mppx 0.6.13 → 0.6.15

package/src/client/internal/Fetch.test.ts

@@ -1,4 +1,4 @@
-import { Receipt } from 'mppx'
+import { Errors, Receipt } from 'mppx'
 import { tempo } from 'mppx/client'
 import { Mppx as Mppx_server, tempo as tempo_server } from 'mppx/server'
 import { createClient, defineChain } from 'viem'
@@ -335,14 +335,15 @@ const noopMethod = {
 } as any
 
 /** Builds a valid 402 response with a WWW-Authenticate header. */
-function make402(overrides?: { method?: string; intent?: string }) {
+function make402(overrides?: { expires?: string; intent?: string; method?: string }) {
   const method = overrides?.method ?? 'test'
   const intent = overrides?.intent ?? 'test'
+  const expires = overrides?.expires ? `, expires="${overrides.expires}"` : ''
   const request = btoa(JSON.stringify({ amount: '1' }))
     .replace(/\+/g, '-')
     .replace(/\//g, '_')
     .replace(/=+$/, '')
-  const header = `Payment id="abc", realm="test", method="${method}", intent="${intent}", request="${request}"`
+  const header = `Payment id="abc", realm="test", method="${method}", intent="${intent}", request="${request}"${expires}`
   return new Response(null, {
     status: 402,
     headers: { 'WWW-Authenticate': header },
@@ -603,6 +604,24 @@ describe('Fetch.from: init passthrough (non-402)', () => {
 })
 
 describe('Fetch.from: 402 retry path', () => {
+  test('rejects expired challenges before hooks or credential creation', async () => {
+    const createCredential = vi.fn(async () => 'credential')
+    const onChallenge = vi.fn(async () => undefined)
+    const mockFetch = vi.fn(async () =>
+      make402({ expires: new Date(Date.now() - 60_000).toISOString() }),
+    )
+    const fetch = Fetch.from({
+      fetch: mockFetch as typeof globalThis.fetch,
+      methods: [{ ...noopMethod, createCredential }],
+      onChallenge,
+    })
+
+    await expect(fetch('https://example.com/api')).rejects.toThrow(Errors.PaymentExpiredError)
+    expect(onChallenge).not.toHaveBeenCalled()
+    expect(createCredential).not.toHaveBeenCalled()
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+  })
+
   test('strips context from init on retry', async () => {
     const calls: { init: RequestInit | undefined }[] = []
     let callCount = 0

package/src/client/internal/Fetch.ts

@@ -1,4 +1,5 @@
 import * as Challenge from '../../Challenge.js'
+import * as Expires from '../../Expires.js'
 import * as AcceptPayment from '../../internal/AcceptPayment.js'
 import type * as Method from '../../Method.js'
 import type * as z from '../../zod.js'
@@ -80,6 +81,7 @@ export function from<const methods extends readonly Method.AnyClient[]>(
       )
 
     const { challenge, method: mi } = selected
+    if (challenge.expires) Expires.assert(challenge.expires, challenge.id)
 
     const onChallengeCredential = onChallenge
       ? await onChallenge(challenge, {

package/src/mcp-sdk/client/McpClient.test.ts

@@ -2,11 +2,12 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js'
 import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
 import { McpError } from '@modelcontextprotocol/sdk/types.js'
-import { Challenge, Mcp as core_Mcp } from 'mppx'
+import { Challenge, Credential, Errors, Mcp as core_Mcp, Method } from 'mppx'
 import { tempo as tempo_client } from 'mppx/client'
 import { Mppx as Mppx_server, tempo as tempo_server } from 'mppx/server'
+import { Methods } from 'mppx/tempo'
 import { createClient } from 'viem'
-import { afterEach, beforeEach, describe, expect, test } from 'vp/test'
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vp/test'
 import { accounts, asset, chain, http, client as testClient } from '~test/tempo/viem.js'
 
 import * as McpServer_transport from '../server/Transport.js'
@@ -187,6 +188,42 @@ describe('McpClient.wrap', () => {
       'No compatible payment method. Server offers: unknown_method.charge. Client has: tempo.charge',
     )
   })
+
+  test('behavior: rejects expired challenges before creating credential', async () => {
+    const challenge = Challenge.fromMethod(Methods.charge, {
+      realm,
+      secretKey,
+      expires: new Date(Date.now() - 60_000).toISOString(),
+      request: {
+        amount: '1',
+        currency: asset,
+        decimals: 6,
+        recipient: accounts[0].address,
+      },
+    })
+
+    server.registerTool('expired_tool', { description: 'Tool' }, async () => {
+      throw new McpError(core_Mcp.paymentRequiredCode, 'Payment Required', {
+        httpStatus: 402,
+        challenges: [challenge],
+      })
+    })
+
+    const createCredential = vi.fn(async ({ challenge }) =>
+      Credential.serialize({
+        challenge,
+        payload: { signature: '0xsignature', type: 'transaction' },
+      }),
+    )
+    const mcp = McpClient.wrap(client, {
+      methods: [Method.toClient(Methods.charge, { createCredential })],
+    })
+
+    await expect(mcp.callTool({ name: 'expired_tool', arguments: {} })).rejects.toThrow(
+      Errors.PaymentExpiredError,
+    )
+    expect(createCredential).not.toHaveBeenCalled()
+  })
 })
 
 describe('isPaymentRequiredError', () => {

package/src/mcp-sdk/client/McpClient.ts

@@ -3,6 +3,7 @@ import type { McpError } from '@modelcontextprotocol/sdk/types.js'
 
 import type * as Challenge from '../../Challenge.js'
 import * as Credential from '../../Credential.js'
+import * as Expires from '../../Expires.js'
 import * as AcceptPayment from '../../internal/AcceptPayment.js'
 import * as core_Mcp from '../../Mcp.js'
 import type * as Method from '../../Method.js'
@@ -186,6 +187,8 @@ async function createCredential<methods extends readonly Method.AnyClient[]>(
       `No method found for "${challenge.method}.${challenge.intent}". Available: ${methods.map((m) => `${m.name}.${m.intent}`).join(', ')}`,
     )
 
+  if (challenge.expires) Expires.assert(challenge.expires, challenge.id)
+
   const parsedContext = mi.context && context !== undefined ? mi.context.parse(context) : undefined
   return mi.createCredential(
     parsedContext !== undefined ? { challenge, context: parsedContext } : ({ challenge } as never),

package/src/middlewares/express.test.ts

@@ -253,6 +253,33 @@ describe('session', () => {
 })
 
 describe('payment', () => {
+  test('short-circuits management responses', async () => {
+    let handlerRan = false
+    const managementResponse = new Response(null, {
+      status: 204,
+      headers: { 'Payment-Receipt': 'management-receipt' },
+    })
+    const intent = () => async () => ({
+      status: 200 as const,
+      withReceipt: () => managementResponse,
+    })
+
+    const app = express()
+    app.get('/', payment(intent as any, {} as any), (_req, res) => {
+      handlerRan = true
+      res.json({ data: 'content' })
+    })
+
+    const server = await createServer(app)
+    const response = await globalThis.fetch(server.url)
+    expect(response.status).toBe(204)
+    expect(response.headers.get('Payment-Receipt')).toBe('management-receipt')
+    expect(await response.text()).toBe('')
+    expect(handlerRan).toBe(false)
+
+    server.close()
+  })
+
   test('returns 402 when no credential', async () => {
     const { mppx } = createCoreChargeHarness(false)
 

package/src/middlewares/express.ts

@@ -76,6 +76,30 @@ export function payment<const intent extends Mppx_internal.AnyMethodFn>(
       return
     }
 
+    const managementResponse = (() => {
+      try {
+        return (result.withReceipt as () => Response)()
+      } catch (error) {
+        if (
+          error instanceof Error &&
+          error.message === 'withReceipt() requires a response argument'
+        )
+          return null
+        throw error
+      }
+    })()
+
+    if (managementResponse) {
+      res.status(managementResponse.status)
+      for (const [key, value] of managementResponse.headers) res.setHeader(key, value)
+      if (managementResponse.body === null) {
+        res.end()
+        return
+      }
+      res.send(Buffer.from(await managementResponse.arrayBuffer()))
+      return
+    }
+
     const originalJson = res.json.bind(res)
     res.json = (body: any) => {
       const wrapped = result.withReceipt(Response.json(body))

package/src/stripe/server/internal/html/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@stripe/stripe-js": "9.1.0",
+    "@stripe/stripe-js": "9.3.1",
     "mppx": "workspace:*"
   }
 }

package/src/stripe/server/internal/html.gen.ts

@@ -1,2 +1,2 @@
 // Generated — do not edit.
-export const html = "<script>(function(){var e=(e,t)=>()=>(e&&(t=e(e=0)),t),t=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),n=t((e=>{Object.defineProperty(e,`__esModule`,{value:!0});function t(e){\"@babel/helpers - typeof\";return t=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},t(e)}var n=`dahlia`,r=function(e){return e===3?`v3`:e},i=`https://js.stripe.com`,a=`${i}/${n}/stripe.js`,o=/^https:\\/\\/js\\.stripe\\.com\\/v3\\/?(\\?.*)?$/,s=/^https:\\/\\/js\\.stripe\\.com\\/(v3|[a-z]+)\\/stripe\\.js(\\?.*)?$/,c=`loadStripe.setLoadParameters was called but an existing Stripe.js script already exists in the document; existing script parameters will be used`,l=function(e){return o.test(e)||s.test(e)},u=function(){for(var e=document.querySelectorAll(`script[src^=\"${i}\"]`),t=0;t<e.length;t++){var n=e[t];if(l(n.src))return n}return null},d=function(e){var t=e&&!e.advancedFraudSignals?`?advancedFraudSignals=false`:``,n=document.createElement(`script`);n.src=`${a}${t}`;var r=document.head||document.body;if(!r)throw Error(`Expected document.body not to be null. Stripe.js requires a <body> element.`);return r.appendChild(n),n},ee=function(e,t){!e||!e._registerWrapper||e._registerWrapper({name:`stripe-js`,version:`9.1.0`,startTime:t})},f=null,p=null,m=null,h=function(e){return function(t){e(Error(`Failed to load Stripe.js`,{cause:t}))}},te=function(e,t){return function(){window.Stripe?e(window.Stripe):t(Error(`Stripe.js not available`))}},g=function(e){return f===null?(f=new Promise(function(t,n){if(typeof window>`u`||typeof document>`u`){t(null);return}if(window.Stripe&&e&&console.warn(c),window.Stripe){t(window.Stripe);return}try{var r=u();if(r&&e)console.warn(c);else if(!r)r=d(e);else if(r&&m!==null&&p!==null){var i;r.removeEventListener(`load`,m),r.removeEventListener(`error`,p),(i=r.parentNode)==null||i.removeChild(r),r=d(e)}m=te(t,n),p=h(n),r.addEventListener(`load`,m),r.addEventListener(`error`,p)}catch(e){n(e);return}}),f.catch(function(e){return f=null,Promise.reject(e)})):f},_=function(e,i,a){if(e===null)return null;var o=i[0];if(typeof o!=`string`)throw Error(`Expected publishable key to be of type string, got type ${t(o)} instead.`);var s=o.match(/^pk_test/),c=r(e.version),l=n;s&&c!==l&&console.warn(`Stripe.js@${c} was loaded on the page, but @stripe/stripe-js@9.1.0 expected Stripe.js@${l}. This may result in unexpected behavior. For more information, see https://docs.stripe.com/sdks/stripejs-versioning`);var u=e.apply(void 0,i);return ee(u,a),u},v=function(e){var n=`invalid load parameters; expected object of shape\n\n    {advancedFraudSignals: boolean}\n\nbut received\n\n    ${JSON.stringify(e)}\n`;if(e===null||t(e)!==`object`)throw Error(n);if(Object.keys(e).length===1&&typeof e.advancedFraudSignals==`boolean`)return e;throw Error(n)},y,b=!1,x=function(){for(var e=arguments.length,t=Array(e),n=0;n<e;n++)t[n]=arguments[n];b=!0;var r=Date.now();return g(y).then(function(e){return _(e,t,r)})};x.setLoadParameters=function(e){if(b&&y){var t=v(e);if(Object.keys(t).reduce(function(t,n){return t&&e[n]===y?.[n]},!0))return}if(b)throw Error(`You cannot change load parameters after calling loadStripe`);y=v(e)},e.loadStripe=x})),r=t(((e,t)=>{t.exports=n()})),i,a=e((()=>{i=`0.1.1`}));function o(){return i}var s=e((()=>{a()}));function c(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause?c(e.cause,t):t?null:e}var l,u=e((()=>{s(),l=class e extends Error{static setStaticOptions(t){e.prototype.docsOrigin=t.docsOrigin,e.prototype.showVersion=t.showVersion,e.prototype.version=t.version}constructor(t,n={}){let r=(()=>{if(n.cause instanceof e){if(n.cause.details)return n.cause.details;if(n.cause.shortMessage)return n.cause.shortMessage}return n.cause&&`details`in n.cause&&typeof n.cause.details==`string`?n.cause.details:n.cause?.message?n.cause.message:n.details})(),i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=n.docsOrigin??e.prototype.docsOrigin,o=`${a}${i??``}`,s=!!(n.version??e.prototype.showVersion),c=n.version??e.prototype.version,l=[t||`An error occurred.`,...n.metaMessages?[``,...n.metaMessages]:[],...r||i||s?[``,r?`Details: ${r}`:void 0,i?`See: ${o}`:void 0,s?`Version: ${c}`:void 0]:[]].filter(e=>typeof e==`string`).join(`\n`);super(l,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,`details`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docs`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docsOrigin`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docsPath`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`shortMessage`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`showVersion`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`version`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`cause`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.cause=n.cause,this.details=r,this.docs=o,this.docsOrigin=a,this.docsPath=i,this.shortMessage=t,this.showVersion=s,this.version=c}walk(e){return c(this,e)}},Object.defineProperty(l,`defaultStaticOptions`,{enumerable:!0,configurable:!0,writable:!0,value:{docsOrigin:`https://oxlib.sh`,showVersion:!1,version:`ox@${o()}`}}),l.setStaticOptions(l.defaultStaticOptions)}));function d(e,t){if(v(e)>t)throw new b({givenSize:v(e),maxSize:t})}function ee(e,t={}){let{dir:n,size:r=32}=t;if(r===0)return e;if(e.length>r)throw new x({size:e.length,targetSize:r,type:`Bytes`});let i=new Uint8Array(r);for(let t=0;t<r;t++){let a=n===`right`;i[a?t:r-t-1]=e[a?t:e.length-t-1]}return i}var f=e((()=>{ne()}));function p(e){if(e===null||typeof e==`boolean`||typeof e==`string`)return JSON.stringify(e);if(typeof e==`number`){if(!Number.isFinite(e))throw TypeError(`Cannot canonicalize non-finite number`);return Object.is(e,-0)?`0`:JSON.stringify(e)}if(typeof e==`bigint`)throw TypeError(`Cannot canonicalize bigint`);if(Array.isArray(e))return`[${e.map(e=>p(e)).join(`,`)}]`;if(typeof e==`object`)return`{${Object.keys(e).sort().reduce((t,n)=>{let r=e[n];return r!==void 0&&t.push(`${JSON.stringify(n)}:${p(r)}`),t},[]).join(`,`)}}`}function m(e,t){return JSON.parse(e,(e,n)=>{let r=n;return typeof r==`string`&&r.endsWith(h)?BigInt(r.slice(0,-9)):typeof t==`function`?t(e,r):r})}var h,te=e((()=>{h=`#__bigint`}));function g(e,t={}){let{size:n}=t,r=y.encode(e);return typeof n==`number`?(d(r,n),_(r,n)):r}function _(e,t){return ee(e,{dir:`right`,size:t})}function v(e){return e.length}var y,b,x,ne=e((()=>{u(),f(),te(),y=new TextEncoder,b=class extends l{constructor({givenSize:e,maxSize:t}){super(`Size cannot exceed \\`${t}\\` bytes. Given size: \\`${e}\\` bytes.`),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeOverflowError`})}},x=class extends l{constructor({size:e,targetSize:t,type:n}){super(`${n.charAt(0).toUpperCase()}${n.slice(1).toLowerCase()} size (\\`${e}\\`) exceeds padding size (\\`${t}\\`).`),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeExceedsPaddingSizeError`})}}}));ne();let re=new TextDecoder,S=Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[t,e.charCodeAt(0)]));({...Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[e.charCodeAt(0),t]))});function ie(e,t={}){let{pad:n=!0,url:r=!1}=t,i=new Uint8Array(Math.ceil(e.length/3)*4);for(let t=0,n=0;n<e.length;t+=4,n+=3){let r=(e[n]<<16)+(e[n+1]<<8)+(e[n+2]|0);i[t]=S[r>>18],i[t+1]=S[r>>12&63],i[t+2]=S[r>>6&63],i[t+3]=S[r&63]}let a=e.length%3,o=Math.floor(e.length/3)*4+(a&&a+1),s=re.decode(new Uint8Array(i.buffer,0,o));return n&&a===1&&(s+=`==`),n&&a===2&&(s+=`=`),r&&(s=s.replaceAll(`+`,`-`).replaceAll(`/`,`_`)),s}function ae(e,t={}){return ie(g(e),t)}function oe(e){return ae(p(e),{pad:!1,url:!0})}Object.freeze({status:`aborted`});function C(e,t,n){function r(n,r){if(n._zod||Object.defineProperty(n,`_zod`,{value:{def:r,constr:o,traits:new Set},enumerable:!1}),n._zod.traits.has(e))return;n._zod.traits.add(e),t(n,r);let i=o.prototype,a=Object.keys(i);for(let e=0;e<a.length;e++){let t=a[e];t in n||(n[t]=i[t].bind(n))}}let i=n?.Parent??Object;class a extends i{}Object.defineProperty(a,`name`,{value:e});function o(e){var t;let i=n?.Parent?new a:this;r(i,e),(t=i._zod).deferred??(t.deferred=[]);for(let e of i._zod.deferred)e();return i}return Object.defineProperty(o,`init`,{value:r}),Object.defineProperty(o,Symbol.hasInstance,{value:t=>n?.Parent&&t instanceof n.Parent?!0:t?._zod?.traits?.has(e)}),Object.defineProperty(o,`name`,{value:e}),o}var w=class extends Error{constructor(){super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`)}},se=class extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`),this.name=`ZodEncodeError`}};let ce={};function T(e){return e&&Object.assign(ce,e),ce}function le(e,t){return typeof t==`bigint`?t.toString():t}function ue(e){return{get value(){{let t=e();return Object.defineProperty(this,`value`,{value:t}),t}throw Error(`cached value already set`)}}}function de(e){return e==null}function fe(e){let t=+!!e.startsWith(`^`),n=e.endsWith(`$`)?e.length-1:e.length;return e.slice(t,n)}let E=Symbol(`evaluating`);function D(e,t,n){let r;Object.defineProperty(e,t,{get(){if(r!==E)return r===void 0&&(r=E,r=n()),r},set(n){Object.defineProperty(e,t,{value:n})},configurable:!0})}let pe=`captureStackTrace`in Error?Error.captureStackTrace:(...e)=>{};function O(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function me(e){if(O(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!=`function`)return!0;let n=t.prototype;return!(O(n)===!1||Object.prototype.hasOwnProperty.call(n,`isPrototypeOf`)===!1)}function he(e,t,n){let r=new e._zod.constr(t??e._zod.def);return(!t||n?.parent)&&(r._zod.parent=e),r}function k(e){let t=e;if(!t)return{};if(typeof t==`string`)return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error(\"Cannot specify both `message` and `error` params\");t.error=t.message}return delete t.message,typeof t.error==`string`?{...t,error:()=>t.error}:t}function ge(e){return Object.keys(e).filter(t=>e[t]._zod.optin===`optional`&&e[t]._zod.optout===`optional`)}-Number.MAX_VALUE,Number.MAX_VALUE;function A(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function j(e,t){return t.map(t=>{var n;return(n=t).path??(n.path=[]),t.path.unshift(e),t})}function M(e){return typeof e==`string`?e:e?.message}function N(e,t,n){let r={...e,path:e.path??[]};return e.message||(r.message=M(e.inst?._zod.def?.error?.(e))??M(t?.error?.(e))??M(n.customError?.(e))??M(n.localeError?.(e))??`Invalid input`),delete r.inst,delete r.continue,t?.reportInput||delete r.input,r}function _e(e){return Array.isArray(e)?`array`:typeof e==`string`?`string`:`unknown`}let ve=(e,t)=>{e.name=`$ZodError`,Object.defineProperty(e,`_zod`,{value:e._zod,enumerable:!1}),Object.defineProperty(e,`issues`,{value:t,enumerable:!1}),e.message=JSON.stringify(t,le,2),Object.defineProperty(e,`toString`,{value:()=>e.message,enumerable:!1})},ye=C(`$ZodError`,ve),P=C(`$ZodError`,ve,{Parent:Error}),be=(e=>(t,n,r,i)=>{let a=r?Object.assign(r,{async:!1}):{async:!1},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise)throw new w;if(o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw pe(t,i?.callee),t}return o.value})(P),xe=(e=>async(t,n,r,i)=>{let a=r?Object.assign(r,{async:!0}):{async:!0},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise&&(o=await o),o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw pe(t,i?.callee),t}return o.value})(P),F=(e=>(t,n,r)=>{let i=r?{...r,async:!1}:{async:!1},a=t._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new w;return a.issues.length?{success:!1,error:new(e??ye)(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),I=(e=>async(t,n,r)=>{let i=r?Object.assign(r,{async:!0}):{async:!0},a=t._zod.run({value:n,issues:[]},i);return a instanceof Promise&&(a=await a),a.issues.length?{success:!1,error:new e(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),Se=e=>{let t=e?`[\\\\s\\\\S]{${e?.minimum??0},${e?.maximum??``}}`:`[\\\\s\\\\S]*`;return RegExp(`^${t}$`)},L=/^-?\\d+(?:\\.\\d+)?$/,R=C(`$ZodCheck`,(e,t)=>{var n;e._zod??={},e._zod.def=t,(n=e._zod).onattach??(n.onattach=[])}),Ce=C(`$ZodCheckMinLength`,(e,t)=>{var n;R.init(e,t),(n=e._zod.def).when??(n.when=e=>{let t=e.value;return!de(t)&&t.length!==void 0}),e._zod.onattach.push(e=>{let n=e._zod.bag.minimum??-1/0;t.minimum>n&&(e._zod.bag.minimum=t.minimum)}),e._zod.check=n=>{let r=n.value;if(r.length>=t.minimum)return;let i=_e(r);n.issues.push({origin:i,code:`too_small`,minimum:t.minimum,inclusive:!0,input:r,inst:e,continue:!t.abort})}}),we=C(`$ZodCheckStringFormat`,(e,t)=>{var n,r;R.init(e,t),e._zod.onattach.push(e=>{let n=e._zod.bag;n.format=t.format,t.pattern&&(n.patterns??=new Set,n.patterns.add(t.pattern))}),t.pattern?(n=e._zod).check??(n.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:t.format,input:n.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})}):(r=e._zod).check??(r.check=()=>{})}),Te=C(`$ZodCheckRegex`,(e,t)=>{we.init(e,t),e._zod.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:`regex`,input:n.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),Ee={major:4,minor:3,patch:6},z=C(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=Ee;let r=[...e._zod.def.checks??[]];e._zod.traits.has(`$ZodCheck`)&&r.unshift(e);for(let t of r)for(let n of t._zod.onattach)n(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let t=(e,t,n)=>{let r=A(e),i;for(let a of t){if(a._zod.def.when){if(!a._zod.def.when(e))continue}else if(r)continue;let t=e.issues.length,o=a._zod.check(e);if(o instanceof Promise&&n?.async===!1)throw new w;if(i||o instanceof Promise)i=(i??Promise.resolve()).then(async()=>{await o,e.issues.length!==t&&(r||=A(e,t))});else{if(e.issues.length===t)continue;r||=A(e,t)}}return i?i.then(()=>e):e},n=(n,i,a)=>{if(A(n))return n.aborted=!0,n;let o=t(i,r,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(t=>e._zod.parse(t,a))}return e._zod.parse(o,a)};e._zod.run=(i,a)=>{if(a.skipChecks)return e._zod.parse(i,a);if(a.direction===`backward`){let t=e._zod.parse({value:i.value,issues:[]},{...a,skipChecks:!0});return t instanceof Promise?t.then(e=>n(e,i,a)):n(t,i,a)}let o=e._zod.parse(i,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(e=>t(e,r,a))}return t(o,r,a)}}D(e,`~standard`,()=>({validate:t=>{try{let n=F(e,t);return n.success?{value:n.data}:{issues:n.error?.issues}}catch{return I(e,t).then(e=>e.success?{value:e.data}:{issues:e.error?.issues})}},vendor:`zod`,version:1}))}),De=C(`$ZodString`,(e,t)=>{z.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??Se(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch{}return typeof n.value==`string`||n.issues.push({expected:`string`,code:`invalid_type`,input:n.value,inst:e}),n}}),Oe=C(`$ZodNumber`,(e,t)=>{z.init(e,t),e._zod.pattern=e._zod.bag.pattern??L,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Number(n.value)}catch{}let i=n.value;if(typeof i==`number`&&!Number.isNaN(i)&&Number.isFinite(i))return n;let a=typeof i==`number`?Number.isNaN(i)?`NaN`:Number.isFinite(i)?void 0:`Infinity`:void 0;return n.issues.push({expected:`number`,code:`invalid_type`,input:i,inst:e,...a?{received:a}:{}}),n}});function B(e,t,n){e.issues.length&&t.issues.push(...j(n,e.issues)),t.value[n]=e.value}let ke=C(`$ZodArray`,(e,t)=>{z.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!Array.isArray(i))return n.issues.push({expected:`array`,code:`invalid_type`,input:i,inst:e}),n;n.value=Array(i.length);let a=[];for(let e=0;e<i.length;e++){let o=i[e],s=t.element._zod.run({value:o,issues:[]},r);s instanceof Promise?a.push(s.then(t=>B(t,n,e))):B(s,n,e)}return a.length?Promise.all(a).then(()=>n):n}});function V(e,t,n,r,i){if(e.issues.length){if(i&&!(n in r))return;t.issues.push(...j(n,e.issues))}e.value===void 0?n in r&&(t.value[n]=void 0):t.value[n]=e.value}function Ae(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has(`$ZodType`))throw Error(`Invalid element at key \"${n}\": expected a Zod schema`);let n=ge(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function je(e,t,n,r,i,a){let o=[],s=i.keySet,c=i.catchall._zod,l=c.def.type,u=c.optout===`optional`;for(let i in t){if(s.has(i))continue;if(l===`never`){o.push(i);continue}let a=c.run({value:t[i],issues:[]},r);a instanceof Promise?e.push(a.then(e=>V(e,n,i,t,u))):V(a,n,i,t,u)}return o.length&&n.issues.push({code:`unrecognized_keys`,keys:o,input:t,inst:a}),e.length?Promise.all(e).then(()=>n):n}let Me=C(`$ZodObject`,(e,t)=>{if(z.init(e,t),!Object.getOwnPropertyDescriptor(t,`shape`)?.get){let e=t.shape;Object.defineProperty(t,`shape`,{get:()=>{let n={...e};return Object.defineProperty(t,`shape`,{value:n}),n}})}let n=ue(()=>Ae(t));D(e._zod,`propValues`,()=>{let e=t.shape,n={};for(let t in e){let r=e[t]._zod;if(r.values){n[t]??(n[t]=new Set);for(let e of r.values)n[t].add(e)}}return n});let r=O,i=t.catchall,a;e._zod.parse=(t,o)=>{a??=n.value;let s=t.value;if(!r(s))return t.issues.push({expected:`object`,code:`invalid_type`,input:s,inst:e}),t;t.value={};let c=[],l=a.shape;for(let e of a.keys){let n=l[e],r=n._zod.optout===`optional`,i=n._zod.run({value:s[e],issues:[]},o);i instanceof Promise?c.push(i.then(n=>V(n,t,e,s,r))):V(i,t,e,s,r)}return i?je(c,s,t,o,n.value,e):c.length?Promise.all(c).then(()=>t):t}}),Ne=C(`$ZodRecord`,(e,t)=>{z.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!me(i))return n.issues.push({expected:`record`,code:`invalid_type`,input:i,inst:e}),n;let a=[],o=t.keyType._zod.values;if(o){n.value={};let s=new Set;for(let e of o)if(typeof e==`string`||typeof e==`number`||typeof e==`symbol`){s.add(typeof e==`number`?e.toString():e);let o=t.valueType._zod.run({value:i[e],issues:[]},r);o instanceof Promise?a.push(o.then(t=>{t.issues.length&&n.issues.push(...j(e,t.issues)),n.value[e]=t.value})):(o.issues.length&&n.issues.push(...j(e,o.issues)),n.value[e]=o.value)}let c;for(let e in i)s.has(e)||(c??=[],c.push(e));c&&c.length>0&&n.issues.push({code:`unrecognized_keys`,input:i,inst:e,keys:c})}else{n.value={};for(let o of Reflect.ownKeys(i)){if(o===`__proto__`)continue;let s=t.keyType._zod.run({value:o,issues:[]},r);if(s instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(typeof o==`string`&&L.test(o)&&s.issues.length){let e=t.keyType._zod.run({value:Number(o),issues:[]},r);if(e instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);e.issues.length===0&&(s=e)}if(s.issues.length){t.mode===`loose`?n.value[o]=i[o]:n.issues.push({code:`invalid_key`,origin:`record`,issues:s.issues.map(e=>N(e,r,T())),input:o,path:[o],inst:e});continue}let c=t.valueType._zod.run({value:i[o],issues:[]},r);c instanceof Promise?a.push(c.then(e=>{e.issues.length&&n.issues.push(...j(o,e.issues)),n.value[s.value]=e.value})):(c.issues.length&&n.issues.push(...j(o,c.issues)),n.value[s.value]=c.value)}}return a.length?Promise.all(a).then(()=>n):n}}),Pe=C(`$ZodTransform`,(e,t)=>{z.init(e,t),e._zod.parse=(n,r)=>{if(r.direction===`backward`)throw new se(e.constructor.name);let i=t.transform(n.value,n);if(r.async)return(i instanceof Promise?i:Promise.resolve(i)).then(e=>(n.value=e,n));if(i instanceof Promise)throw new w;return n.value=i,n}});function Fe(e,t){return e.issues.length&&t===void 0?{issues:[],value:void 0}:e}let Ie=C(`$ZodOptional`,(e,t)=>{z.init(e,t),e._zod.optin=`optional`,e._zod.optout=`optional`,D(e._zod,`values`,()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),D(e._zod,`pattern`,()=>{let e=t.innerType._zod.pattern;return e?RegExp(`^(${fe(e.source)})?$`):void 0}),e._zod.parse=(e,n)=>{if(t.innerType._zod.optin===`optional`){let r=t.innerType._zod.run(e,n);return r instanceof Promise?r.then(t=>Fe(t,e.value)):Fe(r,e.value)}return e.value===void 0?e:t.innerType._zod.run(e,n)}}),Le=C(`$ZodPipe`,(e,t)=>{z.init(e,t),D(e._zod,`values`,()=>t.in._zod.values),D(e._zod,`optin`,()=>t.in._zod.optin),D(e._zod,`optout`,()=>t.out._zod.optout),D(e._zod,`propValues`,()=>t.in._zod.propValues),e._zod.parse=(e,n)=>{if(n.direction===`backward`){let r=t.out._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.in,n)):H(r,t.in,n)}let r=t.in._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.out,n)):H(r,t.out,n)}});function H(e,t,n){return e.issues.length?(e.aborted=!0,e):t._zod.run({value:e.value,issues:e.issues},n)}function Re(e,t){return new e({type:`string`,...k(t)})}function ze(e,t){return new e({type:`number`,checks:[],...k(t)})}function Be(e,t){return new Ce({check:`min_length`,...k(t),minimum:e})}function Ve(e,t){return new Te({check:`string_format`,format:`regex`,...k(t),pattern:e})}let U=C(`ZodMiniType`,(e,t)=>{if(!e._zod)throw Error(`Uninitialized schema in ZodMiniType.`);z.init(e,t),e.def=t,e.type=t.type,e.parse=(t,n)=>be(e,t,n,{callee:e.parse}),e.safeParse=(t,n)=>F(e,t,n),e.parseAsync=async(t,n)=>xe(e,t,n,{callee:e.parseAsync}),e.safeParseAsync=async(t,n)=>I(e,t,n),e.check=(...n)=>e.clone({...t,checks:[...t.checks??[],...n.map(e=>typeof e==`function`?{_zod:{check:e,def:{check:`custom`},onattach:[]}}:e)]},{parent:!0}),e.with=e.check,e.clone=(t,n)=>he(e,t,n),e.brand=()=>e,e.register=((t,n)=>(t.add(e,n),e)),e.apply=t=>t(e)}),He=C(`ZodMiniString`,(e,t)=>{De.init(e,t),U.init(e,t)});function W(e){return Re(He,e)}let Ue=C(`ZodMiniNumber`,(e,t)=>{Oe.init(e,t),U.init(e,t)});function We(e){return ze(Ue,e)}let Ge=C(`ZodMiniArray`,(e,t)=>{ke.init(e,t),U.init(e,t)});function Ke(e,t){return new Ge({type:`array`,element:e,...k(t)})}let qe=C(`ZodMiniObject`,(e,t)=>{Me.init(e,t),U.init(e,t),D(e,`shape`,()=>t.shape)});function G(e,t){return new qe({type:`object`,shape:e??{},...k(t)})}let Je=C(`ZodMiniRecord`,(e,t)=>{Ne.init(e,t),U.init(e,t)});function Ye(e,t,n){return new Je({type:`record`,keyType:e,valueType:t,...k(n)})}let Xe=C(`ZodMiniTransform`,(e,t)=>{Pe.init(e,t),U.init(e,t)});function Ze(e){return new Xe({type:`transform`,transform:e})}let Qe=C(`ZodMiniOptional`,(e,t)=>{Ie.init(e,t),U.init(e,t)});function K(e){return new Qe({type:`optional`,innerType:e})}let $e=C(`ZodMiniPipe`,(e,t)=>{Le.init(e,t),U.init(e,t)});function et(e,t){return new $e({type:`pipe`,in:e,out:t})}function tt(){return W().check(Ve(/^\\d+(\\.\\d+)?$/,`Invalid amount`))}function nt(e){let{opaque:t,request:n,...r}=e.challenge,i={challenge:{...r,...t!==void 0&&{opaque:oe(t)},request:oe(n)},payload:e.payload,...e.source&&{source:e.source}};return`Payment ${ae(JSON.stringify(i),{pad:!1,url:!0})}`}function rt(e){return e}function it(e,t){let{context:n,createCredential:r}=t;return{...e,context:n,createCredential:r}}var q,at=e((()=>{q=`2.47.6`}));function ot(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause!==void 0?ot(e.cause,t):t?null:e}var J,st;e((()=>{at(),J={getDocsUrl:({docsBaseUrl:e,docsPath:t=``,docsSlug:n})=>t?`${e??`https://viem.sh`}${t}${n?`#${n}`:``}`:void 0,version:`viem@${q}`},st=class e extends Error{constructor(t,n={}){let r=n.cause instanceof e?n.cause.details:n.cause?.message?n.cause.message:n.details,i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=J.getDocsUrl?.({...n,docsPath:i}),o=[t||`An error occurred.`,``,...n.metaMessages?[...n.metaMessages,``]:[],...a?[`Docs: ${a}`]:[],...r?[`Details: ${r}`]:[],...J.version?[`Version: ${J.version}`]:[]].join(`\n`);super(o,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,`details`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docsPath`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`metaMessages`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`shortMessage`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`version`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.details=r,this.docsPath=i,this.metaMessages=n.metaMessages,this.name=n.name??this.name,this.shortMessage=t,this.version=q}walk(e){return ot(this,e)}}}))();var ct=class extends st{constructor({value:e}){super(`Number \\`${e}\\` is not a valid decimal number.`,{name:`InvalidDecimalNumberError`})}};function lt(e,t){if(!/^(-?)([0-9]*)\\.?([0-9]*)$/.test(e))throw new ct({value:e});let[n,r=`0`]=e.split(`.`),i=n.startsWith(`-`);if(i&&(n=n.slice(1)),r=r.replace(/(0+)$/,``),t===0)Math.round(Number(`.${r}`))===1&&(n=`${BigInt(n)+1n}`),r=``;else if(r.length>t){let[e,i,a]=[r.slice(0,t-1),r.slice(t-1,t),r.slice(t)],o=Math.round(Number(`${i}.${a}`));r=o>9?`${BigInt(e)+BigInt(1)}0`.padStart(e.length+1,`0`):`${e}${o}`,r.length>t&&(r=r.slice(1),n=`${BigInt(n)+1n}`),r=r.slice(0,t)}else r=r.padEnd(t,`0`);return BigInt(`${i?`-`:``}${n}${r}`)}let ut=rt({name:`stripe`,intent:`charge`,schema:{credential:{payload:G({externalId:K(W()),spt:W()})},request:et(G({amount:tt(),currency:W(),decimals:We(),description:K(W()),externalId:K(W()),metadata:K(Ye(W(),W())),networkId:W(),paymentMethodTypes:Ke(W()).check(Be(1)),recipient:K(W())}),Ze(({amount:e,decimals:t,metadata:n,networkId:r,paymentMethodTypes:i,...a})=>({...a,amount:lt(e,t).toString(),methodDetails:{networkId:r,paymentMethodTypes:i,...n!==void 0&&{metadata:n}}})))}});function dt(e){let{client:t,createToken:n,externalId:r,paymentMethod:i}=e;return it(ut,{context:G({paymentMethod:K(W())}),async createCredential({challenge:e,context:a}){let o=a?.paymentMethod??i;if(!o)throw Error(`paymentMethod is required (pass via context or parameters)`);let s=e.request.amount,c=e.request.currency,l=e.request.methodDetails?.networkId;if(!l)throw Error(`networkId is required in challenge.methodDetails`);let u=e.request.methodDetails?.metadata;if(u?.externalId)throw Error(`methodDetails.metadata.externalId is reserved; use credential externalId instead`);return nt({challenge:e,payload:{spt:await n({amount:s,challenge:e,client:t,currency:c,expiresAt:e.expires?Math.floor(new Date(e.expires).getTime()/1e3):Math.floor(Date.now()/1e3)+3600,metadata:u,networkId:l,paymentMethod:o}),...r?{externalId:r}:{}}})}})}function ft(e){return[dt(e)]}(function(e){e.charge=dt})(ft||={});var pt=r();let Y={data:`__MPPX_DATA__`,error:`root_error`,root:`root`},mt={serviceWorker:`__mppx_worker`,tab:`__mppx_tab`},X={challengeId:`data-mppx-challenge-id`,remaining:`data-remaining`};var Z=class{name;constructor(e){this.name=`--mppx-${e}`}toString(){return`var(${this.name})`}};let ht={accent:new Z(`accent`),background:new Z(`background`),border:new Z(`border`),foreground:new Z(`foreground`),muted:new Z(`muted`),negative:new Z(`negative`),positive:new Z(`positive`),surface:new Z(`surface`),fontFamily:new Z(`font-family`),fontSizeBase:new Z(`font-size-base`),radius:new Z(`radius`),spacingUnit:new Z(`spacing-unit`)};String.raw`<style>\n  *,\n  ::after,\n  ::before,\n  ::backdrop,\n  ::file-selector-button {\n    box-sizing: border-box;\n    margin: 0;\n    padding: 0;\n    border: 0 solid;\n    border-color: ${ht.border};\n  }\n  html,\n  :host {\n    line-height: 1.5;\n    -webkit-text-size-adjust: 100%;\n    tab-size: 4;\n    -webkit-tap-highlight-color: transparent;\n  }\n  h1,\n  h2,\n  h3,\n  h4,\n  h5,\n  h6 {\n    font-size: inherit;\n    font-weight: inherit;\n  }\n  a {\n    color: inherit;\n    -webkit-text-decoration: inherit;\n    text-decoration: inherit;\n  }\n  b,\n  strong {\n    font-weight: bolder;\n  }\n  code,\n  kbd,\n  samp,\n  pre {\n    font-family:\n      ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New',\n      monospace;\n    font-size: 1em;\n  }\n  small {\n    font-size: 80%;\n  }\n  ol,\n  ul,\n  menu {\n    list-style: none;\n  }\n  img,\n  svg,\n  video,\n  canvas,\n  audio,\n  iframe,\n  embed,\n  object {\n    display: block;\n    vertical-align: middle;\n  }\n  img,\n  video {\n    max-width: 100%;\n    height: auto;\n  }\n  button,\n  input,\n  select,\n  optgroup,\n  textarea,\n  ::file-selector-button {\n    font: inherit;\n    font-feature-settings: inherit;\n    font-variation-settings: inherit;\n    letter-spacing: inherit;\n    color: inherit;\n    border-radius: 0;\n    background-color: transparent;\n    opacity: 1;\n  }\n  ::file-selector-button {\n    margin-inline-end: 4px;\n  }\n  ::placeholder {\n    opacity: 1;\n  }\n  @supports (not (-webkit-appearance: -apple-pay-button)) or (contain-intrinsic-size: 1px) {\n    ::placeholder {\n      color: color-mix(in oklab, currentcolor 50%, transparent);\n    }\n  }\n  textarea {\n    resize: vertical;\n  }\n  ::-webkit-search-decoration {\n    -webkit-appearance: none;\n  }\n  :-moz-ui-invalid {\n    box-shadow: none;\n  }\n  button,\n  input:where([type='button'], [type='reset'], [type='submit']),\n  ::file-selector-button {\n    appearance: button;\n  }\n  ::-webkit-inner-spin-button,\n  ::-webkit-outer-spin-button {\n    height: auto;\n  }\n  [hidden]:where(:not([hidden='until-found'])) {\n    display: none !important;\n  }\n</style>`;function gt(e,t){if(t==null)return e;if(!Q(e)||!Q(t))return t??e;let n={...e};for(let[e,r]of Object.entries(t)){if(r==null||r===``)continue;let t=n[e];n[e]=Q(t)&&Q(r)?gt(t,r):r}return n}function Q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function _t(e){let t=new URL(location.href);t.searchParams.set(mt.serviceWorker,``);let n=await navigator.serviceWorker.register(t.pathname+t.search),r=await new Promise(e=>{let t=n.installing??n.waiting??n.active;if(t?.state===`activated`)return e(t);let r=t??n;r.addEventListener(`statechange`,function t(){let i=n.active;i?.state===`activated`&&(r.removeEventListener(`statechange`,t),e(i))})});await new Promise(t=>{let n=new MessageChannel;n.port1.onmessage=()=>t(),r.postMessage({credential:e},[n.port2])}),location.reload()}function vt(e){let t=document.getElementById(Y.data),n=m(t.textContent),r=t.getAttribute(X.remaining);!r||Number(r)<=1?t.remove():t.setAttribute(X.remaining,String(Number(r)-1));let i=document.currentScript,a=i?.getAttribute(X.challengeId),o=a?(i.removeAttribute(X.challengeId),n[a]):Object.values(n).find(t=>t.challenge.method===e);return{...o,error(e){if(!e){document.getElementById(Y.error)?.remove();return}let t=document.getElementById(Y.error);if(t){t.textContent=e;return}let n=document.createElement(`p`);n.id=Y.error,n.className=`mppx-error`,n.role=`alert`,n.textContent=e,document.getElementById(o.rootId)?.after(n)},root:document.getElementById(o.rootId),submit:_t,vars:ht}}let $=vt(`stripe`),yt=String.raw,bt=document.createElement(`style`);bt.textContent=yt`\n  form {\n    display: flex;\n    flex-direction: column;\n    gap: calc(${$.vars.spacingUnit} * 8);\n  }\n  button {\n    background: ${$.vars.accent};\n    border-radius: ${$.vars.radius};\n    color: ${$.vars.background};\n    cursor: pointer;\n    font-weight: 500;\n    padding: calc(${$.vars.spacingUnit} * 4) calc(${$.vars.spacingUnit} * 8);\n    width: 100%;\n  }\n  button:hover:not(:disabled) {\n    opacity: 0.85;\n  }\n  button:disabled {\n    cursor: default;\n    opacity: 0.5;\n  }\n`,$.root.append(bt),(async()=>{let e=await(0,pt.loadStripe)($.config.publishableKey);if(!e)throw Error(`Failed to loadStripe`);let t=window.matchMedia(`(prefers-color-scheme: dark)`),n=()=>{let e=(()=>{if($.config.elements?.options?.appearance?.theme)return $.config.elements?.options?.appearance?.theme;switch($.theme.colorScheme){case`light dark`:return t.matches?`night`:`stripe`;case`light`:return`stripe`;case`dark`:return`night`}})(),n=+!!t.matches;return gt({disableAnimations:!0,theme:e,variables:{borderRadius:$.theme.radius,colorBackground:$.theme.surface[n],colorDanger:$.theme.negative[n],colorPrimary:$.theme.accent[n],colorText:$.theme.foreground[n],colorTextSecondary:$.theme.muted[n],fontSizeBase:$.theme.fontSizeBase,fontFamily:$.theme.fontFamily,spacingUnit:$.theme.spacingUnit}},$.config.elements?.options?.appearance??{})},r=e.elements({appearance:n(),...$.config.elements?.options,amount:Number($.challenge.request.amount),currency:$.challenge.request.currency,mode:`payment`,paymentMethodCreation:`manual`,paymentMethodTypes:$.challenge.request.methodDetails.paymentMethodTypes});t.addEventListener(`change`,()=>{r.update({appearance:n()})});let i=document.createElement(`form`);r.create(`payment`,$.config.elements?.paymentOptions).mount(i),$.root.appendChild(i);let a=document.createElement(`button`);a.textContent=$.text.pay,a.type=`submit`,i.appendChild(a),i.onsubmit=async t=>{t.preventDefault(),$.error(),a.disabled=!0;try{await r.submit();let{paymentMethod:t,error:n}=await e.createPaymentMethod({...$.config.elements?.createPaymentMethodOptions,elements:r});if(n||!t)throw n??Error(`Failed to create payment method`);let i=await ft({client:e,createToken:xt})[0].createCredential({challenge:$.challenge,context:{paymentMethod:t.id}});await $.submit(i)}catch(e){$.error(e instanceof Error?e.message:`Payment failed`)}finally{a.disabled=!1}}})();async function xt(e){let t=new URL($.config.createTokenUrl,location.origin);if(t.origin!==location.origin)throw Error(`createTokenUrl must be same-origin`);let n=await fetch(t,{method:`POST`,headers:{\"Content-Type\":`application/json`},body:JSON.stringify(e)});if(!n.ok){let e=await n.text().catch(()=>`<response body unavailable>`);throw Error(`Failed to create SPT (${n.status}): ${e}`)}return(await n.json()).spt}})();</script>"
+export const html = "<script>(function(){var e=(e,t)=>()=>(e&&(t=e(e=0)),t),t=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),n=t((e=>{Object.defineProperty(e,`__esModule`,{value:!0});function t(e){\"@babel/helpers - typeof\";return t=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},t(e)}var n=`dahlia`,r=function(e){return e===3?`v3`:e},i=`https://js.stripe.com`,a=`${i}/${n}/stripe.js`,o=/^https:\\/\\/js\\.stripe\\.com\\/v3\\/?(\\?.*)?$/,s=/^https:\\/\\/js\\.stripe\\.com\\/(v3|[a-z]+)\\/stripe\\.js(\\?.*)?$/,c=`loadStripe.setLoadParameters was called but an existing Stripe.js script already exists in the document; existing script parameters will be used`,l=function(e){return o.test(e)||s.test(e)},u=function(){for(var e=document.querySelectorAll(`script[src^=\"${i}\"]`),t=0;t<e.length;t++){var n=e[t];if(l(n.src))return n}return null},d=function(e){var t=e&&!e.advancedFraudSignals?`?advancedFraudSignals=false`:``,n=document.createElement(`script`);n.src=`${a}${t}`;var r=document.head||document.body;if(!r)throw Error(`Expected document.body not to be null. Stripe.js requires a <body> element.`);return r.appendChild(n),n},ee=function(e,t){!e||!e._registerWrapper||e._registerWrapper({name:`stripe-js`,version:`9.3.1`,startTime:t})},f=null,p=null,m=null,h=function(e){return function(t){e(Error(`Failed to load Stripe.js`,{cause:t}))}},te=function(e,t){return function(){window.Stripe?e(window.Stripe):t(Error(`Stripe.js not available`))}},g=function(e){return f===null?(f=new Promise(function(t,n){if(typeof window>`u`||typeof document>`u`){t(null);return}if(window.Stripe&&e&&console.warn(c),window.Stripe){t(window.Stripe);return}try{var r=u();if(r&&e)console.warn(c);else if(!r)r=d(e);else if(r&&m!==null&&p!==null){var i;r.removeEventListener(`load`,m),r.removeEventListener(`error`,p),(i=r.parentNode)==null||i.removeChild(r),r=d(e)}m=te(t,n),p=h(n),r.addEventListener(`load`,m),r.addEventListener(`error`,p)}catch(e){n(e);return}}),f.catch(function(e){return f=null,Promise.reject(e)})):f},_=function(e,i,a){if(e===null)return null;var o=i[0];if(typeof o!=`string`)throw Error(`Expected publishable key to be of type string, got type ${t(o)} instead.`);var s=o.match(/^pk_test/),c=r(e.version),l=n;s&&c!==l&&console.warn(`Stripe.js@${c} was loaded on the page, but @stripe/stripe-js@9.3.1 expected Stripe.js@${l}. This may result in unexpected behavior. For more information, see https://docs.stripe.com/sdks/stripejs-versioning`);var u=e.apply(void 0,i);return ee(u,a),u},v=function(e){var n=`invalid load parameters; expected object of shape\n\n    {advancedFraudSignals: boolean}\n\nbut received\n\n    ${JSON.stringify(e)}\n`;if(e===null||t(e)!==`object`)throw Error(n);if(Object.keys(e).length===1&&typeof e.advancedFraudSignals==`boolean`)return e;throw Error(n)},y,b=!1,x=function(){for(var e=arguments.length,t=Array(e),n=0;n<e;n++)t[n]=arguments[n];b=!0;var r=Date.now();return g(y).then(function(e){return _(e,t,r)})};x.setLoadParameters=function(e){if(b&&y){var t=v(e);if(Object.keys(t).reduce(function(t,n){return t&&e[n]===y?.[n]},!0))return}if(b)throw Error(`You cannot change load parameters after calling loadStripe`);y=v(e)},e.loadStripe=x})),r=t(((e,t)=>{t.exports=n()})),i,a=e((()=>{i=`0.1.1`}));function o(){return i}var s=e((()=>{a()}));function c(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause?c(e.cause,t):t?null:e}var l,u=e((()=>{s(),l=class e extends Error{static setStaticOptions(t){e.prototype.docsOrigin=t.docsOrigin,e.prototype.showVersion=t.showVersion,e.prototype.version=t.version}constructor(t,n={}){let r=(()=>{if(n.cause instanceof e){if(n.cause.details)return n.cause.details;if(n.cause.shortMessage)return n.cause.shortMessage}return n.cause&&`details`in n.cause&&typeof n.cause.details==`string`?n.cause.details:n.cause?.message?n.cause.message:n.details})(),i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=n.docsOrigin??e.prototype.docsOrigin,o=`${a}${i??``}`,s=!!(n.version??e.prototype.showVersion),c=n.version??e.prototype.version,l=[t||`An error occurred.`,...n.metaMessages?[``,...n.metaMessages]:[],...r||i||s?[``,r?`Details: ${r}`:void 0,i?`See: ${o}`:void 0,s?`Version: ${c}`:void 0]:[]].filter(e=>typeof e==`string`).join(`\n`);super(l,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,`details`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docs`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docsOrigin`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docsPath`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`shortMessage`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`showVersion`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`version`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`cause`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.cause=n.cause,this.details=r,this.docs=o,this.docsOrigin=a,this.docsPath=i,this.shortMessage=t,this.showVersion=s,this.version=c}walk(e){return c(this,e)}},Object.defineProperty(l,`defaultStaticOptions`,{enumerable:!0,configurable:!0,writable:!0,value:{docsOrigin:`https://oxlib.sh`,showVersion:!1,version:`ox@${o()}`}}),l.setStaticOptions(l.defaultStaticOptions)}));function d(e,t){if(v(e)>t)throw new b({givenSize:v(e),maxSize:t})}function ee(e,t={}){let{dir:n,size:r=32}=t;if(r===0)return e;if(e.length>r)throw new x({size:e.length,targetSize:r,type:`Bytes`});let i=new Uint8Array(r);for(let t=0;t<r;t++){let a=n===`right`;i[a?t:r-t-1]=e[a?t:e.length-t-1]}return i}var f=e((()=>{ne()}));function p(e){if(e===null||typeof e==`boolean`||typeof e==`string`)return JSON.stringify(e);if(typeof e==`number`){if(!Number.isFinite(e))throw TypeError(`Cannot canonicalize non-finite number`);return Object.is(e,-0)?`0`:JSON.stringify(e)}if(typeof e==`bigint`)throw TypeError(`Cannot canonicalize bigint`);if(Array.isArray(e))return`[${e.map(e=>p(e)).join(`,`)}]`;if(typeof e==`object`)return`{${Object.keys(e).sort().reduce((t,n)=>{let r=e[n];return r!==void 0&&t.push(`${JSON.stringify(n)}:${p(r)}`),t},[]).join(`,`)}}`}function m(e,t){return JSON.parse(e,(e,n)=>{let r=n;return typeof r==`string`&&r.endsWith(h)?BigInt(r.slice(0,-9)):typeof t==`function`?t(e,r):r})}var h,te=e((()=>{h=`#__bigint`}));function g(e,t={}){let{size:n}=t,r=y.encode(e);return typeof n==`number`?(d(r,n),_(r,n)):r}function _(e,t){return ee(e,{dir:`right`,size:t})}function v(e){return e.length}var y,b,x,ne=e((()=>{u(),f(),te(),y=new TextEncoder,b=class extends l{constructor({givenSize:e,maxSize:t}){super(`Size cannot exceed \\`${t}\\` bytes. Given size: \\`${e}\\` bytes.`),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeOverflowError`})}},x=class extends l{constructor({size:e,targetSize:t,type:n}){super(`${n.charAt(0).toUpperCase()}${n.slice(1).toLowerCase()} size (\\`${e}\\`) exceeds padding size (\\`${t}\\`).`),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeExceedsPaddingSizeError`})}}}));ne();let re=new TextDecoder,S=Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[t,e.charCodeAt(0)]));({...Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[e.charCodeAt(0),t]))});function ie(e,t={}){let{pad:n=!0,url:r=!1}=t,i=new Uint8Array(Math.ceil(e.length/3)*4);for(let t=0,n=0;n<e.length;t+=4,n+=3){let r=(e[n]<<16)+(e[n+1]<<8)+(e[n+2]|0);i[t]=S[r>>18],i[t+1]=S[r>>12&63],i[t+2]=S[r>>6&63],i[t+3]=S[r&63]}let a=e.length%3,o=Math.floor(e.length/3)*4+(a&&a+1),s=re.decode(new Uint8Array(i.buffer,0,o));return n&&a===1&&(s+=`==`),n&&a===2&&(s+=`=`),r&&(s=s.replaceAll(`+`,`-`).replaceAll(`/`,`_`)),s}function ae(e,t={}){return ie(g(e),t)}function oe(e){return ae(p(e),{pad:!1,url:!0})}Object.freeze({status:`aborted`});function C(e,t,n){function r(n,r){if(n._zod||Object.defineProperty(n,`_zod`,{value:{def:r,constr:o,traits:new Set},enumerable:!1}),n._zod.traits.has(e))return;n._zod.traits.add(e),t(n,r);let i=o.prototype,a=Object.keys(i);for(let e=0;e<a.length;e++){let t=a[e];t in n||(n[t]=i[t].bind(n))}}let i=n?.Parent??Object;class a extends i{}Object.defineProperty(a,`name`,{value:e});function o(e){var t;let i=n?.Parent?new a:this;r(i,e),(t=i._zod).deferred??(t.deferred=[]);for(let e of i._zod.deferred)e();return i}return Object.defineProperty(o,`init`,{value:r}),Object.defineProperty(o,Symbol.hasInstance,{value:t=>n?.Parent&&t instanceof n.Parent?!0:t?._zod?.traits?.has(e)}),Object.defineProperty(o,`name`,{value:e}),o}var w=class extends Error{constructor(){super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`)}},se=class extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`),this.name=`ZodEncodeError`}};let ce={};function T(e){return e&&Object.assign(ce,e),ce}function le(e,t){return typeof t==`bigint`?t.toString():t}function ue(e){return{get value(){{let t=e();return Object.defineProperty(this,`value`,{value:t}),t}throw Error(`cached value already set`)}}}function de(e){return e==null}function fe(e){let t=+!!e.startsWith(`^`),n=e.endsWith(`$`)?e.length-1:e.length;return e.slice(t,n)}let E=Symbol(`evaluating`);function D(e,t,n){let r;Object.defineProperty(e,t,{get(){if(r!==E)return r===void 0&&(r=E,r=n()),r},set(n){Object.defineProperty(e,t,{value:n})},configurable:!0})}let pe=`captureStackTrace`in Error?Error.captureStackTrace:(...e)=>{};function O(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function me(e){if(O(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!=`function`)return!0;let n=t.prototype;return!(O(n)===!1||Object.prototype.hasOwnProperty.call(n,`isPrototypeOf`)===!1)}function he(e,t,n){let r=new e._zod.constr(t??e._zod.def);return(!t||n?.parent)&&(r._zod.parent=e),r}function k(e){let t=e;if(!t)return{};if(typeof t==`string`)return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error(\"Cannot specify both `message` and `error` params\");t.error=t.message}return delete t.message,typeof t.error==`string`?{...t,error:()=>t.error}:t}function ge(e){return Object.keys(e).filter(t=>e[t]._zod.optin===`optional`&&e[t]._zod.optout===`optional`)}-Number.MAX_VALUE,Number.MAX_VALUE;function A(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function j(e,t){return t.map(t=>{var n;return(n=t).path??(n.path=[]),t.path.unshift(e),t})}function M(e){return typeof e==`string`?e:e?.message}function N(e,t,n){let r={...e,path:e.path??[]};return e.message||(r.message=M(e.inst?._zod.def?.error?.(e))??M(t?.error?.(e))??M(n.customError?.(e))??M(n.localeError?.(e))??`Invalid input`),delete r.inst,delete r.continue,t?.reportInput||delete r.input,r}function _e(e){return Array.isArray(e)?`array`:typeof e==`string`?`string`:`unknown`}let ve=(e,t)=>{e.name=`$ZodError`,Object.defineProperty(e,`_zod`,{value:e._zod,enumerable:!1}),Object.defineProperty(e,`issues`,{value:t,enumerable:!1}),e.message=JSON.stringify(t,le,2),Object.defineProperty(e,`toString`,{value:()=>e.message,enumerable:!1})},ye=C(`$ZodError`,ve),P=C(`$ZodError`,ve,{Parent:Error}),be=(e=>(t,n,r,i)=>{let a=r?Object.assign(r,{async:!1}):{async:!1},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise)throw new w;if(o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw pe(t,i?.callee),t}return o.value})(P),xe=(e=>async(t,n,r,i)=>{let a=r?Object.assign(r,{async:!0}):{async:!0},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise&&(o=await o),o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw pe(t,i?.callee),t}return o.value})(P),F=(e=>(t,n,r)=>{let i=r?{...r,async:!1}:{async:!1},a=t._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new w;return a.issues.length?{success:!1,error:new(e??ye)(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),I=(e=>async(t,n,r)=>{let i=r?Object.assign(r,{async:!0}):{async:!0},a=t._zod.run({value:n,issues:[]},i);return a instanceof Promise&&(a=await a),a.issues.length?{success:!1,error:new e(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),Se=e=>{let t=e?`[\\\\s\\\\S]{${e?.minimum??0},${e?.maximum??``}}`:`[\\\\s\\\\S]*`;return RegExp(`^${t}$`)},L=/^-?\\d+(?:\\.\\d+)?$/,R=C(`$ZodCheck`,(e,t)=>{var n;e._zod??={},e._zod.def=t,(n=e._zod).onattach??(n.onattach=[])}),Ce=C(`$ZodCheckMinLength`,(e,t)=>{var n;R.init(e,t),(n=e._zod.def).when??(n.when=e=>{let t=e.value;return!de(t)&&t.length!==void 0}),e._zod.onattach.push(e=>{let n=e._zod.bag.minimum??-1/0;t.minimum>n&&(e._zod.bag.minimum=t.minimum)}),e._zod.check=n=>{let r=n.value;if(r.length>=t.minimum)return;let i=_e(r);n.issues.push({origin:i,code:`too_small`,minimum:t.minimum,inclusive:!0,input:r,inst:e,continue:!t.abort})}}),we=C(`$ZodCheckStringFormat`,(e,t)=>{var n,r;R.init(e,t),e._zod.onattach.push(e=>{let n=e._zod.bag;n.format=t.format,t.pattern&&(n.patterns??=new Set,n.patterns.add(t.pattern))}),t.pattern?(n=e._zod).check??(n.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:t.format,input:n.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})}):(r=e._zod).check??(r.check=()=>{})}),Te=C(`$ZodCheckRegex`,(e,t)=>{we.init(e,t),e._zod.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:`regex`,input:n.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),Ee={major:4,minor:3,patch:6},z=C(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=Ee;let r=[...e._zod.def.checks??[]];e._zod.traits.has(`$ZodCheck`)&&r.unshift(e);for(let t of r)for(let n of t._zod.onattach)n(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let t=(e,t,n)=>{let r=A(e),i;for(let a of t){if(a._zod.def.when){if(!a._zod.def.when(e))continue}else if(r)continue;let t=e.issues.length,o=a._zod.check(e);if(o instanceof Promise&&n?.async===!1)throw new w;if(i||o instanceof Promise)i=(i??Promise.resolve()).then(async()=>{await o,e.issues.length!==t&&(r||=A(e,t))});else{if(e.issues.length===t)continue;r||=A(e,t)}}return i?i.then(()=>e):e},n=(n,i,a)=>{if(A(n))return n.aborted=!0,n;let o=t(i,r,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(t=>e._zod.parse(t,a))}return e._zod.parse(o,a)};e._zod.run=(i,a)=>{if(a.skipChecks)return e._zod.parse(i,a);if(a.direction===`backward`){let t=e._zod.parse({value:i.value,issues:[]},{...a,skipChecks:!0});return t instanceof Promise?t.then(e=>n(e,i,a)):n(t,i,a)}let o=e._zod.parse(i,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(e=>t(e,r,a))}return t(o,r,a)}}D(e,`~standard`,()=>({validate:t=>{try{let n=F(e,t);return n.success?{value:n.data}:{issues:n.error?.issues}}catch{return I(e,t).then(e=>e.success?{value:e.data}:{issues:e.error?.issues})}},vendor:`zod`,version:1}))}),De=C(`$ZodString`,(e,t)=>{z.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??Se(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch{}return typeof n.value==`string`||n.issues.push({expected:`string`,code:`invalid_type`,input:n.value,inst:e}),n}}),Oe=C(`$ZodNumber`,(e,t)=>{z.init(e,t),e._zod.pattern=e._zod.bag.pattern??L,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Number(n.value)}catch{}let i=n.value;if(typeof i==`number`&&!Number.isNaN(i)&&Number.isFinite(i))return n;let a=typeof i==`number`?Number.isNaN(i)?`NaN`:Number.isFinite(i)?void 0:`Infinity`:void 0;return n.issues.push({expected:`number`,code:`invalid_type`,input:i,inst:e,...a?{received:a}:{}}),n}});function B(e,t,n){e.issues.length&&t.issues.push(...j(n,e.issues)),t.value[n]=e.value}let ke=C(`$ZodArray`,(e,t)=>{z.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!Array.isArray(i))return n.issues.push({expected:`array`,code:`invalid_type`,input:i,inst:e}),n;n.value=Array(i.length);let a=[];for(let e=0;e<i.length;e++){let o=i[e],s=t.element._zod.run({value:o,issues:[]},r);s instanceof Promise?a.push(s.then(t=>B(t,n,e))):B(s,n,e)}return a.length?Promise.all(a).then(()=>n):n}});function V(e,t,n,r,i){if(e.issues.length){if(i&&!(n in r))return;t.issues.push(...j(n,e.issues))}e.value===void 0?n in r&&(t.value[n]=void 0):t.value[n]=e.value}function Ae(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has(`$ZodType`))throw Error(`Invalid element at key \"${n}\": expected a Zod schema`);let n=ge(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function je(e,t,n,r,i,a){let o=[],s=i.keySet,c=i.catchall._zod,l=c.def.type,u=c.optout===`optional`;for(let i in t){if(s.has(i))continue;if(l===`never`){o.push(i);continue}let a=c.run({value:t[i],issues:[]},r);a instanceof Promise?e.push(a.then(e=>V(e,n,i,t,u))):V(a,n,i,t,u)}return o.length&&n.issues.push({code:`unrecognized_keys`,keys:o,input:t,inst:a}),e.length?Promise.all(e).then(()=>n):n}let Me=C(`$ZodObject`,(e,t)=>{if(z.init(e,t),!Object.getOwnPropertyDescriptor(t,`shape`)?.get){let e=t.shape;Object.defineProperty(t,`shape`,{get:()=>{let n={...e};return Object.defineProperty(t,`shape`,{value:n}),n}})}let n=ue(()=>Ae(t));D(e._zod,`propValues`,()=>{let e=t.shape,n={};for(let t in e){let r=e[t]._zod;if(r.values){n[t]??(n[t]=new Set);for(let e of r.values)n[t].add(e)}}return n});let r=O,i=t.catchall,a;e._zod.parse=(t,o)=>{a??=n.value;let s=t.value;if(!r(s))return t.issues.push({expected:`object`,code:`invalid_type`,input:s,inst:e}),t;t.value={};let c=[],l=a.shape;for(let e of a.keys){let n=l[e],r=n._zod.optout===`optional`,i=n._zod.run({value:s[e],issues:[]},o);i instanceof Promise?c.push(i.then(n=>V(n,t,e,s,r))):V(i,t,e,s,r)}return i?je(c,s,t,o,n.value,e):c.length?Promise.all(c).then(()=>t):t}}),Ne=C(`$ZodRecord`,(e,t)=>{z.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!me(i))return n.issues.push({expected:`record`,code:`invalid_type`,input:i,inst:e}),n;let a=[],o=t.keyType._zod.values;if(o){n.value={};let s=new Set;for(let e of o)if(typeof e==`string`||typeof e==`number`||typeof e==`symbol`){s.add(typeof e==`number`?e.toString():e);let o=t.valueType._zod.run({value:i[e],issues:[]},r);o instanceof Promise?a.push(o.then(t=>{t.issues.length&&n.issues.push(...j(e,t.issues)),n.value[e]=t.value})):(o.issues.length&&n.issues.push(...j(e,o.issues)),n.value[e]=o.value)}let c;for(let e in i)s.has(e)||(c??=[],c.push(e));c&&c.length>0&&n.issues.push({code:`unrecognized_keys`,input:i,inst:e,keys:c})}else{n.value={};for(let o of Reflect.ownKeys(i)){if(o===`__proto__`)continue;let s=t.keyType._zod.run({value:o,issues:[]},r);if(s instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(typeof o==`string`&&L.test(o)&&s.issues.length){let e=t.keyType._zod.run({value:Number(o),issues:[]},r);if(e instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);e.issues.length===0&&(s=e)}if(s.issues.length){t.mode===`loose`?n.value[o]=i[o]:n.issues.push({code:`invalid_key`,origin:`record`,issues:s.issues.map(e=>N(e,r,T())),input:o,path:[o],inst:e});continue}let c=t.valueType._zod.run({value:i[o],issues:[]},r);c instanceof Promise?a.push(c.then(e=>{e.issues.length&&n.issues.push(...j(o,e.issues)),n.value[s.value]=e.value})):(c.issues.length&&n.issues.push(...j(o,c.issues)),n.value[s.value]=c.value)}}return a.length?Promise.all(a).then(()=>n):n}}),Pe=C(`$ZodTransform`,(e,t)=>{z.init(e,t),e._zod.parse=(n,r)=>{if(r.direction===`backward`)throw new se(e.constructor.name);let i=t.transform(n.value,n);if(r.async)return(i instanceof Promise?i:Promise.resolve(i)).then(e=>(n.value=e,n));if(i instanceof Promise)throw new w;return n.value=i,n}});function Fe(e,t){return e.issues.length&&t===void 0?{issues:[],value:void 0}:e}let Ie=C(`$ZodOptional`,(e,t)=>{z.init(e,t),e._zod.optin=`optional`,e._zod.optout=`optional`,D(e._zod,`values`,()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),D(e._zod,`pattern`,()=>{let e=t.innerType._zod.pattern;return e?RegExp(`^(${fe(e.source)})?$`):void 0}),e._zod.parse=(e,n)=>{if(t.innerType._zod.optin===`optional`){let r=t.innerType._zod.run(e,n);return r instanceof Promise?r.then(t=>Fe(t,e.value)):Fe(r,e.value)}return e.value===void 0?e:t.innerType._zod.run(e,n)}}),Le=C(`$ZodPipe`,(e,t)=>{z.init(e,t),D(e._zod,`values`,()=>t.in._zod.values),D(e._zod,`optin`,()=>t.in._zod.optin),D(e._zod,`optout`,()=>t.out._zod.optout),D(e._zod,`propValues`,()=>t.in._zod.propValues),e._zod.parse=(e,n)=>{if(n.direction===`backward`){let r=t.out._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.in,n)):H(r,t.in,n)}let r=t.in._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.out,n)):H(r,t.out,n)}});function H(e,t,n){return e.issues.length?(e.aborted=!0,e):t._zod.run({value:e.value,issues:e.issues},n)}function Re(e,t){return new e({type:`string`,...k(t)})}function ze(e,t){return new e({type:`number`,checks:[],...k(t)})}function Be(e,t){return new Ce({check:`min_length`,...k(t),minimum:e})}function Ve(e,t){return new Te({check:`string_format`,format:`regex`,...k(t),pattern:e})}let U=C(`ZodMiniType`,(e,t)=>{if(!e._zod)throw Error(`Uninitialized schema in ZodMiniType.`);z.init(e,t),e.def=t,e.type=t.type,e.parse=(t,n)=>be(e,t,n,{callee:e.parse}),e.safeParse=(t,n)=>F(e,t,n),e.parseAsync=async(t,n)=>xe(e,t,n,{callee:e.parseAsync}),e.safeParseAsync=async(t,n)=>I(e,t,n),e.check=(...n)=>e.clone({...t,checks:[...t.checks??[],...n.map(e=>typeof e==`function`?{_zod:{check:e,def:{check:`custom`},onattach:[]}}:e)]},{parent:!0}),e.with=e.check,e.clone=(t,n)=>he(e,t,n),e.brand=()=>e,e.register=((t,n)=>(t.add(e,n),e)),e.apply=t=>t(e)}),He=C(`ZodMiniString`,(e,t)=>{De.init(e,t),U.init(e,t)});function W(e){return Re(He,e)}let Ue=C(`ZodMiniNumber`,(e,t)=>{Oe.init(e,t),U.init(e,t)});function We(e){return ze(Ue,e)}let Ge=C(`ZodMiniArray`,(e,t)=>{ke.init(e,t),U.init(e,t)});function Ke(e,t){return new Ge({type:`array`,element:e,...k(t)})}let qe=C(`ZodMiniObject`,(e,t)=>{Me.init(e,t),U.init(e,t),D(e,`shape`,()=>t.shape)});function G(e,t){return new qe({type:`object`,shape:e??{},...k(t)})}let Je=C(`ZodMiniRecord`,(e,t)=>{Ne.init(e,t),U.init(e,t)});function Ye(e,t,n){return new Je({type:`record`,keyType:e,valueType:t,...k(n)})}let Xe=C(`ZodMiniTransform`,(e,t)=>{Pe.init(e,t),U.init(e,t)});function Ze(e){return new Xe({type:`transform`,transform:e})}let Qe=C(`ZodMiniOptional`,(e,t)=>{Ie.init(e,t),U.init(e,t)});function K(e){return new Qe({type:`optional`,innerType:e})}let $e=C(`ZodMiniPipe`,(e,t)=>{Le.init(e,t),U.init(e,t)});function et(e,t){return new $e({type:`pipe`,in:e,out:t})}function tt(){return W().check(Ve(/^\\d+(\\.\\d+)?$/,`Invalid amount`))}function nt(e){let{opaque:t,request:n,...r}=e.challenge,i={challenge:{...r,...t!==void 0&&{opaque:oe(t)},request:oe(n)},payload:e.payload,...e.source&&{source:e.source}};return`Payment ${ae(JSON.stringify(i),{pad:!1,url:!0})}`}function rt(e){return e}function it(e,t){let{context:n,createCredential:r}=t;return{...e,context:n,createCredential:r}}var q,at=e((()=>{q=`2.47.6`}));function ot(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause!==void 0?ot(e.cause,t):t?null:e}var J,st;e((()=>{at(),J={getDocsUrl:({docsBaseUrl:e,docsPath:t=``,docsSlug:n})=>t?`${e??`https://viem.sh`}${t}${n?`#${n}`:``}`:void 0,version:`viem@${q}`},st=class e extends Error{constructor(t,n={}){let r=n.cause instanceof e?n.cause.details:n.cause?.message?n.cause.message:n.details,i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=J.getDocsUrl?.({...n,docsPath:i}),o=[t||`An error occurred.`,``,...n.metaMessages?[...n.metaMessages,``]:[],...a?[`Docs: ${a}`]:[],...r?[`Details: ${r}`]:[],...J.version?[`Version: ${J.version}`]:[]].join(`\n`);super(o,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,`details`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`docsPath`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`metaMessages`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`shortMessage`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`version`,{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,`name`,{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.details=r,this.docsPath=i,this.metaMessages=n.metaMessages,this.name=n.name??this.name,this.shortMessage=t,this.version=q}walk(e){return ot(this,e)}}}))();var ct=class extends st{constructor({value:e}){super(`Number \\`${e}\\` is not a valid decimal number.`,{name:`InvalidDecimalNumberError`})}};function lt(e,t){if(!/^(-?)([0-9]*)\\.?([0-9]*)$/.test(e))throw new ct({value:e});let[n,r=`0`]=e.split(`.`),i=n.startsWith(`-`);if(i&&(n=n.slice(1)),r=r.replace(/(0+)$/,``),t===0)Math.round(Number(`.${r}`))===1&&(n=`${BigInt(n)+1n}`),r=``;else if(r.length>t){let[e,i,a]=[r.slice(0,t-1),r.slice(t-1,t),r.slice(t)],o=Math.round(Number(`${i}.${a}`));r=o>9?`${BigInt(e)+BigInt(1)}0`.padStart(e.length+1,`0`):`${e}${o}`,r.length>t&&(r=r.slice(1),n=`${BigInt(n)+1n}`),r=r.slice(0,t)}else r=r.padEnd(t,`0`);return BigInt(`${i?`-`:``}${n}${r}`)}let ut=rt({name:`stripe`,intent:`charge`,schema:{credential:{payload:G({externalId:K(W()),spt:W()})},request:et(G({amount:tt(),currency:W(),decimals:We(),description:K(W()),externalId:K(W()),metadata:K(Ye(W(),W())),networkId:W(),paymentMethodTypes:Ke(W()).check(Be(1)),recipient:K(W())}),Ze(({amount:e,decimals:t,metadata:n,networkId:r,paymentMethodTypes:i,...a})=>({...a,amount:lt(e,t).toString(),methodDetails:{networkId:r,paymentMethodTypes:i,...n!==void 0&&{metadata:n}}})))}});function dt(e){let{client:t,createToken:n,externalId:r,paymentMethod:i}=e;return it(ut,{context:G({paymentMethod:K(W())}),async createCredential({challenge:e,context:a}){let o=a?.paymentMethod??i;if(!o)throw Error(`paymentMethod is required (pass via context or parameters)`);let s=e.request.amount,c=e.request.currency,l=e.request.methodDetails?.networkId;if(!l)throw Error(`networkId is required in challenge.methodDetails`);let u=e.request.methodDetails?.metadata;if(u?.externalId)throw Error(`methodDetails.metadata.externalId is reserved; use credential externalId instead`);return nt({challenge:e,payload:{spt:await n({amount:s,challenge:e,client:t,currency:c,expiresAt:e.expires?Math.floor(new Date(e.expires).getTime()/1e3):Math.floor(Date.now()/1e3)+3600,metadata:u,networkId:l,paymentMethod:o}),...r?{externalId:r}:{}}})}})}function ft(e){return[dt(e)]}(function(e){e.charge=dt})(ft||={});var pt=r();let Y={data:`__MPPX_DATA__`,error:`root_error`,root:`root`},mt={serviceWorker:`__mppx_worker`,tab:`__mppx_tab`},X={challengeId:`data-mppx-challenge-id`,remaining:`data-remaining`};var Z=class{name;constructor(e){this.name=`--mppx-${e}`}toString(){return`var(${this.name})`}};let ht={accent:new Z(`accent`),background:new Z(`background`),border:new Z(`border`),foreground:new Z(`foreground`),muted:new Z(`muted`),negative:new Z(`negative`),positive:new Z(`positive`),surface:new Z(`surface`),fontFamily:new Z(`font-family`),fontSizeBase:new Z(`font-size-base`),radius:new Z(`radius`),spacingUnit:new Z(`spacing-unit`)};String.raw`<style>\n  *,\n  ::after,\n  ::before,\n  ::backdrop,\n  ::file-selector-button {\n    box-sizing: border-box;\n    margin: 0;\n    padding: 0;\n    border: 0 solid;\n    border-color: ${ht.border};\n  }\n  html,\n  :host {\n    line-height: 1.5;\n    -webkit-text-size-adjust: 100%;\n    tab-size: 4;\n    -webkit-tap-highlight-color: transparent;\n  }\n  h1,\n  h2,\n  h3,\n  h4,\n  h5,\n  h6 {\n    font-size: inherit;\n    font-weight: inherit;\n  }\n  a {\n    color: inherit;\n    -webkit-text-decoration: inherit;\n    text-decoration: inherit;\n  }\n  b,\n  strong {\n    font-weight: bolder;\n  }\n  code,\n  kbd,\n  samp,\n  pre {\n    font-family:\n      ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New',\n      monospace;\n    font-size: 1em;\n  }\n  small {\n    font-size: 80%;\n  }\n  ol,\n  ul,\n  menu {\n    list-style: none;\n  }\n  img,\n  svg,\n  video,\n  canvas,\n  audio,\n  iframe,\n  embed,\n  object {\n    display: block;\n    vertical-align: middle;\n  }\n  img,\n  video {\n    max-width: 100%;\n    height: auto;\n  }\n  button,\n  input,\n  select,\n  optgroup,\n  textarea,\n  ::file-selector-button {\n    font: inherit;\n    font-feature-settings: inherit;\n    font-variation-settings: inherit;\n    letter-spacing: inherit;\n    color: inherit;\n    border-radius: 0;\n    background-color: transparent;\n    opacity: 1;\n  }\n  ::file-selector-button {\n    margin-inline-end: 4px;\n  }\n  ::placeholder {\n    opacity: 1;\n  }\n  @supports (not (-webkit-appearance: -apple-pay-button)) or (contain-intrinsic-size: 1px) {\n    ::placeholder {\n      color: color-mix(in oklab, currentcolor 50%, transparent);\n    }\n  }\n  textarea {\n    resize: vertical;\n  }\n  ::-webkit-search-decoration {\n    -webkit-appearance: none;\n  }\n  :-moz-ui-invalid {\n    box-shadow: none;\n  }\n  button,\n  input:where([type='button'], [type='reset'], [type='submit']),\n  ::file-selector-button {\n    appearance: button;\n  }\n  ::-webkit-inner-spin-button,\n  ::-webkit-outer-spin-button {\n    height: auto;\n  }\n  [hidden]:where(:not([hidden='until-found'])) {\n    display: none !important;\n  }\n</style>`;function gt(e,t){if(t==null)return e;if(!Q(e)||!Q(t))return t??e;let n={...e};for(let[e,r]of Object.entries(t)){if(r==null||r===``)continue;let t=n[e];n[e]=Q(t)&&Q(r)?gt(t,r):r}return n}function Q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function _t(e){let t=new URL(location.href);t.searchParams.set(mt.serviceWorker,``);let n=await navigator.serviceWorker.register(t.pathname+t.search),r=await new Promise(e=>{let t=n.installing??n.waiting??n.active;if(t?.state===`activated`)return e(t);let r=t??n;r.addEventListener(`statechange`,function t(){let i=n.active;i?.state===`activated`&&(r.removeEventListener(`statechange`,t),e(i))})});await new Promise(t=>{let n=new MessageChannel;n.port1.onmessage=()=>t(),r.postMessage({credential:e},[n.port2])}),location.reload()}function vt(e){let t=document.getElementById(Y.data),n=m(t.textContent),r=t.getAttribute(X.remaining);!r||Number(r)<=1?t.remove():t.setAttribute(X.remaining,String(Number(r)-1));let i=document.currentScript,a=i?.getAttribute(X.challengeId),o=a?(i.removeAttribute(X.challengeId),n[a]):Object.values(n).find(t=>t.challenge.method===e);return{...o,error(e){if(!e){document.getElementById(Y.error)?.remove();return}let t=document.getElementById(Y.error);if(t){t.textContent=e;return}let n=document.createElement(`p`);n.id=Y.error,n.className=`mppx-error`,n.role=`alert`,n.textContent=e,document.getElementById(o.rootId)?.after(n)},root:document.getElementById(o.rootId),submit:_t,vars:ht}}let $=vt(`stripe`),yt=String.raw,bt=document.createElement(`style`);bt.textContent=yt`\n  form {\n    display: flex;\n    flex-direction: column;\n    gap: calc(${$.vars.spacingUnit} * 8);\n  }\n  button {\n    background: ${$.vars.accent};\n    border-radius: ${$.vars.radius};\n    color: ${$.vars.background};\n    cursor: pointer;\n    font-weight: 500;\n    padding: calc(${$.vars.spacingUnit} * 4) calc(${$.vars.spacingUnit} * 8);\n    width: 100%;\n  }\n  button:hover:not(:disabled) {\n    opacity: 0.85;\n  }\n  button:disabled {\n    cursor: default;\n    opacity: 0.5;\n  }\n`,$.root.append(bt),(async()=>{let e=await(0,pt.loadStripe)($.config.publishableKey);if(!e)throw Error(`Failed to loadStripe`);let t=window.matchMedia(`(prefers-color-scheme: dark)`),n=()=>{let e=(()=>{if($.config.elements?.options?.appearance?.theme)return $.config.elements?.options?.appearance?.theme;switch($.theme.colorScheme){case`light dark`:return t.matches?`night`:`stripe`;case`light`:return`stripe`;case`dark`:return`night`}})(),n=+!!t.matches;return gt({disableAnimations:!0,theme:e,variables:{borderRadius:$.theme.radius,colorBackground:$.theme.surface[n],colorDanger:$.theme.negative[n],colorPrimary:$.theme.accent[n],colorText:$.theme.foreground[n],colorTextSecondary:$.theme.muted[n],fontSizeBase:$.theme.fontSizeBase,fontFamily:$.theme.fontFamily,spacingUnit:$.theme.spacingUnit}},$.config.elements?.options?.appearance??{})},r=e.elements({appearance:n(),...$.config.elements?.options,amount:Number($.challenge.request.amount),currency:$.challenge.request.currency,mode:`payment`,paymentMethodCreation:`manual`,paymentMethodTypes:$.challenge.request.methodDetails.paymentMethodTypes});t.addEventListener(`change`,()=>{r.update({appearance:n()})});let i=document.createElement(`form`);r.create(`payment`,$.config.elements?.paymentOptions).mount(i),$.root.appendChild(i);let a=document.createElement(`button`);a.textContent=$.text.pay,a.type=`submit`,i.appendChild(a),i.onsubmit=async t=>{t.preventDefault(),$.error(),a.disabled=!0;try{await r.submit();let{paymentMethod:t,error:n}=await e.createPaymentMethod({...$.config.elements?.createPaymentMethodOptions,elements:r});if(n||!t)throw n??Error(`Failed to create payment method`);let i=await ft({client:e,createToken:xt})[0].createCredential({challenge:$.challenge,context:{paymentMethod:t.id}});await $.submit(i)}catch(e){$.error(e instanceof Error?e.message:`Payment failed`)}finally{a.disabled=!1}}})();async function xt(e){let t=new URL($.config.createTokenUrl,location.origin);if(t.origin!==location.origin)throw Error(`createTokenUrl must be same-origin`);let n=await fetch(t,{method:`POST`,headers:{\"Content-Type\":`application/json`},body:JSON.stringify(e)});if(!n.ok){let e=await n.text().catch(()=>`<response body unavailable>`);throw Error(`Failed to create SPT (${n.status}): ${e}`)}return(await n.json()).spt}})();</script>"

package/src/tempo/client/SessionManager.ts

@@ -138,10 +138,28 @@ export function sessionManager(parameters: sessionManager.Parameters): SessionMa
 
   function updateSpentFromReceipt(receipt: SessionReceipt | null | undefined) {
     if (!receipt || receipt.channelId !== channel?.channelId) return
+    assertReceiptWithinLocalState(receipt)
     const next = BigInt(receipt.spent)
     spent = spent > next ? spent : next
   }
 
+  function assertReceiptWithinLocalState(receipt: SessionReceipt) {
+    if (!channel || receipt.channelId !== channel.channelId) return
+    const acceptedCumulative = BigInt(receipt.acceptedCumulative)
+    const receiptSpent = BigInt(receipt.spent)
+    if (receiptSpent > acceptedCumulative) {
+      throw new Error('receipt spent exceeds accepted cumulative voucher amount')
+    }
+    if (acceptedCumulative > channel.cumulativeAmount) {
+      throw new Error('receipt accepted cumulative exceeds local voucher state')
+    }
+    if (receiptSpent > channel.cumulativeAmount) {
+      throw new Error('receipt spent exceeds local voucher state')
+    }
+    assertVoucherWithinLocalLimit(acceptedCumulative)
+    assertVoucherWithinLocalLimit(receiptSpent)
+  }
+
   function waitForReceipt(predicate: (receipt: SessionReceipt) => boolean = () => true) {
     if (receiptWaiter) throw new Error('receipt wait already in progress')
     return new Promise<SessionReceipt>((resolve, reject) => {
@@ -762,7 +780,14 @@ export function sessionManager(parameters: sessionManager.Parameters): SessionMa
         context: {
           action: 'close',
           channelId: closeChannelId,
-          cumulativeAmountRaw: getFallbackCloseAmount(closeChallenge, closeChannelId),
+          cumulativeAmountRaw: (() => {
+            const closeAmount = BigInt(getFallbackCloseAmount(closeChallenge, closeChannelId))
+            if (closeAmount > channel.cumulativeAmount) {
+              throw new Error('fallback close amount exceeds local voucher state')
+            }
+            assertVoucherWithinLocalLimit(closeAmount)
+            return closeAmount.toString()
+          })(),
         },
       })
 

package/src/tempo/internal/fee-payer.test.ts

@@ -123,6 +123,145 @@ describe('validateCalls', () => {
     ).not.toThrow()
   })
 
+  test('accepts approve + buy + exact expected split transfers', () => {
+    expect(() =>
+      validateCalls(
+        [
+          {
+            to: swapTokenIn,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'approve',
+              args: [Addresses.stablecoinDex, 100n],
+            }),
+          },
+          {
+            to: Addresses.stablecoinDex,
+            data: swapData,
+          },
+          {
+            to: swapTokenOut,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'transfer',
+              args: [bogus, 90n],
+            }),
+          },
+          {
+            to: swapTokenOut,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'transferWithMemo',
+              args: [
+                '0x0000000000000000000000000000000000000002',
+                10n,
+                '0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef',
+              ],
+            }),
+          },
+        ],
+        details,
+        {
+          currency: swapTokenOut,
+          expectedTransfers: [
+            { amount: '90', recipient: bogus },
+            {
+              amount: '10',
+              memo: '0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef',
+              recipient: '0x0000000000000000000000000000000000000002',
+            },
+          ],
+        },
+      ),
+    ).not.toThrow()
+  })
+
+  test('error: rejects extra transfers when expected payments are supplied', () => {
+    expect(() =>
+      validateCalls(
+        [
+          {
+            to: swapTokenOut,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'transfer',
+              args: [bogus, 100n],
+            }),
+          },
+          {
+            to: swapTokenOut,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'transfer',
+              args: ['0x0000000000000000000000000000000000000002', 1n],
+            }),
+          },
+        ],
+        details,
+        {
+          currency: swapTokenOut,
+          expectedTransfers: [{ amount: '100', recipient: bogus }],
+        },
+      ),
+    ).toThrow('disallowed call pattern')
+  })
+
+  test('error: rejects expected transfers to the wrong token', () => {
+    expect(() =>
+      validateCalls(
+        [
+          {
+            to: swapTokenIn,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'transfer',
+              args: [bogus, 100n],
+            }),
+          },
+        ],
+        details,
+        {
+          currency: swapTokenOut,
+          expectedTransfers: [{ amount: '100', recipient: bogus }],
+        },
+      ),
+    ).toThrow('payment transfer does not match challenge')
+  })
+
+  test('error: rejects swaps whose output token does not fund the payment', () => {
+    expect(() =>
+      validateCalls(
+        [
+          {
+            to: swapTokenIn,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'approve',
+              args: [Addresses.stablecoinDex, 100n],
+            }),
+          },
+          {
+            to: Addresses.stablecoinDex,
+            data: swapData,
+          },
+          {
+            to: bogus,
+            data: encodeFunctionData({
+              abi: Abis.tip20,
+              functionName: 'transfer',
+              args: [bogus, 100n],
+            }),
+          },
+        ],
+        details,
+        {
+          currency: bogus,
+          expectedTransfers: [{ amount: '100', recipient: bogus }],
+        },
+      ),
+    ).toThrow('swap tokenOut does not match payment currency')
+  })
+
   test('error: rejects empty calls', () => {
     expect(() => validateCalls([], details)).toThrow(FeePayerValidationError)
   })