@twzrd1111/clawrouter-mpp 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/mpp-fetch.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 import {
   assertSpendPolicyAllows,
   SpendPolicyError as SpendPolicyError2
@@ -12,6 +12,25 @@ import {
   PAYMENT_SETTLED_NO_COMPLETION,
   SpendPolicyError
 } from "@twzrd1111/clawrouter";
+
+// src/credit-record.ts
+var CreditLedger = class {
+  rows = [];
+  /** One row per payer and challenge. A retry returns the first row. */
+  recordOnce(entry) {
+    const prior = this.rows.find(
+      (row) => row.payer === entry.payer && row.challengeId === entry.challengeId
+    );
+    if (prior) return prior;
+    this.rows.push(Object.freeze({ ...entry }));
+    return this.rows[this.rows.length - 1];
+  }
+  read() {
+    return Object.freeze([...this.rows]);
+  }
+};
+
+// src/mpp-paid-failure.ts
 var MppPaidNoCompletionError = class extends Error {
   reference;
   status;
@@ -22,19 +41,75 @@ var MppPaidNoCompletionError = class extends Error {
     this.status = status;
   }
 };
+var UNKNOWN_REFERENCE = "mpp-unknown";
+function creditPaidNoCompletion(ledger, err, fields, hooks) {
+  if (!(err instanceof MppPaidNoCompletionError)) {
+    throw new TypeError("credit requires MppPaidNoCompletionError");
+  }
+  void hooks;
+  const reference = [fields.reference, err.reference].find(
+    (value) => typeof value === "string" && value !== "" && value !== UNKNOWN_REFERENCE
+  );
+  const { reference: _dropped, ...rest } = fields;
+  void _dropped;
+  return ledger.recordOnce(reference ? { ...rest, reference } : rest);
+}
+var credits = new CreditLedger();
+function creditFromChallenge(challenge, payer) {
+  const request = challenge.request;
+  const amount = request && "amount" in request ? request.amount : void 0;
+  if (typeof amount !== "string" || !/^\d+$/.test(amount) || !payer || !challenge.id)
+    return void 0;
+  return { payer, amount, challengeId: challenge.id };
+}
+function readCredits(ledger = credits) {
+  return ledger.read();
+}
 var storage = new AsyncLocalStorage();
+var paidResponses = /* @__PURE__ */ new WeakMap();
+function rejectPaidNoCompletion(response, reason) {
+  const paid = paidResponses.get(response);
+  if (paid) throw fail(paid.spend, paid.call, response.status, reason);
+}
+function isPaidResponse(response) {
+  return paidResponses.has(response);
+}
+function readPaidCallEvidence(response) {
+  const paid = paidResponses.get(response);
+  if (!paid) return void 0;
+  const { payer, reference, credit, gate, payment } = paid.call;
+  return {
+    payer,
+    ...reference ? { reference } : {},
+    ...credit ? { credit } : {},
+    ...gate ? { gate } : {},
+    ...payment ? { payment } : {}
+  };
+}
+function currentPaidCall() {
+  return storage.getStore();
+}
+function markGateEvaluated(decision) {
+  const call = storage.getStore();
+  if (call && decision) call.gate = decision;
+}
+function markPaymentChallenge(payment) {
+  const call = storage.getStore();
+  if (call) call.payment = payment;
+}
 function paymentReference(payload) {
   return `mpp-${createHash("sha256").update(payload).digest("hex").slice(0, 16)}`;
 }
-function markSigned(payload, record) {
+function markSigned(payload, facts, record) {
   const call = storage.getStore();
   if (!call || call.signed) return;
   call.signed = true;
   call.reference = paymentReference(payload);
   call.record = record;
+  call.credit = facts;
 }
-async function guardPaid(spend, run) {
-  const call = { signed: false };
+async function guardPaid(spend, run, payer) {
+  const call = { signed: false, payer };
   let response;
   try {
     response = await storage.run(call, run);
@@ -46,6 +121,7 @@ async function guardPaid(spend, run) {
   if (call.signed && response.status >= 400) {
     throw fail(spend, call, response.status, await boundedSnippet(response));
   }
+  if (call.signed) paidResponses.set(response, { spend, call });
   return response;
 }
 var SNIPPET_CHARS = 200;
@@ -90,17 +166,21 @@ async function boundedSnippet(response, timeoutMs = SNIPPET_TIMEOUT_MS) {
   }
 }
 function fail(spend, call, status, detail, cause) {
-  const reference = call.reference ?? "mpp-unknown";
+  const reference = call.reference ?? UNKNOWN_REFERENCE;
   const why = status !== void 0 ? `HTTP ${status}` : "request failed";
   if (spend && call.record) {
     spend.annotateRecord(call.record, `signed, no completion (${why}) ref ${reference}`);
   }
-  return new MppPaidNoCompletionError(
+  const error = new MppPaidNoCompletionError(
     `MPP payment was signed and sent but no completion came back (${why}${detail ? `: ${detail}` : ""}). Not retrying, to avoid paying twice. Payment reference: ${reference}`,
     reference,
     status,
     { cause }
   );
+  if (call.credit) {
+    creditPaidNoCompletion(credits, error, { ...call.credit, reason: why });
+  }
+  return error;
 }
 
 // src/mpp-optional.ts
@@ -119,12 +199,527 @@ async function loadOptional(name, range, importer) {
   }
 }
 var MPPX_RANGE = "~0.17.0";
-var PAY_KIT_RANGE = "~0.13.1";
+var SOLANA_MPP_RANGE = "~0.7.0";
+
+// src/mpp-gate.ts
+function paymentFactsFromMppChallenge(challenge) {
+  const request = challenge.request;
+  const details = request.methodDetails && typeof request.methodDetails === "object" ? request.methodDetails : {};
+  const rawNetwork = details.chainId ?? request.chainId ?? details.network ?? request.network;
+  return {
+    challengeId: challenge.id,
+    method: challenge.method,
+    intent: challenge.intent,
+    payTo: typeof request.recipient === "string" ? request.recipient : null,
+    network: typeof rawNetwork === "number" ? `eip155:${rawNetwork}` : typeof rawNetwork === "string" ? rawNetwork : null,
+    asset: typeof request.currency === "string" ? request.currency : null,
+    amountAtomic: typeof request.amount === "string" ? request.amount : null
+  };
+}
+function assertMppIntegration(integration, rail) {
+  if (integration?.twzrdMppIntegration !== true) {
+    throw new TypeError(`${rail} MPP requires the MPP integration marker; refusing unmarked hooks`);
+  }
+  if (typeof integration.gate !== "function") {
+    throw new TypeError(`${rail} MPP requires a pre-payment gate; refusing an ungated rail`);
+  }
+  if (typeof integration.onFulfillment !== "function" || typeof integration.flush !== "function") {
+    throw new TypeError(`${rail} MPP requires fulfillment and flush callbacks`);
+  }
+}
+function freezeRecursively(value) {
+  if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value)) freezeRecursively(child);
+  }
+  return value;
+}
+var MppGateError = class extends Error {
+  code;
+  challengeId;
+  decisionId;
+  reasonCodes;
+  constructor(code, challengeId, message, decision) {
+    super(message);
+    this.name = "MppGateError";
+    this.code = code;
+    this.challengeId = challengeId;
+    this.decisionId = decision?.decisionId;
+    this.reasonCodes = decision?.reasonCodes;
+  }
+};
+async function evaluateMppGate(evaluator, challenge) {
+  if (!evaluator) return void 0;
+  const gateChallenge = freezeRecursively(structuredClone(challenge));
+  const raw = await evaluator(gateChallenge);
+  const disposition = raw && typeof raw === "object" ? raw.disposition : null;
+  if (!raw || typeof raw !== "object" || typeof disposition !== "string" || !["allow", "warn", "block"].includes(disposition)) {
+    throw new MppGateError(
+      "MPP_GATE_INVALID_RESULT",
+      challenge.id,
+      "MPP gate returned an invalid result; refusing payment"
+    );
+  }
+  const result = raw;
+  const decision = {
+    disposition: result.disposition,
+    ...typeof result.decisionId === "string" ? { decisionId: result.decisionId } : {},
+    ...typeof result.intentHash === "string" ? { intentHash: result.intentHash } : {},
+    ...Array.isArray(result.reasonCodes) && result.reasonCodes.every((x) => typeof x === "string") ? { reasonCodes: [...result.reasonCodes] } : {}
+  };
+  if (decision.disposition === "block") {
+    throw new MppGateError(
+      "MPP_GATE_BLOCKED",
+      challenge.id,
+      `MPP gate blocked challenge ${challenge.id}${decision.reasonCodes?.length ? `: ${decision.reasonCodes.join(",")}` : ""}`,
+      decision
+    );
+  }
+  return decision;
+}
+
+// src/mpp-fulfillment-record.ts
+import { createHash as createHash2 } from "crypto";
+var MPP_FULFILLMENT_RECORD_SCHEMA = "twzrd.mpp.fulfillment.v2";
+var MPP_FULFILLMENT_MAX_BODY_BYTES = 1024 * 1024;
+var NO_BODY_DIGEST = { response_bytes: null, body_sha256: null };
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function string(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function isTimestamp(value) {
+  return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value) && Number.isFinite(Date.parse(value));
+}
+function originOf(input) {
+  const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function decodeReceiptObject(value, challengeId, expectedIntent, expectedMethod) {
+  const receipt = asRecord(value);
+  if (!receipt || string(receipt.method) !== expectedMethod || !string(receipt.reference) || receipt.status !== "success" || !isTimestamp(receipt.timestamp)) {
+    return { state: "invalid_format", value: null };
+  }
+  if (typeof receipt.intent === "string" && receipt.intent !== expectedIntent || expectedIntent !== "charge" && receipt.intent !== expectedIntent || expectedIntent === "session" && (receipt.method !== "tempo" || receipt.challengeId !== challengeId || typeof receipt.channelId !== "string" || typeof receipt.acceptedCumulative !== "string" || typeof receipt.spent !== "string")) {
+    return { state: "invalid_format", value: null };
+  }
+  return { state: "valid_format", value: receipt };
+}
+function decodeReceipt(encoded, challengeId, expectedIntent, expectedMethod) {
+  if (!encoded) return { state: "missing", value: null };
+  try {
+    return decodeReceiptObject(
+      JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")),
+      challengeId,
+      expectedIntent,
+      expectedMethod
+    );
+  } catch {
+    return { state: "invalid_format", value: null };
+  }
+}
+function createSseReceiptParser(challengeId, expectedIntent, expectedMethod) {
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let eventName = "";
+  let data = [];
+  let totalBytes = 0;
+  let unavailable = false;
+  let receipt;
+  let sellerReportedModel = null;
+  const hash = createHash2("sha256");
+  const finishEvent = () => {
+    if (data.length && eventName === "payment-receipt" && !receipt) {
+      try {
+        receipt = decodeReceiptObject(
+          JSON.parse(data.join("\n")),
+          challengeId,
+          expectedIntent,
+          expectedMethod
+        );
+      } catch {
+        receipt = { state: "invalid_format", value: null };
+      }
+    } else if (data.length && (!eventName || eventName === "message") && !sellerReportedModel) {
+      try {
+        sellerReportedModel = string(asRecord(JSON.parse(data.join("\n")))?.model);
+      } catch {
+      }
+    }
+    eventName = "";
+    data = [];
+  };
+  const line = (raw) => {
+    const value = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+    if (!value) return finishEvent();
+    if (value.startsWith(":")) return;
+    const separator = value.indexOf(":");
+    const field = separator < 0 ? value : value.slice(0, separator);
+    const fieldValue = separator < 0 ? "" : value.slice(separator + 1).replace(/^ /, "");
+    if (field === "event") eventName = fieldValue;
+    if (field === "data" && data.join("\n").length + fieldValue.length <= 16 * 1024)
+      data.push(fieldValue);
+  };
+  return {
+    push(chunk) {
+      totalBytes += chunk.byteLength;
+      if (totalBytes <= MPP_FULFILLMENT_MAX_BODY_BYTES) hash.update(chunk);
+      if (totalBytes > MPP_FULFILLMENT_MAX_BODY_BYTES) {
+        unavailable = true;
+        buffer = "";
+        data = [];
+        return;
+      }
+      if (unavailable) return;
+      buffer += decoder.decode(chunk, { stream: true });
+      for (; ; ) {
+        const newline = buffer.indexOf("\n");
+        if (newline < 0) break;
+        line(buffer.slice(0, newline));
+        buffer = buffer.slice(newline + 1);
+      }
+      if (buffer.length > 16 * 1024) {
+        unavailable = true;
+        buffer = "";
+      }
+    },
+    /** Digest of every pushed byte; call only after the source stream reported done. */
+    digest() {
+      return totalBytes > MPP_FULFILLMENT_MAX_BODY_BYTES ? NO_BODY_DIGEST : { response_bytes: totalBytes, body_sha256: hash.digest("hex") };
+    },
+    finish() {
+      if (!unavailable && !receipt) {
+        buffer += decoder.decode();
+        if (buffer) line(buffer);
+        finishEvent();
+      }
+      return {
+        receipt: receipt ?? { state: unavailable ? "unavailable" : "missing", value: null },
+        sellerReportedModel
+      };
+    }
+  };
+}
+async function readBodyCapped(body) {
+  if (!body) return null;
+  const reader = body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MPP_FULFILLMENT_MAX_BODY_BYTES) {
+        await reader.cancel().catch(() => void 0);
+        return null;
+      }
+      chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+  } catch {
+    return null;
+  }
+}
+function parseJson(bytes) {
+  if (!bytes) return void 0;
+  try {
+    return JSON.parse(bytes.toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function digestOf(bytes) {
+  return bytes ? {
+    response_bytes: bytes.byteLength,
+    body_sha256: createHash2("sha256").update(bytes).digest("hex")
+  } : NO_BODY_DIGEST;
+}
+async function readJsonCapped(body) {
+  return parseJson(await readBodyCapped(body));
+}
+function bodyIsJson(headers) {
+  return (headers.get("content-type") ?? "").toLowerCase().includes("json");
+}
+async function readRequestBody(input, init) {
+  const headers = new Headers(input instanceof Request ? input.headers : void 0);
+  new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
+  if (!bodyIsJson(headers)) return void 0;
+  if (typeof init?.body === "string") {
+    if (Buffer.byteLength(init.body, "utf8") > MPP_FULFILLMENT_MAX_BODY_BYTES) return void 0;
+    try {
+      return JSON.parse(init.body);
+    } catch {
+      return void 0;
+    }
+  }
+  if (input instanceof Request && init?.body === void 0) {
+    try {
+      return await readJsonCapped(input.clone().body);
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function wrappedResponse(response, body) {
+  const wrapped = new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+  Object.defineProperties(wrapped, {
+    url: { value: response.url },
+    redirected: { value: response.redirected },
+    type: { value: response.type }
+  });
+  return wrapped;
+}
+async function emitRecord(input, receipt, requestValue, responseValue, sink, digest, sellerModelOverride) {
+  const req = asRecord(requestValue);
+  const res = asRecord(responseValue);
+  const requestedModel = string(req?.model);
+  const sellerReportedModel = string(sellerModelOverride) ?? string(res?.model);
+  const row = {
+    schema: MPP_FULFILLMENT_RECORD_SCHEMA,
+    at_unix_ms: Date.now(),
+    resource_origin: originOf(input.input),
+    http_status: input.response.status,
+    payment_method: input.payment.method,
+    payment_intent: input.payment.intent,
+    challenge_id: input.payment.challengeId,
+    paid_to: input.payment.payTo,
+    network: input.payment.network,
+    asset: input.payment.asset,
+    amount_atomic: input.payment.amountAtomic,
+    receipt_state: receipt.state,
+    receipt_status: string(receipt.value?.status),
+    receipt_method: string(receipt.value?.method),
+    receipt_reference: string(receipt.value?.reference),
+    receipt_timestamp: string(receipt.value?.timestamp),
+    requested_model: requestedModel,
+    seller_reported_model: sellerReportedModel,
+    seller_reported_model_matches_request: requestedModel && sellerReportedModel ? requestedModel.toLowerCase() === sellerReportedModel.toLowerCase() : null,
+    gate: input.gate ?? null,
+    response_bytes: digest.response_bytes,
+    body_sha256: digest.body_sha256
+  };
+  await sink(row);
+}
+function recordMppFulfillment(input, sink, onPending) {
+  const track = (pending) => {
+    onPending?.(pending);
+    void pending.catch(() => {
+    });
+  };
+  const receipt = decodeReceipt(
+    input.response.headers.get("payment-receipt"),
+    input.payment.challengeId,
+    input.payment.intent,
+    input.payment.method
+  );
+  const requestBody = readRequestBody(input.input, input.init);
+  const isSse = (input.response.headers.get("content-type") ?? "").toLowerCase().startsWith("text/event-stream");
+  if (isSse && receipt.state === "missing" && input.response.body && input.response.status !== 204 && input.response.status !== 205) {
+    const parser = createSseReceiptParser(
+      input.payment.challengeId,
+      input.payment.intent,
+      input.payment.method
+    );
+    const reader = input.response.body.getReader();
+    let resolveRecording;
+    let rejectRecording;
+    const recording2 = new Promise((resolve, reject) => {
+      resolveRecording = resolve;
+      rejectRecording = reject;
+    });
+    track(recording2);
+    let recordingStarted = false;
+    const finishRecord = (receipt2, sellerReportedModel, digest) => {
+      if (recordingStarted) return;
+      recordingStarted = true;
+      const write = requestBody.then(
+        (request) => emitRecord(input, receipt2, request, void 0, sink, digest, sellerReportedModel)
+      );
+      void write.then(resolveRecording, rejectRecording);
+      void write.catch(() => {
+        process.emitWarning("MPP fulfillment record failed; call payFetch.flush() to inspect", {
+          code: "TWZRD_MPP_FULFILLMENT_RECORD_FAILED"
+        });
+      });
+    };
+    const tapped = new ReadableStream({
+      async pull(controller) {
+        try {
+          const { done, value } = await reader.read();
+          if (done) {
+            const parsed = parser.finish();
+            finishRecord(parsed.receipt, parsed.sellerReportedModel, parser.digest());
+            controller.close();
+            reader.releaseLock();
+            return;
+          }
+          parser.push(value);
+          controller.enqueue(value);
+        } catch (error) {
+          finishRecord({ state: "unavailable", value: null }, null, NO_BODY_DIGEST);
+          controller.error(error);
+        }
+      },
+      async cancel(reason) {
+        await reader.cancel(reason).catch(() => void 0);
+        const parsed = parser.finish();
+        const receipt2 = parsed.receipt.state === "missing" ? { state: "unavailable", value: null } : parsed.receipt;
+        finishRecord(receipt2, parsed.sellerReportedModel, NO_BODY_DIGEST);
+      }
+    });
+    return wrappedResponse(input.response, tapped);
+  }
+  const responseBody = bodyIsJson(input.response.headers) ? readBodyCapped(input.response.clone().body) : Promise.resolve(null);
+  const recording = Promise.all([requestBody, responseBody]).then(
+    ([request, bytes]) => emitRecord(input, receipt, request, parseJson(bytes), sink, digestOf(bytes))
+  );
+  track(recording);
+  void recording.catch(() => {
+    process.emitWarning("MPP fulfillment record failed; call payFetch.flush() to inspect", {
+      code: "TWZRD_MPP_FULFILLMENT_RECORD_FAILED"
+    });
+  });
+  return input.response;
+}
+
+// src/mpp-payment-budget.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var PAY_FETCH_BUDGET_CONTEXT = /* @__PURE__ */ Symbol.for("twzrd.clawrouter.pay-fetch-budget.v1");
+var contextStorage = new AsyncLocalStorage2();
+function paymentBudgetFromInit(init) {
+  const context = init?.[PAY_FETCH_BUDGET_CONTEXT];
+  if (!context || typeof context !== "object") return void 0;
+  const value = context;
+  return typeof value.assertPaymentAllowed === "function" && typeof value.recordSigned === "function" ? value : void 0;
+}
+function stripPaymentBudgetFromInit(init) {
+  if (!init) return void 0;
+  const clean = { ...init };
+  delete clean[PAY_FETCH_BUDGET_CONTEXT];
+  return clean;
+}
+function currentMppPaymentBudget() {
+  return contextStorage.getStore();
+}
+function runWithMppPaymentBudget(context, run) {
+  return contextStorage.run(context, run);
+}
+
+// src/mpp-flush.ts
+var MppFlushTimeoutError = class extends Error {
+  pending;
+  timeoutMs;
+  ledgerPending;
+  constructor(pending, timeoutMs, ledgerPending = false) {
+    super(
+      `MPP flush deadline reached after ${timeoutMs} ms: ${pending} fulfillment record(s) pending; ledger flush ${ledgerPending ? "still pending" : "finished"}`
+    );
+    this.name = "MppFlushTimeoutError";
+    this.pending = pending;
+    this.timeoutMs = timeoutMs;
+    this.ledgerPending = ledgerPending;
+  }
+};
+var MAX_TIMER_MS = 2147483647;
+function deadlineOf(options) {
+  const value = options?.timeoutMs;
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > MAX_TIMER_MS) {
+    throw new TypeError(`flush timeoutMs must be a number from 0 to ${MAX_TIMER_MS}`);
+  }
+  return value;
+}
+var ownership = /* @__PURE__ */ new WeakMap();
+function ownershipFor(failures) {
+  let entry = ownership.get(failures);
+  if (!entry) {
+    entry = { waiters: /* @__PURE__ */ new Map(), claimed: /* @__PURE__ */ new WeakSet() };
+    ownership.set(failures, entry);
+  }
+  return entry;
+}
+var isObject = (value) => typeof value === "object" && value !== null || typeof value === "function";
+async function flushFulfillments(pending, failures, integrationFlush, options) {
+  const timeoutMs = deadlineOf(options);
+  let timer;
+  let expired = false;
+  const deadline = timeoutMs === void 0 ? void 0 : new Promise((resolve) => {
+    timer = setTimeout(() => {
+      expired = true;
+      resolve();
+    }, timeoutMs);
+  });
+  const wait = (task) => deadline ? Promise.race([task, deadline]) : task;
+  try {
+    await wait(Promise.all([...pending]).then(() => void 0));
+    const owners = ownershipFor(failures);
+    const ownErrors = [];
+    let ledgerPending = true;
+    let waiting = true;
+    let source;
+    try {
+      source = Promise.resolve(integrationFlush());
+    } catch (error) {
+      ownErrors.push(error);
+      ledgerPending = false;
+    }
+    const release = () => {
+      if (!waiting) return;
+      waiting = false;
+      if (!source) return;
+      const left = (owners.waiters.get(source) ?? 1) - 1;
+      if (left > 0) owners.waiters.set(source, left);
+      else owners.waiters.delete(source);
+    };
+    let ledger = Promise.resolve();
+    if (source) {
+      const observed = source;
+      owners.waiters.set(observed, (owners.waiters.get(observed) ?? 0) + 1);
+      ledger = observed.catch((error) => {
+        if (waiting) {
+          ownErrors.push(error);
+          if (isObject(error)) owners.claimed.add(error);
+          const queued = failures.indexOf(error);
+          if (queued >= 0) failures.splice(queued, 1);
+        } else if (!owners.waiters.get(observed) && !(isObject(error) && owners.claimed.has(error)) && !failures.includes(error)) {
+          failures.push(error);
+        }
+      }).finally(() => {
+        ledgerPending = false;
+      });
+    }
+    try {
+      await wait(ledger);
+    } finally {
+      release();
+    }
+    const errors = [.../* @__PURE__ */ new Set([...failures.splice(0), ...ownErrors])];
+    if (expired) errors.push(new MppFlushTimeoutError(pending.size, timeoutMs, ledgerPending));
+    if (errors.length) throw new AggregateError(errors, "MPP fulfillment records did not flush");
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
 // src/mpp-fetch.ts
+var mppxClientDeps = {
+  load: () => loadOptional("mppx", MPPX_RANGE, () => import("mppx/client"))
+};
 var DEFAULT_TEMPO_USD_ASSETS = /* @__PURE__ */ new Set([
   "0x20c0000000000000000000000000000000000000",
-  "0x20c000000000000000000000b9537d11c60e8b50"
+  "0x20c000000000000000000000b9537d11c60e8b50",
+  "0x20c000000000000000000000f37de3740adec032"
 ]);
 function quoteFromChallenge(challenge, usdAssets = DEFAULT_TEMPO_USD_ASSETS) {
   const req = challenge.request ?? {};
@@ -139,46 +734,119 @@ function quoteFromChallenge(challenge, usdAssets = DEFAULT_TEMPO_USD_ASSETS) {
     priceable
   };
 }
-function guardMethod(method, control, usdAssets = DEFAULT_TEMPO_USD_ASSETS) {
+function guardMethod(method, control, usdAssets = DEFAULT_TEMPO_USD_ASSETS, gate) {
+  const signedOnce = /* @__PURE__ */ new Map();
+  const gateOnce = /* @__PURE__ */ new Map();
+  const reuseKey = (challenge) => JSON.stringify(challenge);
   const guarded = {
     createCredential: async (options) => {
-      let reservationId;
-      if (control) {
-        const quote = quoteFromChallenge(options.challenge, usdAssets);
-        if (!quote.priceable && control.hasAmountLimits()) {
-          throw new SpendPolicyError2(
-            `MPP quote is in an asset or shape ClawRouter cannot price (${quote.asset ?? "none"}); refusing to pay against a configured spend limit`
-          );
-        }
-        reservationId = assertSpendPolicyAllows(control, quote);
+      const challenge = options.challenge;
+      markPaymentChallenge(paymentFactsFromMppChallenge(challenge));
+      const key = reuseKey(challenge);
+      let gatePending = gateOnce.get(key);
+      if (!gatePending) {
+        gatePending = evaluateMppGate(gate, challenge);
+        gateOnce.set(key, gatePending);
       }
-      let credential;
+      let gateDecision;
       try {
-        credential = await method.createCredential(options);
+        gateDecision = await gatePending;
       } catch (err) {
-        if (control && reservationId !== void 0) control.releaseReservation(reservationId);
+        if (gateOnce.get(key) === gatePending) gateOnce.delete(key);
         throw err;
       }
-      const record = control && reservationId !== void 0 ? control.settleReservation(reservationId, { action: "mpp tempo charge" }) : void 0;
-      markSigned(credential, record);
-      return credential;
+      if (gateOnce.get(key) === gatePending) gateOnce.delete(key);
+      markGateEvaluated(gateDecision);
+      const quote = quoteFromChallenge(challenge, usdAssets);
+      const budget = currentMppPaymentBudget();
+      const quoteMicros = quote.priceable && quote.amount && /^\d+$/.test(quote.amount) ? BigInt(quote.amount) : void 0;
+      budget?.assertPaymentAllowed(quoteMicros);
+      const call = currentPaidCall();
+      const credit = creditFromChallenge(challenge, call?.payer ?? "");
+      if (call && !credit)
+        throw new Error("challenge is missing amount or id, or payer is missing");
+      let attempt = signedOnce.get(key);
+      if (!attempt) {
+        const state = {
+          promise: Promise.resolve({ credential: "" }),
+          signingStarted: false
+        };
+        state.promise = (async () => {
+          let reservationId;
+          if (control) {
+            if (!quote.priceable && control.hasAmountLimits()) {
+              throw new SpendPolicyError2(
+                `MPP quote is in an asset or shape ClawRouter cannot price (${quote.asset ?? "none"}); refusing to pay against a configured spend limit`
+              );
+            }
+            reservationId = assertSpendPolicyAllows(control, quote);
+          }
+          let credential;
+          try {
+            state.signingStarted = true;
+            credential = await method.createCredential(options);
+          } catch (err) {
+            if (control && reservationId !== void 0) control.releaseReservation(reservationId);
+            throw err;
+          }
+          const record = control && reservationId !== void 0 ? control.settleReservation(reservationId, { action: "mpp tempo charge" }) : void 0;
+          budget?.recordSigned(quoteMicros);
+          return { credential, record };
+        })();
+        signedOnce.set(key, state);
+        attempt = state;
+      }
+      let signed;
+      try {
+        signed = await attempt.promise;
+      } catch (err) {
+        if (!attempt.signingStarted && signedOnce.get(key) === attempt) signedOnce.delete(key);
+        throw err;
+      }
+      markSigned(signed.credential, credit, signed.record);
+      return signed.credential;
     }
   };
   return { ...method, ...guarded };
 }
-function createMppFetch(account, base = fetch, opts = {}) {
-  const calls = new AsyncLocalStorage2();
+function createMppFetch(account, base = fetch, opts) {
+  assertMppIntegration(opts?.integration, "Tempo");
+  const integration = Object.freeze({ ...opts.integration });
+  const calls = new AsyncLocalStorage3();
+  const pendingFulfillments = /* @__PURE__ */ new Set();
+  const fulfillmentFailures = [];
+  const trackFulfillment = (task) => {
+    let tracked;
+    tracked = task.then(
+      () => {
+        pendingFulfillments.delete(tracked);
+      },
+      (error) => {
+        fulfillmentFailures.push(error);
+        pendingFulfillments.delete(tracked);
+      }
+    );
+    pendingFulfillments.add(tracked);
+  };
   const recording = async (input, init) => {
     const res = await base(input, init);
     const call = calls.getStore();
     if (call) call.last402 = res.status === 402 ? res.clone() : void 0;
+    const paid = currentPaidCall();
+    if (res.status !== 402 && paid?.signed && paid.payment) {
+      return recordMppFulfillment(
+        { input, init, response: res, payment: paid.payment, gate: paid.gate },
+        integration.onFulfillment,
+        trackFulfillment
+      );
+    }
     return res;
   };
   const { spend, usdAssets } = opts;
   let mppxPromise;
-  const getMppx = () => mppxPromise ??= loadOptional("mppx", MPPX_RANGE, () => import("mppx/client")).then(
+  const getMppx = () => mppxPromise ??= mppxClientDeps.load().then(
     ({ Mppx, tempo }) => Mppx.create({
-      methods: tempo({ account }).map((m) => guardMethod(m, spend, usdAssets)),
+      methods: tempo({ account }).map((m) => guardMethod(m, spend, usdAssets, integration.gate)),
       polyfill: false,
       fetch: recording
     })
@@ -186,8 +854,16 @@ function createMppFetch(account, base = fetch, opts = {}) {
   const payFetch = async (input, init) => {
     const call = {};
     const mppx = await getMppx();
+    const budget = paymentBudgetFromInit(init);
+    const cleanInit = stripPaymentBudgetFromInit(init);
     try {
-      return await calls.run(call, () => guardPaid(spend, () => mppx.fetch(input, init)));
+      return await runWithMppPaymentBudget(
+        budget,
+        () => calls.run(
+          call,
+          () => guardPaid(spend, () => mppx.fetch(input, cleanInit), account.address)
+        )
+      );
     } catch (e) {
       if (call.last402 && /No method found for challenges/.test(e.message)) {
         return call.last402;
@@ -196,118 +872,296 @@ function createMppFetch(account, base = fetch, opts = {}) {
     }
   };
   payFetch.enforcesSpend = opts.spend !== void 0;
+  payFetch.deferStreamingHeaders = true;
+  payFetch.supportsNativeStreaming = true;
+  payFetch.onNoCompletion = rejectPaidNoCompletion;
+  payFetch.isPaidResponse = isPaidResponse;
+  payFetch.flush = (options) => flushFulfillments(pendingFulfillments, fulfillmentFailures, () => integration.flush(), options);
   return payFetch;
 }
 
 // src/mpp-solana-fetch.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 import {
   assertSpendPolicyAllows as assertSpendPolicyAllows2,
   SpendPolicyError as SpendPolicyError3
 } from "@twzrd1111/clawrouter";
 var DEFAULT_SOLANA_USD_MINTS = /* @__PURE__ */ new Set([
   "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
-  // USDC mainnet
   "4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU",
-  // USDC devnet
   "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB"
-  // USDT mainnet
 ]);
 var CAIP2 = {
   mainnet: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
   devnet: "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1",
   localnet: "solana:localnet"
 };
+var solanaChargeDeps = {
+  load: () => loadOptional("@solana/mpp", SOLANA_MPP_RANGE, () => import("@solana/mpp/client"))
+};
 async function createSolanaMppFetch(opts) {
-  const { spend, network } = opts;
+  assertMppIntegration(opts?.integration, "Solana");
+  const integration = Object.freeze({ ...opts.integration });
+  const { charge, selectSolanaChargeChallengeFromResponse, resolveStablecoinMint } = await solanaChargeDeps.load();
+  const base = opts.fetch ?? fetch;
   const usd = /* @__PURE__ */ new Set([...DEFAULT_SOLANA_USD_MINTS, ...opts.usdMints ?? []]);
-  const calls = new AsyncLocalStorage3();
-  const permissions = spend ? {
-    authorize(candidate) {
-      const call = calls.getStore();
-      if (!call)
-        throw new SpendPolicyError3("Solana MPP payment attempted outside a guarded call");
-      const priceable = usd.has(candidate.mint);
-      if (!priceable && spend.hasAmountLimits()) {
-        throw new SpendPolicyError3(
-          `MPP quote is in a mint ClawRouter cannot price (${candidate.mint}); refusing to pay against a configured spend limit`
-        );
-      }
-      const amount = priceable ? candidate.amount.toString() : void 0;
-      call.quote = {
-        network: CAIP2[candidate.network],
-        asset: candidate.mint,
-        amount,
-        priceable
-      };
-      call.reservationId = assertSpendPolicyAllows2(spend, {
-        network: call.quote.network,
-        asset: candidate.mint,
-        amount,
-        payeeDeferred: true
-      });
-      return { maxAmountAtomic: candidate.amount };
-    }
-  } : void 0;
-  const { PayKitClient } = await loadOptional(
-    "@solana/pay-kit",
-    PAY_KIT_RANGE,
-    () => import("@solana/pay-kit/client")
-  );
-  const client = await PayKitClient.builder().signer(opts.signer).rpcUrl(opts.rpcUrl).network(network).accept(["mpp"]).permissions(permissions).onProgress((event) => {
-    const call = calls.getStore();
-    const e = event;
-    if (!call) return;
-    if (!spend) {
-      if (e.type === "signed" && typeof e.transaction === "string") markSigned(e.transaction);
-      return;
-    }
-    if (e.type === "challenge" && call.quote) {
-      const result = spend.check(0, {
-        payTo: e.recipient,
-        network: call.quote.network,
-        asset: call.quote.asset
-      });
-      if (!result.allowed) {
-        throw new SpendPolicyError3(result.reason ?? "blocked by spend policy", {
-          blockedBy: result.blockedBy,
-          blockedByPolicy: result.blockedByPolicy
-        });
-      }
-      call.payeeChecked = true;
-    } else if (e.type === "signing") {
-      if (!call.payeeChecked) {
-        throw new SpendPolicyError3("payee was never checked before signing; refusing to sign");
+  const network = opts.network === "mainnet" ? "mainnet-beta" : opts.network;
+  const signedOnce = /* @__PURE__ */ new Map();
+  const gateOnce = /* @__PURE__ */ new Map();
+  const pendingFulfillments = /* @__PURE__ */ new Set();
+  const fulfillmentFailures = [];
+  const trackFulfillment = (task) => {
+    let tracked;
+    tracked = task.then(
+      () => {
+        pendingFulfillments.delete(tracked);
+      },
+      (error) => {
+        fulfillmentFailures.push(error);
+        pendingFulfillments.delete(tracked);
       }
-    } else if (e.type === "signed" || e.type === "paid") {
-      let record;
-      if (call.reservationId !== void 0 && !call.settled) {
-        call.settled = true;
-        record = spend.settleReservation(call.reservationId, { action: "mpp solana charge" });
-      }
-      if (e.type === "signed" && typeof e.transaction === "string")
-        markSigned(e.transaction, record);
-    }
-  }).build();
+    );
+    pendingFulfillments.add(tracked);
+  };
   const payFetch = async (input, init) => {
-    const call = { settled: false, payeeChecked: false };
-    try {
-      return await guardPaid(spend, () => calls.run(call, () => client.fetch(input, init, "mpp")));
-    } finally {
-      if (spend && call.reservationId !== void 0 && !call.settled) {
-        spend.releaseReservation(call.reservationId);
-      }
-    }
+    const budget = paymentBudgetFromInit(init);
+    const cleanInit = stripPaymentBudgetFromInit(init);
+    return runWithMppPaymentBudget(
+      budget,
+      () => guardPaid(
+        opts.spend,
+        async () => {
+          const request = new Request(input, cleanInit);
+          const requestForRecord = request.clone();
+          const probe = await base(request.clone());
+          if (probe.status !== 402) return probe;
+          if (probe.redirected)
+            throw new SpendPolicyError3("Refusing a payment challenge reached through a redirect");
+          const challenge = selectSolanaChargeChallengeFromResponse(probe);
+          if (!challenge) return probe;
+          const challengeNetwork = challenge.request.methodDetails.network ?? "mainnet";
+          if (solanaNetworkId(challengeNetwork) !== CAIP2[opts.network]) {
+            throw new SpendPolicyError3(
+              "Solana challenge network does not match the configured network"
+            );
+          }
+          const credit = creditFromChallenge(challenge, opts.signer.address);
+          if (!credit) throw new Error("challenge is missing amount or id");
+          const quote = quoteFromSolanaChallenge(
+            {
+              request: {
+                ...challenge.request,
+                methodDetails: { ...challenge.request.methodDetails, network: challengeNetwork },
+                currency: resolveStablecoinMint(challenge.request.currency, network) ?? challenge.request.currency
+              }
+            },
+            usd
+          );
+          const payment = paymentFactsFromMppChallenge(challenge);
+          markPaymentChallenge(payment);
+          const key = JSON.stringify([
+            challenge.id,
+            challenge.realm,
+            challenge.method,
+            challenge.intent,
+            challenge.expires,
+            challenge.request
+          ]);
+          let gatePending = gateOnce.get(key);
+          if (!gatePending) {
+            gatePending = evaluateMppGate(integration.gate, challenge);
+            gateOnce.set(key, gatePending);
+          }
+          let gateDecision;
+          try {
+            gateDecision = await gatePending;
+          } catch (err) {
+            if (gateOnce.get(key) === gatePending) gateOnce.delete(key);
+            throw err;
+          }
+          if (gateOnce.get(key) === gatePending) gateOnce.delete(key);
+          markGateEvaluated(gateDecision);
+          const budgetContext = currentMppPaymentBudget();
+          const budgetQuoteMicros = quote.priceable && quote.amount && /^\d+$/.test(quote.amount) ? BigInt(quote.amount) : void 0;
+          budgetContext?.assertPaymentAllowed(budgetQuoteMicros);
+          let pending = signedOnce.get(key);
+          if (!pending) {
+            pending = (async () => {
+              const spend = opts.spend;
+              if (spend && !quote.priceable && spend.hasAmountLimits()) {
+                throw new SpendPolicyError3(
+                  "MPP quote is in a mint ClawRouter cannot price; refusing to pay against a configured spend limit"
+                );
+              }
+              const reservationId = spend ? assertSpendPolicyAllows2(spend, quote) : void 0;
+              let signed = false;
+              let sessionSpendRecorded = false;
+              let record;
+              let payload = "";
+              try {
+                const method = charge({
+                  signer: opts.signer,
+                  rpcUrl: opts.rpcUrl,
+                  expectedNetwork: challengeNetwork,
+                  broadcast: false,
+                  onProgress(event) {
+                    if (event.type !== "signed") return;
+                    signed = true;
+                    payload = event.transaction;
+                    if (!sessionSpendRecorded) {
+                      budgetContext?.recordSigned(budgetQuoteMicros);
+                      sessionSpendRecorded = true;
+                    }
+                    if (spend && reservationId !== void 0) {
+                      record = spend.settleReservation(reservationId, {
+                        action: "mpp solana charge"
+                      });
+                    }
+                    markSigned(payload, credit, record);
+                  }
+                });
+                const credential = await method.createCredential({ challenge });
+                if (!signed) {
+                  payload = credential;
+                  if (!sessionSpendRecorded) {
+                    budgetContext?.recordSigned(budgetQuoteMicros);
+                    sessionSpendRecorded = true;
+                  }
+                  if (spend && reservationId !== void 0) {
+                    record = spend.settleReservation(reservationId, {
+                      action: "mpp solana charge"
+                    });
+                  }
+                }
+                return {
+                  credential,
+                  payload,
+                  record,
+                  gate: gateDecision,
+                  payment
+                };
+              } catch (err) {
+                if (signed) {
+                  throw new MppPaidNoCompletionError(
+                    "Solana payment was signed but credential construction failed; refusing to sign again",
+                    paymentReference(payload),
+                    void 0,
+                    { cause: err }
+                  );
+                }
+                if (!signed && spend && reservationId !== void 0)
+                  spend.releaseReservation(reservationId);
+                throw err;
+              }
+            })();
+            signedOnce.set(key, pending);
+          }
+          let result;
+          try {
+            result = await pending;
+          } catch (err) {
+            if (!(err instanceof MppPaidNoCompletionError) && signedOnce.get(key) === pending)
+              signedOnce.delete(key);
+            throw err;
+          }
+          markGateEvaluated(result.gate);
+          if (result.payment) markPaymentChallenge(result.payment);
+          markSigned(result.payload, credit, result.record);
+          const headers = new Headers(request.headers);
+          headers.set("authorization", result.credential);
+          const response = await base(new Request(request, { headers }));
+          const paid = currentPaidCall();
+          if (response.status !== 402 && paid?.signed && paid.payment) {
+            return recordMppFulfillment(
+              { input: requestForRecord, response, payment: paid.payment, gate: paid.gate },
+              integration.onFulfillment,
+              trackFulfillment
+            );
+          }
+          return response;
+        },
+        opts.signer.address
+      )
+    );
   };
-  payFetch.enforcesSpend = spend !== void 0;
+  payFetch.enforcesSpend = opts.spend !== void 0;
+  payFetch.deferStreamingHeaders = true;
+  payFetch.supportsNativeStreaming = true;
+  payFetch.onNoCompletion = rejectPaidNoCompletion;
+  payFetch.isPaidResponse = isPaidResponse;
+  payFetch.flush = (options) => flushFulfillments(pendingFulfillments, fulfillmentFailures, () => integration.flush(), options);
   return payFetch;
 }
+function solanaNetworkId(value) {
+  if (value === "devnet" || value === CAIP2.devnet) return CAIP2.devnet;
+  if (value === "mainnet" || value === "mainnet-beta" || value === CAIP2.mainnet)
+    return CAIP2.mainnet;
+  if (value === "localnet" || value === CAIP2.localnet) return CAIP2.localnet;
+  return value;
+}
+function quoteFromSolanaChallenge(challenge, usdMints = DEFAULT_SOLANA_USD_MINTS) {
+  const req = challenge.request ?? {};
+  const asset = typeof req.currency === "string" ? req.currency : void 0;
+  const rawNetwork = req.methodDetails?.network;
+  const priceable = asset !== void 0 && usdMints.has(asset) && typeof req.amount === "string";
+  return {
+    payTo: typeof req.recipient === "string" ? req.recipient : void 0,
+    network: typeof rawNetwork === "string" ? solanaNetworkId(rawNetwork) : void 0,
+    asset,
+    amount: priceable ? req.amount : void 0,
+    priceable
+  };
+}
+
+// src/spent-proof.ts
+var ReplayRejectedError = class extends Error {
+  constructor(networkId, txSignature, challengeId) {
+    super("payment transaction or challenge already used on this network");
+    this.networkId = networkId;
+    this.txSignature = txSignature;
+    this.challengeId = challengeId;
+    this.name = "ReplayRejectedError";
+  }
+  networkId;
+  txSignature;
+  challengeId;
+  status = 409;
+  code = "proof_replayed";
+};
+var SpentProofLedger = class {
+  transactions = /* @__PURE__ */ new Map();
+  challenges = /* @__PURE__ */ new Map();
+  claim(networkId, txSignature, challengeId) {
+    if (!networkId || !txSignature || !challengeId)
+      throw new TypeError("network id, transaction signature, and challenge id are required");
+    const transactionKey = JSON.stringify([networkId, txSignature]);
+    const challengeKey = JSON.stringify([networkId, challengeId]);
+    if (this.transactions.has(transactionKey) || this.challenges.has(challengeKey)) return false;
+    this.transactions.set(transactionKey, challengeId);
+    this.challenges.set(challengeKey, txSignature);
+    return true;
+  }
+};
+async function fulfillPaidProof(opts) {
+  const won = opts.ledger.claim(opts.networkId, opts.txSignature, opts.challengeId);
+  if (!won) throw new ReplayRejectedError(opts.networkId, opts.txSignature, opts.challengeId);
+  return opts.upstream();
+}
 export {
+  CreditLedger,
   DEFAULT_SOLANA_USD_MINTS,
   DEFAULT_TEMPO_USD_ASSETS,
+  MPP_FULFILLMENT_MAX_BODY_BYTES,
+  MPP_FULFILLMENT_RECORD_SCHEMA,
+  MppFlushTimeoutError,
+  MppGateError,
   MppPaidNoCompletionError,
+  ReplayRejectedError,
+  SpentProofLedger,
   createMppFetch,
   createSolanaMppFetch,
-  guardMethod,
-  quoteFromChallenge
+  creditPaidNoCompletion,
+  fulfillPaidProof,
+  quoteFromChallenge,
+  readCredits,
+  readPaidCallEvidence
 };