@piprail/sdk 2.9.0 → 2.11.0

package/dist/{ledger-BtzrfO-3.d.ts → ledger-OQos-tmj.d.ts}

@@ -126,8 +126,54 @@ interface X402ExactAcceptEntry {
         symbol?: string;
     };
 }
-/** A challenge `accepts[]` entry — either PipRail's `onchain-proof` rail or a standard `exact` rail. */
-type X402AnyAccept = X402AcceptEntry | X402ExactAcceptEntry;
+/**
+ * A standard x402 `upto` rail (EVM / Permit2) — variable-amount / metered billing.
+ * The buyer signs a Permit2 `PermitWitnessTransferFrom` authorization for `amount`
+ * as a **MAXIMUM**; the merchant serves the resource, meters the **actual** usage, then
+ * self-settles `actual ≤ max` through the canonical `x402UptoPermit2Proxy` from its own
+ * relayer (which is the bound `witness.facilitator`). EVM-Permit2 ONLY — the upto spec
+ * bans EIP-3009 (it fixes the amount at sign time) and has no non-EVM variant. A SEPARATE
+ * accept type from {@link X402ExactAcceptEntry}: the only wire delta vs the exact Permit2
+ * rail is `scheme: 'upto'` and the `witness.facilitator` field, but keeping them distinct
+ * leaves the exact parser/union untouched and lets the gate/client route on `scheme`.
+ */
+interface X402UptoAcceptEntry {
+    scheme: 'upto';
+    network: Caip2;
+    /** The authorized MAXIMUM in base units (already scaled by decimals). The merchant
+     *  settles the ACTUAL (≤ this) after serving. */
+    amount: string;
+    asset: AssetId;
+    payTo: AddressId;
+    maxTimeoutSeconds: number;
+    extra: {
+        /** PipRail's transfer-method tag for the upto rail. This literal `'permit2-upto'` IS what
+         *  rides on the wire in `extra.assetTransferMethod` — it's a NON-STANDARD extra key (the
+         *  upto spec defines no `assetTransferMethod`; the discriminant a conformant foreign client
+         *  keys off is `scheme: 'upto'` + the Permit2 witness shape, and it ignores this unknown key).
+         *  We carry it so OUR parser stays unambiguous from the exact Permit2 rail. */
+        assetTransferMethod: 'permit2-upto';
+        /** The address bound into `witness.facilitator`. In self-settle this is the merchant's
+         *  own relayer; the buyer MUST sign over it; only this address can settle (the proxy
+         *  reverts `UnauthorizedFacilitator()` otherwise). */
+        facilitatorAddress: string;
+        /** The Permit2 domain is fixed (`"Permit2"`), but the token's `name`/`version` ride
+         *  along for the optional EIP-2612 gas-sponsoring extension. Read/re-derived on-chain,
+         *  never assumed. */
+        name?: string;
+        version?: string;
+        /** Confirmations the gate waits for before granting access — a PipRail convenience. */
+        minConfirmations?: number;
+        /** Token decimals — a PipRail convenience (standard clients ignore unknown keys). */
+        decimals?: number;
+        /** Human-readable MAX, e.g. "0.50". */
+        amountFormatted?: string;
+        symbol?: string;
+    };
+}
+/** A challenge `accepts[]` entry — PipRail's `onchain-proof` rail, a standard `exact`
+ *  rail, or a standard `upto` (metered) rail. */
+type X402AnyAccept = X402AcceptEntry | X402ExactAcceptEntry | X402UptoAcceptEntry;
 interface X402Challenge {
     x402Version: 2;
     /**
@@ -210,6 +256,42 @@ interface Permit2PaymentPayload {
     signature: string;
     permit2Authorization: Permit2Authorization;
 }
+/**
+ * The `permit2Authorization` a payer signs for the x402 `upto` (metered) EVM scheme.
+ * Identical to {@link Permit2Authorization} EXCEPT the witness carries a `facilitator`
+ * field as its **MIDDLE** member (`{ to, facilitator, validAfter }`) — the only delta
+ * from the exact Permit2 witness. The EIP-712 witness type is
+ * `Witness(address to,address facilitator,uint256 validAfter)`. `permitted.amount` is
+ * the signed **MAXIMUM**; the merchant settles the ACTUAL (≤ max). `spender` is the
+ * canonical **x402UptoPermit2Proxy**. All numeric fields are DECIMAL strings on the wire.
+ */
+interface Permit2UptoAuthorization {
+    /** What may be pulled: the ERC-20 token + the signed MAXIMUM base-unit amount. */
+    permitted: {
+        token: string;
+        amount: string;
+    };
+    /** The payer (token owner). */
+    from: string;
+    /** The signature's allowed spender — the canonical x402UptoPermit2Proxy. */
+    spender: string;
+    /** Permit2 unordered nonce (a uint256, decimal string). Single-use via its bitmap. */
+    nonce: string;
+    /** Unix-seconds signature expiry. */
+    deadline: string;
+    /** The proxy-enforced witness: funds go ONLY to `to`, only the bound `facilitator` can
+     *  settle, and not before `validAfter`. `facilitator` is the MIDDLE field. */
+    witness: {
+        to: string;
+        facilitator: string;
+        validAfter: string;
+    };
+}
+/** The `payload` a client sends for the `upto` rail: a signature + its Permit2 upto authorization. */
+interface Permit2UptoPaymentPayload {
+    signature: string;
+    permit2Authorization: Permit2UptoAuthorization;
+}
 /**
  * The `payload` a client sends for the **SVM (Solana) `exact`** variant: a base64-encoded,
  * serialized, **partially-signed** versioned Solana transaction (the buyer's `TransferChecked`
@@ -311,8 +393,21 @@ type ParsedExactPayment = (ParsedExactBase & {
     method: 'near';
     payload: ExactNearPaymentPayload;
 });
+/**
+ * What {@link parseUptoPaymentHeader} extracts from an inbound `upto` payment — the
+ * metered-rail sibling of {@link ParsedExactPayment}. A single PipRail-internal
+ * `method: 'permit2-upto'` discriminant (the on-wire `scheme` is `'upto'`). `network`/
+ * `asset` are the CLIENT's claim — used only to MATCH an offered rail; the gate re-derives
+ * every verified field from its own trusted rail. Kept separate from the exact parse path
+ * so an upto payload (scheme `'upto'`, witness carries `facilitator`) never matches the
+ * exact parser and vice-versa.
+ */
+type ParsedUptoPayment = ParsedExactBase & {
+    method: 'permit2-upto';
+    payload: Permit2UptoPaymentPayload;
+};
 interface X402Receipt {
-    scheme: 'onchain-proof' | 'exact';
+    scheme: 'onchain-proof' | 'exact' | 'upto';
     /**
      * x402 v2 SettlementResponse: settlement succeeded. Always `true` here — a
      * failed verification returns a 402, never a receipt.
@@ -332,6 +427,15 @@ interface X402Receipt {
     payer: AddressId;
     payTo: AddressId;
     verifiedAt: string;
+    /**
+     * NEW (additive, optional). The challenge nonce this settlement was bound to —
+     * the value `genNonce()` minted into the 402 and echoed back as the buyer's
+     * `payload.nonce` (NOT an exact-rail authorization/delegate nonce). REQUIRED to
+     * re-verify Template-A families (Stellar/XRPL/NEAR/Algorand/TON) off-chain via a
+     * synthetic accept; informational on digest-bound (Template-B) families. Omitted
+     * unless the gate's `receipts` option is on, so a default 200 stays byte-identical.
+     */
+    nonce?: string;
 }
 /**
  * The settled-payment record handed to a gate's `onPaid` hook — the wire
@@ -364,6 +468,49 @@ interface PaidReceipt extends X402Receipt {
      */
     idempotencyKey: string;
 }
+/**
+ * The OPTIONAL Tier-2 EIP-712 delivery attestation — the official offer-receipt
+ * `SignedReceipt`. Populated only when the merchant enables `receipts: { attest }`
+ * (a separate phase); absent for Tier-1 chain-grounded receipts. Kept open for
+ * forward-compat with the spec's typed-data fields, filled in by the EVM
+ * `signReceipt` SPI; verification is `PipRailClient.verifyAttestation`.
+ */
+interface SignedReceipt {
+    /** The EIP-712 signature over the receipt typed-data. */
+    signature: string;
+    /** The recovered signer the verifier expects to equal the merchant `payTo`. */
+    signer: AddressId;
+    [extra: string]: unknown;
+}
+/**
+ * The self-contained, portable receipt a buyer KEEPS and **anyone** re-verifies
+ * against the chain with only an RPC — no key, no backend, no PipRail account.
+ * It bundles the verified {@link X402Receipt} (which carries `nonce` for Template-A
+ * re-verification) with the reconstruction metadata a third party needs to rebuild
+ * the trusted accept and re-run the driver's `verify()`: what was paid for
+ * (`resource`) and the asset `decimals` (Stellar/XRPL/TON need it to re-scale the
+ * amount). Rides the wire in `extensions['offer-receipt'].info` on the
+ * `PAYMENT-RESPONSE` header; {@link PipRailClient.verifyReceipt} re-verifies it.
+ */
+interface PipRailReceipt {
+    /** Receipt-format version — distinct from `x402Version`. */
+    piprail: '1';
+    /** The verified settlement (carries the challenge `nonce` for Template-A re-verify). */
+    receipt: X402Receipt;
+    /** What was paid for — the challenge's resource URL. */
+    resource: {
+        url: string;
+    };
+    /**
+     * ADDITIVE. The asset's on-chain decimals — threaded into the synthetic accept's
+     * `extra.decimals` so Stellar/XRPL/TON `verify()` can re-scale the wire amount.
+     * Receipt-bundle metadata only (the gate already knows it via {@link PaidReceipt});
+     * NOT on the minimal wire {@link X402Receipt}.
+     */
+    decimals?: number;
+    /** OPTIONAL Tier-2 attestation — present only when the merchant signed it. */
+    attestation?: SignedReceipt;
+}
 /**
  * Why a verification failed — a closed, chain-agnostic vocabulary. Every code a
  * driver returns is in this union; a client/agent branches on it rather than
@@ -378,7 +525,7 @@ interface PaidReceipt extends X402Receipt {
  * `maxPaymentRetries` (a short backoff absorbs RPC lag); it does not branch on
  * the code.
  */
-type VerifyErrorCode = 'tx_not_found' | 'insufficient_confirmations' | 'tx_reverted' | 'no_meta' | 'wrong_recipient' | 'amount_too_low' | 'transfer_not_found' | 'payment_expired' | 'tx_already_used' | 'signature_invalid';
+type VerifyErrorCode = 'tx_not_found' | 'insufficient_confirmations' | 'tx_reverted' | 'no_meta' | 'wrong_recipient' | 'amount_too_low' | 'transfer_not_found' | 'payment_expired' | 'tx_already_used' | 'signature_invalid' | 'upto_settle_exceeds_max';
 /** The shape every driver's `verify()` returns. Shared by drivers + protocol. */
 type VerifyResult = {
     ok: true;
@@ -393,8 +540,50 @@ declare const HEADER_SIGNATURE = "payment-signature";
 declare const HEADER_RESPONSE = "payment-response";
 declare const HEADER_SIGNATURE_V1 = "x-payment";
 declare const HEADER_RESPONSE_V1 = "x-payment-response";
+/**
+ * Decode a base64-JSON wire value into a plain object (or `null` on garbage) — the
+ * inverse of {@link buildSignatureHeader}/{@link buildExactSignatureHeader}. Exported
+ * so a transport that carries the SAME payload as RAW JSON (A2A) can round-trip a
+ * base64 fixture into the object the `…Object` parser cores / `gate.verifyObject` consume.
+ */
+declare function decodeBase64Json(value: string): unknown;
 declare function buildChallengeHeader(challenge: X402Challenge): string;
-declare function buildReceiptHeader(receipt: X402Receipt): string;
+/**
+ * Build the PAYMENT-RESPONSE header from a settled {@link X402Receipt}. When `extensions`
+ * is supplied (the gate's `receipts` option is on), it rides as an `extensions` sibling on
+ * the SettlementResponse — a standard x402 reader ignores it, {@link parseReceiptExtension}
+ * reconstructs the {@link PipRailReceipt}. Omit it (the default) and the header is
+ * byte-identical to before this feature.
+ */
+declare function buildReceiptHeader(receipt: X402Receipt, extensions?: Record<string, unknown>): string;
+/** The x402 extension key for verifiable delivery receipts (the `offer-receipt` extension). */
+declare const EXT_OFFER_RECEIPT = "offer-receipt";
+/**
+ * Assemble the `extensions['offer-receipt']` block for a settled response — PURE
+ * JSON, viem-free. SPEC-FAITHFUL placement:
+ *  - `info.receipt` holds the official `offer-receipt` **SignedReceipt** (the canonical
+ *    `{ format, payload, signature }` a STOCK `@x402/extensions` reader
+ *    (`extractReceiptFromResponse` → `info.receipt`) consumes, PLUS an additive `signer` —
+ *    the recovered signer address, a convenience a stock reader ignores and a verifier
+ *    re-derives from the signature anyway, so it's never trusted on the wire) — present
+ *    ONLY when a Tier-2 attestation was signed. When there is no attestation (Tier-1,
+ *    chain-grounded) there is no signed artifact, so `info.receipt` is absent — a stock
+ *    reader correctly sees "no signed receipt" (because there isn't one).
+ *  - `info.settlement` holds PipRail's chain-grounded {@link X402Receipt} (the
+ *    settlement record {@link parseReceiptExtension} re-reads for `verifyReceipt`) — a
+ *    PipRail-namespaced sibling a stock reader ignores.
+ * The optional `schema` JSON-Schema sibling is owner-gated and not emitted by default.
+ * The gate merges the returned record into the SettlementResponse's `extensions` on the
+ * `PAYMENT-RESPONSE` header.
+ */
+declare function buildReceiptExtension(bundle: {
+    receipt: X402Receipt;
+    resource: {
+        url: string;
+    };
+    decimals?: number;
+    attestation?: SignedReceipt;
+}): Record<string, unknown>;
 declare function buildSignatureHeader(signature: X402PaymentSignature): string;
 /**
  * Build the v2 PAYMENT-SIGNATURE header value for a standard x402 `exact` payment:
@@ -410,6 +599,19 @@ declare function buildExactSignatureHeader(input: {
     accepted: X402ExactAcceptEntry;
     payload: ExactPaymentPayloadAny;
 }): string;
+/**
+ * Build the v2 PAYMENT-SIGNATURE header value for a standard x402 `upto` (metered)
+ * payment: base64 of `{ x402Version: 2, accepted, payload }`. `accepted` is the chosen
+ * upto rail echoed back VERBATIM from the challenge's `accepts[]`; `payload` is the
+ * Permit2-upto `{ signature, permit2Authorization }` the buyer's EVM driver produced
+ * (the witness carries `facilitator`). Chain-agnostic (pure JSON/base64). Round-trips
+ * through {@link parseUptoPaymentHeader}. (The `exact` counterpart is
+ * {@link buildExactSignatureHeader}.)
+ */
+declare function buildUptoSignatureHeader(input: {
+    accepted: X402UptoAcceptEntry;
+    payload: Permit2UptoPaymentPayload;
+}): string;
 /**
  * Parse the PAYMENT-REQUIRED challenge from a 402 response. Prefers the
  * `payment-required` header, falls back to the JSON body.
@@ -420,6 +622,17 @@ declare function parseChallenge(response: Response): Promise<X402Challenge | nul
  *  server may set. Returns a fully-formed {@link X402Receipt} only (a bare foreign
  *  exact SettleResponse without a `payer` is read by {@link parseSettleResponse}). */
 declare function parseReceipt(response: Response): X402Receipt | null;
+/**
+ * Read a {@link PipRailReceipt} back from a settled response's `PAYMENT-RESPONSE`
+ * header (v2, or the v1 `X-PAYMENT-RESPONSE` fallback). Reads PipRail's chain-grounded
+ * settlement record from `extensions['offer-receipt'].info.settlement`, and the optional
+ * Tier-2 {@link SignedReceipt} from the spec slot `info.receipt`. Liberal/Postel: TOLERATES
+ * + IGNORES a `schema` sibling (or any unknown sibling), and — for robustness — also accepts
+ * the settlement record at `info.receipt` if it's there instead (an X402Receipt, distinguished
+ * from a SignedReceipt by {@link isValidReceipt}). Returns `null` when no header, no extension
+ * block, or no valid settlement record. Pure — no chain read.
+ */
+declare function parseReceiptExtension(response: Response): PipRailReceipt | null;
 /**
  * A standard x402 SettleResponse as the BUYER reads it off a settled (non-402)
  * response. The `success` flag is authoritative: `false` is an EXPLICIT facilitator/
@@ -432,6 +645,13 @@ interface SettleOutcome {
     network?: string;
     payer?: string;
     errorReason?: string;
+    /**
+     * The ACTUAL settled amount in atomic units, when the SettleResponse carries it
+     * (the x402 `upto` scheme makes this field REQUIRED — may be `"0"`). The upto buyer
+     * reads it to record the metered ACTUAL spend in its ledger rather than the signed MAX.
+     * Absent for `onchain-proof`/`exact` settle responses (they fix the amount up front).
+     */
+    amount?: string;
 }
 /**
  * Read a standard x402 SettleResponse for the BUYER, from the v2 `payment-response`
@@ -444,7 +664,17 @@ interface SettleOutcome {
  * settlement from a phantom one (never record a spend on `success:false`).
  */
 declare function parseSettleResponse(response: Response): SettleOutcome | null;
-/** Parse a PAYMENT-SIGNATURE header value (server side). */
+/**
+ * Parse an already-decoded `onchain-proof` PaymentPayload OBJECT (server side) —
+ * the object-accepting CORE of {@link parseSignatureHeader}. Identical logic to the
+ * base64 entry-point below, minus the `fromBase64Json` decode: this is what the A2A
+ * transport feeds raw JSON metadata into (A2A carries the payload as raw JSON, not
+ * base64), via `gate.verifyObject`. {@link parseSignatureHeader} is the thin base64
+ * wrapper — byte-identical to before this split on the HTTP path.
+ */
+declare function parseSignatureObject(parsed: unknown): X402PaymentSignature | null;
+/** Parse a PAYMENT-SIGNATURE header value (server side). A thin base64 wrapper over
+ *  {@link parseSignatureObject} — byte-identical to before the object-core split. */
 declare function parseSignatureHeader(value: string): X402PaymentSignature | null;
 /**
  * Parse an inbound `exact` payment from a base64 header value (`PAYMENT-SIGNATURE`
@@ -455,6 +685,32 @@ declare function parseSignatureHeader(value: string): X402PaymentSignature | nul
  * `onchain-proof` proof, or malformed).
  */
 declare function parseExactPaymentHeader(value: string): ParsedExactPayment | null;
+/**
+ * Parse an already-decoded `exact` PaymentPayload OBJECT — the object-accepting CORE
+ * of {@link parseExactPaymentHeader}, identical logic minus the base64 decode. It
+ * absorbs the v1/v2 wire skew (the `accepted` wrapper vs flat `scheme`/`network`) and
+ * the six exact-method discriminants. The A2A transport feeds raw JSON metadata here
+ * (via `gate.verifyObject`); {@link parseExactPaymentHeader} is the thin base64 wrapper,
+ * byte-identical to before this split on the HTTP path.
+ */
+declare function parseExactObject(parsed: unknown): ParsedExactPayment | null;
+/**
+ * Parse an inbound `upto` (metered) payment from a base64 header value
+ * (`PAYMENT-SIGNATURE` v2 or `X-PAYMENT` v1). A SEPARATE parser from
+ * {@link parseExactPaymentHeader}, gated strictly on `scheme === 'upto'` AND a
+ * `witness.facilitator` STRING — so an upto payload never matches the exact parser and an
+ * exact Permit2 payload (no `witness.facilitator`) never matches this one. Returns null
+ * when the value isn't a recognisable `upto` payment.
+ */
+declare function parseUptoPaymentHeader(value: string): ParsedUptoPayment | null;
+/**
+ * Parse an already-decoded `upto` (metered) PaymentPayload OBJECT — the object-accepting
+ * CORE of {@link parseUptoPaymentHeader}, identical logic minus the base64 decode. Gated
+ * strictly on `scheme === 'upto'` + a `witness.facilitator` string. The A2A transport feeds
+ * raw JSON metadata here (via `gate.verifyObject`); {@link parseUptoPaymentHeader} is the thin
+ * base64 wrapper, byte-identical to before this split on the HTTP path.
+ */
+declare function parseUptoObject(parsed: unknown): ParsedUptoPayment | null;
 /**
  * Pick the first accepts[] entry on the `onchain-proof` scheme whose network
  * satisfies `matches` (any chain family). Returns null if none match.
@@ -505,10 +761,21 @@ interface SpendRecord {
     host: string;
     network: Caip2;
     asset: string;
-    /** Base units paid (already scaled by decimals). */
+    /** Base units that count toward the budget. For onchain-proof/exact this is the paid
+     *  amount. For the metered `upto` rail it is the authorized **MAX** (not the merchant's
+     *  claimed actual) — the only buyer-provable bound, so a malicious merchant that settles
+     *  the MAX on-chain but under-reports the actual can never loosen a cumulative cap
+     *  (`maxTotal` / `maxTotalPerDenom` / `windowTotal`). See {@link settledBase} for the actual. */
     amountBase: string;
-    /** Human-readable amount, e.g. '0.05'. */
+    /** Human-readable {@link amountBase}, e.g. '0.05'. */
     amountFormatted: string;
+    /** METERED `upto` ONLY: the merchant-claimed settled **actual**, clamped to `≤` the
+     *  authorized MAX (`amountBase`). Informational — surfaced for transparency/reconciliation
+     *  (and equal to the receipt's amount); it does NOT feed any cap (those tally the MAX).
+     *  Absent for onchain-proof/exact (where the actual IS the budgeted amount). */
+    settledBase?: string;
+    /** Human-readable {@link settledBase}. */
+    settledFormatted?: string;
     symbol?: string;
     /** TRUE token decimals. Carried on the record so a {@link SpendStore} can rebuild
      *  exact totals + the grand total on reload (the client stamps it on every settle). */
@@ -655,4 +922,4 @@ declare class SpendLedger {
     summary(): SpendSummary;
 }
 
-export { type AddressId as A, buildSignatureHeader as B, type Caip2 as C, memorySpendStore as D, type ExactAuthorizationWire as E, parseChallenge as F, parseExactPaymentHeader as G, HEADER_REQUIRED as H, parseReceipt as I, parseSettleResponse as J, parseSignatureHeader as K, pickAccept as L, type PaidReceipt as P, type SettleOutcome as S, type VerifyErrorCode as V, type X402AcceptEntry as X, type AssetId as a, type ExactPaymentPayload as b, type ExactPaymentPayloadAny as c, HEADER_RESPONSE as d, HEADER_RESPONSE_V1 as e, HEADER_SIGNATURE as f, HEADER_SIGNATURE_V1 as g, type ParsedExactPayment as h, type Permit2Authorization as i, type Permit2PaymentPayload as j, type SpendAssetTotal as k, type SpendDenomTotal as l, SpendLedger as m, type SpendRecord as n, type SpendStore as o, type SpendSummary as p, type VerifyResult as q, type X402AnyAccept as r, type X402Challenge as s, type X402ExactAcceptEntry as t, type X402PaymentSignature as u, type X402Receipt as v, type X402ResourceObject as w, buildChallengeHeader as x, buildExactSignatureHeader as y, buildReceiptHeader as z };
+export { parseSignatureObject as $, type AddressId as A, type X402PaymentSignature as B, type Caip2 as C, type X402Receipt as D, EXT_OFFER_RECEIPT as E, type X402ResourceObject as F, type X402UptoAcceptEntry as G, HEADER_REQUIRED as H, buildChallengeHeader as I, buildExactSignatureHeader as J, buildReceiptExtension as K, buildReceiptHeader as L, buildSignatureHeader as M, buildUptoSignatureHeader as N, decodeBase64Json as O, type PaidReceipt as P, memorySpendStore as Q, parseChallenge as R, type SettleOutcome as S, parseExactObject as T, parseExactPaymentHeader as U, type VerifyErrorCode as V, parseReceipt as W, type X402AcceptEntry as X, parseReceiptExtension as Y, parseSettleResponse as Z, parseSignatureHeader as _, type AssetId as a, parseUptoObject as a0, parseUptoPaymentHeader as a1, pickAccept as a2, type ExactAuthorizationWire as b, type ExactPaymentPayload as c, type ExactPaymentPayloadAny as d, HEADER_RESPONSE as e, HEADER_RESPONSE_V1 as f, HEADER_SIGNATURE as g, HEADER_SIGNATURE_V1 as h, type ParsedExactPayment as i, type ParsedUptoPayment as j, type Permit2Authorization as k, type Permit2PaymentPayload as l, type Permit2UptoAuthorization as m, type Permit2UptoPaymentPayload as n, type PipRailReceipt as o, type SignedReceipt as p, type SpendAssetTotal as q, type SpendDenomTotal as r, SpendLedger as s, type SpendRecord as t, type SpendStore as u, type SpendSummary as v, type VerifyResult as w, type X402AnyAccept as x, type X402Challenge as y, type X402ExactAcceptEntry as z };

package/dist/node.d.cts

@@ -1,5 +1,5 @@
-import { o as SpendStore } from './ledger-BtzrfO-3.cjs';
-export { D as memorySpendStore } from './ledger-BtzrfO-3.cjs';
+import { u as SpendStore } from './ledger-OQos-tmj.cjs';
+export { Q as memorySpendStore } from './ledger-OQos-tmj.cjs';
 
 /**
  * A durable {@link SpendStore} backed by a local JSONL file (one settled payment per

package/dist/node.d.ts

@@ -1,5 +1,5 @@
-import { o as SpendStore } from './ledger-BtzrfO-3.js';
-export { D as memorySpendStore } from './ledger-BtzrfO-3.js';
+import { u as SpendStore } from './ledger-OQos-tmj.js';
+export { Q as memorySpendStore } from './ledger-OQos-tmj.js';
 
 /**
  * A durable {@link SpendStore} backed by a local JSONL file (one settled payment per

package/dist/receipt-NNEID77X.js

@@ -0,0 +1,14 @@
+import {
+  RECEIPT_DOMAIN,
+  RECEIPT_PRIMARY_TYPE,
+  RECEIPT_TYPES,
+  signReceiptEvm,
+  verifyReceiptAttestationEvm
+} from "./chunk-3SBTJKAG.js";
+export {
+  RECEIPT_DOMAIN,
+  RECEIPT_PRIMARY_TYPE,
+  RECEIPT_TYPES,
+  signReceiptEvm,
+  verifyReceiptAttestationEvm
+};

package/dist/receipt-QCDPMWNF.cjs

@@ -0,0 +1,14 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+var _chunkCQQI5IJXcjs = require('./chunk-CQQI5IJX.cjs');
+
+
+
+
+
+
+exports.RECEIPT_DOMAIN = _chunkCQQI5IJXcjs.RECEIPT_DOMAIN; exports.RECEIPT_PRIMARY_TYPE = _chunkCQQI5IJXcjs.RECEIPT_PRIMARY_TYPE; exports.RECEIPT_TYPES = _chunkCQQI5IJXcjs.RECEIPT_TYPES; exports.signReceiptEvm = _chunkCQQI5IJXcjs.signReceiptEvm; exports.verifyReceiptAttestationEvm = _chunkCQQI5IJXcjs.verifyReceiptAttestationEvm;

package/dist/{stellar-BEMT7UYF.js → stellar-ASP2THL2.js}

@@ -336,7 +336,7 @@ function makeStellarNetwork(preset, rpcUrl) {
       }
       return {
         asset: stellarAssetId(t.code, t.issuer),
-        decimals: t.decimals,
+        decimals: STELLAR_DECIMALS,
         symbol: t.symbol ?? t.code
       };
     },

package/dist/{stellar-SUKASK4N.cjs → stellar-CRWBSX4E.cjs}

@@ -336,7 +336,7 @@ function makeStellarNetwork(preset, rpcUrl) {
       }
       return {
         asset: stellarAssetId(t.code, t.issuer),
-        decimals: t.decimals,
+        decimals: STELLAR_DECIMALS,
         symbol: _nullishCoalesce(t.symbol, () => ( t.code))
       };
     },

package/dist/{sui-F5JQ2N6I.js → sui-FZIKZNVI.js}

@@ -44,13 +44,23 @@ async function paySui(params) {
       const [coin] = tx.splitCoins(tx.gas, [amount]);
       tx.transferObjects([coin], accept.payTo);
     } else {
-      const coins = await client.getCoins({ owner: sender, coinType: accept.asset });
-      if (!coins.data.length) {
+      const ids = [];
+      let gathered = 0n;
+      let cursor;
+      do {
+        const page = await client.getCoins({ owner: sender, coinType: accept.asset, cursor });
+        for (const c of page.data) {
+          ids.push(c.coinObjectId);
+          gathered += BigInt(c.balance);
+          if (gathered >= amount) break;
+        }
+        cursor = page.hasNextPage ? page.nextCursor : null;
+      } while (gathered < amount && cursor);
+      if (!ids.length) {
         throw new InsufficientFundsError(
           `Sui wallet holds no ${accept.asset} coin objects to pay from.`
         );
       }
-      const ids = coins.data.map((c) => c.coinObjectId);
       const primary = ids[0];
       if (ids.length > 1) {
         tx.mergeCoins(tx.object(primary), ids.slice(1).map((id) => tx.object(id)));

package/dist/{sui-VE5LT7BL.cjs → sui-Y4RLKKE2.cjs}

@@ -44,13 +44,23 @@ async function paySui(params) {
       const [coin] = tx.splitCoins(tx.gas, [amount]);
       tx.transferObjects([coin], accept.payTo);
     } else {
-      const coins = await client.getCoins({ owner: sender, coinType: accept.asset });
-      if (!coins.data.length) {
+      const ids = [];
+      let gathered = 0n;
+      let cursor;
+      do {
+        const page = await client.getCoins({ owner: sender, coinType: accept.asset, cursor });
+        for (const c of page.data) {
+          ids.push(c.coinObjectId);
+          gathered += BigInt(c.balance);
+          if (gathered >= amount) break;
+        }
+        cursor = page.hasNextPage ? page.nextCursor : null;
+      } while (gathered < amount && cursor);
+      if (!ids.length) {
         throw new (0, _chunkMWBT7MCEcjs.InsufficientFundsError)(
           `Sui wallet holds no ${accept.asset} coin objects to pay from.`
         );
       }
-      const ids = coins.data.map((c) => c.coinObjectId);
       const primary = ids[0];
       if (ids.length > 1) {
         tx.mergeCoins(tx.object(primary), ids.slice(1).map((id) => tx.object(id)));

package/dist/{tron-ZZZS3FNN.js → tron-BMCWN5SS.js}

@@ -76,8 +76,14 @@ async function payTron(params) {
 }
 async function payTronNative(params) {
   const { client, from, privateKey, accept } = params;
+  const sun = BigInt(accept.amount);
+  if (sun > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new InsufficientFundsError(
+      `Tron native amount ${accept.amount} sun exceeds the safe-integer range tronweb.sendTrx accepts \u2014 price this resource in a smaller native amount or a TRC-20 token.`
+    );
+  }
   try {
-    const unsigned = await client.transactionBuilder.sendTrx(accept.payTo, Number(accept.amount), from);
+    const unsigned = await client.transactionBuilder.sendTrx(accept.payTo, Number(sun), from);
     const signed = await client.trx.sign(unsigned, privateKey);
     const broadcast = await client.trx.sendRawTransaction(signed);
     if (broadcast.result === true || broadcast.txid || broadcast.transaction?.txID) {

package/dist/{tron-EMFXDFHW.cjs → tron-OMXB6EW2.cjs}

@@ -76,8 +76,14 @@ async function payTron(params) {
 }
 async function payTronNative(params) {
   const { client, from, privateKey, accept } = params;
+  const sun = BigInt(accept.amount);
+  if (sun > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new (0, _chunkMWBT7MCEcjs.InsufficientFundsError)(
+      `Tron native amount ${accept.amount} sun exceeds the safe-integer range tronweb.sendTrx accepts \u2014 price this resource in a smaller native amount or a TRC-20 token.`
+    );
+  }
   try {
-    const unsigned = await client.transactionBuilder.sendTrx(accept.payTo, Number(accept.amount), from);
+    const unsigned = await client.transactionBuilder.sendTrx(accept.payTo, Number(sun), from);
     const signed = await client.trx.sign(unsigned, privateKey);
     const broadcast = await client.trx.sendRawTransaction(signed);
     if (broadcast.result === true || broadcast.txid || _optionalChain([broadcast, 'access', _9 => _9.transaction, 'optionalAccess', _10 => _10.txID])) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piprail/sdk",
-  "version": "2.9.0",
+  "version": "2.11.0",
   "description": "Accept x402 crypto payments across 29 chains — every major EVM chain plus Solana, TON, Tron, NEAR, Sui, Aptos, Algorand, Stellar & XRPL — in a couple of lines. No backend, no database, no fee; payments settle straight to your wallet.",
   "type": "module",
   "main": "./dist/index.cjs",