mppx 0.6.30 → 0.6.31

package/dist/tempo/server/internal/html.gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,68liBAA68liB,CAAA"}
+{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,ii7iBAAii7iB,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.6.30",
+  "version": "0.6.31",
   "main": "./dist/index.js",
   "license": "MIT",
   "files": [
@@ -143,8 +143,8 @@
     }
   },
   "dependencies": {
-    "incur": "^0.4.5",
-    "ox": "0.14.24",
+    "incur": "^0.4.8",
+    "ox": "0.14.27",
     "zod": "^4.4.3"
   },
   "repository": {

package/src/server/Mppx.test.ts

@@ -3983,6 +3983,80 @@ describe('realm auto-detection', () => {
     }
   })
 
+  // A raw request line can carry a protocol-relative or embedded-authority
+  // target that WHATWG URL would resolve into a foreign host, which would then
+  // be auto-detected as the challenge realm. The realm must stay bound to the
+  // Host header.
+  test.each([
+    { name: 'protocol-relative', path: '//evil.com/resource' },
+    { name: 'embedded authority', path: '//first.example//evil.com/resource' },
+  ])('ignores $name request targets when deriving realm in node listeners', async ({ path }) => {
+    const handler = Mppx.create({ methods: [mockMethod], secretKey })
+    const server = await Http.createServer(async (req, res) => {
+      const result = await Mppx.toNodeListener(
+        handler.charge({
+          amount: '100',
+          currency: '0x0000000000000000000000000000000000000001',
+          recipient: '0x0000000000000000000000000000000000000002',
+        }),
+      )(req, res)
+
+      if (result.status !== 402) res.end('OK')
+    })
+
+    try {
+      const rawResponse = await new Promise<{
+        body: string
+        headers: http.IncomingHttpHeaders
+        statusCode: number
+      }>((resolve, reject) => {
+        const request = http.request(
+          {
+            host: '127.0.0.1',
+            port: server.port,
+            method: 'GET',
+            path,
+            headers: { Host: `localhost:${server.port}` },
+          },
+          (response) => {
+            const chunks: Buffer[] = []
+            response.on('data', (chunk) => chunks.push(Buffer.from(chunk)))
+            response.on('end', () => {
+              resolve({
+                body: Buffer.concat(chunks).toString('utf8'),
+                headers: response.headers,
+                statusCode: response.statusCode ?? 0,
+              })
+            })
+          },
+        )
+
+        request.on('error', reject)
+        request.end()
+      })
+
+      const headers = new Headers()
+      for (const [name, value] of Object.entries(rawResponse.headers)) {
+        if (Array.isArray(value)) {
+          for (const item of value) headers.append(name, item)
+        } else if (value !== undefined) {
+          headers.append(name, value)
+        }
+      }
+
+      const challenge = Challenge.fromResponse(
+        new Response(rawResponse.body, {
+          status: rawResponse.statusCode,
+          headers,
+        }),
+      )
+
+      expect(challenge.realm).toBe('localhost')
+    } finally {
+      server.close()
+    }
+  })
+
   test('credential verifies across different casing of same host', async () => {
     const handler = Mppx.create({ methods: [mockMethod], secretKey })
 

package/src/server/Request.test.ts

@@ -1,5 +1,8 @@
 import { EventEmitter } from 'node:events'
+import { createServer } from 'node:http'
 import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import { connect } from 'node:net'
 
 import { Request } from 'mppx/server'
 import { describe, expect, test } from 'vp/test'
@@ -73,6 +76,32 @@ describe('fromNodeListener', () => {
     expect(request.url).toBe('http://example.com/api/resource?q=1')
   })
 
+  // The request target's authority must never override the trusted host
+  // (options.host > Host > :authority > localhost). A raw request line can
+  // carry protocol-relative, triple-slash, backslash, or embedded-authority
+  // targets that WHATWG URL would otherwise resolve into a foreign host.
+  test.each([
+    ['protocol-relative', '//evil.com/path?q=1', 'http://example.com/path?q=1'],
+    ['triple-slash', '///evil.com/x', 'http://example.com/x'],
+    ['backslash', '/\\evil.com/x', 'http://example.com/x'],
+    ['userinfo authority', '//user:pass@evil.com/path', 'http://example.com/path'],
+    ['ipv6 authority', '//[2001:db8::1]:8443/path', 'http://example.com/path'],
+    ['embedded authority', '//first.example//evil.com/path', 'http://example.com//evil.com/path'],
+    [
+      'absolute embedded authority',
+      'http://first.example//evil.com/p',
+      'http://example.com//evil.com/p',
+    ],
+    ['encoded slashes stay path', '/%2F%2Fevil.com/p', 'http://example.com/%2F%2Fevil.com/p'],
+  ])('binds host to Host header for %s request targets', (_name, url, expected) => {
+    const [req, res] = createMockRequest({ url, rawHeaders: ['Host', 'example.com'] })
+
+    const request = Request.fromNodeListener(req, res)
+
+    expect(request.url).toBe(expected)
+    expect(new URL(request.url).host).toBe('example.com')
+  })
+
   test('uses explicit protocol and host overrides', () => {
     const [req, res] = createMockRequest({
       url: '/api/resource',
@@ -172,3 +201,55 @@ describe('fromNodeListener', () => {
     expect(await request.text()).toBe('hello')
   })
 })
+
+// Conformance harness: a normal HTTP client cannot emit these request targets,
+// so they are driven through Node's real HTTP parser over a raw socket to prove
+// the adapter neutralizes host confusion end-to-end (not just via mocks).
+describe('toNodeListener (raw request target)', () => {
+  async function captureRequestUrl(rawRequestLine: string): Promise<string> {
+    let resolveUrl!: (url: string) => void
+    const observed = new Promise<string>((resolve) => {
+      resolveUrl = resolve
+    })
+
+    const server = createServer(
+      Request.toNodeListener(async (request) => {
+        resolveUrl(request.url)
+        return new Response('ok')
+      }),
+    )
+
+    try {
+      await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()))
+      const { port } = server.address() as AddressInfo
+      const socket = connect(port, '127.0.0.1')
+      await new Promise<void>((resolve, reject) => {
+        socket.once('connect', () => resolve())
+        socket.once('error', reject)
+      })
+      socket.write(rawRequestLine)
+      const url = await observed
+      socket.destroy()
+      return url
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()))
+    }
+  }
+
+  test('binds host to Host header for a protocol-relative raw request target', async () => {
+    const url = await captureRequestUrl(
+      'GET //evil.com/protected?q=1 HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n',
+    )
+
+    expect(url).toBe('http://example.com/protected?q=1')
+    expect(new URL(url).host).toBe('example.com')
+  })
+
+  test('binds host to Host header for an embedded-authority raw request target', async () => {
+    const url = await captureRequestUrl(
+      'GET //first.example//evil.com/protected HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n',
+    )
+
+    expect(new URL(url).host).toBe('example.com')
+  })
+})

package/src/server/Request.ts

@@ -86,7 +86,7 @@ export function fromNodeListener(
     headers.get('Host') ??
     (req.headers as Record<string, string>)[':authority'] ??
     'localhost'
-  const url = new URL(normalizeRequestTarget(req.url), `${protocol}//${host}`)
+  const url = createRequestUrl(req.url, `${protocol}//${host}`)
 
   const init: RequestInit & { duplex?: string } = {
     method,
@@ -116,17 +116,31 @@ function hasBody(headers: Headers): boolean {
   return (contentLength !== null && contentLength !== '0') || headers.has('transfer-encoding')
 }
 
-function normalizeRequestTarget(url: string | undefined): string {
-  if (!url) return '/'
+/**
+ * Builds the request `URL` from a request target and a trusted origin.
+ *
+ * Only the parsed `pathname`/`search` are copied onto the trusted origin, so
+ * the target's authority can never override the host (protocol-relative,
+ * `///`, backslash, absolute-form, or embedded-authority targets). Components
+ * are copied onto a `URL` object rather than concatenated and re-parsed, since
+ * a normalized path can itself begin with `//` and be read as an authority.
+ */
+function createRequestUrl(target: string | undefined, origin: string): URL {
+  const url = new URL(origin)
+  if (!target) return url
 
+  let parsed: URL
   try {
-    const absoluteUrl = new URL(url)
-    // Absolute-form request targets can carry a different origin than the socket host.
-    // Keep only path+query so realm detection stays bound to Host/:authority.
-    if (absoluteUrl.protocol === 'http:' || absoluteUrl.protocol === 'https:')
-      return `${absoluteUrl.pathname}${absoluteUrl.search}`
-  } catch {}
+    parsed = new URL(target, 'http://mppx.invalid')
+  } catch {
+    throw new TypeError('Invalid request target')
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+    throw new TypeError('Unsupported request target protocol')
 
+  url.pathname = parsed.pathname
+  url.search = parsed.search
+  url.hash = ''
   return url
 }
 

package/src/stripe/server/internal/html/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@stripe/stripe-js": "9.4.0",
+    "@stripe/stripe-js": "9.7.0",
     "mppx": "workspace:*"
   }
 }

package/src/stripe/server/internal/html.gen.ts

@@ -1,2 +1,2 @@
 // Generated — do not edit.
-export const html = "<script>(function(){var e=(e,t)=>()=>(e&&(t=e(e=0)),t),t=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),n=t((e=>{Object.defineProperty(e,\"__esModule\",{value:!0});function t(e){\"@babel/helpers - typeof\";return t=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},t(e)}var n=`dahlia`,r=function(e){return e===3?`v3`:e},i=`https://js.stripe.com`,a=`${i}/${n}/stripe.js`,o=/^https:\\/\\/js\\.stripe\\.com\\/v3\\/?(\\?.*)?$/,s=/^https:\\/\\/js\\.stripe\\.com\\/(v3|[a-z]+)\\/stripe\\.js(\\?.*)?$/,c=`loadStripe.setLoadParameters was called but an existing Stripe.js script already exists in the document; existing script parameters will be used`,l=function(e){return o.test(e)||s.test(e)},u=function(){for(var e=document.querySelectorAll(`script[src^=\"${i}\"]`),t=0;t<e.length;t++){var n=e[t];if(l(n.src))return n}return null},d=function(e){var t=e&&!e.advancedFraudSignals?`?advancedFraudSignals=false`:``,n=document.createElement(`script`);n.src=`${a}${t}`;var r=document.head||document.body;if(!r)throw Error(`Expected document.body not to be null. Stripe.js requires a <body> element.`);return r.appendChild(n),n},ee=function(e,t){!e||!e._registerWrapper||e._registerWrapper({name:`stripe-js`,version:`9.4.0`,startTime:t})},f=null,p=null,m=null,h=function(e){return function(t){e(Error(`Failed to load Stripe.js`,{cause:t}))}},g=function(e,t){return function(){window.Stripe?e(window.Stripe):t(Error(`Stripe.js not available`))}},te=function(e){return f===null?(f=new Promise(function(t,n){if(typeof window>`u`||typeof document>`u`){t(null);return}if(window.Stripe&&e&&console.warn(c),window.Stripe){t(window.Stripe);return}try{var r=u();if(r&&e)console.warn(c);else if(!r)r=d(e);else if(r&&m!==null&&p!==null){var i;r.removeEventListener(`load`,m),r.removeEventListener(`error`,p),(i=r.parentNode)==null||i.removeChild(r),r=d(e)}m=g(t,n),p=h(n),r.addEventListener(`load`,m),r.addEventListener(`error`,p)}catch(e){n(e);return}}),f.catch(function(e){return f=null,Promise.reject(e)})):f},ne=function(e,i,a){if(e===null)return null;var o=i[0];if(typeof o!=`string`)throw Error(`Expected publishable key to be of type string, got type ${t(o)} instead.`);var s=o.match(/^pk_test/),c=r(e.version),l=n;s&&c!==l&&console.warn(`Stripe.js@${c} was loaded on the page, but @stripe/stripe-js@9.4.0 expected Stripe.js@${l}. This may result in unexpected behavior. For more information, see https://docs.stripe.com/sdks/stripejs-versioning`);var u=e.apply(void 0,i);return ee(u,a),u},_=function(e){var n=`invalid load parameters; expected object of shape\n\n    {advancedFraudSignals: boolean}\n\nbut received\n\n    ${JSON.stringify(e)}\n`;if(e===null||t(e)!==`object`)throw Error(n);if(Object.keys(e).length===1&&typeof e.advancedFraudSignals==`boolean`)return e;throw Error(n)},v,y=!1,b=function(){for(var e=arguments.length,t=Array(e),n=0;n<e;n++)t[n]=arguments[n];y=!0;var r=Date.now();return te(v).then(function(e){return ne(e,t,r)})};b.setLoadParameters=function(e){if(y&&v){var t=_(e);if(Object.keys(t).reduce(function(t,n){return t&&e[n]===v?.[n]},!0))return}if(y)throw Error(`You cannot change load parameters after calling loadStripe`);v=_(e)},e.loadStripe=b})),r=t(((e,t)=>{t.exports=n()})),i,a=e((()=>{i=`0.1.1`}));function o(){return i}var s=e((()=>{a()}));function c(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause?c(e.cause,t):t?null:e}var l,u=e((()=>{s(),l=class e extends Error{static setStaticOptions(t){e.prototype.docsOrigin=t.docsOrigin,e.prototype.showVersion=t.showVersion,e.prototype.version=t.version}constructor(t,n={}){let r=(()=>{if(n.cause instanceof e){if(n.cause.details)return n.cause.details;if(n.cause.shortMessage)return n.cause.shortMessage}return n.cause&&`details`in n.cause&&typeof n.cause.details==`string`?n.cause.details:n.cause?.message?n.cause.message:n.details})(),i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=n.docsOrigin??e.prototype.docsOrigin,o=`${a}${i??``}`,s=!!(n.version??e.prototype.showVersion),c=n.version??e.prototype.version,l=[t||`An error occurred.`,...n.metaMessages?[``,...n.metaMessages]:[],...r||i||s?[``,r?`Details: ${r}`:void 0,i?`See: ${o}`:void 0,s?`Version: ${c}`:void 0]:[]].filter(e=>typeof e==`string`).join(`\n`);super(l,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,\"details\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docs\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docsOrigin\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docsPath\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"shortMessage\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"showVersion\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"version\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"cause\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.cause=n.cause,this.details=r,this.docs=o,this.docsOrigin=a,this.docsPath=i,this.shortMessage=t,this.showVersion=s,this.version=c}walk(e){return c(this,e)}},Object.defineProperty(l,\"defaultStaticOptions\",{enumerable:!0,configurable:!0,writable:!0,value:{docsOrigin:`https://oxlib.sh`,showVersion:!1,version:`ox@${o()}`}}),l.setStaticOptions(l.defaultStaticOptions)}));function d(e,t){if(_(e)>t)throw new y({givenSize:_(e),maxSize:t})}function ee(e,t={}){let{dir:n,size:r=32}=t;if(r===0)return e;if(e.length>r)throw new b({size:e.length,targetSize:r,type:`Bytes`});let i=new Uint8Array(r);for(let t=0;t<r;t++){let a=n===`right`;i[a?t:r-t-1]=e[a?t:e.length-t-1]}return i}var f=e((()=>{re()}));function p(e){if(e===null||typeof e==`boolean`||typeof e==`string`)return JSON.stringify(e);if(typeof e==`number`){if(!Number.isFinite(e))throw TypeError(`Cannot canonicalize non-finite number`);return Object.is(e,-0)?`0`:JSON.stringify(e)}if(typeof e==`bigint`)throw TypeError(`Cannot canonicalize bigint`);if(Array.isArray(e))return`[${e.map(e=>p(e)).join(`,`)}]`;if(typeof e==`object`)return`{${Object.keys(e).sort().reduce((t,n)=>{let r=e[n];return r!==void 0&&t.push(`${JSON.stringify(n)}:${p(r)}`),t},[]).join(`,`)}}`}function m(e,t){return JSON.parse(e,(e,n)=>{let r=n;return typeof r==`string`&&r.endsWith(h)?BigInt(r.slice(0,-9)):typeof t==`function`?t(e,r):r})}var h,g=e((()=>{h=`#__bigint`}));function te(e,t={}){let{size:n}=t,r=v.encode(e);return typeof n==`number`?(d(r,n),ne(r,n)):r}function ne(e,t){return ee(e,{dir:`right`,size:t})}function _(e){return e.length}var v,y,b,re=e((()=>{u(),f(),g(),v=new TextEncoder,y=class extends l{constructor({givenSize:e,maxSize:t}){super(`Size cannot exceed \\`${t}\\` bytes. Given size: \\`${e}\\` bytes.`),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeOverflowError`})}},b=class extends l{constructor({size:e,targetSize:t,type:n}){super(`${n.charAt(0).toUpperCase()}${n.slice(1).toLowerCase()} size (\\`${e}\\`) exceeds padding size (\\`${t}\\`).`),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeExceedsPaddingSizeError`})}}}));re();let ie=new TextDecoder,x=Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[t,e.charCodeAt(0)]));({...Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[e.charCodeAt(0),t]))});function ae(e,t={}){let{pad:n=!0,url:r=!1}=t,i=new Uint8Array(Math.ceil(e.length/3)*4);for(let t=0,n=0;n<e.length;t+=4,n+=3){let r=(e[n]<<16)+(e[n+1]<<8)+(e[n+2]|0);i[t]=x[r>>18],i[t+1]=x[r>>12&63],i[t+2]=x[r>>6&63],i[t+3]=x[r&63]}let a=e.length%3,o=Math.floor(e.length/3)*4+(a&&a+1),s=ie.decode(new Uint8Array(i.buffer,0,o));return n&&a===1&&(s+=`==`),n&&a===2&&(s+=`=`),r&&(s=s.replaceAll(`+`,`-`).replaceAll(`/`,`_`)),s}function oe(e,t={}){return ae(te(e),t)}g();function S(e){return oe(p(e),{pad:!1,url:!0})}var se;function C(e,t,n){function r(n,r){if(n._zod||Object.defineProperty(n,\"_zod\",{value:{def:r,constr:o,traits:new Set},enumerable:!1}),n._zod.traits.has(e))return;n._zod.traits.add(e),t(n,r);let i=o.prototype,a=Object.keys(i);for(let e=0;e<a.length;e++){let t=a[e];t in n||(n[t]=i[t].bind(n))}}let i=n?.Parent??Object;class a extends i{}Object.defineProperty(a,\"name\",{value:e});function o(e){var t;let i=n?.Parent?new a:this;r(i,e),(t=i._zod).deferred??(t.deferred=[]);for(let e of i._zod.deferred)e();return i}return Object.defineProperty(o,\"init\",{value:r}),Object.defineProperty(o,Symbol.hasInstance,{value:t=>n?.Parent&&t instanceof n.Parent?!0:t?._zod?.traits?.has(e)}),Object.defineProperty(o,\"name\",{value:e}),o}var w=class extends Error{constructor(){super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`)}},ce=class extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`),this.name=`ZodEncodeError`}};(se=globalThis).__zod_globalConfig??(se.__zod_globalConfig={});let le=globalThis.__zod_globalConfig;function T(e){return e&&Object.assign(le,e),le}function ue(e,t){return typeof t==`bigint`?t.toString():t}function de(e){return{get value(){{let t=e();return Object.defineProperty(this,\"value\",{value:t}),t}throw Error(`cached value already set`)}}}function fe(e){return e==null}function pe(e){let t=+!!e.startsWith(`^`),n=e.endsWith(`$`)?e.length-1:e.length;return e.slice(t,n)}let E=Symbol(`evaluating`);function D(e,t,n){let r;Object.defineProperty(e,t,{get(){if(r!==E)return r===void 0&&(r=E,r=n()),r},set(n){Object.defineProperty(e,t,{value:n})},configurable:!0})}let me=`captureStackTrace`in Error?Error.captureStackTrace:(...e)=>{};function O(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function he(e){if(O(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!=`function`)return!0;let n=t.prototype;return!(O(n)===!1||Object.prototype.hasOwnProperty.call(n,`isPrototypeOf`)===!1)}function ge(e,t,n){let r=new e._zod.constr(t??e._zod.def);return(!t||n?.parent)&&(r._zod.parent=e),r}function k(e){let t=e;if(!t)return{};if(typeof t==`string`)return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error(\"Cannot specify both `message` and `error` params\");t.error=t.message}return delete t.message,typeof t.error==`string`?{...t,error:()=>t.error}:t}function _e(e){return Object.keys(e).filter(t=>e[t]._zod.optin===`optional`&&e[t]._zod.optout===`optional`)}-Number.MAX_VALUE,Number.MAX_VALUE;function A(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function ve(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue===!1)return!0;return!1}function j(e,t){return t.map(t=>{var n;return(n=t).path??(n.path=[]),t.path.unshift(e),t})}function M(e){return typeof e==`string`?e:e?.message}function N(e,t,n){let r=e.message?e.message:M(e.inst?._zod.def?.error?.(e))??M(t?.error?.(e))??M(n.customError?.(e))??M(n.localeError?.(e))??`Invalid input`,{inst:i,continue:a,input:o,...s}=e;return s.path??=[],s.message=r,t?.reportInput&&(s.input=o),s}function ye(e){return Array.isArray(e)?`array`:typeof e==`string`?`string`:`unknown`}let be=(e,t)=>{e.name=`$ZodError`,Object.defineProperty(e,\"_zod\",{value:e._zod,enumerable:!1}),Object.defineProperty(e,\"issues\",{value:t,enumerable:!1}),e.message=JSON.stringify(t,ue,2),Object.defineProperty(e,\"toString\",{value:()=>e.message,enumerable:!1})},xe=C(`$ZodError`,be),P=C(`$ZodError`,be,{Parent:Error}),Se=(e=>(t,n,r,i)=>{let a=r?{...r,async:!1}:{async:!1},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise)throw new w;if(o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw me(t,i?.callee),t}return o.value})(P),Ce=(e=>async(t,n,r,i)=>{let a=r?{...r,async:!0}:{async:!0},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise&&(o=await o),o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw me(t,i?.callee),t}return o.value})(P),we=(e=>(t,n,r)=>{let i=r?{...r,async:!1}:{async:!1},a=t._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new w;return a.issues.length?{success:!1,error:new(e??xe)(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),F=(e=>async(t,n,r)=>{let i=r?{...r,async:!0}:{async:!0},a=t._zod.run({value:n,issues:[]},i);return a instanceof Promise&&(a=await a),a.issues.length?{success:!1,error:new e(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),Te=e=>{let t=e?`[\\\\s\\\\S]{${e?.minimum??0},${e?.maximum??``}}`:`[\\\\s\\\\S]*`;return RegExp(`^${t}$`)},I=/^-?\\d+(?:\\.\\d+)?$/,L=C(`$ZodCheck`,(e,t)=>{var n;e._zod??={},e._zod.def=t,(n=e._zod).onattach??(n.onattach=[])}),Ee=C(`$ZodCheckMinLength`,(e,t)=>{var n;L.init(e,t),(n=e._zod.def).when??(n.when=e=>{let t=e.value;return!fe(t)&&t.length!==void 0}),e._zod.onattach.push(e=>{let n=e._zod.bag.minimum??-1/0;t.minimum>n&&(e._zod.bag.minimum=t.minimum)}),e._zod.check=n=>{let r=n.value;if(r.length>=t.minimum)return;let i=ye(r);n.issues.push({origin:i,code:`too_small`,minimum:t.minimum,inclusive:!0,input:r,inst:e,continue:!t.abort})}}),De=C(`$ZodCheckStringFormat`,(e,t)=>{var n,r;L.init(e,t),e._zod.onattach.push(e=>{let n=e._zod.bag;n.format=t.format,t.pattern&&(n.patterns??=new Set,n.patterns.add(t.pattern))}),t.pattern?(n=e._zod).check??(n.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:t.format,input:n.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})}):(r=e._zod).check??(r.check=()=>{})}),Oe=C(`$ZodCheckRegex`,(e,t)=>{De.init(e,t),e._zod.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:`regex`,input:n.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),ke={major:4,minor:4,patch:3},R=C(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=ke;let r=[...e._zod.def.checks??[]];e._zod.traits.has(`$ZodCheck`)&&r.unshift(e);for(let t of r)for(let n of t._zod.onattach)n(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let t=(e,t,n)=>{let r=A(e),i;for(let a of t){if(a._zod.def.when){if(ve(e)||!a._zod.def.when(e))continue}else if(r)continue;let t=e.issues.length,o=a._zod.check(e);if(o instanceof Promise&&n?.async===!1)throw new w;if(i||o instanceof Promise)i=(i??Promise.resolve()).then(async()=>{await o,e.issues.length!==t&&(r||=A(e,t))});else{if(e.issues.length===t)continue;r||=A(e,t)}}return i?i.then(()=>e):e},n=(n,i,a)=>{if(A(n))return n.aborted=!0,n;let o=t(i,r,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(t=>e._zod.parse(t,a))}return e._zod.parse(o,a)};e._zod.run=(i,a)=>{if(a.skipChecks)return e._zod.parse(i,a);if(a.direction===`backward`){let t=e._zod.parse({value:i.value,issues:[]},{...a,skipChecks:!0});return t instanceof Promise?t.then(e=>n(e,i,a)):n(t,i,a)}let o=e._zod.parse(i,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(e=>t(e,r,a))}return t(o,r,a)}}D(e,`~standard`,()=>({validate:t=>{try{let n=we(e,t);return n.success?{value:n.data}:{issues:n.error?.issues}}catch{return F(e,t).then(e=>e.success?{value:e.data}:{issues:e.error?.issues})}},vendor:`zod`,version:1}))}),Ae=C(`$ZodString`,(e,t)=>{R.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??Te(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch{}return typeof n.value==`string`||n.issues.push({expected:`string`,code:`invalid_type`,input:n.value,inst:e}),n}}),je=C(`$ZodNumber`,(e,t)=>{R.init(e,t),e._zod.pattern=e._zod.bag.pattern??I,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Number(n.value)}catch{}let i=n.value;if(typeof i==`number`&&!Number.isNaN(i)&&Number.isFinite(i))return n;let a=typeof i==`number`?Number.isNaN(i)?`NaN`:Number.isFinite(i)?void 0:`Infinity`:void 0;return n.issues.push({expected:`number`,code:`invalid_type`,input:i,inst:e,...a?{received:a}:{}}),n}});function z(e,t,n){e.issues.length&&t.issues.push(...j(n,e.issues)),t.value[n]=e.value}let Me=C(`$ZodArray`,(e,t)=>{R.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!Array.isArray(i))return n.issues.push({expected:`array`,code:`invalid_type`,input:i,inst:e}),n;n.value=Array(i.length);let a=[];for(let e=0;e<i.length;e++){let o=i[e],s=t.element._zod.run({value:o,issues:[]},r);s instanceof Promise?a.push(s.then(t=>z(t,n,e))):z(s,n,e)}return a.length?Promise.all(a).then(()=>n):n}});function B(e,t,n,r,i,a){let o=n in r;if(e.issues.length){if(i&&a&&!o)return;t.issues.push(...j(n,e.issues))}if(!o&&!i){e.issues.length||t.issues.push({code:`invalid_type`,expected:`nonoptional`,input:void 0,path:[n]});return}e.value===void 0?o&&(t.value[n]=void 0):t.value[n]=e.value}function Ne(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has(`$ZodType`))throw Error(`Invalid element at key \"${n}\": expected a Zod schema`);let n=_e(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function Pe(e,t,n,r,i,a){let o=[],s=i.keySet,c=i.catchall._zod,l=c.def.type,u=c.optin===`optional`,d=c.optout===`optional`;for(let i in t){if(i===`__proto__`||s.has(i))continue;if(l===`never`){o.push(i);continue}let a=c.run({value:t[i],issues:[]},r);a instanceof Promise?e.push(a.then(e=>B(e,n,i,t,u,d))):B(a,n,i,t,u,d)}return o.length&&n.issues.push({code:`unrecognized_keys`,keys:o,input:t,inst:a}),e.length?Promise.all(e).then(()=>n):n}let Fe=C(`$ZodObject`,(e,t)=>{if(R.init(e,t),!Object.getOwnPropertyDescriptor(t,`shape`)?.get){let e=t.shape;Object.defineProperty(t,\"shape\",{get:()=>{let n={...e};return Object.defineProperty(t,\"shape\",{value:n}),n}})}let n=de(()=>Ne(t));D(e._zod,`propValues`,()=>{let e=t.shape,n={};for(let t in e){let r=e[t]._zod;if(r.values){n[t]??(n[t]=new Set);for(let e of r.values)n[t].add(e)}}return n});let r=O,i=t.catchall,a;e._zod.parse=(t,o)=>{a??=n.value;let s=t.value;if(!r(s))return t.issues.push({expected:`object`,code:`invalid_type`,input:s,inst:e}),t;t.value={};let c=[],l=a.shape;for(let e of a.keys){let n=l[e],r=n._zod.optin===`optional`,i=n._zod.optout===`optional`,a=n._zod.run({value:s[e],issues:[]},o);a instanceof Promise?c.push(a.then(n=>B(n,t,e,s,r,i))):B(a,t,e,s,r,i)}return i?Pe(c,s,t,o,n.value,e):c.length?Promise.all(c).then(()=>t):t}}),Ie=C(`$ZodRecord`,(e,t)=>{R.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!he(i))return n.issues.push({expected:`record`,code:`invalid_type`,input:i,inst:e}),n;let a=[],o=t.keyType._zod.values;if(o){n.value={};let s=new Set;for(let c of o)if(typeof c==`string`||typeof c==`number`||typeof c==`symbol`){s.add(typeof c==`number`?c.toString():c);let o=t.keyType._zod.run({value:c,issues:[]},r);if(o instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(o.issues.length){n.issues.push({code:`invalid_key`,origin:`record`,issues:o.issues.map(e=>N(e,r,T())),input:c,path:[c],inst:e});continue}let l=o.value,u=t.valueType._zod.run({value:i[c],issues:[]},r);u instanceof Promise?a.push(u.then(e=>{e.issues.length&&n.issues.push(...j(c,e.issues)),n.value[l]=e.value})):(u.issues.length&&n.issues.push(...j(c,u.issues)),n.value[l]=u.value)}let c;for(let e in i)s.has(e)||(c??=[],c.push(e));c&&c.length>0&&n.issues.push({code:`unrecognized_keys`,input:i,inst:e,keys:c})}else{n.value={};for(let o of Reflect.ownKeys(i)){if(o===`__proto__`||!Object.prototype.propertyIsEnumerable.call(i,o))continue;let s=t.keyType._zod.run({value:o,issues:[]},r);if(s instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(typeof o==`string`&&I.test(o)&&s.issues.length){let e=t.keyType._zod.run({value:Number(o),issues:[]},r);if(e instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);e.issues.length===0&&(s=e)}if(s.issues.length){t.mode===`loose`?n.value[o]=i[o]:n.issues.push({code:`invalid_key`,origin:`record`,issues:s.issues.map(e=>N(e,r,T())),input:o,path:[o],inst:e});continue}let c=t.valueType._zod.run({value:i[o],issues:[]},r);c instanceof Promise?a.push(c.then(e=>{e.issues.length&&n.issues.push(...j(o,e.issues)),n.value[s.value]=e.value})):(c.issues.length&&n.issues.push(...j(o,c.issues)),n.value[s.value]=c.value)}}return a.length?Promise.all(a).then(()=>n):n}}),Le=C(`$ZodTransform`,(e,t)=>{R.init(e,t),e._zod.optin=`optional`,e._zod.parse=(n,r)=>{if(r.direction===`backward`)throw new ce(e.constructor.name);let i=t.transform(n.value,n);if(r.async)return(i instanceof Promise?i:Promise.resolve(i)).then(e=>(n.value=e,n.fallback=!0,n));if(i instanceof Promise)throw new w;return n.value=i,n.fallback=!0,n}});function V(e,t){return t===void 0&&(e.issues.length||e.fallback)?{issues:[],value:void 0}:e}let Re=C(`$ZodOptional`,(e,t)=>{R.init(e,t),e._zod.optin=`optional`,e._zod.optout=`optional`,D(e._zod,`values`,()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),D(e._zod,`pattern`,()=>{let e=t.innerType._zod.pattern;return e?RegExp(`^(${pe(e.source)})?$`):void 0}),e._zod.parse=(e,n)=>{if(t.innerType._zod.optin===`optional`){let r=e.value,i=t.innerType._zod.run(e,n);return i instanceof Promise?i.then(e=>V(e,r)):V(i,r)}return e.value===void 0?e:t.innerType._zod.run(e,n)}}),ze=C(`$ZodPipe`,(e,t)=>{R.init(e,t),D(e._zod,`values`,()=>t.in._zod.values),D(e._zod,`optin`,()=>t.in._zod.optin),D(e._zod,`optout`,()=>t.out._zod.optout),D(e._zod,`propValues`,()=>t.in._zod.propValues),e._zod.parse=(e,n)=>{if(n.direction===`backward`){let r=t.out._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.in,n)):H(r,t.in,n)}let r=t.in._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.out,n)):H(r,t.out,n)}});function H(e,t,n){return e.issues.length?(e.aborted=!0,e):t._zod.run({value:e.value,issues:e.issues,fallback:e.fallback},n)}function Be(e,t){return new e({type:`string`,...k(t)})}function Ve(e,t){return new e({type:`number`,checks:[],...k(t)})}function He(e,t){return new Ee({check:`min_length`,...k(t),minimum:e})}function Ue(e,t){return new Oe({check:`string_format`,format:`regex`,...k(t),pattern:e})}let U=C(`ZodMiniType`,(e,t)=>{if(!e._zod)throw Error(`Uninitialized schema in ZodMiniType.`);R.init(e,t),e.def=t,e.type=t.type,e.parse=(t,n)=>Se(e,t,n,{callee:e.parse}),e.safeParse=(t,n)=>we(e,t,n),e.parseAsync=async(t,n)=>Ce(e,t,n,{callee:e.parseAsync}),e.safeParseAsync=async(t,n)=>F(e,t,n),e.check=(...n)=>e.clone({...t,checks:[...t.checks??[],...n.map(e=>typeof e==`function`?{_zod:{check:e,def:{check:`custom`},onattach:[]}}:e)]},{parent:!0}),e.with=e.check,e.clone=(t,n)=>ge(e,t,n),e.brand=()=>e,e.register=((t,n)=>(t.add(e,n),e)),e.apply=t=>t(e)}),We=C(`ZodMiniString`,(e,t)=>{Ae.init(e,t),U.init(e,t)});function W(e){return Be(We,e)}let Ge=C(`ZodMiniNumber`,(e,t)=>{je.init(e,t),U.init(e,t)});function Ke(e){return Ve(Ge,e)}let qe=C(`ZodMiniArray`,(e,t)=>{Me.init(e,t),U.init(e,t)});function Je(e,t){return new qe({type:`array`,element:e,...k(t)})}let Ye=C(`ZodMiniObject`,(e,t)=>{Fe.init(e,t),U.init(e,t),D(e,`shape`,()=>t.shape)});function G(e,t){return new Ye({type:`object`,shape:e??{},...k(t)})}let Xe=C(`ZodMiniRecord`,(e,t)=>{Ie.init(e,t),U.init(e,t)});function Ze(e,t,n){return!t||!t._zod?new Xe({type:`record`,keyType:W(),valueType:e,...k(t)}):new Xe({type:`record`,keyType:e,valueType:t,...k(n)})}let Qe=C(`ZodMiniTransform`,(e,t)=>{Le.init(e,t),U.init(e,t)});function $e(e){return new Qe({type:`transform`,transform:e})}let et=C(`ZodMiniOptional`,(e,t)=>{Re.init(e,t),U.init(e,t)});function K(e){return new et({type:`optional`,innerType:e})}let tt=C(`ZodMiniPipe`,(e,t)=>{ze.init(e,t),U.init(e,t)});function nt(e,t){return new tt({type:`pipe`,in:e,out:t})}function rt(){return W().check(Ue(/^\\d+(\\.\\d+)?$/,`Invalid amount`))}function it(e){let{meta:t,opaque:n,request:r,...i}=e.challenge,a=n??(t===void 0?void 0:S(t)),o={challenge:{...i,...a!==void 0&&{opaque:a},request:S(r)},payload:e.payload,...e.source&&{source:e.source}};return`Payment ${oe(JSON.stringify(o),{pad:!1,url:!0})}`}var q,at=e((()=>{q=`2.51.3`}));function ot(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause!==void 0?ot(e.cause,t):t?null:e}var J,st;e((()=>{at(),J={getDocsUrl:({docsBaseUrl:e,docsPath:t=``,docsSlug:n})=>t?`${e??`https://viem.sh`}${t}${n?`#${n}`:``}`:void 0,version:`viem@${q}`},st=class e extends Error{constructor(t,n={}){let r=n.cause instanceof e?n.cause.details:n.cause?.message?n.cause.message:n.details,i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=J.getDocsUrl?.({...n,docsPath:i}),o=[t||`An error occurred.`,``,...n.metaMessages?[...n.metaMessages,``]:[],...a?[`Docs: ${a}`]:[],...r?[`Details: ${r}`]:[],...J.version?[`Version: ${J.version}`]:[]].join(`\n`);super(o,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,\"details\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docsPath\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"metaMessages\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"shortMessage\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"version\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.details=r,this.docsPath=i,this.metaMessages=n.metaMessages,this.name=n.name??this.name,this.shortMessage=t,this.version=q}walk(e){return ot(this,e)}}}))();var ct=class extends st{constructor({value:e}){super(`Number \\`${e}\\` is not a valid decimal number.`,{name:`InvalidDecimalNumberError`})}};function lt(e,t){if(!/^(-?)([0-9]*)\\.?([0-9]*)$/.test(e))throw new ct({value:e});let[n,r=`0`]=e.split(`.`),i=n.startsWith(`-`);if(i&&(n=n.slice(1)),r=r.replace(/(0+)$/,``),t===0)Math.round(Number(`.${r}`))===1&&(n=`${BigInt(n)+1n}`),r=``;else if(r.length>t){let[e,i,a]=[r.slice(0,t-1),r.slice(t-1,t),r.slice(t)],o=Math.round(Number(`${i}.${a}`));r=o>9?`${BigInt(e)+BigInt(1)}0`.padStart(e.length+1,`0`):`${e}${o}`,r.length>t&&(r=r.slice(1),n=`${BigInt(n)+1n}`),r=r.slice(0,t)}else r=r.padEnd(t,`0`);return BigInt(`${i?`-`:``}${n}${r}`)}function ut(e){return e}function dt(e,t){let{context:n,createCredential:r}=t;return{...e,context:n,createCredential:r}}let ft=ut({name:`stripe`,intent:`charge`,schema:{credential:{payload:G({externalId:K(W()),spt:W()})},request:nt(G({amount:rt(),currency:W(),decimals:Ke(),description:K(W()),externalId:K(W()),metadata:K(Ze(W(),W())),networkId:W(),paymentMethodTypes:Je(W()).check(He(1)),recipient:K(W())}),$e(({amount:e,decimals:t,metadata:n,networkId:r,paymentMethodTypes:i,...a})=>({...a,amount:lt(e,t).toString(),methodDetails:{networkId:r,paymentMethodTypes:i,...n!==void 0&&{metadata:n}}})))}});function pt(e){let{client:t,createToken:n,externalId:r,paymentMethod:i}=e;return dt(ft,{context:G({paymentMethod:K(W())}),async createCredential({challenge:e,context:a}){let o=a?.paymentMethod??i;if(!o)throw Error(`paymentMethod is required (pass via context or parameters)`);let s=e.request.amount,c=e.request.currency,l=e.request.methodDetails?.networkId;if(!l)throw Error(`networkId is required in challenge.methodDetails`);let u=e.request.methodDetails?.metadata;if(u?.externalId)throw Error(`methodDetails.metadata.externalId is reserved; use credential externalId instead`);return it({challenge:e,payload:{spt:await n({amount:s,challenge:e,client:t,currency:c,expiresAt:e.expires?Math.floor(new Date(e.expires).getTime()/1e3):Math.floor(Date.now()/1e3)+3600,metadata:u,networkId:l,paymentMethod:o}),...r?{externalId:r}:{}}})}})}function mt(e){return[pt(e)]}(function(e){e.charge=pt})(mt||={});var ht=r();let Y={data:`__MPPX_DATA__`,error:`root_error`,root:`root`},gt={serviceWorker:`__mppx_worker`,tab:`__mppx_tab`},X={challengeId:`data-mppx-challenge-id`,remaining:`data-remaining`};var Z=class{name;constructor(e){this.name=`--mppx-${e}`}toString(){return`var(${this.name})`}};let _t={accent:new Z(`accent`),background:new Z(`background`),border:new Z(`border`),foreground:new Z(`foreground`),muted:new Z(`muted`),negative:new Z(`negative`),positive:new Z(`positive`),surface:new Z(`surface`),fontFamily:new Z(`font-family`),fontSizeBase:new Z(`font-size-base`),radius:new Z(`radius`),spacingUnit:new Z(`spacing-unit`)};String.raw`<style>\n  *,\n  ::after,\n  ::before,\n  ::backdrop,\n  ::file-selector-button {\n    box-sizing: border-box;\n    margin: 0;\n    padding: 0;\n    border: 0 solid;\n    border-color: ${_t.border};\n  }\n  html,\n  :host {\n    line-height: 1.5;\n    -webkit-text-size-adjust: 100%;\n    tab-size: 4;\n    -webkit-tap-highlight-color: transparent;\n  }\n  h1,\n  h2,\n  h3,\n  h4,\n  h5,\n  h6 {\n    font-size: inherit;\n    font-weight: inherit;\n  }\n  a {\n    color: inherit;\n    -webkit-text-decoration: inherit;\n    text-decoration: inherit;\n  }\n  b,\n  strong {\n    font-weight: bolder;\n  }\n  code,\n  kbd,\n  samp,\n  pre {\n    font-family:\n      ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New',\n      monospace;\n    font-size: 1em;\n  }\n  small {\n    font-size: 80%;\n  }\n  ol,\n  ul,\n  menu {\n    list-style: none;\n  }\n  img,\n  svg,\n  video,\n  canvas,\n  audio,\n  iframe,\n  embed,\n  object {\n    display: block;\n    vertical-align: middle;\n  }\n  img,\n  video {\n    max-width: 100%;\n    height: auto;\n  }\n  button,\n  input,\n  select,\n  optgroup,\n  textarea,\n  ::file-selector-button {\n    font: inherit;\n    font-feature-settings: inherit;\n    font-variation-settings: inherit;\n    letter-spacing: inherit;\n    color: inherit;\n    border-radius: 0;\n    background-color: transparent;\n    opacity: 1;\n  }\n  ::file-selector-button {\n    margin-inline-end: 4px;\n  }\n  ::placeholder {\n    opacity: 1;\n  }\n  @supports (not (-webkit-appearance: -apple-pay-button)) or (contain-intrinsic-size: 1px) {\n    ::placeholder {\n      color: color-mix(in oklab, currentcolor 50%, transparent);\n    }\n  }\n  textarea {\n    resize: vertical;\n  }\n  ::-webkit-search-decoration {\n    -webkit-appearance: none;\n  }\n  :-moz-ui-invalid {\n    box-shadow: none;\n  }\n  button,\n  input:where([type='button'], [type='reset'], [type='submit']),\n  ::file-selector-button {\n    appearance: button;\n  }\n  ::-webkit-inner-spin-button,\n  ::-webkit-outer-spin-button {\n    height: auto;\n  }\n  [hidden]:where(:not([hidden='until-found'])) {\n    display: none !important;\n  }\n</style>`;function vt(e,t){if(t==null)return e;if(!Q(e)||!Q(t))return t??e;let n={...e};for(let[e,r]of Object.entries(t)){if(r==null||r===``)continue;let t=n[e];n[e]=Q(t)&&Q(r)?vt(t,r):r}return n}function Q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function yt(e){let t=new URL(location.href);t.searchParams.set(gt.serviceWorker,``);let n=await navigator.serviceWorker.register(t.pathname+t.search),r=await new Promise(e=>{let t=n.installing??n.waiting??n.active;if(t?.state===`activated`)return e(t);let r=t??n;r.addEventListener(`statechange`,function t(){let i=n.active;i?.state===`activated`&&(r.removeEventListener(`statechange`,t),e(i))})});await new Promise(t=>{let n=new MessageChannel;n.port1.onmessage=()=>t(),r.postMessage({credential:e},[n.port2])}),location.reload()}g();function bt(e){let t=document.getElementById(Y.data),n=m(t.textContent),r=t.getAttribute(X.remaining);!r||Number(r)<=1?t.remove():t.setAttribute(X.remaining,String(Number(r)-1));let i=document.currentScript,a=i?.getAttribute(X.challengeId),o=a?(i.removeAttribute(X.challengeId),n[a]):Object.values(n).find(t=>t.challenge.method===e);return{...o,error(e){if(!e){document.getElementById(Y.error)?.remove();return}let t=document.getElementById(Y.error);if(t){t.textContent=e;return}let n=document.createElement(`p`);n.id=Y.error,n.className=`mppx-error`,n.role=`alert`,n.textContent=e,document.getElementById(o.rootId)?.after(n)},root:document.getElementById(o.rootId),submit:yt,vars:_t}}let $=bt(`stripe`),xt=String.raw,St=document.createElement(`style`);St.textContent=xt`\n  form {\n    display: flex;\n    flex-direction: column;\n    gap: calc(${$.vars.spacingUnit} * 8);\n  }\n  button {\n    background: ${$.vars.accent};\n    border-radius: ${$.vars.radius};\n    color: ${$.vars.background};\n    cursor: pointer;\n    font-weight: 500;\n    padding: calc(${$.vars.spacingUnit} * 4) calc(${$.vars.spacingUnit} * 8);\n    width: 100%;\n  }\n  button:hover:not(:disabled) {\n    opacity: 0.85;\n  }\n  button:disabled {\n    cursor: default;\n    opacity: 0.5;\n  }\n`,$.root.append(St),(async()=>{let e=await(0,ht.loadStripe)($.config.publishableKey);if(!e)throw Error(`Failed to loadStripe`);let t=window.matchMedia(`(prefers-color-scheme: dark)`),n=()=>{let e=(()=>{if($.config.elements?.options?.appearance?.theme)return $.config.elements?.options?.appearance?.theme;switch($.theme.colorScheme){case`light dark`:return t.matches?`night`:`stripe`;case`light`:return`stripe`;case`dark`:return`night`}})(),n=+!!t.matches;return vt({disableAnimations:!0,theme:e,variables:{borderRadius:$.theme.radius,colorBackground:$.theme.surface[n],colorDanger:$.theme.negative[n],colorPrimary:$.theme.accent[n],colorText:$.theme.foreground[n],colorTextSecondary:$.theme.muted[n],fontSizeBase:$.theme.fontSizeBase,fontFamily:$.theme.fontFamily,spacingUnit:$.theme.spacingUnit}},$.config.elements?.options?.appearance??{})},r=e.elements({appearance:n(),...$.config.elements?.options,amount:Number($.challenge.request.amount),currency:$.challenge.request.currency,mode:`payment`,paymentMethodCreation:`manual`,paymentMethodTypes:$.challenge.request.methodDetails.paymentMethodTypes});t.addEventListener(`change`,()=>{r.update({appearance:n()})});let i=document.createElement(`form`);r.create(`payment`,$.config.elements?.paymentOptions).mount(i),$.root.appendChild(i);let a=document.createElement(`button`);a.textContent=$.text.pay,a.type=`submit`,i.appendChild(a),i.onsubmit=async t=>{t.preventDefault(),$.error(),a.disabled=!0;try{await r.submit();let{paymentMethod:t,error:n}=await e.createPaymentMethod({...$.config.elements?.createPaymentMethodOptions,elements:r});if(n||!t)throw n??Error(`Failed to create payment method`);let i=await mt({client:e,createToken:Ct})[0].createCredential({challenge:$.challenge,context:{paymentMethod:t.id}});await $.submit(i)}catch(e){$.error(e instanceof Error?e.message:`Payment failed`)}finally{a.disabled=!1}}})();async function Ct(e){let t=new URL($.config.createTokenUrl,location.origin);if(t.origin!==location.origin)throw Error(`createTokenUrl must be same-origin`);let n=await fetch(t,{method:`POST`,headers:{\"Content-Type\":`application/json`},body:JSON.stringify(e)});if(!n.ok){let e=await n.text().catch(()=>`<response body unavailable>`);throw Error(`Failed to create SPT (${n.status}): ${e}`)}return(await n.json()).spt}})();</script>"
+export const html = "<script>(function(){var e=(e,t)=>()=>(e&&(t=e(e=0)),t),t=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),n=t((e=>{Object.defineProperty(e,\"__esModule\",{value:!0});function t(e){\"@babel/helpers - typeof\";return t=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},t(e)}var n=`dahlia`,r=function(e){return e===3?`v3`:e},i=`https://js.stripe.com`,a=`${i}/${n}/stripe.js`,o=/^https:\\/\\/js\\.stripe\\.com\\/v3\\/?(\\?.*)?$/,s=/^https:\\/\\/js\\.stripe\\.com\\/(v3|[a-z]+)\\/stripe\\.js(\\?.*)?$/,c=`loadStripe.setLoadParameters was called but an existing Stripe.js script already exists in the document; existing script parameters will be used`,l=function(e){return o.test(e)||s.test(e)},u=function(){for(var e=document.querySelectorAll(`script[src^=\"${i}\"]`),t=0;t<e.length;t++){var n=e[t];if(l(n.src))return n}return null},d=function(e){var t=e&&!e.advancedFraudSignals?`?advancedFraudSignals=false`:``,n=document.createElement(`script`);n.src=`${a}${t}`;var r=document.head||document.body;if(!r)throw Error(`Expected document.body not to be null. Stripe.js requires a <body> element.`);return r.appendChild(n),n},ee=function(e,t){!e||!e._registerWrapper||e._registerWrapper({name:`stripe-js`,version:`9.7.0`,startTime:t})},f=null,p=null,m=null,h=function(e){return function(t){e(Error(`Failed to load Stripe.js`,{cause:t}))}},g=function(e,t){return function(){window.Stripe?e(window.Stripe):t(Error(`Stripe.js not available`))}},te=function(e){return f===null?(f=new Promise(function(t,n){if(typeof window>`u`||typeof document>`u`){t(null);return}if(window.Stripe&&e&&console.warn(c),window.Stripe){t(window.Stripe);return}try{var r=u();if(r&&e)console.warn(c);else if(!r)r=d(e);else if(r&&m!==null&&p!==null){var i;r.removeEventListener(`load`,m),r.removeEventListener(`error`,p),(i=r.parentNode)==null||i.removeChild(r),r=d(e)}m=g(t,n),p=h(n),r.addEventListener(`load`,m),r.addEventListener(`error`,p)}catch(e){n(e);return}}),f.catch(function(e){return f=null,Promise.reject(e)})):f},ne=function(e,i,a){if(e===null)return null;var o=i[0];if(typeof o!=`string`)throw Error(`Expected publishable key to be of type string, got type ${t(o)} instead.`);var s=o.match(/^pk_test/),c=r(e.version),l=n;s&&c!==l&&console.warn(`Stripe.js@${c} was loaded on the page, but @stripe/stripe-js@9.7.0 expected Stripe.js@${l}. This may result in unexpected behavior. For more information, see https://docs.stripe.com/sdks/stripejs-versioning`);var u=e.apply(void 0,i);return ee(u,a),u},_=function(e){var n=`invalid load parameters; expected object of shape\n\n    {advancedFraudSignals: boolean}\n\nbut received\n\n    ${JSON.stringify(e)}\n`;if(e===null||t(e)!==`object`)throw Error(n);if(Object.keys(e).length===1&&typeof e.advancedFraudSignals==`boolean`)return e;throw Error(n)},v,y=!1,b=function(){for(var e=arguments.length,t=Array(e),n=0;n<e;n++)t[n]=arguments[n];y=!0;var r=Date.now();return te(v).then(function(e){return ne(e,t,r)})};b.setLoadParameters=function(e){if(y&&v){var t=_(e);if(Object.keys(t).reduce(function(t,n){return t&&e[n]===v?.[n]},!0))return}if(y)throw Error(`You cannot change load parameters after calling loadStripe`);v=_(e)},e.loadStripe=b})),r=t(((e,t)=>{t.exports=n()})),i,a=e((()=>{i=`0.1.1`}));function o(){return i}var s=e((()=>{a()}));function c(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause?c(e.cause,t):t?null:e}var l,u=e((()=>{s(),l=class e extends Error{static setStaticOptions(t){e.prototype.docsOrigin=t.docsOrigin,e.prototype.showVersion=t.showVersion,e.prototype.version=t.version}constructor(t,n={}){let r=(()=>{if(n.cause instanceof e){if(n.cause.details)return n.cause.details;if(n.cause.shortMessage)return n.cause.shortMessage}return n.cause&&`details`in n.cause&&typeof n.cause.details==`string`?n.cause.details:n.cause?.message?n.cause.message:n.details})(),i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=n.docsOrigin??e.prototype.docsOrigin,o=`${a}${i??``}`,s=!!(n.version??e.prototype.showVersion),c=n.version??e.prototype.version,l=[t||`An error occurred.`,...n.metaMessages?[``,...n.metaMessages]:[],...r||i||s?[``,r?`Details: ${r}`:void 0,i?`See: ${o}`:void 0,s?`Version: ${c}`:void 0]:[]].filter(e=>typeof e==`string`).join(`\n`);super(l,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,\"details\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docs\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docsOrigin\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docsPath\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"shortMessage\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"showVersion\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"version\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"cause\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.cause=n.cause,this.details=r,this.docs=o,this.docsOrigin=a,this.docsPath=i,this.shortMessage=t,this.showVersion=s,this.version=c}walk(e){return c(this,e)}},Object.defineProperty(l,\"defaultStaticOptions\",{enumerable:!0,configurable:!0,writable:!0,value:{docsOrigin:`https://oxlib.sh`,showVersion:!1,version:`ox@${o()}`}}),l.setStaticOptions(l.defaultStaticOptions)}));function d(e,t){if(_(e)>t)throw new y({givenSize:_(e),maxSize:t})}function ee(e,t={}){let{dir:n,size:r=32}=t;if(r===0)return e;if(e.length>r)throw new b({size:e.length,targetSize:r,type:`Bytes`});let i=new Uint8Array(r);for(let t=0;t<r;t++){let a=n===`right`;i[a?t:r-t-1]=e[a?t:e.length-t-1]}return i}var f=e((()=>{re()}));function p(e){if(e===null||typeof e==`boolean`||typeof e==`string`)return JSON.stringify(e);if(typeof e==`number`){if(!Number.isFinite(e))throw TypeError(`Cannot canonicalize non-finite number`);return Object.is(e,-0)?`0`:JSON.stringify(e)}if(typeof e==`bigint`)throw TypeError(`Cannot canonicalize bigint`);if(Array.isArray(e))return`[${e.map(e=>p(e)).join(`,`)}]`;if(typeof e==`object`)return`{${Object.keys(e).sort().reduce((t,n)=>{let r=e[n];return r!==void 0&&t.push(`${JSON.stringify(n)}:${p(r)}`),t},[]).join(`,`)}}`}function m(e,t){return JSON.parse(e,(e,n)=>{let r=n;return typeof r==`string`&&r.endsWith(h)?BigInt(r.slice(0,-9)):typeof t==`function`?t(e,r):r})}var h,g=e((()=>{h=`#__bigint`}));function te(e,t={}){let{size:n}=t,r=v.encode(e);return typeof n==`number`?(d(r,n),ne(r,n)):r}function ne(e,t){return ee(e,{dir:`right`,size:t})}function _(e){return e.length}var v,y,b,re=e((()=>{u(),f(),g(),v=new TextEncoder,y=class extends l{constructor({givenSize:e,maxSize:t}){super(`Size cannot exceed \\`${t}\\` bytes. Given size: \\`${e}\\` bytes.`),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeOverflowError`})}},b=class extends l{constructor({size:e,targetSize:t,type:n}){super(`${n.charAt(0).toUpperCase()}${n.slice(1).toLowerCase()} size (\\`${e}\\`) exceeds padding size (\\`${t}\\`).`),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`Bytes.SizeExceedsPaddingSizeError`})}}}));re();let ie=new TextDecoder,x=Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[t,e.charCodeAt(0)]));({...Object.fromEntries(Array.from(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`).map((e,t)=>[e.charCodeAt(0),t]))});function ae(e,t={}){let{pad:n=!0,url:r=!1}=t,i=new Uint8Array(Math.ceil(e.length/3)*4);for(let t=0,n=0;n<e.length;t+=4,n+=3){let r=(e[n]<<16)+(e[n+1]<<8)+(e[n+2]|0);i[t]=x[r>>18],i[t+1]=x[r>>12&63],i[t+2]=x[r>>6&63],i[t+3]=x[r&63]}let a=e.length%3,o=Math.floor(e.length/3)*4+(a&&a+1),s=ie.decode(new Uint8Array(i.buffer,0,o));return n&&a===1&&(s+=`==`),n&&a===2&&(s+=`=`),r&&(s=s.replaceAll(`+`,`-`).replaceAll(`/`,`_`)),s}function oe(e,t={}){return ae(te(e),t)}g();function S(e){return oe(p(e),{pad:!1,url:!0})}var se;function C(e,t,n){function r(n,r){if(n._zod||Object.defineProperty(n,\"_zod\",{value:{def:r,constr:o,traits:new Set},enumerable:!1}),n._zod.traits.has(e))return;n._zod.traits.add(e),t(n,r);let i=o.prototype,a=Object.keys(i);for(let e=0;e<a.length;e++){let t=a[e];t in n||(n[t]=i[t].bind(n))}}let i=n?.Parent??Object;class a extends i{}Object.defineProperty(a,\"name\",{value:e});function o(e){var t;let i=n?.Parent?new a:this;r(i,e),(t=i._zod).deferred??(t.deferred=[]);for(let e of i._zod.deferred)e();return i}return Object.defineProperty(o,\"init\",{value:r}),Object.defineProperty(o,Symbol.hasInstance,{value:t=>n?.Parent&&t instanceof n.Parent?!0:t?._zod?.traits?.has(e)}),Object.defineProperty(o,\"name\",{value:e}),o}var w=class extends Error{constructor(){super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`)}},ce=class extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`),this.name=`ZodEncodeError`}};(se=globalThis).__zod_globalConfig??(se.__zod_globalConfig={});let le=globalThis.__zod_globalConfig;function T(e){return e&&Object.assign(le,e),le}function ue(e,t){return typeof t==`bigint`?t.toString():t}function de(e){return{get value(){{let t=e();return Object.defineProperty(this,\"value\",{value:t}),t}throw Error(`cached value already set`)}}}function fe(e){return e==null}function pe(e){let t=+!!e.startsWith(`^`),n=e.endsWith(`$`)?e.length-1:e.length;return e.slice(t,n)}let E=Symbol(`evaluating`);function D(e,t,n){let r;Object.defineProperty(e,t,{get(){if(r!==E)return r===void 0&&(r=E,r=n()),r},set(n){Object.defineProperty(e,t,{value:n})},configurable:!0})}let me=`captureStackTrace`in Error?Error.captureStackTrace:(...e)=>{};function O(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function he(e){if(O(e)===!1)return!1;let t=e.constructor;if(t===void 0||typeof t!=`function`)return!0;let n=t.prototype;return!(O(n)===!1||Object.prototype.hasOwnProperty.call(n,`isPrototypeOf`)===!1)}function ge(e,t,n){let r=new e._zod.constr(t??e._zod.def);return(!t||n?.parent)&&(r._zod.parent=e),r}function k(e){let t=e;if(!t)return{};if(typeof t==`string`)return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error(\"Cannot specify both `message` and `error` params\");t.error=t.message}return delete t.message,typeof t.error==`string`?{...t,error:()=>t.error}:t}function _e(e){return Object.keys(e).filter(t=>e[t]._zod.optin===`optional`&&e[t]._zod.optout===`optional`)}-Number.MAX_VALUE,Number.MAX_VALUE;function A(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function ve(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue===!1)return!0;return!1}function j(e,t){return t.map(t=>{var n;return(n=t).path??(n.path=[]),t.path.unshift(e),t})}function M(e){return typeof e==`string`?e:e?.message}function N(e,t,n){let r=e.message?e.message:M(e.inst?._zod.def?.error?.(e))??M(t?.error?.(e))??M(n.customError?.(e))??M(n.localeError?.(e))??`Invalid input`,{inst:i,continue:a,input:o,...s}=e;return s.path??=[],s.message=r,t?.reportInput&&(s.input=o),s}function ye(e){return Array.isArray(e)?`array`:typeof e==`string`?`string`:`unknown`}let be=(e,t)=>{e.name=`$ZodError`,Object.defineProperty(e,\"_zod\",{value:e._zod,enumerable:!1}),Object.defineProperty(e,\"issues\",{value:t,enumerable:!1}),e.message=JSON.stringify(t,ue,2),Object.defineProperty(e,\"toString\",{value:()=>e.message,enumerable:!1})},xe=C(`$ZodError`,be),P=C(`$ZodError`,be,{Parent:Error}),Se=(e=>(t,n,r,i)=>{let a=r?{...r,async:!1}:{async:!1},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise)throw new w;if(o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw me(t,i?.callee),t}return o.value})(P),Ce=(e=>async(t,n,r,i)=>{let a=r?{...r,async:!0}:{async:!0},o=t._zod.run({value:n,issues:[]},a);if(o instanceof Promise&&(o=await o),o.issues.length){let t=new(i?.Err??e)(o.issues.map(e=>N(e,a,T())));throw me(t,i?.callee),t}return o.value})(P),we=(e=>(t,n,r)=>{let i=r?{...r,async:!1}:{async:!1},a=t._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new w;return a.issues.length?{success:!1,error:new(e??xe)(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),F=(e=>async(t,n,r)=>{let i=r?{...r,async:!0}:{async:!0},a=t._zod.run({value:n,issues:[]},i);return a instanceof Promise&&(a=await a),a.issues.length?{success:!1,error:new e(a.issues.map(e=>N(e,i,T())))}:{success:!0,data:a.value}})(P),Te=e=>{let t=e?`[\\\\s\\\\S]{${e?.minimum??0},${e?.maximum??``}}`:`[\\\\s\\\\S]*`;return RegExp(`^${t}$`)},I=/^-?\\d+(?:\\.\\d+)?$/,L=C(`$ZodCheck`,(e,t)=>{var n;e._zod??={},e._zod.def=t,(n=e._zod).onattach??(n.onattach=[])}),Ee=C(`$ZodCheckMinLength`,(e,t)=>{var n;L.init(e,t),(n=e._zod.def).when??(n.when=e=>{let t=e.value;return!fe(t)&&t.length!==void 0}),e._zod.onattach.push(e=>{let n=e._zod.bag.minimum??-1/0;t.minimum>n&&(e._zod.bag.minimum=t.minimum)}),e._zod.check=n=>{let r=n.value;if(r.length>=t.minimum)return;let i=ye(r);n.issues.push({origin:i,code:`too_small`,minimum:t.minimum,inclusive:!0,input:r,inst:e,continue:!t.abort})}}),De=C(`$ZodCheckStringFormat`,(e,t)=>{var n,r;L.init(e,t),e._zod.onattach.push(e=>{let n=e._zod.bag;n.format=t.format,t.pattern&&(n.patterns??=new Set,n.patterns.add(t.pattern))}),t.pattern?(n=e._zod).check??(n.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:t.format,input:n.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})}):(r=e._zod).check??(r.check=()=>{})}),Oe=C(`$ZodCheckRegex`,(e,t)=>{De.init(e,t),e._zod.check=n=>{t.pattern.lastIndex=0,!t.pattern.test(n.value)&&n.issues.push({origin:`string`,code:`invalid_format`,format:`regex`,input:n.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),ke={major:4,minor:4,patch:3},R=C(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=ke;let r=[...e._zod.def.checks??[]];e._zod.traits.has(`$ZodCheck`)&&r.unshift(e);for(let t of r)for(let n of t._zod.onattach)n(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let t=(e,t,n)=>{let r=A(e),i;for(let a of t){if(a._zod.def.when){if(ve(e)||!a._zod.def.when(e))continue}else if(r)continue;let t=e.issues.length,o=a._zod.check(e);if(o instanceof Promise&&n?.async===!1)throw new w;if(i||o instanceof Promise)i=(i??Promise.resolve()).then(async()=>{await o,e.issues.length!==t&&(r||=A(e,t))});else{if(e.issues.length===t)continue;r||=A(e,t)}}return i?i.then(()=>e):e},n=(n,i,a)=>{if(A(n))return n.aborted=!0,n;let o=t(i,r,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(t=>e._zod.parse(t,a))}return e._zod.parse(o,a)};e._zod.run=(i,a)=>{if(a.skipChecks)return e._zod.parse(i,a);if(a.direction===`backward`){let t=e._zod.parse({value:i.value,issues:[]},{...a,skipChecks:!0});return t instanceof Promise?t.then(e=>n(e,i,a)):n(t,i,a)}let o=e._zod.parse(i,a);if(o instanceof Promise){if(a.async===!1)throw new w;return o.then(e=>t(e,r,a))}return t(o,r,a)}}D(e,`~standard`,()=>({validate:t=>{try{let n=we(e,t);return n.success?{value:n.data}:{issues:n.error?.issues}}catch{return F(e,t).then(e=>e.success?{value:e.data}:{issues:e.error?.issues})}},vendor:`zod`,version:1}))}),Ae=C(`$ZodString`,(e,t)=>{R.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??Te(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch{}return typeof n.value==`string`||n.issues.push({expected:`string`,code:`invalid_type`,input:n.value,inst:e}),n}}),je=C(`$ZodNumber`,(e,t)=>{R.init(e,t),e._zod.pattern=e._zod.bag.pattern??I,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Number(n.value)}catch{}let i=n.value;if(typeof i==`number`&&!Number.isNaN(i)&&Number.isFinite(i))return n;let a=typeof i==`number`?Number.isNaN(i)?`NaN`:Number.isFinite(i)?void 0:`Infinity`:void 0;return n.issues.push({expected:`number`,code:`invalid_type`,input:i,inst:e,...a?{received:a}:{}}),n}});function z(e,t,n){e.issues.length&&t.issues.push(...j(n,e.issues)),t.value[n]=e.value}let Me=C(`$ZodArray`,(e,t)=>{R.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!Array.isArray(i))return n.issues.push({expected:`array`,code:`invalid_type`,input:i,inst:e}),n;n.value=Array(i.length);let a=[];for(let e=0;e<i.length;e++){let o=i[e],s=t.element._zod.run({value:o,issues:[]},r);s instanceof Promise?a.push(s.then(t=>z(t,n,e))):z(s,n,e)}return a.length?Promise.all(a).then(()=>n):n}});function B(e,t,n,r,i,a){let o=n in r;if(e.issues.length){if(i&&a&&!o)return;t.issues.push(...j(n,e.issues))}if(!o&&!i){e.issues.length||t.issues.push({code:`invalid_type`,expected:`nonoptional`,input:void 0,path:[n]});return}e.value===void 0?o&&(t.value[n]=void 0):t.value[n]=e.value}function Ne(e){let t=Object.keys(e.shape);for(let n of t)if(!e.shape?.[n]?._zod?.traits?.has(`$ZodType`))throw Error(`Invalid element at key \"${n}\": expected a Zod schema`);let n=_e(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function Pe(e,t,n,r,i,a){let o=[],s=i.keySet,c=i.catchall._zod,l=c.def.type,u=c.optin===`optional`,d=c.optout===`optional`;for(let i in t){if(i===`__proto__`||s.has(i))continue;if(l===`never`){o.push(i);continue}let a=c.run({value:t[i],issues:[]},r);a instanceof Promise?e.push(a.then(e=>B(e,n,i,t,u,d))):B(a,n,i,t,u,d)}return o.length&&n.issues.push({code:`unrecognized_keys`,keys:o,input:t,inst:a}),e.length?Promise.all(e).then(()=>n):n}let Fe=C(`$ZodObject`,(e,t)=>{if(R.init(e,t),!Object.getOwnPropertyDescriptor(t,`shape`)?.get){let e=t.shape;Object.defineProperty(t,\"shape\",{get:()=>{let n={...e};return Object.defineProperty(t,\"shape\",{value:n}),n}})}let n=de(()=>Ne(t));D(e._zod,`propValues`,()=>{let e=t.shape,n={};for(let t in e){let r=e[t]._zod;if(r.values){n[t]??(n[t]=new Set);for(let e of r.values)n[t].add(e)}}return n});let r=O,i=t.catchall,a;e._zod.parse=(t,o)=>{a??=n.value;let s=t.value;if(!r(s))return t.issues.push({expected:`object`,code:`invalid_type`,input:s,inst:e}),t;t.value={};let c=[],l=a.shape;for(let e of a.keys){let n=l[e],r=n._zod.optin===`optional`,i=n._zod.optout===`optional`,a=n._zod.run({value:s[e],issues:[]},o);a instanceof Promise?c.push(a.then(n=>B(n,t,e,s,r,i))):B(a,t,e,s,r,i)}return i?Pe(c,s,t,o,n.value,e):c.length?Promise.all(c).then(()=>t):t}}),Ie=C(`$ZodRecord`,(e,t)=>{R.init(e,t),e._zod.parse=(n,r)=>{let i=n.value;if(!he(i))return n.issues.push({expected:`record`,code:`invalid_type`,input:i,inst:e}),n;let a=[],o=t.keyType._zod.values;if(o){n.value={};let s=new Set;for(let c of o)if(typeof c==`string`||typeof c==`number`||typeof c==`symbol`){s.add(typeof c==`number`?c.toString():c);let o=t.keyType._zod.run({value:c,issues:[]},r);if(o instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(o.issues.length){n.issues.push({code:`invalid_key`,origin:`record`,issues:o.issues.map(e=>N(e,r,T())),input:c,path:[c],inst:e});continue}let l=o.value,u=t.valueType._zod.run({value:i[c],issues:[]},r);u instanceof Promise?a.push(u.then(e=>{e.issues.length&&n.issues.push(...j(c,e.issues)),n.value[l]=e.value})):(u.issues.length&&n.issues.push(...j(c,u.issues)),n.value[l]=u.value)}let c;for(let e in i)s.has(e)||(c??=[],c.push(e));c&&c.length>0&&n.issues.push({code:`unrecognized_keys`,input:i,inst:e,keys:c})}else{n.value={};for(let o of Reflect.ownKeys(i)){if(o===`__proto__`||!Object.prototype.propertyIsEnumerable.call(i,o))continue;let s=t.keyType._zod.run({value:o,issues:[]},r);if(s instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);if(typeof o==`string`&&I.test(o)&&s.issues.length){let e=t.keyType._zod.run({value:Number(o),issues:[]},r);if(e instanceof Promise)throw Error(`Async schemas not supported in object keys currently`);e.issues.length===0&&(s=e)}if(s.issues.length){t.mode===`loose`?n.value[o]=i[o]:n.issues.push({code:`invalid_key`,origin:`record`,issues:s.issues.map(e=>N(e,r,T())),input:o,path:[o],inst:e});continue}let c=t.valueType._zod.run({value:i[o],issues:[]},r);c instanceof Promise?a.push(c.then(e=>{e.issues.length&&n.issues.push(...j(o,e.issues)),n.value[s.value]=e.value})):(c.issues.length&&n.issues.push(...j(o,c.issues)),n.value[s.value]=c.value)}}return a.length?Promise.all(a).then(()=>n):n}}),Le=C(`$ZodTransform`,(e,t)=>{R.init(e,t),e._zod.optin=`optional`,e._zod.parse=(n,r)=>{if(r.direction===`backward`)throw new ce(e.constructor.name);let i=t.transform(n.value,n);if(r.async)return(i instanceof Promise?i:Promise.resolve(i)).then(e=>(n.value=e,n.fallback=!0,n));if(i instanceof Promise)throw new w;return n.value=i,n.fallback=!0,n}});function V(e,t){return t===void 0&&(e.issues.length||e.fallback)?{issues:[],value:void 0}:e}let Re=C(`$ZodOptional`,(e,t)=>{R.init(e,t),e._zod.optin=`optional`,e._zod.optout=`optional`,D(e._zod,`values`,()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),D(e._zod,`pattern`,()=>{let e=t.innerType._zod.pattern;return e?RegExp(`^(${pe(e.source)})?$`):void 0}),e._zod.parse=(e,n)=>{if(t.innerType._zod.optin===`optional`){let r=e.value,i=t.innerType._zod.run(e,n);return i instanceof Promise?i.then(e=>V(e,r)):V(i,r)}return e.value===void 0?e:t.innerType._zod.run(e,n)}}),ze=C(`$ZodPipe`,(e,t)=>{R.init(e,t),D(e._zod,`values`,()=>t.in._zod.values),D(e._zod,`optin`,()=>t.in._zod.optin),D(e._zod,`optout`,()=>t.out._zod.optout),D(e._zod,`propValues`,()=>t.in._zod.propValues),e._zod.parse=(e,n)=>{if(n.direction===`backward`){let r=t.out._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.in,n)):H(r,t.in,n)}let r=t.in._zod.run(e,n);return r instanceof Promise?r.then(e=>H(e,t.out,n)):H(r,t.out,n)}});function H(e,t,n){return e.issues.length?(e.aborted=!0,e):t._zod.run({value:e.value,issues:e.issues,fallback:e.fallback},n)}function Be(e,t){return new e({type:`string`,...k(t)})}function Ve(e,t){return new e({type:`number`,checks:[],...k(t)})}function He(e,t){return new Ee({check:`min_length`,...k(t),minimum:e})}function Ue(e,t){return new Oe({check:`string_format`,format:`regex`,...k(t),pattern:e})}let U=C(`ZodMiniType`,(e,t)=>{if(!e._zod)throw Error(`Uninitialized schema in ZodMiniType.`);R.init(e,t),e.def=t,e.type=t.type,e.parse=(t,n)=>Se(e,t,n,{callee:e.parse}),e.safeParse=(t,n)=>we(e,t,n),e.parseAsync=async(t,n)=>Ce(e,t,n,{callee:e.parseAsync}),e.safeParseAsync=async(t,n)=>F(e,t,n),e.check=(...n)=>e.clone({...t,checks:[...t.checks??[],...n.map(e=>typeof e==`function`?{_zod:{check:e,def:{check:`custom`},onattach:[]}}:e)]},{parent:!0}),e.with=e.check,e.clone=(t,n)=>ge(e,t,n),e.brand=()=>e,e.register=((t,n)=>(t.add(e,n),e)),e.apply=t=>t(e)}),We=C(`ZodMiniString`,(e,t)=>{Ae.init(e,t),U.init(e,t)});function W(e){return Be(We,e)}let Ge=C(`ZodMiniNumber`,(e,t)=>{je.init(e,t),U.init(e,t)});function Ke(e){return Ve(Ge,e)}let qe=C(`ZodMiniArray`,(e,t)=>{Me.init(e,t),U.init(e,t)});function Je(e,t){return new qe({type:`array`,element:e,...k(t)})}let Ye=C(`ZodMiniObject`,(e,t)=>{Fe.init(e,t),U.init(e,t),D(e,`shape`,()=>t.shape)});function G(e,t){return new Ye({type:`object`,shape:e??{},...k(t)})}let Xe=C(`ZodMiniRecord`,(e,t)=>{Ie.init(e,t),U.init(e,t)});function Ze(e,t,n){return!t||!t._zod?new Xe({type:`record`,keyType:W(),valueType:e,...k(t)}):new Xe({type:`record`,keyType:e,valueType:t,...k(n)})}let Qe=C(`ZodMiniTransform`,(e,t)=>{Le.init(e,t),U.init(e,t)});function $e(e){return new Qe({type:`transform`,transform:e})}let et=C(`ZodMiniOptional`,(e,t)=>{Re.init(e,t),U.init(e,t)});function K(e){return new et({type:`optional`,innerType:e})}let tt=C(`ZodMiniPipe`,(e,t)=>{ze.init(e,t),U.init(e,t)});function nt(e,t){return new tt({type:`pipe`,in:e,out:t})}function rt(){return W().check(Ue(/^\\d+(\\.\\d+)?$/,`Invalid amount`))}function it(e){let{meta:t,opaque:n,request:r,...i}=e.challenge,a=n??(t===void 0?void 0:S(t)),o={challenge:{...i,...a!==void 0&&{opaque:a},request:S(r)},payload:e.payload,...e.source&&{source:e.source}};return`Payment ${oe(JSON.stringify(o),{pad:!1,url:!0})}`}var q,at=e((()=>{q=`2.51.3`}));function ot(e,t){return t?.(e)?e:e&&typeof e==`object`&&`cause`in e&&e.cause!==void 0?ot(e.cause,t):t?null:e}var J,st;e((()=>{at(),J={getDocsUrl:({docsBaseUrl:e,docsPath:t=``,docsSlug:n})=>t?`${e??`https://viem.sh`}${t}${n?`#${n}`:``}`:void 0,version:`viem@${q}`},st=class e extends Error{constructor(t,n={}){let r=n.cause instanceof e?n.cause.details:n.cause?.message?n.cause.message:n.details,i=n.cause instanceof e&&n.cause.docsPath||n.docsPath,a=J.getDocsUrl?.({...n,docsPath:i}),o=[t||`An error occurred.`,``,...n.metaMessages?[...n.metaMessages,``]:[],...a?[`Docs: ${a}`]:[],...r?[`Details: ${r}`]:[],...J.version?[`Version: ${J.version}`]:[]].join(`\n`);super(o,n.cause?{cause:n.cause}:void 0),Object.defineProperty(this,\"details\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"docsPath\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"metaMessages\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"shortMessage\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"version\",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,\"name\",{enumerable:!0,configurable:!0,writable:!0,value:`BaseError`}),this.details=r,this.docsPath=i,this.metaMessages=n.metaMessages,this.name=n.name??this.name,this.shortMessage=t,this.version=q}walk(e){return ot(this,e)}}}))();var ct=class extends st{constructor({value:e}){super(`Number \\`${e}\\` is not a valid decimal number.`,{name:`InvalidDecimalNumberError`})}};function lt(e,t){if(!/^(-?)([0-9]*)\\.?([0-9]*)$/.test(e))throw new ct({value:e});let[n,r=`0`]=e.split(`.`),i=n.startsWith(`-`);if(i&&(n=n.slice(1)),r=r.replace(/(0+)$/,``),t===0)Math.round(Number(`.${r}`))===1&&(n=`${BigInt(n)+1n}`),r=``;else if(r.length>t){let[e,i,a]=[r.slice(0,t-1),r.slice(t-1,t),r.slice(t)],o=Math.round(Number(`${i}.${a}`));r=o>9?`${BigInt(e)+BigInt(1)}0`.padStart(e.length+1,`0`):`${e}${o}`,r.length>t&&(r=r.slice(1),n=`${BigInt(n)+1n}`),r=r.slice(0,t)}else r=r.padEnd(t,`0`);return BigInt(`${i?`-`:``}${n}${r}`)}function ut(e){return e}function dt(e,t){let{context:n,createCredential:r}=t;return{...e,context:n,createCredential:r}}let ft=ut({name:`stripe`,intent:`charge`,schema:{credential:{payload:G({externalId:K(W()),spt:W()})},request:nt(G({amount:rt(),currency:W(),decimals:Ke(),description:K(W()),externalId:K(W()),metadata:K(Ze(W(),W())),networkId:W(),paymentMethodTypes:Je(W()).check(He(1)),recipient:K(W())}),$e(({amount:e,decimals:t,metadata:n,networkId:r,paymentMethodTypes:i,...a})=>({...a,amount:lt(e,t).toString(),methodDetails:{networkId:r,paymentMethodTypes:i,...n!==void 0&&{metadata:n}}})))}});function pt(e){let{client:t,createToken:n,externalId:r,paymentMethod:i}=e;return dt(ft,{context:G({paymentMethod:K(W())}),async createCredential({challenge:e,context:a}){let o=a?.paymentMethod??i;if(!o)throw Error(`paymentMethod is required (pass via context or parameters)`);let s=e.request.amount,c=e.request.currency,l=e.request.methodDetails?.networkId;if(!l)throw Error(`networkId is required in challenge.methodDetails`);let u=e.request.methodDetails?.metadata;if(u?.externalId)throw Error(`methodDetails.metadata.externalId is reserved; use credential externalId instead`);return it({challenge:e,payload:{spt:await n({amount:s,challenge:e,client:t,currency:c,expiresAt:e.expires?Math.floor(new Date(e.expires).getTime()/1e3):Math.floor(Date.now()/1e3)+3600,metadata:u,networkId:l,paymentMethod:o}),...r?{externalId:r}:{}}})}})}function mt(e){return[pt(e)]}(function(e){e.charge=pt})(mt||={});var ht=r();let Y={data:`__MPPX_DATA__`,error:`root_error`,root:`root`},gt={serviceWorker:`__mppx_worker`,tab:`__mppx_tab`},X={challengeId:`data-mppx-challenge-id`,remaining:`data-remaining`};var Z=class{name;constructor(e){this.name=`--mppx-${e}`}toString(){return`var(${this.name})`}};let _t={accent:new Z(`accent`),background:new Z(`background`),border:new Z(`border`),foreground:new Z(`foreground`),muted:new Z(`muted`),negative:new Z(`negative`),positive:new Z(`positive`),surface:new Z(`surface`),fontFamily:new Z(`font-family`),fontSizeBase:new Z(`font-size-base`),radius:new Z(`radius`),spacingUnit:new Z(`spacing-unit`)};String.raw`<style>\n  *,\n  ::after,\n  ::before,\n  ::backdrop,\n  ::file-selector-button {\n    box-sizing: border-box;\n    margin: 0;\n    padding: 0;\n    border: 0 solid;\n    border-color: ${_t.border};\n  }\n  html,\n  :host {\n    line-height: 1.5;\n    -webkit-text-size-adjust: 100%;\n    tab-size: 4;\n    -webkit-tap-highlight-color: transparent;\n  }\n  h1,\n  h2,\n  h3,\n  h4,\n  h5,\n  h6 {\n    font-size: inherit;\n    font-weight: inherit;\n  }\n  a {\n    color: inherit;\n    -webkit-text-decoration: inherit;\n    text-decoration: inherit;\n  }\n  b,\n  strong {\n    font-weight: bolder;\n  }\n  code,\n  kbd,\n  samp,\n  pre {\n    font-family:\n      ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New',\n      monospace;\n    font-size: 1em;\n  }\n  small {\n    font-size: 80%;\n  }\n  ol,\n  ul,\n  menu {\n    list-style: none;\n  }\n  img,\n  svg,\n  video,\n  canvas,\n  audio,\n  iframe,\n  embed,\n  object {\n    display: block;\n    vertical-align: middle;\n  }\n  img,\n  video {\n    max-width: 100%;\n    height: auto;\n  }\n  button,\n  input,\n  select,\n  optgroup,\n  textarea,\n  ::file-selector-button {\n    font: inherit;\n    font-feature-settings: inherit;\n    font-variation-settings: inherit;\n    letter-spacing: inherit;\n    color: inherit;\n    border-radius: 0;\n    background-color: transparent;\n    opacity: 1;\n  }\n  ::file-selector-button {\n    margin-inline-end: 4px;\n  }\n  ::placeholder {\n    opacity: 1;\n  }\n  @supports (not (-webkit-appearance: -apple-pay-button)) or (contain-intrinsic-size: 1px) {\n    ::placeholder {\n      color: color-mix(in oklab, currentcolor 50%, transparent);\n    }\n  }\n  textarea {\n    resize: vertical;\n  }\n  ::-webkit-search-decoration {\n    -webkit-appearance: none;\n  }\n  :-moz-ui-invalid {\n    box-shadow: none;\n  }\n  button,\n  input:where([type='button'], [type='reset'], [type='submit']),\n  ::file-selector-button {\n    appearance: button;\n  }\n  ::-webkit-inner-spin-button,\n  ::-webkit-outer-spin-button {\n    height: auto;\n  }\n  [hidden]:where(:not([hidden='until-found'])) {\n    display: none !important;\n  }\n</style>`;function vt(e,t){if(t==null)return e;if(!Q(e)||!Q(t))return t??e;let n={...e};for(let[e,r]of Object.entries(t)){if(r==null||r===``)continue;let t=n[e];n[e]=Q(t)&&Q(r)?vt(t,r):r}return n}function Q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function yt(e){let t=new URL(location.href);t.searchParams.set(gt.serviceWorker,``);let n=await navigator.serviceWorker.register(t.pathname+t.search),r=await new Promise(e=>{let t=n.installing??n.waiting??n.active;if(t?.state===`activated`)return e(t);let r=t??n;r.addEventListener(`statechange`,function t(){let i=n.active;i?.state===`activated`&&(r.removeEventListener(`statechange`,t),e(i))})});await new Promise(t=>{let n=new MessageChannel;n.port1.onmessage=()=>t(),r.postMessage({credential:e},[n.port2])}),location.reload()}g();function bt(e){let t=document.getElementById(Y.data),n=m(t.textContent),r=t.getAttribute(X.remaining);!r||Number(r)<=1?t.remove():t.setAttribute(X.remaining,String(Number(r)-1));let i=document.currentScript,a=i?.getAttribute(X.challengeId),o=a?(i.removeAttribute(X.challengeId),n[a]):Object.values(n).find(t=>t.challenge.method===e);return{...o,error(e){if(!e){document.getElementById(Y.error)?.remove();return}let t=document.getElementById(Y.error);if(t){t.textContent=e;return}let n=document.createElement(`p`);n.id=Y.error,n.className=`mppx-error`,n.role=`alert`,n.textContent=e,document.getElementById(o.rootId)?.after(n)},root:document.getElementById(o.rootId),submit:yt,vars:_t}}let $=bt(`stripe`),xt=String.raw,St=document.createElement(`style`);St.textContent=xt`\n  form {\n    display: flex;\n    flex-direction: column;\n    gap: calc(${$.vars.spacingUnit} * 8);\n  }\n  button {\n    background: ${$.vars.accent};\n    border-radius: ${$.vars.radius};\n    color: ${$.vars.background};\n    cursor: pointer;\n    font-weight: 500;\n    padding: calc(${$.vars.spacingUnit} * 4) calc(${$.vars.spacingUnit} * 8);\n    width: 100%;\n  }\n  button:hover:not(:disabled) {\n    opacity: 0.85;\n  }\n  button:disabled {\n    cursor: default;\n    opacity: 0.5;\n  }\n`,$.root.append(St),(async()=>{let e=await(0,ht.loadStripe)($.config.publishableKey);if(!e)throw Error(`Failed to loadStripe`);let t=window.matchMedia(`(prefers-color-scheme: dark)`),n=()=>{let e=(()=>{if($.config.elements?.options?.appearance?.theme)return $.config.elements?.options?.appearance?.theme;switch($.theme.colorScheme){case`light dark`:return t.matches?`night`:`stripe`;case`light`:return`stripe`;case`dark`:return`night`}})(),n=+!!t.matches;return vt({disableAnimations:!0,theme:e,variables:{borderRadius:$.theme.radius,colorBackground:$.theme.surface[n],colorDanger:$.theme.negative[n],colorPrimary:$.theme.accent[n],colorText:$.theme.foreground[n],colorTextSecondary:$.theme.muted[n],fontSizeBase:$.theme.fontSizeBase,fontFamily:$.theme.fontFamily,spacingUnit:$.theme.spacingUnit}},$.config.elements?.options?.appearance??{})},r=e.elements({appearance:n(),...$.config.elements?.options,amount:Number($.challenge.request.amount),currency:$.challenge.request.currency,mode:`payment`,paymentMethodCreation:`manual`,paymentMethodTypes:$.challenge.request.methodDetails.paymentMethodTypes});t.addEventListener(`change`,()=>{r.update({appearance:n()})});let i=document.createElement(`form`);r.create(`payment`,$.config.elements?.paymentOptions).mount(i),$.root.appendChild(i);let a=document.createElement(`button`);a.textContent=$.text.pay,a.type=`submit`,i.appendChild(a),i.onsubmit=async t=>{t.preventDefault(),$.error(),a.disabled=!0;try{await r.submit();let{paymentMethod:t,error:n}=await e.createPaymentMethod({...$.config.elements?.createPaymentMethodOptions,elements:r});if(n||!t)throw n??Error(`Failed to create payment method`);let i=await mt({client:e,createToken:Ct})[0].createCredential({challenge:$.challenge,context:{paymentMethod:t.id}});await $.submit(i)}catch(e){$.error(e instanceof Error?e.message:`Payment failed`)}finally{a.disabled=!1}}})();async function Ct(e){let t=new URL($.config.createTokenUrl,location.origin);if(t.origin!==location.origin)throw Error(`createTokenUrl must be same-origin`);let n=await fetch(t,{method:`POST`,headers:{\"Content-Type\":`application/json`},body:JSON.stringify(e)});if(!n.ok){let e=await n.text().catch(()=>`<response body unavailable>`);throw Error(`Failed to create SPT (${n.status}): ${e}`)}return(await n.json()).spt}})();</script>"

package/src/tempo/server/Session.test.ts

@@ -486,7 +486,7 @@ describe.runIf(isLocalnet)('session', () => {
           },
           request: makeRequest(),
         }),
-      ).rejects.toThrow('voucher amount is below settled on-chain amount')
+      ).rejects.toThrow('voucher amount is at or below settled on-chain amount')
     })
 
     test('zero signer fallback uses payer', async () => {
@@ -698,27 +698,128 @@ describe.runIf(isLocalnet)('session', () => {
       ).rejects.toThrow(InvalidSignatureError)
     })
 
-    test('rejects non-increasing voucher replay', async () => {
+    test('accepts lower voucher replay idempotently', async () => {
       const { channelId, serializedTransaction } = await createSignedOpenTransaction(10000000n)
       const server = createServer()
       await openServerChannel(server, channelId, serializedTransaction)
 
+      const before = await store.getChannel(channelId)
+
+      // A non-advancing voucher (below highest, above settled) is accepted
+      // idempotently with the current highest amount, per the session spec.
+      const receipt = (await server.verify({
+        credential: {
+          challenge: makeChallenge({ id: 'challenge-2', channelId }),
+          payload: {
+            action: 'voucher' as const,
+            channelId,
+            cumulativeAmount: '500000',
+            signature: await signTestVoucher(channelId, 500000n),
+          },
+        },
+        request: makeRequest(),
+      })) as SessionReceipt
+
+      expect(receipt.status).toBe('success')
+      expect(receipt.acceptedCumulative).toBe('1000000')
+
+      // Channel state is unchanged - no advance, no additional charge.
+      const after = await store.getChannel(channelId)
+      expect(after).toEqual(before)
+    })
+
+    test('accepts lower replay after a higher voucher has advanced the channel', async () => {
+      const { channelId, serializedTransaction } = await createSignedOpenTransaction(10000000n)
+      const server = createServer()
+      await openServerChannel(server, channelId, serializedTransaction)
+
+      // Advance the channel from the opening 1000000 to 5000000.
+      await server.verify({
+        credential: {
+          challenge: makeChallenge({ id: 'challenge-advance', channelId }),
+          payload: {
+            action: 'voucher' as const,
+            channelId,
+            cumulativeAmount: '5000000',
+            signature: await signTestVoucher(channelId, 5000000n),
+          },
+        },
+        request: makeRequest(),
+      })
+
+      const before = await store.getChannel(channelId)
+
+      // A lower (but above-settled) voucher returns the current highest
+      // without rewinding state.
+      const receipt = (await server.verify({
+        credential: {
+          challenge: makeChallenge({ id: 'challenge-lower', channelId }),
+          payload: {
+            action: 'voucher' as const,
+            channelId,
+            cumulativeAmount: '3000000',
+            signature: await signTestVoucher(channelId, 3000000n),
+          },
+        },
+        request: makeRequest(),
+      })) as SessionReceipt
+
+      expect(receipt.status).toBe('success')
+      expect(receipt.acceptedCumulative).toBe('5000000')
+
+      const after = await store.getChannel(channelId)
+      expect(after).toEqual(before)
+    })
+
+    test('accepts lower voucher replay even when below minVoucherDelta', async () => {
+      const { channelId, serializedTransaction } = await createSignedOpenTransaction(10000000n)
+      // Non-advancing replay must short-circuit before the delta check.
+      const server = createServer({ minVoucherDelta: '2' })
+      await openServerChannel(server, channelId, serializedTransaction)
+
+      const before = await store.getChannel(channelId)
+
+      const receipt = (await server.verify({
+        credential: {
+          challenge: makeChallenge({ id: 'challenge-lower-delta', channelId }),
+          payload: {
+            action: 'voucher' as const,
+            channelId,
+            cumulativeAmount: '500000',
+            signature: await signTestVoucher(channelId, 500000n),
+          },
+        },
+        request: makeRequest(),
+      })) as SessionReceipt
+
+      expect(receipt.status).toBe('success')
+      expect(receipt.acceptedCumulative).toBe('1000000')
+
+      const after = await store.getChannel(channelId)
+      expect(after).toEqual(before)
+    })
+
+    test('rejects lower voucher replay signed by the wrong signer', async () => {
+      const { channelId, serializedTransaction } = await createSignedOpenTransaction(10000000n)
+      const server = createServer()
+      await openServerChannel(server, channelId, serializedTransaction)
+
+      // A valid signature from a different account must NOT be treated as an
+      // idempotent replay.
       await expect(
         server.verify({
           credential: {
-            challenge: makeChallenge({ id: 'challenge-2', channelId }),
+            challenge: makeChallenge({ id: 'challenge-wrong-signer', channelId }),
             payload: {
               action: 'voucher' as const,
               channelId,
               cumulativeAmount: '500000',
-              signature: await signTestVoucher(channelId, 500000n),
+              signature: await signTestVoucher(channelId, 500000n, accounts[3]),
             },
           },
           request: makeRequest(),
         }),
-      ).rejects.toThrow(
-        'voucher cumulativeAmount must be strictly greater than highest accepted voucher',
-      )
+      ).rejects.toThrow(InvalidSignatureError)
     })
 
     test('rejects replay of settled voucher', async () => {
@@ -743,7 +844,7 @@ describe.runIf(isLocalnet)('session', () => {
           },
           request: makeRequest(),
         }),
-      ).rejects.toThrow('voucher cumulativeAmount is below on-chain settled amount')
+      ).rejects.toThrow('voucher cumulativeAmount is at or below on-chain settled amount')
     })
 
     test('rejects voucher exceeding deposit', async () => {
@@ -820,17 +921,15 @@ describe.runIf(isLocalnet)('session', () => {
             payload: {
               action: 'voucher' as const,
               channelId,
-              // Attacker submits cumulativeAmount=500000, which is <= highestVoucherAmount (1000000)
-              // but > settled (0). Rejected by non-increasing cumulative amount check before signature validation.
+              // Forged signature for a non-advancing amount (500000 <= highest
+              // 1000000, > settled 0). Rejected by signature verification.
               cumulativeAmount: '500000',
               signature: `0x${'ab'.repeat(65)}` as Hex,
             },
           },
           request: makeRequest(),
         }),
-      ).rejects.toThrow(
-        'voucher cumulativeAmount must be strictly greater than highest accepted voucher',
-      )
+      ).rejects.toThrow('invalid voucher signature')
     })
 
     test('rejects forged voucher with valid amount but invalid signature', async () => {
@@ -967,7 +1066,7 @@ describe.runIf(isLocalnet)('session', () => {
           },
           request: makeRequest(),
         }),
-      ).rejects.toThrow('voucher cumulativeAmount is below on-chain settled amount')
+      ).rejects.toThrow('voucher cumulativeAmount is at or below on-chain settled amount')
     })
 
     test('rejects leaked voucher used in open action with mismatched channel', async () => {
@@ -2510,7 +2609,7 @@ describe.runIf(isLocalnet)('session', () => {
           },
           request: makeRequest(),
         }),
-      ).rejects.toThrow('voucher cumulativeAmount is below on-chain settled amount')
+      ).rejects.toThrow('voucher cumulativeAmount is at or below on-chain settled amount')
     })
 
     test('close after recovery respects on-chain settled as minimum', async () => {
@@ -4385,7 +4484,7 @@ describe.runIf(isLocalnet)('session', () => {
         if (result.status === 402) return result.challenge
 
         if (action === 'voucher') {
-          return new Response(null, { status: 200 })
+          return result.withReceipt()
         }
 
         if (request.headers.get('Accept')?.includes('text/event-stream')) {
@@ -4463,7 +4562,7 @@ describe.runIf(isLocalnet)('session', () => {
         if (result.status === 402) return result.challenge
 
         if (action === 'voucher') {
-          return new Response(null, { status: 200 })
+          return result.withReceipt()
         }
 
         if (request.headers.get('Accept')?.includes('text/event-stream')) {
@@ -4631,7 +4730,7 @@ describe.runIf(isLocalnet)('session', () => {
         if (result.status === 402) return result.challenge
 
         if (action === 'voucher') {
-          return new Response(null, { status: 200 })
+          return result.withReceipt()
         }
 
         if (request.headers.get('Accept')?.includes('text/event-stream')) {