@toon-protocol/client-mcp 0.1.0 → 0.2.0

package/dist/{chunk-5KFXUT5Q.js → chunk-NP35YO5O.js}

@@ -3,11 +3,13 @@ import {
   hmac
 } from "./chunk-32QD72IL.js";
 import {
-  ed25519
-} from "./chunk-FSS45ZX3.js";
+  ed25519,
+  hexToBytes,
+  sha256
+} from "./chunk-DLYE6U2Z.js";
 import {
   HashMD,
-  sha256,
+  sha256 as sha2562,
   sha512
 } from "./chunk-LR7W2ISE.js";
 import {
@@ -20,7 +22,7 @@ import {
   concatBytes,
   createHasher,
   createView,
-  hexToBytes,
+  hexToBytes as hexToBytes2,
   isBytes,
   kdfInputToBytes,
   randomBytes,
@@ -29,7 +31,7 @@ import {
 } from "./chunk-VA7XC4FD.js";
 
 // ../client/dist/index.js
-import { generateSecretKey as generateSecretKey3, getPublicKey as getPublicKey22 } from "nostr-tools/pure";
+import { generateSecretKey as generateSecretKey3, getPublicKey as getPublicKey22, finalizeEvent as finalizeEvent11 } from "nostr-tools/pure";
 import { generateSecretKey as generateSecretKey2 } from "nostr-tools/pure";
 
 // ../../node_modules/.pnpm/@toon-protocol+core@1.4.2_@toon-protocol+connector@3.13.0_typescript@5.9.3/node_modules/@toon-protocol/core/dist/chunk-5WT7ISKC.js
@@ -164,380 +166,13 @@ import { SimplePool as SimplePool2 } from "nostr-tools/pool";
 import { getPublicKey } from "nostr-tools/pure";
 import WebSocket2 from "ws";
 import { getPublicKey as getPublicKey2, verifyEvent } from "nostr-tools/pure";
-
-// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
-function isBytes2(a) {
-  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
-}
-function abytes2(value, length, title = "") {
-  const bytes = isBytes2(value);
-  const len = value?.length;
-  const needsLen = length !== void 0;
-  if (!bytes || needsLen && len !== length) {
-    const prefix = title && `"${title}" `;
-    const ofLen = needsLen ? ` of length ${length}` : "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
-    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    if (!bytes)
-      throw new TypeError(message);
-    throw new RangeError(message);
-  }
-  return value;
-}
-function aexists(instance, checkFinished = true) {
-  if (instance.destroyed)
-    throw new Error("Hash instance has been destroyed");
-  if (checkFinished && instance.finished)
-    throw new Error("Hash#digest() has already been called");
-}
-function aoutput(out, instance) {
-  abytes2(out, void 0, "digestInto() output");
-  const min = instance.outputLen;
-  if (out.length < min) {
-    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
-  }
-}
-function clean2(...arrays) {
-  for (let i = 0; i < arrays.length; i++) {
-    arrays[i].fill(0);
-  }
-}
-function createView2(arr) {
-  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
-}
-function rotr(word, shift) {
-  return word << 32 - shift | word >>> shift;
-}
-var hasHexBuiltin = /* @__PURE__ */ (() => (
-  // @ts-ignore
-  typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
-))();
-var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
-function asciiToBase16(ch) {
-  if (ch >= asciis._0 && ch <= asciis._9)
-    return ch - asciis._0;
-  if (ch >= asciis.A && ch <= asciis.F)
-    return ch - (asciis.A - 10);
-  if (ch >= asciis.a && ch <= asciis.f)
-    return ch - (asciis.a - 10);
-  return;
-}
-function hexToBytes2(hex) {
-  if (typeof hex !== "string")
-    throw new TypeError("hex string expected, got " + typeof hex);
-  if (hasHexBuiltin) {
-    try {
-      return Uint8Array.fromHex(hex);
-    } catch (error) {
-      if (error instanceof SyntaxError)
-        throw new RangeError(error.message);
-      throw error;
-    }
-  }
-  const hl = hex.length;
-  const al = hl / 2;
-  if (hl % 2)
-    throw new RangeError("hex string expected, got unpadded hex of length " + hl);
-  const array = new Uint8Array(al);
-  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
-    const n1 = asciiToBase16(hex.charCodeAt(hi));
-    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
-    if (n1 === void 0 || n2 === void 0) {
-      const char = hex[hi] + hex[hi + 1];
-      throw new RangeError('hex string expected, got non-hex character "' + char + '" at index ' + hi);
-    }
-    array[ai] = n1 * 16 + n2;
-  }
-  return array;
-}
-function createHasher2(hashCons, info = {}) {
-  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
-  const tmp = hashCons(void 0);
-  hashC.outputLen = tmp.outputLen;
-  hashC.blockLen = tmp.blockLen;
-  hashC.canXOF = tmp.canXOF;
-  hashC.create = (opts) => hashCons(opts);
-  Object.assign(hashC, info);
-  return Object.freeze(hashC);
-}
-var oidNist = (suffix) => ({
-  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
-  // Larger suffix values would need base-128 OID encoding and a different length byte.
-  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
-});
-
-// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/_md.js
-function Chi(a, b, c) {
-  return a & b ^ ~a & c;
-}
-function Maj(a, b, c) {
-  return a & b ^ a & c ^ b & c;
-}
-var HashMD2 = class {
-  blockLen;
-  outputLen;
-  canXOF = false;
-  padOffset;
-  isLE;
-  // For partial updates less than block size
-  buffer;
-  view;
-  finished = false;
-  length = 0;
-  pos = 0;
-  destroyed = false;
-  constructor(blockLen, outputLen, padOffset, isLE) {
-    this.blockLen = blockLen;
-    this.outputLen = outputLen;
-    this.padOffset = padOffset;
-    this.isLE = isLE;
-    this.buffer = new Uint8Array(blockLen);
-    this.view = createView2(this.buffer);
-  }
-  update(data) {
-    aexists(this);
-    abytes2(data);
-    const { view, buffer, blockLen } = this;
-    const len = data.length;
-    for (let pos = 0; pos < len; ) {
-      const take = Math.min(blockLen - this.pos, len - pos);
-      if (take === blockLen) {
-        const dataView = createView2(data);
-        for (; blockLen <= len - pos; pos += blockLen)
-          this.process(dataView, pos);
-        continue;
-      }
-      buffer.set(data.subarray(pos, pos + take), this.pos);
-      this.pos += take;
-      pos += take;
-      if (this.pos === blockLen) {
-        this.process(view, 0);
-        this.pos = 0;
-      }
-    }
-    this.length += data.length;
-    this.roundClean();
-    return this;
-  }
-  digestInto(out) {
-    aexists(this);
-    aoutput(out, this);
-    this.finished = true;
-    const { buffer, view, blockLen, isLE } = this;
-    let { pos } = this;
-    buffer[pos++] = 128;
-    clean2(this.buffer.subarray(pos));
-    if (this.padOffset > blockLen - pos) {
-      this.process(view, 0);
-      pos = 0;
-    }
-    for (let i = pos; i < blockLen; i++)
-      buffer[i] = 0;
-    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
-    this.process(view, 0);
-    const oview = createView2(out);
-    const len = this.outputLen;
-    if (len % 4)
-      throw new Error("_sha2: outputLen must be aligned to 32bit");
-    const outLen = len / 4;
-    const state = this.get();
-    if (outLen > state.length)
-      throw new Error("_sha2: outputLen bigger than state");
-    for (let i = 0; i < outLen; i++)
-      oview.setUint32(4 * i, state[i], isLE);
-  }
-  digest() {
-    const { buffer, outputLen } = this;
-    this.digestInto(buffer);
-    const res = buffer.slice(0, outputLen);
-    this.destroy();
-    return res;
-  }
-  _cloneInto(to) {
-    to ||= new this.constructor();
-    to.set(...this.get());
-    const { blockLen, buffer, length, finished, destroyed, pos } = this;
-    to.destroyed = destroyed;
-    to.finished = finished;
-    to.length = length;
-    to.pos = pos;
-    if (length % blockLen)
-      to.buffer.set(buffer);
-    return to;
-  }
-  clone() {
-    return this._cloneInto();
-  }
-};
-var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
-  1779033703,
-  3144134277,
-  1013904242,
-  2773480762,
-  1359893119,
-  2600822924,
-  528734635,
-  1541459225
-]);
-
-// ../../node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha2.js
-var SHA256_K = /* @__PURE__ */ Uint32Array.from([
-  1116352408,
-  1899447441,
-  3049323471,
-  3921009573,
-  961987163,
-  1508970993,
-  2453635748,
-  2870763221,
-  3624381080,
-  310598401,
-  607225278,
-  1426881987,
-  1925078388,
-  2162078206,
-  2614888103,
-  3248222580,
-  3835390401,
-  4022224774,
-  264347078,
-  604807628,
-  770255983,
-  1249150122,
-  1555081692,
-  1996064986,
-  2554220882,
-  2821834349,
-  2952996808,
-  3210313671,
-  3336571891,
-  3584528711,
-  113926993,
-  338241895,
-  666307205,
-  773529912,
-  1294757372,
-  1396182291,
-  1695183700,
-  1986661051,
-  2177026350,
-  2456956037,
-  2730485921,
-  2820302411,
-  3259730800,
-  3345764771,
-  3516065817,
-  3600352804,
-  4094571909,
-  275423344,
-  430227734,
-  506948616,
-  659060556,
-  883997877,
-  958139571,
-  1322822218,
-  1537002063,
-  1747873779,
-  1955562222,
-  2024104815,
-  2227730452,
-  2361852424,
-  2428436474,
-  2756734187,
-  3204031479,
-  3329325298
-]);
-var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-var SHA2_32B = class extends HashMD2 {
-  constructor(outputLen) {
-    super(64, outputLen, 8, false);
-  }
-  get() {
-    const { A, B, C, D, E, F, G, H } = this;
-    return [A, B, C, D, E, F, G, H];
-  }
-  // prettier-ignore
-  set(A, B, C, D, E, F, G, H) {
-    this.A = A | 0;
-    this.B = B | 0;
-    this.C = C | 0;
-    this.D = D | 0;
-    this.E = E | 0;
-    this.F = F | 0;
-    this.G = G | 0;
-    this.H = H | 0;
-  }
-  process(view, offset) {
-    for (let i = 0; i < 16; i++, offset += 4)
-      SHA256_W[i] = view.getUint32(offset, false);
-    for (let i = 16; i < 64; i++) {
-      const W15 = SHA256_W[i - 15];
-      const W2 = SHA256_W[i - 2];
-      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
-      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
-      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
-    }
-    let { A, B, C, D, E, F, G, H } = this;
-    for (let i = 0; i < 64; i++) {
-      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
-      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
-      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
-      const T2 = sigma0 + Maj(A, B, C) | 0;
-      H = G;
-      G = F;
-      F = E;
-      E = D + T1 | 0;
-      D = C;
-      C = B;
-      B = A;
-      A = T1 + T2 | 0;
-    }
-    A = A + this.A | 0;
-    B = B + this.B | 0;
-    C = C + this.C | 0;
-    D = D + this.D | 0;
-    E = E + this.E | 0;
-    F = F + this.F | 0;
-    G = G + this.G | 0;
-    H = H + this.H | 0;
-    this.set(A, B, C, D, E, F, G, H);
-  }
-  roundClean() {
-    clean2(SHA256_W);
-  }
-  destroy() {
-    this.destroyed = true;
-    this.set(0, 0, 0, 0, 0, 0, 0, 0);
-    clean2(this.buffer);
-  }
-};
-var _SHA256 = class extends SHA2_32B {
-  // We cannot use array here since array allows indexing by variable
-  // which means optimizer/compiler cannot use registers.
-  A = SHA256_IV[0] | 0;
-  B = SHA256_IV[1] | 0;
-  C = SHA256_IV[2] | 0;
-  D = SHA256_IV[3] | 0;
-  E = SHA256_IV[4] | 0;
-  F = SHA256_IV[5] | 0;
-  G = SHA256_IV[6] | 0;
-  H = SHA256_IV[7] | 0;
-  constructor() {
-    super(32);
-  }
-};
-var sha2562 = /* @__PURE__ */ createHasher2(
-  () => new _SHA256(),
-  /* @__PURE__ */ oidNist(1)
-);
-
-// ../../node_modules/.pnpm/@toon-protocol+core@1.4.2_@toon-protocol+connector@3.13.0_typescript@5.9.3/node_modules/@toon-protocol/core/dist/index.js
 import { SimplePool as SimplePool3 } from "nostr-tools/pool";
 import { getPublicKey as getPublicKey3 } from "nostr-tools/pure";
 import WebSocket22 from "ws";
 import { getPublicKey as getPublicKey4 } from "nostr-tools/pure";
 import { getPublicKey as getPublicKey5 } from "nostr-tools/pure";
 var ILP_PEER_INFO_KIND = 10032;
+var BLOB_STORAGE_REQUEST_KIND = 5094;
 var ILP_SEGMENT_PATTERN = /^[a-z0-9-]+$/;
 var MAX_ILP_ADDRESS_LENGTH = 1023;
 function isValidIlpAddressStructure(address) {
@@ -920,6 +555,40 @@ function buildIlpPeerInfoEvent(info, secretKey, options = {}) {
     secretKey
   );
 }
+function buildBlobStorageRequest(params, secretKey) {
+  if (!params.blobData || params.blobData.length === 0) {
+    throw new ToonError(
+      "Blob storage request blobData is required and must not be empty",
+      "DVM_MISSING_INPUT"
+    );
+  }
+  if (typeof params.bid !== "string" || params.bid === "") {
+    throw new ToonError(
+      "Blob storage request bid must be a non-empty string (USDC micro-units)",
+      "DVM_INVALID_BID"
+    );
+  }
+  const contentType = params.contentType ?? "application/octet-stream";
+  const base64Blob = params.blobData.toString("base64");
+  const tags = [];
+  tags.push(["i", base64Blob, "blob"]);
+  tags.push(["bid", params.bid, "usdc"]);
+  tags.push(["output", contentType]);
+  if (params.params !== void 0) {
+    for (const p of params.params) {
+      tags.push(["param", p.key, p.value]);
+    }
+  }
+  return finalizeEvent9(
+    {
+      kind: BLOB_STORAGE_REQUEST_KIND,
+      content: "",
+      tags,
+      created_at: Math.floor(Date.now() / 1e3)
+    },
+    secretKey
+  );
+}
 var genesis_peers_default = [];
 var PUBKEY_REGEX3 = /^[0-9a-f]{64}$/;
 var ILP_ADDRESS_REGEX = /^g\.[a-zA-Z0-9.-]+$/;
@@ -1132,11 +801,11 @@ function resolveTokenForChain(chain2, requesterPreferredTokens, responderPreferr
   return void 0;
 }
 function hexToBytes3(hex) {
-  const clean3 = hex.startsWith("0x") ? hex.slice(2) : hex;
-  if (clean3.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(clean3)) {
+  const clean2 = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (clean2.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(clean2)) {
     throw new Error(`Invalid hex string: ${hex}`);
   }
-  return hexToBytes2(clean3);
+  return hexToBytes(clean2);
 }
 function concatBytes2(...parts) {
   let len = 0;
@@ -1197,7 +866,7 @@ function hexToMinaBase58PrivateKey(privateKey) {
     Uint8Array.from([MINA_PRIVATE_KEY_VERSION, 1]),
     leScalar
   );
-  const checksum2 = sha2562(sha2562(payload)).slice(0, 4);
+  const checksum2 = sha256(sha256(payload)).slice(0, 4);
   return base58Encode(concatBytes2(payload, checksum2));
 }
 var BootstrapError = class extends ToonError {
@@ -2343,7 +2012,7 @@ function pbkdf2(hash, password, salt, opts) {
 }
 
 // ../../node_modules/.pnpm/@scure+base@1.2.6/node_modules/@scure/base/lib/esm/index.js
-function isBytes3(a) {
+function isBytes2(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
 }
 function isArrayOf(isString, arr) {
@@ -2558,7 +2227,7 @@ function radix(num) {
   const _256 = 2 ** 8;
   return {
     encode: (bytes) => {
-      if (!isBytes3(bytes))
+      if (!isBytes2(bytes))
         throw new Error("radix.encode input should be Uint8Array");
       return convertRadix(Array.from(bytes), _256, num);
     },
@@ -2577,7 +2246,7 @@ function radix2(bits, revPadding = false) {
     throw new Error("radix2: carry overflow");
   return {
     encode: (bytes) => {
-      if (!isBytes3(bytes))
+      if (!isBytes2(bytes))
         throw new Error("radix2.encode input should be Uint8Array");
       return convertRadix2(Array.from(bytes), 8, bits, !revPadding);
     },
@@ -2592,7 +2261,7 @@ function checksum(len, fn) {
   afn(fn);
   return {
     encode(data) {
-      if (!isBytes3(data))
+      if (!isBytes2(data))
         throw new Error("checksum.encode: input should be Uint8Array");
       const sum = fn(data).slice(0, len);
       const res = new Uint8Array(data.length + len);
@@ -2601,7 +2270,7 @@ function checksum(len, fn) {
       return res;
     },
     decode(data) {
-      if (!isBytes3(data))
+      if (!isBytes2(data))
         throw new Error("checksum.decode: input should be Uint8Array");
       const payload = data.slice(0, -len);
       const oldChecksum = data.slice(-len);
@@ -2653,7 +2322,7 @@ function generateMnemonic(wordlist2, strength = 128) {
 }
 var calcChecksum = (entropy) => {
   const bitsLeft = 8 - entropy.length / 4;
-  return new Uint8Array([sha256(entropy)[0] >> bitsLeft << bitsLeft]);
+  return new Uint8Array([sha2562(entropy)[0] >> bitsLeft << bitsLeft]);
 };
 function getCoder(wordlist2) {
   if (!Array.isArray(wordlist2) || wordlist2.length !== 2048 || typeof wordlist2[0] !== "string")
@@ -4777,7 +4446,7 @@ function bytesToNumberLE(bytes) {
   return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));
 }
 function numberToBytesBE(n, len) {
-  return hexToBytes(n.toString(16).padStart(len * 2, "0"));
+  return hexToBytes2(n.toString(16).padStart(len * 2, "0"));
 }
 function numberToBytesLE(n, len) {
   return numberToBytesBE(n, len).reverse();
@@ -4786,7 +4455,7 @@ function ensureBytes(title, hex, expectedLength) {
   let res;
   if (typeof hex === "string") {
     try {
-      res = hexToBytes(hex);
+      res = hexToBytes2(hex);
     } catch (e) {
       throw new Error(title + " must be hex string or Uint8Array, cause: " + e);
     }
@@ -6266,7 +5935,7 @@ function ecdsa(Point2, hash, ecdsaOpts = {}) {
       return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
     }
     static fromHex(hex, format) {
-      return this.fromBytes(hexToBytes(hex), format);
+      return this.fromBytes(hexToBytes2(hex), format);
     }
     addRecoveryBit(recovery) {
       return new Signature(this.r, this.s, recovery);
@@ -6301,7 +5970,7 @@ function ecdsa(Point2, hash, ecdsaOpts = {}) {
     toBytes(format = defaultSigOpts_format) {
       validateSigFormat(format);
       if (format === "der")
-        return hexToBytes(DER.hexFromSig(this));
+        return hexToBytes2(DER.hexFromSig(this));
       const r = Fn.toBytes(this.r);
       const s = Fn.toBytes(this.s);
       if (format === "recovered") {
@@ -6575,7 +6244,7 @@ function sqrtMod(y) {
   return root;
 }
 var Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });
-var secp256k1 = createCurve({ ...secp256k1_CURVE, Fp: Fpk1, lowS: true, endo: secp256k1_ENDO }, sha256);
+var secp256k1 = createCurve({ ...secp256k1_CURVE, Fp: Fpk1, lowS: true, endo: secp256k1_ENDO }, sha2562);
 
 // ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/legacy.js
 var Rho160 = /* @__PURE__ */ Uint8Array.from([
@@ -6697,7 +6366,7 @@ var ripemd160 = /* @__PURE__ */ createHasher(() => new RIPEMD160());
 
 // ../../node_modules/.pnpm/@scure+bip32@1.7.0/node_modules/@scure/bip32/lib/esm/index.js
 var Point = secp256k1.ProjectivePoint;
-var base58check = createBase58check(sha256);
+var base58check = createBase58check(sha2562);
 function bytesToNumber(bytes) {
   abytes(bytes);
   const h = bytes.length === 0 ? "0" : bytesToHex(bytes);
@@ -6706,12 +6375,12 @@ function bytesToNumber(bytes) {
 function numberToBytes(num) {
   if (typeof num !== "bigint")
     throw new Error("bigint expected");
-  return hexToBytes(num.toString(16).padStart(64, "0"));
+  return hexToBytes2(num.toString(16).padStart(64, "0"));
 }
 var MASTER_SECRET = utf8ToBytes("Bitcoin seed");
 var BITCOIN_VERSIONS = { private: 76066276, public: 76067358 };
 var HARDENED_OFFSET = 2147483648;
-var hash160 = (data) => ripemd160(sha256(data));
+var hash160 = (data) => ripemd160(sha2562(data));
 var fromU32 = (data) => createView(data).getUint32(0, false);
 var toU32 = (n) => {
   if (!Number.isSafeInteger(n) || n < 0 || n > 2 ** 32 - 1) {
@@ -6952,7 +6621,7 @@ import {
 import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
 import { toHex as toHex3 } from "viem";
 import { readFileSync, writeFileSync, existsSync } from "fs";
-import { finalizeEvent as finalizeEvent11 } from "nostr-tools/pure";
+import { finalizeEvent as finalizeEvent22 } from "nostr-tools/pure";
 import { nip19 } from "nostr-tools";
 import { getPublicKey as getPublicKey32 } from "nostr-tools/pure";
 import {
@@ -6968,6 +6637,7 @@ var ToonClientError = class extends Error {
     this.code = code;
     this.name = "ToonClientError";
   }
+  code;
 };
 var NetworkError = class extends ToonClientError {
   constructor(message, cause) {
@@ -7021,7 +6691,7 @@ function deriveEvmIdentity(secretKey) {
 async function deriveSolanaKey(seed, accountIndex = 0) {
   const { hmac: hmac2 } = await import("./hmac-26UC6YKX.js");
   const { sha512: sha5122 } = await import("./sha512-WYC446ZM.js");
-  const { ed25519: ed255194 } = await import("./ed25519-2QVPINLS.js");
+  const { ed25519: ed255194 } = await import("./ed25519-2LFQXLYS.js");
   const encoder = new TextEncoder();
   let I = hmac2(sha5122, encoder.encode("ed25519 seed"), seed);
   let key = I.slice(0, 32);
@@ -7369,6 +7039,9 @@ function toHex2(bytes) {
 function encodeUtf8(str) {
   return new TextEncoder().encode(str);
 }
+function decodeUtf8(bytes) {
+  return new TextDecoder().decode(bytes);
+}
 function isBase64(str) {
   return /^[A-Za-z0-9+/]*={0,2}$/.test(str);
 }
@@ -8232,6 +7905,227 @@ var BtpRuntimeClient = class {
     };
   }
 };
+var ILP_CLAIM_HEADER = "ILP-Payment-Channel-Claim";
+var ILP_PEER_ID_HEADER = "ILP-Peer-Id";
+var HttpIlpClient = class {
+  httpEndpoint;
+  peerId;
+  authToken;
+  timeout;
+  retryConfig;
+  httpClient;
+  createWebSocket;
+  constructor(config) {
+    this.httpEndpoint = config.httpEndpoint;
+    this.peerId = config.peerId;
+    this.authToken = config.authToken;
+    this.timeout = config.timeout ?? 3e4;
+    this.retryConfig = {
+      maxRetries: config.maxRetries ?? 3,
+      retryDelay: config.retryDelay ?? 1e3
+    };
+    this.httpClient = config.httpClient ?? fetch;
+    this.createWebSocket = config.createWebSocket;
+  }
+  /**
+   * Send an ILP PREPARE via `POST /ilp` WITHOUT a claim. The connector accepts
+   * this only on free/zero-amount routes; paid writes must use
+   * {@link sendIlpPacketWithClaim}. Satisfies the IlpClient interface.
+   */
+  async sendIlpPacket(params) {
+    return withRetry(() => this.postPrepare(params), {
+      maxRetries: this.retryConfig.maxRetries,
+      retryDelay: this.retryConfig.retryDelay,
+      exponentialBackoff: true,
+      shouldRetry: (error) => error instanceof NetworkError
+    });
+  }
+  /**
+   * Send an ILP PREPARE via `POST /ilp` with the payment-channel claim attached
+   * as the `ILP-Payment-Channel-Claim` header. `claim` is the SAME JSON object
+   * the BTP path attaches as the `payment-channel-claim` protocolData entry —
+   * we base64(JSON.stringify(claim)) it, byte-for-byte identical to BTP.
+   */
+  async sendIlpPacketWithClaim(params, claim) {
+    return withRetry(() => this.postPrepare(params, claim), {
+      maxRetries: this.retryConfig.maxRetries,
+      retryDelay: this.retryConfig.retryDelay,
+      exponentialBackoff: true,
+      shouldRetry: (error) => error instanceof NetworkError
+    });
+  }
+  /**
+   * Upgrade to a duplex BTP session over the SAME endpoint.
+   *
+   * Derives the `ws(s)://` URL from `httpEndpoint`, opens a WebSocket with
+   * `Sec-WebSocket-Protocol: btp` and the same `ILP-Peer-Id` + `Authorization`
+   * headers, and returns a connected {@link BtpRuntimeClient}. When auth headers
+   * are present the connector pre-authenticates the session (no in-band auth
+   * frame); without them the BtpRuntimeClient falls back to the normal BTP
+   * auth-frame flow.
+   *
+   * NOTE: passing per-connection headers + a subprotocol to a WebSocket is
+   * Node-only (the `ws` package). Browsers cannot set arbitrary request headers
+   * on a WebSocket handshake, so a browser consumer must use the gateway
+   * transport or BTP-with-auth-frame instead.
+   */
+  async upgradeToBtp() {
+    const btpUrl = httpEndpointToBtpUrl(this.httpEndpoint);
+    const createWebSocket = this.createWebSocket ?? await makeBtpWebSocketFactory(this.authHeaders());
+    const client = new BtpRuntimeClient({
+      btpUrl,
+      // BtpRuntimeClient sends an auth frame using these; when the connector
+      // pre-authenticated via Upgrade headers it accepts the (redundant) frame.
+      peerId: this.peerId ?? "client",
+      authToken: this.authToken ?? "",
+      createWebSocket
+    });
+    await client.connect();
+    return client;
+  }
+  // ─── Private ──────────────────────────────────────────────────────────────
+  authHeaders() {
+    const headers = {};
+    if (this.peerId) headers[ILP_PEER_ID_HEADER] = this.peerId;
+    if (this.authToken) headers["Authorization"] = `Bearer ${this.authToken}`;
+    return headers;
+  }
+  /**
+   * Single attempt: serialize the PREPARE, POST it, and map the response.
+   * @throws {NetworkError} On connection/timeout failures (retried).
+   * @throws {ConnectorError} On non-retryable transport errors (5xx / unexpected).
+   */
+  async postPrepare(params, claim) {
+    const requestTimeout = params.timeout ?? this.timeout;
+    const prepare = serializeIlpPrepare({
+      type: ILPPacketType.PREPARE,
+      amount: BigInt(params.amount),
+      destination: params.destination,
+      executionCondition: new Uint8Array(32),
+      expiresAt: new Date(Date.now() + requestTimeout),
+      data: fromBase64(params.data)
+    });
+    const headers = {
+      "Content-Type": "application/octet-stream",
+      ...this.authHeaders()
+    };
+    if (claim !== void 0) {
+      headers[ILP_CLAIM_HEADER] = toBase64(
+        encodeUtf8(JSON.stringify(claim))
+      );
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), requestTimeout);
+    try {
+      const response = await this.httpClient(this.httpEndpoint, {
+        method: "POST",
+        headers,
+        // Copy into a fresh ArrayBuffer so fetch sees a clean body, not a view.
+        body: prepare.slice(),
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      return await this.mapResponse(response);
+    } catch (error) {
+      clearTimeout(timeoutId);
+      throw this.mapTransportError(error, requestTimeout);
+    }
+  }
+  /**
+   * Map a `200 OK` body (OER FULFILL/REJECT) to an IlpSendResult; map a non-2xx
+   * to a transport error. Per the wire contract, ILP-level rejects arrive as a
+   * 200 + REJECT body — only HTTP non-2xx means a transport-layer failure.
+   */
+  async mapResponse(response) {
+    if (response.ok) {
+      const buf = new Uint8Array(await response.arrayBuffer());
+      if (buf.length === 0) {
+        throw new ConnectorError("Empty 200 body from /ilp (expected OER ILP response)");
+      }
+      const ilp = deserializeIlpPacket(buf);
+      if (ilp.type === ILPPacketType.FULFILL) {
+        return {
+          accepted: true,
+          data: ilp.data.length > 0 ? toBase64(ilp.data) : void 0
+        };
+      }
+      return {
+        accepted: false,
+        code: ilp.code,
+        message: ilp.message,
+        data: ilp.data.length > 0 ? toBase64(ilp.data) : void 0
+      };
+    }
+    const body = await response.text().catch(() => "");
+    const detail = body ? `: ${body}` : "";
+    if (response.status >= 500) {
+      throw new ConnectorError(
+        `Connector transport error (${response.status} ${response.statusText})${detail}`
+      );
+    }
+    throw new ConnectorError(
+      `ILP-over-HTTP request rejected (${response.status} ${response.statusText})${detail}`
+    );
+  }
+  mapTransportError(error, requestTimeout) {
+    if (error instanceof ConnectorError || error instanceof NetworkError) {
+      return error;
+    }
+    if (error instanceof Error && error.name === "AbortError") {
+      return new NetworkError(`Request timeout after ${requestTimeout}ms`, error);
+    }
+    if (error instanceof TypeError && (error.message.includes("fetch failed") || error.message.includes("ECONNREFUSED") || error.message.includes("ECONNRESET") || error.message.includes("ETIMEDOUT") || error.message.includes("network"))) {
+      return new NetworkError(`Network connection failed: ${error.message}`, error);
+    }
+    return new ConnectorError(
+      `Unexpected error during ILP-over-HTTP request: ${error instanceof Error ? error.message : String(error)}`,
+      error instanceof Error ? error : void 0
+    );
+  }
+};
+function httpEndpointToBtpUrl(httpEndpoint) {
+  return httpEndpoint.replace(/^https:\/\//i, "wss://").replace(/^http:\/\//i, "ws://");
+}
+async function makeBtpWebSocketFactory(headers) {
+  const { createRequire } = await import("module");
+  const require2 = createRequire(import.meta.url);
+  const WS = require2("ws");
+  const ws = WS;
+  const WSClass = typeof ws === "function" ? ws : typeof ws.default === "function" ? ws.default : typeof ws.WebSocket === "function" ? ws.WebSocket : null;
+  if (WSClass === null) {
+    throw new Error(
+      "makeBtpWebSocketFactory: require('ws') did not yield a constructor on .default, .WebSocket, or the module root."
+    );
+  }
+  return (url) => (
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    new WSClass(url, "btp", { headers })
+  );
+}
+function readDiscoveredIlpPeer(peer) {
+  const p = peer ?? {};
+  return {
+    btpEndpoint: typeof p["btpEndpoint"] === "string" ? p["btpEndpoint"] : void 0,
+    httpEndpoint: typeof p["httpEndpoint"] === "string" ? p["httpEndpoint"] : void 0,
+    supportsUpgrade: typeof p["supportsUpgrade"] === "boolean" ? p["supportsUpgrade"] : void 0
+  };
+}
+function selectIlpTransport(peer, options = {}) {
+  const needsDuplex = options.needsDuplex ?? false;
+  const http2 = peer.httpEndpoint?.trim() || void 0;
+  const btp = peer.btpEndpoint?.trim() || void 0;
+  const canUpgrade = peer.supportsUpgrade === true;
+  if (needsDuplex) {
+    if (btp) return { kind: "btp", btpEndpoint: btp };
+    if (http2 && canUpgrade) return { kind: "http-upgradable", httpEndpoint: http2 };
+    throw new Error(
+      "Duplex transport required but peer exposes neither a btpEndpoint nor an upgradable httpEndpoint"
+    );
+  }
+  if (http2) return { kind: "http", httpEndpoint: http2, canUpgrade };
+  if (btp) return { kind: "btp", btpEndpoint: btp };
+  throw new Error("Peer exposes neither an httpEndpoint nor a btpEndpoint");
+}
 var TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
 var SYSTEM_PROGRAM_ID = "11111111111111111111111111111111";
 var RENT_SYSVAR_ID = "SysvarRent111111111111111111111111111111111";
@@ -8319,7 +8213,7 @@ function findProgramAddress(seeds, programId) {
     input.set(programId, offset);
     offset += programId.length;
     input.set(PDA_MARKER, offset);
-    const hash = sha256(input);
+    const hash = sha2562(input);
     if (!isOnCurve(hash)) return { pda: hash, bump };
   }
   throw new Error("Could not find a viable PDA bump seed");
@@ -9399,6 +9293,12 @@ async function initializeHttpMode(config) {
   const effectiveBtpUrl = transport.btpUrl ?? config.btpUrl;
   const effectiveConnectorUrl = transport.connectorUrl ?? config.connectorUrl;
   const settlementInfo = buildSettlementInfo(config);
+  const discoveredPeer = readDiscoveredIlpPeer({
+    btpEndpoint: effectiveBtpUrl,
+    httpEndpoint: config.connectorHttpEndpoint,
+    supportsUpgrade: config.connectorSupportsUpgrade
+  });
+  const transportChoice = discoveredPeer.httpEndpoint || discoveredPeer.btpEndpoint ? selectIlpTransport(discoveredPeer, { needsDuplex: false }) : null;
   let btpClient = null;
   if (effectiveBtpUrl) {
     btpClient = new BtpRuntimeClient({
@@ -9409,7 +9309,20 @@ async function initializeHttpMode(config) {
     });
     await btpClient.connect();
   }
-  const runtimeClient = btpClient ?? new HttpRuntimeClient({
+  let httpIlpClient = null;
+  if (transportChoice && (transportChoice.kind === "http" || transportChoice.kind === "http-upgradable")) {
+    httpIlpClient = new HttpIlpClient({
+      httpEndpoint: transportChoice.httpEndpoint,
+      ...config.btpPeerId !== void 0 ? { peerId: config.btpPeerId } : {},
+      ...config.btpAuthToken !== void 0 ? { authToken: config.btpAuthToken } : {},
+      timeout: config.queryTimeout,
+      maxRetries: config.maxRetries,
+      retryDelay: config.retryDelay,
+      ...transport.httpClient !== void 0 ? { httpClient: transport.httpClient } : {},
+      ...transport.createWebSocket !== void 0 ? { createWebSocket: transport.createWebSocket } : {}
+    });
+  }
+  const runtimeClient = httpIlpClient ?? btpClient ?? new HttpRuntimeClient({
     connectorUrl: effectiveConnectorUrl,
     timeout: config.queryTimeout,
     maxRetries: config.maxRetries,
@@ -9666,7 +9579,7 @@ var DEFAULT_MINA_TOKEN_ID = "MINA";
 var MINA_CLAIM_NETWORK = "devnet";
 function deriveMinaSalt(zkAppAddress, nonce) {
   const digestHex = bytesToHex(
-    sha256(new TextEncoder().encode(`mina-pc-salt:${zkAppAddress}:${nonce}`))
+    sha2562(new TextEncoder().encode(`mina-pc-salt:${zkAppAddress}:${nonce}`))
   );
   const salt = BigInt("0x" + digestHex.slice(0, 60));
   return salt === 0n ? 1n : salt;
@@ -10134,6 +10047,319 @@ var JsonFileChannelStore = class {
     writeFileSync(this.filePath, JSON.stringify(data, null, 2), "utf-8");
   }
 };
+var ARWEAVE_TX_ID_REGEX = /^[A-Za-z0-9_-]{43}$/;
+async function requestBlobStorage(client, secretKey, params) {
+  const bid = params.bid ?? (params.ilpAmount !== void 0 ? String(params.ilpAmount) : void 0);
+  if (bid === void 0 || bid === "") {
+    return {
+      success: false,
+      error: "requestBlobStorage requires a bid (or ilpAmount to derive it)"
+    };
+  }
+  const blobBuffer = Buffer.from(
+    params.blobData.buffer,
+    params.blobData.byteOffset,
+    params.blobData.byteLength
+  );
+  let event;
+  try {
+    event = buildBlobStorageRequest(
+      {
+        blobData: blobBuffer,
+        contentType: params.contentType,
+        bid
+      },
+      secretKey
+    );
+  } catch (error) {
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+  const result = await client.publishEvent(event, {
+    destination: params.destination,
+    claim: params.claim,
+    ilpAmount: params.ilpAmount
+  });
+  if (!result.success) {
+    return {
+      success: false,
+      eventId: result.eventId ?? event.id,
+      error: result.error ?? "Blob storage request rejected"
+    };
+  }
+  if (!result.data) {
+    return {
+      success: false,
+      eventId: event.id,
+      error: "FULFILL contained no data; expected base64-encoded Arweave tx ID"
+    };
+  }
+  const txId = decodeUtf8(fromBase64(result.data));
+  if (!ARWEAVE_TX_ID_REGEX.test(txId)) {
+    return {
+      success: false,
+      eventId: event.id,
+      error: `Decoded FULFILL data is not a valid Arweave tx ID: "${txId}"`
+    };
+  }
+  return {
+    success: true,
+    txId,
+    eventId: event.id
+  };
+}
+var Http402Client = class {
+  fetchImpl;
+  resolveClaim;
+  createIlpClient;
+  needsDuplex;
+  constructor(config = {}) {
+    this.fetchImpl = config.fetch ?? fetch;
+    this.resolveClaim = config.resolveClaim;
+    this.createIlpClient = config.createIlpClient ?? ((httpEndpoint) => new HttpIlpClient({ httpEndpoint }));
+    this.needsDuplex = config.needsDuplex ?? false;
+  }
+  /**
+   * `fetch()`-like entry point. Issues the request; on `402` parses the x402
+   * challenge and — when a usable `toon-channel` offer is present and a claim
+   * resolver is configured — pays over TOON and returns the reconstructed
+   * `Response`. Otherwise returns the original 402 unchanged (AC5).
+   */
+  async fetch(url, opts = {}) {
+    const method = (opts.method ?? "GET").toUpperCase();
+    const probe = await this.fetchImpl(url, {
+      method,
+      ...opts.headers ? { headers: opts.headers } : {},
+      ...opts.body !== void 0 ? { body: opts.body } : {},
+      ...opts.timeout !== void 0 ? { signal: AbortSignal.timeout(opts.timeout) } : {}
+    });
+    if (probe.status !== 402) return probe;
+    const challenge = await parseX402Challenge(probe.clone());
+    const accept = challenge.toonChannel;
+    if (!accept || !this.resolveClaim) return probe;
+    return this.payOverToon(url, method, opts, accept, this.resolveClaim);
+  }
+  /**
+   * Open/reuse a channel (via the injected claim resolver), serialize the HTTP
+   * request into the ILP packet `data`, send it to `POST /ilp` with the claim,
+   * and reconstruct the origin `Response` from the FULFILL `data`.
+   */
+  async payOverToon(url, method, opts, accept, resolveClaim) {
+    const destination = opts.destination ?? accept.destination;
+    const claim = await resolveClaim(destination, accept.amount);
+    const requestBytes = serializeHttpRequest({
+      method,
+      url,
+      headers: opts.headers,
+      body: opts.body
+    });
+    const peer = {
+      httpEndpoint: accept.httpEndpoint,
+      supportsUpgrade: accept.supportsUpgrade
+    };
+    const choice = selectIlpTransport(peer, {
+      needsDuplex: this.needsDuplex
+    });
+    const ilpClient = this.createIlpClient(accept.httpEndpoint);
+    const result = await this.sendOverChoice(
+      ilpClient,
+      choice,
+      {
+        destination,
+        amount: String(accept.amount),
+        data: toBase64(requestBytes),
+        ...opts.timeout !== void 0 ? { timeout: opts.timeout } : {}
+      },
+      claim
+    );
+    if (!result.accepted) {
+      throw new ConnectorError(
+        `h402 payment rejected by connector: ${result.code ?? "F00"} ${result.message ?? ""}`.trim()
+      );
+    }
+    if (!result.data) {
+      throw new ConnectorError(
+        "h402 FULFILL carried no data (expected an HTTP response payload)"
+      );
+    }
+    return parseHttpResponse(fromBase64(result.data));
+  }
+  /**
+   * Send the serialized HTTP-in-ILP PREPARE over the selected transport.
+   *
+   * - `http` / `http-upgradable`: stateless one-shot `POST /ilp` with the claim.
+   * - `http-upgradable` additionally exercises {@link HttpIlpClient.upgradeToBtp}
+   *   for the duplex/streaming path (AC4). v1 still drives the actual write over
+   *   the one-shot HTTP method even after upgrading — full duplex body streaming
+   *   is a documented follow-up — but the upgrade call path is wired here.
+   * - `btp`: not reachable from h402 (the x402 offer only carries an
+   *   `httpEndpoint`); guarded for completeness.
+   */
+  async sendOverChoice(ilpClient, choice, params, claim) {
+    if (choice.kind === "http-upgradable") {
+      const btp = await ilpClient.upgradeToBtp();
+      try {
+        return await btp.sendIlpPacketWithClaim(
+          params,
+          claim
+        );
+      } finally {
+        await btp.disconnect().catch(() => {
+        });
+      }
+    }
+    if (choice.kind === "btp") {
+      throw new ToonClientError(
+        "h402 offer resolved to a BTP-only transport; the x402 toon-channel entry must advertise an httpEndpoint",
+        "INVALID_STATE"
+      );
+    }
+    return ilpClient.sendIlpPacketWithClaim(params, claim);
+  }
+};
+function readString(obj, keys) {
+  for (const k of keys) {
+    const v = obj[k];
+    if (typeof v === "string" && v.trim().length > 0) return v.trim();
+  }
+  return void 0;
+}
+function readAmount(obj, keys) {
+  for (const k of keys) {
+    const v = obj[k];
+    if (typeof v === "bigint") return v;
+    if (typeof v === "number" && Number.isFinite(v)) return BigInt(Math.trunc(v));
+    if (typeof v === "string" && /^\d+$/.test(v.trim())) return BigInt(v.trim());
+  }
+  return void 0;
+}
+async function parseX402Challenge(response) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    return {};
+  }
+  return parseX402Body(body);
+}
+function parseX402Body(body) {
+  if (typeof body !== "object" || body === null) return {};
+  const b = body;
+  const version = typeof b["x402Version"] === "number" ? b["x402Version"] : void 0;
+  const accepts = Array.isArray(b["accepts"]) ? b["accepts"] : [];
+  for (const raw of accepts) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const entry = raw;
+    const scheme = readString(entry, ["scheme"]);
+    if (scheme !== "toon-channel") continue;
+    const destination = readString(entry, [
+      "destination",
+      "ilpAddress",
+      "payTo"
+    ]);
+    const httpEndpoint = readString(entry, [
+      "httpEndpoint",
+      "ilpEndpoint",
+      "endpoint"
+    ]);
+    const amount = readAmount(entry, ["amount", "price", "maxAmountRequired"]);
+    if (!destination || !httpEndpoint || amount === void 0) continue;
+    const network = readString(entry, ["network", "chain"]);
+    const supportsUpgrade = entry["supportsUpgrade"] === true || entry["upgradable"] === true;
+    return {
+      ...version !== void 0 ? { x402Version: version } : {},
+      toonChannel: {
+        scheme: "toon-channel",
+        ...network !== void 0 ? { network } : {},
+        destination,
+        amount,
+        httpEndpoint,
+        supportsUpgrade
+      }
+    };
+  }
+  return version !== void 0 ? { x402Version: version } : {};
+}
+var CRLF = "\r\n";
+function concatHeadAndBody(head, body) {
+  const headBytes = encodeUtf8(head);
+  const out = new Uint8Array(headBytes.length + body.length);
+  out.set(headBytes, 0);
+  out.set(body, headBytes.length);
+  return out;
+}
+function bodyToBytes(body) {
+  if (body === void 0) return new Uint8Array(0);
+  return typeof body === "string" ? encodeUtf8(body) : body;
+}
+function serializeHttpRequest(req) {
+  const u = new URL(req.url);
+  const target = `${u.pathname}${u.search}` || "/";
+  const bodyBytes = bodyToBytes(req.body);
+  const headers = /* @__PURE__ */ new Map();
+  const put = (name, value) => headers.set(name.toLowerCase(), `${name}: ${value}`);
+  const has = (name) => headers.has(name.toLowerCase());
+  for (const [name, value] of Object.entries(req.headers ?? {})) {
+    put(name, value);
+  }
+  if (!has("host")) put("Host", u.host);
+  if (bodyBytes.length > 0 && !has("content-length")) {
+    put("Content-Length", String(bodyBytes.length));
+  }
+  const lines = [
+    `${req.method.toUpperCase()} ${target} HTTP/1.1`,
+    ...headers.values()
+  ];
+  const head = lines.join(CRLF) + CRLF + CRLF;
+  return concatHeadAndBody(head, bodyBytes);
+}
+function findHeaderEnd(bytes) {
+  for (let i = 0; i + 3 < bytes.length; i++) {
+    if (bytes[i] === 13 && bytes[i + 1] === 10 && bytes[i + 2] === 13 && bytes[i + 3] === 10) {
+      return i + 4;
+    }
+  }
+  return -1;
+}
+function parseHttpResponse(bytes) {
+  const headerEnd = findHeaderEnd(bytes);
+  const headBytes = headerEnd === -1 ? bytes : bytes.subarray(0, headerEnd - 2);
+  const body = headerEnd === -1 ? new Uint8Array(0) : bytes.subarray(headerEnd);
+  const headText = decodeUtf8(headBytes);
+  const lines = headText.split(CRLF).filter((l) => l.length > 0);
+  const statusLine = lines.shift();
+  if (!statusLine) {
+    throw new ConnectorError(
+      "h402 response payload had no HTTP status line"
+    );
+  }
+  const match = /^HTTP\/\d\.\d\s+(\d{3})(?:\s+(.*))?$/.exec(statusLine.trim());
+  if (!match) {
+    throw new ConnectorError(
+      `h402 response payload had a malformed status line: "${statusLine}"`
+    );
+  }
+  const status = parseInt(match[1], 10);
+  const statusText = match[2] ?? "";
+  const headers = new Headers();
+  for (const line of lines) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const name = line.slice(0, idx).trim();
+    const value = line.slice(idx + 1).trim();
+    if (name.length === 0) continue;
+    headers.append(name, value);
+  }
+  const nullBodyStatus = status === 101 || status === 204 || status === 205 || status === 304;
+  const init = { status, headers };
+  if (statusText) init.statusText = statusText;
+  return new Response(
+    nullBodyStatus || body.length === 0 ? null : body.slice(),
+    init
+  );
+}
 var ToonClient = class {
   config;
   state = null;
@@ -10184,6 +10410,28 @@ var ToonClient = class {
   getPublicKey() {
     return getPublicKey22(this.config.secretKey);
   }
+  /**
+   * Sign an unsigned Nostr event template with the client's Nostr secret key,
+   * returning a fully-signed event (id + pubkey + sig).
+   *
+   * This is the key primitive behind the daemon's sign-and-publish path: a UI
+   * or agent supplies only `{ kind, content, tags, created_at }` and never holds
+   * the private key — signing happens here, inside the key owner.
+   */
+  signEvent(template) {
+    return finalizeEvent11(template, this.config.secretKey);
+  }
+  /**
+   * Upload bytes to Arweave via the kind:5094 blob-storage DVM (single-packet),
+   * signing the request with this client's Nostr key and paying through its
+   * existing channel. Returns the Arweave tx id on success.
+   *
+   * Backs the daemon's `upload-media` path: the key and claim/channel plumbing
+   * stay inside the client; callers pass only the bytes.
+   */
+  async uploadBlob(params) {
+    return requestBlobStorage(this, this.config.secretKey, params);
+  }
   /**
    * Per-chain settlement readiness for the configured `network` tier, mirroring
    * the townhouse node's status. Returns `undefined` when no named `network` is
@@ -10466,6 +10714,46 @@ var ToonClient = class {
       );
     }
   }
+  /**
+   * Payment-aware HTTP fetch over TOON (issue #50). A `fetch()`-like method that
+   * makes paying for an HTTP resource transparent:
+   *
+   *   1. Issues the HTTP request to `url`.
+   *   2. On `402`, parses the x402 `accepts` array and selects the
+   *      `toon-channel` entry (see {@link Http402Client} for the wire shape).
+   *   3. Opens/reuses a payment channel for the entry's ILP destination (via
+   *      ChannelManager), signs a balance proof for the demanded price, and
+   *      re-sends the SAME HTTP request as a transparent HTTP-in-ILP packet to
+   *      the connector's `POST /ilp` (via {@link HttpIlpClient}), with the claim
+   *      in the `ILP-Payment-Channel-Claim` header.
+   *   4. Reconstructs and returns a standard Web `Response` from the FULFILL
+   *      `data`. The caller never sees ILP.
+   *
+   * If the origin offers no `toon-channel` entry, the original `402` Response is
+   * returned unchanged (the caller sees the vanilla x402 challenge).
+   *
+   * The channel/claim plumbing is wired to the live ChannelManager + per-chain
+   * signer via `resolveClaimForDestination` — identical to `publishEvent`. The
+   * `amount` paid comes from the selected x402 entry (the resource's price).
+   *
+   * @throws {ToonClientError} If the client is not started.
+   * @throws {ConnectorError} If the connector rejects the payment or returns no
+   *   HTTP payload.
+   */
+  async h402Fetch(url, opts) {
+    if (!this.state) {
+      throw new ToonClientError(
+        "Client not started. Call start() first.",
+        "INVALID_STATE"
+      );
+    }
+    const client = new Http402Client({
+      ...this.channelManager ? {
+        resolveClaim: (destination, amount) => this.resolveClaimForDestination(destination, amount)
+      } : {}
+    });
+    return client.fetch(url, opts);
+  }
   /**
    * Sends a raw swap ILP packet (Story 12.5) to a Mill peer with an attached
    * balance-proof claim. This is a lower-level surface than `publishEvent`:
@@ -11073,6 +11361,9 @@ var ControlApiError = class extends Error {
     this.detail = detail;
     this.name = "ControlApiError";
   }
+  status;
+  retryable;
+  detail;
 };
 var DaemonUnreachableError = class extends Error {
   constructor(baseUrl, causedBy) {
@@ -11081,6 +11372,8 @@ var DaemonUnreachableError = class extends Error {
     this.causedBy = causedBy;
     this.name = "DaemonUnreachableError";
   }
+  baseUrl;
+  causedBy;
 };
 var ControlClient = class {
   baseUrl;
@@ -11107,9 +11400,18 @@ var ControlClient = class {
   publish(body) {
     return this.request("POST", "/publish", body);
   }
+  publishUnsigned(body) {
+    return this.request("POST", "/publish-unsigned", body);
+  }
+  uploadMedia(body) {
+    return this.request("POST", "/upload-media", body);
+  }
   subscribe(body) {
     return this.request("POST", "/subscribe", body);
   }
+  query(body) {
+    return this.request("POST", "/query", body);
+  }
   events(query = {}) {
     const qs = new URLSearchParams();
     if (query.subId) qs.set("subId", query.subId);
@@ -11128,6 +11430,13 @@ var ControlClient = class {
   swap(body) {
     return this.request("POST", "/swap", body);
   }
+  httpFetchPaid(body) {
+    return this.request(
+      "POST",
+      "/http-fetch-paid",
+      body
+    );
+  }
   targets() {
     return this.request("GET", "/targets");
   }
@@ -11318,4 +11627,4 @@ export {
 @scure/bip32/lib/esm/index.js:
   (*! scure-bip32 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=chunk-5KFXUT5Q.js.map
+//# sourceMappingURL=chunk-NP35YO5O.js.map