@weftlabs/sdk 0.25.0

package/dist/server.js

@@ -0,0 +1,1587 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  MAX_EXTENSION_BYTES: () => MAX_EXTENSION_BYTES,
+  WEFT_API_KEY_HEADER: () => WEFT_API_KEY_HEADER,
+  WEFT_DECLARED_HEADER: () => WEFT_DECLARED_HEADER,
+  WEFT_PRODUCT_EXTENSION_KEY: () => WEFT_PRODUCT_EXTENSION_KEY,
+  WEFT_PRODUCT_INFO_SCHEMA: () => WEFT_PRODUCT_INFO_SCHEMA,
+  WEFT_REQUEST_EXTENSION_KEY: () => WEFT_REQUEST_EXTENSION_KEY,
+  WEFT_REQUEST_INFO_SCHEMA: () => WEFT_REQUEST_INFO_SCHEMA,
+  WEFT_TYPE_TAG_PREFIX: () => WEFT_TYPE_TAG_PREFIX,
+  X402_FACILITATOR_URL: () => X402_FACILITATOR_URL,
+  applyProductIdentity: () => applyProductIdentity,
+  createFacilitatorClient: () => createFacilitatorClient,
+  getFeeInfo: () => getFeeInfo,
+  invalidateFeeCache: () => invalidateFeeCache,
+  productTypeTag: () => productTypeTag,
+  registerDynamicExtensions: () => registerDynamicExtensions,
+  weftPaymentMiddleware: () => weftPaymentMiddleware,
+  weftPaymentMiddlewareHono: () => weftPaymentMiddlewareHono
+});
+module.exports = __toCommonJS(server_exports);
+__reExport(server_exports, require("@x402/core/server"), module.exports);
+
+// src/facilitator/index.ts
+var facilitator_exports = {};
+__export(facilitator_exports, {
+  X402_FACILITATOR_URL: () => X402_FACILITATOR_URL,
+  createFacilitatorClient: () => createFacilitatorClient,
+  getFeeInfo: () => getFeeInfo,
+  invalidateFeeCache: () => invalidateFeeCache
+});
+__reExport(facilitator_exports, require("@x402/core"));
+__reExport(facilitator_exports, require("@x402/core/types"));
+
+// src/facilitator/client.ts
+var import_server = require("@x402/core/server");
+var FACILITATOR_UNAVAILABLE_ERROR = "weft:facilitator-settle-unavailable";
+var X402_FACILITATOR_URL = "https://x402.weft.network";
+var X402_FACILITATOR_URL_ENV = "X402_FACILITATOR_URL";
+var FacilitatorUnavailableError = class extends Error {
+  constructor() {
+    super(FACILITATOR_UNAVAILABLE_ERROR);
+    this.statusCode = 503;
+    this.name = "FacilitatorUnavailableError";
+  }
+};
+function isUnavailableSettleError(error) {
+  if (!(error instanceof Error)) return false;
+  const candidate = error;
+  return candidate.name === "SettleError" && candidate.statusCode === 503 && "errorReason" in candidate && "errorMessage" in candidate && "payer" in candidate && "transaction" in candidate && "network" in candidate && !(candidate.errorReason === "settlement_pending" && candidate.transaction);
+}
+var WeftHTTPFacilitatorClient = class extends import_server.HTTPFacilitatorClient {
+  async settle(paymentPayload, paymentRequirements) {
+    try {
+      return await super.settle(paymentPayload, paymentRequirements);
+    } catch (error) {
+      if (isUnavailableSettleError(error)) {
+        throw new FacilitatorUnavailableError();
+      }
+      throw error;
+    }
+  }
+};
+function validateUrl(url) {
+  if (!url || url.trim() === "") {
+    throw new Error("Invalid URL: URL cannot be empty");
+  }
+  if (!url.startsWith("http://") && !url.startsWith("https://")) {
+    throw new Error(
+      `Invalid URL format: URL must start with http:// or https://, got: ${url}`
+    );
+  }
+}
+function resolveUrl(config) {
+  if (config?.url) {
+    return config.url;
+  }
+  if (typeof process !== "undefined" && process.env?.[X402_FACILITATOR_URL_ENV]) {
+    return process.env[X402_FACILITATOR_URL_ENV];
+  }
+  return X402_FACILITATOR_URL;
+}
+function assertPathKeyedAuthHeaders(headers) {
+  const isHeaderObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+  const hasPathKey = ["verify", "settle", "supported", "bazaar"].some(
+    (key) => isHeaderObject(headers[key])
+  );
+  const looksFlat = !hasPathKey && Object.values(headers).some((value) => !isHeaderObject(value));
+  if (looksFlat) {
+    throw new Error(
+      'createAuthHeaders must return an object keyed by facilitator path, e.g. { verify: { Authorization: "..." }, settle: { ... }, supported: { ... } }, but received a flat headers object.'
+    );
+  }
+}
+function mergeSellerWins(derived, seller) {
+  const merged = { ...derived };
+  for (const [name, value] of Object.entries(seller ?? {})) {
+    for (const existing of Object.keys(merged)) {
+      if (existing.toLowerCase() === name.toLowerCase()) {
+        delete merged[existing];
+      }
+    }
+    merged[name] = value;
+  }
+  return merged;
+}
+function createFacilitatorClient(config, weftAuthHeaders) {
+  const url = resolveUrl(config);
+  validateUrl(url);
+  const sellerCreateAuthHeaders = config?.createAuthHeaders;
+  const derivedByPath = Object.entries(weftAuthHeaders ?? {}).filter(
+    ([, headers]) => headers !== void 0 && Object.keys(headers).length > 0
+  );
+  const createAuthHeaders = derivedByPath.length > 0 ? async () => {
+    const sellerHeaders = sellerCreateAuthHeaders ? await sellerCreateAuthHeaders() : void 0;
+    if (sellerHeaders) {
+      assertPathKeyedAuthHeaders(sellerHeaders);
+    }
+    const merged = { ...sellerHeaders };
+    for (const [path, derived] of derivedByPath) {
+      merged[path] = mergeSellerWins(derived, sellerHeaders?.[path]);
+    }
+    return merged;
+  } : sellerCreateAuthHeaders;
+  return new WeftHTTPFacilitatorClient({
+    url,
+    createAuthHeaders
+  });
+}
+
+// src/facilitator/fee.ts
+var DEFAULT_CACHE_TTL = 5 * 60 * 1e3;
+var feeCache = null;
+function invalidateFeeCache() {
+  feeCache = null;
+}
+function isCacheValid() {
+  if (!feeCache) return false;
+  const now = Date.now();
+  return now - feeCache.fetchedAt < feeCache.ttl;
+}
+async function getFeeInfo(config, cacheConfig) {
+  if (isCacheValid() && feeCache) {
+    return feeCache.feeInfo;
+  }
+  const client = createFacilitatorClient(config);
+  const supported = await client.getSupported();
+  const fee = supported.fee;
+  if (!fee) {
+    throw new Error("Fee information not found in /supported response");
+  }
+  if (typeof fee.amount !== "string") {
+    throw new Error("Invalid fee structure: amount must be a string");
+  }
+  if (typeof fee.asset !== "string") {
+    throw new Error("Invalid fee structure: asset must be a string");
+  }
+  if (typeof fee.network !== "string") {
+    throw new Error("Invalid fee structure: network must be a string");
+  }
+  const feeInfo = {
+    amount: fee.amount,
+    asset: fee.asset,
+    network: fee.network
+  };
+  feeCache = {
+    feeInfo,
+    fetchedAt: Date.now(),
+    ttl: cacheConfig?.ttl ?? DEFAULT_CACHE_TTL
+  };
+  return feeInfo;
+}
+
+// src/facilitator/middleware/express.ts
+var import_server2 = require("@x402/core/server");
+
+// package.json
+var version = "0.25.0";
+
+// src/facilitator/middleware/product.ts
+var PRODUCT_TYPES = ["api", "agent", "mcp"];
+var WEFT_TYPE_TAG_PREFIX = "weft:type:";
+var MAX_TAGS = 5;
+var MAX_TAG_CHARS = 32;
+var MAX_DIMENSIONS = 8;
+var MAX_DIMENSION_CHARS = 64;
+var DIMENSION_NAME = /^[A-Za-z_][A-Za-z0-9_.-]*$/;
+var MAX_SERVICE_NAME_CHARS = 32;
+var MAX_ICON_URL_CHARS = 2048;
+var PRINTABLE_ASCII = /^[\x20-\x7e]+$/;
+var WEFT_PRODUCT_EXTENSION_KEY = "weft.product";
+var WEFT_PRODUCT_INFO_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  type: "object",
+  properties: {
+    kind: { type: "string", enum: [...PRODUCT_TYPES] },
+    product_id: { type: "string", minLength: 1 },
+    manifest_hash: { type: "string", minLength: 1 }
+  },
+  additionalProperties: false
+};
+function productTypeTag(type) {
+  return `${WEFT_TYPE_TAG_PREFIX}${type}`;
+}
+function isDeclared(value) {
+  return value !== void 0 && value !== null;
+}
+function typeName(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (Array.isArray(value)) {
+    return "an array";
+  }
+  return `a ${typeof value}`;
+}
+function show(value) {
+  try {
+    return JSON.stringify(value) ?? String(value);
+  } catch {
+    return typeName(value);
+  }
+}
+function isSingleRoute(routes) {
+  return "accepts" in routes;
+}
+function createWarn() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message, dedupeKey) => {
+    const key = dedupeKey ?? message;
+    if (seen.has(key)) {
+      return;
+    }
+    seen.add(key);
+    console.warn(`[weft] ${message}`);
+  };
+}
+function asString(field, value, warn) {
+  if (!isDeclared(value)) {
+    return void 0;
+  }
+  if (typeof value !== "string") {
+    warn(
+      `ignoring ${field} ${show(value)}: expected a string, got ${typeName(value)}`
+    );
+    return void 0;
+  }
+  return value;
+}
+function isReservedTypeTag(tag) {
+  return tag.trim().toLowerCase().startsWith(WEFT_TYPE_TAG_PREFIX);
+}
+function resolveType(value, field, warn) {
+  if (!isDeclared(value)) {
+    return void 0;
+  }
+  if (typeof value !== "string" || !PRODUCT_TYPES.includes(value)) {
+    warn(
+      `ignoring ${field} ${show(value)}: expected one of ${PRODUCT_TYPES.join(", ")}`
+    );
+    return void 0;
+  }
+  return value;
+}
+function asTagList(value, field, warn) {
+  if (!isDeclared(value)) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    warn(
+      `ignoring ${field} ${show(value)}: expected an array of strings, got ${typeName(value)}`
+    );
+    return void 0;
+  }
+  return value.filter((entry) => {
+    if (typeof entry === "string") {
+      return true;
+    }
+    warn(
+      `dropping tag ${show(entry)}: expected a string, got ${typeName(entry)}`
+    );
+    return false;
+  });
+}
+function resolveTags(routeTags, identityTags, type, warn) {
+  const declared = asTagList(routeTags, "route tags", warn) ?? asTagList(identityTags, "tags", warn);
+  if (declared === void 0 && type === void 0) {
+    return void 0;
+  }
+  const sellerTags = (declared ?? []).filter((tag) => {
+    if (!isReservedTypeTag(tag)) {
+      return true;
+    }
+    warn(
+      `dropping reserved tag ${show(tag)}: declare the product kind with \`type\` (${PRODUCT_TYPES.join(", ")}) on the middleware config or on the route`
+    );
+    return false;
+  });
+  const malformed = [];
+  const carried = [
+    ...type !== void 0 ? [productTypeTag(type)] : [],
+    ...sellerTags
+  ].filter((tag) => {
+    if (tag.length <= MAX_TAG_CHARS && PRINTABLE_ASCII.test(tag)) {
+      return true;
+    }
+    malformed.push(tag);
+    return false;
+  });
+  if (malformed.length > 0) {
+    warn(
+      `dropping ${malformed.length} tag(s) the x402 protocol cannot carry (max ${MAX_TAG_CHARS} printable-ASCII characters each): ${malformed.join(", ")}`
+    );
+  }
+  const deduped = [...new Set(carried)];
+  if (deduped.length > MAX_TAGS) {
+    const dropped = deduped.slice(MAX_TAGS);
+    warn(
+      `dropping ${dropped.length} tag(s): the x402 protocol carries ${MAX_TAGS}` + (type !== void 0 ? " and the declared type uses one of them" : "") + `. Dropped: ${dropped.join(", ")}`
+    );
+  }
+  const bounded = deduped.slice(0, MAX_TAGS);
+  return bounded.length > 0 ? bounded : void 0;
+}
+function resolveServiceName(routeServiceName, identityName, warn) {
+  const declared = asString("route serviceName", routeServiceName, warn) ?? asString("name", identityName, warn);
+  if (declared === void 0) {
+    return void 0;
+  }
+  if (!PRINTABLE_ASCII.test(declared)) {
+    warn(
+      `dropping product name ${show(declared)}: the x402 protocol carries 1-${MAX_SERVICE_NAME_CHARS} printable-ASCII characters (U+0020-U+007E)`
+    );
+    return void 0;
+  }
+  if (declared.length > MAX_SERVICE_NAME_CHARS) {
+    const truncated = declared.slice(0, MAX_SERVICE_NAME_CHARS);
+    warn(
+      `product name ${show(declared)} is ${declared.length} characters; the x402 protocol carries ${MAX_SERVICE_NAME_CHARS}, so it travels as ${show(truncated)}`
+    );
+    return truncated;
+  }
+  return declared;
+}
+function resolveIconUrl(routeIconUrl, identityIconUrl, warn) {
+  const declared = asString("route iconUrl", routeIconUrl, warn) ?? asString("iconUrl", identityIconUrl, warn);
+  if (declared === void 0) {
+    return void 0;
+  }
+  if (declared.length > MAX_ICON_URL_CHARS) {
+    warn(
+      `dropping iconUrl: ${declared.length} characters exceeds the ${MAX_ICON_URL_CHARS} the x402 protocol carries`
+    );
+    return void 0;
+  }
+  let scheme;
+  try {
+    scheme = new URL(declared).protocol;
+  } catch {
+    warn(
+      `dropping iconUrl ${show(declared)}: expected an absolute http or https URL`
+    );
+    return void 0;
+  }
+  if (scheme !== "http:" && scheme !== "https:") {
+    warn(
+      `dropping iconUrl ${show(declared)}: only http and https are carried (a dashboard renders this URL)`
+    );
+    return void 0;
+  }
+  return declared;
+}
+function resolveDimensions(value, warn) {
+  const declared = asTagList(value, "dimensions", warn);
+  if (declared === void 0) {
+    return void 0;
+  }
+  const malformed = [];
+  const named = declared.filter((name) => {
+    if (name.length <= MAX_DIMENSION_CHARS && DIMENSION_NAME.test(name)) {
+      return true;
+    }
+    malformed.push(name);
+    return false;
+  });
+  if (malformed.length > 0) {
+    warn(
+      `dropping ${malformed.length} dimension(s) that do not name a field (max ${MAX_DIMENSION_CHARS} characters, starting with a letter or underscore): ${malformed.join(", ")}`
+    );
+  }
+  const deduped = [...new Set(named)];
+  if (deduped.length > MAX_DIMENSIONS) {
+    warn(
+      `dropping ${deduped.length - MAX_DIMENSIONS} dimension(s): at most ${MAX_DIMENSIONS} travel. Dropped: ${deduped.slice(MAX_DIMENSIONS).join(", ")}`
+    );
+  }
+  const bounded = deduped.slice(0, MAX_DIMENSIONS);
+  return bounded.length > 0 ? bounded : void 0;
+}
+function resolveOpaqueString(field, value, warn) {
+  const declared = asString(field, value, warn);
+  if (declared === void 0) {
+    return void 0;
+  }
+  const trimmed = declared.trim();
+  if (trimmed === "") {
+    warn(`ignoring empty ${field}`);
+    return void 0;
+  }
+  return trimmed;
+}
+function resolveProductExtensions(routeExtensions, type, declaration, warn) {
+  const productId = resolveOpaqueString(
+    "productId",
+    declaration.productId,
+    warn
+  );
+  const manifestHash = resolveOpaqueString(
+    "manifestHash",
+    declaration.manifestHash,
+    warn
+  );
+  const info = {
+    ...type !== void 0 && { kind: type },
+    ...productId !== void 0 && { product_id: productId },
+    ...manifestHash !== void 0 && { manifest_hash: manifestHash }
+  };
+  if (Object.keys(info).length === 0) {
+    return void 0;
+  }
+  if (routeExtensions !== void 0) {
+    if (typeof routeExtensions !== "object" || routeExtensions === null || Array.isArray(routeExtensions)) {
+      warn(
+        `route extensions ${show(routeExtensions)} are ${typeName(routeExtensions)}, not an object; leaving them untouched and skipping the ${WEFT_PRODUCT_EXTENSION_KEY} declaration for this route`
+      );
+      return void 0;
+    }
+    if (WEFT_PRODUCT_EXTENSION_KEY in routeExtensions) {
+      return void 0;
+    }
+  }
+  return {
+    ...routeExtensions,
+    [WEFT_PRODUCT_EXTENSION_KEY]: { info, schema: WEFT_PRODUCT_INFO_SCHEMA }
+  };
+}
+function applyToRoute(route, identity, warn) {
+  if (typeof route !== "object" || route === null) {
+    warn(
+      `ignoring route ${show(route)}: expected a route config object, got ${typeName(route)}`
+    );
+    return route;
+  }
+  const {
+    type: declaredType,
+    serviceName: declaredServiceName,
+    tags: declaredTags,
+    iconUrl: declaredIconUrl,
+    ...rest
+  } = route;
+  const type = resolveType(declaredType, "route type", warn) ?? resolveType(identity.type, "type", warn);
+  const serviceName = resolveServiceName(
+    declaredServiceName,
+    identity.name,
+    warn
+  );
+  const iconUrl = resolveIconUrl(declaredIconUrl, identity.iconUrl, warn);
+  const tags = resolveTags(declaredTags, identity.tags, type, warn);
+  const extensions = resolveProductExtensions(
+    rest.extensions,
+    type,
+    identity,
+    warn
+  );
+  return {
+    ...rest,
+    ...serviceName !== void 0 && { serviceName },
+    ...tags !== void 0 && { tags },
+    ...iconUrl !== void 0 && { iconUrl },
+    ...extensions !== void 0 && { extensions }
+  };
+}
+function hasProductIdentity(identity) {
+  return isDeclared(identity.name) || isDeclared(identity.type) || isDeclared(identity.tags) || isDeclared(identity.iconUrl) || isDeclared(identity.productId) || isDeclared(identity.manifestHash);
+}
+function hasRouteIdentity(routes) {
+  if (isSingleRoute(routes)) {
+    return isDeclared(routes.type);
+  }
+  return Object.values(routes).some((route) => isDeclared(route?.type));
+}
+function sanitizeProductIdentity(identity) {
+  const silent = () => void 0;
+  const type = resolveType(identity.type, "type", silent);
+  const name = resolveServiceName(void 0, identity.name, silent);
+  const iconUrl = resolveIconUrl(void 0, identity.iconUrl, silent);
+  const tags = resolveTags(void 0, identity.tags, type, silent)?.filter(
+    (tag) => !isReservedTypeTag(tag)
+  );
+  return {
+    ...name !== void 0 && { name },
+    ...type !== void 0 && { type },
+    ...tags !== void 0 && tags.length > 0 && { tags },
+    ...iconUrl !== void 0 && { iconUrl }
+  };
+}
+function applyProductIdentity(routes, identity) {
+  if (typeof routes !== "object" || routes === null) {
+    return routes;
+  }
+  if (!hasProductIdentity(identity) && !hasRouteIdentity(routes)) {
+    return routes;
+  }
+  const warn = createWarn();
+  if (isSingleRoute(routes)) {
+    return applyToRoute(routes, identity, warn);
+  }
+  return Object.fromEntries(
+    Object.entries(routes).map(([pattern, route]) => [
+      pattern,
+      applyToRoute(route, identity, warn)
+    ])
+  );
+}
+
+// src/facilitator/middleware/handshake.ts
+var WEFT_DECLARED_HEADER = "X-Weft-Declared";
+function base64UrlEncode(value) {
+  const bytes = new TextEncoder().encode(value);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function declaredIdentityValue(declaration) {
+  const declared = sanitizeProductIdentity(declaration);
+  const dimensions = resolveDimensions(declaration.dimensions, createWarn());
+  const payload = {
+    ...declared.name !== void 0 && { name: declared.name },
+    ...declared.type !== void 0 && { type: declared.type },
+    ...declared.tags !== void 0 && { tags: declared.tags },
+    ...declared.iconUrl !== void 0 && { icon_url: declared.iconUrl },
+    ...dimensions !== void 0 && { dimensions }
+  };
+  if (Object.keys(payload).length === 0) {
+    return void 0;
+  }
+  return base64UrlEncode(JSON.stringify(payload));
+}
+var HEADER_SAFE = /^[\x21-\x7e]+$/;
+function resolveApiKey(apiKey) {
+  if (apiKey === void 0 || apiKey === null) {
+    return void 0;
+  }
+  if (typeof apiKey !== "string") {
+    console.warn(
+      `[weft] ignoring apiKey: expected a string, got ${typeof apiKey}`
+    );
+    return void 0;
+  }
+  const trimmed = apiKey.trim();
+  if (trimmed === "") {
+    console.warn("[weft] ignoring empty apiKey");
+    return void 0;
+  }
+  if (!HEADER_SAFE.test(trimmed)) {
+    console.warn(
+      "[weft] ignoring apiKey: it contains whitespace or non-printable characters that cannot travel in an HTTP header"
+    );
+    return void 0;
+  }
+  return trimmed;
+}
+var WEFT_API_KEY_HEADER = "X-API-Key";
+function buildFacilitatorAuthHeaders(adapter, apiKey, declaration) {
+  const key = resolveApiKey(apiKey);
+  const supported = {
+    "User-Agent": `weft-sdk-${adapter}/${version}`
+  };
+  if (key !== void 0) {
+    supported["Authorization"] = `Bearer ${key}`;
+  }
+  const declared = declaredIdentityValue(declaration);
+  if (declared !== void 0) {
+    supported[WEFT_DECLARED_HEADER] = declared;
+  }
+  const settle = key !== void 0 ? { [WEFT_API_KEY_HEADER]: key } : void 0;
+  const verify = key !== void 0 ? { [WEFT_API_KEY_HEADER]: key } : void 0;
+  return {
+    supported,
+    ...settle !== void 0 && { settle },
+    ...verify !== void 0 && { verify }
+  };
+}
+
+// src/facilitator/middleware/extensions.ts
+var WEFT_REQUEST_EXTENSION_KEY = "weft.request";
+var WEFT_REQUEST_INFO_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  title: "Weft per-request context",
+  description: "Seller-authored context for one paid request, for display only. Unauthenticated buyer input by the time it is read; key nothing on it.",
+  type: "object",
+  additionalProperties: true
+};
+var MAX_EXTENSION_BYTES = 16 * 1024;
+function requestOf(context) {
+  const transport = context.transportContext;
+  return transport?.request;
+}
+function dropKey(context, key) {
+  delete context.paymentRequiredResponse.extensions?.[key];
+  return void 0;
+}
+function toJson(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function byteLength(text) {
+  return new TextEncoder().encode(text).length;
+}
+function projectedBytes(context, key, value) {
+  const projected = {
+    ...context.paymentRequiredResponse.extensions,
+    [key]: value
+  };
+  const json = toJson(projected);
+  return json === void 0 ? void 0 : byteLength(json);
+}
+function dynamicExtension(key, warn) {
+  return {
+    key,
+    async enrichPaymentRequiredResponse(declaration, context) {
+      if (typeof declaration !== "function") {
+        return void 0;
+      }
+      const request = requestOf(context);
+      if (!request) {
+        warn(
+          `extensions[${key}] is a callback but no HTTP request context reached it; dropping the key from the challenge`,
+          `${key}:no-request`
+        );
+        return dropKey(context, key);
+      }
+      let resolved;
+      try {
+        resolved = await declaration(request);
+      } catch (error) {
+        warn(
+          `extensions[${key}] callback failed; dropping the key from the challenge: ` + (error instanceof Error ? error.message : String(error)),
+          `${key}:threw`
+        );
+        return dropKey(context, key);
+      }
+      if (resolved === void 0 || resolved === null) {
+        return dropKey(context, key);
+      }
+      const json = toJson(resolved);
+      if (json === void 0) {
+        warn(
+          `extensions[${key}] callback returned a value JSON cannot carry (a function, a circular reference, a BigInt or similar); dropping the key from the challenge`,
+          `${key}:unserializable`
+        );
+        return dropKey(context, key);
+      }
+      const wire = JSON.parse(json);
+      if (typeof wire !== "object" || wire === null || Array.isArray(wire)) {
+        warn(
+          `extensions[${key}] callback returned ${Array.isArray(wire) ? "an array" : `a ${typeof wire}`}; the x402 extensions channel carries objects, so the key is dropped from the challenge`,
+          `${key}:not-an-object`
+        );
+        return dropKey(context, key);
+      }
+      const value = key === WEFT_REQUEST_EXTENSION_KEY ? { info: wire, schema: WEFT_REQUEST_INFO_SCHEMA } : wire;
+      const bytes = projectedBytes(context, key, value) ?? byteLength(json);
+      if (bytes > MAX_EXTENSION_BYTES) {
+        warn(
+          `extensions[${key}] takes the challenge's extensions to ${bytes} bytes, over the ${MAX_EXTENSION_BYTES}-byte facilitator relay cap; dropping the key so the rest of the declaration still reaches settlement`,
+          `${key}:over-cap`
+        );
+        return dropKey(context, key);
+      }
+      return value;
+    }
+  };
+}
+function routeConfigs(routes) {
+  if (typeof routes !== "object" || routes === null) {
+    return [];
+  }
+  const configs = "accepts" in routes ? [routes] : Object.values(routes);
+  return configs.filter(
+    (config) => typeof config === "object" && config !== null
+  );
+}
+function dynamicExtensionKeys(routes) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const config of routeConfigs(routes)) {
+    const extensions = config.extensions;
+    if (typeof extensions !== "object" || extensions === null) {
+      continue;
+    }
+    for (const [key, value] of Object.entries(extensions)) {
+      if (typeof value === "function") {
+        keys.add(key);
+      }
+    }
+  }
+  return [...keys];
+}
+function registerDynamicExtensions(server, routes) {
+  const keys = dynamicExtensionKeys(routes);
+  if (keys.length === 0) {
+    return;
+  }
+  const warn = createWarn();
+  if (typeof server.registerExtension !== "function") {
+    warn(
+      `this @x402/core build has no registerExtension, so per-request route extensions (${keys.join(", ")}) cannot be resolved and will not ship`
+    );
+    return;
+  }
+  for (const key of keys) {
+    server.registerExtension(dynamicExtension(key, warn));
+  }
+}
+
+// src/facilitator/middleware/replay.ts
+var import_http = require("@x402/core/http");
+var import_schemas = require("@x402/core/schemas");
+function paymentResumeCandidate(context) {
+  if (!context.paymentHeader) return void 0;
+  try {
+    const paymentPayload = (0, import_http.decodePaymentSignatureHeader)(context.paymentHeader);
+    (0, import_schemas.validatePaymentPayload)(paymentPayload);
+    if (paymentPayload.x402Version !== 2) return void 0;
+    return {
+      paymentPayload,
+      paymentRequirements: paymentPayload.accepted
+    };
+  } catch {
+    return void 0;
+  }
+}
+function resumePaymentResult(resourceServer, resumed, context) {
+  return {
+    type: "payment-verified",
+    paymentPayload: resumed.paymentPayload,
+    paymentRequirements: resumed.paymentRequirements,
+    declaredExtensions: resumed.declaredExtensions,
+    beforeHandlerSettlement: resumed.beforeHandlerSettlement,
+    cancellationDispatcher: resumed.cancellationDispatcher ?? resourceServer.createPaymentCancellationDispatcher(
+      resumed.paymentPayload,
+      resumed.paymentRequirements,
+      resumed.declaredExtensions,
+      { request: context },
+      resumed.beforeHandlerSettlement ? ["before-handler"] : []
+    )
+  };
+}
+
+// src/facilitator/middleware/settlement.ts
+var import_http2 = require("@x402/core/http");
+var CORE_FACILITATOR_UNAVAILABLE = /^Facilitator settle failed \(503\):(?: |$)/;
+function isFacilitatorUnavailable(errorReason) {
+  return errorReason === FACILITATOR_UNAVAILABLE_ERROR || CORE_FACILITATOR_UNAVAILABLE.test(errorReason ?? "");
+}
+function responseHeader(headers, name) {
+  const value = Object.entries(headers).find(
+    ([key]) => key.toLowerCase() === name
+  )?.[1];
+  return Array.isArray(value) ? value[0] : value;
+}
+function isFacilitatorUnavailableResponse(response) {
+  if (typeof response.body === "object" && response.body !== null) {
+    for (const field of ["errorReason", "error"]) {
+      if (field in response.body && typeof response.body[field] === "string" && isFacilitatorUnavailable(
+        response.body[field]
+      )) {
+        return true;
+      }
+    }
+  }
+  const paymentResponse = responseHeader(response.headers, "payment-response");
+  if (!paymentResponse) return false;
+  try {
+    return isFacilitatorUnavailable(
+      (0, import_http2.decodePaymentResponseHeader)(paymentResponse).errorReason
+    );
+  } catch {
+    return false;
+  }
+}
+function isJsonResponse(response) {
+  const contentType = responseHeader(response.headers, "content-type");
+  return /^(application\/json|[^;]+\+json)(?:;|$)/i.test(contentType ?? "");
+}
+function serializeResponseBody(response) {
+  if (isJsonResponse(response)) return JSON.stringify(response.body ?? {});
+  if (response.body instanceof Blob || response.body instanceof ArrayBuffer || ArrayBuffer.isView(response.body)) {
+    return response.body;
+  }
+  return typeof response.body === "string" ? response.body : String(response.body ?? "");
+}
+
+// src/facilitator/middleware/express.ts
+var UNSAFE_FAILURE_HEADERS = /* @__PURE__ */ new Set([
+  import_server2.SETTLEMENT_OVERRIDES_HEADER.toLowerCase(),
+  "location",
+  "set-cookie"
+]);
+function isUnsafeFailureHeader(name, value) {
+  const normalized = name.toLowerCase();
+  return UNSAFE_FAILURE_HEADERS.has(normalized) || normalized === "cache-control" && value !== void 0 && /\bpublic\b/i.test(
+    Array.isArray(value) ? value.join(",") : String(value)
+  );
+}
+var FACILITATOR_SYNC_RETRY_FLOOR_MS = 3e4;
+var ExpressAdapter = class {
+  constructor(req) {
+    this.req = req;
+  }
+  getHeader(name) {
+    const value = this.req.header(name);
+    return Array.isArray(value) ? value[0] : value;
+  }
+  getMethod() {
+    return this.req.method;
+  }
+  getPath() {
+    return this.req.path;
+  }
+  getUrl() {
+    const host = this.req.headers.host || "localhost";
+    return `${this.req.protocol}://${host}${this.req.path}`;
+  }
+  getAcceptHeader() {
+    return this.getHeader("Accept") || "";
+  }
+  getUserAgent() {
+    return this.getHeader("User-Agent") || "";
+  }
+  getQueryParams() {
+    return this.req.query;
+  }
+  getQueryParam(name) {
+    return this.req.query[name];
+  }
+  getBody() {
+    return this.req.body;
+  }
+};
+function toHeaderRecord(headers) {
+  const record = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (value === void 0) continue;
+    record[key] = Array.isArray(value) ? value.join(",") : String(value);
+  }
+  return record;
+}
+function responseBodyFromBufferedCalls(calls) {
+  const chunks = [];
+  for (const [method, args] of calls) {
+    if (method !== "write" && method !== "end") continue;
+    const chunk = args[0];
+    if (chunk === void 0) continue;
+    if (typeof chunk === "string") {
+      const encoding = typeof args[1] === "string" ? args[1] : "utf8";
+      if (!Buffer.isEncoding(encoding)) return void 0;
+      chunks.push(Buffer.from(chunk, encoding));
+    } else if (Buffer.isBuffer(chunk) || chunk instanceof Uint8Array) {
+      chunks.push(Buffer.from(chunk));
+    } else {
+      return void 0;
+    }
+  }
+  return Buffer.concat(chunks);
+}
+function restoreHeaders(res, headers) {
+  for (const name of Object.keys(res.getHeaders())) res.removeHeader(name);
+  for (const [name, value] of Object.entries(headers)) {
+    if (value !== void 0) res.setHeader(name, value);
+  }
+}
+async function sendCoreResponse(res, response) {
+  res.status(response.status);
+  Object.entries(response.headers).forEach(([key, value]) => {
+    res.setHeader(key, value);
+  });
+  if (isJsonResponse(response)) {
+    res.json(response.body ?? {});
+  } else if (response.body instanceof Blob) {
+    res.send(Buffer.from(await response.body.arrayBuffer()));
+  } else if (response.body instanceof ArrayBuffer) {
+    res.send(Buffer.from(response.body));
+  } else if (ArrayBuffer.isView(response.body)) {
+    res.send(
+      Buffer.from(
+        response.body.buffer,
+        response.body.byteOffset,
+        response.body.byteLength
+      )
+    );
+  } else {
+    res.send(
+      typeof response.body === "string" ? response.body : String(response.body ?? "")
+    );
+  }
+}
+function sendFacilitatorUnavailable(res) {
+  res.removeHeader("payment-response");
+  res.removeHeader(import_server2.SETTLEMENT_OVERRIDES_HEADER);
+  res.setHeader("retry-after", "1");
+  res.setHeader("cache-control", (0, import_server2.withPrivateCacheControl)(null));
+  res.status(503).json({ error: "facilitator_unavailable" });
+}
+function weftPaymentMiddleware(routes, config) {
+  const facilitatorClient = createFacilitatorClient(
+    config?.facilitator,
+    buildFacilitatorAuthHeaders("express", config?.apiKey, config ?? {})
+  );
+  const resourceServer = new import_server2.x402ResourceServer(facilitatorClient);
+  registerDynamicExtensions(resourceServer, routes);
+  if (config?.schemes) {
+    config.schemes.forEach(({ network, server: schemeServer }) => {
+      resourceServer.register(network, schemeServer);
+    });
+  }
+  const httpServer = new import_server2.x402HTTPResourceServer(
+    resourceServer,
+    applyProductIdentity(routes, config ?? {})
+  );
+  if (config?.paywall) {
+    httpServer.registerPaywallProvider(config.paywall);
+  }
+  const syncOnStart = config?.syncFacilitatorOnStart ?? true;
+  let facilitatorSynced = false;
+  let syncInFlight = null;
+  let lastFailedSyncAt = 0;
+  const syncFacilitator = () => {
+    syncInFlight ?? (syncInFlight = httpServer.initialize().then(
+      () => {
+        facilitatorSynced = true;
+      },
+      (error) => {
+        lastFailedSyncAt = Date.now();
+        console.warn(
+          "[weft] facilitator sync failed; payment-protected routes degrade until a later attempt succeeds: " + (error instanceof Error ? error.message : String(error))
+        );
+      }
+    ).finally(() => {
+      syncInFlight = null;
+    }));
+    return syncInFlight;
+  };
+  let bootSync = syncOnStart ? syncFacilitator() : null;
+  return async (req, res, next) => {
+    const adapter = new ExpressAdapter(req);
+    const context = {
+      adapter,
+      path: req.path,
+      method: req.method,
+      paymentHeader: adapter.getHeader("payment-signature") || adapter.getHeader("x-payment")
+    };
+    if (!httpServer.requiresPayment(context)) {
+      return next();
+    }
+    if (bootSync) {
+      await bootSync;
+      bootSync = null;
+    }
+    if (syncOnStart && !facilitatorSynced && Date.now() - lastFailedSyncAt >= FACILITATOR_SYNC_RETRY_FLOOR_MS) {
+      void syncFacilitator();
+    }
+    let result;
+    try {
+      const resumeCandidate = paymentResumeCandidate(context);
+      const resumedPayment = resumeCandidate ? await config?.resumeVerifiedPayment?.(context, resumeCandidate) : void 0;
+      result = resumedPayment ? resumePaymentResult(resourceServer, resumedPayment, context) : await httpServer.processHTTPRequest(context, config?.paywallConfig);
+    } catch (error) {
+      return next(error);
+    }
+    switch (result.type) {
+      case "no-payment-required":
+        return next();
+      case "payment-error": {
+        const { response } = result;
+        if (isFacilitatorUnavailableResponse(response)) {
+          sendFacilitatorUnavailable(res);
+          return;
+        }
+        await sendCoreResponse(res, response);
+        return;
+      }
+      case "payment-verified": {
+        const {
+          paymentPayload,
+          paymentRequirements,
+          declaredExtensions,
+          cancellationDispatcher,
+          beforeHandlerSettlement
+        } = result;
+        const originalWriteHead = res.writeHead.bind(res);
+        const originalWrite = res.write.bind(res);
+        const originalEnd = res.end.bind(res);
+        const originalFlushHeaders = res.flushHeaders.bind(res);
+        const originalSetHeader = res.setHeader.bind(res);
+        const originalRemoveHeader = res.removeHeader.bind(res);
+        const headersBeforeHandler = { ...res.getHeaders() };
+        let bufferedCalls = [];
+        let settled = false;
+        const failureHeaders = /* @__PURE__ */ new Map();
+        const restoreResponseMethods = () => {
+          res.setHeader = originalSetHeader;
+          res.removeHeader = originalRemoveHeader;
+          res.writeHead = originalWriteHead;
+          res.write = originalWrite;
+          res.end = originalEnd;
+          res.flushHeaders = originalFlushHeaders;
+        };
+        const replayBufferedCall = ([method, args]) => {
+          if (method === "writeHead") {
+            const [statusCode, statusMessage] = args;
+            return typeof statusMessage === "string" ? originalWriteHead(statusCode, statusMessage) : originalWriteHead(statusCode);
+          }
+          if (method === "write") return originalWrite(...args);
+          if (method === "end") return originalEnd(...args);
+          return originalFlushHeaders();
+        };
+        let endCalled;
+        const endPromise = new Promise((resolve) => {
+          endCalled = resolve;
+        });
+        res.writeHead = function(...args) {
+          if (!settled) {
+            const [statusCode, statusMessageOrHeaders, maybeHeaders] = args;
+            if (typeof statusCode === "number") {
+              res.statusCode = statusCode;
+            }
+            const headers = typeof statusMessageOrHeaders === "string" ? maybeHeaders : statusMessageOrHeaders;
+            if (Array.isArray(headers)) {
+              const grouped = /* @__PURE__ */ new Map();
+              for (let index = 0; index < headers.length; index += 2) {
+                const name = String(headers[index]);
+                const key = name.toLowerCase();
+                const entry = grouped.get(key) ?? { name, values: [] };
+                entry.values.push(String(headers[index + 1]));
+                grouped.set(key, entry);
+              }
+              for (const { name, values } of grouped.values()) {
+                res.setHeader(name, values.length === 1 ? values[0] : values);
+              }
+            } else if (headers && typeof headers === "object") {
+              for (const [key, value] of Object.entries(headers)) {
+                if (value === void 0) continue;
+                res.setHeader(
+                  key,
+                  Array.isArray(value) ? value : String(value)
+                );
+              }
+            }
+            bufferedCalls.push(["writeHead", args]);
+            return res;
+          }
+          return originalWriteHead(...args);
+        };
+        res.setHeader = function(name, value) {
+          const result2 = originalSetHeader(name, value);
+          if (!settled && res.statusCode >= 400) {
+            failureHeaders.set(name.toLowerCase(), {
+              name,
+              value: Array.isArray(value) ? [...value] : value
+            });
+          }
+          return result2;
+        };
+        res.removeHeader = function(name) {
+          originalRemoveHeader(name);
+          if (!settled && res.statusCode >= 400) {
+            failureHeaders.set(name.toLowerCase(), { name });
+          }
+        };
+        res.write = function(...args) {
+          if (!settled) {
+            bufferedCalls.push(["write", args]);
+            return true;
+          }
+          return originalWrite(...args);
+        };
+        res.end = function(...args) {
+          if (!settled) {
+            bufferedCalls.push(["end", args]);
+            endCalled();
+            return res;
+          }
+          return originalEnd(...args);
+        };
+        res.flushHeaders = function() {
+          if (!settled) {
+            bufferedCalls.push(["flushHeaders", []]);
+            return;
+          }
+          return originalFlushHeaders();
+        };
+        const finalizeFailure = async (cancellation) => {
+          const preservedFailureHeaders = /* @__PURE__ */ new Map();
+          for (const [name, value] of Object.entries(res.getHeaders())) {
+            if (value === void 0 || isUnsafeFailureHeader(name, value))
+              continue;
+            preservedFailureHeaders.set(
+              name,
+              Array.isArray(value) ? [...value] : value
+            );
+          }
+          const cancelSettlement = await cancellationDispatcher.cancel(cancellation);
+          settled = true;
+          restoreHeaders(res, headersBeforeHandler);
+          for (const [name, value] of Object.entries(res.getHeaders())) {
+            if (isUnsafeFailureHeader(name, value)) res.removeHeader(name);
+          }
+          for (const [name, value] of preservedFailureHeaders) {
+            res.setHeader(name, value);
+          }
+          for (const { name, value } of failureHeaders.values()) {
+            if (value === void 0 || isUnsafeFailureHeader(name, value))
+              res.removeHeader(name);
+            else res.setHeader(name, value);
+          }
+          const existingCacheControl = Object.entries(res.getHeaders()).find(
+            ([key]) => key.toLowerCase() === "cache-control"
+          )?.[1];
+          const headers = httpServer.createFailurePathSettlementHeaders(
+            cancelSettlement,
+            beforeHandlerSettlement,
+            paymentPayload,
+            Array.isArray(existingCacheControl) ? existingCacheControl.join(",") : existingCacheControl === void 0 ? void 0 : String(existingCacheControl)
+          );
+          Object.entries(headers ?? {}).forEach(([key, value]) => {
+            res.setHeader(key, value);
+          });
+          restoreResponseMethods();
+          for (const call of bufferedCalls) replayBufferedCall(call);
+          bufferedCalls = [];
+        };
+        try {
+          next();
+        } catch (error) {
+          bufferedCalls = [];
+          restoreHeaders(res, headersBeforeHandler);
+          failureHeaders.clear();
+          try {
+            next(error);
+          } catch (errorMiddlewareError) {
+            restoreResponseMethods();
+            throw errorMiddlewareError;
+          }
+          await endPromise;
+          await finalizeFailure({ reason: "handler_threw", error });
+          return;
+        }
+        await endPromise;
+        if (res.statusCode >= 400) {
+          await finalizeFailure({
+            reason: "handler_failed",
+            responseStatus: res.statusCode
+          });
+          return;
+        }
+        try {
+          const settleResult = await httpServer.processSettlement(
+            paymentPayload,
+            paymentRequirements,
+            declaredExtensions,
+            // The route handler signals a settlement override (a metered amount
+            // below the signed maximum) through a response header.
+            // `processSettlement` only reads that off `transportContext`, so
+            // omitting this settles the full authorised amount and makes
+            // `upto` behave exactly like `exact`.
+            {
+              request: context,
+              responseBody: responseBodyFromBufferedCalls(bufferedCalls),
+              responseHeaders: toHeaderRecord(res.getHeaders())
+            },
+            void 0,
+            beforeHandlerSettlement
+          );
+          if (!settleResult.success) {
+            bufferedCalls = [];
+            restoreHeaders(res, headersBeforeHandler);
+            if (isFacilitatorUnavailable(settleResult.errorReason)) {
+              sendFacilitatorUnavailable(res);
+              return;
+            }
+            const { response } = settleResult;
+            await sendCoreResponse(res, response);
+            return;
+          }
+          Object.entries(settleResult.headers).forEach(([key, value]) => {
+            const headerValue = Array.isArray(value) ? value.join(",") : String(value);
+            res.setHeader(key, headerValue);
+          });
+          const cacheControl = res.getHeaders()["cache-control"];
+          res.setHeader(
+            "cache-control",
+            (0, import_server2.withPrivateCacheControl)(
+              Array.isArray(cacheControl) ? cacheControl.join(",") : cacheControl === void 0 ? null : String(cacheControl)
+            )
+          );
+          res.removeHeader(import_server2.SETTLEMENT_OVERRIDES_HEADER);
+        } catch (error) {
+          bufferedCalls = [];
+          restoreHeaders(res, headersBeforeHandler);
+          settled = true;
+          restoreResponseMethods();
+          next(error);
+          return;
+        } finally {
+          settled = true;
+          restoreResponseMethods();
+          for (const call of bufferedCalls) replayBufferedCall(call);
+          bufferedCalls = [];
+        }
+        return;
+      }
+    }
+  };
+}
+
+// src/facilitator/middleware/hono.ts
+var import_server3 = require("@x402/core/server");
+var FACILITATOR_SYNC_RETRY_FLOOR_MS2 = 3e4;
+var HonoAdapter = class {
+  constructor(c) {
+    this.c = c;
+  }
+  getHeader(name) {
+    return this.c.req.header(name);
+  }
+  getMethod() {
+    return this.c.req.method;
+  }
+  getPath() {
+    return this.c.req.path;
+  }
+  getUrl() {
+    return this.c.req.url;
+  }
+  getAcceptHeader() {
+    return this.c.req.header("Accept") || "";
+  }
+  getUserAgent() {
+    return this.c.req.header("User-Agent") || "";
+  }
+  getQueryParams() {
+    const query = this.c.req.query();
+    const result = {};
+    for (const [key, value] of Object.entries(query)) {
+      result[key] = value;
+    }
+    return result;
+  }
+  getQueryParam(name) {
+    return this.c.req.query(name);
+  }
+  async getBody() {
+    try {
+      return await this.c.req.json();
+    } catch {
+      return void 0;
+    }
+  }
+};
+function toHeaderRecord2(headers) {
+  if (!headers) return void 0;
+  const record = {};
+  headers.forEach((value, key) => {
+    record[key] = value;
+  });
+  return record;
+}
+function withResponseHeaders(response, additions) {
+  if ((!additions || Object.keys(additions).length === 0) && !response.headers.has(import_server3.SETTLEMENT_OVERRIDES_HEADER))
+    return response;
+  const headers = new Headers(response.headers);
+  Object.entries(additions ?? {}).forEach(([key, value]) => {
+    headers.set(key, value);
+  });
+  headers.delete(import_server3.SETTLEMENT_OVERRIDES_HEADER);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function withSuccessfulSettlementHeaders(response, additions) {
+  const headers = new Headers(response.headers);
+  Object.entries(additions).forEach(([key, value]) => {
+    headers.set(key, value);
+  });
+  headers.delete(import_server3.SETTLEMENT_OVERRIDES_HEADER);
+  headers.set(
+    "cache-control",
+    (0, import_server3.withPrivateCacheControl)(headers.get("cache-control"))
+  );
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function failureResponse(body, status, headers) {
+  const responseHeaders = new Headers();
+  for (const [name, value] of Object.entries(headers)) {
+    const values = Array.isArray(value) ? value : [value];
+    for (const item of values) responseHeaders.append(name, item);
+  }
+  return new Response(serializeResponseBody({ body, headers }), {
+    status,
+    headers: responseHeaders
+  });
+}
+function facilitatorUnavailableResponse() {
+  return failureResponse({ error: "facilitator_unavailable" }, 503, {
+    "retry-after": "1",
+    "cache-control": (0, import_server3.withPrivateCacheControl)(null),
+    "content-type": "application/json; charset=UTF-8"
+  });
+}
+function replaceContextResponse(c, response) {
+  for (const name of [...c.res?.headers.keys() ?? []]) {
+    c.header(name, void 0);
+  }
+  c.res = response;
+}
+function weftPaymentMiddlewareHono(routes, config) {
+  const facilitatorClient = createFacilitatorClient(
+    config?.facilitator,
+    buildFacilitatorAuthHeaders("hono", config?.apiKey, config ?? {})
+  );
+  const resourceServer = new import_server3.x402ResourceServer(facilitatorClient);
+  registerDynamicExtensions(resourceServer, routes);
+  if (config?.schemes) {
+    config.schemes.forEach(({ network, server: schemeServer }) => {
+      resourceServer.register(network, schemeServer);
+    });
+  }
+  const httpServer = new import_server3.x402HTTPResourceServer(
+    resourceServer,
+    applyProductIdentity(routes, config ?? {})
+  );
+  if (config?.paywall) {
+    httpServer.registerPaywallProvider(config.paywall);
+  }
+  const syncOnStart = config?.syncFacilitatorOnStart ?? true;
+  let facilitatorSynced = false;
+  let syncInFlight = null;
+  let lastFailedSyncAt = 0;
+  const syncFacilitator = () => {
+    syncInFlight ?? (syncInFlight = httpServer.initialize().then(
+      () => {
+        facilitatorSynced = true;
+      },
+      (error) => {
+        lastFailedSyncAt = Date.now();
+        console.warn(
+          "[weft] facilitator sync failed; payment-protected routes degrade until a later attempt succeeds: " + (error instanceof Error ? error.message : String(error))
+        );
+      }
+    ).finally(() => {
+      syncInFlight = null;
+    }));
+    return syncInFlight;
+  };
+  let bootSync = syncOnStart ? syncFacilitator() : null;
+  return async (c, next) => {
+    const adapter = new HonoAdapter(c);
+    const context = {
+      adapter,
+      path: c.req.path,
+      method: c.req.method,
+      paymentHeader: adapter.getHeader("payment-signature") || adapter.getHeader("x-payment")
+    };
+    if (!httpServer.requiresPayment(context)) {
+      return next();
+    }
+    if (bootSync) {
+      await bootSync;
+      bootSync = null;
+    }
+    if (syncOnStart && !facilitatorSynced && Date.now() - lastFailedSyncAt >= FACILITATOR_SYNC_RETRY_FLOOR_MS2) {
+      void syncFacilitator();
+    }
+    const resumeCandidate = paymentResumeCandidate(context);
+    const resumedPayment = resumeCandidate ? await config?.resumeVerifiedPayment?.(context, resumeCandidate) : void 0;
+    const result = resumedPayment ? resumePaymentResult(resourceServer, resumedPayment, context) : await httpServer.processHTTPRequest(context, config?.paywallConfig);
+    switch (result.type) {
+      case "no-payment-required":
+        return next();
+      case "payment-error": {
+        const { response } = result;
+        if (isFacilitatorUnavailableResponse(response)) {
+          return facilitatorUnavailableResponse();
+        }
+        if (!response.isHtml && !isJsonResponse(response)) {
+          return failureResponse(
+            response.body,
+            response.status,
+            response.headers
+          );
+        }
+        Object.entries(response.headers).forEach(([key, value]) => {
+          c.header(key, value);
+        });
+        if (response.isHtml) {
+          return c.html(response.body, response.status);
+        }
+        return c.json(response.body || {}, response.status);
+      }
+      case "payment-verified": {
+        const {
+          paymentPayload,
+          paymentRequirements,
+          declaredExtensions,
+          cancellationDispatcher,
+          beforeHandlerSettlement
+        } = result;
+        const propagateHandlerError = async (error) => {
+          replaceContextResponse(c, new Response());
+          const cancelSettlement = await cancellationDispatcher.cancel({
+            reason: "handler_threw",
+            error
+          });
+          const headers = httpServer.createFailurePathSettlementHeaders(
+            cancelSettlement,
+            beforeHandlerSettlement,
+            paymentPayload
+          );
+          Object.entries(headers ?? {}).forEach(([key, value]) => {
+            c.header(key, value);
+          });
+          throw error;
+        };
+        const originalHeader = c.header;
+        const handlerHeaders = /* @__PURE__ */ new Set();
+        const errorHeaders = /* @__PURE__ */ new Set();
+        c.header = (name, value, options) => {
+          (c.error ? errorHeaders : handlerHeaders).add(name.toLowerCase());
+          originalHeader.call(c, name, value, options);
+        };
+        try {
+          await next();
+        } catch (error) {
+          c.header = originalHeader;
+          await propagateHandlerError(error);
+        }
+        c.header = originalHeader;
+        if (c.error) {
+          const res2 = c.res ?? new Response();
+          const responseHeaders = new Headers(res2.headers);
+          for (const name of handlerHeaders) {
+            if (!errorHeaders.has(name)) responseHeaders.delete(name);
+          }
+          const cancelSettlement = await cancellationDispatcher.cancel({
+            reason: "handler_threw",
+            error: c.error
+          });
+          const headers = httpServer.createFailurePathSettlementHeaders(
+            cancelSettlement,
+            beforeHandlerSettlement,
+            paymentPayload,
+            responseHeaders.get("cache-control")
+          );
+          const sanitizedResponse = new Response(res2.body, {
+            status: res2.status,
+            statusText: res2.statusText,
+            headers: responseHeaders
+          });
+          replaceContextResponse(
+            c,
+            withResponseHeaders(sanitizedResponse, headers)
+          );
+          return;
+        }
+        let res = c.res;
+        if (res && res.status >= 400) {
+          const cancelSettlement = await cancellationDispatcher.cancel({
+            reason: "handler_failed",
+            responseStatus: res.status
+          });
+          const headers = httpServer.createFailurePathSettlementHeaders(
+            cancelSettlement,
+            beforeHandlerSettlement,
+            paymentPayload,
+            res.headers.get("cache-control")
+          );
+          replaceContextResponse(c, withResponseHeaders(res, headers));
+          return;
+        }
+        let settleResult;
+        try {
+          settleResult = await httpServer.processSettlement(
+            paymentPayload,
+            paymentRequirements,
+            declaredExtensions,
+            // The route handler signals a settlement override (a metered amount
+            // below the signed maximum) through a response header.
+            // `processSettlement` only reads that off `transportContext`, so
+            // omitting this settles the full authorised amount and makes
+            // `upto` behave exactly like `exact`.
+            {
+              request: context,
+              responseBody: res ? Buffer.from(await res.clone().arrayBuffer()) : void 0,
+              responseHeaders: toHeaderRecord2(res?.headers)
+            },
+            void 0,
+            beforeHandlerSettlement
+          );
+        } catch (error) {
+          replaceContextResponse(c, new Response());
+          throw error;
+        }
+        if (!settleResult.success) {
+          if (isFacilitatorUnavailable(settleResult.errorReason)) {
+            replaceContextResponse(c, facilitatorUnavailableResponse());
+            return;
+          }
+          const { response } = settleResult;
+          replaceContextResponse(
+            c,
+            failureResponse(response.body, response.status, response.headers)
+          );
+          return;
+        } else if (res) {
+          res = withSuccessfulSettlementHeaders(res, settleResult.headers);
+        }
+        if (res) replaceContextResponse(c, res);
+        return;
+      }
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MAX_EXTENSION_BYTES,
+  WEFT_API_KEY_HEADER,
+  WEFT_DECLARED_HEADER,
+  WEFT_PRODUCT_EXTENSION_KEY,
+  WEFT_PRODUCT_INFO_SCHEMA,
+  WEFT_REQUEST_EXTENSION_KEY,
+  WEFT_REQUEST_INFO_SCHEMA,
+  WEFT_TYPE_TAG_PREFIX,
+  X402_FACILITATOR_URL,
+  applyProductIdentity,
+  createFacilitatorClient,
+  getFeeInfo,
+  invalidateFeeCache,
+  productTypeTag,
+  registerDynamicExtensions,
+  weftPaymentMiddleware,
+  weftPaymentMiddlewareHono,
+  ...require("@x402/core/server")
+});
+//# sourceMappingURL=server.js.map