@wafermapxyz/cli 0.4.4 → 0.4.6

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.4.6 (3 Nov 2026)
+
+**`history --verify` tells an executed payment from a cancelled one.** Thank you @GBLIN_Protocol for the catch.
+
+- EIP-3009 `authorizationState` is true both after a payment is executed and after its nonce is cancelled (`cancelAuthorization`), so a cancelled nonce used to read as `used`. The wallet never cancels on its own, but a nonce cancelled by hand would have been shown as paid.
+- A `true` is now confirmed by the token contract's `AuthorizationUsed` event for that payer and nonce: first in the receipt of the settlement transaction the server named, otherwise in the blocks between signing and expiry, the only time the payment could have executed. Found: `used`. Not found: `cancelled` (spent nonce, no transfer). If the RPC cannot answer, the result is `error`, never a guess. Base's public RPC refuses log searches, so a Base payment with no settlement transaction on record needs `WAFERMAP_RPC_BASE` set to another RPC.
+- `history --verify` checks four payments at a time instead of all at once, so public RPCs stop refusing long histories.
+- SDK: `checkPayment()` returns the new `"cancelled"` state and takes the entry's `at` and `tx` when given.
+
+## 0.4.5 (2 Nov 2026)
+
+**Pay Wafermap in $WAFERMAP, at 50% off. The tokens are burned.**
+
+- `wafermap call <id> --pay wafermap` (MCP `wafermap_call` with `payIn: "wafermap"`, SDK `call(id, input, { payIn: "wafermap" })`) pays one of Wafermap's own resources in $WAFERMAP instead of USDG/USDC. $WAFERMAP has no EIP-3009, so the payment is a Uniswap Permit2 signature for one exact amount, spendable for two minutes only by Wafermap's relayer, which sends it to the dead address once the call succeeded. A failed call moves nothing.
+- `wafermap approve-wafermap`: the one-time Permit2 approval (one Robinhood Chain transaction, paid in ETH).
+- What the client checks before it signs, trusting the server for none of it: the spender is Wafermap's relayer as fixed in this release (`WAFERMAP_RELAYERS`); the option names the canonical Permit2, the $WAFERMAP token and the dead address; the amount is valued at a price this client reads itself (GeckoTerminal) and refused when it is worth more than the quote states. The caps count the higher of the two values.
+- Only `call()` to Wafermap ever signs a $WAFERMAP permit. `pay()` to third-party services never does, whatever they offer, because a Permit2 spender chooses where the tokens go.
+
 ## 0.4.4 (2 Nov 2026)
 
 **$WAFERMAP holder tiers.**

package/README.md

@@ -84,6 +84,8 @@ Pass `approve: (a) => boolean` to confirm each payment or swap yourself, and `le
 
 A wallet that holds at least 100,000 $WAFERMAP on Robinhood Chain pays 50% less for Wafermap's own resources when it pays on an EVM network (Robinhood Chain, Base, Arbitrum, Polygon). Nothing to set up: `wafermap call` names the wallet to Wafermap and the quote comes back discounted; the server re-checks the balance of the wallet that signs. Marketplace listings and Solana payments keep the regular price. Check a wallet: https://wafermap.xyz/api/holder?address=0x…, or run `wafermap holder`.
 
+Wafermap's own resources can also be **paid in $WAFERMAP at 50% off, and the tokens are burned**: `wafermap approve-wafermap` once (a Permit2 approval, one Robinhood Chain transaction), then `wafermap call <id> --pay wafermap`. Each payment is a Permit2 signature for one exact amount, usable for two minutes only by Wafermap's relayer (fixed in the client), checked against a market price the client reads itself.
+
 With 1,000,000 $WAFERMAP the wallet is **Pro**: 10 free calls a day (UTC) to resources listed at $0.01 or less. `wafermap call` sends a holder pass (a signed message, no transaction, valid 24 hours) to Wafermap only; when a call is free, nothing is signed for payment and it prints `✓ Free call`. Holders of 100,000 also unlock x402 Tracker Pro: `wafermap pass` prints a pass for its API. Details: https://wafermap.xyz/docs#holders
 
 ## Where the limits live
@@ -92,7 +94,7 @@ The caps sit with the key, on your machine. Before the wallet signs anything it
 
 **The daily cap counts what the wallet signed, not what a server says it charged.** Every payment is written to `spend.jsonl` at its full signed amount the moment it is signed, before it is sent, and stays counted whatever the server answers: an error, a receipt saying $0, no receipt, or no answer at all. Check, sign and record run one payment at a time within a process, so calls started together cannot share the same remaining budget. Across processes on the same wallet (two MCP clients, or the CLI next to the MCP server), the wallet re-reads the shared log right after recording a signed payment and, if the cap is now passed, drops that payment before it is sent. (Before 0.3.3 the cap trusted the server's receipt; see [CHANGELOG.md](CHANGELOG.md).)
 
-**What the wallet cannot enforce.** An x402 `exact` payment is a signed authorization (EIP-3009 on EVM chains, a partially signed transaction on Solana). Whoever receives it can execute it once until it expires. The wallet signs EVM authorizations for at most 90 seconds, or less when the server asks for less (300 before 0.4.0). "A failed call costs $0" is therefore a promise of the server you pay: Wafermap's server settles only after the resource worked and otherwise lets the authorization expire unused. You do not have to take that on trust: `wafermap history --verify` asks each token contract (`authorizationState`) whether every signed payment was executed, and shows the ones that expired unused (`error` means the RPC did not answer). Solana payments are not checked yet. The caps bound the worst case either way.
+**What the wallet cannot enforce.** An x402 `exact` payment is a signed authorization (EIP-3009 on EVM chains, a partially signed transaction on Solana). Whoever receives it can execute it once until it expires. The wallet signs EVM authorizations for at most 90 seconds, or less when the server asks for less (300 before 0.4.0). "A failed call costs $0" is therefore a promise of the server you pay: Wafermap's server settles only after the resource worked and otherwise lets the authorization expire unused. You do not have to take that on trust: `wafermap history --verify` asks each token contract (`authorizationState`) whether every signed payment was executed, and shows the ones that expired unused (`error` means the RPC did not answer). Because `authorizationState` is also true after `cancelAuthorization`, a payment only shows as `used` once the contract's `AuthorizationUsed` event for that nonce is found (in the settlement transaction, or in the blocks between signing and expiry); a nonce that is spent but never executed shows as `cancelled`. The search needs `eth_getLogs`, which Base's public RPC refuses; set `WAFERMAP_RPC_BASE` to your own RPC if a Base payment without a transaction on record shows `error`. Solana payments are not checked yet. The caps bound the worst case either way.
 
 **Time limits.** Requests to paid resources and services, to Wafermap's API, to the swap API and to Solana RPC give up after 60 seconds (`timeoutMs` in the SDK); EVM RPC calls keep viem's own time-outs. `wafermap resources` uses the same limit. Set `WAFERMAP_TIMEOUT_MS` to change it for the CLI and the MCP server. A paid call that times out after the payment was signed says so: the payment stays counted, and for EVM payments the message says until when it can be executed.
 

package/dist/cli.js

@@ -296,6 +296,34 @@ var init_solana = __esm({
 });
 
 // shared/x402client.ts
+async function wafermapPriceUsd(f = fetch) {
+  const res = await f(`https://api.geckoterminal.com/api/v2/simple/networks/robinhood/token_price/${WAFERMAP_TOKEN}`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(15e3) });
+  const j = await res.json().catch(() => null);
+  const p = Number(j?.data?.attributes?.token_prices?.[WAFERMAP_TOKEN]);
+  if (!res.ok || !(p > 0)) throw new X402Error("price_unavailable", "The $WAFERMAP market price could not be read, so the amount cannot be checked. Nothing was signed; pay in USDG or USDC.");
+  return p;
+}
+function tokenOption(r) {
+  const e = r?.extra ?? {};
+  const same = (a, b) => String(a ?? "").toLowerCase() === b.toLowerCase();
+  if (r?.scheme !== TOKEN_SCHEME || r.network !== "eip155:4663" || !same(r.asset, WAFERMAP_TOKEN) || !same(r.payTo, DEAD) || !same(e.permit2, PERMIT2)) return;
+  if (!/^\d{1,40}$/.test(String(r.amount)) || !/^0x[0-9a-fA-F]{40}$/.test(String(e.spender)) || !(Number(e.usd) > 0)) return;
+  if (!WAFERMAP_RELAYERS.some((a) => same(e.spender, a))) return;
+  return { amount: String(r.amount), usd: Number(e.usd), spender: e.spender, maxTimeoutSeconds: Number(r.maxTimeoutSeconds) || 120, raw: r };
+}
+async function signTokenPayment(signer, t, resource) {
+  const nonce = BigInt(randomNonce()) >> 8n;
+  const deadline = BigInt(Math.floor(Date.now() / 1e3) + Math.min(t.maxTimeoutSeconds, 120));
+  const permitted = { token: WAFERMAP_TOKEN, amount: BigInt(t.amount) };
+  let signature;
+  try {
+    signature = await signer.signTypedData({ domain: { name: "Permit2", chainId: 4663, verifyingContract: PERMIT2 }, types: PERMIT_TYPES, primaryType: "PermitTransferFrom", message: { permitted, spender: t.spender, nonce, deadline } });
+  } catch (e) {
+    throw new X402Error("sign_rejected", e?.shortMessage ?? e?.message ?? "Signature rejected.");
+  }
+  const payload = { owner: signer.address, permit: { permitted: { token: WAFERMAP_TOKEN, amount: t.amount }, nonce: nonce.toString(), deadline: deadline.toString() }, signature };
+  return { name: "PAYMENT-SIGNATURE", value: b64encode(JSON.stringify({ x402Version: 2, resource, accepted: t.raw, payload })), deadline: Number(deadline) };
+}
 function chainOf(network) {
   const n = String(network ?? "").toLowerCase();
   return PAY_CHAINS.find((c) => c.caip.toLowerCase() === n || c.v1 === n || c.id > 0 && String(c.id) === n);
@@ -314,8 +342,13 @@ async function readQuote(res) {
   const version = Number(body.x402Version) === 1 ? 1 : 2;
   const accepts = [];
   const offered = [];
+  let token;
   for (const r of body.accepts) {
     offered.push(`${r.scheme ?? "?"}/${r.network ?? "?"}`);
+    if (r?.scheme === TOKEN_SCHEME) {
+      token ??= tokenOption(r);
+      continue;
+    }
     const chain = chainOf(r.network);
     if (!chain || r.scheme !== "exact") continue;
     if (chain.vm === "evm" ? String(r.asset ?? "").toLowerCase() !== chain.stable.toLowerCase() : r.asset !== chain.stable) continue;
@@ -329,7 +362,7 @@ async function readQuote(res) {
     accepts.push({ version, chain, amount, usd: Number(amount) / 1e6, payTo: r.payTo, asset: r.asset, maxTimeoutSeconds: Number(r.maxTimeoutSeconds) || 120, extra, raw: r });
   }
   const inputError = body.inputError?.message ? { code: String(body.inputError.code ?? "invalid_input"), message: String(body.inputError.message) } : void 0;
-  return { version, resource: body.resource ?? null, accepts, offered, inputError };
+  return { version, resource: body.resource ?? null, accepts, offered, inputError, ...token ? { token } : {} };
 }
 function choose(q, prefer = CHAIN_KEYS) {
   for (const k of prefer) {
@@ -381,6 +414,23 @@ async function x402fetch(url, init, opts) {
   if (first.status !== 402) return { res: first, paid: null };
   const quote = await readQuote(first);
   if (quote.inputError) throw new X402Error(quote.inputError.code, quote.inputError.message);
+  if (opts.payIn === "wafermap") {
+    const t = quote.token;
+    if (!t) throw new X402Error("token_not_offered", "This call is not offered in $WAFERMAP right now (or not to a known Wafermap relayer). Pay in USDG or USDC.");
+    const value = Number(BigInt(t.amount) / 10n ** 12n) / 1e6 * await (opts.tokenPriceUsd ?? (() => wafermapPriceUsd(fetch)))();
+    if (value > t.usd * TOKEN_VALUE_SLACK + 5e-4) throw new X402Error("price_mismatch", `The quote asks for $WAFERMAP worth about $${value.toFixed(4)} at the market price, more than the $${t.usd} it states. Nothing was signed.`);
+    const usd = Math.max(t.usd, Math.round(value * 1e6) / 1e6);
+    const req2 = { version: 2, chain: PAY_CHAINS[0], amount: String(Math.round(usd * 1e6)), usd, payTo: DEAD, asset: WAFERMAP_TOKEN, maxTimeoutSeconds: t.maxTimeoutSeconds, extra: {}, raw: t.raw };
+    if (opts.approve) await opts.approve(req2);
+    const signer2 = typeof opts.signer === "function" ? await opts.signer() : opts.signer;
+    const header2 = await signTokenPayment(signer2, t, quote.resource);
+    const signed2 = { req: req2, from: signer2.address, token: { amount: t.amount } };
+    opts.onSigned?.(signed2);
+    const headers2 = new Headers(init.headers);
+    headers2.set(header2.name, header2.value);
+    const res2 = await f(url, { ...init, headers: headers2 });
+    return { res: res2, paid: { ...signed2, tx: readSettlement(res2)?.tx ?? null } };
+  }
   const req = choose(quote, (opts.prefer ?? CHAIN_KEYS).filter((k) => k !== "solana" || opts.solana));
   if (opts.approve) await opts.approve(req);
   const svm = req.chain.vm === "svm";
@@ -393,7 +443,7 @@ async function x402fetch(url, init, opts) {
   const res = await f(url, { ...init, headers });
   return { res, paid: { ...signed, tx: readSettlement(res)?.tx ?? null } };
 }
-var USDC_DOMAIN, PAY_CHAINS, EVM_CHAINS, CHAIN_KEYS, X402Error, b64encode, b64decode, TYPES, MAX_VALIDITY_SECONDS, randomNonce;
+var USDC_DOMAIN, PAY_CHAINS, EVM_CHAINS, CHAIN_KEYS, WAFERMAP_TOKEN, PERMIT2, DEAD, TOKEN_SCHEME, WAFERMAP_RELAYERS, TOKEN_VALUE_SLACK, PERMIT_TYPES, X402Error, b64encode, b64decode, TYPES, MAX_VALIDITY_SECONDS, randomNonce;
 var init_x402client = __esm({
   "shared/x402client.ts"() {
     "use strict";
@@ -408,6 +458,24 @@ var init_x402client = __esm({
     ];
     EVM_CHAINS = PAY_CHAINS.filter((c) => c.vm === "evm");
     CHAIN_KEYS = PAY_CHAINS.map((c) => c.key);
+    WAFERMAP_TOKEN = "0xfda080f64d84c989cfc50ff18253542cfe502db3";
+    PERMIT2 = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+    DEAD = "0x000000000000000000000000000000000000dEaD";
+    TOKEN_SCHEME = "wafermap-permit2";
+    WAFERMAP_RELAYERS = ["0xD21547a387a9CfFb747211983c91f457742Ef00D"];
+    TOKEN_VALUE_SLACK = 1.25;
+    PERMIT_TYPES = {
+      PermitTransferFrom: [
+        { name: "permitted", type: "TokenPermissions" },
+        { name: "spender", type: "address" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint256" }
+      ],
+      TokenPermissions: [
+        { name: "token", type: "address" },
+        { name: "amount", type: "uint256" }
+      ]
+    };
     X402Error = class extends Error {
       constructor(code, message) {
         super(message);
@@ -492,7 +560,7 @@ __export(core_exports, {
   listResources: () => listResources,
   mergeLog: () => mergeLog
 });
-import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http } from "viem";
+import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http, pad, parseAbiItem, toEventSelector } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 import { arbitrum, base, polygon, robinhood } from "viem/chains";
 function mergeLog(entries) {
@@ -503,14 +571,56 @@ function mergeLog(entries) {
     return { ...e, status: o.status, tx: o.tx ?? e.tx, reported: o.reported ?? null, ...o.status === "aborted" ? { usd: 0 } : {} };
   });
 }
+async function blockAt(client, ts, side, latest) {
+  if (ts >= Number(latest.timestamp)) return latest.number;
+  let hi = latest;
+  let lo = await client.getBlock({ blockNumber: latest.number > 100000n ? latest.number - 100000n : 0n });
+  while (Number(lo.timestamp) > ts && lo.number > 0n) {
+    const back = (hi.number - lo.number) * 4n;
+    hi = lo;
+    lo = await client.getBlock({ blockNumber: lo.number > back ? lo.number - back : 0n });
+  }
+  for (let i = 0; i < 20 && hi.number - lo.number > 20n; i++) {
+    const span = Number(hi.timestamp - lo.timestamp) || 1;
+    let guess = lo.number + BigInt(Math.floor(Number(hi.number - lo.number) * (ts - Number(lo.timestamp)) / span));
+    if (guess <= lo.number) guess = lo.number + 1n;
+    if (guess >= hi.number) guess = hi.number - 1n;
+    const b = await client.getBlock({ blockNumber: guess });
+    if (Number(b.timestamp) <= ts) lo = b;
+    else hi = b;
+  }
+  return side === "from" ? lo.number : hi.number;
+}
 async function checkPayment(e, rpc) {
   if (e.network === "solana" || !e.nonce || !(e.network in CHAINS)) return "unknown";
   const chain = PAY_CHAINS.find((c) => c.key === e.network);
   try {
     const client = createPublicClient({ chain: CHAINS[e.network], transport: http(rpc) });
     const used = await client.readContract({ address: chain.stable, abi: AUTH_STATE_ABI, functionName: "authorizationState", args: [e.payer, e.nonce] });
-    if (used) return "used";
-    return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    if (!used) return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    const isOurs = (l) => l.address.toLowerCase() === chain.stable.toLowerCase() && l.topics[0] === toEventSelector(AUTH_USED) && l.topics[1]?.toLowerCase() === pad(e.payer).toLowerCase() && l.topics[2]?.toLowerCase() === e.nonce.toLowerCase();
+    if (e.tx && /^0x[0-9a-fA-F]{64}$/.test(e.tx)) {
+      const receipt = await client.getTransactionReceipt({ hash: e.tx }).catch(() => null);
+      if (receipt?.status === "success" && receipt.logs.some(isOurs)) return "used";
+    }
+    if (!e.validBefore || !e.at) return "error";
+    const latest = await client.getBlock();
+    const fromBlock = await blockAt(client, Math.floor(e.at / 1e3) - 60, "from", latest);
+    const toBlock = await blockAt(client, e.validBefore + 30, "to", latest);
+    for (let start = fromBlock; start <= toBlock; start += 50n) {
+      const end = start + 49n < toBlock ? start + 49n : toBlock;
+      for (let attempt = 0; ; attempt++) {
+        try {
+          const logs = await client.getLogs({ address: chain.stable, event: AUTH_USED, args: { authorizer: e.payer, nonce: e.nonce }, fromBlock: start, toBlock: end });
+          if (logs.length) return "used";
+          break;
+        } catch (err) {
+          if (attempt >= 3) throw err;
+          await new Promise((r) => setTimeout(r, 1500 * (attempt + 1)));
+        }
+      }
+    }
+    return "cancelled";
   } catch {
     return "error";
   }
@@ -538,7 +648,7 @@ async function listResources(baseUrl = "https://wafermap.xyz", timeoutMs = DEFAU
   if (!r.ok || !Array.isArray(j?.data)) throw new WafermapError("network_error", `${host} returned no catalog (HTTP ${r.status}).`);
   return j.data;
 }
-var NETS, isNet, isSwapNet, WafermapError, CHAINS, AUTH_STATE_ABI, DEFAULT_LIMITS, DEFAULT_TIMEOUT_MS, timedOut, Wafermap;
+var NETS, isNet, isSwapNet, WafermapError, CHAINS, AUTH_STATE_ABI, AUTH_USED, DEFAULT_LIMITS, DEFAULT_TIMEOUT_MS, timedOut, Wafermap;
 var init_core = __esm({
   "src/core.ts"() {
     "use strict";
@@ -558,6 +668,7 @@ var init_core = __esm({
     };
     CHAINS = { robinhood, base, arbitrum, polygon };
     AUTH_STATE_ABI = [{ type: "function", name: "authorizationState", stateMutability: "view", inputs: [{ name: "authorizer", type: "address" }, { name: "nonce", type: "bytes32" }], outputs: [{ type: "bool" }] }];
+    AUTH_USED = parseAbiItem("event AuthorizationUsed(address indexed authorizer, bytes32 indexed nonce)");
     DEFAULT_LIMITS = { perPayment: 0.1, perDay: 1, perSwap: 25 };
     DEFAULT_TIMEOUT_MS = 6e4;
     timedOut = (e) => e?.name === "TimeoutError" || e?.cause?.name === "TimeoutError";
@@ -575,6 +686,7 @@ var init_core = __esm({
       timeoutMs;
       /** fetch with this wallet's time limit: a server that never answers cannot hold a call forever. */
       fetch;
+      tokenPriceUsd;
       constructor(o) {
         const account = o.account ?? (o.privateKey ? privateKeyToAccount(o.privateKey) : null);
         if (!account) throw new WafermapError("no_account", "Pass privateKey or account.");
@@ -587,6 +699,7 @@ var init_core = __esm({
         this.approveFn = o.approve;
         this.rpc = o.rpc ?? {};
         this.timeoutMs = o.timeoutMs && o.timeoutMs > 0 ? o.timeoutMs : DEFAULT_TIMEOUT_MS;
+        this.tokenPriceUsd = o.tokenPriceUsd;
         this.fetch = (input, init) => fetch(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(this.timeoutMs) });
         const sol = o.solana ?? (o.privateKey ? solanaKeyFromEvm(o.privateKey) : null);
         const solRpc = this.rpc.solana ?? `${this.baseUrl}/api/solana`;
@@ -660,7 +773,7 @@ var init_core = __esm({
         this.queue = prev.then(() => held);
         return prev.then(() => release);
       }
-      async paidFetch(kind, what, url, init, network) {
+      async paidFetch(kind, what, url, init, network, payIn) {
         let id = null;
         let release = null;
         const unlock = () => {
@@ -673,9 +786,11 @@ var init_core = __esm({
             solana: this.solana ?? void 0,
             prefer: this.prefer(network),
             fetch: this.fetch,
+            payIn,
+            tokenPriceUsd: this.tokenPriceUsd,
             approve: async (req) => {
               release = await this.acquire();
-              await this.gate({ kind, what, usd: req.usd, network: req.chain.key, detail: `${req.chain.symbol} to ${req.payTo}` });
+              await this.gate({ kind, what, usd: req.usd, network: req.chain.key, detail: req.asset === WAFERMAP_TOKEN ? "in $WAFERMAP at 50% off, burned" : `${req.chain.symbol} to ${req.payTo}` });
             },
             onSigned: (s) => {
               id = this.booked(kind, what, s);
@@ -711,9 +826,33 @@ var init_core = __esm({
         this.passCache = encodePass(await makePass({ address: this.account.address, signMessage: (a) => this.account.signMessage(a) }));
         return this.passCache;
       }
+      // ---- Paying in $WAFERMAP (Permit2; the tokens are burned) ----
+      /** Whether this wallet has approved Permit2 to move its $WAFERMAP (needed once before paying in $WAFERMAP). */
+      async wafermapApproved() {
+        const a = await this.client("robinhood").readContract({ address: WAFERMAP_TOKEN, abi: erc20Abi2, functionName: "allowance", args: [this.address, PERMIT2] });
+        return a >= 10n ** 30n;
+      }
+      /** Approves Permit2 (Uniswap's, at its canonical address) to move this wallet's $WAFERMAP: one on-chain
+       *  transaction on Robinhood Chain, paid in ETH. Each payment after that is a signature for one exact amount,
+       *  spendable only by Wafermap's relayer for two minutes. */
+      async approveWafermap() {
+        const wallet = createWalletClient({ account: this.account, chain: CHAINS.robinhood, transport: http(this.rpc.robinhood) });
+        try {
+          const tx = await wallet.writeContract({ address: WAFERMAP_TOKEN, abi: erc20Abi2, functionName: "approve", args: [PERMIT2, 2n ** 256n - 1n] });
+          const rc = await this.client("robinhood").waitForTransactionReceipt({ hash: tx, timeout: 6e4 });
+          if (rc.status !== "success") throw new WafermapError("approve_failed", `The approval reverted: ${tx}`);
+          return tx;
+        } catch (e) {
+          if (e instanceof WafermapError) throw e;
+          throw new WafermapError("approve_failed", e?.shortMessage ?? e?.message ?? "The approval failed.");
+        }
+      }
       async call(id, input = {}, o = {}) {
+        const inToken = o.payIn === "wafermap";
+        if (inToken && id.startsWith("m/")) throw new WafermapError("token_not_offered", "Marketplace listings are paid in USDG or USDC to their seller, not in $WAFERMAP.");
+        if (inToken && !await this.wafermapApproved().catch(() => true)) throw new WafermapError("permit2_not_approved", "Paying in $WAFERMAP needs a one-time approval of Permit2. Run `wafermap approve-wafermap` (one transaction on Robinhood Chain, paid in ETH), then call again.");
         const pass = id.startsWith("m/") ? null : await this.holderPass();
-        const go = () => this.paidFetch("resource", id, `${this.baseUrl}/v1/${id}`, { method: "POST", headers: { "content-type": "application/json", "x-wafermap-payer": this.address, ...pass ? { [PASS_HEADER]: pass } : {} }, body: JSON.stringify(input) }, o.network);
+        const go = () => this.paidFetch("resource", id, `${this.baseUrl}/v1/${id}`, { method: "POST", headers: { "content-type": "application/json", "x-wafermap-payer": this.address, ...pass ? { [PASS_HEADER]: pass } : {} }, body: JSON.stringify(input) }, o.network, inToken ? "wafermap" : void 0);
         const settle = (r2, out2) => {
           if (!r2.paid || !r2.id) return;
           const status = r2.res.status === 402 ? "refused" : r2.res.ok ? "ok" : "failed";
@@ -1023,7 +1162,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "0.4.4";
+    VERSION = "0.4.6";
   }
 });
 
@@ -1123,11 +1262,16 @@ async function runMcp() {
     {
       title: "Call a Wafermap resource",
       description: "Run one Wafermap resource and pay its exact price over x402 from the local wallet, within the per-payment and daily caps. Failed calls are not charged.",
-      inputSchema: { resource: z.string().describe("Resource id, e.g. market-brief, prediction-markets, stock-signal, flux-2-dev."), input: z.record(z.string(), z.any()).optional().describe("Input fields for the resource."), network: NET }
+      inputSchema: {
+        resource: z.string().describe("Resource id, e.g. market-brief, prediction-markets, stock-signal, flux-2-dev."),
+        input: z.record(z.string(), z.any()).optional().describe("Input fields for the resource."),
+        network: NET,
+        payIn: z.enum(["stablecoin", "wafermap"]).optional().describe("wafermap: pay Wafermap's own resources in $WAFERMAP at 50% off (the tokens are burned; needs `wafermap approve-wafermap` once). Default: USDG/USDC.")
+      }
     },
-    async ({ resource, input, network }) => {
+    async ({ resource, input, network, payIn }) => {
       try {
-        return result(await wm.call(resource, input ?? {}, { network }));
+        return result(await wm.call(resource, input ?? {}, { network, payIn }));
       } catch (e) {
         return failure(e);
       }
@@ -1578,6 +1722,8 @@ Wallet
 Pay
   wafermap resources [words]            Wafermap's pay-per-call catalog
   wafermap call <id> [field=value ...]  run a resource and pay its price  (--json '{...}' for complex input)
+  wafermap call <id> ... --pay wafermap pay a Wafermap resource in $WAFERMAP at 50% off (the tokens are burned)
+  wafermap approve-wafermap             one-time approval so the wallet can pay in $WAFERMAP (Robinhood Chain, ETH gas)
   wafermap holder                       what this wallet's $WAFERMAP unlocks: holder price, Pro free calls left today
   wafermap pass                         print a holder pass (X-Wafermap-Pass) for scripts and x402 Tracker Pro
   wafermap discover <words>             search third-party x402 services
@@ -1695,6 +1841,14 @@ async function main() {
   Caps: $0.10 per payment, $1 per day, $25 per swap. Change with \`wafermap limits\`.`);
       return;
     }
+    case "approve-wafermap": {
+      const wm = openWallet(await password());
+      if (await wm.wafermapApproved()) return console.log("\u2713 Already approved: this wallet can pay Wafermap in $WAFERMAP (wafermap call <id> --pay wafermap).");
+      console.error(`This sends one transaction on Robinhood Chain from ${wm.address}, paid in ETH: approve Permit2 (Uniswap, 0x000000000022D473030F116dDEE9F6B43aC78BA3) to move this wallet's $WAFERMAP. Each payment after that is a separate signature for one exact amount, usable only by Wafermap's relayer for two minutes.`);
+      if (!yes && !/^y(es)?$/i.test((await ask("Send the approval? [y/N] ")).trim())) die("Cancelled. Nothing was sent.");
+      const tx = await wm.approveWafermap();
+      return console.log(`\u2713 Approved \xB7 ${EXPLORER("robinhood")}/tx/${tx}`);
+    }
     case "holder": {
       const addr = keystoreAddress() ?? die("No wallet yet. Run `wafermap init`.");
       const j = await holderInfo(addr, process.env.WAFERMAP_URL, Number(process.env.WAFERMAP_TIMEOUT_MS) || void 0);
@@ -1759,7 +1913,16 @@ async function main() {
       if (!rows.length) return console.log(`Nothing in the last ${days} days.`);
       const verify = a.flags.verify !== void 0;
       const RPC = { robinhood: process.env.WAFERMAP_RPC_ROBINHOOD, base: process.env.WAFERMAP_RPC_BASE, arbitrum: process.env.WAFERMAP_RPC_ARBITRUM, polygon: process.env.WAFERMAP_RPC_POLYGON };
-      const chain = verify ? await Promise.all(rows.map((e) => e.kind === "swap" ? null : checkPayment(e, RPC[e.network]))) : [];
+      const chain = [];
+      if (verify) {
+        let next = 0;
+        await Promise.all(Array.from({ length: 4 }, async () => {
+          while (next < rows.length) {
+            const i = next++;
+            chain[i] = rows[i].kind === "swap" ? null : await checkPayment(rows[i], RPC[rows[i].network]);
+          }
+        }));
+      }
       rows.forEach((e, i) => {
         const state = [e.status, chain[i] ? `on-chain: ${chain[i]}` : null].filter(Boolean).join(", ");
         console.log(`${new Date(e.at).toISOString().slice(0, 16).replace("T", " ")}  ${e.kind.padEnd(8)}  ${e.kind === "swap" ? "      " : `$${e.usd}`.padEnd(8)}  ${e.network.padEnd(9)}  ${e.what}${state ? `  [${state}]` : ""}${e.tx ? `  ${EXPLORER(e.network)}/tx/${e.tx}` : ""}`);
@@ -1770,7 +1933,8 @@ async function main() {
 Total $${total.toFixed(4)} in ${pays.length} payments. From 0.3.3 every payment counts at its full signed amount; older lines show what the server reported.`);
       if (verify) {
         const never = rows.filter((e, i) => e.kind !== "swap" && chain[i] === "unused").reduce((s, e) => s + e.usd, 0);
-        console.log(`On-chain: $${never.toFixed(4)} of that was signed but never executed and has expired. "unknown" = Solana or an older log line; "error" = the RPC did not answer, try again.`);
+        const cancelled = rows.filter((e, i) => e.kind !== "swap" && chain[i] === "cancelled").reduce((s, e) => s + e.usd, 0);
+        console.log(`On-chain: $${never.toFixed(4)} of that was signed but never executed and has expired${cancelled ? `, and $${cancelled.toFixed(4)} was cancelled by this wallet before it executed` : ""}. "used" = the token contract logged the transfer (AuthorizationUsed); "cancelled" = the nonce is spent but never executed (cancelAuthorization); "unknown" = Solana or an older log line; "error" = the RPC did not answer, try again (Base's public RPC refuses log searches: for a payment with no transaction on record, set WAFERMAP_RPC_BASE to your own RPC).`);
       } else console.log("Add --verify to check on-chain which signed payments were executed.");
       return;
     }
@@ -1794,8 +1958,10 @@ Total $${total.toFixed(4)} in ${pays.length} payments. From 0.3.3 every payment
     case "call": {
       const id = a._[0] ?? die("Which resource? e.g. wafermap call gas-now network=base");
       const wm = openWallet(await password(), approver(yes));
-      const out = await wm.call(id, inputOf(a, 1), { network: net(a.flags.network) });
-      if (out.receipt) console.error(`\u2713 Paid $${out.receipt.amountUsd} ${out.receipt.asset} \xB7 ${EXPLORER(out.receipt.network)}/tx/${out.receipt.tx}`);
+      const payIn = a.flags.pay === "wafermap" ? "wafermap" : a.flags.pay === void 0 || a.flags.pay === "usd" ? void 0 : die("--pay must be wafermap (or leave it out to pay in USDG/USDC)");
+      const out = await wm.call(id, inputOf(a, 1), { network: net(a.flags.network), payIn });
+      if (out.receipt?.asset === "WAFERMAP") console.error(`\u2713 Paid ${out.receipt.amountTokens} $WAFERMAP (\u2248 $${out.receipt.amountUsd}), burned \xB7 ${EXPLORER(out.receipt.network)}/tx/${out.receipt.tx}`);
+      else if (out.receipt) console.error(`\u2713 Paid $${out.receipt.amountUsd} ${out.receipt.asset} \xB7 ${EXPLORER(out.receipt.network)}/tx/${out.receipt.tx}`);
       else if (out.free) console.error(`\u2713 Free call ($WAFERMAP Pro) \xB7 ${out.free.left} of ${out.free.perDay} left today. Nothing was paid.`);
       if (typeof a.flags.out === "string") await saveMedia(out.result, a.flags.out);
       return printResult(out.result);

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/core.ts
-import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http } from "viem";
+import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http, pad, parseAbiItem, toEventSelector } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 import { arbitrum, base, polygon, robinhood } from "viem/chains";
 
@@ -283,6 +283,52 @@ var PAY_CHAINS = [
 ];
 var EVM_CHAINS = PAY_CHAINS.filter((c) => c.vm === "evm");
 var CHAIN_KEYS = PAY_CHAINS.map((c) => c.key);
+var WAFERMAP_TOKEN = "0xfda080f64d84c989cfc50ff18253542cfe502db3";
+var PERMIT2 = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var DEAD = "0x000000000000000000000000000000000000dEaD";
+var TOKEN_SCHEME = "wafermap-permit2";
+var WAFERMAP_RELAYERS = ["0xD21547a387a9CfFb747211983c91f457742Ef00D"];
+var TOKEN_VALUE_SLACK = 1.25;
+async function wafermapPriceUsd(f = fetch) {
+  const res = await f(`https://api.geckoterminal.com/api/v2/simple/networks/robinhood/token_price/${WAFERMAP_TOKEN}`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(15e3) });
+  const j = await res.json().catch(() => null);
+  const p = Number(j?.data?.attributes?.token_prices?.[WAFERMAP_TOKEN]);
+  if (!res.ok || !(p > 0)) throw new X402Error("price_unavailable", "The $WAFERMAP market price could not be read, so the amount cannot be checked. Nothing was signed; pay in USDG or USDC.");
+  return p;
+}
+var PERMIT_TYPES = {
+  PermitTransferFrom: [
+    { name: "permitted", type: "TokenPermissions" },
+    { name: "spender", type: "address" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ],
+  TokenPermissions: [
+    { name: "token", type: "address" },
+    { name: "amount", type: "uint256" }
+  ]
+};
+function tokenOption(r) {
+  const e = r?.extra ?? {};
+  const same = (a, b) => String(a ?? "").toLowerCase() === b.toLowerCase();
+  if (r?.scheme !== TOKEN_SCHEME || r.network !== "eip155:4663" || !same(r.asset, WAFERMAP_TOKEN) || !same(r.payTo, DEAD) || !same(e.permit2, PERMIT2)) return;
+  if (!/^\d{1,40}$/.test(String(r.amount)) || !/^0x[0-9a-fA-F]{40}$/.test(String(e.spender)) || !(Number(e.usd) > 0)) return;
+  if (!WAFERMAP_RELAYERS.some((a) => same(e.spender, a))) return;
+  return { amount: String(r.amount), usd: Number(e.usd), spender: e.spender, maxTimeoutSeconds: Number(r.maxTimeoutSeconds) || 120, raw: r };
+}
+async function signTokenPayment(signer, t, resource) {
+  const nonce = BigInt(randomNonce()) >> 8n;
+  const deadline = BigInt(Math.floor(Date.now() / 1e3) + Math.min(t.maxTimeoutSeconds, 120));
+  const permitted = { token: WAFERMAP_TOKEN, amount: BigInt(t.amount) };
+  let signature;
+  try {
+    signature = await signer.signTypedData({ domain: { name: "Permit2", chainId: 4663, verifyingContract: PERMIT2 }, types: PERMIT_TYPES, primaryType: "PermitTransferFrom", message: { permitted, spender: t.spender, nonce, deadline } });
+  } catch (e) {
+    throw new X402Error("sign_rejected", e?.shortMessage ?? e?.message ?? "Signature rejected.");
+  }
+  const payload = { owner: signer.address, permit: { permitted: { token: WAFERMAP_TOKEN, amount: t.amount }, nonce: nonce.toString(), deadline: deadline.toString() }, signature };
+  return { name: "PAYMENT-SIGNATURE", value: b64encode(JSON.stringify({ x402Version: 2, resource, accepted: t.raw, payload })), deadline: Number(deadline) };
+}
 var X402Error = class extends Error {
   constructor(code, message) {
     super(message);
@@ -315,8 +361,13 @@ async function readQuote(res) {
   const version = Number(body.x402Version) === 1 ? 1 : 2;
   const accepts = [];
   const offered = [];
+  let token;
   for (const r of body.accepts) {
     offered.push(`${r.scheme ?? "?"}/${r.network ?? "?"}`);
+    if (r?.scheme === TOKEN_SCHEME) {
+      token ??= tokenOption(r);
+      continue;
+    }
     const chain = chainOf(r.network);
     if (!chain || r.scheme !== "exact") continue;
     if (chain.vm === "evm" ? String(r.asset ?? "").toLowerCase() !== chain.stable.toLowerCase() : r.asset !== chain.stable) continue;
@@ -330,7 +381,7 @@ async function readQuote(res) {
     accepts.push({ version, chain, amount, usd: Number(amount) / 1e6, payTo: r.payTo, asset: r.asset, maxTimeoutSeconds: Number(r.maxTimeoutSeconds) || 120, extra, raw: r });
   }
   const inputError = body.inputError?.message ? { code: String(body.inputError.code ?? "invalid_input"), message: String(body.inputError.message) } : void 0;
-  return { version, resource: body.resource ?? null, accepts, offered, inputError };
+  return { version, resource: body.resource ?? null, accepts, offered, inputError, ...token ? { token } : {} };
 }
 function choose(q, prefer = CHAIN_KEYS) {
   for (const k of prefer) {
@@ -394,6 +445,23 @@ async function x402fetch(url, init, opts) {
   if (first.status !== 402) return { res: first, paid: null };
   const quote = await readQuote(first);
   if (quote.inputError) throw new X402Error(quote.inputError.code, quote.inputError.message);
+  if (opts.payIn === "wafermap") {
+    const t = quote.token;
+    if (!t) throw new X402Error("token_not_offered", "This call is not offered in $WAFERMAP right now (or not to a known Wafermap relayer). Pay in USDG or USDC.");
+    const value = Number(BigInt(t.amount) / 10n ** 12n) / 1e6 * await (opts.tokenPriceUsd ?? (() => wafermapPriceUsd(fetch)))();
+    if (value > t.usd * TOKEN_VALUE_SLACK + 5e-4) throw new X402Error("price_mismatch", `The quote asks for $WAFERMAP worth about $${value.toFixed(4)} at the market price, more than the $${t.usd} it states. Nothing was signed.`);
+    const usd = Math.max(t.usd, Math.round(value * 1e6) / 1e6);
+    const req2 = { version: 2, chain: PAY_CHAINS[0], amount: String(Math.round(usd * 1e6)), usd, payTo: DEAD, asset: WAFERMAP_TOKEN, maxTimeoutSeconds: t.maxTimeoutSeconds, extra: {}, raw: t.raw };
+    if (opts.approve) await opts.approve(req2);
+    const signer2 = typeof opts.signer === "function" ? await opts.signer() : opts.signer;
+    const header2 = await signTokenPayment(signer2, t, quote.resource);
+    const signed2 = { req: req2, from: signer2.address, token: { amount: t.amount } };
+    opts.onSigned?.(signed2);
+    const headers2 = new Headers(init.headers);
+    headers2.set(header2.name, header2.value);
+    const res2 = await f(url, { ...init, headers: headers2 });
+    return { res: res2, paid: { ...signed2, tx: readSettlement(res2)?.tx ?? null } };
+  }
   const req = choose(quote, (opts.prefer ?? CHAIN_KEYS).filter((k) => k !== "solana" || opts.solana));
   if (opts.approve) await opts.approve(req);
   const svm = req.chain.vm === "svm";
@@ -462,14 +530,57 @@ function mergeLog(entries) {
     return { ...e, status: o.status, tx: o.tx ?? e.tx, reported: o.reported ?? null, ...o.status === "aborted" ? { usd: 0 } : {} };
   });
 }
+async function blockAt(client, ts, side, latest) {
+  if (ts >= Number(latest.timestamp)) return latest.number;
+  let hi = latest;
+  let lo = await client.getBlock({ blockNumber: latest.number > 100000n ? latest.number - 100000n : 0n });
+  while (Number(lo.timestamp) > ts && lo.number > 0n) {
+    const back = (hi.number - lo.number) * 4n;
+    hi = lo;
+    lo = await client.getBlock({ blockNumber: lo.number > back ? lo.number - back : 0n });
+  }
+  for (let i = 0; i < 20 && hi.number - lo.number > 20n; i++) {
+    const span = Number(hi.timestamp - lo.timestamp) || 1;
+    let guess = lo.number + BigInt(Math.floor(Number(hi.number - lo.number) * (ts - Number(lo.timestamp)) / span));
+    if (guess <= lo.number) guess = lo.number + 1n;
+    if (guess >= hi.number) guess = hi.number - 1n;
+    const b = await client.getBlock({ blockNumber: guess });
+    if (Number(b.timestamp) <= ts) lo = b;
+    else hi = b;
+  }
+  return side === "from" ? lo.number : hi.number;
+}
+var AUTH_USED = parseAbiItem("event AuthorizationUsed(address indexed authorizer, bytes32 indexed nonce)");
 async function checkPayment(e, rpc) {
   if (e.network === "solana" || !e.nonce || !(e.network in CHAINS)) return "unknown";
   const chain = PAY_CHAINS.find((c) => c.key === e.network);
   try {
     const client = createPublicClient({ chain: CHAINS[e.network], transport: http(rpc) });
     const used = await client.readContract({ address: chain.stable, abi: AUTH_STATE_ABI, functionName: "authorizationState", args: [e.payer, e.nonce] });
-    if (used) return "used";
-    return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    if (!used) return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    const isOurs = (l) => l.address.toLowerCase() === chain.stable.toLowerCase() && l.topics[0] === toEventSelector(AUTH_USED) && l.topics[1]?.toLowerCase() === pad(e.payer).toLowerCase() && l.topics[2]?.toLowerCase() === e.nonce.toLowerCase();
+    if (e.tx && /^0x[0-9a-fA-F]{64}$/.test(e.tx)) {
+      const receipt = await client.getTransactionReceipt({ hash: e.tx }).catch(() => null);
+      if (receipt?.status === "success" && receipt.logs.some(isOurs)) return "used";
+    }
+    if (!e.validBefore || !e.at) return "error";
+    const latest = await client.getBlock();
+    const fromBlock = await blockAt(client, Math.floor(e.at / 1e3) - 60, "from", latest);
+    const toBlock = await blockAt(client, e.validBefore + 30, "to", latest);
+    for (let start = fromBlock; start <= toBlock; start += 50n) {
+      const end = start + 49n < toBlock ? start + 49n : toBlock;
+      for (let attempt = 0; ; attempt++) {
+        try {
+          const logs = await client.getLogs({ address: chain.stable, event: AUTH_USED, args: { authorizer: e.payer, nonce: e.nonce }, fromBlock: start, toBlock: end });
+          if (logs.length) return "used";
+          break;
+        } catch (err) {
+          if (attempt >= 3) throw err;
+          await new Promise((r) => setTimeout(r, 1500 * (attempt + 1)));
+        }
+      }
+    }
+    return "cancelled";
   } catch {
     return "error";
   }
@@ -514,6 +625,7 @@ var Wafermap = class {
   timeoutMs;
   /** fetch with this wallet's time limit: a server that never answers cannot hold a call forever. */
   fetch;
+  tokenPriceUsd;
   constructor(o) {
     const account = o.account ?? (o.privateKey ? privateKeyToAccount(o.privateKey) : null);
     if (!account) throw new WafermapError("no_account", "Pass privateKey or account.");
@@ -526,6 +638,7 @@ var Wafermap = class {
     this.approveFn = o.approve;
     this.rpc = o.rpc ?? {};
     this.timeoutMs = o.timeoutMs && o.timeoutMs > 0 ? o.timeoutMs : DEFAULT_TIMEOUT_MS;
+    this.tokenPriceUsd = o.tokenPriceUsd;
     this.fetch = (input, init) => fetch(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(this.timeoutMs) });
     const sol = o.solana ?? (o.privateKey ? solanaKeyFromEvm(o.privateKey) : null);
     const solRpc = this.rpc.solana ?? `${this.baseUrl}/api/solana`;
@@ -599,7 +712,7 @@ var Wafermap = class {
     this.queue = prev.then(() => held);
     return prev.then(() => release);
   }
-  async paidFetch(kind, what, url, init, network) {
+  async paidFetch(kind, what, url, init, network, payIn) {
     let id = null;
     let release = null;
     const unlock = () => {
@@ -612,9 +725,11 @@ var Wafermap = class {
         solana: this.solana ?? void 0,
         prefer: this.prefer(network),
         fetch: this.fetch,
+        payIn,
+        tokenPriceUsd: this.tokenPriceUsd,
         approve: async (req) => {
           release = await this.acquire();
-          await this.gate({ kind, what, usd: req.usd, network: req.chain.key, detail: `${req.chain.symbol} to ${req.payTo}` });
+          await this.gate({ kind, what, usd: req.usd, network: req.chain.key, detail: req.asset === WAFERMAP_TOKEN ? "in $WAFERMAP at 50% off, burned" : `${req.chain.symbol} to ${req.payTo}` });
         },
         onSigned: (s) => {
           id = this.booked(kind, what, s);
@@ -650,9 +765,33 @@ var Wafermap = class {
     this.passCache = encodePass(await makePass({ address: this.account.address, signMessage: (a) => this.account.signMessage(a) }));
     return this.passCache;
   }
+  // ---- Paying in $WAFERMAP (Permit2; the tokens are burned) ----
+  /** Whether this wallet has approved Permit2 to move its $WAFERMAP (needed once before paying in $WAFERMAP). */
+  async wafermapApproved() {
+    const a = await this.client("robinhood").readContract({ address: WAFERMAP_TOKEN, abi: erc20Abi2, functionName: "allowance", args: [this.address, PERMIT2] });
+    return a >= 10n ** 30n;
+  }
+  /** Approves Permit2 (Uniswap's, at its canonical address) to move this wallet's $WAFERMAP: one on-chain
+   *  transaction on Robinhood Chain, paid in ETH. Each payment after that is a signature for one exact amount,
+   *  spendable only by Wafermap's relayer for two minutes. */
+  async approveWafermap() {
+    const wallet = createWalletClient({ account: this.account, chain: CHAINS.robinhood, transport: http(this.rpc.robinhood) });
+    try {
+      const tx = await wallet.writeContract({ address: WAFERMAP_TOKEN, abi: erc20Abi2, functionName: "approve", args: [PERMIT2, 2n ** 256n - 1n] });
+      const rc = await this.client("robinhood").waitForTransactionReceipt({ hash: tx, timeout: 6e4 });
+      if (rc.status !== "success") throw new WafermapError("approve_failed", `The approval reverted: ${tx}`);
+      return tx;
+    } catch (e) {
+      if (e instanceof WafermapError) throw e;
+      throw new WafermapError("approve_failed", e?.shortMessage ?? e?.message ?? "The approval failed.");
+    }
+  }
   async call(id, input = {}, o = {}) {
+    const inToken = o.payIn === "wafermap";
+    if (inToken && id.startsWith("m/")) throw new WafermapError("token_not_offered", "Marketplace listings are paid in USDG or USDC to their seller, not in $WAFERMAP.");
+    if (inToken && !await this.wafermapApproved().catch(() => true)) throw new WafermapError("permit2_not_approved", "Paying in $WAFERMAP needs a one-time approval of Permit2. Run `wafermap approve-wafermap` (one transaction on Robinhood Chain, paid in ETH), then call again.");
     const pass = id.startsWith("m/") ? null : await this.holderPass();
-    const go = () => this.paidFetch("resource", id, `${this.baseUrl}/v1/${id}`, { method: "POST", headers: { "content-type": "application/json", "x-wafermap-payer": this.address, ...pass ? { [PASS_HEADER]: pass } : {} }, body: JSON.stringify(input) }, o.network);
+    const go = () => this.paidFetch("resource", id, `${this.baseUrl}/v1/${id}`, { method: "POST", headers: { "content-type": "application/json", "x-wafermap-payer": this.address, ...pass ? { [PASS_HEADER]: pass } : {} }, body: JSON.stringify(input) }, o.network, inToken ? "wafermap" : void 0);
     const settle = (r2, out2) => {
       if (!r2.paid || !r2.id) return;
       const status = r2.res.status === 402 ? "refused" : r2.res.ok ? "ok" : "failed";
@@ -768,7 +907,10 @@ export {
   MAX_VALIDITY_SECONDS,
   PASS_HEADER,
   PAY_CHAINS,
+  PERMIT2,
   SwapError,
+  WAFERMAP_RELAYERS,
+  WAFERMAP_TOKEN,
   Wafermap,
   WafermapError,
   X402Error,
@@ -786,5 +928,7 @@ export {
   quoteSwap,
   readQuote,
   signPayment,
+  signTokenPayment,
+  wafermapPriceUsd,
   x402fetch
 };

package/dist/types/shared/x402client.d.ts

@@ -56,7 +56,30 @@ export type Quote = {
         code: string;
         message: string;
     };
+    token?: TokenRequirement;
 };
+export declare const WAFERMAP_TOKEN = "0xfda080f64d84c989cfc50ff18253542cfe502db3";
+export declare const PERMIT2 = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+export declare const DEAD = "0x000000000000000000000000000000000000dEaD";
+export declare const TOKEN_SCHEME = "wafermap-permit2";
+/** Wafermap's relayer wallets, the only spenders this client signs a $WAFERMAP permit for. Empty: paying in
+ *  $WAFERMAP is off in this build. A new relayer address ships as a new client release. */
+export declare const WAFERMAP_RELAYERS: string[];
+/** $WAFERMAP in USD, read by the client itself from GeckoTerminal. Throws when it cannot be read. */
+export declare function wafermapPriceUsd(f?: typeof fetch): Promise<number>;
+export type TokenRequirement = {
+    amount: string;
+    usd: number;
+    spender: Hex;
+    maxTimeoutSeconds: number;
+    raw: any;
+};
+/** Signs a Permit2 transfer of exactly the quoted $WAFERMAP to Wafermap's relayer, valid for at most 120 s. */
+export declare function signTokenPayment(signer: Signer, t: TokenRequirement, resource: any): Promise<{
+    name: string;
+    value: string;
+    deadline: number;
+}>;
 export declare class X402Error extends Error {
     code: string;
     constructor(code: string, message: string);
@@ -92,6 +115,9 @@ export type Signed = {
     req: Requirement;
     from: string;
     auth?: SignedAuth;
+    token?: {
+        amount: string;
+    };
 };
 export type PaidCall = {
     res: Response;
@@ -113,4 +139,6 @@ export declare function x402fetch(url: string, init: RequestInit, opts: {
     approve?: (req: Requirement) => Promise<void> | void;
     onSigned?: (s: Signed) => void;
     fetch?: typeof fetch;
+    payIn?: "stablecoin" | "wafermap";
+    tokenPriceUsd?: () => Promise<number>;
 }): Promise<PaidCall>;

package/dist/types/src/core.d.ts

@@ -71,6 +71,9 @@ export type WafermapOptions = {
     /** Give up on any HTTP request (quote, paid call, discovery, swap API) after this long. Default 60000 ms.
      *  A paid call that times out after signing stays counted until its authorization expires. */
     timeoutMs?: number;
+    /** Where the $WAFERMAP price comes from when paying in $WAFERMAP (default: GeckoTerminal, read by this client).
+     *  The signed amount is valued at this price and refused when it is worth more than the quote states. */
+    tokenPriceUsd?: () => Promise<number>;
 };
 export declare class WafermapError extends Error {
     code: string;
@@ -81,10 +84,16 @@ export declare function mergeLog(entries: SpendEntry[]): SpendEntry[];
 /**
  * Was a signed payment ever executed? Reads the token contract (EIP-3009 authorizationState),
  * so the answer does not depend on any server and needs no key. "unused" after expiry means it
- * can never be charged. Solana payments and old log lines without a nonce come back "unknown"; an RPC
- * failure comes back "error".
+ * can never be charged. authorizationState is also true after cancelAuthorization, so a true is
+ * confirmed by the AuthorizationUsed event: first in the receipt of the transaction the server
+ * named, else in the blocks between signing and expiry, the only time it could have executed.
+ * None there means the nonce was cancelled, never executed ("cancelled"). Solana payments and old
+ * log lines without a nonce come back "unknown"; an RPC failure comes back "error".
  */
-export declare function checkPayment(e: Pick<SpendEntry, "network" | "payer" | "nonce" | "validBefore">, rpc?: string): Promise<"used" | "unused" | "pending" | "unknown" | "error">;
+export declare function checkPayment(e: Pick<SpendEntry, "network" | "payer" | "nonce" | "validBefore"> & {
+    at?: number;
+    tx?: string | null;
+}, rpc?: string): Promise<"used" | "cancelled" | "unused" | "pending" | "unknown" | "error">;
 export declare const DEFAULT_LIMITS: Limits;
 export declare const DEFAULT_TIMEOUT_MS = 60000;
 /** What a wallet's $WAFERMAP unlocks (holder price, Pro free calls left today), from /api/holder. Needs no key. */
@@ -105,6 +114,7 @@ export declare class Wafermap {
     readonly timeoutMs: number;
     /** fetch with this wallet's time limit: a server that never answers cannot hold a call forever. */
     readonly fetch: typeof fetch;
+    private readonly tokenPriceUsd?;
     constructor(o: WafermapOptions);
     get address(): `0x${string}`;
     client(n: EvmNet): PublicClient;
@@ -133,8 +143,15 @@ export declare class Wafermap {
      *  proves the wallet to Wafermap for what its $WAFERMAP unlocks (Pro free calls, x402 Tracker Pro). Signing
      *  a message moves no funds. */
     holderPass(): Promise<string>;
+    /** Whether this wallet has approved Permit2 to move its $WAFERMAP (needed once before paying in $WAFERMAP). */
+    wafermapApproved(): Promise<boolean>;
+    /** Approves Permit2 (Uniswap's, at its canonical address) to move this wallet's $WAFERMAP: one on-chain
+     *  transaction on Robinhood Chain, paid in ETH. Each payment after that is a signature for one exact amount,
+     *  spendable only by Wafermap's relayer for two minutes. */
+    approveWafermap(): Promise<string>;
     call(id: string, input?: Record<string, unknown>, o?: {
         network?: Net;
+        payIn?: "stablecoin" | "wafermap";
     }): Promise<{
         resource: string;
         result: any;
@@ -142,6 +159,8 @@ export declare class Wafermap {
             network: string;
             asset: string;
             amountUsd: number;
+            amountTokens?: number;
+            burned?: boolean;
             payer: string;
             tx: string;
             ms: number;

package/dist/types/src/index.d.ts

@@ -1,6 +1,6 @@
 export { Wafermap, WafermapError, DEFAULT_LIMITS, DEFAULT_TIMEOUT_MS, checkPayment, holderInfo, listResources, mergeLog } from "./core.js";
 export { PASS_HEADER, passMessage, encodePass, decodePass, makePass } from "../shared/pass";
 export type { Approval, Limits, Net, PaymentStatus, SpendEntry, SwapQuote, Token, WafermapOptions } from "./core.js";
-export { x402fetch, readQuote, choose, signPayment, PAY_CHAINS, MAX_VALIDITY_SECONDS, X402Error } from "../shared/x402client";
+export { x402fetch, readQuote, choose, signPayment, signTokenPayment, wafermapPriceUsd, PAY_CHAINS, MAX_VALIDITY_SECONDS, WAFERMAP_RELAYERS, WAFERMAP_TOKEN, PERMIT2, X402Error } from "../shared/x402client";
 export { quoteSwap, executeSwap, decodeSwap, KYBER_ROUTER, SwapError } from "../shared/swap";
 export type { Requirement, Quote, Signed, SignedAuth, Signer } from "../shared/x402client";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wafermapxyz/cli",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Wafermap for agents: an encrypted local wallet that pays x402 resources, discovers and pays third-party x402 services (USDG on Robinhood Chain; USDC on Solana, Base, Arbitrum, Polygon), and swaps on Robinhood Chain and Base. CLI, SDK and MCP server.",
   "type": "module",
   "bin": {