twzrd-x402-gate 0.11.1 → 0.11.2

package/CHANGELOG.md

@@ -28,7 +28,59 @@ All notable changes to `twzrd-x402-gate`. Dates are npm publish dates (UTC).
 - **Seller side** (`createTwzrdSettleGuard`): fail-open by default. A screen that throws
   returns without aborting settlement unless `failOpen: false`.
 
-## 0.11.1 — unreleased (security fix)
+## 0.11.2 — 2026-09-28 (security fix)
+
+Fixes from a line-by-line audit of the published 0.11.1. Every change adds a
+refusal or makes an existing one reliable; none loosens one.
+
+- **Malformed amounts are refused on every entry point** (`amount_malformed`,
+  before intel). An amount must be an ASCII base-unit integer: no sign, decimal
+  point, exponent, whitespace or non-ASCII digit. Signing schemes build the
+  transfer from this string, so there is no safe reading of anything else.
+  `twzrd.safeFetch` keeps reporting it as `malformed_amount`. A computed
+  `priceUsdc` that is negative or not finite is refused as `twzrd_invalid_price`.
+- **Fetch wrappers and the MCP hook check every offer.** `withTwzrdGuard`,
+  `wrapFetchWithTwzrdGate`, `installTwzrdAutoGate(payWrap)` and
+  `twzrdOnPaymentRequested` scored one `accepts[]` entry while the paying client
+  could choose another. Every distinct entry now gets the free approval (one
+  preflight each; paid hops run once), and more than 8 distinct offers are
+  refused (`too_many_payment_options`). The x402 client hooks already scored
+  the selected entry and are unchanged.
+- **`./cloudflare-base` applies the package's signing rules** to the Base USDC
+  entry: asset, amount, block, wash, never-evaluated cap, score floor and
+  recommended cap. It used to sign on any non-block verdict. The price is read
+  from the entry's own `amount`; the `priceUsdc` option no longer affects the
+  decision. New options `preflightMinScore` and `refuseUnevaluated`.
+- **Genuine USDC is no longer refused as `twzrd_non_usdc_asset`** when the 402
+  omits the network or names Solana mainnet as `mainnet-beta` or by its bare
+  genesis id. One Solana cluster reading (`solanaCluster`) now serves both the
+  network classifier and the USDC table; `solana:devnet` uses the devnet mints.
+  Solana mints are compared exactly (base58 is case-sensitive).
+- **Intel calls have a deadline.** New option `intelTimeoutMs` (env
+  `TWZRD_INTEL_TIMEOUT_MS`, default 2000). A free preflight or merchant-card call
+  that misses it is an outage, decided by `failOpen` as before. Paid hops are
+  not cut off mid-payment.
+- **Callbacks cannot change a decision.** A throwing or rejecting `onWarnUpsell`
+  no longer crashes the host or turns into `twzrd_fail_open`; a throwing
+  `onReceipt` no longer turns a paid receipt into a deny.
+- A merchant-card outage allowed under `failOpen` is marked
+  (`cardUnreachable: true` and a warning) instead of looking like a clean card.
+- No paid `/trust` receipt and no `onWarnUpsell` for a seller intel has never
+  evaluated (the same rule as the `/quick` hop since 0.11.0).
+- `refuseUnevaluated` and `gateOnCanSpend` accept `true`, `1`, `"true"`,
+  `"yes"`, `"on"` in any case; a typo no longer leaves strict mode silently off.
+- A non-list `accepts` or a null entry is no offer, never a TypeError.
+- Two spellings of the same 0x address in `payTo` / `pay_to` are one recipient.
+- `createTwzrdPayingFetch` and `createTwzrdPolicyFetch` name the missing
+  `@x402/fetch` peer instead of throwing a bare module error.
+- The unreachable `dist/unsafe.js` is no longer shipped, and the README no
+  longer documents a `twzrd-x402-gate/unsafe` import. LICENSE ships in the
+  package.
+
+Deliberately unchanged: a Solana devnet payment named only by its CAIP-2 id is
+still scored (integration harnesses rely on it reaching the preflight).
+
+## 0.11.1 — 2026-09-28 (security fix)
 
 **A requirement that names an asset other than USDC is refused on Solana and Base.**
 
@@ -51,8 +103,10 @@ All notable changes to `twzrd-x402-gate`. Dates are npm publish dates (UTC).
   micro-USDC, so another asset was counted in the wrong units.
 - New exports: `isUsdcRequirement`, `requirementAsset`. `TwzrdApproveContext` gains
   `asset`.
-- Unchanged: a requirement that names no asset (x402 schemes default it to USDC), USDC
-  itself, and unscored networks (their observe policy never priced anything).
+- Unchanged: a requirement that names no asset, USDC itself, and unscored networks.
+  (Corrected in 0.11.2: the schemes do not default an unnamed asset to USDC.
+  x402-solana refuses a requirement with no mint and @x402/svm fetches the mint
+  before building the transfer, so an unnamed asset fails before signing.)
 - Who was exposed: clients on `@x402/core` ≥2.23 with default spend controls already
   refused an unrecognised asset before any TWZRD hook ran. The exposure was the PayAI
   `x402-solana` path, clients with spend controls turned off, and older core.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TWZRD
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/QUICKSTART.md

@@ -6,13 +6,13 @@ is unreachable the gate never *invents* a wash flag. A failed preflight, or a me
 outage on a scored path, blocks by default (`TWZRD_FAIL_OPEN=true` to allow). A reachable
 card with no wash signal still proceeds.
 
-**Pin:** `twzrd-x402-gate@0.11.1` + stock PayAI client `x402-solana@3.0.0` (official
+**Pin:** `twzrd-x402-gate@0.11.2` + stock PayAI client `x402-solana@3.0.0` (official
 `beforePayment` seat). `@x402/core` Path E remains supported; refuse script is fallback.
 
 ## 1. Stock PayAI client (default seat — copy-paste)
 
 ```bash
-npm install twzrd-x402-gate@0.11.1 x402-solana@3.0.0
+npm install twzrd-x402-gate@0.11.2 x402-solana@3.0.0
 ```
 
 > **ESM-only.** The package ships `import` conditions only — a CommonJS
@@ -37,7 +37,7 @@ Then: `await client.fetch("https://merchant.example/paid");`
 ## 1b. Official `@x402/core` client (Path E)
 
 ```bash
-npm install twzrd-x402-gate@0.11.1 @x402/core @x402/fetch @x402/svm
+npm install twzrd-x402-gate@0.11.2 @x402/core @x402/fetch @x402/svm
 ```
 
 ```typescript

package/README.md

@@ -41,7 +41,7 @@ refuse. Protects the **payer** from a risky **merchant** (`payTo`). Chain-neutra
 ### Default-on AutoGate (5 lines)
 
 ```bash
-npm install twzrd-x402-gate@0.11.1 @x402/core @x402/fetch @x402/svm
+npm install twzrd-x402-gate@0.11.2 @x402/core @x402/fetch @x402/svm
 ```
 
 ```typescript
@@ -80,7 +80,7 @@ transfer on-chain. Wash/sybil edges are primarily discounted in TWZRD scoring, n
 revenue refusal.
 
 ```bash
-npm install twzrd-x402-gate@0.11.1
+npm install twzrd-x402-gate@0.11.2
 ```
 
 ```typescript
@@ -125,7 +125,7 @@ Fixture-backed SVM extract tests live in `test/seller-hook.test.ts` +
 Install the published gate and run against wash fixtures:
 
 ```bash
-npm install twzrd-x402-gate@0.11.1
+npm install twzrd-x402-gate@0.11.2
 # from package root after install, or from a checkout:
 npm run wash-dogfood
 ```
@@ -299,7 +299,7 @@ Dogfood (one public live proof path):
 ## Install
 
 ```bash
-npm install twzrd-x402-gate@0.11.1
+npm install twzrd-x402-gate@0.11.2
 ```
 
 Do not hardcode a version in this doc — every past pin here (**0.5.4**, **0.7.1**, **0.8.5**,
@@ -348,9 +348,9 @@ assertIntentApproved(intentBeingSigned, token, {
 // throws MISSING_VERIFIER_KEY | BAD_SIGNATURE | INTENT_HASH_MISMATCH |
 //        DECISION_EXPIRED | DECISION_NOT_ALLOW | DECISION_REPLAYED
 //        -> the signer is never invoked
-// In-process matching without a key is unsafeAssertIntentApprovedWithoutSignature,
-// exported only from the "twzrd-x402-gate/unsafe" subpath — never the root:
-//   import { unsafeAssertIntentApprovedWithoutSignature } from "twzrd-x402-gate/unsafe";
+// There is no published way to match an intent without verifying the decision
+// signature: the old "twzrd-x402-gate/unsafe" subpath was removed in 0.9.4 and
+// its module in 0.11.2. Always verify with a key.
 ```
 
 - `PaymentIntent` v1 (frozen): protocol `x402 | ap2 | ucp | mpp | direct` +
@@ -960,7 +960,7 @@ An approval here carries `unevaluated: true` and `score: null`, never a trust sc
 
 A price above `recommended_cap_usdc` returns a reason that starts with `twzrd_over_recommended_cap_`. A direct `createTwzrdBeforePaymentHook` abort of a block card returns reason `twzrd_decision_block`. That reason string is not `block` and is not `twzrd_fail_closed`. A missing `payTo` returns reason `twzrd_unidentifiable_payment_recipient` from `twzrdApprovePayment`. That reason is not `twzrd_missing_payTo`. When the buyer preflight fetch throws and `TWZRD_FAIL_OPEN` is unset, `twzrdApprovePayment` returns reason `twzrd_fail_closed`. That reason is not `twzrd_preflight_fetch_error`.
 
-An evaluated `warn` (no `null_reason`, score present) is allowed unless overridden. When the buyer preflight fetch throws and `TWZRD_FAIL_OPEN` is unset, `twzrdApprovePayment` returns `approved: false` with reason `twzrd_fail_closed` and the wallet does not sign. An omitted `failOpen` on `createTwzrdSettleGuard` is a different default: a thrown screen returns without abort. 0.11.1 is not uniformly fail-closed.
+An evaluated `warn` (no `null_reason`, score present) is allowed unless overridden. When the buyer preflight fetch throws and `TWZRD_FAIL_OPEN` is unset, `twzrdApprovePayment` returns `approved: false` with reason `twzrd_fail_closed` and the wallet does not sign. An omitted `failOpen` on `createTwzrdSettleGuard` is a different default: a thrown screen returns without abort. 0.11.2 is not uniformly fail-closed.
 
 A 402 whose payment requirements yield **no identifiable seller wallet** (missing/empty `payTo`, or an unparseable `accepts[]`) is a different case from "unknown seller" — it always **blocks** with `reason: twzrd_unidentifiable_payment_recipient`, without ever calling the preflight network. The wallet does not sign. This is unconditional (not affected by buyer `failOpen`): that switch governs a buyer preflight outage, not a missing payTo. An omitted `failOpen` on `createTwzrdSettleGuard` is a different default: a thrown screen returns without abort.
 
@@ -968,6 +968,111 @@ A 402 whose payment requirements yield **no identifiable seller wallet** (missin
 > not yet in the TWZRD corpus, including legitimate ones. `can_spend: false` alone does not block (`gateOnCanSpend` defaults false). That is separate from `null_reason: unknown_subject`, which signs only within its card's cap.
 > Set `gateOnCanSpend: true` to also block on `can_spend: false`.
 
+## Refusals
+
+Every reason the gate returns, by entry point. A refusal means the wallet was not asked
+to sign (`signerInvocations = 0`). `test/readme-refusal-codes.test.ts` fails if a reason
+string in the source is missing here, so this table cannot drift from the code.
+`<...>` marks a value filled in at runtime.
+
+### Buyer approval (`twzrdApprovePayment`, used by every buyer entry point)
+
+On the x402 client hooks (`createTwzrdBeforePaymentHook`, `installTwzrdAutoGate`,
+`createTwzrdPayKitBeforePaymentHook`, `createGuardedX402Fetch`) the abort reason is
+`[twzrd] <reason> payTo=<payTo> network=<network>`.
+
+| Reason | When | Default |
+|---|---|---|
+| `twzrd_unidentifiable_payment_recipient` | The requirement names no `payTo`. Intel is not called. | always |
+| `twzrd_invalid_price` | A caller passed a `priceUsdc` that is negative or not finite. Intel is not called. | always (0.11.2+) |
+| `twzrd_non_usdc_asset` | On Solana or Base, the requirement names an asset that is not USDC on that network. Intel is not called; `failOpen` does not apply. | always (0.11.1+) |
+| `network_not_scored`, `network_missing` | The network is not scored (not Solana or Base mainnet). | refused only with `unsupportedNetworkMode: "strict"`; the default `observe` allows |
+| `twzrd_decision_<decision>` | Intel's card decision is in `blockDecisions`. | `twzrd_decision_block` |
+| `twzrd_unevaluated_subject_<null_reason>` | Intel has never evaluated the seller, and `refuseUnevaluated` is set or the decision is not `allow`/`warn`. | strict mode off |
+| `twzrd_unevaluated_no_cap_<null_reason>` | Never evaluated, and the card has no finite `recommended_cap_usdc`. | always |
+| `twzrd_unevaluated_unknown_price_<null_reason>` | Never evaluated, and the price is unknown. | always |
+| `twzrd_unevaluated_over_cap_<price>_gt_<cap>` | Never evaluated, and the price is above the card's cap (live: min($0.10, price)). | always |
+| `twzrd_can_spend_false` | The card says `can_spend: false`. | only with `gateOnCanSpend: true` |
+| `twzrd_score_<score>_below_<min>` | An evaluated seller scores below `preflightMinScore`. | min 40 |
+| `twzrd_over_recommended_cap_<price>_gt_<cap>` | An evaluated seller, and the price is above the card's `recommended_cap_usdc`. | always |
+| `twzrd_wash_flagged` | The free merchant card says `wash_flagged: true`. | on (`refuseWashFlagged` defaults true on every entry point) |
+| `twzrd_wash_flagged_above_cap_<price>_gt_<cap>`, `twzrd_wash_flagged_above_cap_unknown_price_max_<cap>` | Wash-flagged, `washMaxUsdc` is set, and the price is above it or unknown. | only with `washMaxUsdc` |
+| `twzrd_fail_closed (<error>)` | The preflight did not answer (non-2xx, non-JSON, network error, or no answer within `intelTimeoutMs`). | fail-closed unless `failOpen` |
+| `twzrd_card_unreachable_fail_closed (<error>)` | The merchant card did not answer (5xx, 429, non-JSON, network error, or no answer within `intelTimeoutMs`). A 4xx is an answer, not an outage. With `failOpen` the payment is allowed and the result carries `cardUnreachable: true` (the wash check did not run). | fail-closed unless `failOpen` |
+
+Approval reasons, for `onDecision` consumers: `twzrd_allow`, `twzrd_warn_allowed`,
+`twzrd_unevaluated_within_cap_<price>_le_<cap>`, `twzrd_wash_capped_<price>_le_<cap>`,
+`twzrd_fail_open` (an outage allowed because `failOpen` is set).
+
+### x402 client hook only
+
+| Reason | When |
+|---|---|
+| `amount_field_conflict`, `payto_field_conflict` | The requirement's v1 and v2 price fields (`maxAmountRequired` / `amount`) or recipient fields (`payTo` / `pay_to`) disagree. Two spellings of the same 0x address are one recipient. |
+| `amount_malformed` | The amount is present but is not an ASCII base-unit integer (a sign, decimal point, exponent, whitespace or non-ASCII digit). Refused before intel on every entry point (0.11.2+); `twzrd.safeFetch` reports it as `malformed_amount`. |
+| `payment_control_unevaluable: missing <field>` | Payment Control is on and the requirement has no amount or `payTo`. |
+| `payment_control_block:<reason codes>` | Payment Control (`paymentControl` option) refused the intent. |
+| `twzrd_escalated_warn_block (paid quick score <score> < <floor>)` | `escalateOnWarn` bought the $0.001 `/quick` score and it is below the floor. |
+| `twzrd_receipt_required_missing_x402Fetch` | `requireReceipt` needs a paid receipt and no `x402Fetch` is wired. |
+| `twzrd_receipt_required_failed (HTTP <status>)`, `twzrd_receipt_required_error (<error>)` | The required paid receipt could not be bought. |
+| `aborted_before_payment: signal already aborted` | The caller's abort signal fired before the hook ran. |
+
+### Fetch wrappers and the MCP hook
+
+`withTwzrdGuard`, `wrapFetchWithTwzrdGate`, `installTwzrdAutoGate(payWrap)` and
+`twzrdOnPaymentRequested` see the whole 402 but not which `accepts[]` entry the
+paying client will choose, so every distinct entry must pass the buyer approval
+(one free preflight each; paid hops run once, for the preferred entry). The
+first refusal is reported with that entry's `payTo` (0.11.2+).
+
+| Reason | When |
+|---|---|
+| `too_many_payment_options` | The 402 lists more than 8 distinct offers. |
+
+### `./cloudflare-base` (edge Worker seat)
+
+`withTwzrdBasePreflight` and `createTwzrdCloudflareBaseApproval` apply the same
+rules to the Base USDC entry, restated in the module so it imports nothing:
+`twzrd_unidentifiable_payment_recipient`, `amount_field_conflict`,
+`amount_malformed`, `twzrd_non_usdc_asset`, `invalid_base_offer` (before
+intel; `failOpen` never signs these), then `twzrd_decision_block`, `twzrd_wash_flagged`,
+`twzrd_unevaluated_subject_*`, `twzrd_unevaluated_no_cap_*`,
+`twzrd_unevaluated_over_cap_*`, `twzrd_score_*_below_*` and
+`twzrd_over_recommended_cap_*`. The price comes from the entry's own `amount`;
+the `priceUsdc` option is ignored for the decision. Before 0.11.2 this seat
+signed on any non-block verdict.
+
+### `createGuardedX402Fetch` local caps
+
+Abort reason `[twzrd-guarded-fetch] <reason>`; these run before the buyer approval above.
+
+| Reason | When |
+|---|---|
+| `price_cap_exceeded` | The price is above `maxPricePerCall`. |
+| `hourly_budget_exceeded` | The payment would take spend in the last hour above `hourlyBudgetCap`. |
+| `amount_field_conflict`, `payto_field_conflict` | As in the client hook table. |
+| `recipient_missing` | `allowedRecipients` is set and the requirement names no recipient. |
+| `unauthorized_recipient` | `allowedRecipients` is set and `payTo` is not in it. |
+| `amount_missing_or_malformed` | A spend rule is set and the amount is not a base-unit integer. |
+| `unsupported_or_non_usdc_asset` | A spend rule is set and the asset is not USDC on that network. |
+
+### `twzrd.safeFetch` verdicts
+
+`{ verdict: "block", reason }`:
+
+| Reason | When |
+|---|---|
+| `unparseable_402` | The 402 has no readable payment requirements. |
+| `network_not_allowed` | No offer is on an `allowNetworks` network. |
+| `amount_field_conflict`, `payto_field_conflict` | As above. |
+| `no_payable_requirement` | No offer names both a recipient and an amount. |
+| `malformed_amount` | The amount is not a base-unit integer. |
+| `non_usdc_asset` | On Solana or Base, the offer names an asset that is not USDC (the budget counts micro-USDC). |
+| `over_max_spend`, `over_cumulative_spend` | The payment, or the running total, would pass `maxSpend`. |
+| `intel_block` | The injected preflight answered `block`. |
+| `decision_bind_required` | A signed decision is required and none was bound. |
+| `bind_required_no_compose`, `bind_required_no_settlement`, `bind_required_no_leaf_hash`, `bind_mismatch` | A resource bind was required and could not be built or did not match. |
+
 ## Config
 
 | Option | Env | Default | Description |
@@ -977,7 +1082,8 @@ A 402 whose payment requirements yield **no identifiable seller wallet** (missin
 | `blockDecisions` | `TWZRD_BLOCK_DECISIONS` | `block` | Decisions that throw |
 | `failOpen` (buyer preflight only) | `TWZRD_FAIL_OPEN` | `false` | Buyer outage only: default does not sign. `createTwzrdSettleGuard` omitted `failOpen` is the other default — a thrown screen returns without abort |
 | `gateOnCanSpend` | `TWZRD_GATE_ON_CAN_SPEND` | `false` | Also block when `can_spend=false` |
-| `refuseUnevaluated` | `TWZRD_REFUSE_UNEVALUATED` | `false` | Refuse every seller intel has not evaluated, instead of allowing it up to the card's `recommended_cap_usdc` |
+| `refuseUnevaluated` | `TWZRD_REFUSE_UNEVALUATED` | `false` | Refuse every seller intel has not evaluated, instead of allowing it up to the card's `recommended_cap_usdc`. `true`, `1`, `"yes"`, `"on"` in any case turn it on. |
+| `intelTimeoutMs` | `TWZRD_INTEL_TIMEOUT_MS` | `2000` | Deadline for each free intel call (preflight, merchant card). A miss is an outage, decided by `failOpen`. Paid hops are not cut off mid-payment. |
 | `autoReceipt` | — | `false` | Optional V7: auto-buy $0.05 `/trust` when `/quick` did not already settle |
 | `x402Fetch` | — | — | x402-capable fetch for `autoReceipt` |
 | `onReceipt` | — | — | Callback after receipt is captured |

package/dist/all-offers.d.ts

@@ -0,0 +1,29 @@
+import type { ResolvedTwzrdGateConfig } from "./config.js";
+/**
+ * A fetch wrapper or MCP hook sees the whole 402 but not which accepts[] entry
+ * the paying client will choose: @x402/core takes the first entry its schemes
+ * can pay, x402-solana the first Solana entry, a fee-payer preference another.
+ * So every distinct entry must pass before the payer gets the 402. Scoring one
+ * entry let a seller list a clean wallet next to a refused one and be paid on
+ * the refused one (0.11.2).
+ */
+export declare const MAX_DISTINCT_OFFERS = 8;
+export declare const TOO_MANY_PAYMENT_OPTIONS = "too_many_payment_options";
+/** The distinct offer objects in a seller-supplied accepts value. */
+export declare function distinctOffers(accepts: unknown): Array<Record<string, unknown>>;
+export declare function sameOffer(a: Record<string, unknown>, b: Record<string, unknown>): boolean;
+/**
+ * Free approval of every offer except `skip` (already evaluated by the caller).
+ * Returns the first refusal, or undefined when all pass. No paid hops.
+ */
+export declare function firstRefusedOffer(offers: Array<Record<string, unknown>>, opts: {
+    config?: ResolvedTwzrdGateConfig;
+    resourceUrl?: string;
+    agentIntent: string;
+    skip?: Record<string, unknown>;
+}): Promise<{
+    offer: Record<string, unknown>;
+    payTo?: string;
+    reason: string;
+} | undefined>;
+//# sourceMappingURL=all-offers.d.ts.map

package/dist/all-offers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"all-offers.d.ts","sourceRoot":"","sources":["../src/all-offers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAS3D;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAanE,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAU/E;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAEzF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACtC,IAAI,EAAE;IACJ,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAsBzF"}

package/dist/all-offers.js

@@ -0,0 +1,66 @@
+import { offerObjects, priceUsdcFromAmountMicro, requirementAsset, resolveRequirementFields, } from "./payto.js";
+import { twzrdApprovePayment } from "./policy.js";
+/**
+ * A fetch wrapper or MCP hook sees the whole 402 but not which accepts[] entry
+ * the paying client will choose: @x402/core takes the first entry its schemes
+ * can pay, x402-solana the first Solana entry, a fee-payer preference another.
+ * So every distinct entry must pass before the payer gets the 402. Scoring one
+ * entry let a seller list a clean wallet next to a refused one and be paid on
+ * the refused one (0.11.2).
+ */
+export const MAX_DISTINCT_OFFERS = 8;
+export const TOO_MANY_PAYMENT_OPTIONS = "too_many_payment_options";
+function offerKey(e) {
+    const f = resolveRequirementFields(e);
+    return [
+        f.payTo ?? String(e.payTo ?? e.pay_to ?? ""),
+        f.amount ?? String(e.amount ?? e.maxAmountRequired ?? ""),
+        String(e.asset ?? ""),
+        String(e.network ?? "").toLowerCase(),
+        f.conflict ?? "",
+    ].join("|");
+}
+/** The distinct offer objects in a seller-supplied accepts value. */
+export function distinctOffers(accepts) {
+    const seen = new Set();
+    const out = [];
+    for (const e of offerObjects(accepts)) {
+        const k = offerKey(e);
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push(e);
+    }
+    return out;
+}
+export function sameOffer(a, b) {
+    return offerKey(a) === offerKey(b);
+}
+/**
+ * Free approval of every offer except `skip` (already evaluated by the caller).
+ * Returns the first refusal, or undefined when all pass. No paid hops.
+ */
+export async function firstRefusedOffer(offers, opts) {
+    if (offers.length > MAX_DISTINCT_OFFERS) {
+        return { offer: offers[0] ?? {}, reason: TOO_MANY_PAYMENT_OPTIONS };
+    }
+    for (const offer of offers) {
+        if (opts.skip && sameOffer(offer, opts.skip))
+            continue;
+        const f = resolveRequirementFields(offer);
+        if (f.conflict)
+            return { offer, payTo: f.payTo, reason: f.conflict };
+        const approval = await twzrdApprovePayment({
+            resourceUrl: offer.resource ?? opts.resourceUrl,
+            payTo: f.payTo,
+            priceUsdc: priceUsdcFromAmountMicro(f.amount, offer),
+            agentIntent: opts.agentIntent,
+            chain: offer.network,
+            asset: requirementAsset(offer),
+        }, opts.config);
+        if (!approval.approved)
+            return { offer, payTo: f.payTo, reason: approval.reason };
+    }
+    return undefined;
+}
+//# sourceMappingURL=all-offers.js.map

package/dist/all-offers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"all-offers.js","sourceRoot":"","sources":["../src/all-offers.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,SAAS,QAAQ,CAAC,CAA0B;IAC1C,MAAM,CAAC,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO;QACL,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACrC,CAAC,CAAC,QAAQ,IAAI,EAAE;KACjB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAA0B,EAAE,CAA0B;IAC9E,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAsC,EACtC,IAKC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACvD,MAAM,CAAC,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC;YACE,WAAW,EAAG,KAAK,CAAC,QAA+B,IAAI,IAAI,CAAC,WAAW;YACvE,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC;YACpD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,KAAK,CAAC,OAA6B;YAC1C,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;SAC/B,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/attempt-echo.d.ts

@@ -1,7 +1,7 @@
 /**
  * Funnel join-key pass-through for paying clients.
  *
- * Server 402s (PR #2819) emit `extensions.twzrd_attempt` on PAYMENT-REQUIRED.
+ * TWZRD intel 402s emit `extensions.twzrd_attempt` on PAYMENT-REQUIRED.
  * `@x402/fetch` / `@x402/core` createPaymentPayload drops unknown extensions,
  * so every paid retry lands as a new singleton in `x402_funnel_events`.
  *

package/dist/attempt-echo.js

@@ -1,7 +1,7 @@
 /**
  * Funnel join-key pass-through for paying clients.
  *
- * Server 402s (PR #2819) emit `extensions.twzrd_attempt` on PAYMENT-REQUIRED.
+ * TWZRD intel 402s emit `extensions.twzrd_attempt` on PAYMENT-REQUIRED.
  * `@x402/fetch` / `@x402/core` createPaymentPayload drops unknown extensions,
  * so every paid retry lands as a new singleton in `x402_funnel_events`.
  *

package/dist/auto-gate.d.ts

@@ -1,7 +1,7 @@
 /**
  * installTwzrdAutoGate — canonical default trust checkpoint entry point.
  *
- * Design: docs/strategy/install-autogate-design.md (#1586).
+ * Design notes live with the TWZRD intel service.
  *
  * One name across five adapters:
  *   1. Fetch / payWrap     — guard raw fetch, then hand to x402 payer

package/dist/auto-gate.js

@@ -1,7 +1,7 @@
 /**
  * installTwzrdAutoGate — canonical default trust checkpoint entry point.
  *
- * Design: docs/strategy/install-autogate-design.md (#1586).
+ * Design notes live with the TWZRD intel service.
  *
  * One name across five adapters:
  *   1. Fetch / payWrap     — guard raw fetch, then hand to x402 payer

package/dist/cloudflare-base.d.ts

@@ -16,12 +16,27 @@ export type BasePreflightVerdict = {
     /** TWZRD's current preflight calls this trust_score; normalized here for callers. */
     riskScore: number | null;
     reasons: string[];
+    /** Free preflight fields the signing rules below read (0.11.2). */
+    nullReason?: string | null;
+    scoreIsNull?: boolean;
+    recommendedCapUsdc?: number | null;
+    washFlagged?: boolean | null;
 };
+/** Base mainnet USDC. The only asset this module signs for. */
+export declare const BASE_USDC = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
 export type CloudflareBaseGateOptions = {
     intelBase?: string;
     fetch?: typeof fetch;
-    /** Explicit price context only; x402 atomic amounts are never treated as USD. */
+    /**
+     * Ignored for the signing decision since 0.11.2: the price is read from the
+     * Base USDC entry's own `amount`, so a caller cannot understate it.
+     * @deprecated
+     */
     priceUsdc?: number;
+    /** Refuse an evaluated seller scoring below this (default 40, same as the package). */
+    preflightMinScore?: number;
+    /** Refuse every seller intel has never evaluated (same as the package option). */
+    refuseUnevaluated?: boolean;
     resourceName?: string;
     agentIntent?: string;
     /** Default false: an unavailable or malformed preflight does not permit signing. */
@@ -43,7 +58,14 @@ export declare function twzrdBasePreflight(requirements: CloudflareBaseRequireme
 export declare function createTwzrdCloudflareBaseApproval(options?: CloudflareBaseGateOptions): (requirements: CloudflareBaseRequirements) => Promise<boolean>;
 /**
  * Minimal signing interceptor for a Worker or Viem account. The callback is
- * invoked only after the exact Base payTo received a non-block verdict.
+ * invoked only when the Base USDC offer passes the package's signing rules:
+ * not blocked, not wash-flagged, a never-evaluated seller within its cap, an
+ * evaluated seller at or above the score floor and within its cap (0.11.2).
  */
 export declare function withTwzrdBasePreflight<T>(requirements: CloudflareBaseRequirements, options: CloudflareBaseGateOptions, signOrSend: () => Promise<T>): Promise<T>;
+/**
+ * The package's signing rules applied to a Base preflight card (0.11.2).
+ * Before 0.11.2 this module signed on any non-block verdict.
+ */
+export declare function baseRefusal(verdict: BasePreflightVerdict, priceUsdc: number, options?: Pick<CloudflareBaseGateOptions, "preflightMinScore" | "refuseUnevaluated">): string | undefined;
 //# sourceMappingURL=cloudflare-base.d.ts.map

package/dist/cloudflare-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-base.d.ts","sourceRoot":"","sources":["../src/cloudflare-base.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,YAAY,gBAA4B,CAAC;AAEtD,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE3B,OAAO,EAAE,oBAAoB;CAK1C;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,0BAA0B,EACxC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,qFAAqF;AACrF,wBAAgB,iCAAiC,CAC/C,OAAO,GAAE,yBAA8B,GACtC,CAAC,YAAY,EAAE,0BAA0B,KAAK,OAAO,CAAC,OAAO,CAAC,CAQhE;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,YAAY,EAAE,0BAA0B,EACxC,OAAO,EAAE,yBAAyB,EAClC,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAUZ"}
+{"version":3,"file":"cloudflare-base.d.ts","sourceRoot":"","sources":["../src/cloudflare-base.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,YAAY,gBAA4B,CAAC;AAEtD,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,SAAS,+CAA+C,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE3B,OAAO,EAAE,oBAAoB;CAK1C;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,0BAA0B,EACxC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,qFAAqF;AACrF,wBAAgB,iCAAiC,CAC/C,OAAO,GAAE,yBAA8B,GACtC,CAAC,YAAY,EAAE,0BAA0B,KAAK,OAAO,CAAC,OAAO,CAAC,CAgBhE;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,YAAY,EAAE,0BAA0B,EACxC,OAAO,EAAE,yBAAyB,EAClC,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAyBZ;AAgDD;;;GAGG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,IAAI,CAAC,yBAAyB,EAAE,mBAAmB,GAAG,mBAAmB,CAAM,GACvF,MAAM,GAAG,SAAS,CAoBpB"}