@tempoxyz/patron 0.0.19 → 0.0.21

package/README.md

@@ -50,7 +50,9 @@ and the site's domain through an Oblivious HTTP relay (RFC 9458): the relay sees
 not the content; the gateway sees the content but not your IP.
 
 Local state lives in `~/.patron`: settings, seals encrypted with AES-256-GCM under a key
-file readable only by you, and this month's per-site counts, which never leave the machine.
+file readable only by you, this month's per-site counts, which never leave the machine, and
+a copy of the CLI in `~/.patron/cli` that agent hooks start with node, so a read never waits
+on npx. Running `npx @tempoxyz/patron` updates the copy.
 
 ## Budget
 

package/dist/bin.js

@@ -4,14 +4,14 @@ const require = __patronCreateRequire(import.meta.url)
 
 // src/bin.ts
 if (process.argv[2] === "hook") {
-  const { runHookProcess } = await import("./chunks/hook-process-XBV2NU4E.js");
+  const { runHookProcess } = await import("./chunks/hook-process-FNSWFVFP.js");
   await runHookProcess().catch(() => void 0);
   process.exit(0);
 } else if (process.argv[2] === "pay") {
-  const { runPayProcess } = await import("./chunks/hook-process-XBV2NU4E.js");
+  const { runPayProcess } = await import("./chunks/hook-process-FNSWFVFP.js");
   await runPayProcess().catch(() => void 0);
   process.exit(0);
 } else {
-  const { run } = await import("./chunks/-I33RKF7A.js");
+  const { run } = await import("./chunks/-NGLRKGBT.js");
   process.exitCode = await run(process.argv.slice(2));
 }

package/dist/chunks/{-I33RKF7A.js → -NGLRKGBT.js}

@@ -28,10 +28,10 @@ import {
   withPatronStatus,
   withoutPatronHandlers,
   writeJsonObject
-} from "./chunk-WG4BTHH7.js";
+} from "./chunk-UFBFF3R6.js";
 import {
   startRefill
-} from "./chunk-CV2WYKM7.js";
+} from "./chunk-HEQBEBKL.js";
 import {
   DEFAULT_MONTHLY_BUDGET_USD,
   MAX_TOKENS_PER_PAGE,
@@ -62,13 +62,14 @@ import "./chunk-GTMLTZRN.js";
 
 // src/index.ts
 import { readFileSync } from "node:fs";
-import { rm as rm3 } from "node:fs/promises";
-import { homedir } from "node:os";
+import { rm as rm4 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
 
 // src/agents.ts
 import { constants } from "node:fs";
-import { access, realpath } from "node:fs/promises";
-import { delimiter, join as join4 } from "node:path";
+import { access as access2, realpath as realpath2 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { delimiter, join as join5 } from "node:path";
 
 // src/amp.ts
 import { mkdir, readFile, rm } from "node:fs/promises";
@@ -322,6 +323,66 @@ function parse(text) {
   }
 }
 
+// src/stable-install.ts
+import {
+  access,
+  cp,
+  mkdir as mkdir2,
+  readdir,
+  readFile as readFile3,
+  readlink,
+  realpath,
+  rename,
+  rm as rm3,
+  symlink
+} from "node:fs/promises";
+import { basename, dirname as dirname3, join as join4 } from "node:path";
+function stableBin(home) {
+  return join4(home, "cli", "current", "dist", "bin.js");
+}
+async function installStableCli(home, script = process.argv[1]) {
+  const resolved = script ? await realpath(script).catch(() => void 0) : void 0;
+  if (!resolved || !/[/\\]_npx[/\\]/.test(resolved) || basename(resolved) !== "bin.js")
+    return void 0;
+  const packageDir = dirname3(dirname3(resolved));
+  const { version } = JSON.parse(await readFile3(join4(packageDir, "package.json"), "utf8"));
+  if (typeof version !== "string" || !/^[\w.+-]+$/.test(version)) return void 0;
+  const root = join4(home, "cli");
+  const target = join4(root, version);
+  await mkdir2(root, { recursive: true, mode: 448 });
+  if (!await isFile(join4(target, "dist", "bin.js"))) {
+    const staging = `${target}.${process.pid}.tmp`;
+    await rm3(staging, { force: true, recursive: true });
+    await cp(join4(packageDir, "dist"), join4(staging, "dist"), { recursive: true });
+    await cp(join4(packageDir, "package.json"), join4(staging, "package.json"));
+    await rm3(target, { force: true, recursive: true });
+    await rename(staging, target);
+  }
+  const current = join4(root, "current");
+  const linked = await readlink(current).catch(() => void 0);
+  const previous = linked ? basename(linked) : void 0;
+  if (previous !== version) {
+    const link = `${current}.${process.pid}.tmp`;
+    await rm3(link, { force: true });
+    await symlink(process.platform === "win32" ? target : version, link, "junction");
+    await rename(link, current).catch(async () => {
+      await rm3(current, { force: true, recursive: true });
+      await rename(link, current);
+    });
+  }
+  for (const entry of await readdir(root)) {
+    if (entry === "current" || entry === version || entry === previous) continue;
+    await rm3(join4(root, entry), { force: true, recursive: true });
+  }
+  return stableBin(home);
+}
+async function isFile(path) {
+  return access(path).then(
+    () => true,
+    () => false
+  );
+}
+
 // src/agents.ts
 var AGENT_LABELS = {
   amp: "Amp",
@@ -332,7 +393,7 @@ var AGENT_LABELS = {
 var ADAPTERS = {
   amp: {
     files: ({ env, home }) => [ampPluginPath(env, home)],
-    detect: async ({ env, home }) => await exists(join4(env.XDG_CONFIG_HOME || join4(home, ".config"), "amp")) || await onPath(["amp"], env.PATH ?? ""),
+    detect: async ({ env, home }) => await exists(join5(env.XDG_CONFIG_HOME || join5(home, ".config"), "amp")) || await onPath(["amp"], env.PATH ?? ""),
     install: async (command, { env, home }) => ({
       state: await installAmpPlugin(ampPluginPath(env, home), command)
     }),
@@ -357,7 +418,7 @@ var ADAPTERS = {
   },
   cursor: {
     files: ({ home }) => [cursorHooksPath(home)],
-    detect: async ({ env, home }) => await exists(join4(home, ".cursor")) || await onPath(["cursor-agent", "cursor"], env.PATH ?? ""),
+    detect: async ({ env, home }) => await exists(join5(home, ".cursor")) || await onPath(["cursor-agent", "cursor"], env.PATH ?? ""),
     install: async (command, { home }) => ({
       state: await installCursorHook(cursorHooksPath(home), command)
     }),
@@ -365,10 +426,10 @@ var ADAPTERS = {
   }
 };
 function claudeDirectory({ env, home }) {
-  return env.CLAUDE_CONFIG_DIR || join4(home, ".claude");
+  return env.CLAUDE_CONFIG_DIR || join5(home, ".claude");
 }
 function claudeSettingsPath(environment) {
-  return join4(claudeDirectory(environment), "settings.json");
+  return join5(claudeDirectory(environment), "settings.json");
 }
 async function detectAgents(environment) {
   const found = await Promise.all(
@@ -421,7 +482,7 @@ async function removeAgents(environment) {
   );
 }
 function originalsStore({ env, home }) {
-  return originalsPath(env.PATRON_HOME || join4(home, ".patron"));
+  return originalsPath(env.PATRON_HOME || join5(home, ".patron"));
 }
 function failure(agent, error) {
   return {
@@ -431,18 +492,20 @@ function failure(agent, error) {
     state: "failed"
   };
 }
-async function hookCommand(env = process.env, script = process.argv[1], node = process.execPath) {
+async function hookCommand(env = process.env, script = process.argv[1], node = process.execPath, patronHome = env.PATRON_HOME || join5(homedir(), ".patron")) {
   if (env.PATRON_HOOK_COMMAND) return env.PATRON_HOOK_COMMAND;
-  const resolved = script ? await realpath(script).catch(() => void 0) : void 0;
+  const resolved = script ? await realpath2(script).catch(() => void 0) : void 0;
   if (resolved && /[/\\]bin\.js$/.test(resolved) && !/[/\\]_npx[/\\]/.test(resolved))
     return `${quote(node)} ${quote(resolved)} hook`;
+  if (await exists(stableBin(patronHome)))
+    return `${quote(node)} ${quote(stableBin(patronHome))} hook`;
   return "npx -y @tempoxyz/patron hook";
 }
 function quote(value) {
   return /^[\w./:@-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
 }
 async function exists(path) {
-  return access(path).then(
+  return access2(path).then(
     () => true,
     () => false
   );
@@ -451,7 +514,7 @@ async function onPath(commands, path) {
   for (const directory of path.split(delimiter)) {
     if (!directory) continue;
     for (const command of commands) {
-      const found = await access(join4(directory, command), constants.X_OK).then(
+      const found = await access2(join5(directory, command), constants.X_OK).then(
         () => true,
         () => false
       );
@@ -744,7 +807,7 @@ function defaults() {
   const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
   const color = supportsColor(process.stdout);
   return {
-    agents: { env: process.env, home: homedir() },
+    agents: { env: process.env, home: homedir2() },
     color,
     fetch: globalThis.fetch,
     interactive,
@@ -848,6 +911,18 @@ async function main(deps) {
   await status(deps, deps.interactive);
 }
 async function syncAgents(deps, config) {
+  await installStableCli(deps.settings.home).catch(() => void 0);
+  const command = await hookCommand(deps.agents.env);
+  const moved = (await installAgents(config.agents, command, deps.agents)).filter((result) => result.state === "installed").map((result) => result.agent);
+  if (moved.length > 0) {
+    say(
+      deps,
+      `Patron now starts with node for ${moved.map((a) => AGENT_LABELS[a]).join(", ")}.`
+    );
+    if (moved.includes("codex"))
+      say(deps, "  Codex: trust the hook again in /hooks when it asks.");
+    say(deps);
+  }
   const upgraded = await upgradeAgents(config.agents, deps.agents);
   if (upgraded.length > 0) {
     const names = upgraded.map((agent) => AGENT_LABELS[agent]).join(", ");
@@ -860,11 +935,7 @@ async function syncAgents(deps, config) {
     (agent) => !config.agents.includes(agent)
   );
   if (added.length === 0) return;
-  const results = await installAgents(
-    added,
-    await hookCommand(deps.agents.env),
-    deps.agents
-  );
+  const results = await installAgents(added, command, deps.agents);
   for (const line of formatAgentResults(results, deps.color)) say(deps, line);
   say(deps);
   const installed = results.filter((result) => result.state !== "failed").map((result) => result.agent);
@@ -910,6 +981,7 @@ async function setup(deps) {
   const bought = await buyWithinBudget(settings, config, STARTER_TOKENS, deps.openWallet);
   done(deps, `${bought.toLocaleString("en-US")} seals ready`);
   deps.startRefill();
+  await installStableCli(settings.home).catch(() => void 0);
   const agents = await detectAgents(deps.agents);
   if (agents.length === 0) {
     say(deps);
@@ -1147,7 +1219,7 @@ async function uninstall(deps) {
     }
   }
   if (purge) {
-    await rm3(deps.settings.home, { force: true, recursive: true });
+    await rm4(deps.settings.home, { force: true, recursive: true });
     done(deps, "Local data deleted.");
   } else
     say(

package/dist/chunks/{chunk-CV2WYKM7.js → chunk-HEQBEBKL.js}

@@ -3,10 +3,12 @@ const require = __patronCreateRequire(import.meta.url)
 
 // src/refill-process.ts
 import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
 function startRefill(script = process.argv[1]) {
   try {
     if (!script) return;
-    const child = spawn(process.execPath, [...process.execArgv, script, "refill"], {
+    const [command, args] = refillCommand(script);
+    const child = spawn(command, args, {
       detached: true,
       env: process.env,
       stdio: "ignore"
@@ -16,6 +18,17 @@ function startRefill(script = process.argv[1]) {
   } catch {
   }
 }
+function refillCommand(script) {
+  try {
+    createRequire(script).resolve("mppx");
+    return [process.execPath, [...process.execArgv, script, "refill"]];
+  } catch {
+    return [
+      process.platform === "win32" ? "npx.cmd" : "npx",
+      ["-y", "@tempoxyz/patron", "refill"]
+    ];
+  }
+}
 function startPayment(payload, script = process.argv[1]) {
   return new Promise((resolve) => {
     try {

package/dist/chunks/{chunk-WG4BTHH7.js → chunk-UFBFF3R6.js}

@@ -34215,9 +34215,9 @@ var PARTIALLY_BLIND_RSA_TOKEN_TYPE = {
 
 // ../../node_modules/.pnpm/@cloudflare+privacypass-ts@0.9.0/node_modules/@cloudflare/privacypass-ts/lib/src/pub_verif_token.js
 var BlindRSAMode;
-(function(BlindRSAMode3) {
-  BlindRSAMode3[BlindRSAMode3["PSSZero"] = 0] = "PSSZero";
-  BlindRSAMode3[BlindRSAMode3["PSS"] = 48] = "PSS";
+(function(BlindRSAMode2) {
+  BlindRSAMode2[BlindRSAMode2["PSSZero"] = 0] = "PSSZero";
+  BlindRSAMode2[BlindRSAMode2["PSS"] = 48] = "PSS";
 })(BlindRSAMode || (BlindRSAMode = {}));
 var PartiallyBlindRSAMode = BlindRSAMode;
 var BLINDRSA_EXTRA_PARAMS = {
@@ -34538,29 +34538,259 @@ var MediaType2;
   MediaType3["GENERIC_BATCHED_TOKEN_RESPONSE"] = "application/private-token-generic-batch-response";
 })(MediaType2 || (MediaType2 = {}));
 
+// ../client/src/blind-rsa.ts
+var HASH = "SHA-384";
+var HASH_LENGTH = 48;
+var SALT_LENGTH = 48;
+var MAX_BLIND_ATTEMPTS = 128;
+async function importBlindRsaKey(cryptoKey) {
+  const algorithm = cryptoKey.algorithm;
+  if (cryptoKey.type !== "public" || algorithm.name !== "RSA-PSS")
+    throw new Error("key is not an RSA-PSS public key");
+  if (algorithm.hash.name !== HASH) throw new Error(`key hash is not ${HASH}`);
+  const jwk = await crypto.subtle.exportKey("jwk", cryptoKey);
+  if (!jwk.n || !jwk.e) throw new Error("key has invalid parameters");
+  const n = bytesToInt(fromBase64UrlBytes(jwk.n));
+  const e = bytesToInt(fromBase64UrlBytes(jwk.e));
+  const modulusBits = n.toString(2).length;
+  if (modulusBits !== algorithm.modulusLength)
+    throw new Error("key has invalid parameters");
+  return { cryptoKey, n, e, modulusBits, modulusBytes: Math.ceil(modulusBits / 8) };
+}
+async function blind(key, messages) {
+  const encoded = await Promise.all(
+    messages.map(
+      (msg) => emsaPssEncode(
+        msg,
+        key.modulusBits - 1,
+        crypto.getRandomValues(new Uint8Array(SALT_LENGTH))
+      )
+    )
+  );
+  return blindEncoded(key, encoded, randomBlindingFactors(key, messages.length));
+}
+function blindEncoded(key, encoded, factors) {
+  const { n } = key;
+  if (encoded.length !== factors.length)
+    throw new Error("one blinding factor per message");
+  const messages = encoded.map(bytesToInt);
+  let product = 1n;
+  for (const m of messages) {
+    if (m >= n) throw new Error("invalid input");
+    product = product * m % n;
+  }
+  if (gcd(product, n) !== 1n) throw new Error("invalid input");
+  return messages.map((m, index) => {
+    const factor = factors[index];
+    const z2 = m * modPow(factor.r, key.e, n) % n;
+    return { blindedMsg: intToBytes(z2, key.modulusBytes), inv: factor.inv };
+  });
+}
+async function finalize2(key, msg, blindSig, inv) {
+  if (blindSig.length !== key.modulusBytes) throw new Error("unexpected input size");
+  const z2 = bytesToInt(blindSig);
+  if (z2 >= key.n) throw new Error("invalid signature");
+  const sig = intToBytes(z2 * inv % key.n, key.modulusBytes);
+  const valid = await crypto.subtle.verify(
+    { name: "RSA-PSS", saltLength: SALT_LENGTH },
+    key.cryptoKey,
+    sig,
+    msg.slice()
+  );
+  if (!valid) throw new Error("invalid signature");
+  return sig;
+}
+async function emsaPssEncode(msg, emBits, salt) {
+  const emLength = Math.ceil(emBits / 8);
+  if (emLength < HASH_LENGTH + salt.length + 2) throw new Error("encoding error");
+  const mHash = await digest(msg);
+  const mPrime = new Uint8Array(8 + HASH_LENGTH + salt.length);
+  mPrime.set(mHash, 8);
+  mPrime.set(salt, 8 + HASH_LENGTH);
+  const h = await digest(mPrime);
+  const dbLength = emLength - HASH_LENGTH - 1;
+  const mask = await mgf12(h, dbLength);
+  const em = new Uint8Array(emLength);
+  em[dbLength - salt.length - 1] = 1;
+  em.set(salt, dbLength - salt.length);
+  for (let index = 0; index < dbLength; index++)
+    em[index] = (em[index] ?? 0) ^ (mask[index] ?? 0);
+  em[0] = (em[0] ?? 0) & 255 >> 8 * emLength - emBits;
+  em.set(h, dbLength);
+  em[emLength - 1] = 188;
+  return em;
+}
+function inverseMod2(a, n) {
+  let oldR = a % n;
+  let r = n;
+  let oldS = 1n;
+  let s = 0n;
+  while (r !== 0n) {
+    const quotient = oldR / r;
+    const nextR = oldR - quotient * r;
+    oldR = r;
+    r = nextR;
+    const nextS = oldS - quotient * s;
+    oldS = s;
+    s = nextS;
+  }
+  if (oldR !== 1n) return void 0;
+  return oldS < 0n ? oldS + n : oldS;
+}
+function randomBlindingFactors(key, count) {
+  const { n } = key;
+  for (let attempt = 0; attempt < MAX_BLIND_ATTEMPTS; attempt++) {
+    const factors = Array.from({ length: count }, () => randomBelow(key));
+    const prefixes = [];
+    let product = 1n;
+    for (const r of factors) {
+      product = product * r % n;
+      prefixes.push(product);
+    }
+    let inverse = inverseMod2(product, n);
+    if (inverse === void 0) continue;
+    const inverses = new Array(count);
+    for (let index = count - 1; index >= 0; index--) {
+      const r = factors[index];
+      inverses[index] = index === 0 ? inverse : inverse * prefixes[index - 1] % n;
+      inverse = inverse * r % n;
+    }
+    return factors.map((r, index) => ({ r, inv: inverses[index] }));
+  }
+  throw new Error("blinding error: no invertible blinding factor found");
+}
+function randomBelow(key) {
+  const bytes = new Uint8Array(key.modulusBytes);
+  const topMask = 255 >> 8 * key.modulusBytes - key.modulusBits;
+  try {
+    for (let attempt = 0; attempt < MAX_BLIND_ATTEMPTS; attempt++) {
+      crypto.getRandomValues(bytes);
+      bytes[0] = (bytes[0] ?? 0) & topMask;
+      const r = bytesToInt(bytes);
+      if (r !== 0n && r < key.n) return r;
+    }
+  } finally {
+    bytes.fill(0);
+  }
+  throw new Error("blinding error: no blinding factor below n found");
+}
+function modPow(base, exponent, modulus) {
+  let result = 1n;
+  let square = base % modulus;
+  let remaining = exponent;
+  while (remaining > 0n) {
+    if (remaining & 1n) result = result * square % modulus;
+    remaining >>= 1n;
+    if (remaining > 0n) square = square * square % modulus;
+  }
+  return result;
+}
+function gcd(a, b) {
+  let x = a;
+  let y = b;
+  while (y !== 0n) {
+    const next = x % y;
+    x = y;
+    y = next;
+  }
+  return x;
+}
+async function mgf12(seed, length2) {
+  const blocks = Math.ceil(length2 / HASH_LENGTH);
+  const hashes = await Promise.all(
+    Array.from({ length: blocks }, (_, counter) => {
+      const input2 = new Uint8Array(seed.length + 4);
+      input2.set(seed);
+      new DataView(input2.buffer).setUint32(seed.length, counter);
+      return digest(input2);
+    })
+  );
+  const mask = new Uint8Array(blocks * HASH_LENGTH);
+  hashes.forEach((hash2, index) => {
+    mask.set(hash2, index * HASH_LENGTH);
+  });
+  return mask.subarray(0, length2);
+}
+async function digest(data) {
+  return new Uint8Array(await crypto.subtle.digest(HASH, data.slice()));
+}
+var HEX = Array.from({ length: 256 }, (_, byte) => byte.toString(16).padStart(2, "0"));
+function bytesToInt(bytes) {
+  if (bytes.length === 0) return 0n;
+  let hex3 = "";
+  for (const byte of bytes) hex3 += HEX[byte];
+  return BigInt(`0x${hex3}`);
+}
+function intToBytes(value, length2) {
+  const hex3 = value.toString(16);
+  if (value < 0n || hex3.length > length2 * 2) throw new Error("integer too large");
+  const padded = hex3.padStart(length2 * 2, "0");
+  const bytes = new Uint8Array(length2);
+  for (let index = 0; index < length2; index++)
+    bytes[index] = Number.parseInt(padded.slice(index * 2, index * 2 + 2), 16);
+  return bytes;
+}
+function fromBase64UrlBytes(value) {
+  const base643 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const binary = atob(base643 + "=".repeat((4 - base643.length % 4) % 4));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+
 // ../client/src/privacy-pass.ts
-var { BlindRSAMode: BlindRSAMode2, Client: Client3 } = pub_verif_token_exports;
+var { BLIND_RSA: BLIND_RSA2, TokenRequest: TokenRequest3, TokenResponse: TokenResponse3, convertRSASSAPSSToEnc: convertRSASSAPSSToEnc2 } = pub_verif_token_exports;
 function tokenChallenge() {
   return new TokenChallenge(TOKEN_TYPE, ISSUER_NAME, new Uint8Array(0));
 }
 async function createTokenRequests(publicKey, count) {
+  if (!(count > 0)) return [];
   const issuerKey = fromBase64Url(publicKey);
-  const challenge = tokenChallenge();
-  const pending = [];
-  for (let index = 0; index < count; index++) {
-    const client = new Client3(BlindRSAMode2.PSS);
-    const request = await client.createTokenRequest(challenge, issuerKey);
-    pending.push({
+  const cryptoKey = await crypto.subtle.importKey(
+    "spki",
+    convertRSASSAPSSToEnc2(issuerKey).slice(),
+    BLIND_RSA2.rsaParams,
+    true,
+    ["verify"]
+  );
+  const key = await importBlindRsaKey(cryptoKey);
+  if (key.modulusBytes !== BLIND_RSA2.Nk) throw new Error("issuer key is not RSA-2048");
+  const [tokenKeyId, challengeDigest] = await Promise.all([
+    sha256(issuerKey),
+    sha256(tokenChallenge().serialize())
+  ]);
+  const truncatedTokenKeyId = tokenKeyId[tokenKeyId.length - 1] ?? 0;
+  const inputs = Array.from({ length: Math.ceil(count) }, () => {
+    const nonce = crypto.getRandomValues(new Uint8Array(32));
+    return new AuthenticatorInput(
+      BLIND_RSA2,
+      BLIND_RSA2.value,
+      nonce,
+      challengeDigest,
+      tokenKeyId
+    );
+  });
+  const tokenInputs = inputs.map((input2) => input2.serialize());
+  const blinded = await blind(key, tokenInputs);
+  const pending = inputs.map((authInput, index) => {
+    const tokenInput = tokenInputs[index];
+    const { blindedMsg, inv: blindInv } = blinded[index];
+    let inv = blindInv;
+    const request = new TokenRequest3(truncatedTokenKeyId, blindedMsg, BLIND_RSA2);
+    return {
       request: toBase64Url(request.serialize()),
       async finalize(signature) {
-        const response = client.deserializeTokenResponse(fromBase64Url(signature));
-        const token = await client.finalize(response);
-        return toBase64Url(token.serialize());
+        if (inv === void 0) throw new Error("token was already finalized");
+        const response = TokenResponse3.deserialize(fromBase64Url(signature));
+        const authenticator = await finalize2(key, tokenInput, response.blindSig, inv);
+        inv = void 0;
+        return toBase64Url(new Token(BLIND_RSA2, authInput, authenticator).serialize());
       }
-    });
-  }
+    };
+  });
   return pending;
 }
+async function sha256(data) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", data.slice()));
+}
 
 // ../client/src/index.ts
 async function getIssuer(gatewayUrl, fetchFn = fetch) {

package/dist/chunks/{hook-6DRXW2XN.js → hook-IWRRBFKG.js}

@@ -15,7 +15,7 @@ import {
   needsRefill,
   redeem,
   refillSize
-} from "./chunk-WG4BTHH7.js";
+} from "./chunk-UFBFF3R6.js";
 import {
   clampTokensPerPage,
   settingsFor

package/dist/chunks/{hook-process-XBV2NU4E.js → hook-process-FNSWFVFP.js}

@@ -10,7 +10,7 @@ import {
 import {
   startPayment,
   startRefill
-} from "./chunk-CV2WYKM7.js";
+} from "./chunk-HEQBEBKL.js";
 import {
   resolveSettings
 } from "./chunk-CF4LJZLC.js";
@@ -25,7 +25,7 @@ async function runHookProcess(argument = process.argv[3]) {
   if (isCursorPayload(payload)) process.stdout.write("{}\n");
   if (!turnEnd(payload) && hookDomains(payload).length === 0) return;
   if (await startPayment(raw)) return;
-  const { runHook } = await import("./hook-6DRXW2XN.js");
+  const { runHook } = await import("./hook-IWRRBFKG.js");
   await runHook({
     readInput: async () => raw,
     settings: resolveSettings(),
@@ -33,7 +33,7 @@ async function runHookProcess(argument = process.argv[3]) {
   });
 }
 async function runPayProcess() {
-  const { PAY_TIMEOUT_MS, runHook } = await import("./hook-6DRXW2XN.js");
+  const { PAY_TIMEOUT_MS, runHook } = await import("./hook-IWRRBFKG.js");
   setTimeout(() => process.exit(0), PAY_TIMEOUT_MS + 1e3).unref();
   const raw = await readStdin(HOOK_TIMEOUT_MS);
   await runHook(

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tempoxyz/patron",
-	"version": "0.0.19",
+	"version": "0.0.21",
 	"description": "Pay the websites your AI agents read, privately",
 	"type": "module",
 	"bin": {