agent402-tollbooth 0.10.4 → 0.10.6

package/bots.js

@@ -1,7 +1,7 @@
 // Default set of AI / LLM crawler and agent user-agents to charge.
 //
 // Deliberately AI-focused: traditional search indexers (Googlebot, Bingbot,
-// DuckDuckBot) are NOT here — you almost always want classic SEO indexing to
+// DuckDuckBot) are NOT here, you almost always want classic SEO indexing to
 // stay free. Override the whole list with `botUserAgents`, or supply your own
 // `charge(req)` predicate for full control.
 export const AI_BOTS = [

package/dashboard.js

@@ -1,10 +1,10 @@
 // A tiny self-contained operator dashboard for the tollbooth, served at
 // /__tollbooth by the reverse-proxy CLI. It polls /__tollbooth/stats and shows
-// how much of your traffic is bots and what the gate is collecting — the visual
+// how much of your traffic is bots and what the gate is collecting, the visual
 // answer to "I had to upgrade my plan to serve bots I don't monetize."
 //
 // Visual rhythm mirrors agent402.tools/analytics: stat-card grid, inline-SVG
-// rolling sparkline (built client-side from poll deltas — no server changes,
+// rolling sparkline (built client-side from poll deltas, no server changes,
 // no third-party chart lib), and a window selector that changes how many
 // recent polls feed the sparkline. Pure function (no deps) so it's trivially
 // testable.
@@ -13,7 +13,7 @@ export function dashboardHtml() {
 <html lang="en"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="robots" content="noindex">
-<title>agent402-tollbooth — live stats</title>
+<title>agent402-tollbooth: live stats</title>
 <style>
   :root{--bg:#0b0e14;--card:#131826;--text:#e6e9f0;--muted:#8b93a7;--accent:#4ade80;--line:#1e2638;--mono:ui-monospace,SFMono-Regular,Menlo,monospace}
   *{box-sizing:border-box;margin:0}body{background:var(--bg);color:var(--text);font:16px/1.5 system-ui,-apple-system,sans-serif}
@@ -59,9 +59,9 @@ export function dashboardHtml() {
     <div class="row">
       <h2>Requests / poll</h2>
       <div class="meta">
-        <span>rate<b id="ratenow">—</b></span>
-        <span>peak<b id="ratepeak">—</b></span>
-        <span class="paid">paid<b id="paidnow">—</b></span>
+        <span>rate<b id="ratenow">-</b></span>
+        <span>peak<b id="ratepeak">-</b></span>
+        <span class="paid">paid<b id="paidnow">-</b></span>
       </div>
       <div class="windows" id="windows">
         <button class="w" data-n="12">1m</button>
@@ -76,23 +76,23 @@ export function dashboardHtml() {
     </svg>
   </div>
   <div class="ratios">
-    <div class="card"><div class="k">Bot share</div><div class="v" id="botpct">—</div><div class="hint">charged + would-charge</div></div>
-    <div class="card"><div class="k">Paid conversion</div><div class="v accent" id="paidpct">—</div><div class="hint">of all requests, paid (PoW or USDC)</div></div>
-    <div class="card"><div class="k">Paid in USDC</div><div class="v accent" id="usdcpct">—</div><div class="hint">of paid, settled on Base</div></div>
+    <div class="card"><div class="k">Bot share</div><div class="v" id="botpct">-</div><div class="hint">charged + would-charge</div></div>
+    <div class="card"><div class="k">Paid conversion</div><div class="v accent" id="paidpct">-</div><div class="hint">of all requests, paid (PoW or USDC)</div></div>
+    <div class="card"><div class="k">Paid in USDC</div><div class="v accent" id="usdcpct">-</div><div class="hint">of paid, settled on Base</div></div>
   </div>
   <div class="probes" id="probes">
     <h2>Operator probes</h2>
-    <div class="sub">Copy-paste curls — verify the gate is doing what these counters say.</div>
+    <div class="sub">Copy-paste curls: verify the gate is doing what these counters say.</div>
     <div class="probe">
       <div class="label"><span>Raw stats JSON (scrape this for metrics / alerts)</span><button class="copy" data-target="p1">copy</button></div>
       <pre id="p1">curl -s &lt;origin&gt;/__tollbooth/stats | jq</pre>
     </div>
     <div class="probe">
-      <div class="label"><span>Probe as a known bot — should see 402 (or pass-through in observe mode)</span><button class="copy" data-target="p2">copy</button></div>
+      <div class="label"><span>Probe as a known bot: should see 402 (or pass-through in observe mode)</span><button class="copy" data-target="p2">copy</button></div>
       <pre id="p2">curl -i -A 'GPTBot/1.0' &lt;origin&gt;/</pre>
     </div>
     <div class="probe">
-      <div class="label"><span>Probe as a browser — should be free</span><button class="copy" data-target="p3">copy</button></div>
+      <div class="label"><span>Probe as a browser: should be free</span><button class="copy" data-target="p3">copy</button></div>
       <pre id="p3">curl -i -A 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15' &lt;origin&gt;/</pre>
     </div>
     <div class="probe">
@@ -100,7 +100,7 @@ export function dashboardHtml() {
       <pre id="p4">curl -s -A 'GPTBot/1.0' &lt;origin&gt;/ | jq .</pre>
     </div>
     <div class="probe">
-      <div class="label"><span>KPI grep — single-line dashboard for a shell</span><button class="copy" data-target="p5">copy</button></div>
+      <div class="label"><span>KPI grep: a single-line dashboard for a shell</span><button class="copy" data-target="p5">copy</button></div>
       <pre id="p5">curl -s &lt;origin&gt;/__tollbooth/stats | jq '{requests, charged, powSolved, x402Paid, mppPaid}'</pre>
     </div>
   </div>
@@ -119,12 +119,12 @@ const cards=[
 ];
 // Rolling poll-delta series for the sparkline. We retain up to MAX_POINTS
 // raw deltas (one per 5s tick) and the active window selector controls how
-// many of the tail points are plotted. Built client-side — no server-side
+// many of the tail points are plotted. Built client-side, no server-side
 // timeseries store needed, and the data dies with the tab.
 var MAX_POINTS=180; // 15 minutes at one poll per 5s
 // Parallel deltas: total requests AND paid requests (PoW + USDC). Both are
 // computed off the same tick cadence so they share an x-axis and a single
-// y-scale. paidSeries is the dashed overlay — "is the bot traffic actually
+// y-scale. paidSeries is the dashed overlay, "is the bot traffic actually
 // paying, or just arriving?" at a glance, no math required.
 var series=[]; var paidSeries=[]; var lastRequests=null; var lastPaid=null; var activeWindow=60;
 function drawSpark(){
@@ -193,7 +193,7 @@ function bindWindows(){
 async function tick(){
   try{
     const s=await (await fetch("/__tollbooth/stats",{cache:"no-store"})).json();
-    // Counters are always numbers — coerce, never trust raw JSON from the
+    // Counters are always numbers, coerce, never trust raw JSON from the
     // configured stats endpoint (a compromised collector with httpStatsSink
     // could otherwise inject HTML through this innerHTML sink).
     document.getElementById("grid").innerHTML=cards.map(function(c){
@@ -203,7 +203,7 @@ async function tick(){
       var lbl=String(label).replace(/[&<>"']/g,function(ch){return({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[ch];});
       return '<div class="card"><div class="k">'+lbl+'</div><div class="v '+(acc||"")+'">'+v+'</div></div>';
     }).join("");
-    // Derived operator ratios — computed client-side so the gate stays a
+    // Derived operator ratios, computed client-side so the gate stays a
     // pure counter store. All inputs are coerced numbers (see render loop
     // above), so a malicious snapshot can't smuggle non-numerics here.
     var reqs=Number(s.requests)||0;
@@ -216,14 +216,14 @@ async function tick(){
     var paidPct=reqs?Math.round((paid/reqs)*100):0;
     document.getElementById("paidpct").textContent=paidPct+"%";
     // Paid-in-USDC share: of *paid* requests, how many settled in USDC vs PoW.
-    // Answers "are bots paying me real money, or just grinding compute?" "—"
+    // Answers "are bots paying me real money, or just grinding compute?" ", "
     // when there are no paid requests yet (avoids 0/0 NaN).
     document.getElementById("usdcpct").textContent=paid?Math.round((usd/paid)*100)+"%":"\u2014";
     document.getElementById("mode").textContent=s.observe?" \u00B7 OBSERVE":"";
     if(s.since)document.getElementById("since").textContent="since "+new Date(s.since).toLocaleString();
     // Roll the series: delta of total requests since the last tick is the
     // per-poll arrival rate. First tick seeds lastRequests/lastPaid with no
-    // plot — we need a baseline to subtract on tick #2.
+    // plot: we need a baseline to subtract on tick #2.
     var now=Number(s.requests); if(!Number.isFinite(now)) now=0;
     var nowPaid=(Number(s.powSolved)||0)+(Number(s.x402Paid)||0)+(Number(s.mppPaid)||0);
     if(lastRequests!==null){
@@ -240,7 +240,7 @@ async function tick(){
     lastPaid=nowPaid;
   }catch(e){/* keep last values */}
 }
-// Operator probes — replace the literal <origin> placeholder with the actual
+// Operator probes, replace the literal <origin> placeholder with the actual
 // host so what the operator copies is what they can run, no edit step. Done
 // once on load; probe text doesn't change after.
 function initProbes(){

package/demo.js

@@ -14,7 +14,7 @@ const lz = (buf) => { let b = 0; for (const x of buf) { if (x === 0) { b += 8; c
 // A "premium content" site, fronted by the tollbooth.
 const app = express();
 app.use(createTollbooth({ price: "$0.002", payTo: "0xYourWalletHere000000000000000000000000", powDifficulty: 18 }));
-app.use((_req, res) => res.send("📄 The Future of Machine Payments — full article text…"));
+app.use((_req, res) => res.send("📄 The Future of Machine Payments: full article text…"));
 const server = app.listen(0);
 const base = `http://localhost:${server.address().port}`;
 const visit = (ua, extra = {}) => fetch(`${base}/article`, { headers: { "user-agent": ua, ...extra } });
@@ -23,16 +23,16 @@ const HUMAN = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3
 const CRAWLER = "Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)";
 
 try {
-  log(`${c.bold}agent402-tollbooth — live pay-per-crawl demo${c.reset}`);
+  log(`${c.bold}agent402-tollbooth: live pay-per-crawl demo${c.reset}`);
   log(`${c.dim}A premium-content site is now running behind the tollbooth.${c.reset}\n`);
 
-  // 1) A human browses — free.
+  // 1) A human browses, free.
   log(`${c.cyan}① A human opens the page (normal browser)${c.reset}`);
   let r = await visit(HUMAN);
   log(`   → HTTP ${r.status} ${c.green}FREE${c.reset}  "${await r.text()}"`);
   log(`   ${c.dim}Humans are never charged.${c.reset}\n`);
 
-  // 2) An AI crawler hits the same page — 402.
+  // 2) An AI crawler hits the same page, 402.
   log(`${c.cyan}② An AI crawler hits the same page (ClaudeBot)${c.reset}`);
   r = await visit(CRAWLER);
   const q = await r.json();
@@ -48,11 +48,11 @@ try {
   while (lz(createHash("sha256").update(`${q.proofOfWork.challenge}:${nonce}`).digest()) < q.proofOfWork.difficulty) nonce++;
   log(`   ${c.dim}solved in ${((Date.now() - t0) / 1000).toFixed(2)}s (nonce=${nonce})${c.reset}`);
 
-  // 4) Retry with the solution — unlocked.
+  // 4) Retry with the solution, unlocked.
   r = await visit(CRAWLER, { "x-pow-solution": `${q.proofOfWork.token}:${nonce}` });
   log(`   → HTTP ${r.status} ${c.green}OK${c.reset} (paid via ${r.headers.get("x-tollbooth-paid")})  "${await r.text()}"\n`);
 
-  log(`${c.bold}${c.green}✓ Pay-per-crawl, end to end${c.reset} — humans free, bots pay (USDC or compute). No Cloudflare, no Stripe, no signup.`);
+  log(`${c.bold}${c.green}✓ Pay-per-crawl, end to end${c.reset}: humans free, bots pay (USDC or compute), settled to your own wallet with no signup.`);
 } finally {
   server.close();
 }

package/edge.js

@@ -1,4 +1,4 @@
-// Edge / runtime-agnostic tollbooth — the same pay-per-crawl gate, built on the
+// Edge / runtime-agnostic tollbooth, the same pay-per-crawl gate, built on the
 // Web Crypto + Fetch APIs so it runs anywhere: Cloudflare Workers, Next.js
 // middleware (edge), Deno, Bun, and Node 20+. No node:* imports.
 //
@@ -42,7 +42,7 @@ function constEq(a, b) {
  * Web Crypto proof-of-work. `secret` is required (edge runtimes can't keep a
  * random per-process secret across invocations). `store` is an optional
  * single-use replay backend: { claim(token, expMs) => bool|Promise<bool> } that
- * atomically returns true only the first time a token is seen — e.g. a Cloudflare
+ * atomically returns true only the first time a token is seen, e.g. a Cloudflare
  * KV wrapper; defaults to in-isolate memory.
  */
 export function createEdgePow({ secret, difficulty = 18, ttlMs = 5 * 60 * 1000, store } = {}) {
@@ -51,7 +51,7 @@ export function createEdgePow({ secret, difficulty = 18, ttlMs = 5 * 60 * 1000,
   const MAX = 50_000; // bound memory: edge runtimes have no timer to sweep, so prune on write
   const used = store || {
     // Atomic single-use claim. The body is synchronous (no await), so two
-    // concurrent claims of the same token cannot both win within an isolate —
+    // concurrent claims of the same token cannot both win within an isolate,
     // closing the TOCTOU that a separate has()+add() would open.
     claim: (k, exp) => {
       const e = mem.get(k);
@@ -102,7 +102,7 @@ export function createEdgePow({ secret, difficulty = 18, ttlMs = 5 * 60 * 1000,
     if (leadingZeroBits(h) < Number(diffStr)) return { ok: false, reason: "insufficient work" };
     // Atomically claim single-use only AFTER the work is validated, so an invalid
     // attempt never consumes the token and concurrent dupes can't both pass.
-    // F05: FAIL CLOSED — if the claim store is unavailable, deny rather than let
+    // F05: FAIL CLOSED, if the claim store is unavailable, deny rather than let
     // the exception propagate (or, worse, grant). Strict single-use needs an
     // atomic store (Durable Object); see worker.js durableObjectStore + the
     // wrangler template. A get-then-put KV store is best-effort only.
@@ -159,7 +159,7 @@ export function createEdgeTollbooth(config = {}) {
     // operators run the gate on a live site for a week before flipping on enforcement.
     observe = false,
     // Pluggable durable-stats sink. Default = in-memory (per-isolate, so on the
-    // edge it dies with the isolate — pass kvStatsSink(env.TOLLBOOTH_KV) for
+    // edge it dies with the isolate, pass kvStatsSink(env.TOLLBOOTH_KV) for
     // cross-isolate aggregation).
     statsSink,
     message = "This resource charges automated / AI clients per request. Humans browse free; bots pay in USDC via x402 or by solving a proof-of-work.",
@@ -181,7 +181,7 @@ export function createEdgeTollbooth(config = {}) {
   const mem = memorySink();
   const sink = statsSink || mem;
   const writeThrough = statsSink && statsSink !== mem;
-  // Stats must never break a request path — a buggy custom sink can throw
+  // Stats must never break a request path, a buggy custom sink can throw
   // synchronously; we shrug and continue.
   const incr = (k, n = 1) => {
     try { mem.incr(k, n); } catch { /* ignore */ }
@@ -189,7 +189,7 @@ export function createEdgeTollbooth(config = {}) {
   };
 
   // Heuristic only. A bot can trivially set `User-Agent: Mozilla/5.0 …` and
-  // `Accept: text/html` to pass — `strict` mode uses this as the lower bound
+  // `Accept: text/html` to pass, `strict` mode uses this as the lower bound
   // (charge anything that does NOT look like a browser), not as proof of
   // humanity. For hard guarantees use mode:"all" or `charge:` predicate.
   const looksHuman = (request) => {
@@ -212,7 +212,7 @@ export function createEdgeTollbooth(config = {}) {
     if (!shouldCharge(request)) { incr("freeAllowed"); return null; }
     if (observe) { incr("wouldCharge"); return null; }
     const u = new URL(request.url);
-    // F18: bind the canonical ORIGIN, not just path+query — otherwise a proof
+    // F18: bind the canonical ORIGIN, not just path+query, otherwise a proof
     // for /x transfers to any other site sharing the secret. On the edge the
     // request URL already carries the real origin; prefer an explicit
     // resourceBaseUrl when configured.
@@ -285,12 +285,12 @@ export function createEdgeTollbooth(config = {}) {
   }
 
   // Operator surface: in-process mirror (sync), durable snapshot (async),
-  // and an explicit flush() for edge runtimes — the Worker should call this
+  // and an explicit flush() for edge runtimes, the Worker should call this
   // inside ctx.waitUntil so buffered KV writes actually happen.
   gate.observe = observe;
   gate.stats = () => ({ ...mem.snapshot(), observe });
   gate.snapshot = async () => ({ ...(await sink.snapshot()), observe });
-  // flush() is typically wired to ctx.waitUntil — swallow errors so a sink
+  // flush() is typically wired to ctx.waitUntil, swallow errors so a sink
   // outage can't surface as an unhandled rejection after the response.
   gate.flush = async () => { try { if (sink.flush) await sink.flush(); } catch { /* ignore */ } };
   return gate;

package/index.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-// agent402-tollbooth — an open-source, self-hostable x402 "pay-per-crawl" gate.
+// agent402-tollbooth: an open-source, self-hostable x402 "pay-per-crawl" gate.
 //
 // Put it in front of any site or API: human visitors pass through free, while
-// AI crawlers / agents must pay per request — either in USDC over the x402
+// AI crawlers / agents must pay per request, either in USDC over the x402
 // protocol, or for free by solving a proof-of-work (no wallet, no signup, no
-// Stripe, no Cloudflare). Use it two ways:
+// account). Use it two ways:
 //
 //   1. Express middleware:   app.use(createTollbooth({ ... }))
 //   2. Reverse proxy (CLI):  TOLLBOOTH_UPSTREAM=https://your-site.com npx agent402-tollbooth
 //
 // The proof-of-work rail works out of the box with zero configuration. To also
 // accept USDC, set `payTo` and supply `verifyX402` (wire it to the standard
-// x402 server middleware / your facilitator — see README).
+// x402 server middleware / your facilitator, see README).
 import { realpathSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Readable } from "node:stream";
@@ -34,7 +34,7 @@ const VERIFY_TIMEOUT_MS = Number(process.env.TOLLBOOTH_VERIFY_TIMEOUT_MS) || 10_
 // P1.5 / FR4-10: a first-party `verifyX402` built from a standard @x402/express
 // payment middleware, that OWNS timeout + cancellation. The gate calls
 // verifyX402(req, opts) and puts an AbortSignal on `opts.signal` (aborted when
-// the gate's own verify timeout fires); this wrapper honors it — once the signal
+// the gate's own verify timeout fires); this wrapper honors it, once the signal
 // aborts (or its own optional backstop timeout fires) it settles the verify
 // promise immediately and reports NOT-verified, so a slow middleware can't leave
 // the gate hanging or produce a charged-then-denied result after the gate has
@@ -170,9 +170,9 @@ export function createTollbooth(config = {}) {
     replayStore,
     botUserAgents = AI_BOTS,
     // Who pays. Default "bots" = the original behavior (charge AI crawler UAs).
-    //  "all"    — charge every client except a `free()` match (UA detection is
+    //  "all":    charge every client except a `free()` match (UA detection is
     //             not a security boundary; this stops relying on it).
-    //  "strict" — charge anything that isn't a real-browser request (browser-like
+    //  "strict": charge anything that isn't a real-browser request (browser-like
     //             UA + an HTML Accept). Raises the bar on naive scrapers.
     // An explicit charge()/free() still wins over the mode.
     mode = process.env.TOLLBOOTH_MODE || "bots",
@@ -195,7 +195,7 @@ export function createTollbooth(config = {}) {
     resourceBaseUrl = process.env.TOLLBOOTH_RESOURCE_BASE || "",
     // Adaptive proof-of-work: raise difficulty as charged-request load climbs, so
     // high-volume abuse pays escalating CPU regardless of how it disguises itself.
-    // Off by default — behavior is unchanged unless explicitly enabled.
+    // Off by default, behavior is unchanged unless explicitly enabled.
     adaptive = config.adaptive ?? (process.env.TOLLBOOTH_ADAPTIVE === "true"),
     adaptivePerBit = Number(process.env.TOLLBOOTH_ADAPTIVE_PER_BIT) || 300, // +1 bit per N charged req/min
     maxDifficulty,
@@ -243,14 +243,14 @@ export function createTollbooth(config = {}) {
     return true;
   };
 
-  // Passive analytics — never affects request handling, just counts what happens.
+  // Passive analytics, never affects request handling, just counts what happens.
   // `mem` is an always-on in-process mirror so `.stats()` stays synchronous for
   // single-process Node deployments. A durable `statsSink` (KV/HTTP) is written
   // through alongside and is the source of truth for `.snapshot()`.
   const mem = memorySink();
   const sink = statsSink || mem;
   const writeThrough = statsSink && statsSink !== mem;
-  // Never let a buggy custom sink throw inside the request path — stats are
+  // Never let a buggy custom sink throw inside the request path, stats are
   // non-critical and must not be able to break a payment decision.
   const incr = (k, n = 1) => {
     try { mem.incr(k, n); } catch { /* ignore */ }
@@ -396,7 +396,7 @@ export function createTollbooth(config = {}) {
         // live 2026-08-20: a yParity-style v byte the node normalizes makes
         // the relay's post-broadcast hash check fail a payment that SETTLED;
         // the buyer retried into a double charge). Ask the chain whether this
-        // credential's own transaction landed before discarding the response —
+        // credential's own transaction landed before discarding the response,
         // exact txid derivation from the signed bytes, verification never a
         // re-broadcast, fails closed to the 402. See tempo.js.
         const check = tempoCfg.confirmSettlement || ((c) => confirmTempoSettlement(c, { rpcUrl: tempoCfg.confirmRpcUrl, fetchImpl: tempoCfg.fetch }));
@@ -602,7 +602,7 @@ export function createTollbooth(config = {}) {
   // .stats() is sync (in-process mirror). .snapshot() is async (durable sink).
   tollbooth.stats = () => ({ ...mem.snapshot(), difficultyNow: difficultyNow(), observe });
   tollbooth.snapshot = async () => ({ ...(await sink.snapshot()), difficultyNow: difficultyNow(), observe });
-  // Swallow flush errors — flush() is typically wired to ctx.waitUntil on the
+  // Swallow flush errors, flush() is typically wired to ctx.waitUntil on the
   // edge; an unhandled rejection there pollutes logs without affecting the
   // already-sent response.
   tollbooth.flush = async () => { try { if (sink.flush) await sink.flush(); } catch { /* ignore */ } };
@@ -617,7 +617,7 @@ export function createProxy(upstream, { maxBody = 10 * 1024 * 1024 } = {}) {
   return async (req, res) => {
     try {
       // Take ONLY the path+query from the (possibly hostile) target; the
-      // authority is always the operator's upstream — protocol-relative or
+      // authority is always the operator's upstream, protocol-relative or
       // absolute-form targets cannot redirect us to another host.
       const reqUrl = new URL(req.originalUrl || req.url || "/", base);
       const target = new URL(reqUrl.pathname + reqUrl.search, base);
@@ -769,7 +769,7 @@ async function startCli() {
   const port = rawPort !== "" && Number.isInteger(Number(rawPort)) && Number(rawPort) >= 0 ? Number(rawPort) : 4021;
   const _secret = process.env.TOLLBOOTH_SECRET;
   if (!_secret) {
-    console.warn("⚠ TOLLBOOTH_SECRET not set — proof-of-work tokens use a random per-process secret: they won't survive a restart and will be rejected across multiple workers/instances. Set a stable TOLLBOOTH_SECRET in production.");
+    console.warn("⚠ TOLLBOOTH_SECRET not set: proof-of-work tokens use a random per-process secret: they won't survive a restart and will be rejected across multiple workers/instances. Set a stable TOLLBOOTH_SECRET in production.");
   } else if (/^change-me/i.test(_secret) || _secret === "change-me-to-a-long-random-string") {
     // FATAL, not a warning. The placeholder is published in our own deploy
     // template, so anyone can read it, mint a token with difficulty 0 and walk
@@ -834,18 +834,18 @@ async function startCli() {
   const app = express();
   const x402mw = await buildCliX402Middleware();
   const gate = createTollbooth({ resourceBaseUrl: process.env.TOLLBOOTH_RESOURCE_BASE || upstream || "", replayStore, ...(x402mw ? { x402: x402mw } : {}) });
-  // Operator analytics — aggregate counts only (no per-request data), mounted
+  // Operator analytics, aggregate counts only (no per-request data), mounted
   // before the gate so they're always reachable and never themselves charged.
   // Two opt-in admin tokens (legacy `TOLLBOOTH_STATS_TOKEN` covers /stats only;
   // `TOLLBOOTH_ADMIN_TOKEN` covers both the HTML dashboard AND /stats). If
-  // neither is set the surfaces remain public (aggregate counts only — current
+  // neither is set the surfaces remain public (aggregate counts only, current
   // behavior) so existing deploys don't break. Comparison is timing-safe.
   const { dashboardHtml } = await import("./dashboard.js");
   const { timingSafeEqual } = await import("node:crypto");
   const ADMIN_TOKEN = process.env.TOLLBOOTH_ADMIN_TOKEN || "";
   const STATS_TOKEN = process.env.TOLLBOOTH_STATS_TOKEN || "";
   if (!ADMIN_TOKEN) {
-    console.warn("⚠ TOLLBOOTH_ADMIN_TOKEN not set — the /__tollbooth analytics dashboard is publicly reachable (aggregate counts only, no per-request/payer data). Set TOLLBOOTH_ADMIN_TOKEN to require a token.");
+    console.warn("⚠ TOLLBOOTH_ADMIN_TOKEN not set: the /__tollbooth analytics dashboard is publicly reachable (aggregate counts only, no per-request/payer data). Set TOLLBOOTH_ADMIN_TOKEN to require a token.");
   }
   const presented = (req) => {
     const auth = req.headers["authorization"];
@@ -855,7 +855,7 @@ async function startCli() {
     return "";
   };
   // tokenMatch returns true only on a real, timing-safe equal match. An empty
-  // `expected` is treated as "no rule configured", NOT as a wildcard — callers
+  // `expected` is treated as "no rule configured", NOT as a wildcard, callers
   // upstream decide whether to invoke this check at all.
   const tokenMatch = (expected, got) => {
     if (!expected || typeof got !== "string" || got.length !== expected.length) return false;
@@ -894,7 +894,7 @@ async function startCli() {
     const rails = [gate.pow ? "proof-of-work" : "", paidLabel].filter(Boolean).join(" + ");
     // The BOUND port, so PORT=0 (let the OS pick) prints something a caller can use.
     const bound = server.address()?.port ?? port;
-    console.log(`agent402-tollbooth listening on :${bound} — charging AI bots via ${rails || "proof-of-work"}`);
+    console.log(`agent402-tollbooth listening on :${bound}, charging AI bots via ${rails || "proof-of-work"}`);
     if (upstream) console.log(`  proxying → ${upstream}`);
   });
   // Evidence for a process that leaves without being told to. Four times

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent402-tollbooth",
-  "version": "0.10.4",
-  "description": "Agent402 tollbooth: open-source, self-hostable pay-per-crawl for x402 AND MPP (the sell side of Agentic Finance): charge AI bots per request (USDC via x402, or MPP - the Machine Payments Protocol - through the same settlement, or USDG on Robinhood Chain, or free proof-of-work) while humans browse free. Drop-in Express middleware or reverse proxy that settles both wires from env alone - no Cloudflare, no Stripe, no signup.",
+  "version": "0.10.6",
+  "description": "Agent402 tollbooth: open-source, self-hostable pay-per-crawl for x402 AND MPP (the sell side of Agentic Finance): charge AI bots per request (USDC via x402, or MPP - the Machine Payments Protocol - through the same settlement, or USDG on Robinhood Chain, or free proof-of-work) while humans browse free. Drop-in Express middleware or reverse proxy that settles both wires from env alone, on your own server with no account or signup.",
   "type": "module",
   "main": "index.js",
   "bin": {

package/pow.js

@@ -1,5 +1,5 @@
 // Self-contained proof-of-work for the tollbooth: a no-wallet payment rail.
-// A client without USDC proves it spent real CPU instead — the same scheme
+// A client without USDC proves it spent real CPU instead, the same scheme
 // Agent402 uses, packaged standalone so the tollbooth has zero crypto deps.
 //
 // Tokens are HMAC-signed by this process (stateless to issue), bound to the

package/sinks.js

@@ -1,17 +1,17 @@
-// Pluggable stats sinks for the tollbooth — turn the in-memory counter into
+// Pluggable stats sinks for the tollbooth, turn the in-memory counter into
 // something that survives restart and aggregates across processes / isolates.
 //
 // A sink is just:
 //   {
 //     incr(field, n=1)   // fire-and-forget; sync from the gate's perspective
-//     flush()            // optional — run at end of request via ctx.waitUntil
+//     flush()            // optional, run at end of request via ctx.waitUntil
 //     snapshot()         // returns the aggregated counts as { field: number, ... }
 //   }
 //
 // Shipped sinks:
-//   memorySink()                       — default, in-process, zero config.
-//   kvStatsSink(kv, opts)              — Cloudflare KV (append-only, eventually consistent).
-//   httpStatsSink(url, opts)           — POST batched deltas to any collector.
+//   memorySink():                       default, in-process, zero config.
+//   kvStatsSink(kv, opts), Cloudflare KV (append-only, eventually consistent).
+//   httpStatsSink(url, opts), POST batched deltas to any collector.
 //
 // Want strong consistency on Cloudflare? Back it with a Durable Object that
 // implements the same { incr, snapshot } interface and pass it as `statsSink`.
@@ -22,7 +22,7 @@ const ZERO = () => Object.fromEntries(KNOWN_FIELDS.map((k) => [k, 0]));
 // Filter an untrusted JSON blob (KV value or HTTP collector response) to only
 // the known numeric counters. Prevents a compromised store from injecting
 // arbitrary keys or non-numeric values that downstream renderers (e.g.
-// dashboard.js) might treat as HTML. Defense in depth — the dashboard also
+// dashboard.js) might treat as HTML. Defense in depth, the dashboard also
 // coerces, but trim at the boundary.
 const sanitize = (obj) => {
   const out = ZERO();
@@ -56,7 +56,7 @@ export function memorySink() {
  *    delta becomes a KV write. Without that, deltas stay in isolate memory
  *    and die with the isolate.
  *  - KV has no atomic increment, so we never RMW a shared counter. Each
- *    flush writes a brand-new key (unique id + ts) — concurrent isolates
+ *    flush writes a brand-new key (unique id + ts), concurrent isolates
  *    can't lose each other's deltas. Snapshot sums every key under the prefix.
  *  - Tradeoff: snapshot reads list+get every key, which is fine for low traffic
  *    (deltas batched per request) but expensive for very high traffic. For
@@ -105,7 +105,7 @@ export function kvStatsSink(kv, { bucket = "default", ttlSeconds = 60 * 60 * 24
 
 /**
  * HTTP-backed sink. Batched POSTs of `{ incr: { field: n, ... }, ts }`.
- * GET on the same URL returns the aggregated snapshot — wire that up on your
+ * GET on the same URL returns the aggregated snapshot, wire that up on your
  * collector (a tiny Vercel route hander, an Express app, anything).
  *
  *   incr(): buffers locally and schedules a flush via setTimeout (Node) or
@@ -163,7 +163,7 @@ export function httpStatsSink(url, { token, batchMs = 2000, fetchImpl, allowInse
           signal: AbortSignal.timeout(5000),
         });
         if (!r.ok) return ZERO();
-        // Sanitize at the trust boundary — a compromised or misconfigured
+        // Sanitize at the trust boundary, a compromised or misconfigured
         // collector cannot inject non-numeric values or extra keys that the
         // dashboard would render as HTML.
         return sanitize(await r.json());

package/tempo.js

@@ -248,7 +248,7 @@ export function tempoProblem(kind, detail) {
 }
 
 // ---------------------------------------------------------------------------
-// Chain-truth confirm on broadcast failure (2026-08-20) — the relay's verdict
+// Chain-truth confirm on broadcast failure (2026-08-20), the relay's verdict
 // and the chain's truth can diverge: a buyer whose packed signature ends with
 // a yParity-style v byte (0x00/0x01) gets normalized to 27/28 by the Tempo
 // node, so the canonical txid stops matching keccak(submitted bytes) and the
@@ -256,9 +256,9 @@ export function tempoProblem(kind, detail) {
 // that SETTLED (measured live: two double charges in one buy attempt).
 // Before answering 402, ask the chain whether this credential's OWN
 // transaction landed. The txid commits to the signed bytes, so the candidates
-// are exact — the submitted form and its v-swapped twin — never a time-window
+// are exact, the submitted form and its v-swapped twin, never a time-window
 // or payer heuristic. Fails closed on every uncertainty. Dependency-free like
-// the rest of this file: keccak-256 is implemented below (BigInt lanes — it
+// the rest of this file: keccak-256 is implemented below (BigInt lanes, it
 // runs at most once per FAILED broadcast, so speed is irrelevant) and pinned
 // against standard vectors plus the live incident transaction in the tests.
 // ---------------------------------------------------------------------------
@@ -290,7 +290,7 @@ function keccakF(A) {
 }
 
 /** keccak-256 of a Buffer, as a 0x hex string. Original Keccak padding
- *  (0x01 … 0x80), NOT SHA-3's 0x06 — Ethereum txids use the former. */
+ *  (0x01 … 0x80), NOT SHA-3's 0x06, Ethereum txids use the former. */
 export function keccak256Hex(buf) {
   const rate = 136;
   const padded = Buffer.alloc(Math.ceil((buf.length + 1) / rate) * rate);
@@ -309,7 +309,7 @@ export function keccak256Hex(buf) {
 
 /** The txids this signed Tempo transaction could have landed under: the
  *  submitted bytes, plus (when the envelope verifiably ends with the 65-byte
- *  packed signature — RLP string header 0xb841 at the right offset) the
+ *  packed signature, RLP string header 0xb841 at the right offset) the
  *  v-swapped twin: yParity (0/1) <-> legacy (27/28). */
 export function candidateTxIds(signedTx) {
   const hex = String(signedTx || "").toLowerCase();

package/worker.js

@@ -1,4 +1,4 @@
-// Cloudflare Worker entry for the tollbooth — open-source pay-per-crawl on the
+// Cloudflare Worker entry for the tollbooth, open-source pay-per-crawl on the
 // edge. Deploy in front of your origin: humans pass through, AI crawlers pay
 // (USDC via x402, or free proof-of-work).
 //
@@ -16,7 +16,7 @@
 import { createEdgeTollbooth, kvStatsSink } from "./edge.js";
 import { dashboardHtml } from "./dashboard.js";
 
-// Constant-time string compare — Cloudflare Workers don't ship node:crypto's
+// Constant-time string compare, Cloudflare Workers don't ship node:crypto's
 // timingSafeEqual. Short-circuiting `===` on a secret token leaks length and
 // prefix bits to a sufficiently patient attacker; this doesn't.
 function constEq(a, b) {
@@ -29,7 +29,7 @@ function constEq(a, b) {
 
 const kvStore = (kv) => ({
   // Best-effort claim. KV has no native compare-and-set, so this is get-then-put
-  // (eventually consistent) — concurrent dupes across isolates/locations can
+  // (eventually consistent), concurrent dupes across isolates/locations can
   // both observe "unseen" and both pass. For STRICT single-use use the Durable
   // Object store below. Returns true only the first time a token is seen.
   claim: async (k, expMs) => {
@@ -40,7 +40,7 @@ const kvStore = (kv) => ({
 });
 
 // F05: strict single-use replay claim via a Durable Object. A DO instance is
-// single-threaded — every request addressed to one DO id is serialized — so the
+// single-threaded: every request addressed to one DO id is serialized, so the
 // get-then-put INSIDE it is ATOMIC across all isolates and locations (KV is
 // eventually consistent and has no compare-and-set). Each token is routed to its
 // own DO id, so claims only ever contend on the exact token they concern.
@@ -52,7 +52,7 @@ export class TollboothReplay {
     const already = await this.state.storage.get("claimed");
     if (already != null) return Response.json({ granted: false });
     await this.state.storage.put("claimed", 1);
-    // Auto-expire the DO storage at the token's expiry — the token is worthless
+    // Auto-expire the DO storage at the token's expiry, the token is worthless
     // after that, so the claim record can be dropped and storage stays bounded.
     if (expMs > Date.now()) { try { await this.state.storage.setAlarm(expMs); } catch { /* */ } }
     return Response.json({ granted: true });
@@ -82,7 +82,7 @@ export default {
     // FR4-04: FAIL CLOSED in enforcing mode without an ATOMIC replay store. A
     // Durable Object (TOLLBOOTH_REPLAY) gives strict single-use across isolates
     // and locations. KV is eventually consistent (get-then-put, NOT atomic), so
-    // concurrent duplicate PoW solutions can both pass — a warning does not
+    // concurrent duplicate PoW solutions can both pass, a warning does not
     // protect a production deployment. Refuse to enforce on a non-atomic (or
     // absent) store unless the operator sets an explicit, loud insecure override.
     const allowNonAtomic = env.TOLLBOOTH_ALLOW_NON_ATOMIC_REPLAY === "true";
@@ -97,12 +97,12 @@ export default {
       replayStore = durableObjectStore(env.TOLLBOOTH_REPLAY);
     } else if (env.TOLLBOOTH_KV) {
       replayStore = kvStore(env.TOLLBOOTH_KV);
-      if (enforcing) console.warn("agent402-tollbooth: ENFORCING on eventually-consistent KV via explicit TOLLBOOTH_ALLOW_NON_ATOMIC_REPLAY override (get-then-put is NOT atomic — concurrent duplicate solutions across isolates/locations can both pass). Bind a Durable Object as TOLLBOOTH_REPLAY for strict single-use.");
+      if (enforcing) console.warn("agent402-tollbooth: ENFORCING on eventually-consistent KV via explicit TOLLBOOTH_ALLOW_NON_ATOMIC_REPLAY override (get-then-put is NOT atomic: concurrent duplicate solutions across isolates/locations can both pass). Bind a Durable Object as TOLLBOOTH_REPLAY for strict single-use.");
     } else if (enforcing) {
-      console.warn("agent402-tollbooth: ENFORCING with NO replay store via explicit TOLLBOOTH_ALLOW_NON_ATOMIC_REPLAY override — proof-of-work replay protection is per-isolate only. Bind a Durable Object for production.");
+      console.warn("agent402-tollbooth: ENFORCING with NO replay store via explicit TOLLBOOTH_ALLOW_NON_ATOMIC_REPLAY override: proof-of-work replay protection is per-isolate only. Bind a Durable Object for production.");
     }
     // Durable stats live in KV if a namespace is bound. Without it, the dashboard
-    // is per-isolate (dies on cold start) — fine for dev, useless for prod.
+    // is per-isolate (dies on cold start), fine for dev, useless for prod.
     const statsSink = env.TOLLBOOTH_KV
       ? kvStatsSink(env.TOLLBOOTH_KV, { bucket: env.TOLLBOOTH_STATS_BUCKET || "default" })
       : undefined;
@@ -119,14 +119,14 @@ export default {
     });
 
     // Free, never-gated operator endpoints. Mounted BEFORE the gate so they
-    // can't be paywalled — and so the dashboard polls work even when the rest
+    // can't be paywalled, and so the dashboard polls work even when the rest
     // of the origin is fully gated.
     const u = new URL(request.url);
     if (u.pathname === "/__tollbooth" || u.pathname === "/__tollbooth/") {
       return new Response(dashboardHtml(), { headers: { "content-type": "text/html; charset=utf-8" } });
     }
     if (u.pathname === "/__tollbooth/stats") {
-      // Optional bearer-token gate — share with your monitoring caller. We
+      // Optional bearer-token gate, share with your monitoring caller. We
       // recommend setting this in any prod deploy: without it, anyone on the
       // internet can read aggregate counts (no per-request data, but still
       // potentially sensitive competitive info).
@@ -139,7 +139,7 @@ export default {
     }
 
     const blocked = await gate(request);
-    // Flush any buffered stats to KV after we've replied — survives the response.
+    // Flush any buffered stats to KV after we've replied, survives the response.
     if (ctx && typeof ctx.waitUntil === "function") ctx.waitUntil(gate.flush());
     if (blocked) return blocked;