {
+    return { ok: false, error: "signature_invalid", detail: `Authorization binds facilitator ${witnessFacilitator}, not this relayer ${relayerAddress}; only the bound facilitator can settle.` };
+  }
+  if (permittedAmount < maxAmount) {
+    return { ok: false, error: "amount_too_low", detail: `Permitted (signed MAX) ${permittedAmount} is below the rail max ${maxAmount}.` };
+  }
+  if (permittedAmount > maxAmount) {
+    return { ok: false, error: "upto_settle_exceeds_max", detail: `Permitted (signed MAX) ${permittedAmount} exceeds the advertised rail max ${maxAmount}; sign exactly the ceiling.` };
+  }
+  if (settleAmount < 0n) {
+    return { ok: false, error: "upto_settle_exceeds_max", detail: `Settle amount ${settleAmount} is negative.` };
+  }
+  if (settleAmount > permittedAmount) {
+    return { ok: false, error: "upto_settle_exceeds_max", detail: `Settle amount ${settleAmount} exceeds the signed MAX ${permittedAmount}.` };
+  }
+  const now = BigInt(Math.floor(Date.now() / 1e3));
+  if (deadline <= now) {
+    return { ok: false, error: "payment_expired", detail: `Permit2 deadline ${deadline} <= now ${now}.` };
+  }
+  let fromCode;
+  try {
+    fromCode = await publicClient.getCode({ address: from });
+  } catch (e17) {
+    return { ok: false, error: "tx_not_found", detail: `Could not read code at ${from} (transient RPC) \u2014 retry.` };
+  }
+  if (!(fromCode && fromCode !== "0x")) {
+    let recovered;
+    try {
+      recovered = await _viem.recoverTypedDataAddress.call(void 0, {
+        domain: { name: "Permit2", chainId: chain.id, verifyingContract: PERMIT2_ADDRESS },
+        types: PERMIT2_UPTO_WITNESS_TYPES,
+        primaryType: "PermitWitnessTransferFrom",
+        message: {
+          permitted: { token: permittedToken, amount: permittedAmount },
+          spender,
+          nonce,
+          deadline,
+          witness: { to: witnessTo, facilitator: witnessFacilitator, validAfter }
+        },
+        signature
+      });
+    } catch (err) {
+      return { ok: false, error: "signature_invalid", detail: `Not a valid EIP-712 signature: ${shorten3(err instanceof Error ? err.message : String(err))}.` };
+    }
+    if (recovered !== from) {
+      return { ok: false, error: "signature_invalid", detail: `Signature recovered to ${recovered}, not the authorizer ${from}.` };
+    }
+  }
+  if (settleAmount === 0n) {
+    return {
+      ok: true,
+      receipt: {
+        scheme: "upto",
+        success: true,
+        network: accept.network,
+        transaction: "",
+        asset: accept.asset,
+        amount: "0",
+        payer: from,
+        payTo: accept.payTo,
+        verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+  }
+  try {
+    const word = nonce >> 8n;
+    const bit = nonce & 0xffn;
+    const bitmap = await publicClient.readContract({
+      address: PERMIT2_ADDRESS,
+      abi: permit2NonceBitmapAbi,
+      functionName: "nonceBitmap",
+      args: [from, word]
+    });
+    if ((bitmap >> bit & 1n) === 1n) {
+      return { ok: false, error: "tx_already_used", detail: `Permit2 nonce ${nonce} already used or invalidated for ${from}.` };
+    }
+  } catch (e18) {
+    return { ok: false, error: "tx_not_found", detail: "Could not read the Permit2 nonce bitmap (transient RPC) \u2014 retry." };
+  }
+  const settleArgs = [
+    { permitted: { token: permittedToken, amount: permittedAmount }, nonce, deadline },
+    settleAmount,
+    from,
+    { to: witnessTo, facilitator: witnessFacilitator, validAfter },
+    signature
+  ];
+  try {
+    await publicClient.simulateContract({
+      account,
+      address: proxy,
+      abi: x402UptoProxyAbi,
+      functionName: "settle",
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      args: settleArgs
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/nonce|invalidated|used/i.test(msg)) return { ok: false, error: "tx_already_used", detail: "Permit2 nonce is used or invalidated." };
+    if (/expired|deadline|too early|not yet/i.test(msg)) return { ok: false, error: "payment_expired", detail: shorten3(msg) };
+    if (/exceeds.*permitted|AmountExceeds/i.test(msg)) return { ok: false, error: "upto_settle_exceeds_max", detail: shorten3(msg) };
+    if (/facilitator|Unauthorized/i.test(msg)) return { ok: false, error: "signature_invalid", detail: shorten3(msg) };
+    if (/signature/i.test(msg)) return { ok: false, error: "signature_invalid", detail: shorten3(msg) };
+    return { ok: false, error: "tx_reverted", detail: `upto settle would revert: ${shorten3(msg)}` };
+  }
+  let txHash;
+  try {
+    txHash = await walletClient.writeContract({
+      account,
+      chain,
+      address: proxy,
+      abi: x402UptoProxyAbi,
+      functionName: "settle",
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      args: settleArgs
+    });
+  } catch (err) {
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(
+      `upto settle: the merchant relayer failed to broadcast the proxy settle (${shorten3(err instanceof Error ? err.message : String(err))}). The payer's signature is still valid and its nonce unused \u2014 fund/fix the relayer and the payer can retry.`,
+      { cause: err }
+    );
+  }
+  try {
+    const confirmations = _nullishCoalesce(accept.extra.minConfirmations, () => ( 1));
+    const receipt = await publicClient.waitForTransactionReceipt({ hash: txHash, confirmations });
+    if (receipt.status !== "success") {
+      return { ok: false, error: "tx_reverted", detail: `Settlement tx ${txHash} reverted on-chain.` };
+    }
+  } catch (err) {
+    throw new (0, _chunkMWBT7MCEcjs.SettlementError)(
+      `upto settle: broadcast ${txHash} but couldn't confirm it (${shorten3(err instanceof Error ? err.message : String(err))}).`,
+      { cause: err }
+    );
+  }
+  return {
+    ok: true,
+    receipt: {
+      scheme: "upto",
+      success: true,
+      network: accept.network,
+      transaction: txHash,
+      asset: accept.asset,
+      // The ACTUAL settled amount (≤ max) — what the buyer reads back to record metered spend.
+      amount: settleAmount.toString(),
+      payer: from,
+      payTo: accept.payTo,
+      verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+}
+
 // src/x402.ts
 var HEADER_REQUIRED = "payment-required";
 var HEADER_SIGNATURE = "payment-signature";
@@ -1386,10 +1744,13 @@ function decodeBase64(b64) {
 function fromBase64Json(b64) {
   try {
     return JSON.parse(decodeBase64(b64));
-  } catch (e16) {
+  } catch (e19) {
     return null;
   }
 }
+function decodeBase64Json(value) {
+  return fromBase64Json(value);
+}
 function toBase64Json(value) {
   return encodeBase64(JSON.stringify(value));
 }
@@ -1405,8 +1766,15 @@ function chainIdFromNetwork(network) {
 function buildChallengeHeader(challenge) {
   return toBase64Json(challenge);
 }
-function buildReceiptHeader(receipt) {
-  return toBase64Json(receipt);
+function buildReceiptHeader(receipt, extensions) {
+  return toBase64Json(extensions ? { ...receipt, extensions } : receipt);
+}
+var EXT_OFFER_RECEIPT = "offer-receipt";
+function buildReceiptExtension(bundle) {
+  const info = { settlement: bundle.receipt, resource: bundle.resource };
+  if (typeof bundle.decimals === "number") info.decimals = bundle.decimals;
+  if (bundle.attestation) info.receipt = bundle.attestation;
+  return { [EXT_OFFER_RECEIPT]: { info } };
 }
 function buildSignatureHeader(signature) {
   return toBase64Json(signature);
@@ -1414,6 +1782,9 @@ function buildSignatureHeader(signature) {
 function buildExactSignatureHeader(input) {
   return toBase64Json({ x402Version: 2, accepted: input.accepted, payload: input.payload });
 }
+function buildUptoSignatureHeader(input) {
+  return toBase64Json({ x402Version: 2, accepted: input.accepted, payload: input.payload });
+}
 async function parseChallenge(response) {
   const headerValue = response.headers.get(HEADER_REQUIRED);
   if (headerValue) {
@@ -1423,7 +1794,7 @@ async function parseChallenge(response) {
   try {
     const body = await response.clone().json();
     if (isValidChallenge(body)) return body;
-  } catch (e17) {
+  } catch (e20) {
   }
   return null;
 }
@@ -1433,6 +1804,27 @@ function parseReceipt(response) {
   const parsed = fromBase64Json(headerValue);
   return isValidReceipt(parsed) ? parsed : null;
 }
+function parseReceiptExtension(response) {
+  const headerValue = _nullishCoalesce(response.headers.get(HEADER_RESPONSE), () => ( response.headers.get(HEADER_RESPONSE_V1)));
+  if (!headerValue) return null;
+  const parsed = fromBase64Json(headerValue);
+  if (!parsed || typeof parsed !== "object") return null;
+  const ext = parsed.extensions;
+  const block = _optionalChain([ext, 'optionalAccess', _12 => _12[EXT_OFFER_RECEIPT]]);
+  const info = _optionalChain([block, 'optionalAccess', _13 => _13.info]);
+  if (!info) return null;
+  const settlement = isValidReceipt(info.settlement) ? info.settlement : isValidReceipt(info.receipt) ? info.receipt : void 0;
+  if (!settlement) return null;
+  const attestation = info.receipt && info.receipt !== settlement ? info.receipt : void 0;
+  const res = info.resource;
+  return {
+    piprail: "1",
+    receipt: settlement,
+    resource: { url: res && typeof res.url === "string" ? res.url : "" },
+    ...typeof info.decimals === "number" ? { decimals: info.decimals } : {},
+    ...attestation ? { attestation } : {}
+  };
+}
 function parseSettleResponse(response) {
   const headerValue = _nullishCoalesce(response.headers.get(HEADER_RESPONSE), () => ( response.headers.get(HEADER_RESPONSE_V1)));
   if (!headerValue) return null;
@@ -1443,15 +1835,17 @@ function parseSettleResponse(response) {
     ...typeof parsed.transaction === "string" ? { transaction: parsed.transaction } : {},
     ...typeof parsed.network === "string" ? { network: parsed.network } : {},
     ...typeof parsed.payer === "string" ? { payer: parsed.payer } : {},
-    ...typeof parsed.errorReason === "string" ? { errorReason: parsed.errorReason } : {}
+    ...typeof parsed.errorReason === "string" ? { errorReason: parsed.errorReason } : {},
+    // The upto SettleResponse's REQUIRED `amount` (actual settled atomic units) — string
+    // passthrough so the upto buyer records ACTUAL, not MAX. Absent on onchain-proof/exact.
+    ...typeof parsed.amount === "string" ? { amount: parsed.amount } : {}
   };
 }
-function parseSignatureHeader(value) {
-  const parsed = fromBase64Json(value);
+function parseSignatureObject(parsed) {
   if (!parsed || typeof parsed !== "object") return null;
   const v = parsed;
   const accepted = v.accepted;
-  const scheme = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _9 => _9.scheme]), () => ( v.scheme));
+  const scheme = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _14 => _14.scheme]), () => ( v.scheme));
   if (scheme !== "onchain-proof") return null;
   const payload = v.payload;
   if (!payload || typeof payload.txHash !== "string" || typeof payload.nonce !== "string") {
@@ -1459,14 +1853,19 @@ function parseSignatureHeader(value) {
   }
   return parsed;
 }
+function parseSignatureHeader(value) {
+  return parseSignatureObject(fromBase64Json(value));
+}
 function parseExactPaymentHeader(value) {
-  const parsed = fromBase64Json(value);
+  return parseExactObject(fromBase64Json(value));
+}
+function parseExactObject(parsed) {
   if (!parsed || typeof parsed !== "object") return null;
   const v = parsed;
   const accepted = _nullishCoalesce(v.accepted, () => ( null));
-  const scheme = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _10 => _10.scheme]), () => ( v.scheme));
+  const scheme = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _15 => _15.scheme]), () => ( v.scheme));
   if (scheme !== "exact") return null;
-  const network = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _11 => _11.network]), () => ( v.network));
+  const network = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _16 => _16.network]), () => ( v.network));
   if (typeof network !== "string") return null;
   const payload = v.payload;
   if (!payload || typeof payload !== "object") return null;
@@ -1525,6 +1924,42 @@ function parseExactPaymentHeader(value) {
   }
   return null;
 }
+function parseUptoPaymentHeader(value) {
+  return parseUptoObject(fromBase64Json(value));
+}
+function parseUptoObject(parsed) {
+  if (!parsed || typeof parsed !== "object") return null;
+  const v = parsed;
+  const accepted = _nullishCoalesce(v.accepted, () => ( null));
+  const scheme = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _17 => _17.scheme]), () => ( v.scheme));
+  if (scheme !== "upto") return null;
+  const network = _nullishCoalesce(_optionalChain([accepted, 'optionalAccess', _18 => _18.network]), () => ( v.network));
+  if (typeof network !== "string") return null;
+  const payload = v.payload;
+  if (!payload || typeof payload !== "object") return null;
+  const signature = payload.signature;
+  if (typeof signature !== "string") return null;
+  const p2 = payload.permit2Authorization;
+  if (!p2 || typeof p2 !== "object") return null;
+  const permitted = p2.permitted;
+  const witness = p2.witness;
+  if (!permitted || typeof permitted !== "object" || !witness || typeof witness !== "object") return null;
+  if (typeof permitted.token !== "string" || typeof permitted.amount !== "string") return null;
+  if (typeof witness.to !== "string" || typeof witness.facilitator !== "string" || typeof witness.validAfter !== "string") {
+    return null;
+  }
+  for (const k of ["from", "spender", "nonce", "deadline"]) {
+    if (typeof p2[k] !== "string") return null;
+  }
+  const x402Version = typeof v.x402Version === "number" ? v.x402Version : 2;
+  const asset = accepted && typeof accepted.asset === "string" ? accepted.asset : void 0;
+  const base2 = { x402Version, network, ...asset ? { asset } : {}, raw: v };
+  return {
+    ...base2,
+    method: "permit2-upto",
+    payload: { signature, permit2Authorization: p2 }
+  };
+}
 function isValidChallenge(value) {
   if (!value || typeof value !== "object") return false;
   const v = value;
@@ -1537,7 +1972,7 @@ function isValidChallenge(value) {
 function isValidReceipt(value) {
   if (!value || typeof value !== "object") return false;
   const v = value;
-  if (v.scheme !== "onchain-proof" && v.scheme !== "exact") return false;
+  if (v.scheme !== "onchain-proof" && v.scheme !== "exact" && v.scheme !== "upto") return false;
   if (typeof v.transaction !== "string" && typeof v.txHash !== "string") return false;
   if (typeof v.payer !== "string") return false;
   return true;
@@ -1560,7 +1995,7 @@ var evmDriver = {
     let resolved;
     try {
       resolved = resolveChain(opts.chain, opts.rpcUrl);
-    } catch (e18) {
+    } catch (e21) {
       return null;
     }
     return makeEvmNetwork(resolved);
@@ -1616,7 +2051,7 @@ function makeEvmNetwork(resolved) {
       let normalized;
       try {
         normalized = _viem.getAddress.call(void 0, asset);
-      } catch (e19) {
+      } catch (e22) {
         return null;
       }
       for (const info of Object.values(resolved.tokens)) {
@@ -1702,7 +2137,7 @@ function makeEvmNetwork(resolved) {
           basis: "estimated",
           detail: `~${gasLimit} gas @ ${gasPrice} wei/gas`
         });
-      } catch (e20) {
+      } catch (e23) {
         const gasPrice = 5000000000n;
         return _chunkMWBT7MCEcjs.nativeCost.call(void 0, {
           symbol,
@@ -1725,7 +2160,7 @@ function makeEvmNetwork(resolved) {
           functionName: "balanceOf",
           args: [owner]
         });
-      } catch (e21) {
+      } catch (e24) {
         token = null;
       }
       return { token, native };
@@ -1745,6 +2180,12 @@ function makeEvmNetwork(resolved) {
         signMessage: (message) => a.walletClient.signMessage({ account: a.account, message })
       };
     },
+    // Tier-2 service-delivery attestation (EVM-only) — sign the official offer-receipt
+    // EIP-712 RECEIPT_TYPES with the bound (payTo) wallet. Chain-independent (domain
+    // chainId is hardcoded 1); viem lives in ./receipt.ts (a lazy chunk).
+    signReceipt(wallet, input) {
+      return _chunkCQQI5IJXcjs.signReceiptEvm.call(void 0, wallet, input);
+    },
     async verify(ref, accept) {
       return verifyEvm({
         publicClient,
@@ -1828,6 +2269,43 @@ function makeEvmNetwork(resolved) {
         payload,
         accept
       });
+    },
+    // Standard x402 `upto` (metered) rail — EVM-Permit2 ONLY. The metered sibling of the
+    // exact trio. resolveUptoRail advertises (Permit2-only, proxy-gated, relayer = facilitator);
+    // payUpto signs the MAX with witness.facilitator bound; settleUptoSelf self-settles the actual.
+    async resolveUptoRail({ asset, relayer }) {
+      const relayerAddress = relayer._native.account.address;
+      const domain = asset === "native" ? null : await readExactDomain(publicClient, asset).catch(() => null);
+      return resolveUptoRailEvm({
+        asset,
+        relayerAddress,
+        proxySupported: () => isUptoProxyChain(resolved.chainId),
+        domain
+      });
+    },
+    async payUpto(wallet, accept) {
+      const a = wallet._native;
+      const { payload, payerFrom, nonce } = await payUptoEvm({
+        publicClient,
+        walletClient: a.walletClient,
+        account: a.account,
+        chainId: resolved.chainId,
+        chain: resolved.chain,
+        accept
+      });
+      return { payload, accepted: accept, payerFrom, nonce };
+    },
+    async settleUptoSelf({ relayer, payload, accept, settleAmount }) {
+      const a = relayer._native;
+      return verifyAndSettleUptoEvm({
+        publicClient,
+        walletClient: a.walletClient,
+        account: a.account,
+        chain: resolved.chain,
+        payload,
+        accept,
+        settleAmount
+      });
     }
   };
 }
@@ -1868,7 +2346,7 @@ var loaders = {
   stellar: async () => {
     let mod;
     try {
-      mod = await Promise.resolve().then(() => _interopRequireWildcard(require("./stellar-SUKASK4N.cjs")));
+      mod = await Promise.resolve().then(() => _interopRequireWildcard(require("./stellar-CRWBSX4E.cjs")));
     } catch (cause) {
       throw new (0, _chunkMWBT7MCEcjs.MissingDriverError)(
         `Stellar selected, but its package isn't installed. Run: npm install @stellar/stellar-sdk`,
@@ -1892,7 +2370,7 @@ var loaders = {
   tron: async () => {
     let mod;
     try {
-      mod = await Promise.resolve().then(() => _interopRequireWildcard(require("./tron-EMFXDFHW.cjs")));
+      mod = await Promise.resolve().then(() => _interopRequireWildcard(require("./tron-OMXB6EW2.cjs")));
     } catch (cause) {
       throw new (0, _chunkMWBT7MCEcjs.MissingDriverError)(
         `Tron selected, but its package isn't installed. Run: npm install tronweb`,
@@ -1904,7 +2382,7 @@ var loaders = {
   sui: async () => {
     let mod;
     try {
-      mod = await Promise.resolve().then(() => _interopRequireWildcard(require("./sui-VE5LT7BL.cjs")));
+      mod = await Promise.resolve().then(() => _interopRequireWildcard(require("./sui-Y4RLKKE2.cjs")));
     } catch (cause) {
       throw new (0, _chunkMWBT7MCEcjs.MissingDriverError)(
         `Sui selected, but its package isn't installed. Run: npm install @mysten/sui`,
@@ -2109,7 +2587,7 @@ function fieldTokens(r) {
   try {
     const u = new URL(r.resource);
     pathText = `${u.hostname} ${u.pathname}`;
-  } catch (e22) {
+  } catch (e25) {
   }
   return [
     [tokenize(r.name), FIELD_WEIGHTS.name],
@@ -2164,7 +2642,7 @@ function sortResources(items, sort, order) {
 async function safeSearch(run) {
   try {
     return await run();
-  } catch (e23) {
+  } catch (e26) {
     return [];
   }
 }
@@ -2303,7 +2781,7 @@ async function register402Index(input) {
     if (res.ok) {
       const body = await res.json().catch(() => ({}));
       const msg = typeof body.message === "string" && body.message.length > 0 ? body.message : void 0;
-      const live = _optionalChain([body, 'access', _12 => _12.service, 'optionalAccess', _13 => _13.status]) === "active";
+      const live = _optionalChain([body, 'access', _19 => _19.service, 'optionalAccess', _20 => _20.status]) === "active";
       return {
         source: "402index",
         ok: true,
@@ -2330,7 +2808,7 @@ async function readIndexError(res) {
       (p) => typeof p === "string" && p.length > 0
     );
     return parts.length ? [...new Set(parts)].join(" \u2014 ") : void 0;
-  } catch (e24) {
+  } catch (e27) {
     return void 0;
   }
 }
@@ -2440,11 +2918,11 @@ async function readSiwxInfo(res) {
   try {
     const body = await res.json();
     const ext = body.extensions;
-    const siwx = _optionalChain([ext, 'optionalAccess', _14 => _14["sign-in-with-x"]]);
-    const info = _nullishCoalesce(_optionalChain([siwx, 'optionalAccess', _15 => _15.info]), () => ( siwx));
-    if (info && info.chainId == null && Array.isArray(_optionalChain([siwx, 'optionalAccess', _16 => _16.supportedChains]))) {
+    const siwx = _optionalChain([ext, 'optionalAccess', _21 => _21["sign-in-with-x"]]);
+    const info = _nullishCoalesce(_optionalChain([siwx, 'optionalAccess', _22 => _22.info]), () => ( siwx));
+    if (info && info.chainId == null && Array.isArray(_optionalChain([siwx, 'optionalAccess', _23 => _23.supportedChains]))) {
       const evm = siwx.supportedChains.find(
-        (c) => typeof _optionalChain([c, 'optionalAccess', _17 => _17.chainId]) === "string" && c.chainId.startsWith("eip155:")
+        (c) => typeof _optionalChain([c, 'optionalAccess', _24 => _24.chainId]) === "string" && c.chainId.startsWith("eip155:")
       );
       if (evm && typeof evm.chainId === "string") info.chainId = evm.chainId;
     }
@@ -2452,7 +2930,7 @@ async function readSiwxInfo(res) {
       return info;
     }
     return null;
-  } catch (e25) {
+  } catch (e28) {
     return null;
   }
 }
@@ -2549,7 +3027,7 @@ function hostOf(url) {
   try {
     const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(url) ? url : `https://${url}`;
     return new URL(withScheme).hostname || url;
-  } catch (e26) {
+  } catch (e29) {
     return url;
   }
 }
@@ -2598,7 +3076,7 @@ var BUILTIN_DENOMS = {
 function denomOf(symbol, asset, policy) {
   if (asset === "native") return void 0;
   const norm = (v) => typeof v === "string" && v.trim() !== "" ? v.trim().toUpperCase() : void 0;
-  const override = _optionalChain([policy, 'optionalAccess', _18 => _18.denomFor]);
+  const override = _optionalChain([policy, 'optionalAccess', _25 => _25.denomFor]);
   if (override && typeof override === "object") {
     if (asset && asset in override) {
       const d = norm(override[asset]);
@@ -2796,10 +3274,10 @@ var SpendLedger = (_class = class {
       let seed = [];
       try {
         seed = _nullishCoalesce(store.load(), () => ( []));
-      } catch (e27) {
+      } catch (e30) {
         seed = [];
       }
-      for (const r of seed) this.ingest(r, _nullishCoalesce(_optionalChain([r, 'optionalAccess', _19 => _19.decimals]), () => ( 0)), _optionalChain([r, 'optionalAccess', _20 => _20.denom]));
+      for (const r of seed) this.ingest(r, _nullishCoalesce(_optionalChain([r, 'optionalAccess', _26 => _26.decimals]), () => ( 0)), _optionalChain([r, 'optionalAccess', _27 => _27.denom]));
     }
   }
   /**
@@ -2855,13 +3333,13 @@ var SpendLedger = (_class = class {
     if (rec && this.store) {
       try {
         this.store.append(rec);
-      } catch (e28) {
+      } catch (e31) {
       }
     }
   }
   /** Running total (base units) already spent on this (network, asset). */
   totalFor(network, asset) {
-    return _nullishCoalesce(_optionalChain([this, 'access', _21 => _21.buckets, 'access', _22 => _22.get, 'call', _23 => _23(keyFor(network, asset)), 'optionalAccess', _24 => _24.total]), () => ( 0n));
+    return _nullishCoalesce(_optionalChain([this, 'access', _28 => _28.buckets, 'access', _29 => _29.get, 'call', _30 => _30(keyFor(network, asset)), 'optionalAccess', _31 => _31.total]), () => ( 0n));
   }
   /**
    * Running grand total for a DENOMINATION, scaled to {@link DENOM_PRECISION} (so
@@ -2955,7 +3433,7 @@ var SpendLedger = (_class = class {
         denom,
         totalScaled: scaled.toString(),
         totalFormatted: _chunkMWBT7MCEcjs.formatUnits.call(void 0, scaled, DENOM_PRECISION),
-        count: this.records.filter((r) => _optionalChain([r, 'access', _25 => _25.denom, 'optionalAccess', _26 => _26.toUpperCase, 'call', _27 => _27()]) === denom).length
+        count: this.records.filter((r) => _optionalChain([r, 'access', _32 => _32.denom, 'optionalAccess', _33 => _33.toUpperCase, 'call', _34 => _34()]) === denom).length
       })),
       records: [...this.records]
     };
@@ -2970,7 +3448,8 @@ var RECIPIENT_FIX = {
   NOT_OPTED_IN: "the recipient must opt into this asset once (a 0-amount self-transfer)",
   INACTIVE: "the recipient account doesn't exist yet \u2014 fund it with the chain's base reserve to activate it"
 };
-var PipRailClient = class {
+var RECEIPT_VERIFY_WINDOW_SECONDS = 100 * 365 * 24 * 60 * 60;
+var PipRailClient = (_class2 = class {
   
   
   
@@ -2986,7 +3465,11 @@ var PipRailClient = class {
   // Resolved lazily on first request — this is what lets Solana (and future
   // families) auto-mount with no setup call.
   
-  constructor(opts) {
+  // The verifiable receipt from the most recent settled fetch (null if the server emitted
+  // none). Captured pure (no chain read) and surfaced via lastReceipt(); the resource URL is
+  // stamped from the URL this client actually fetched (authoritative over the gate's default).
+  __init6() {this.lastReceiptValue = null}
+  constructor(opts) {;_class2.prototype.__init6.call(this);
     this.opts = opts;
     this.maxRetries = Math.max(1, _nullishCoalesce(opts.maxPaymentRetries, () => ( 3)));
     this.retryTimeoutMs = _nullishCoalesce(opts.retryTimeoutMs, () => ( 3e4));
@@ -3129,7 +3612,130 @@ var PipRailClient = class {
   safeEmit(event) {
     try {
       this.onEvent(event);
-    } catch (e29) {
+    } catch (e32) {
+    }
+  }
+  /**
+   * Capture the verifiable receipt from a settled response (pure — no chain read), stamping
+   * the resource URL this client actually fetched (authoritative over the gate's default ''). A
+   * settled fetch with no receipt extension sets it to `null` so {@link lastReceipt} reflects the
+   * latest fetch. Never throws — a malformed header just yields `null`.
+   */
+  captureReceipt(response, url) {
+    try {
+      const parsed = parseReceiptExtension(response);
+      this.lastReceiptValue = parsed ? { ...parsed, resource: { url } } : null;
+    } catch (e33) {
+      this.lastReceiptValue = null;
+    }
+  }
+  /**
+   * The verifiable {@link PipRailReceipt} from the most recent settled `fetch` — the
+   * self-contained record the buyer KEEPS and anyone re-verifies against the chain
+   * (see {@link PipRailClient.verifyReceipt}). `null` when the last settled fetch carried
+   * no receipt (the gate's `receipts` option was off) or no payment has settled yet. Pure.
+   */
+  lastReceipt() {
+    return this.lastReceiptValue;
+  }
+  /**
+   * Re-verify ANY {@link PipRailReceipt} against the chain — the anyone-can-run primitive.
+   * Re-reads `receipt.transaction` via the receipt's own network driver and re-derives
+   * `payTo`/`asset`/`payer` from the tx, **never trusting the receipt's claims**: a forged
+   * `payTo`/`asset`/over-stated `amount` makes the driver's `verify()` fail (`ok:false`); a
+   * forged `payer` surfaces as `matchesClaims:false`. Static + WALLET-FREE — a third party
+   * verifies with only a chain + RPC, no PipRail account. **Never throws** (an RPC error or a
+   * malformed receipt → `{ ok:false, error }`). Viem-free here — the chain read happens inside
+   * the lazily-mounted family driver (the protocol layer pulls no chain libs). Durable for
+   * digest-bound families; recency-bounded for the account-watch families (see
+   * {@link ReceiptVerification}).
+   */
+  static async verifyReceipt(receipt, opts) {
+    const r = _optionalChain([receipt, 'optionalAccess', _35 => _35.receipt]);
+    if (!r || typeof r !== "object") {
+      return { ok: false, onChain: { payTo: "", asset: "", amount: "", payer: "" }, matchesClaims: false, ageSeconds: 0, error: "tx_not_found" };
+    }
+    const claimed = { payTo: _nullishCoalesce(r.payTo, () => ( "")), asset: _nullishCoalesce(r.asset, () => ( "")), amount: _nullishCoalesce(r.amount, () => ( "")), payer: _nullishCoalesce(r.payer, () => ( "")) };
+    const ageSeconds = receiptAgeSeconds(r.verifiedAt);
+    try {
+      const chain = chainSelectorForNetwork(r.network, _optionalChain([opts, 'optionalAccess', _36 => _36.rpcUrl]));
+      const net = await resolveNetwork2({
+        chain,
+        ..._optionalChain([opts, 'optionalAccess', _37 => _37.rpcUrl]) ? { rpcUrl: opts.rpcUrl } : {}
+      });
+      const accept = {
+        scheme: "onchain-proof",
+        network: r.network,
+        amount: r.amount,
+        asset: r.asset,
+        payTo: r.payTo,
+        maxTimeoutSeconds: RECEIPT_VERIFY_WINDOW_SECONDS,
+        extra: {
+          nonce: _nullishCoalesce(r.nonce, () => ( "")),
+          // the challenge/memo nonce — REQUIRED for Template-A re-verify
+          decimals: _nullishCoalesce(receipt.decimals, () => ( 6)),
+          // B10c — Stellar/XRPL/TON re-scale by it; 6 = USDC fallback
+          minConfirmations: 0,
+          amountFormatted: ""
+        }
+      };
+      const ref = familyForChain(chain) === "near" ? `${r.payer}:${r.transaction}` : r.transaction;
+      const result = await net.verify(ref, accept);
+      if (!result.ok) {
+        return { ok: false, onChain: claimed, matchesClaims: false, ageSeconds, error: result.error };
+      }
+      const oc = result.receipt;
+      const onChain = { payTo: oc.payTo, asset: oc.asset, amount: oc.amount, payer: oc.payer };
+      const matchesClaims = sameAddress(oc.payer, r.payer);
+      return { ok: true, onChain, matchesClaims, ageSeconds };
+    } catch (e34) {
+      return { ok: false, onChain: claimed, matchesClaims: false, ageSeconds, error: "tx_not_found" };
+    }
+  }
+  /**
+   * Verify the OPTIONAL Tier-2 service-delivery attestation on a {@link PipRailReceipt}
+   * — the merchant's signed proof that the resource was actually SERVED (the one thing
+   * the chain can't attest). For an EVM EIP-712 attestation this re-recovers the signer
+   * from the signature over the official `offer-receipt` typed data and checks
+   * `recover === receipt.payTo` (spec §4.5.1 / §5.5) — the classic EIP-712 footgun made
+   * safe (`recoverTypedDataAddress` returns a WRONG address rather than throwing on a bad
+   * signature, so the equality check is the real verification). A tampered signature →
+   * `{ ok:false }`, never a throw.
+   *
+   * Static + wallet-free. **Never throws** (a malformed/absent attestation, an unsupported
+   * format, or a recovery fault → `{ ok:false, reason }`). Viem-free HERE — the recover runs
+   * inside the lazily-imported EVM receipt driver (a lazy chunk), so the protocol layer pulls
+   * no chain libs. The JWS format defers to R3 (`{ ok:false, reason:'jws-not-loaded' }`).
+   */
+  static async verifyAttestation(receipt) {
+    const att = _optionalChain([receipt, 'optionalAccess', _38 => _38.attestation]);
+    if (!att || typeof att !== "object" || typeof att.signature !== "string") {
+      return { ok: false, reason: "no-attestation" };
+    }
+    if (att.format === "jws") {
+      return { ok: false, reason: "jws-not-loaded" };
+    }
+    const r = receipt.receipt;
+    if (!r || typeof r !== "object") return { ok: false, reason: "no-receipt" };
+    const payload = _nullishCoalesce(att.payload, () => ( {}));
+    const network = typeof payload.network === "string" ? payload.network : r.network;
+    const resourceUrl = typeof payload.resourceUrl === "string" ? payload.resourceUrl : _nullishCoalesce(_optionalChain([receipt, 'access', _39 => _39.resource, 'optionalAccess', _40 => _40.url]), () => ( ""));
+    const payer = typeof payload.payer === "string" ? payload.payer : r.payer;
+    const issuedAt = typeof payload.issuedAt === "number" ? payload.issuedAt : receiptIssuedAtSeconds(r.verifiedAt);
+    const transaction = typeof payload.transaction === "string" ? payload.transaction : _nullishCoalesce(r.transaction, () => ( ""));
+    try {
+      const { verifyReceiptAttestationEvm } = await Promise.resolve().then(() => _interopRequireWildcard(require("./receipt-QCDPMWNF.cjs")));
+      return await verifyReceiptAttestationEvm({
+        payTo: r.payTo,
+        network,
+        resourceUrl,
+        payer,
+        issuedAt,
+        transaction,
+        signature: att.signature
+      });
+    } catch (e35) {
+      return { ok: false, reason: "verify-failed" };
     }
   }
   /** Auto-mount the chain's driver, resolve the network, and bind the wallet — once. */
@@ -3159,7 +3765,7 @@ var PipRailClient = class {
    * as-is) or a plain object (serialised as JSON).
    */
   post(url, body, init) {
-    const headers = new Headers(_optionalChain([init, 'optionalAccess', _28 => _28.headers]));
+    const headers = new Headers(_optionalChain([init, 'optionalAccess', _41 => _41.headers]));
     let payload;
     if (body === void 0 || body === null) {
       payload = void 0;
@@ -3190,7 +3796,7 @@ var PipRailClient = class {
    * "0.05 USDC on Base, within budget → pay it." No funds move.
    */
   async quote(url, init) {
-    const res = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), method: _nullishCoalesce(_optionalChain([init, 'optionalAccess', _29 => _29.method]), () => ( "GET")) });
+    const res = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), method: _nullishCoalesce(_optionalChain([init, 'optionalAccess', _42 => _42.method]), () => ( "GET")) });
     if (res.status !== 402) return null;
     const { quote } = await this.resolveChallenge(url, res, this.resolveSchemes());
     return quote;
@@ -3209,11 +3815,16 @@ var PipRailClient = class {
    * on Tron, where a USD₮ transfer can cost real TRX.
    */
   async estimateCost(url, init) {
-    const res = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), method: _nullishCoalesce(_optionalChain([init, 'optionalAccess', _30 => _30.method]), () => ( "GET")) });
+    const res = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), method: _nullishCoalesce(_optionalChain([init, 'optionalAccess', _43 => _43.method]), () => ( "GET")) });
     if (res.status !== 402) return null;
-    const { net, accept, quote } = await this.resolveChallenge(url, res, this.resolveSchemes());
-    const cost = await net.estimateCost(accept);
-    return { quote, cost };
+    try {
+      const { net, accept, quote } = await this.resolveChallenge(url, res, this.resolveSchemes());
+      const cost = await net.estimateCost(accept);
+      return { quote, cost };
+    } catch (err) {
+      if (err instanceof _chunkMWBT7MCEcjs.InvalidEnvelopeError) return null;
+      throw err;
+    }
   }
   /** Aggregated snapshot of every payment this client has settled — total
    *  count, cumulative spend per token, cumulative spend per denomination (the
@@ -3242,8 +3853,8 @@ var PipRailClient = class {
     return {
       session: {
         start,
-        expiresAt: _optionalChain([view, 'optionalAccess', _31 => _31.expiresAt]) != null ? new Date(view.expiresAt).toISOString() : null,
-        secondsRemaining: _nullishCoalesce(_optionalChain([view, 'optionalAccess', _32 => _32.secondsRemaining]), () => ( null))
+        expiresAt: _optionalChain([view, 'optionalAccess', _44 => _44.expiresAt]) != null ? new Date(view.expiresAt).toISOString() : null,
+        secondsRemaining: _nullishCoalesce(_optionalChain([view, 'optionalAccess', _45 => _45.secondsRemaining]), () => ( null))
       },
       byAsset: this.remaining(),
       byDenom: this.denomRemaining(),
@@ -3258,7 +3869,7 @@ var PipRailClient = class {
    * price-converted figure (tokens grouped as one unit, each 1:1).
    */
   denomRemaining() {
-    const caps = _optionalChain([this, 'access', _33 => _33.opts, 'access', _34 => _34.policy, 'optionalAccess', _35 => _35.maxTotalPerDenom]);
+    const caps = _optionalChain([this, 'access', _46 => _46.opts, 'access', _47 => _47.policy, 'optionalAccess', _48 => _48.maxTotalPerDenom]);
     if (!caps) return [];
     return Object.entries(caps).map(([rawDenom, capStr]) => {
       const denom = rawDenom.toUpperCase();
@@ -3281,11 +3892,11 @@ var PipRailClient = class {
     const policy = this.opts.policy;
     const settled = this.ledger.count();
     const out = { settled };
-    if (_optionalChain([policy, 'optionalAccess', _36 => _36.maxPayments]) !== void 0) {
+    if (_optionalChain([policy, 'optionalAccess', _49 => _49.maxPayments]) !== void 0) {
       out.lifetimeCap = policy.maxPayments;
       out.lifetimeRemaining = Math.max(0, policy.maxPayments - settled);
     }
-    if (_optionalChain([policy, 'optionalAccess', _37 => _37.maxPaymentsPerWindow]) !== void 0 && policy.windowSeconds !== void 0) {
+    if (_optionalChain([policy, 'optionalAccess', _50 => _50.maxPaymentsPerWindow]) !== void 0 && policy.windowSeconds !== void 0) {
       const windowSettled = this.ledger.countSince(Date.now() - policy.windowSeconds * 1e3);
       out.windowCap = policy.maxPaymentsPerWindow;
       out.windowSettled = windowSettled;
@@ -3301,7 +3912,7 @@ var PipRailClient = class {
    * never throws, never sums across tokens (no price oracle). PROCESS-SCOPED.
    */
   remaining() {
-    const maxTotal = _optionalChain([this, 'access', _38 => _38.opts, 'access', _39 => _39.policy, 'optionalAccess', _40 => _40.maxTotal]);
+    const maxTotal = _optionalChain([this, 'access', _51 => _51.opts, 'access', _52 => _52.policy, 'optionalAccess', _53 => _53.maxTotal]);
     return this.ledger.assetBuckets().map((b) => {
       const base2 = {
         network: b.network,
@@ -3353,7 +3964,7 @@ var PipRailClient = class {
    * the plan yourself. No funds move.
    */
   async planPayment(url, init) {
-    const res = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), method: _nullishCoalesce(_optionalChain([init, 'optionalAccess', _41 => _41.method]), () => ( "GET")) });
+    const res = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), method: _nullishCoalesce(_optionalChain([init, 'optionalAccess', _54 => _54.method]), () => ( "GET")) });
     if (res.status !== 402) return null;
     const challenge = await parseChallenge(res);
     if (!challenge) {
@@ -3534,7 +4145,7 @@ var PipRailClient = class {
    * streams throw `NonReplayableBodyError`.
    */
   async fetch(url, init) {
-    const body = _optionalChain([init, 'optionalAccess', _42 => _42.body]);
+    const body = _optionalChain([init, 'optionalAccess', _55 => _55.body]);
     if (body !== void 0 && body !== null && !isReplayableBodyInit(body)) {
       throw new (0, _chunkMWBT7MCEcjs.NonReplayableBodyError)(
         "fetch(): init.body is not replayable. Pass a string, FormData, URLSearchParams, ArrayBuffer, or Blob \u2014 not a ReadableStream."
@@ -3542,7 +4153,7 @@ var PipRailClient = class {
     }
     const firstResponse = await fetch(url, init);
     if (firstResponse.status !== 402) return firstResponse;
-    const schemes = this.resolveSchemes(_optionalChain([init, 'optionalAccess', _43 => _43.schemes]));
+    const schemes = this.resolveSchemes(_optionalChain([init, 'optionalAccess', _56 => _56.schemes]));
     const resolved = await this.resolveChallenge(url, firstResponse, schemes);
     const { net, wallet, challenge } = resolved;
     if (!wallet) {
@@ -3552,7 +4163,7 @@ var PipRailClient = class {
     }
     let accept = resolved.accept;
     let quote = resolved.quote;
-    const autoRoute = _nullishCoalesce(_nullishCoalesce(_optionalChain([init, 'optionalAccess', _44 => _44.autoRoute]), () => ( this.opts.autoRoute)), () => ( false));
+    const autoRoute = _nullishCoalesce(_nullishCoalesce(_optionalChain([init, 'optionalAccess', _57 => _57.autoRoute]), () => ( this.opts.autoRoute)), () => ( false));
     if (autoRoute) {
       const plan = await this.planFromChallenge(net, wallet, challenge, url, schemes);
       if (!plan.best) {
@@ -3565,9 +4176,17 @@ var PipRailClient = class {
     }
     this.safeEmit({ kind: "payment-required", challenge, accept });
     await this.authorize(quote);
+    if (accept.scheme === "upto") {
+      return this.payUptoRail(net, wallet, accept, url, init, quote);
+    }
     if (accept.scheme === "exact") {
       return this.payExactRail(net, wallet, accept, url, init, quote);
     }
+    if (accept.scheme !== "onchain-proof") {
+      throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
+        `internal: unrouted accept scheme '${accept.scheme}' reached the onchain-proof pay path.`
+      );
+    }
     const { ref, confirmed } = await this.payAndConfirm(net, wallet, accept);
     const response = await this.retryWithProof(url, init, accept, ref, confirmed);
     this.recordSpend(quote, ref);
@@ -3654,6 +4273,13 @@ var PipRailClient = class {
         )
       );
     }
+    if (schemes.includes("upto")) {
+      out.push(
+        ...challenge.accepts.filter(
+          (a) => a.scheme === "upto" && this.supportsNetwork(net, a.network) && typeof net.payUpto === "function" && net.describeAsset(a.asset) != null && typeof _optionalChain([a, 'access', _58 => _58.extra, 'optionalAccess', _59 => _59.facilitatorAddress]) === "string" && a.extra.facilitatorAddress.length > 0 && Number.isInteger(a.maxTimeoutSeconds) && a.maxTimeoutSeconds > 0
+        )
+      );
+    }
     return out;
   }
   /** Build the full {@link PaymentPlan} from an already-parsed challenge + bound
@@ -3675,11 +4301,11 @@ var PipRailClient = class {
         ...session ? { session } : {}
       };
     }
-    const analysed = await Promise.all(
+    const analysed = (await Promise.all(
       candidates.map(
-        (accept) => this.analyzeRail(net, wallet, accept, url, challenge.resource.description)
+        (accept) => this.analyzeRail(net, wallet, accept, url, challenge.resource.description).catch(() => null)
       )
-    );
+    )).filter((o) => o !== null);
     const options = rankOptions(analysed);
     const best = _nullishCoalesce(options.find((o) => o.state === "payable"), () => ( null));
     const status = best ? "ready" : options.some((o) => o.state === "unknown") ? "unknown" : "blocked";
@@ -3703,7 +4329,7 @@ var PipRailClient = class {
     const rr = await net.recipientReady(accept.payTo, accept.asset).catch(() => ({ ready: "unknown" }));
     const amount = BigInt(accept.amount);
     const fee = safeBig(cost.fee);
-    const isExact = accept.scheme === "exact";
+    const isExact = accept.scheme === "exact" || accept.scheme === "upto";
     const isNative = accept.asset === "native";
     const blockers = [];
     const warnings = [];
@@ -3783,7 +4409,7 @@ var PipRailClient = class {
     }
     const amountBase = BigInt(accept.amount);
     const described = net.describeAsset(accept.asset);
-    const decimals = _nullishCoalesce(_optionalChain([described, 'optionalAccess', _45 => _45.decimals]), () => ( _optionalChain([accept, 'access', _46 => _46.extra, 'optionalAccess', _47 => _47.decimals])));
+    const decimals = _nullishCoalesce(_optionalChain([described, 'optionalAccess', _60 => _60.decimals]), () => ( _optionalChain([accept, 'access', _61 => _61.extra, 'optionalAccess', _62 => _62.decimals])));
     if (typeof decimals !== "number" || !Number.isInteger(decimals) || decimals < 0) {
       throw new (0, _chunkMWBT7MCEcjs.InvalidEnvelopeError)(
         `challenge for ${accept.asset} on ${accept.network} states no valid decimals and the SDK doesn't recognise the token \u2014 refusing to price it.`
@@ -3794,7 +4420,7 @@ var PipRailClient = class {
         `challenge for ${accept.asset} on ${accept.network} states ${decimals} decimals (> ${_chunkMWBT7MCEcjs.MAX_DECIMALS}) \u2014 refusing to price it (no real token is that deep).`
       );
     }
-    const symbol = _nullishCoalesce(_optionalChain([described, 'optionalAccess', _48 => _48.symbol]), () => ( _optionalChain([accept, 'access', _49 => _49.extra, 'optionalAccess', _50 => _50.symbol])));
+    const symbol = _nullishCoalesce(_optionalChain([described, 'optionalAccess', _63 => _63.symbol]), () => ( _optionalChain([accept, 'access', _64 => _64.extra, 'optionalAccess', _65 => _65.symbol])));
     const amountFormatted = _chunkMWBT7MCEcjs.formatUnits.call(void 0, amountBase, decimals);
     const intent = {
       host: hostOf2(url),
@@ -3836,7 +4462,7 @@ var PipRailClient = class {
       this.ledger.totalFor(accept.network, accept.asset),
       ctx
     );
-    const serverSymbol = _optionalChain([accept, 'access', _51 => _51.extra, 'optionalAccess', _52 => _52.symbol]);
+    const serverSymbol = _optionalChain([accept, 'access', _66 => _66.extra, 'optionalAccess', _67 => _67.symbol]);
     const symbolMismatch = intent.recognized && !!serverSymbol && !!symbol && serverSymbol.toUpperCase() !== symbol.toUpperCase();
     return {
       url,
@@ -3909,16 +4535,41 @@ var PipRailClient = class {
    *  denomination it counts toward in the grand total). Then fire the `onSpend` callback
    *  with the record + the post-payment budget, and emit any `warnAtFraction` thresholds
    *  this payment just crossed. All observability is isolated — a throwing hook never
-   *  affects the (already-settled) payment. */
-  recordSpend(quote, ref) {
+   *  affects the (already-settled) payment.
+   *
+   *  `settledAmountBase` is the SINGLE upto ledger-reconciliation seam: the quote (and thus
+   *  the policy/budget) gates on the MAX, and for the metered `upto` rail the budgeted amount
+   *  RECORDED is ALSO the authorized MAX — the only buyer-provable bound. The merchant's
+   *  claimed actual is UNTRUSTED (a malicious merchant can settle the MAX on-chain yet report
+   *  a tiny `SettleOutcome.amount`); recording it would let an under-report silently loosen a
+   *  cumulative cap (`maxTotal`/`maxTotalPerDenom`/`windowTotal`) past the buyer's real on-chain
+   *  spend (POL-1). So the cap-bearing `amountBase` is the MAX; the clamped actual is surfaced
+   *  separately on `settledBase`/`settledFormatted` for transparency (it equals the receipt's
+   *  amount). When absent (onchain-proof/exact) this is byte-identical to before. */
+  recordSpend(quote, ref, settledAmountBase) {
     const denom = denomOf(quote.symbol, quote.asset, this.opts.policy);
+    const amountBase = quote.amount;
+    const amountFormatted = quote.amountFormatted;
+    let settledBase;
+    let settledFormatted;
+    if (settledAmountBase !== void 0 && /^\d+$/.test(settledAmountBase)) {
+      try {
+        const claimed = BigInt(settledAmountBase);
+        const max = BigInt(quote.amount);
+        const shown = claimed < max ? claimed : max;
+        settledBase = shown.toString();
+        settledFormatted = _chunkMWBT7MCEcjs.formatUnits.call(void 0, shown, quote.decimals);
+      } catch (e36) {
+      }
+    }
     const record = {
       url: quote.url,
       host: hostOf2(quote.url),
       network: quote.network,
       asset: quote.asset,
-      amountBase: quote.amount,
-      amountFormatted: quote.amountFormatted,
+      amountBase,
+      amountFormatted,
+      ...settledBase !== void 0 ? { settledBase, settledFormatted } : {},
       ...quote.symbol ? { symbol: quote.symbol } : {},
       decimals: quote.decimals,
       ...denom ? { denom } : {},
@@ -3930,7 +4581,7 @@ var PipRailClient = class {
     if (this.opts.onSpend) {
       try {
         this.opts.onSpend(record, budget);
-      } catch (e30) {
+      } catch (e37) {
       }
     }
     this.emitThresholds(budget);
@@ -3943,7 +4594,7 @@ var PipRailClient = class {
    * `warnAtFraction` is set. Reads the just-computed {@link SessionBudget}; isolated (safeEmit).
    */
   emitThresholds(budget) {
-    const frac = _optionalChain([this, 'access', _53 => _53.opts, 'access', _54 => _54.policy, 'optionalAccess', _55 => _55.warnAtFraction]);
+    const frac = _optionalChain([this, 'access', _68 => _68.opts, 'access', _69 => _69.policy, 'optionalAccess', _70 => _70.warnAtFraction]);
     if (frac === void 0) return;
     const fire = (scope, label, spentFormatted, capFormatted, fraction) => {
       if (fraction < frac) return;
@@ -3967,7 +4618,7 @@ var PipRailClient = class {
       fire("denom", d.denom, d.spentFormatted, d.capFormatted, d.fraction);
     }
     const policy = this.opts.policy;
-    if (_optionalChain([policy, 'optionalAccess', _56 => _56.windowTotal]) !== void 0 && policy.windowSeconds !== void 0) {
+    if (_optionalChain([policy, 'optionalAccess', _71 => _71.windowTotal]) !== void 0 && policy.windowSeconds !== void 0) {
       const since = Date.now() - policy.windowSeconds * 1e3;
       for (const r of budget.byAsset) {
         const cap = _chunkMWBT7MCEcjs.floorUnits.call(void 0, policy.windowTotal, r.decimals);
@@ -4005,7 +4656,7 @@ var PipRailClient = class {
     const ref = await net.send(wallet, accept);
     this.safeEmit({ kind: "payment-broadcast", ref });
     try {
-      const { height } = await net.confirm(ref, _nullishCoalesce(_optionalChain([accept, 'access', _57 => _57.extra, 'optionalAccess', _58 => _58.minConfirmations]), () => ( 1)));
+      const { height } = await net.confirm(ref, _nullishCoalesce(_optionalChain([accept, 'access', _72 => _72.extra, 'optionalAccess', _73 => _73.minConfirmations]), () => ( 1)));
       this.safeEmit({
         kind: "payment-confirmed",
         ref,
@@ -4025,9 +4676,9 @@ var PipRailClient = class {
     const signature = {
       x402Version: 2,
       accepted: accept,
-      payload: { nonce: _optionalChain([accept, 'access', _59 => _59.extra, 'optionalAccess', _60 => _60.nonce]), txHash: ref }
+      payload: { nonce: _optionalChain([accept, 'access', _74 => _74.extra, 'optionalAccess', _75 => _75.nonce]), txHash: ref }
     };
-    const headers = new Headers(_optionalChain([originalInit, 'optionalAccess', _61 => _61.headers]));
+    const headers = new Headers(_optionalChain([originalInit, 'optionalAccess', _76 => _76.headers]));
     headers.set(HEADER_SIGNATURE, buildSignatureHeader(signature));
     let lastResponse = null;
     let lastReason = null;
@@ -4042,7 +4693,7 @@ var PipRailClient = class {
         () => timeoutController.abort(),
         this.retryTimeoutMs
       );
-      const signal = _optionalChain([originalInit, 'optionalAccess', _62 => _62.signal]) && typeof AbortSignal.any === "function" ? AbortSignal.any([timeoutController.signal, originalInit.signal]) : timeoutController.signal;
+      const signal = _optionalChain([originalInit, 'optionalAccess', _77 => _77.signal]) && typeof AbortSignal.any === "function" ? AbortSignal.any([timeoutController.signal, originalInit.signal]) : timeoutController.signal;
       try {
         lastResponse = await fetch(url, {
           ..._nullishCoalesce(originalInit, () => ( {})),
@@ -4062,54 +4713,139 @@ var PipRailClient = class {
       }
       if (lastResponse.status !== 402) {
         const receipt = parseReceipt(lastResponse);
+        this.captureReceipt(lastResponse, url);
         this.safeEmit({ kind: "payment-settled", receipt });
         return lastResponse;
       }
-      lastReason = await _asyncNullishCoalesce(await readInvalidReason(lastResponse), async () => ( lastReason));
+      lastReason = await _asyncNullishCoalesce(await readInvalidReason(lastResponse), async () => ( lastReason));
+    }
+    const why = lastReason ? `${lastReason.error}${lastReason.detail ? ` \u2014 ${lastReason.detail}` : ""}` : "server gave no reason";
+    const unconfirmedNote = confirmed ? "" : " (broadcast but NOT locally confirmed \u2014 it may still have settled on-chain)";
+    this.safeEmit({
+      kind: "payment-failed",
+      reason: `server returned 402 after broadcasting payment ${ref}${unconfirmedNote} (${why})`,
+      ...lastReason ? { code: lastReason.error, detail: lastReason.detail } : {}
+    });
+    throw new (0, _chunkMWBT7MCEcjs.MaxRetriesExceededError)(
+      `Server still returned 402 after ${attempts} attempt(s) with on-chain proof ref=${ref}${unconfirmedNote}. Last server rejection: ${why}. Re-verify or re-submit ref=${ref} before retrying \u2014 never re-pay (it would double-spend).`,
+      { ref }
+    );
+  }
+  /**
+   * Pay a standard x402 `exact` rail — a SEPARATE, fundamentally more conservative
+   * path than {@link retryWithProof}. The buyer SIGNS an EIP-3009 authorization ONCE
+   * (the driver's `payExact`) and the server / merchant-chosen facilitator BROADCASTS
+   * it synchronously, so a blind re-POST of a still-in-flight authorization could
+   * double-BROADCAST it. Hence, unlike the onchain-proof loop:
+   *
+   *   • sign exactly once — reuse the SAME header on every retry, never re-sign;
+   *   • retry ONLY an explicit 402 (a definitive pre-broadcast rejection), bounded
+   *     well under `maxTimeoutSeconds` so the loop can't outlive the authorization;
+   *   • a post-POST transport error/timeout → {@link PaymentTimeoutError} carrying the
+   *     nonce (the facilitator MAY have settled — verify on-chain, NEVER re-pay);
+   *   • a 5xx → return as-is (server settle failure; the authorization stays valid +
+   *     its nonce unused) — no settled event, no spend;
+   *   • a 200 whose SettleResponse says `success:false` → a rejection, NEVER a spend;
+   *   • the spend is recorded EXACTLY ONCE, on an affirmative settlement only.
+   */
+  async payExactRail(net, wallet, accept, url, init, quote) {
+    if (!net.payExact) {
+      throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
+        `the ${net.family} family can't pay a standard 'exact' rail (supported on EVM, Solana, Algorand + NEAR today).`
+      );
+    }
+    throwIfAborted(_optionalChain([init, 'optionalAccess', _78 => _78.signal]));
+    const { payload, accepted, payerFrom, nonce } = await net.payExact(wallet, accept);
+    const headers = new Headers(_optionalChain([init, 'optionalAccess', _79 => _79.headers]));
+    headers.set(HEADER_SIGNATURE, buildExactSignatureHeader({ accepted, payload }));
+    const rejectDefinitive = (why2) => {
+      this.safeEmit({ kind: "payment-failed", reason: `exact: facilitator rejected nonce=${nonce} (${why2})`, code: why2 });
+      throw new (0, _chunkMWBT7MCEcjs.MaxRetriesExceededError)(
+        `exact: the facilitator rejected the payment (${why2}). Fix the cause, then re-present the SAME signed authorization (nonce=${nonce}) \u2014 do NOT re-sign a fresh nonce. ref=${nonce}.`,
+        { ref: nonce }
+      );
+    };
+    const deadline = Date.now() + Math.max(1, Math.floor(accept.maxTimeoutSeconds / 2)) * 1e3;
+    const maxAttempts = Math.min(this.maxRetries, 3);
+    let lastReason = null;
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+      if (attempt > 0) {
+        if (Date.now() >= deadline) break;
+        await new Promise((r) => setTimeout(r, Math.min(2e3, 400 * 2 ** (attempt - 1))));
+      }
+      throwIfAborted(_optionalChain([init, 'optionalAccess', _80 => _80.signal]));
+      const budget = Math.min(this.retryTimeoutMs, deadline - Date.now());
+      if (budget <= 0) break;
+      const timeoutController = new AbortController();
+      const timeoutId = setTimeout(() => timeoutController.abort(), budget);
+      const signal = _optionalChain([init, 'optionalAccess', _81 => _81.signal]) && typeof AbortSignal.any === "function" ? AbortSignal.any([timeoutController.signal, init.signal]) : timeoutController.signal;
+      let response;
+      try {
+        response = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), headers, signal });
+      } catch (err) {
+        throw new (0, _chunkMWBT7MCEcjs.PaymentTimeoutError)(
+          `exact: no response after submitting the authorization (nonce=${nonce}) to ${hostOf2(url)}. The facilitator may have already settled it \u2014 verify on-chain with authorizationState(${payerFrom}, ${nonce}) before re-presenting; do NOT re-pay.`,
+          { cause: err, ref: nonce }
+        );
+      } finally {
+        clearTimeout(timeoutId);
+      }
+      const settle = parseSettleResponse(response);
+      if (response.status === 402) {
+        if (settle && settle.success === false) rejectDefinitive(_nullishCoalesce(settle.errorReason, () => ( "the facilitator reported success:false")));
+        lastReason = await _asyncNullishCoalesce(await readInvalidReason(response), async () => ( lastReason));
+        continue;
+      }
+      if (response.ok && !(settle && settle.success === false)) {
+        const receipt = parseReceipt(response);
+        this.captureReceipt(response, url);
+        this.safeEmit({ kind: "payment-settled", receipt, ...settle ? { settle } : {} });
+        const ref = _optionalChain([settle, 'optionalAccess', _82 => _82.transaction]) || _optionalChain([receipt, 'optionalAccess', _83 => _83.transaction]) || `eip3009-nonce:${nonce}`;
+        this.recordSpend(quote, ref);
+        return response;
+      }
+      if (response.status >= 500) {
+        this.safeEmit({ kind: "payment-failed", reason: `exact: server ${response.status} \u2014 authorization nonce=${nonce} not settled` });
+        return response;
+      }
+      if (settle && settle.success === false) rejectDefinitive(_nullishCoalesce(settle.errorReason, () => ( "the facilitator reported success:false")));
+      this.safeEmit({ kind: "payment-failed", reason: `exact: server ${response.status} \u2014 authorization nonce=${nonce} not settled` });
+      return response;
     }
     const why = lastReason ? `${lastReason.error}${lastReason.detail ? ` \u2014 ${lastReason.detail}` : ""}` : "server gave no reason";
-    const unconfirmedNote = confirmed ? "" : " (broadcast but NOT locally confirmed \u2014 it may still have settled on-chain)";
     this.safeEmit({
       kind: "payment-failed",
-      reason: `server returned 402 after broadcasting payment ${ref}${unconfirmedNote} (${why})`,
+      reason: `exact: 402 after submitting authorization nonce=${nonce} (${why})`,
       ...lastReason ? { code: lastReason.error, detail: lastReason.detail } : {}
     });
     throw new (0, _chunkMWBT7MCEcjs.MaxRetriesExceededError)(
-      `Server still returned 402 after ${attempts} attempt(s) with on-chain proof ref=${ref}${unconfirmedNote}. Last server rejection: ${why}. Re-verify or re-submit ref=${ref} before retrying \u2014 never re-pay (it would double-spend).`,
-      { ref }
+      `exact: server still returned 402 after submitting the signed authorization (nonce=${nonce}). Last rejection: ${why}. Re-present the SAME authorization \u2014 do NOT re-sign a fresh nonce; verify authorizationState(${payerFrom}, ${nonce}) first. ref=${nonce}.`,
+      { ref: nonce }
     );
   }
   /**
-   * Pay a standard x402 `exact` rail — a SEPARATE, fundamentally more conservative
-   * path than {@link retryWithProof}. The buyer SIGNS an EIP-3009 authorization ONCE
-   * (the driver's `payExact`) and the server / merchant-chosen facilitator BROADCASTS
-   * it synchronously, so a blind re-POST of a still-in-flight authorization could
-   * double-BROADCAST it. Hence, unlike the onchain-proof loop:
-   *
-   *   • sign exactly once — reuse the SAME header on every retry, never re-sign;
-   *   • retry ONLY an explicit 402 (a definitive pre-broadcast rejection), bounded
-   *     well under `maxTimeoutSeconds` so the loop can't outlive the authorization;
-   *   • a post-POST transport error/timeout → {@link PaymentTimeoutError} carrying the
-   *     nonce (the facilitator MAY have settled — verify on-chain, NEVER re-pay);
-   *   • a 5xx → return as-is (server settle failure; the authorization stays valid +
-   *     its nonce unused) — no settled event, no spend;
-   *   • a 200 whose SettleResponse says `success:false` → a rejection, NEVER a spend;
-   *   • the spend is recorded EXACTLY ONCE, on an affirmative settlement only.
+   * The standard `upto` (metered) buyer path — a near-clone of {@link payExactRail} with TWO
+   * deltas: (1) it signs a Permit2-upto authorization for the MAX via `payUpto` + frames it
+   * with `buildUptoSignatureHeader`; (2) it records the ACTUAL settled amount (read off the
+   * SettleResponse's required `amount` field, via `recordSpend(quote, ref, settle.amount)`) in
+   * the ledger — the budget gated on the MAX, the ledger records the ACTUAL. A server that omits
+   * `settle.amount` FAILS SAFE to the MAX (over-counts, never under-counts). The buyer SIGNS, the
+   * merchant self-settles — the buyer never broadcasts.
    */
-  async payExactRail(net, wallet, accept, url, init, quote) {
-    if (!net.payExact) {
+  async payUptoRail(net, wallet, accept, url, init, quote) {
+    if (!net.payUpto) {
       throw new (0, _chunkMWBT7MCEcjs.UnsupportedSchemeError)(
-        `the ${net.family} family can't pay a standard 'exact' rail (supported on EVM, Solana, Algorand + NEAR today).`
+        `the ${net.family} family can't pay a standard 'upto' rail (EVM-Permit2 only today).`
       );
     }
-    throwIfAborted(_optionalChain([init, 'optionalAccess', _63 => _63.signal]));
-    const { payload, accepted, payerFrom, nonce } = await net.payExact(wallet, accept);
-    const headers = new Headers(_optionalChain([init, 'optionalAccess', _64 => _64.headers]));
-    headers.set(HEADER_SIGNATURE, buildExactSignatureHeader({ accepted, payload }));
+    throwIfAborted(_optionalChain([init, 'optionalAccess', _84 => _84.signal]));
+    const { payload, accepted, payerFrom, nonce } = await net.payUpto(wallet, accept);
+    const headers = new Headers(_optionalChain([init, 'optionalAccess', _85 => _85.headers]));
+    headers.set(HEADER_SIGNATURE, buildUptoSignatureHeader({ accepted, payload }));
     const rejectDefinitive = (why2) => {
-      this.safeEmit({ kind: "payment-failed", reason: `exact: facilitator rejected nonce=${nonce} (${why2})`, code: why2 });
+      this.safeEmit({ kind: "payment-failed", reason: `upto: facilitator rejected nonce=${nonce} (${why2})`, code: why2 });
       throw new (0, _chunkMWBT7MCEcjs.MaxRetriesExceededError)(
-        `exact: the facilitator rejected the payment (${why2}). Fix the cause, then re-present the SAME signed authorization (nonce=${nonce}) \u2014 do NOT re-sign a fresh nonce. ref=${nonce}.`,
+        `upto: the server rejected the payment (${why2}). Fix the cause, then re-present the SAME signed authorization (nonce=${nonce}) \u2014 do NOT re-sign a fresh nonce. ref=${nonce}.`,
         { ref: nonce }
       );
     };
@@ -4121,18 +4857,18 @@ var PipRailClient = class {
         if (Date.now() >= deadline) break;
         await new Promise((r) => setTimeout(r, Math.min(2e3, 400 * 2 ** (attempt - 1))));
       }
-      throwIfAborted(_optionalChain([init, 'optionalAccess', _65 => _65.signal]));
+      throwIfAborted(_optionalChain([init, 'optionalAccess', _86 => _86.signal]));
       const budget = Math.min(this.retryTimeoutMs, deadline - Date.now());
       if (budget <= 0) break;
       const timeoutController = new AbortController();
       const timeoutId = setTimeout(() => timeoutController.abort(), budget);
-      const signal = _optionalChain([init, 'optionalAccess', _66 => _66.signal]) && typeof AbortSignal.any === "function" ? AbortSignal.any([timeoutController.signal, init.signal]) : timeoutController.signal;
+      const signal = _optionalChain([init, 'optionalAccess', _87 => _87.signal]) && typeof AbortSignal.any === "function" ? AbortSignal.any([timeoutController.signal, init.signal]) : timeoutController.signal;
       let response;
       try {
         response = await fetch(url, { ..._nullishCoalesce(init, () => ( {})), headers, signal });
       } catch (err) {
         throw new (0, _chunkMWBT7MCEcjs.PaymentTimeoutError)(
-          `exact: no response after submitting the authorization (nonce=${nonce}) to ${hostOf2(url)}. The facilitator may have already settled it \u2014 verify on-chain with authorizationState(${payerFrom}, ${nonce}) before re-presenting; do NOT re-pay.`,
+          `upto: no response after submitting the authorization (nonce=${nonce}) to ${hostOf2(url)}. The merchant may have already settled it \u2014 verify on-chain before re-presenting; do NOT re-pay.`,
           { cause: err, ref: nonce }
         );
       } finally {
@@ -4140,46 +4876,48 @@ var PipRailClient = class {
       }
       const settle = parseSettleResponse(response);
       if (response.status === 402) {
-        if (settle && settle.success === false) rejectDefinitive(_nullishCoalesce(settle.errorReason, () => ( "the facilitator reported success:false")));
+        if (settle && settle.success === false) rejectDefinitive(_nullishCoalesce(settle.errorReason, () => ( "the server reported success:false")));
         lastReason = await _asyncNullishCoalesce(await readInvalidReason(response), async () => ( lastReason));
         continue;
       }
       if (response.ok && !(settle && settle.success === false)) {
         const receipt = parseReceipt(response);
+        this.captureReceipt(response, url);
         this.safeEmit({ kind: "payment-settled", receipt, ...settle ? { settle } : {} });
-        const ref = _optionalChain([settle, 'optionalAccess', _67 => _67.transaction]) || _optionalChain([receipt, 'optionalAccess', _68 => _68.transaction]) || `eip3009-nonce:${nonce}`;
-        this.recordSpend(quote, ref);
+        const ref = _optionalChain([settle, 'optionalAccess', _88 => _88.transaction]) || _optionalChain([receipt, 'optionalAccess', _89 => _89.transaction]) || `upto-nonce:${nonce}`;
+        const settledAmount = _nullishCoalesce(_optionalChain([settle, 'optionalAccess', _90 => _90.amount]), () => ( _optionalChain([receipt, 'optionalAccess', _91 => _91.amount])));
+        this.recordSpend(quote, ref, settledAmount);
         return response;
       }
       if (response.status >= 500) {
-        this.safeEmit({ kind: "payment-failed", reason: `exact: server ${response.status} \u2014 authorization nonce=${nonce} not settled` });
+        this.safeEmit({ kind: "payment-failed", reason: `upto: server ${response.status} \u2014 authorization nonce=${nonce} not settled` });
         return response;
       }
-      if (settle && settle.success === false) rejectDefinitive(_nullishCoalesce(settle.errorReason, () => ( "the facilitator reported success:false")));
-      this.safeEmit({ kind: "payment-failed", reason: `exact: server ${response.status} \u2014 authorization nonce=${nonce} not settled` });
+      if (settle && settle.success === false) rejectDefinitive(_nullishCoalesce(settle.errorReason, () => ( "the server reported success:false")));
+      this.safeEmit({ kind: "payment-failed", reason: `upto: server ${response.status} \u2014 authorization nonce=${nonce} not settled` });
       return response;
     }
     const why = lastReason ? `${lastReason.error}${lastReason.detail ? ` \u2014 ${lastReason.detail}` : ""}` : "server gave no reason";
     this.safeEmit({
       kind: "payment-failed",
-      reason: `exact: 402 after submitting authorization nonce=${nonce} (${why})`,
+      reason: `upto: 402 after submitting authorization nonce=${nonce} (${why})`,
       ...lastReason ? { code: lastReason.error, detail: lastReason.detail } : {}
     });
     throw new (0, _chunkMWBT7MCEcjs.MaxRetriesExceededError)(
-      `exact: server still returned 402 after submitting the signed authorization (nonce=${nonce}). Last rejection: ${why}. Re-present the SAME authorization \u2014 do NOT re-sign a fresh nonce; verify authorizationState(${payerFrom}, ${nonce}) first. ref=${nonce}.`,
+      `upto: server still returned 402 after submitting the signed authorization (nonce=${nonce}). Last rejection: ${why}. Re-present the SAME authorization \u2014 do NOT re-sign a fresh nonce. ref=${nonce}.`,
       { ref: nonce }
     );
   }
-};
+}, _class2);
 function throwIfAborted(signal) {
-  if (_optionalChain([signal, 'optionalAccess', _69 => _69.aborted])) {
+  if (_optionalChain([signal, 'optionalAccess', _92 => _92.aborted])) {
     throw _nullishCoalesce(signal.reason, () => ( new DOMException("This operation was aborted.", "AbortError")));
   }
 }
 function safeBig(s) {
   try {
     return BigInt(s);
-  } catch (e31) {
+  } catch (e38) {
     return 0n;
   }
 }
@@ -4242,10 +4980,10 @@ function buildFundingHint(options, chainLabel) {
     return `Couldn't fully read your wallet on ${chainLabel} (RPC throttled) \u2014 retry; you may already be able to pay ${target.quote.amountFormatted} ${sym}.`;
   }
   const parts = [];
-  if (target.blockers.includes("INSUFFICIENT_TOKEN") && _optionalChain([target, 'access', _70 => _70.shortfall, 'optionalAccess', _71 => _71.token])) {
+  if (target.blockers.includes("INSUFFICIENT_TOKEN") && _optionalChain([target, 'access', _93 => _93.shortfall, 'optionalAccess', _94 => _94.token])) {
     parts.push(`top up ${target.shortfall.token} ${sym}`);
   }
-  if (target.blockers.includes("INSUFFICIENT_GAS") && _optionalChain([target, 'access', _72 => _72.shortfall, 'optionalAccess', _73 => _73.native])) {
+  if (target.blockers.includes("INSUFFICIENT_GAS") && _optionalChain([target, 'access', _95 => _95.shortfall, 'optionalAccess', _96 => _96.native])) {
     parts.push(`add ~${target.shortfall.native} ${target.cost.feeSymbol} for gas`);
   }
   return parts.length ? `Can't settle on ${chainLabel}: ${parts.join(" and ")} (to pay ${target.quote.amountFormatted} ${sym}).` : `Can't settle on ${chainLabel} for ${target.quote.amountFormatted} ${sym}.`;
@@ -4259,7 +4997,7 @@ async function planAcross(clients, url, init) {
   const status = best ? "ready" : options.some((o) => o.state === "unknown") ? "unknown" : "blocked";
   return {
     url,
-    network: _nullishCoalesce(_optionalChain([best, 'optionalAccess', _74 => _74.accept, 'access', _75 => _75.network]), () => ( live[0].network)),
+    network: _nullishCoalesce(_optionalChain([best, 'optionalAccess', _97 => _97.accept, 'access', _98 => _98.network]), () => ( live[0].network)),
     status,
     payable: best !== null,
     best,
@@ -4307,7 +5045,7 @@ function reasonCodeForPolicy(code) {
 function hostOf2(url) {
   try {
     return new URL(url).hostname;
-  } catch (e32) {
+  } catch (e39) {
     return url;
   }
 }
@@ -4324,8 +5062,8 @@ function isReplayableBodyInit(value) {
 async function readInvalidReason(response) {
   try {
     const body = await response.clone().json();
-    const ext = _optionalChain([body, 'optionalAccess', _76 => _76.extensions]);
-    const piprail = _optionalChain([ext, 'optionalAccess', _77 => _77.piprail]);
+    const ext = _optionalChain([body, 'optionalAccess', _99 => _99.extensions]);
+    const piprail = _optionalChain([ext, 'optionalAccess', _100 => _100.piprail]);
     if (piprail && typeof piprail.code === "string") {
       return {
         error: piprail.code,
@@ -4344,12 +5082,44 @@ async function readInvalidReason(response) {
         detail: typeof body.invalidMessage === "string" ? body.invalidMessage : ""
       };
     }
-  } catch (e33) {
+  } catch (e40) {
   }
   const settle = parseSettleResponse(response);
-  if (_optionalChain([settle, 'optionalAccess', _78 => _78.errorReason])) return { error: settle.errorReason, detail: "" };
+  if (_optionalChain([settle, 'optionalAccess', _101 => _101.errorReason])) return { error: settle.errorReason, detail: "" };
   return null;
 }
+var EVM_PRESET_FOR_CHAINID = {
+  1: "ethereum",
+  8453: "base",
+  137: "polygon",
+  42161: "arbitrum",
+  10: "optimism",
+  43114: "avalanche",
+  56: "bnb"
+};
+function chainSelectorForNetwork(network, rpcUrl) {
+  const chainId = chainIdFromNetwork(network);
+  if (chainId !== null) {
+    const preset = EVM_PRESET_FOR_CHAINID[chainId];
+    if (preset) return preset;
+    return { id: chainId, rpcUrl: _nullishCoalesce(rpcUrl, () => ( "")) };
+  }
+  const namespace = _nullishCoalesce(network.split(":")[0], () => ( ""));
+  return namespace === "tvm" ? "ton" : namespace;
+}
+function receiptAgeSeconds(verifiedAt) {
+  const t = Date.parse(verifiedAt);
+  if (Number.isNaN(t)) return 0;
+  return Math.max(0, Math.round((Date.now() - t) / 1e3));
+}
+function receiptIssuedAtSeconds(verifiedAt) {
+  const t = Date.parse(verifiedAt);
+  if (Number.isNaN(t)) return 0;
+  return Math.floor(t / 1e3);
+}
+function sameAddress(a, b) {
+  return typeof a === "string" && typeof b === "string" && a.toLowerCase() === b.toLowerCase();
+}
 
 // src/payer.ts
 var MultiChainPayer = class _MultiChainPayer {
@@ -4413,7 +5183,7 @@ var MultiChainPayer = class _MultiChainPayer {
         ledger,
         ...opts.policy ? { policy: opts.policy } : {},
         ...opts.schemes ? { schemes: opts.schemes } : {},
-        ..._optionalChain([opts, 'access', _79 => _79.rpcUrls, 'optionalAccess', _80 => _80[chain]]) ? { rpcUrl: opts.rpcUrls[chain] } : {},
+        ..._optionalChain([opts, 'access', _102 => _102.rpcUrls, 'optionalAccess', _103 => _103[chain]]) ? { rpcUrl: opts.rpcUrls[chain] } : {},
         ...opts.onBeforePay ? { onBeforePay: opts.onBeforePay } : {},
         ...opts.onEvent ? { onEvent: opts.onEvent } : {},
         ...opts.maxPaymentRetries != null ? { maxPaymentRetries: opts.maxPaymentRetries } : {},
@@ -4471,7 +5241,7 @@ var MultiChainPayer = class _MultiChainPayer {
    * {@link PipRailClient.post}.
    */
   post(url, body, init) {
-    const headers = new Headers(_optionalChain([init, 'optionalAccess', _81 => _81.headers]));
+    const headers = new Headers(_optionalChain([init, 'optionalAccess', _104 => _104.headers]));
     let payload;
     if (body === void 0 || body === null) {
       payload = void 0;
@@ -4582,7 +5352,13 @@ var BRAND = {
 };
 var WHAT = 'This is an x402 "402 Payment Required" endpoint. Pay one of the offered rails to access it.';
 function howFor(scheme) {
-  return scheme === "exact" ? "Standard x402 exact rail \u2014 sign an EIP-3009 / Permit2 / SVM authorization; any stock x402 client (e.g. @x402/fetch) can pay this." : "Pay this amount on-chain to payTo, then resubmit with a payment-signature header carrying the proof ref + nonce. Easiest with @piprail/sdk (see sdk.install).";
+  if (scheme === "exact") {
+    return "Standard x402 exact rail \u2014 sign an EIP-3009 / Permit2 / SVM authorization; any stock x402 client (e.g. @x402/fetch) can pay this.";
+  }
+  if (scheme === "upto") {
+    return "Standard x402 upto (metered) rail \u2014 sign a Permit2 authorization for the MAX amount; the server settles the ACTUAL (\u2264 max) after serving. BUDGET AGAINST THE MAX \u2014 the server MAY fully charge it. EVM-Permit2 only; enable with schemes:['upto'].";
+  }
+  return "Pay this amount on-chain to payTo, then resubmit with a payment-signature header carrying the proof ref + nonce. Easiest with @piprail/sdk (see sdk.install).";
 }
 function railOf(a) {
   const extra = _nullishCoalesce(a.extra, () => ( {}));
@@ -4609,19 +5385,20 @@ function buildSelfDescription(input) {
     mcp: { run: BRAND.mcpRun, tool: "piprail_pay_request" },
     docs: { home: BRAND.home, agents: BRAND.docs, pay: BRAND.payDocs },
     discovery: { openapi: "/openapi.json", wellKnown: "/.well-known/x402" },
+    ...input.verifiableReceipts ? { verifiableReceipts: true } : {},
     ...input.instruction ? { instruction: input.instruction } : {}
   };
 }
 function buildEndpointInfo(input) {
   const d = input.descriptor;
-  const summary = _nullishCoalesce(_optionalChain([d, 'optionalAccess', _82 => _82.summary]), () => ( input.description));
-  const hasInput = _optionalChain([d, 'optionalAccess', _83 => _83.queryParams]) && Object.keys(d.queryParams).length > 0;
+  const summary = _nullishCoalesce(_optionalChain([d, 'optionalAccess', _105 => _105.summary]), () => ( input.description));
+  const hasInput = _optionalChain([d, 'optionalAccess', _106 => _106.queryParams]) && Object.keys(d.queryParams).length > 0;
   const endpoint = {
     ...summary ? { summary } : {},
-    ..._optionalChain([d, 'optionalAccess', _84 => _84.method]) ? { method: d.method.toUpperCase() } : {},
+    ..._optionalChain([d, 'optionalAccess', _107 => _107.method]) ? { method: d.method.toUpperCase() } : {},
     ...input.mimeType ? { mimeType: input.mimeType } : {},
     ...hasInput ? { input: d.queryParams } : {},
-    ..._optionalChain([d, 'optionalAccess', _85 => _85.output]) ? { output: d.output } : {}
+    ..._optionalChain([d, 'optionalAccess', _108 => _108.output]) ? { output: d.output } : {}
   };
   return Object.keys(endpoint).length > 0 ? endpoint : void 0;
 }
@@ -4708,17 +5485,21 @@ and pay with the tools below.
 Always plan before you pay so you never commit to a payment you cannot finish.
 
 ## Gasless \u2014 the exact rail (zero gas for you)
-A 402 may offer up to two rails; you don't choose per payment \u2014 the client does, automatically:
+A 402 may offer up to three rails; you don't choose per payment \u2014 the client does, automatically:
 - onchain-proof (PipRail's default): you broadcast the payment yourself and pay the network gas
   (the native coin \u2014 ETH/SOL/\u2026). Works on every chain.
 - exact (the ratified x402 rail, opt-in): you only SIGN; the server \u2014 or a facilitator it chose
   (e.g. PayAI) \u2014 broadcasts it, so you pay ZERO gas (you need only the token, no native coin). It
   works on EVM, Solana + Algorand, and the on-chain method (EIP-3009 / Permit2 / SVM / Algorand
   fee-pooled group) is picked automatically.
+- upto (the metered/variable x402 rail, opt-in, EVM): the amount you see is a MAXIMUM \u2014 you sign
+  a ceiling, the server meters real usage and settles the ACTUAL (<= the max). BUDGET AGAINST THE MAX:
+  the plan/policy treat the ceiling as the spend (a server may charge up to it), so a payable plan
+  means the MAX fits your budget; the settled actual is recorded for reconciliation.
 When the exact scheme is enabled AND balance-aware routing is on, paying picks the cheapest
 settleable rail \u2014 i.e. the gasless exact one. Nothing changes in your loop: quote \u2192 plan \u2192 pay is
-identical. The exact scheme is OPT-IN by the operator (MCP: PIPRAIL_SCHEMES=onchain-proof,exact);
-you can't enable it yourself, but you can report when a 402 needs it (see UNSUPPORTED_SCHEME below).
+identical. The exact/upto schemes are OPT-IN by the operator (MCP: PIPRAIL_SCHEMES=onchain-proof,exact,upto);
+you can't enable them yourself, but you can report when a 402 needs one (see UNSUPPORTED_SCHEME below).
 
 ## Reading a refusal \u2014 never crash, never double-spend
 A failed pay returns a STRUCTURED object, never a thrown error you must catch:
@@ -4782,7 +5563,7 @@ async function readBody(res) {
   if (!text) return null;
   try {
     return JSON.parse(text);
-  } catch (e34) {
+  } catch (e41) {
     return text;
   }
 }
@@ -5001,11 +5782,13 @@ function paymentTools(client) {
             }
             res = await client.fetch(url, { method, headers, body });
           }
+          const verifiable = parseReceiptExtension(res);
           return {
             status: res.status,
             ok: res.ok,
             body: await readBody(res),
-            receipt: parseReceipt(res)
+            receipt: parseReceipt(res),
+            ...verifiable ? { verifiableReceipt: { ...verifiable, resource: { url } } } : {}
           };
         } catch (err) {
           if (err instanceof _chunkMWBT7MCEcjs.PipRailError) {
@@ -5125,6 +5908,38 @@ function paymentTools(client) {
       },
       parameters: { type: "object", properties: {}, additionalProperties: false },
       invoke: async () => ({ guide: PIPRAIL_AGENT_GUIDE })
+    },
+    {
+      name: "piprail_verify_receipt",
+      description: "Re-verify a PipRail VERIFIABLE RECEIPT against the chain \u2014 confirm a payment REALLY settled (the funds provably moved to payTo for AT LEAST the stated amount) WITHOUT trusting whoever handed you the receipt. Read-only and WALLET-FREE: pass the PipRailReceipt JSON (from a prior piprail_pay_request `verifiableReceipt`, or any third party). Returns { ok, onChain:{payTo,asset,amount,payer}, matchesClaims, ageSeconds, error? }: `ok` = the chain confirms the settlement; `onChain.payer` is RE-DERIVED from the tx and `matchesClaims:false` means the receipt forged the payer; `amount` is a verified lower bound. Pass `rpcUrl` for a chain outside the common presets.",
+      annotations: {
+        title: "Verify a payment receipt",
+        readOnlyHint: true,
+        // re-reads the chain; moves nothing, needs no wallet
+        idempotentHint: true,
+        openWorldHint: true
+        // reads an on-chain tx via RPC
+      },
+      parameters: {
+        type: "object",
+        properties: {
+          receipt: {
+            type: "object",
+            description: "The PipRailReceipt JSON ({ piprail, receipt, resource, decimals? }) to re-verify."
+          },
+          rpcUrl: {
+            type: "string",
+            description: "Optional RPC URL for the receipt's chain (required for chains outside the common presets)."
+          }
+        },
+        required: ["receipt"],
+        additionalProperties: false
+      },
+      invoke: async (args) => {
+        const receipt = args.receipt;
+        const opts = args.rpcUrl ? { rpcUrl: String(args.rpcUrl) } : void 0;
+        return await PipRailClient.verifyReceipt(receipt, opts);
+      }
     }
   ];
 }
@@ -5181,7 +5996,7 @@ function buildBazaarExtension(descriptor = {}) {
 function pathOf(url) {
   try {
     return new URL(url).pathname || "/";
-  } catch (e35) {
+  } catch (e42) {
     return url.startsWith("/") ? url : `/${url}`;
   }
 }
@@ -5290,28 +6105,28 @@ async function fetchFacilitatorFeePayer(url, network, timeoutMs = 8e3) {
     const res = await fetch(`${base2}/supported`, { signal: ctrl.signal });
     if (!res.ok) return void 0;
     const body = await res.json();
-    const kinds = Array.isArray(_optionalChain([body, 'optionalAccess', _86 => _86.kinds])) ? body.kinds : [];
+    const kinds = Array.isArray(_optionalChain([body, 'optionalAccess', _109 => _109.kinds])) ? body.kinds : [];
     const want = normalizeNetwork(network);
-    const kind = kinds.find((k) => _optionalChain([k, 'optionalAccess', _87 => _87.scheme]) === "exact" && normalizeNetwork(String(_nullishCoalesce(_optionalChain([k, 'optionalAccess', _88 => _88.network]), () => ( "")))) === want);
-    const fp = _optionalChain([kind, 'optionalAccess', _89 => _89.extra, 'optionalAccess', _90 => _90.feePayer]);
+    const kind = kinds.find((k) => _optionalChain([k, 'optionalAccess', _110 => _110.scheme]) === "exact" && normalizeNetwork(String(_nullishCoalesce(_optionalChain([k, 'optionalAccess', _111 => _111.network]), () => ( "")))) === want);
+    const fp = _optionalChain([kind, 'optionalAccess', _112 => _112.extra, 'optionalAccess', _113 => _113.feePayer]);
     return typeof fp === "string" ? fp : void 0;
-  } catch (e36) {
+  } catch (e43) {
     return void 0;
   } finally {
     clearTimeout(timer);
   }
 }
 function parseFacilitatorSupported(body) {
-  const kinds = _optionalChain([body, 'optionalAccess', _91 => _91.kinds]);
+  const kinds = _optionalChain([body, 'optionalAccess', _114 => _114.kinds]);
   if (!Array.isArray(kinds)) return [];
   const out = [];
   for (const k of kinds) {
     if (!k || typeof k !== "object") continue;
     const o = k;
     if (typeof o.scheme !== "string" || typeof o.network !== "string") continue;
-    const fp = _optionalChain([o, 'access', _92 => _92.extra, 'optionalAccess', _93 => _93.feePayer]);
+    const fp = _optionalChain([o, 'access', _115 => _115.extra, 'optionalAccess', _116 => _116.feePayer]);
     const ver = o.x402Version;
-    const method = _optionalChain([o, 'access', _94 => _94.extra, 'optionalAccess', _95 => _95.assetTransferMethod]);
+    const method = _optionalChain([o, 'access', _117 => _117.extra, 'optionalAccess', _118 => _118.assetTransferMethod]);
     out.push({
       scheme: o.scheme,
       network: o.network,
@@ -5330,7 +6145,7 @@ async function facilitatorCoverage(url, timeoutMs = 8e3) {
     const res = await fetch(`${base2}/supported`, { signal: ctrl.signal });
     if (!res.ok) return [];
     return parseFacilitatorSupported(await res.json());
-  } catch (e37) {
+  } catch (e44) {
     return [];
   } finally {
     clearTimeout(timer);
@@ -5359,7 +6174,7 @@ async function post(url, body, headers) {
   let json = null;
   try {
     json = await res.json();
-  } catch (e38) {
+  } catch (e45) {
   }
   return { status: res.status, json };
 }
@@ -5774,17 +6589,40 @@ function normaliseExactOption(exact) {
   return exact;
 }
 var TRANSIENT_VERIFY_CODES = /* @__PURE__ */ new Set(["tx_not_found", "insufficient_confirmations"]);
+function nowUnixSeconds(verifiedAt) {
+  if (verifiedAt) {
+    const t = Date.parse(verifiedAt);
+    if (!Number.isNaN(t)) return Math.floor(t / 1e3);
+  }
+  return Math.floor(Date.now() / 1e3);
+}
 function createPaymentGate(options) {
   const minConfirmations = _nullishCoalesce(options.minConfirmations, () => ( 1));
   const maxTimeoutSeconds = _nullishCoalesce(options.maxTimeoutSeconds, () => ( 600));
   const genNonce = _nullishCoalesce(options.generateNonce, () => ( (() => globalThis.crypto.randomUUID())));
   const exactOption = normaliseExactOption(options.exact);
+  const receiptsOn = options.receipts !== void 0 && options.receipts !== false;
+  const receiptOpt = typeof options.receipts === "object" ? options.receipts : {};
+  const receiptIncludeTxHash = receiptOpt.includeTxHash !== false;
+  const receiptResourceUrl = _nullishCoalesce(receiptOpt.resource, () => ( ""));
+  const attestWallet = receiptOpt.attest && "wallet" in receiptOpt.attest ? receiptOpt.attest.wallet : void 0;
+  const attestJws = receiptOpt.attest && "jws" in receiptOpt.attest;
+  let attestWarned = false;
+  function warnAttestDegrade(reason) {
+    if (attestWarned) return;
+    attestWarned = true;
+    try {
+      console.warn(`[piprail] receipts.attest ${reason}; emitting an unsigned Tier-1 receipt instead.`);
+    } catch (e46) {
+    }
+  }
   let resolved;
   function ready() {
     if (resolved) return resolved;
     const p = (async () => {
       const accepts = normaliseAccepts(options);
       const exactSkips = [];
+      const uptoSkips = [];
       const specs = await Promise.all(
         accepts.map(async (a) => {
           const net = await resolveNetwork2({ chain: a.chain, rpcUrl: _nullishCoalesce(a.rpcUrl, () => ( options.rpcUrl)) });
@@ -5803,13 +6641,23 @@ function createPaymentGate(options) {
             if (outcome.rail) spec.exact = outcome.rail;
             else if (outcome.skipReason) exactSkips.push(outcome.skipReason);
           }
+          if (options.upto) {
+            const upto = await resolveUptoRail(net, asset);
+            if (upto) spec.upto = upto;
+            else uptoSkips.push(`${net.network}/${asset}`);
+          }
           return spec;
         })
       );
+      if (options.upto && !specs.some((s) => s.upto)) {
+        throw new Error(
+          `requirePayment: \`upto\` (the metered rail) was requested but none of the offered rails support it (tried: ${uptoSkips.join(", ") || "none"}). The \`upto\` scheme is EVM-Permit2 ONLY \u2014 an ERC-20 on a chain with the x402UptoPermit2Proxy deployed (Ethereum/Base/Arbitrum/Optimism/Polygon/BNB), NOT a native coin, NOT a non-EVM family. (Native coins + non-Permit2 chains can never carry \`upto\`.)`
+        );
+      }
       if (exactOption && !specs.some((s) => s.exact)) {
         const why = exactSkips.length > 0 ? exactSkips.join(" ") : "The standard `exact` rail is EVM ERC-20 (EIP-3009 \u2014 USDC / EURC \u2014 or Permit2, e.g. Binance-Peg USDC on BNB) or a Solana SPL token (SVM) \u2014 NOT native coins, NOT families without a standard `exact` scheme.";
         if (exactOption.settle === "keyless") {
-          if (typeof process === "undefined" || !_optionalChain([process, 'optionalAccess', _96 => _96.env, 'optionalAccess', _97 => _97.PIPRAIL_NO_HINTS])) {
+          if (typeof process === "undefined" || !_optionalChain([process, 'optionalAccess', _119 => _119.env, 'optionalAccess', _120 => _120.PIPRAIL_NO_HINTS])) {
             console.warn(
               `[piprail] exact: true \u2014 no offered chain has a gasless \`exact\` rail available, so this gate serves ONCHAIN-PROOF ONLY (buyers PAY GAS \u2014 the fallback when no facilitator can sponsor). ${why} To be gasless: pin \`exact: { settle: { facilitator } }\` or self-settle \`exact: { settle: 'self', relayer }\`. (Suppress with PIPRAIL_NO_HINTS=1.)`
             );
@@ -5837,7 +6685,7 @@ function createPaymentGate(options) {
           skipReason: `${net.network}: \`exact: true\` found no known keyless facilitator for this network. Pass \`exact: { settle: { facilitator } }\`, \`exact: { settle: 'self', relayer }\`, or see the coverage map (KNOWN_FACILITATORS / docs.piprail.com).`
         };
       }
-      if (typeof process === "undefined" || _optionalChain([process, 'optionalAccess', _98 => _98.env, 'optionalAccess', _99 => _99.NODE_ENV]) !== "production" && !_optionalChain([process, 'optionalAccess', _100 => _100.env, 'optionalAccess', _101 => _101.PIPRAIL_NO_HINTS])) {
+      if (typeof process === "undefined" || _optionalChain([process, 'optionalAccess', _121 => _121.env, 'optionalAccess', _122 => _122.NODE_ENV]) !== "production" && !_optionalChain([process, 'optionalAccess', _123 => _123.env, 'optionalAccess', _124 => _124.PIPRAIL_NO_HINTS])) {
         console.warn(
           `[piprail] exact: keyless rail on ${net.network} auto-settles via ${picked.url} (zero-config; pin \`exact.settle.facilitator\` in production).`
         );
@@ -5885,7 +6733,27 @@ function createPaymentGate(options) {
     };
     return { rail: { method: info.method, ...info.extra ? { extra: info.extra } : {}, mode } };
   }
-  const hasCustomStore = Boolean(options.isUsed || options.markUsed);
+  async function resolveUptoRail(net, asset) {
+    const cfg = options.upto;
+    if (!net.resolveUptoRail) return null;
+    if (cfg.relayer === void 0) {
+      throw new Error(
+        "requirePayment: `upto` needs a `relayer` wallet (the gas-paying key that self-settles the metered actual AND is the bound witness.facilitator), e.g. upto: { relayer: { key }, settleAmount }."
+      );
+    }
+    const relayer = net.bindWallet(cfg.relayer);
+    const info = await net.resolveUptoRail({ asset, relayer });
+    if (!info) return null;
+    return { method: info.method, ...info.extra ? { extra: info.extra } : {}, relayer };
+  }
+  const hasIsUsed = typeof options.isUsed === "function";
+  const hasMarkUsed = typeof options.markUsed === "function";
+  if (hasIsUsed !== hasMarkUsed) {
+    throw new Error(
+      "requirePayment/createPaymentGate: `isUsed` and `markUsed` must be provided TOGETHER \u2014 a custom replay store needs both a read and a write. Supplying only " + (hasIsUsed ? "`isUsed`" : "`markUsed`") + " silently disables replay protection (double-spend). Provide both, or neither (the built-in in-memory store)."
+    );
+  }
+  const hasCustomStore = hasIsUsed && hasMarkUsed;
   const localUsed = /* @__PURE__ */ new Map();
   const replayWindowMs = maxTimeoutSeconds * 1e3;
   function pruneUsed(now) {
@@ -5948,10 +6816,33 @@ function createPaymentGate(options) {
       }
     };
   }
+  function buildUptoAccept(s) {
+    const rail = s.upto;
+    return {
+      scheme: "upto",
+      network: s.net.network,
+      amount: s.amountBase.toString(),
+      // the authorized MAX (base units)
+      asset: s.asset,
+      payTo: s.payTo,
+      maxTimeoutSeconds,
+      extra: {
+        assetTransferMethod: "permit2-upto",
+        // facilitatorAddress comes from rail.extra; the spread below carries it (+ name/version).
+        facilitatorAddress: _nullishCoalesce(_optionalChain([rail, 'access', _125 => _125.extra, 'optionalAccess', _126 => _126.facilitatorAddress]), () => ( "")),
+        minConfirmations,
+        decimals: s.decimals,
+        amountFormatted: s.amountFormatted,
+        ...s.symbol ? { symbol: s.symbol } : {},
+        ...rail.extra
+      }
+    };
+  }
   function buildAccepts(specs, nonce) {
     const out = [];
     for (const s of specs) {
       if (s.exact) out.push(buildExactAccept(s));
+      if (s.upto) out.push(buildUptoAccept(s));
       out.push(buildAccept(s, nonce));
     }
     return out;
@@ -5969,9 +6860,10 @@ function createPaymentGate(options) {
     const selfDescribe = options.selfDescribe === false ? void 0 : buildSelfDescription({
       accepts,
       instruction: describeChallenge({ x402Version: 2, resource: { url: resourceUrl }, accepts }),
-      ...endpointInfo ? { endpoint: endpointInfo } : {}
+      ...endpointInfo ? { endpoint: endpointInfo } : {},
+      ...receiptsOn ? { verifiableReceipts: true } : {}
     });
-    const rejectionExt = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _102 => _102.extensions]), () => ( {}));
+    const rejectionExt = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _127 => _127.extensions]), () => ( {}));
     const rejectionPiprail = _nullishCoalesce(rejectionExt.piprail, () => ( {}));
     const bodyPiprail = { ..._nullishCoalesce(selfDescribe, () => ( {})), ...rejectionPiprail };
     const bodyExtensions = {
@@ -5991,7 +6883,7 @@ function createPaymentGate(options) {
         ...options.mimeType ? { mimeType: options.mimeType } : {}
       },
       accepts,
-      ..._optionalChain([opts, 'optionalAccess', _103 => _103.error]) ? { error: opts.error } : {},
+      ..._optionalChain([opts, 'optionalAccess', _128 => _128.error]) ? { error: opts.error } : {},
       ...Object.keys(bodyExtensions).length > 0 ? { extensions: bodyExtensions } : {}
     };
     const headerChallenge = {
@@ -6023,7 +6915,7 @@ function createPaymentGate(options) {
     let amountFormatted = receipt.amount;
     try {
       amountFormatted = _chunkMWBT7MCEcjs.formatUnits.call(void 0, BigInt(receipt.amount), spec.decimals);
-    } catch (e39) {
+    } catch (e47) {
     }
     return {
       ...receipt,
@@ -6037,7 +6929,7 @@ function createPaymentGate(options) {
     if (!options.onPaidError) return;
     try {
       options.onPaidError(error, receipt);
-    } catch (e40) {
+    } catch (e48) {
     }
   }
   function fireOnPaid(receipt) {
@@ -6058,11 +6950,60 @@ function createPaymentGate(options) {
     if (options.awaitOnPaid) await fireOnPaid(paid);
     else void fireOnPaid(paid);
   }
+  async function buildPaidResult(spec, receipt, nonce) {
+    if (!receiptsOn) {
+      return { kind: "paid", receipt, receiptHeader: buildReceiptHeader(receipt) };
+    }
+    try {
+      const stamped = {
+        ...receipt,
+        ...nonce ? { nonce } : {},
+        // §5.3: a suppressed tx is the empty string on the wire, never a missing key.
+        ...receiptIncludeTxHash ? {} : { transaction: "" }
+      };
+      const attestation = await maybeSignAttestation(spec, stamped);
+      const extensions = buildReceiptExtension({
+        receipt: stamped,
+        resource: { url: receiptResourceUrl },
+        decimals: spec.decimals,
+        ...attestation ? { attestation } : {}
+      });
+      return { kind: "paid", receipt: stamped, receiptHeader: buildReceiptHeader(stamped, extensions) };
+    } catch (e49) {
+      return { kind: "paid", receipt, receiptHeader: buildReceiptHeader(receipt) };
+    }
+  }
+  async function maybeSignAttestation(spec, stamped) {
+    if (attestJws) {
+      warnAttestDegrade("JWS attestation is not yet implemented (R3)");
+      return void 0;
+    }
+    if (attestWallet === void 0) return void 0;
+    if (typeof spec.net.signReceipt !== "function") {
+      warnAttestDegrade(`is EVM-only; the ${spec.net.family} rail can't sign an EIP-712 attestation`);
+      return void 0;
+    }
+    try {
+      const wallet = spec.net.bindWallet(attestWallet);
+      return await spec.net.signReceipt(wallet, {
+        payTo: spec.payTo,
+        network: spec.net.network,
+        resourceUrl: receiptResourceUrl,
+        payer: stamped.payer,
+        issuedAt: nowUnixSeconds(stamped.verifiedAt),
+        // §5.3: the signed message carries the empty string for a suppressed tx, never omitted.
+        transaction: receiptIncludeTxHash ? stamped.transaction : ""
+      });
+    } catch (e50) {
+      warnAttestDegrade("signing failed");
+      return void 0;
+    }
+  }
   function reportOnFailedError(error, failure) {
     if (!options.onFailedError) return;
     try {
       options.onFailedError(error, failure);
-    } catch (e41) {
+    } catch (e51) {
     }
   }
   function fireOnFailed(failure) {
@@ -6084,6 +7025,14 @@ function createPaymentGate(options) {
     if (options.awaitOnFailed) await fireOnFailed(failure);
     else void fireOnFailed(failure);
   }
+  function railExtra(full) {
+    const out = {};
+    for (const k of ["assetTransferMethod", "facilitatorAddress", "name", "version"]) {
+      const v = full[k];
+      if (v !== void 0 && v !== "") out[k] = v;
+    }
+    return Object.keys(out).length > 0 ? { extra: out } : {};
+  }
   async function describe(resourceUrl = "") {
     const specs = await ready();
     const accepts = [];
@@ -6098,7 +7047,8 @@ function createPaymentGate(options) {
         maxTimeoutSeconds,
         ...s.symbol ? { symbol: s.symbol } : {}
       };
-      if (s.exact) accepts.push({ scheme: "exact", ...base2 });
+      if (s.exact) accepts.push({ scheme: "exact", ...base2, ...railExtra(buildExactAccept(s).extra) });
+      if (s.upto) accepts.push({ scheme: "upto", ...base2, ...railExtra(buildUptoAccept(s).extra) });
       accepts.push({ scheme: "onchain-proof", ...base2 });
     }
     return {
@@ -6134,7 +7084,7 @@ function createPaymentGate(options) {
     }
     await settleTx(ref, true);
     await deliverOnPaid(spec, result.receipt);
-    return { kind: "paid", receipt: result.receipt, receiptHeader: buildReceiptHeader(result.receipt) };
+    return await buildPaidResult(spec, result.receipt, sig.payload.nonce);
   }
   async function verifyExact(exact) {
     const specs = await ready();
@@ -6162,28 +7112,28 @@ function createPaymentGate(options) {
       nonce = [exact.payload.transaction, exact.payload.senderAuth].map((t) => {
         try {
           return Buffer.from(t, "base64").toString("base64");
-        } catch (e42) {
+        } catch (e52) {
           return t;
         }
       }).join("|");
     } else if ("transaction" in exact.payload) {
       try {
         nonce = Buffer.from(exact.payload.transaction, "base64").toString("base64");
-      } catch (e43) {
+      } catch (e53) {
         nonce = exact.payload.transaction;
       }
     } else if ("paymentGroup" in exact.payload) {
       nonce = exact.payload.paymentGroup.map((t) => {
         try {
           return Buffer.from(t, "base64").toString("base64");
-        } catch (e44) {
+        } catch (e54) {
           return t;
         }
       }).join("|");
     } else if ("signedDelegateAction" in exact.payload) {
       try {
         nonce = Buffer.from(exact.payload.signedDelegateAction, "base64").toString("base64");
-      } catch (e45) {
+      } catch (e55) {
         nonce = exact.payload.signedDelegateAction;
       }
     } else if ("permit2Authorization" in exact.payload) {
@@ -6244,27 +7194,122 @@ function createPaymentGate(options) {
     }
     await settleTx(nonce, true);
     await deliverOnPaid(spec, result.receipt);
-    return { kind: "paid", receipt: result.receipt, receiptHeader: buildReceiptHeader(result.receipt) };
+    return await buildPaidResult(spec, result.receipt);
+  }
+  function resolveSettleAmount(raw, maxAmount, decimals) {
+    if (typeof raw === "bigint") return raw < 0n ? null : raw;
+    const s = raw.trim();
+    if (s.length === 0) return null;
+    try {
+      if (s.endsWith("%")) {
+        const pct = s.slice(0, -1).trim();
+        if (!/^\d+(\.\d+)?$/.test(pct)) return null;
+        const pctScaled = _chunkMWBT7MCEcjs.floorUnits.call(void 0, pct, 4);
+        return maxAmount * pctScaled / (100n * 10n ** 4n);
+      }
+      if (s.startsWith("$")) {
+        const amt = s.slice(1).trim();
+        return _chunkMWBT7MCEcjs.floorUnits.call(void 0, amt, decimals);
+      }
+      if (/^\d+$/.test(s)) return BigInt(s);
+      return _chunkMWBT7MCEcjs.floorUnits.call(void 0, s, decimals);
+    } catch (e56) {
+      return null;
+    }
+  }
+  async function verifyUpto(upto) {
+    const specs = await ready();
+    const uptoSpecs = specs.filter((s) => s.upto);
+    if (uptoSpecs.length === 0) {
+      return rejection("transfer_not_found", "This resource offers no standard `upto` (metered) rail.");
+    }
+    const isCaip = upto.network.includes(":");
+    let candidates = isCaip ? uptoSpecs.filter((s) => s.net.network === upto.network) : uptoSpecs;
+    if (upto.asset) {
+      candidates = candidates.filter((s) => s.asset.toLowerCase() === upto.asset.toLowerCase());
+    }
+    let spec = candidates[0];
+    if (!isCaip && !upto.asset && uptoSpecs.length > 1) spec = void 0;
+    if (!spec && !isCaip && !upto.asset && uptoSpecs.length === 1) spec = uptoSpecs[0];
+    if (!spec || !spec.upto) {
+      return rejection(
+        "transfer_not_found",
+        `No \`upto\` rail offered for ${upto.network}${upto.asset ? `/${upto.asset}` : ""} (offered: ${uptoSpecs.map((s) => `${s.asset}@${s.net.network}`).join(", ")}).`
+      );
+    }
+    const nonce = upto.payload.permit2Authorization.nonce;
+    if (await claimTx(nonce)) {
+      return rejection("tx_already_used", `Authorization nonce ${nonce} was already redeemed.`);
+    }
+    const accept = buildUptoAccept(spec);
+    const relayer = spec.upto.relayer;
+    let result;
+    try {
+      const rawAmount = await options.upto.settleAmount({
+        maxAmount: spec.amountBase,
+        asset: spec.asset,
+        network: spec.net.network,
+        decimals: spec.decimals,
+        ...upto.raw ? { request: upto.raw } : {}
+      });
+      const settleAmount = resolveSettleAmount(rawAmount, spec.amountBase, spec.decimals);
+      if (settleAmount === null) {
+        await settleTx(nonce, false);
+        return rejection(
+          "upto_settle_exceeds_max",
+          `The settleAmount callback returned an unparseable amount (${String(rawAmount)}). Return a bigint, a raw/"NN%"/"$X" string, or 0.`
+        );
+      }
+      result = await spec.net.settleUptoSelf({ relayer, payload: upto.payload, accept, settleAmount });
+    } catch (err) {
+      await settleTx(nonce, false);
+      if (err instanceof _chunkMWBT7MCEcjs.SettlementError) throw err;
+      return rejection(
+        "tx_reverted",
+        `upto: metering/settle failed (${err instanceof Error ? err.message : String(err)}).`
+      );
+    }
+    if (!result.ok) {
+      await settleTx(nonce, false);
+      return rejection(result.error, result.detail);
+    }
+    await settleTx(nonce, true);
+    await deliverOnPaid(spec, result.receipt);
+    return await buildPaidResult(spec, result.receipt);
   }
   async function verify(paymentSignature) {
-    const result = await resolveVerdict(paymentSignature);
+    const raw = normaliseHeader(paymentSignature);
+    const result = await resolveVerdictObject(raw === void 0 ? void 0 : decodeBase64Json(raw));
     if (result.kind === "invalid") await deliverOnFailed(result);
     return result;
   }
-  async function resolveVerdict(paymentSignature) {
-    const raw = normaliseHeader(paymentSignature);
-    if (!raw) return asChallenge();
-    const sig = parseSignatureHeader(raw);
+  async function verifyObject(payload) {
+    const result = await resolveVerdictObject(payload);
+    if (result.kind === "invalid") await deliverOnFailed(result);
+    return result;
+  }
+  async function resolveVerdictObject(obj) {
+    if (obj === void 0 || obj === null) return asChallenge();
+    const sig = parseSignatureObject(obj);
     if (sig && sig.accepted && typeof sig.accepted.network === "string" && typeof sig.accepted.asset === "string") {
       return verifyOnchainProof(sig);
     }
-    const exact = parseExactPaymentHeader(raw);
+    const upto = parseUptoObject(obj);
+    if (upto) return verifyUpto(upto);
+    const exact = parseExactObject(obj);
     if (exact) return verifyExact(exact);
     return asChallenge();
   }
-  return { challenge, verify, describe, landingPage };
+  return { challenge, verify, verifyObject, describe, landingPage };
 }
 function requirePayment(options) {
+  if (options.upto) {
+    throw new (_class3 = class extends _chunkMWBT7MCEcjs.PipRailError {constructor(...args2) { super(...args2); _class3.prototype.__init7.call(this); }
+      __init7() {this.code = "UNSUPPORTED_SCHEME"}
+    }, _class3)(
+      "requirePayment: the 'upto' (metered) rail is unsupported through the Express middleware \u2014 it settles before the route handler serves, so metered usage is unknown at settle time. Call gate.verify() directly (createPaymentGate) and meter inside settleAmount; see docs/accepting-payments/upto-rail-seller.md."
+    );
+  }
   const gate = createPaymentGate(options);
   return async (req, res, next) => {
     let result;
@@ -6319,7 +7364,7 @@ function isRetryableStatus(status) {
 }
 var sleep = (ms) => ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
 async function signBody(secret, body) {
-  const subtle = _optionalChain([globalThis, 'access', _104 => _104.crypto, 'optionalAccess', _105 => _105.subtle]);
+  const subtle = _optionalChain([globalThis, 'access', _129 => _129.crypto, 'optionalAccess', _130 => _130.subtle]);
   if (!subtle) return null;
   try {
     const enc = new TextEncoder();
@@ -6329,7 +7374,7 @@ async function signBody(secret, body) {
     const sig = await subtle.sign("HMAC", key, enc.encode(body));
     const hex = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
     return `sha256=${hex}`;
-  } catch (e46) {
+  } catch (e57) {
     return null;
   }
 }
@@ -6389,8 +7434,8 @@ async function deliverReceipt(receipt, options) {
     const retryable = status === void 0 ? true : isRetryableStatus(status);
     const willRetry = !ok && retryable && attempt < maxAttempts;
     try {
-      _optionalChain([onAttempt, 'optionalCall', _106 => _106({ attempt, ok, ...status !== void 0 ? { status } : {}, ...error ? { error } : {}, willRetry })]);
-    } catch (e47) {
+      _optionalChain([onAttempt, 'optionalCall', _131 => _131({ attempt, ok, ...status !== void 0 ? { status } : {}, ...error ? { error } : {}, willRetry })]);
+    } catch (e58) {
     }
     if (ok) return { delivered: true, attempts: attempt, status };
     if (!willRetry) {
@@ -6411,6 +7456,272 @@ async function deliverReceipt(receipt, options) {
   };
 }
 
+// src/transports/a2a.ts
+var A2A_X402_EXTENSION_URI_V01 = "https://github.com/google-a2a/a2a-x402/v0.1";
+var A2A_X402_EXTENSION_URI_V02 = "https://github.com/google-agentic-commerce/a2a-x402/blob/main/spec/v0.2";
+var A2A_STATUS_KEY = "x402.payment.status";
+var A2A_REQUIRED_KEY = "x402.payment.required";
+var A2A_PAYLOAD_KEY = "x402.payment.payload";
+var A2A_RECEIPTS_KEY = "x402.payment.receipts";
+var A2A_ERROR_KEY = "x402.payment.error";
+var A2A_EXTENSIONS_HEADER = "X-A2A-Extensions";
+var MAX_TASK_RECEIPTS = 64;
+var VERIFY_CODE_TO_A2A_ERROR = {
+  payment_expired: "EXPIRED_PAYMENT",
+  tx_already_used: "DUPLICATE_NONCE",
+  amount_too_low: "INVALID_AMOUNT",
+  upto_settle_exceeds_max: "INVALID_AMOUNT",
+  signature_invalid: "INVALID_SIGNATURE",
+  transfer_not_found: "INVALID_AMOUNT",
+  wrong_recipient: "INVALID_AMOUNT",
+  tx_reverted: "SETTLEMENT_FAILED",
+  tx_not_found: "EXPIRED_PAYMENT",
+  insufficient_confirmations: "EXPIRED_PAYMENT",
+  no_meta: "INVALID_SIGNATURE",
+  // The settlement-side throw code the handler emits for a SettlementError (the merchant's
+  // relayer/facilitator never moved funds) — maps to the spec's SETTLEMENT_FAILED.
+  settlement_failed: "SETTLEMENT_FAILED"
+};
+function toA2AErrorCode(code) {
+  return _nullishCoalesce(VERIFY_CODE_TO_A2A_ERROR[code], () => ( code));
+}
+function toA2APaymentRequired(taskId, challenge, parts) {
+  const metadata = {
+    [A2A_STATUS_KEY]: "payment-required",
+    [A2A_REQUIRED_KEY]: challenge
+  };
+  return {
+    kind: "task",
+    id: taskId,
+    status: {
+      state: "input-required",
+      message: { kind: "message", role: "agent", taskId, ...parts ? { parts } : {}, metadata }
+    }
+  };
+}
+function toA2APaymentReceipts(receipts) {
+  return { [A2A_RECEIPTS_KEY]: receipts };
+}
+function toA2APaymentFailed(code, detail, receipts = [], network) {
+  const entry = {
+    success: false,
+    transaction: "",
+    ...network ? { network } : {},
+    errorReason: `${code}: ${detail}`
+  };
+  return {
+    [A2A_STATUS_KEY]: "payment-failed",
+    [A2A_ERROR_KEY]: toA2AErrorCode(code),
+    [A2A_RECEIPTS_KEY]: [...receipts, entry]
+  };
+}
+function fromA2APaymentRequired(task) {
+  const meta = _optionalChain([task, 'access', _132 => _132.status, 'optionalAccess', _133 => _133.message, 'optionalAccess', _134 => _134.metadata]);
+  const required = _optionalChain([meta, 'optionalAccess', _135 => _135[A2A_REQUIRED_KEY]]);
+  if (!required || typeof required !== "object") return null;
+  return required;
+}
+function fromA2APaymentPayload(message) {
+  const raw = _optionalChain([message, 'access', _136 => _136.metadata, 'optionalAccess', _137 => _137[A2A_PAYLOAD_KEY]]);
+  if (raw === void 0 || raw === null) return null;
+  return { raw, taskId: _nullishCoalesce(message.taskId, () => ( "")) };
+}
+function defaultTaskStore() {
+  const map = /* @__PURE__ */ new Map();
+  function prune(now) {
+    for (const [key, { expiry }] of map) {
+      if (expiry > now) break;
+      map.delete(key);
+    }
+  }
+  return {
+    get(taskId) {
+      const now = Date.now();
+      prune(now);
+      const hit = map.get(taskId);
+      return hit && hit.expiry > now ? hit.record : void 0;
+    },
+    set(taskId, value, ttlMs) {
+      const now = Date.now();
+      prune(now);
+      map.delete(taskId);
+      map.set(taskId, { record: value, expiry: now + ttlMs });
+    }
+  };
+}
+function createA2APaymentHandler(options) {
+  const gate = _nullishCoalesce(options.gate, () => ( createPaymentGate(options)));
+  const maxTimeoutSeconds = _nullishCoalesce(options.maxTimeoutSeconds, () => ( 600));
+  const ttlMs = _nullishCoalesce(options.taskTtlMs, () => ( maxTimeoutSeconds * 1e3));
+  const store = _nullishCoalesce(options.taskStore, () => ( defaultTaskStore()));
+  function appendReceipt(taskId, entry) {
+    const prior = _nullishCoalesce(_optionalChain([store, 'access', _138 => _138.get, 'call', _139 => _139(taskId), 'optionalAccess', _140 => _140.receipts]), () => ( []));
+    const isDup = "success" in entry && entry.success === true && prior.some((r) => "transaction" in r && r.transaction === entry.transaction);
+    const next = isDup ? prior : [...prior, entry];
+    const receipts = next.length > MAX_TASK_RECEIPTS ? next.slice(-MAX_TASK_RECEIPTS) : next;
+    store.set(taskId, { receipts }, ttlMs);
+    return receipts;
+  }
+  function completedTask(taskId, receipts, artifacts, status = "payment-completed") {
+    const metadata = { [A2A_STATUS_KEY]: status, ...toA2APaymentReceipts(receipts) };
+    return {
+      kind: "task",
+      id: taskId,
+      status: { state: "completed", message: { kind: "message", role: "agent", taskId, metadata } },
+      ...artifacts.length > 0 ? { artifacts } : {}
+    };
+  }
+  function reChallengeTask(taskId, result, attempted) {
+    if (result.kind !== "invalid") {
+      const metadata2 = {
+        [A2A_STATUS_KEY]: "payment-required",
+        [A2A_REQUIRED_KEY]: result.challenge
+      };
+      return {
+        kind: "task",
+        id: taskId,
+        status: { state: "input-required", message: { kind: "message", role: "agent", taskId, metadata: metadata2 } }
+      };
+    }
+    const network = _nullishCoalesce(attempted, () => ( singleNetworkOf(result.challenge)));
+    const receipts = appendReceiptFailed(taskId, result.error, result.detail, network);
+    const metadata = {
+      [A2A_STATUS_KEY]: "payment-rejected",
+      [A2A_ERROR_KEY]: toA2AErrorCode(result.error),
+      [A2A_REQUIRED_KEY]: result.challenge,
+      ...toA2APaymentReceipts(receipts)
+    };
+    return {
+      kind: "task",
+      id: taskId,
+      status: { state: "input-required", message: { kind: "message", role: "agent", taskId, metadata } }
+    };
+  }
+  function failedTask(taskId, code, detail, network) {
+    const receipts = appendReceiptFailed(taskId, code, detail, network);
+    const metadata = {
+      [A2A_STATUS_KEY]: "payment-failed",
+      [A2A_ERROR_KEY]: toA2AErrorCode(code),
+      ...toA2APaymentReceipts(receipts)
+    };
+    return {
+      kind: "task",
+      id: taskId,
+      status: { state: "failed", message: { kind: "message", role: "agent", taskId, metadata } }
+    };
+  }
+  function appendReceiptFailed(taskId, code, detail, network) {
+    return appendReceipt(taskId, {
+      success: false,
+      transaction: "",
+      ...network ? { network } : {},
+      errorReason: `${code}: ${detail}`
+    });
+  }
+  async function handleMessage(message, taskId) {
+    const id = _nullishCoalesce(_nullishCoalesce(taskId, () => ( message.taskId)), () => ( newTaskId()));
+    const inbound = fromA2APaymentPayload(message);
+    if (!inbound) {
+      const { challenge } = await gate.challenge(resourceUrlFromMessage(message));
+      store.set(id, { receipts: [] }, ttlMs);
+      return toA2APaymentRequired(id, challenge);
+    }
+    const attempted = networkFromPayload(inbound.raw);
+    let result;
+    try {
+      result = await gate.verifyObject(inbound.raw);
+    } catch (err) {
+      if (err instanceof _chunkMWBT7MCEcjs.SettlementError) {
+        return failedTask(id, "settlement_failed", err.message, attempted);
+      }
+      const detail = err instanceof Error ? err.message : String(err);
+      return failedTask(id, "tx_reverted", detail, attempted);
+    }
+    switch (result.kind) {
+      case "challenge":
+        return reChallengeTask(id, result, attempted);
+      case "invalid":
+        return reChallengeTask(id, result, attempted);
+      case "paid": {
+        const receipts = appendReceipt(id, result.receipt);
+        let artifacts = [];
+        if (options.fulfill) {
+          try {
+            artifacts = await _asyncNullishCoalesce(await options.fulfill({ taskId: id, receipt: result.receipt, message }), async () => ( []));
+          } catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            const annotation = {
+              name: "fulfillment-error",
+              metadata: { "x402.fulfillment.error": detail, "x402.fulfillment.settled": true },
+              parts: [{ kind: "text", text: `Payment settled, but serving the result failed: ${detail}` }]
+            };
+            return completedTask(id, receipts, [annotation]);
+          }
+        }
+        return completedTask(id, receipts, artifacts);
+      }
+    }
+  }
+  function agentCardExtension(opts) {
+    const uri = _optionalChain([opts, 'optionalAccess', _141 => _141.version]) === "v0.2" ? A2A_X402_EXTENSION_URI_V02 : A2A_X402_EXTENSION_URI_V01;
+    return {
+      uri,
+      description: "Supports payments using the x402 protocol for on-chain settlement.",
+      ..._optionalChain([opts, 'optionalAccess', _142 => _142.required]) ? { required: true } : {}
+    };
+  }
+  return { handleMessage, agentCardExtension, gate };
+}
+function singleNetworkOf(challenge) {
+  const nets = new Set((_nullishCoalesce(challenge.accepts, () => ( []))).map((a) => a.network).filter(Boolean));
+  return nets.size === 1 ? [...nets][0] : void 0;
+}
+function networkFromPayload(raw) {
+  const v = raw;
+  if (v && typeof _optionalChain([v, 'access', _143 => _143.accepted, 'optionalAccess', _144 => _144.network]) === "string") return v.accepted.network;
+  if (v && typeof v.network === "string") return v.network;
+  return void 0;
+}
+function newTaskId() {
+  return `task-${globalThis.crypto.randomUUID()}`;
+}
+function resourceUrlFromMessage(message) {
+  for (const part of _nullishCoalesce(message.parts, () => ( []))) {
+    const data = part.data;
+    if (data && typeof data.url === "string") return data.url;
+  }
+  return "";
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -6514,4 +7825,4 @@ async function deliverReceipt(receipt, options) {
 
 
 
-exports.BRAND = BRAND; exports.BUILTIN_DENOMS = BUILTIN_DENOMS; exports.CHAINS = CHAINS; exports.ConfirmationTimeoutError = _chunkMWBT7MCEcjs.ConfirmationTimeoutError; exports.DENOM_PRECISION = DENOM_PRECISION; exports.DIRECTORY_INFO = DIRECTORY_INFO; exports.EIP3009_TYPES = EIP3009_TYPES; exports.EXACT_NETWORK_SLUGS = EXACT_NETWORK_SLUGS; exports.GENERATOR = GENERATOR; exports.HEADER_REQUIRED = HEADER_REQUIRED; exports.HEADER_RESPONSE = HEADER_RESPONSE; exports.HEADER_RESPONSE_V1 = HEADER_RESPONSE_V1; exports.HEADER_SIGNATURE = HEADER_SIGNATURE; exports.HEADER_SIGNATURE_V1 = HEADER_SIGNATURE_V1; exports.InsufficientFundsError = _chunkMWBT7MCEcjs.InsufficientFundsError; exports.InvalidEnvelopeError = _chunkMWBT7MCEcjs.InvalidEnvelopeError; exports.KNOWN_FACILITATORS = KNOWN_FACILITATORS; exports.MaxRetriesExceededError = _chunkMWBT7MCEcjs.MaxRetriesExceededError; exports.MissingDriverError = _chunkMWBT7MCEcjs.MissingDriverError; exports.MultiChainPayer = MultiChainPayer; exports.NoCompatibleAcceptError = _chunkMWBT7MCEcjs.NoCompatibleAcceptError; exports.NonReplayableBodyError = _chunkMWBT7MCEcjs.NonReplayableBodyError; exports.PERMIT2_ADDRESS = PERMIT2_ADDRESS; exports.PERMIT2_PROXY_CHAIN_IDS = PERMIT2_PROXY_CHAIN_IDS; exports.PERMIT2_WITNESS_TYPES = PERMIT2_WITNESS_TYPES; exports.PIPRAIL_AGENT_GUIDE = PIPRAIL_AGENT_GUIDE; exports.POWERED_BY = POWERED_BY; exports.PaymentDeclinedError = _chunkMWBT7MCEcjs.PaymentDeclinedError; exports.PaymentTimeoutError = _chunkMWBT7MCEcjs.PaymentTimeoutError; exports.PipRailClient = PipRailClient; exports.PipRailError = _chunkMWBT7MCEcjs.PipRailError; exports.REGISTER_ATTRIBUTION = REGISTER_ATTRIBUTION; exports.RecipientNotReadyError = _chunkMWBT7MCEcjs.RecipientNotReadyError; exports.SettlementError = _chunkMWBT7MCEcjs.SettlementError; exports.SpendLedger = SpendLedger; exports.UnknownTokenError = _chunkMWBT7MCEcjs.UnknownTokenError; exports.UnsupportedNetworkError = _chunkMWBT7MCEcjs.UnsupportedNetworkError; exports.UnsupportedSchemeError = _chunkMWBT7MCEcjs.UnsupportedSchemeError; exports.WalletRequiredError = _chunkMWBT7MCEcjs.WalletRequiredError; exports.WrongChainError = _chunkMWBT7MCEcjs.WrongChainError; exports.WrongFamilyError = _chunkMWBT7MCEcjs.WrongFamilyError; exports.X402_EXACT_PERMIT2_PROXY = X402_EXACT_PERMIT2_PROXY; exports.agentGuide = agentGuide; exports.appendAttribution = appendAttribution; exports.appendKeywords = appendKeywords; exports.buildBazaarExtension = buildBazaarExtension; exports.buildChallengeHeader = buildChallengeHeader; exports.buildEndpointInfo = buildEndpointInfo; exports.buildExactAuthorization = buildExactAuthorization; exports.buildExactSignatureHeader = buildExactSignatureHeader; exports.buildOpenApi = buildOpenApi; exports.buildReceiptHeader = buildReceiptHeader; exports.buildSelfDescription = buildSelfDescription; exports.buildSignatureHeader = buildSignatureHeader; exports.buildWellKnownX402 = buildWellKnownX402; exports.buildX402DnsTxt = buildX402DnsTxt; exports.chainIdForExactNetwork = chainIdForExactNetwork; exports.claim402IndexDomain = claim402IndexDomain; exports.classifyChallenge = classifyChallenge; exports.createPaymentGate = createPaymentGate; exports.decorateOutcome = decorateOutcome; exports.deliverReceipt = deliverReceipt; exports.denomOf = denomOf; exports.describeChallenge = describeChallenge; exports.discoveryHeaders = discoveryHeaders; exports.eip3009Abi = eip3009Abi; exports.encodeXPaymentHeader = encodeXPaymentHeader; exports.evaluatePolicy = evaluatePolicy; exports.explainDecline = explainDecline; exports.facilitatorCoverage = facilitatorCoverage; exports.fetchAcross = fetchAcross; exports.firstKeylessFacilitator = firstKeylessFacilitator; exports.formatSpendReport = formatSpendReport; exports.getDirectoryInfo = getDirectoryInfo; exports.isPermit2ProxyChain = isPermit2ProxyChain; exports.knownFacilitatorsFor = knownFacilitatorsFor; exports.memorySpendStore = _chunkO4UQOZ4Zcjs.memorySpendStore; exports.normalizeNetwork = normalizeNetwork; exports.parseChallenge = parseChallenge; exports.parseExactPaymentHeader = parseExactPaymentHeader; exports.parseExactRequirements = parseExactRequirements; exports.parseFacilitatorSupported = parseFacilitatorSupported; exports.parseReceipt = parseReceipt; exports.parseSettleResponse = parseSettleResponse; exports.parseSignatureHeader = parseSignatureHeader; exports.paymentTools = paymentTools; exports.pickAccept = pickAccept; exports.planAcross = planAcross; exports.rankResources = rankResources; exports.readExactDomain = readExactDomain; exports.register402Index = register402Index; exports.registerDriver = registerDriver; exports.registerX402Scan = registerX402Scan; exports.renderLandingPage = renderLandingPage; exports.requirePayment = requirePayment; exports.resolveChain = resolveChain; exports.scoreResource = scoreResource; exports.searchOpenIndexes = searchOpenIndexes; exports.settleViaFacilitator = settleViaFacilitator; exports.summarizePlan = summarizePlan; exports.toInsufficientFundsError = _chunkMWBT7MCEcjs.toInsufficientFundsError; exports.toInvalidBody = toInvalidBody; exports.verify402IndexDomain = verify402IndexDomain;
+exports.A2A_ERROR_KEY = A2A_ERROR_KEY; exports.A2A_EXTENSIONS_HEADER = A2A_EXTENSIONS_HEADER; exports.A2A_PAYLOAD_KEY = A2A_PAYLOAD_KEY; exports.A2A_RECEIPTS_KEY = A2A_RECEIPTS_KEY; exports.A2A_REQUIRED_KEY = A2A_REQUIRED_KEY; exports.A2A_STATUS_KEY = A2A_STATUS_KEY; exports.A2A_X402_EXTENSION_URI_V01 = A2A_X402_EXTENSION_URI_V01; exports.A2A_X402_EXTENSION_URI_V02 = A2A_X402_EXTENSION_URI_V02; exports.BRAND = BRAND; exports.BUILTIN_DENOMS = BUILTIN_DENOMS; exports.CHAINS = CHAINS; exports.ConfirmationTimeoutError = _chunkMWBT7MCEcjs.ConfirmationTimeoutError; exports.DENOM_PRECISION = DENOM_PRECISION; exports.DIRECTORY_INFO = DIRECTORY_INFO; exports.EIP3009_TYPES = EIP3009_TYPES; exports.EXACT_NETWORK_SLUGS = EXACT_NETWORK_SLUGS; exports.EXT_OFFER_RECEIPT = EXT_OFFER_RECEIPT; exports.GENERATOR = GENERATOR; exports.HEADER_REQUIRED = HEADER_REQUIRED; exports.HEADER_RESPONSE = HEADER_RESPONSE; exports.HEADER_RESPONSE_V1 = HEADER_RESPONSE_V1; exports.HEADER_SIGNATURE = HEADER_SIGNATURE; exports.HEADER_SIGNATURE_V1 = HEADER_SIGNATURE_V1; exports.InsufficientFundsError = _chunkMWBT7MCEcjs.InsufficientFundsError; exports.InvalidEnvelopeError = _chunkMWBT7MCEcjs.InvalidEnvelopeError; exports.KNOWN_FACILITATORS = KNOWN_FACILITATORS; exports.MaxRetriesExceededError = _chunkMWBT7MCEcjs.MaxRetriesExceededError; exports.MissingDriverError = _chunkMWBT7MCEcjs.MissingDriverError; exports.MultiChainPayer = MultiChainPayer; exports.NoCompatibleAcceptError = _chunkMWBT7MCEcjs.NoCompatibleAcceptError; exports.NonReplayableBodyError = _chunkMWBT7MCEcjs.NonReplayableBodyError; exports.PERMIT2_ADDRESS = PERMIT2_ADDRESS; exports.PERMIT2_PROXY_CHAIN_IDS = PERMIT2_PROXY_CHAIN_IDS; exports.PERMIT2_UPTO_WITNESS_TYPES = PERMIT2_UPTO_WITNESS_TYPES; exports.PERMIT2_WITNESS_TYPES = PERMIT2_WITNESS_TYPES; exports.PIPRAIL_AGENT_GUIDE = PIPRAIL_AGENT_GUIDE; exports.POWERED_BY = POWERED_BY; exports.PaymentDeclinedError = _chunkMWBT7MCEcjs.PaymentDeclinedError; exports.PaymentTimeoutError = _chunkMWBT7MCEcjs.PaymentTimeoutError; exports.PipRailClient = PipRailClient; exports.PipRailError = _chunkMWBT7MCEcjs.PipRailError; exports.REGISTER_ATTRIBUTION = REGISTER_ATTRIBUTION; exports.RecipientNotReadyError = _chunkMWBT7MCEcjs.RecipientNotReadyError; exports.SettlementError = _chunkMWBT7MCEcjs.SettlementError; exports.SpendLedger = SpendLedger; exports.UPTO_PROXY_CHAIN_IDS = UPTO_PROXY_CHAIN_IDS; exports.UnknownTokenError = _chunkMWBT7MCEcjs.UnknownTokenError; exports.UnsupportedNetworkError = _chunkMWBT7MCEcjs.UnsupportedNetworkError; exports.UnsupportedSchemeError = _chunkMWBT7MCEcjs.UnsupportedSchemeError; exports.VERIFY_CODE_TO_A2A_ERROR = VERIFY_CODE_TO_A2A_ERROR; exports.WalletRequiredError = _chunkMWBT7MCEcjs.WalletRequiredError; exports.WrongChainError = _chunkMWBT7MCEcjs.WrongChainError; exports.WrongFamilyError = _chunkMWBT7MCEcjs.WrongFamilyError; exports.X402_EXACT_PERMIT2_PROXY = X402_EXACT_PERMIT2_PROXY; exports.X402_UPTO_PERMIT2_PROXY = X402_UPTO_PERMIT2_PROXY; exports.agentGuide = agentGuide; exports.appendAttribution = appendAttribution; exports.appendKeywords = appendKeywords; exports.buildBazaarExtension = buildBazaarExtension; exports.buildChallengeHeader = buildChallengeHeader; exports.buildEndpointInfo = buildEndpointInfo; exports.buildExactAuthorization = buildExactAuthorization; exports.buildExactSignatureHeader = buildExactSignatureHeader; exports.buildOpenApi = buildOpenApi; exports.buildReceiptExtension = buildReceiptExtension; exports.buildReceiptHeader = buildReceiptHeader; exports.buildSelfDescription = buildSelfDescription; exports.buildSignatureHeader = buildSignatureHeader; exports.buildUptoSignatureHeader = buildUptoSignatureHeader; exports.buildWellKnownX402 = buildWellKnownX402; exports.buildX402DnsTxt = buildX402DnsTxt; exports.chainIdForExactNetwork = chainIdForExactNetwork; exports.claim402IndexDomain = claim402IndexDomain; exports.classifyChallenge = classifyChallenge; exports.createA2APaymentHandler = createA2APaymentHandler; exports.createPaymentGate = createPaymentGate; exports.decodeBase64Json = decodeBase64Json; exports.decorateOutcome = decorateOutcome; exports.deliverReceipt = deliverReceipt; exports.denomOf = denomOf; exports.describeChallenge = describeChallenge; exports.discoveryHeaders = discoveryHeaders; exports.eip3009Abi = eip3009Abi; exports.encodeXPaymentHeader = encodeXPaymentHeader; exports.evaluatePolicy = evaluatePolicy; exports.explainDecline = explainDecline; exports.facilitatorCoverage = facilitatorCoverage; exports.fetchAcross = fetchAcross; exports.firstKeylessFacilitator = firstKeylessFacilitator; exports.formatSpendReport = formatSpendReport; exports.fromA2APaymentPayload = fromA2APaymentPayload; exports.fromA2APaymentRequired = fromA2APaymentRequired; exports.getDirectoryInfo = getDirectoryInfo; exports.isPermit2ProxyChain = isPermit2ProxyChain; exports.isUptoProxyChain = isUptoProxyChain; exports.knownFacilitatorsFor = knownFacilitatorsFor; exports.memorySpendStore = _chunkO4UQOZ4Zcjs.memorySpendStore; exports.normalizeNetwork = normalizeNetwork; exports.parseChallenge = parseChallenge; exports.parseExactObject = parseExactObject; exports.parseExactPaymentHeader = parseExactPaymentHeader; exports.parseExactRequirements = parseExactRequirements; exports.parseFacilitatorSupported = parseFacilitatorSupported; exports.parseReceipt = parseReceipt; exports.parseReceiptExtension = parseReceiptExtension; exports.parseSettleResponse = parseSettleResponse; exports.parseSignatureHeader = parseSignatureHeader; exports.parseSignatureObject = parseSignatureObject; exports.parseUptoObject = parseUptoObject; exports.parseUptoPaymentHeader = parseUptoPaymentHeader; exports.paymentTools = paymentTools; exports.pickAccept = pickAccept; exports.planAcross = planAcross; exports.rankResources = rankResources; exports.readExactDomain = readExactDomain; exports.register402Index = register402Index; exports.registerDriver = registerDriver; exports.registerX402Scan = registerX402Scan; exports.renderLandingPage = renderLandingPage; exports.requirePayment = requirePayment; exports.resolveChain = resolveChain; exports.scoreResource = scoreResource; exports.searchOpenIndexes = searchOpenIndexes; exports.settleViaFacilitator = settleViaFacilitator; exports.summarizePlan = summarizePlan; exports.toA2AErrorCode = toA2AErrorCode; exports.toA2APaymentFailed = toA2APaymentFailed; exports.toA2APaymentReceipts = toA2APaymentReceipts; exports.toA2APaymentRequired = toA2APaymentRequired; exports.toInsufficientFundsError = _chunkMWBT7MCEcjs.toInsufficientFundsError; exports.toInvalidBody = toInvalidBody; exports.verify402IndexDomain = verify402IndexDomain;