agent-receipt-verify 0.0.0-stage → 0.2.2

package/profiles/profile.schema.json

@@ -0,0 +1,115 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://github.com/holistis/agent-receipt-verify/blob/main/profiles/profile.schema.json",
+  "title": "Deployed-endpoint conformance profile",
+  "description": "A versioned, declarative description of what can be checked on someone else's deployed endpoint from the response it already returns. A profile names the clause each check comes from, the input the check needs, and what to report when the check cannot decide. It does not describe how to run the check; that is the runner's job, and the evaluator field is the name that binds the two.",
+  "type": "object",
+  "required": ["profile", "version", "published", "intent", "outcomes", "specs", "checks"],
+  "additionalProperties": true,
+  "properties": {
+    "profile": { "type": "string", "description": "Stable name of the profile, independent of its version." },
+    "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "published": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$", "description": "A profile without a date cannot be told apart from a later one, and then a published number cannot be traced back to the ladder it was measured on." },
+    "intent": { "type": "string", "minLength": 20 },
+    "notMeasured": { "type": "string", "description": "What this profile deliberately says nothing about. A profile that only lists what it checks invites the reader to assume the rest was fine." },
+    "outcomes": {
+      "type": "object",
+      "description": "Exactly four, and each one described. Three is the common mistake: it collapses 'we did not try' into 'we could not decide', and a reader cannot then tell a gap in the runner from a defect in the endpoint.",
+      "required": ["pass", "fail", "skip", "inconclusive"],
+      "additionalProperties": false,
+      "properties": {
+        "pass": { "type": "string", "minLength": 10 },
+        "fail": { "type": "string", "minLength": 10 },
+        "skip": { "type": "string", "minLength": 10 },
+        "inconclusive": { "type": "string", "minLength": 10 }
+      }
+    },
+    "wireStates": { "type": "object", "description": "Optional. How a particular runner's own state names map onto the four outcomes, so a consumer does not have to read that runner's source." },
+    "specs": {
+      "type": "object",
+      "description": "Every specification this profile cites, pinned. A clause reference without a pinned version is a reference to whatever the document says today.",
+      "minProperties": 1,
+      "additionalProperties": {
+        "type": "object",
+        "required": ["repo", "path", "commit", "state"],
+        "additionalProperties": true,
+        "properties": {
+          "repo": { "type": "string" },
+          "path": { "type": "string" },
+          "commit": { "type": "string", "minLength": 7 },
+          "state": { "type": "string", "enum": ["merged on main", "proposed, not merged"] },
+          "pullRequest": { "type": "integer" },
+          "retrieved": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$" },
+          "warning": { "type": "string" }
+        }
+      }
+    },
+    "relatedWork": { "type": "object", "description": "Optional. Other vector or profile sets this one references instead of restating." },
+    "checks": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["id", "key", "level", "name", "requirement", "clause", "input", "assertion", "normative", "whenNotObservable"],
+        "additionalProperties": true,
+        "properties": {
+          "id": { "type": "string", "pattern": "^[A-Z]+-[A-Za-z0-9]+$" },
+          "key": { "type": "string", "description": "Short key a runner uses in its own output. Kept separate from id so a runner's existing output does not have to change when a profile is adopted." },
+          "level": { "type": "integer", "minimum": 0 },
+          "name": { "type": "string", "minLength": 5 },
+          "requirement": { "type": "string", "minLength": 20 },
+          "clause": {
+            "type": "array",
+            "minItems": 1,
+            "description": "Where the requirement comes from. Each entry names a key of specs, so the pin travels with the reference.",
+            "items": {
+              "type": "object",
+              "required": ["spec", "section"],
+              "additionalProperties": true,
+              "properties": {
+                "spec": { "type": "string" },
+                "section": { "type": "string", "minLength": 3 },
+                "quote": { "type": "string" }
+              }
+            }
+          },
+          "input": {
+            "type": "object",
+            "required": ["needs", "pays"],
+            "additionalProperties": true,
+            "properties": {
+              "needs": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+              "requests": { "type": "integer", "minimum": 0 },
+              "pays": { "type": "boolean", "description": "Whether the check needs a real settlement. A passive profile must skip these rather than fail them." }
+            }
+          },
+          "assertion": {
+            "type": "object",
+            "required": ["evaluator", "describes"],
+            "additionalProperties": false,
+            "properties": {
+              "evaluator": { "type": "string", "description": "Name of the routine that decides this check. Deliberately a name and not an expression language: the two checks that matter here involve signature recovery and a chain read, and pretending those fit in a data expression would mean either a dishonest profile or an expression language nobody else implements." },
+              "describes": { "type": "string", "minLength": 20, "description": "What is actually asserted, in plain words, so a second implementation can be written from the profile alone." }
+            }
+          },
+          "normative": { "type": "string", "enum": ["MUST", "SHOULD"] },
+          "whenNotObservable": { "type": "string", "enum": ["skip", "inconclusive"] },
+          "inconclusiveWhen": { "type": "array", "items": { "type": "string" } },
+          "relatedVectors": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["set", "id"],
+              "additionalProperties": true,
+              "properties": {
+                "set": { "type": "string" },
+                "id": { "type": "string" },
+                "subject": { "type": "string" }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/profiles/x402-deployed-ladder-v1.json

@@ -0,0 +1,178 @@
+{
+  "$schema": "./profile.schema.json",
+  "profile": "x402-deployed-ladder",
+  "version": "1.0.0",
+  "published": "2026-10-17",
+  "intent": "Passive audit of a deployed third-party x402 endpoint from the response it already returns, without cooperation from its operator and without paying.",
+  "notMeasured": "Whether the party behind the endpoint is honest, whether the service does what it advertises, whether a price is fair, and anything that needs a settlement. See CONFORMANCE.md for the full list.",
+  "outcomes": {
+    "pass": "The check ran and the response satisfies it.",
+    "fail": "The check ran and the response does not satisfy it.",
+    "skip": "The check was deliberately not attempted, because this profile is passive and the check needs something a passive run will not do, such as paying.",
+    "inconclusive": "The check was attempted and could not decide, for example because a signature algorithm or a key location is outside what the runner supports. Never report this as fail: a runner's own gap is not a defect of the endpoint."
+  },
+  "wireStates": {
+    "note": "The reference runner in this repository emits three states for backward compatibility. This table maps them onto the four outcomes above, so a consumer of this profile can translate without reading our code.",
+    "HAALT": "pass",
+    "HAALT_NIET": "fail",
+    "ONGEMETEN": "skip when the check declares whenNotObservable skip, inconclusive otherwise"
+  },
+  "specs": {
+    "x402-http-v2": {
+      "repo": "x402-foundation/x402",
+      "path": "specs/transports-v2/http.md",
+      "commit": "faa1c694c66a",
+      "state": "merged on main",
+      "retrieved": "2026-10-17"
+    },
+    "offer-receipt": {
+      "repo": "x402-foundation/x402",
+      "path": "specs/extensions/extension-offer-and-receipt.md",
+      "commit": "faa1c694c66a",
+      "state": "merged on main",
+      "retrieved": "2026-10-17"
+    },
+    "offer-receipt-commitment": {
+      "repo": "x402-foundation/x402",
+      "path": "specs/extensions/extension-offer-and-receipt.md",
+      "commit": "0e492d6",
+      "state": "proposed, not merged",
+      "pullRequest": 3827,
+      "retrieved": "2026-10-17",
+      "warning": "Sections 5.6 through 5.6.5 do not exist in the version on main. They exist only on this pull request, which is open. The pinned commit is four commits ahead of main and is fetchable, but the section numbers can still move before it merges. Any check referencing this spec entry is measuring against a proposal, and a result carrying it should say so."
+    }
+  },
+  "relatedWork": {
+    "x402-core-vectors": {
+      "repo": "x402-foundation/x402",
+      "path": "conformance/vectors/x402-core/",
+      "pullRequest": 2776,
+      "state": "proposed, not merged",
+      "note": "That set names a requirement and the request that exercises it, for an implementer proving their own implementation. Its expected field is the same sentence on every vector, so it carries no machine-checkable expectation. This profile references its ids where the subject overlaps rather than restating the requirement, and adds the three things a passive run needs: which input the check requires, what is actually asserted, and what to report when the check cannot decide. Raised as a question in issue 3396."
+    }
+  },
+  "checks": [
+    {
+      "id": "ARV-L0",
+      "key": "t0",
+      "level": 0,
+      "name": "asks for payment the way x402 says",
+      "requirement": "HTTP 402 carrying accepts[] with scheme, network, payTo and an amount, in the body or in the Payment-Required header",
+      "clause": [
+        { "spec": "x402-http-v2", "section": "Payment Required Signaling" },
+        { "spec": "x402-http-v2", "section": "Header Summary" }
+      ],
+      "input": { "needs": ["response status", "response headers", "response body"], "requests": 1, "pays": false },
+      "assertion": {
+        "evaluator": "statusAndAccepts",
+        "describes": "status is 402, and an accepts entry is reachable either in the JSON body or base64 in the Payment-Required header, carrying all four fields"
+      },
+      "normative": "MUST",
+      "whenNotObservable": "inconclusive",
+      "relatedVectors": [
+        { "set": "x402-core-vectors", "id": "X4-001", "subject": "402 payment challenge headers present" }
+      ]
+    },
+    {
+      "id": "ARV-L1",
+      "key": "t1",
+      "level": 1,
+      "name": "declares the offer-receipt extension",
+      "requirement": "the 402 carries an offer-receipt entry in extensions",
+      "clause": [
+        { "spec": "offer-receipt", "section": "4.1 Placement", "quote": "extensions[\"offer-receipt\"].info.offers[]" }
+      ],
+      "input": { "needs": ["the same 402 as ARV-L0"], "requests": 0, "pays": false },
+      "assertion": {
+        "evaluator": "extensionDeclared",
+        "describes": "extensions carries an offer-receipt key, counted from either the object form or the array form"
+      },
+      "normative": "SHOULD",
+      "whenNotObservable": "inconclusive",
+      "relatedVectors": []
+    },
+    {
+      "id": "ARV-L2",
+      "key": "t2",
+      "level": 2,
+      "name": "signs its offer, and the signature verifies",
+      "requirement": "extensions[\"offer-receipt\"].info.offers[0] is a signed artifact whose signature verifies: either an eip712 artifact recovering to an address, or a jws with an EdDSA signature over the offer payload whose key resolves from its kid",
+      "clause": [
+        { "spec": "offer-receipt", "section": "3.1 Common Object Shape" },
+        { "spec": "offer-receipt", "section": "3.3 JWS Header Requirements" },
+        { "spec": "offer-receipt", "section": "4.3 EIP-712 Types for Offer (Normative Schema)" },
+        { "spec": "offer-receipt", "section": "4.5 Offer Verification" },
+        { "spec": "offer-receipt", "section": "4.5.1 Signer Authorization" }
+      ],
+      "input": { "needs": ["the same 402 as ARV-L0", "for a jws offer with a did:web kid: one https fetch of that did document"], "requests": 0, "pays": false },
+      "assertion": {
+        "evaluator": "offerSignatureVerifies",
+        "describes": "the artifact's format is recognised and its signature verifies over the offer payload"
+      },
+      "normative": "SHOULD",
+      "whenNotObservable": "inconclusive",
+      "inconclusiveWhen": [
+        "the signature algorithm is not one this runner implements",
+        "the key cannot be resolved, for example a did:web document that does not answer or whose publicKeyMultibase is not multibase over multicodec 0xed01",
+        "the optional ethers dependency is absent, which is what an eip712 recovery needs"
+      ],
+      "relatedVectors": []
+    },
+    {
+      "id": "ARV-L3",
+      "key": "t3",
+      "level": 3,
+      "name": "emits a receipt that verifies",
+      "requirement": "after payment, the settlement response carries a receipt whose signature recovers to the same signer",
+      "clause": [
+        { "spec": "offer-receipt", "section": "5.1 Placement", "quote": "extensions[\"offer-receipt\"].info.receipt" },
+        { "spec": "offer-receipt", "section": "5.5 Receipt Verification" }
+      ],
+      "input": { "needs": ["a settlement response from a paid request"], "requests": 1, "pays": true },
+      "assertion": {
+        "evaluator": "receiptSignatureVerifies",
+        "describes": "a receipt is present and its signature recovers to the signer that signed the offer"
+      },
+      "normative": "SHOULD",
+      "whenNotObservable": "skip",
+      "relatedVectors": []
+    },
+    {
+      "id": "ARV-L4",
+      "key": "t4",
+      "level": 4,
+      "name": "receipt is version 2 and the salt arrives where 5.6.3 says",
+      "requirement": "payload.version is 2 with both commitment fields, and the salt is at extensions[\"offer-receipt\"].info.authorizationSalt",
+      "clause": [
+        { "spec": "offer-receipt-commitment", "section": "5.6 Authorization Commitment (receipt version 2)" },
+        { "spec": "offer-receipt-commitment", "section": "5.6.3 Salt" }
+      ],
+      "input": { "needs": ["a settlement response from a paid request"], "requests": 0, "pays": true },
+      "assertion": {
+        "evaluator": "receiptVersionTwoAndSaltPlacement",
+        "describes": "payload.version is 2, both commitment fields are present, and the salt sits outside the signed payload at the declared location"
+      },
+      "normative": "MUST",
+      "whenNotObservable": "skip",
+      "relatedVectors": []
+    },
+    {
+      "id": "ARV-L5",
+      "key": "t5",
+      "level": 5,
+      "name": "the commitment opens against the chain to exactly one settlement",
+      "requirement": "section 5.6.4 run against live chain state resolves to exactly one AuthorizationUsed nonce",
+      "clause": [
+        { "spec": "offer-receipt-commitment", "section": "5.6.4 Linking a receipt to its settlement (eip3009)" }
+      ],
+      "input": { "needs": ["a receipt", "its authorization salt", "the asset that was paid", "a chain read"], "requests": 0, "pays": true },
+      "assertion": {
+        "evaluator": "commitmentOpensOnExactlyOneNonce",
+        "describes": "recomputing the commitment over candidate AuthorizationUsed nonces opens on exactly one; zero and more than one both fail closed"
+      },
+      "normative": "MUST",
+      "whenNotObservable": "skip",
+      "relatedVectors": []
+    }
+  ]
+}

package/src/eip3009-autorisatie.mjs

@@ -0,0 +1,228 @@
+// Een onafhankelijke verifieerder voor EIP-3009 betaalautorisaties, geschreven tegen
+// de vectoren van iamonuwa/kanon en niet tegen zijn code.
+//
+// WAAROM DIT HIER STAAT, want het is de ANDERE kant van wat deze repo tot nu toe deed.
+// Alles hier ging over de VERKOPER: zijn ondertekende aanbod, zijn bonnetje, en de
+// vraag of dat bonnetje op precies een afrekening op de keten opent. Een EIP-3009
+// autorisatie is de KOPER-kant: de handtekening waarmee een agent zijn geld vrijgeeft,
+// voor er iets afgerekend is. Samen zijn dat de twee uiteinden van dezelfde transactie,
+// en ze overlappen nergens. Dat is precies waarom een tweede implementatie hier iets
+// toevoegt in plaats van iets te verdubbelen.
+//
+// DE REGEL DIE DEZE HELE REPO DRAAGT, ook hier: geschreven tegen de GEPUBLICEERDE
+// vectoren en de specificaties (EIP-3009, EIP-712), nooit tegen de broncode van de
+// referentie-implementatie. Twee implementaties die elkaars code niet gezien hebben en
+// toch op dezelfde uitslagen komen, dat is interop. Een implementatie die met zichzelf
+// instemt bewijst niets.
+//
+// DE VOLGORDE VAN DE CONTROLES IS ZELF EEN UITSPRAAK, en zij volgt uit zijn eigen
+// beschrijvingen bij de vectoren:
+//   1. netwerk (platte tekst, voor de handtekening; zijn tekst: "the plaintext mismatch")
+//   2. kneedbaarheid van de handtekening (voor het herstellen, anders herstel je een
+//      tweede geldige vorm van dezelfde handtekening)
+//   3. geldigheidsvenster
+//   4. herstellen en de ondertekenaar vergelijken
+//   5. bedrag (zijn tekst: "caught only after the signature verifies")
+//   6. nonce al verbruikt
+// Een andere volgorde geeft bij een vector met twee gebreken een andere redencode. Waar
+// wij van hem afwijken hoort dat GEMELD te worden en niet weggepoetst tot het groen is.
+//
+// ethers is optioneel in dit pakket. Zonder dat pakket kan stap 4 niet en komt de
+// uitslag terug als ONGEMETEN, nooit als afgekeurd: een gat in onze meter is geen
+// gebrek van de betaling.
+
+import { laadEthers } from './x402-conformance-treden.mjs'
+
+/** De helft van de secp256k1-groepsorde. Daarboven is een handtekening kneedbaar. */
+const HALVE_ORDE = 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0n
+
+export const REDENEN = [
+  'VALID',
+  'NETWORK_MISMATCH',
+  'SIG_MALLEABLE',
+  'SIGNER_MISMATCH',
+  'NOT_YET_VALID',
+  'EXPIRED',
+  'NONCE_REPLAY',
+  'AMOUNT_INSUFFICIENT',
+]
+
+/** De EIP-712-types van EIP-3009, normatief en niet over de lijn verzonden. */
+export const TRANSFER_TYPES = {
+  TransferWithAuthorization: [
+    { name: 'from', type: 'address' },
+    { name: 'to', type: 'address' },
+    { name: 'value', type: 'uint256' },
+    { name: 'validAfter', type: 'uint256' },
+    { name: 'validBefore', type: 'uint256' },
+    { name: 'nonce', type: 'bytes32' },
+  ],
+}
+
+/** `eip155:84532` naar 84532. Geeft null bij een vorm die wij niet kennen. */
+export function chainIdUitNetwerk(netwerk) {
+  const m = /^eip155:(\d+)$/.exec(String(netwerk ?? ''))
+  return m ? Number(m[1]) : null
+}
+
+/**
+ * Het domein waaronder deze autorisatie hoort te zijn ondertekend.
+ *
+ * Alle drie de replay-vectoren draaien hierom: wie onder een ander domein tekent
+ * (andere keten, ander contract, andere naam) levert een handtekening die op een ANDER
+ * adres herstelt. Daarom is er geen aparte controle voor cross-chain of cross-contract
+ * nodig: het domein doet dat werk, en de uitslag heet dan terecht SIGNER_MISMATCH.
+ */
+export function domeinUit(accepted) {
+  return {
+    name: accepted?.extra?.name,
+    version: accepted?.extra?.version,
+    chainId: chainIdUitNetwerk(accepted?.network),
+    verifyingContract: accepted?.asset,
+  }
+}
+
+/** Is de s-waarde van deze handtekening boven de halve groepsorde. */
+export function isKneedbaar(signature) {
+  const h = String(signature ?? '').replace(/^0x/i, '')
+  if (h.length < 130) return false
+  const s = BigInt('0x' + h.slice(64, 128))
+  return s > HALVE_ORDE
+}
+
+/**
+ * Beoordeelt een enkele autorisatie.
+ *
+ * Geeft { valid, reason_code } terug in exact de vorm die kanon se vectoren in hun
+ * `expected` gebruiken, plus `ongemeten` met een reden als de controle niet KON
+ * draaien. Die derde mogelijkheid staat niet in zijn schema, en dat is precies het
+ * punt dat wij in x402#3396 open hebben gelegd: een gat in de verifieerder is iets
+ * anders dan een afgekeurde betaling.
+ */
+export async function beoordeelAutorisatie(input, context = {}) {
+  const doelNetwerk = context.doelNetwerk ?? input?.accepted?.network
+  const accepted = input?.accepted ?? {}
+  const auth = input?.payload?.authorization ?? {}
+  const signature = input?.payload?.signature
+  const nu = Number(context.verification_time ?? Math.floor(Date.now() / 1000))
+
+  // 1. Netwerk, in platte tekst, voor er iets met de handtekening gebeurt.
+  if (String(doelNetwerk) !== String(accepted.network)) {
+    return { valid: false, reason_code: 'NETWORK_MISMATCH' }
+  }
+
+  // 2. Kneedbaarheid, voor het herstellen. Een hoge s is een tweede geldige vorm van
+  // dezelfde handtekening, en wie eerst herstelt accepteert die vorm stilletjes.
+  if (isKneedbaar(signature)) {
+    return { valid: false, reason_code: 'SIG_MALLEABLE' }
+  }
+
+  // 3. Het geldigheidsvenster.
+  if (nu < Number(auth.validAfter)) return { valid: false, reason_code: 'NOT_YET_VALID' }
+  if (nu > Number(auth.validBefore)) return { valid: false, reason_code: 'EXPIRED' }
+
+  // 4. Herstellen en de ondertekenaar vergelijken. Zonder ethers kan dit niet, en dan
+  // is de eerlijke uitslag ONGEMETEN.
+  const ethers = await laadEthers()
+  if (!ethers) {
+    return { valid: false, reason_code: null, ongemeten: true, reden: 'ethers ontbreekt, dus de handtekening is niet te herstellen' }
+  }
+  let hersteld
+  try {
+    hersteld = ethers.verifyTypedData(domeinUit(accepted), TRANSFER_TYPES, {
+      from: auth.from, to: auth.to, value: auth.value,
+      validAfter: auth.validAfter, validBefore: auth.validBefore, nonce: auth.nonce,
+    }, signature)
+  } catch (e) {
+    // Een handtekening die niet eens te herstellen is, is geen geldige ondertekenaar.
+    return { valid: false, reason_code: 'SIGNER_MISMATCH', detail: String(e?.message ?? e).slice(0, 120) }
+  }
+  if (String(hersteld).toLowerCase() !== String(auth.from).toLowerCase()) {
+    return { valid: false, reason_code: 'SIGNER_MISMATCH', hersteld }
+  }
+
+  // 5. Het bedrag, pas NA de handtekening: een authentiek ondertekende afwijking.
+  //
+  // DE STANDAARD NEEMT HIER GEEN POSITIE IN, DUS WIJ MAKEN DE KEUZE ZICHTBAAR. Twee
+  // referentie-implementaties eisen GELIJKHEID en wijzen dus ook te veel betalen af:
+  // go/mechanisms/evm/exact/facilitator/eip3009.go regel 65 (`Cmp(requiredValue) != 0`,
+  // fout ErrAuthorizationValueMismatch) en python/x402/mechanisms/evm/exact/
+  // facilitator.py regel 235 (`!=`), met op regel 168 de eigen zin "Amount exactly
+  // matches requirements.amount". Onze eerste versie liet te veel betalen toe en zou
+  // dus op dat ene geval van hen afwijken, terwijl geen enkele gepubliceerde vector
+  // het dekt. Daarom staat 'exact' nu als standaard, is 'at-least' een bewuste keuze,
+  // en draagt de uitslag ALTIJD welke van de twee gebruikt is.
+  const beleid = context.amountPolicy === 'at-least' ? 'at-least' : 'exact'
+  const betaald = BigInt(auth.value ?? 0)
+  const gevraagd = BigInt(accepted.amount ?? 0)
+  const bedragFout = beleid === 'exact' ? betaald !== gevraagd : betaald < gevraagd
+  if (bedragFout) {
+    return { valid: false, reason_code: 'AMOUNT_INSUFFICIENT', amountPolicy: beleid }
+  }
+
+  // 6. Is deze nonce al verbruikt, PER BETALER en niet over iedereen heen.
+  //
+  // EIP-3009 houdt dit zelf per adres bij: `mapping(address => mapping(bytes32 =>
+  // bool))`, en de leesfunctie heet `authorizationState(address authorizer, bytes32
+  // nonce)`. De spec zegt er bovendien bij dat nonces willekeurige 32 bytes zijn,
+  // uniek per adres, en juist geen volgnummers. Een verifieerder die EEN lijst
+  // bijhoudt zonder onderscheid naar betaler is dus STRENGER dan de keten zelf: hij
+  // zou een geldige betaling van een andere partij weigeren die toevallig dezelfde
+  // 32 bytes koos. Onze eerste versie deed precies dat.
+  //
+  // Twee vormen worden aanvaard. Een platte lijst hoort bij DEZE betaler, want zo
+  // gebruiken de gepubliceerde vectoren hem. Een object met het adres als sleutel is
+  // de nauwkeurige vorm en komt overeen met wat het token-contract doet.
+  const betaler = String(auth.from ?? '').toLowerCase()
+  const bron = context.seen_nonces
+  let gezien = []
+  if (Array.isArray(bron)) gezien = bron
+  else if (bron && typeof bron === 'object') {
+    for (const [adres, lijst] of Object.entries(bron)) {
+      if (String(adres).toLowerCase() === betaler) gezien = lijst ?? []
+    }
+  }
+  if (gezien.map((n) => String(n).toLowerCase()).includes(String(auth.nonce).toLowerCase())) {
+    return { valid: false, reason_code: 'NONCE_REPLAY' }
+  }
+
+  return { valid: true, reason_code: 'VALID', ondertekenaar: hersteld, amountPolicy: beleid }
+}
+
+/** Een hele vector beoordelen, met zijn eigen context en doelnetwerk. */
+export async function beoordeelVector(vector) {
+  return beoordeelAutorisatie(vector.input, { ...(vector.context ?? {}), doelNetwerk: vector.network })
+}
+
+// Een commandoregel, zodat een vreemde de kruiscontrole in EEN regel kan narekenen in
+// plaats van ons op ons woord te geloven. Dat is het hele punt van deze repo.
+if (process.argv[1]?.endsWith('eip3009-autorisatie.mjs')) {
+  const fs = await import('node:fs')
+  const path = await import('node:path')
+  const { fileURLToPath } = await import('node:url')
+  const map = path.join(fileURLToPath(new URL('..', import.meta.url)), 'vectors', 'kanon')
+  if (!fs.existsSync(map)) {
+    console.log('geen vectoren gevonden in ' + map)
+    process.exitCode = 2
+  } else {
+    const bestanden = fs.readdirSync(map).filter((f) => f.endsWith('.json')).sort()
+    let eens = 0, oneens = 0, ongemeten = 0
+    console.log('Cross-check against iamonuwa/kanon, EIP-3009 payment authorizations')
+    console.log('Vectors pinned at commit 0d5a7461e996, Apache-2.0, redistributed unmodified.')
+    console.log('This implementation was written against those vectors and against EIP-3009')
+    console.log('and EIP-712, never against that project\'s source.')
+    console.log('')
+    for (const f of bestanden) {
+      const v = JSON.parse(fs.readFileSync(path.join(map, f), 'utf8'))
+      const u = await beoordeelVector(v)
+      if (u.ongemeten) { ongemeten++; console.log('  not measured  ' + v.id + '  ' + u.reden); continue }
+      const zelfde = u.valid === v.expected.valid && u.reason_code === v.expected.reason_code
+      if (zelfde) { eens++; console.log('  agree         ' + v.id.padEnd(42) + ' ' + u.reason_code) }
+      else { oneens++; console.log('  DISAGREE      ' + v.id.padEnd(42) + ' ours ' + u.reason_code + ', theirs ' + v.expected.reason_code) }
+    }
+    console.log('')
+    console.log('agree on ' + eens + ' of ' + bestanden.length + ', disagree ' + oneens + ', not measured ' + ongemeten)
+    if (ongemeten) console.log('Install the optional ethers dependency to run the signature recovery.')
+    process.exitCode = oneens === 0 ? 0 : 1
+  }
+}