@wafermapxyz/cli 0.4.5 → 0.4.6

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.4.6 (3 Nov 2026)
+
+**`history --verify` tells an executed payment from a cancelled one.** Thank you @GBLIN_Protocol for the catch.
+
+- EIP-3009 `authorizationState` is true both after a payment is executed and after its nonce is cancelled (`cancelAuthorization`), so a cancelled nonce used to read as `used`. The wallet never cancels on its own, but a nonce cancelled by hand would have been shown as paid.
+- A `true` is now confirmed by the token contract's `AuthorizationUsed` event for that payer and nonce: first in the receipt of the settlement transaction the server named, otherwise in the blocks between signing and expiry, the only time the payment could have executed. Found: `used`. Not found: `cancelled` (spent nonce, no transfer). If the RPC cannot answer, the result is `error`, never a guess. Base's public RPC refuses log searches, so a Base payment with no settlement transaction on record needs `WAFERMAP_RPC_BASE` set to another RPC.
+- `history --verify` checks four payments at a time instead of all at once, so public RPCs stop refusing long histories.
+- SDK: `checkPayment()` returns the new `"cancelled"` state and takes the entry's `at` and `tx` when given.
+
 ## 0.4.5 (2 Nov 2026)
 
 **Pay Wafermap in $WAFERMAP, at 50% off. The tokens are burned.**

package/README.md

@@ -94,7 +94,7 @@ The caps sit with the key, on your machine. Before the wallet signs anything it
 
 **The daily cap counts what the wallet signed, not what a server says it charged.** Every payment is written to `spend.jsonl` at its full signed amount the moment it is signed, before it is sent, and stays counted whatever the server answers: an error, a receipt saying $0, no receipt, or no answer at all. Check, sign and record run one payment at a time within a process, so calls started together cannot share the same remaining budget. Across processes on the same wallet (two MCP clients, or the CLI next to the MCP server), the wallet re-reads the shared log right after recording a signed payment and, if the cap is now passed, drops that payment before it is sent. (Before 0.3.3 the cap trusted the server's receipt; see [CHANGELOG.md](CHANGELOG.md).)
 
-**What the wallet cannot enforce.** An x402 `exact` payment is a signed authorization (EIP-3009 on EVM chains, a partially signed transaction on Solana). Whoever receives it can execute it once until it expires. The wallet signs EVM authorizations for at most 90 seconds, or less when the server asks for less (300 before 0.4.0). "A failed call costs $0" is therefore a promise of the server you pay: Wafermap's server settles only after the resource worked and otherwise lets the authorization expire unused. You do not have to take that on trust: `wafermap history --verify` asks each token contract (`authorizationState`) whether every signed payment was executed, and shows the ones that expired unused (`error` means the RPC did not answer). Solana payments are not checked yet. The caps bound the worst case either way.
+**What the wallet cannot enforce.** An x402 `exact` payment is a signed authorization (EIP-3009 on EVM chains, a partially signed transaction on Solana). Whoever receives it can execute it once until it expires. The wallet signs EVM authorizations for at most 90 seconds, or less when the server asks for less (300 before 0.4.0). "A failed call costs $0" is therefore a promise of the server you pay: Wafermap's server settles only after the resource worked and otherwise lets the authorization expire unused. You do not have to take that on trust: `wafermap history --verify` asks each token contract (`authorizationState`) whether every signed payment was executed, and shows the ones that expired unused (`error` means the RPC did not answer). Because `authorizationState` is also true after `cancelAuthorization`, a payment only shows as `used` once the contract's `AuthorizationUsed` event for that nonce is found (in the settlement transaction, or in the blocks between signing and expiry); a nonce that is spent but never executed shows as `cancelled`. The search needs `eth_getLogs`, which Base's public RPC refuses; set `WAFERMAP_RPC_BASE` to your own RPC if a Base payment without a transaction on record shows `error`. Solana payments are not checked yet. The caps bound the worst case either way.
 
 **Time limits.** Requests to paid resources and services, to Wafermap's API, to the swap API and to Solana RPC give up after 60 seconds (`timeoutMs` in the SDK); EVM RPC calls keep viem's own time-outs. `wafermap resources` uses the same limit. Set `WAFERMAP_TIMEOUT_MS` to change it for the CLI and the MCP server. A paid call that times out after the payment was signed says so: the payment stays counted, and for EVM payments the message says until when it can be executed.
 

package/dist/cli.js

@@ -560,7 +560,7 @@ __export(core_exports, {
   listResources: () => listResources,
   mergeLog: () => mergeLog
 });
-import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http } from "viem";
+import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http, pad, parseAbiItem, toEventSelector } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 import { arbitrum, base, polygon, robinhood } from "viem/chains";
 function mergeLog(entries) {
@@ -571,14 +571,56 @@ function mergeLog(entries) {
     return { ...e, status: o.status, tx: o.tx ?? e.tx, reported: o.reported ?? null, ...o.status === "aborted" ? { usd: 0 } : {} };
   });
 }
+async function blockAt(client, ts, side, latest) {
+  if (ts >= Number(latest.timestamp)) return latest.number;
+  let hi = latest;
+  let lo = await client.getBlock({ blockNumber: latest.number > 100000n ? latest.number - 100000n : 0n });
+  while (Number(lo.timestamp) > ts && lo.number > 0n) {
+    const back = (hi.number - lo.number) * 4n;
+    hi = lo;
+    lo = await client.getBlock({ blockNumber: lo.number > back ? lo.number - back : 0n });
+  }
+  for (let i = 0; i < 20 && hi.number - lo.number > 20n; i++) {
+    const span = Number(hi.timestamp - lo.timestamp) || 1;
+    let guess = lo.number + BigInt(Math.floor(Number(hi.number - lo.number) * (ts - Number(lo.timestamp)) / span));
+    if (guess <= lo.number) guess = lo.number + 1n;
+    if (guess >= hi.number) guess = hi.number - 1n;
+    const b = await client.getBlock({ blockNumber: guess });
+    if (Number(b.timestamp) <= ts) lo = b;
+    else hi = b;
+  }
+  return side === "from" ? lo.number : hi.number;
+}
 async function checkPayment(e, rpc) {
   if (e.network === "solana" || !e.nonce || !(e.network in CHAINS)) return "unknown";
   const chain = PAY_CHAINS.find((c) => c.key === e.network);
   try {
     const client = createPublicClient({ chain: CHAINS[e.network], transport: http(rpc) });
     const used = await client.readContract({ address: chain.stable, abi: AUTH_STATE_ABI, functionName: "authorizationState", args: [e.payer, e.nonce] });
-    if (used) return "used";
-    return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    if (!used) return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    const isOurs = (l) => l.address.toLowerCase() === chain.stable.toLowerCase() && l.topics[0] === toEventSelector(AUTH_USED) && l.topics[1]?.toLowerCase() === pad(e.payer).toLowerCase() && l.topics[2]?.toLowerCase() === e.nonce.toLowerCase();
+    if (e.tx && /^0x[0-9a-fA-F]{64}$/.test(e.tx)) {
+      const receipt = await client.getTransactionReceipt({ hash: e.tx }).catch(() => null);
+      if (receipt?.status === "success" && receipt.logs.some(isOurs)) return "used";
+    }
+    if (!e.validBefore || !e.at) return "error";
+    const latest = await client.getBlock();
+    const fromBlock = await blockAt(client, Math.floor(e.at / 1e3) - 60, "from", latest);
+    const toBlock = await blockAt(client, e.validBefore + 30, "to", latest);
+    for (let start = fromBlock; start <= toBlock; start += 50n) {
+      const end = start + 49n < toBlock ? start + 49n : toBlock;
+      for (let attempt = 0; ; attempt++) {
+        try {
+          const logs = await client.getLogs({ address: chain.stable, event: AUTH_USED, args: { authorizer: e.payer, nonce: e.nonce }, fromBlock: start, toBlock: end });
+          if (logs.length) return "used";
+          break;
+        } catch (err) {
+          if (attempt >= 3) throw err;
+          await new Promise((r) => setTimeout(r, 1500 * (attempt + 1)));
+        }
+      }
+    }
+    return "cancelled";
   } catch {
     return "error";
   }
@@ -606,7 +648,7 @@ async function listResources(baseUrl = "https://wafermap.xyz", timeoutMs = DEFAU
   if (!r.ok || !Array.isArray(j?.data)) throw new WafermapError("network_error", `${host} returned no catalog (HTTP ${r.status}).`);
   return j.data;
 }
-var NETS, isNet, isSwapNet, WafermapError, CHAINS, AUTH_STATE_ABI, DEFAULT_LIMITS, DEFAULT_TIMEOUT_MS, timedOut, Wafermap;
+var NETS, isNet, isSwapNet, WafermapError, CHAINS, AUTH_STATE_ABI, AUTH_USED, DEFAULT_LIMITS, DEFAULT_TIMEOUT_MS, timedOut, Wafermap;
 var init_core = __esm({
   "src/core.ts"() {
     "use strict";
@@ -626,6 +668,7 @@ var init_core = __esm({
     };
     CHAINS = { robinhood, base, arbitrum, polygon };
     AUTH_STATE_ABI = [{ type: "function", name: "authorizationState", stateMutability: "view", inputs: [{ name: "authorizer", type: "address" }, { name: "nonce", type: "bytes32" }], outputs: [{ type: "bool" }] }];
+    AUTH_USED = parseAbiItem("event AuthorizationUsed(address indexed authorizer, bytes32 indexed nonce)");
     DEFAULT_LIMITS = { perPayment: 0.1, perDay: 1, perSwap: 25 };
     DEFAULT_TIMEOUT_MS = 6e4;
     timedOut = (e) => e?.name === "TimeoutError" || e?.cause?.name === "TimeoutError";
@@ -1119,7 +1162,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "0.4.5";
+    VERSION = "0.4.6";
   }
 });
 
@@ -1870,7 +1913,16 @@ async function main() {
       if (!rows.length) return console.log(`Nothing in the last ${days} days.`);
       const verify = a.flags.verify !== void 0;
       const RPC = { robinhood: process.env.WAFERMAP_RPC_ROBINHOOD, base: process.env.WAFERMAP_RPC_BASE, arbitrum: process.env.WAFERMAP_RPC_ARBITRUM, polygon: process.env.WAFERMAP_RPC_POLYGON };
-      const chain = verify ? await Promise.all(rows.map((e) => e.kind === "swap" ? null : checkPayment(e, RPC[e.network]))) : [];
+      const chain = [];
+      if (verify) {
+        let next = 0;
+        await Promise.all(Array.from({ length: 4 }, async () => {
+          while (next < rows.length) {
+            const i = next++;
+            chain[i] = rows[i].kind === "swap" ? null : await checkPayment(rows[i], RPC[rows[i].network]);
+          }
+        }));
+      }
       rows.forEach((e, i) => {
         const state = [e.status, chain[i] ? `on-chain: ${chain[i]}` : null].filter(Boolean).join(", ");
         console.log(`${new Date(e.at).toISOString().slice(0, 16).replace("T", " ")}  ${e.kind.padEnd(8)}  ${e.kind === "swap" ? "      " : `$${e.usd}`.padEnd(8)}  ${e.network.padEnd(9)}  ${e.what}${state ? `  [${state}]` : ""}${e.tx ? `  ${EXPLORER(e.network)}/tx/${e.tx}` : ""}`);
@@ -1881,7 +1933,8 @@ async function main() {
 Total $${total.toFixed(4)} in ${pays.length} payments. From 0.3.3 every payment counts at its full signed amount; older lines show what the server reported.`);
       if (verify) {
         const never = rows.filter((e, i) => e.kind !== "swap" && chain[i] === "unused").reduce((s, e) => s + e.usd, 0);
-        console.log(`On-chain: $${never.toFixed(4)} of that was signed but never executed and has expired. "unknown" = Solana or an older log line; "error" = the RPC did not answer, try again.`);
+        const cancelled = rows.filter((e, i) => e.kind !== "swap" && chain[i] === "cancelled").reduce((s, e) => s + e.usd, 0);
+        console.log(`On-chain: $${never.toFixed(4)} of that was signed but never executed and has expired${cancelled ? `, and $${cancelled.toFixed(4)} was cancelled by this wallet before it executed` : ""}. "used" = the token contract logged the transfer (AuthorizationUsed); "cancelled" = the nonce is spent but never executed (cancelAuthorization); "unknown" = Solana or an older log line; "error" = the RPC did not answer, try again (Base's public RPC refuses log searches: for a payment with no transaction on record, set WAFERMAP_RPC_BASE to your own RPC).`);
       } else console.log("Add --verify to check on-chain which signed payments were executed.");
       return;
     }

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/core.ts
-import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http } from "viem";
+import { createPublicClient, createWalletClient, erc20Abi as erc20Abi2, formatUnits as formatUnits2, http, pad, parseAbiItem, toEventSelector } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 import { arbitrum, base, polygon, robinhood } from "viem/chains";
 
@@ -530,14 +530,57 @@ function mergeLog(entries) {
     return { ...e, status: o.status, tx: o.tx ?? e.tx, reported: o.reported ?? null, ...o.status === "aborted" ? { usd: 0 } : {} };
   });
 }
+async function blockAt(client, ts, side, latest) {
+  if (ts >= Number(latest.timestamp)) return latest.number;
+  let hi = latest;
+  let lo = await client.getBlock({ blockNumber: latest.number > 100000n ? latest.number - 100000n : 0n });
+  while (Number(lo.timestamp) > ts && lo.number > 0n) {
+    const back = (hi.number - lo.number) * 4n;
+    hi = lo;
+    lo = await client.getBlock({ blockNumber: lo.number > back ? lo.number - back : 0n });
+  }
+  for (let i = 0; i < 20 && hi.number - lo.number > 20n; i++) {
+    const span = Number(hi.timestamp - lo.timestamp) || 1;
+    let guess = lo.number + BigInt(Math.floor(Number(hi.number - lo.number) * (ts - Number(lo.timestamp)) / span));
+    if (guess <= lo.number) guess = lo.number + 1n;
+    if (guess >= hi.number) guess = hi.number - 1n;
+    const b = await client.getBlock({ blockNumber: guess });
+    if (Number(b.timestamp) <= ts) lo = b;
+    else hi = b;
+  }
+  return side === "from" ? lo.number : hi.number;
+}
+var AUTH_USED = parseAbiItem("event AuthorizationUsed(address indexed authorizer, bytes32 indexed nonce)");
 async function checkPayment(e, rpc) {
   if (e.network === "solana" || !e.nonce || !(e.network in CHAINS)) return "unknown";
   const chain = PAY_CHAINS.find((c) => c.key === e.network);
   try {
     const client = createPublicClient({ chain: CHAINS[e.network], transport: http(rpc) });
     const used = await client.readContract({ address: chain.stable, abi: AUTH_STATE_ABI, functionName: "authorizationState", args: [e.payer, e.nonce] });
-    if (used) return "used";
-    return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    if (!used) return e.validBefore && Date.now() / 1e3 > e.validBefore ? "unused" : "pending";
+    const isOurs = (l) => l.address.toLowerCase() === chain.stable.toLowerCase() && l.topics[0] === toEventSelector(AUTH_USED) && l.topics[1]?.toLowerCase() === pad(e.payer).toLowerCase() && l.topics[2]?.toLowerCase() === e.nonce.toLowerCase();
+    if (e.tx && /^0x[0-9a-fA-F]{64}$/.test(e.tx)) {
+      const receipt = await client.getTransactionReceipt({ hash: e.tx }).catch(() => null);
+      if (receipt?.status === "success" && receipt.logs.some(isOurs)) return "used";
+    }
+    if (!e.validBefore || !e.at) return "error";
+    const latest = await client.getBlock();
+    const fromBlock = await blockAt(client, Math.floor(e.at / 1e3) - 60, "from", latest);
+    const toBlock = await blockAt(client, e.validBefore + 30, "to", latest);
+    for (let start = fromBlock; start <= toBlock; start += 50n) {
+      const end = start + 49n < toBlock ? start + 49n : toBlock;
+      for (let attempt = 0; ; attempt++) {
+        try {
+          const logs = await client.getLogs({ address: chain.stable, event: AUTH_USED, args: { authorizer: e.payer, nonce: e.nonce }, fromBlock: start, toBlock: end });
+          if (logs.length) return "used";
+          break;
+        } catch (err) {
+          if (attempt >= 3) throw err;
+          await new Promise((r) => setTimeout(r, 1500 * (attempt + 1)));
+        }
+      }
+    }
+    return "cancelled";
   } catch {
     return "error";
   }

package/dist/types/src/core.d.ts

@@ -84,10 +84,16 @@ export declare function mergeLog(entries: SpendEntry[]): SpendEntry[];
 /**
  * Was a signed payment ever executed? Reads the token contract (EIP-3009 authorizationState),
  * so the answer does not depend on any server and needs no key. "unused" after expiry means it
- * can never be charged. Solana payments and old log lines without a nonce come back "unknown"; an RPC
- * failure comes back "error".
+ * can never be charged. authorizationState is also true after cancelAuthorization, so a true is
+ * confirmed by the AuthorizationUsed event: first in the receipt of the transaction the server
+ * named, else in the blocks between signing and expiry, the only time it could have executed.
+ * None there means the nonce was cancelled, never executed ("cancelled"). Solana payments and old
+ * log lines without a nonce come back "unknown"; an RPC failure comes back "error".
  */
-export declare function checkPayment(e: Pick<SpendEntry, "network" | "payer" | "nonce" | "validBefore">, rpc?: string): Promise<"used" | "unused" | "pending" | "unknown" | "error">;
+export declare function checkPayment(e: Pick<SpendEntry, "network" | "payer" | "nonce" | "validBefore"> & {
+    at?: number;
+    tx?: string | null;
+}, rpc?: string): Promise<"used" | "cancelled" | "unused" | "pending" | "unknown" | "error">;
 export declare const DEFAULT_LIMITS: Limits;
 export declare const DEFAULT_TIMEOUT_MS = 60000;
 /** What a wallet's $WAFERMAP unlocks (holder price, Pro free calls left today), from /api/holder. Needs no key. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wafermapxyz/cli",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Wafermap for agents: an encrypted local wallet that pays x402 resources, discovers and pays third-party x402 services (USDG on Robinhood Chain; USDC on Solana, Base, Arbitrum, Polygon), and swaps on Robinhood Chain and Base. CLI, SDK and MCP server.",
   "type": "module",
   "bin": {