{"version":3,"sources":["../../x402/src/eip3009.ts","../../x402/src/x402auth.ts","../../x402/src/facilitators.ts","../../x402/src/payment-header.ts","../../x402/src/facilitator.ts","../../x402/src/X402Client.ts","../../x402/src/authHeaders.ts"],"names":["toHex","keccak256","encodeAbiParameters","x402Actions","signature","payload"],"mappings":";;;;;AAEO,IAAM,aAAA,GAAgB;AAAA,EACzB,yBAAA,EAA2B;AAAA,IACvB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AAAA,IAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,SAAA,EAAU;AAAA,IACtC,EAAE,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,SAAA,EAAU;AAAA,IACvC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU,GACrC;AAAA;AAAA;AAAA,EAGA,wBAAA,EAA0B;AAAA,IACtB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AAAA,IAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,SAAA,EAAU;AAAA,IACtC,EAAE,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,SAAA,EAAU;AAAA,IACvC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU,GACrC;AAAA,EACA,mBAAA,EAAqB;AAAA,IACjB,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,SAAA,EAAU;AAAA,IACtC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU;AAEzC;AAEO,SAAS,gBAAA,CAAiB,SAAA,EAAmB,YAAA,EAAsB,OAAA,EAAiB,iBAAA,EAA4B;AACnH,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,SAAA;AAAA,IACN,OAAA,EAAS,YAAA;AAAA,IACT,OAAA;AAAA,IACA;AAAA,GACJ;AACJ;AAEO,SAAS,aAAA,GAAqB;AACjC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AACvC,EAAA,OAAOA,WAAM,KAAK,CAAA;AACtB;AAGO,IAAM,oBAAA,GAAuB,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,GAAA;AAE/D,eAAsB,6BAAA,CAClB,cACA,MAAA,EAYY;AACZ,EAAA,MAAM,MAAA,GAAS,gBAAA;AAAA,IACX,MAAA,CAAO,SAAA;AAAA,IACP,MAAA,CAAO,YAAA;AAAA,IACP,MAAA,CAAO,OAAA;AAAA,IACP,MAAA,CAAO;AAAA,GACX;AAEA,EAAA,MAAM,UAAU,YAAA,CAAa,OAAA;AAC7B,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AAEA,EAAA,OAAO,aAAa,aAAA,CAAc;AAAA,IAC9B,OAAA;AAAA,IACA,MAAA;AAAA,IACA,KAAA,EAAO,aAAA;AAAA,IACP,WAAA,EAAa,2BAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACL,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,IAAI,MAAA,CAAO,EAAA;AAAA,MACX,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,aAAa,MAAA,CAAO,WAAA;AAAA,MACpB,OAAO,MAAA,CAAO;AAAA;AAClB,GACH,CAAA;AACL;AAQA,eAAsB,mCAAA,CAClB,cACA,MAAA,EAYY;AACZ,EAAA,MAAM,UAAU,YAAA,CAAa,OAAA;AAC7B,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,QAAQ,OAAA,CAAQ,WAAA,OAAkB,MAAA,CAAO,IAAA,CAAK,aAAY,EAAG;AAC7D,IAAA,MAAM,IAAI,MAAM,CAAA,OAAA,EAAU,OAAA,CAAQ,OAAO,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AAAA,EAClF;AAEA,EAAA,IAAI,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,UAAA,EAAY;AACzC,IAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,UAAA,GAAa,IAAA,EAAM;AAC/C,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,qBAAA,EAAwB,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,UAAU,CAAA,kCAAA;AAAA,KAClE;AAAA,EACJ;AACA,EAAA,OAAO,6BAAA,CAA8B,cAAc,MAAM,CAAA;AAC7D;AAOA,eAAsB,4BAAA,CAClB,cACA,MAAA,EAYY;AACZ,EAAA,MAAM,UAAU,YAAA,CAAa,OAAA;AAC7B,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,QAAQ,OAAA,CAAQ,WAAA,OAAkB,MAAA,CAAO,IAAA,CAAK,aAAY,EAAG;AAC7D,IAAA,MAAM,IAAI,MAAM,CAAA,OAAA,EAAU,OAAA,CAAQ,OAAO,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AAAA,EAClF;AAEA,EAAA,IAAI,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,UAAA,EAAY;AACzC,IAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,UAAA,GAAa,IAAA,EAAM;AAC/C,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,qBAAA,EAAwB,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,UAAU,CAAA,kCAAA;AAAA,KAClE;AAAA,EACJ;AAEA,EAAA,OAAO,aAAa,aAAA,CAAc;AAAA,IAC9B,OAAA;AAAA,IACA,MAAA,EAAQ,iBAAiB,MAAA,CAAO,SAAA,EAAW,OAAO,YAAA,EAAc,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,iBAAiB,CAAA;AAAA,IACxG,KAAA,EAAO,aAAA;AAAA,IACP,WAAA,EAAa,0BAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACL,MAAM,MAAA,CAAO,IAAA;AAAA,MACb,IAAI,MAAA,CAAO,EAAA;AAAA,MACX,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,aAAa,MAAA,CAAO,WAAA;AAAA,MACpB,OAAO,MAAA,CAAO;AAAA;AAClB,GACH,CAAA;AACL;AAMA,eAAsB,uBAAA,CAClB,cACA,MAAA,EAQY;AACZ,EAAA,MAAM,UAAU,YAAA,CAAa,OAAA;AAC7B,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,QAAQ,OAAA,CAAQ,WAAA,OAAkB,MAAA,CAAO,UAAA,CAAW,aAAY,EAAG;AACnE,IAAA,MAAM,IAAI,MAAM,CAAA,OAAA,EAAU,OAAA,CAAQ,OAAO,CAAA,2BAAA,EAA8B,MAAA,CAAO,UAAU,CAAA,CAAE,CAAA;AAAA,EAC9F;AAEA,EAAA,OAAO,aAAa,aAAA,CAAc;AAAA,IAC9B,OAAA;AAAA,IACA,MAAA,EAAQ,iBAAiB,MAAA,CAAO,SAAA,EAAW,OAAO,YAAA,EAAc,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,iBAAiB,CAAA;AAAA,IACxG,KAAA,EAAO,aAAA;AAAA,IACP,WAAA,EAAa,qBAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACL,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,OAAO,MAAA,CAAO;AAAA;AAClB,GACH,CAAA;AACL;ACpMO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,wBAAA,EAA0B;AAAA,IACxB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU;AAAA,IAC9B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,SAAA,EAAU;AAAA,IAClC,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,SAAA,EAAU;AAAA,IAClC,EAAE,IAAA,EAAM,aAAA,EAAe,IAAA,EAAM,SAAA,EAAU;AAAA,IACvC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA;AAAU;AAErC;AAQO,SAAS,kBAAA,CAAmB,KAAA,EAAgB,MAAA,EAAgB,IAAA,EAAgB;AACjF,EAAA,OAAOC,cAAA;AAAA,IACLC,wBAAA;AAAA,MACE,CAAC,EAAE,IAAA,EAAM,SAAA,EAAU,EAAG,EAAE,IAAA,EAAM,SAAA,EAAU,EAAG,EAAE,IAAA,EAAM,SAAA,EAAW,CAAA;AAAA,MAC9D,CAAC,KAAA,EAAO,MAAA,EAAQ,IAAI;AAAA;AACtB,GACF;AACF;AAQA,eAAsB,4BAAA,CACpB,cACA,MAAA,EAKc;AACd,EAAA,MAAM,UAAU,YAAA,CAAa,OAAA;AAC7B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACjE,EAAA,IAAI,QAAQ,OAAA,CAAQ,WAAA,OAAkB,MAAA,CAAO,IAAA,CAAK,aAAY,EAAG;AAC/D,IAAA,MAAM,IAAI,MAAM,CAAA,OAAA,EAAU,OAAA,CAAQ,OAAO,CAAA,qBAAA,EAAwB,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AAAA,EAChF;AACA,EAAA,OAAO,aAAa,aAAA,CAAc;AAAA,IAChC,OAAA;AAAA,IACA,MAAA,EAAQ,EAAE,IAAA,EAAM,iBAAA,EAAmB,OAAA,EAAS,GAAA,EAAK,OAAA,EAAS,MAAA,CAAO,OAAA,EAAS,iBAAA,EAAmB,MAAA,CAAO,WAAA,EAAY;AAAA,IAChH,KAAA,EAAO,gCAAA;AAAA,IACP,WAAA,EAAa,0BAAA;AAAA,IACb,OAAA,EAAS;AAAA,MACP,MAAM,MAAA,CAAO,IAAA;AAAA,MAAM,IAAI,MAAA,CAAO,EAAA;AAAA,MAAI,OAAO,MAAA,CAAO,KAAA;AAAA,MAAO,QAAQ,MAAA,CAAO,MAAA;AAAA,MACtE,QAAQ,MAAA,CAAO,MAAA;AAAA,MAAQ,aAAa,MAAA,CAAO,WAAA;AAAA,MAAa,OAAO,MAAA,CAAO;AAAA;AACxE,GACD,CAAA;AACH;;;ACtDO,IAAM,yBAAA,GAA0E;AAAA;AAAA;AAAA;AAAA,EAIrF,QAAA,EAAU;AAAA,IACR,OAAA,EAAS,QAAA;AAAA,IACT,QAAA,EAAU,4CAAA;AAAA,IACV,IAAA,EAAM,CAAC,6BAAA,EAA+B,6BAAA,EAA+B,6BAA6B;AAAA;AAEtG;AAGO,SAAS,2BAA2B,OAAA,EAA0B;AACnE,EAAA,MAAM,GAAA,GAAM,0BAA0B,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAgD,OAAO,CAAA,qCAAA,CAAuC,CAAA;AACxH,EAAA,OAAO,GAAA,CAAI,QAAA;AACb;AAGO,SAAS,uBAAuB,OAAA,EAA2B;AAChE,EAAA,OAAO,yBAAA,CAA0B,OAAO,CAAA,EAAG,IAAA,IAAQ,EAAC;AACtD;;;ACjCO,IAAM,uBAAA,GAA0B;AAChC,IAAM,wBAAA,GAA2B;AACjC,IAAM,uBAAA,GAA0B;AAGhC,IAAM,iBAAA,GAAoB;AAC1B,IAAM,0BAAA,GAA6B;AAM1C,SAAS,SAAS,IAAA,EAAuB;AACrC,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAChC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,KAAK,IAAI,CAAA;AACpB;AAEA,SAAS,WAAc,OAAA,EAAoB;AACvC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,IAAA,GAAO,OAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA,CAAE,SAAS,OAAO,CAAA;AAAA,EAC1D,CAAA,MAAO;AACH,IAAA,IAAA,GAAO,KAAK,OAAO,CAAA;AAAA,EACvB;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAC1B;AAIO,SAAS,sBAAsB,GAAA,EAA8B;AAChE,EAAA,OAAO,SAAS,GAAG,CAAA;AACvB;AAEO,SAAS,sBAAsB,OAAA,EAAkC;AACpE,EAAA,OAAO,WAA4B,OAAO,CAAA;AAC9C;AAIO,SAAS,qBAAqB,OAAA,EAAiC;AAClE,EAAA,OAAO,SAAS,OAAO,CAAA;AAC3B;AAEO,SAAS,qBAAqB,OAAA,EAAiC;AAClE,EAAA,OAAO,WAA2B,OAAO,CAAA;AAC7C;AAIO,SAAS,qBAAqB,IAAA,EAA8B;AAC/D,EAAA,OAAO,SAAS,IAAI,CAAA;AACxB;AAEO,SAAS,qBAAqB,OAAA,EAAiC;AAClE,EAAA,OAAO,WAA2B,OAAO,CAAA;AAC7C;AAUO,SAAS,uBAAuB,QAAA,EAA4C;AAC/E,EAAA,MAAM,EAAA,GAAK,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AACvD,EAAA,IAAI,EAAA,EAAI,OAAO,qBAAA,CAAsB,EAAE,CAAA;AAGvC,EAAA,MAAM,EAAA,GAAK,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAA;AACpD,EAAA,IAAI,EAAA,EAAI,OAAO,qBAAA,CAAsB,EAAE,CAAA;AAEvC,EAAA,OAAO,IAAA;AACX;AAKO,SAAS,sBAAsB,QAAA,EAA2C;AAC7E,EAAA,MAAM,EAAA,GAAK,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AACvD,EAAA,IAAI,EAAA,EAAI,OAAO,oBAAA,CAAqB,EAAE,CAAA;AAEtC,EAAA,MAAM,EAAA,GAAK,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA;AAC1D,EAAA,IAAI,EAAA,EAAI,OAAO,oBAAA,CAAqB,EAAE,CAAA;AAEtC,EAAA,OAAO,IAAA;AACX;;;ACnFO,IAAM,oBAAN,MAAwB;AAAA,EACV,GAAA;AAAA,EACA,iBAAA;AAAA,EAEjB,YAAY,MAAA,EAA2B;AACnC,IAAA,IAAA,CAAK,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvC,IAAA,IAAA,CAAK,oBAAoB,MAAA,CAAO,iBAAA;AAAA,EACpC;AAAA;AAAA,EAGA,MAAc,UAAA,CAAW,QAAA,EAA6C,IAAA,EAA+C;AACjH,IAAA,MAAM,IAAA,GAA+B,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAC1E,IAAA,IAAI,CAAC,IAAA,CAAK,iBAAA,EAAmB,OAAO,IAAA;AACpC,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,GAAI,MAAM,IAAA,CAAK,iBAAA,CAAkB,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,EAAG;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CACF,cAAA,EACA,mBAAA,EACuB;AACvB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,CAAU,EAAE,aAAa,CAAA,EAAG,cAAA,EAAgB,qBAAqB,CAAA;AACnF,IAAA,MAAM,OAAO,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,OAAA,CAAA,EAAW;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,MAAM,IAAA,CAAK,UAAA,CAAW,UAAU,IAAI,CAAA;AAAA,MAC7C;AAAA,KACH,CAAA;AACD,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,MAAM,IAAI,MAAM,IAAA,CAAK,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACrF;AACA,IAAA,OAAO,KAAK,IAAA,EAAK;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CACF,cAAA,EACA,mBAAA,EACuB;AACvB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,CAAU,EAAE,aAAa,CAAA,EAAG,cAAA,EAAgB,qBAAqB,CAAA;AACnF,IAAA,MAAM,OAAO,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,OAAA,CAAA,EAAW;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,MAAM,IAAA,CAAK,UAAA,CAAW,UAAU,IAAI,CAAA;AAAA,MAC7C;AAAA,KACH,CAAA;AACD,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,MAAM,IAAI,MAAM,IAAA,CAAK,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACrF;AACA,IAAA,OAAO,KAAK,IAAA,EAAK;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAA,GAA2C;AAC7C,IAAA,MAAM,OAAO,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,GAAG,CAAA,UAAA,CAAA,EAAc;AAAA,MAC9C,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,MAAM,IAAA,CAAK,UAAA,CAAW,aAAa,EAAE;AAAA,KACjD,CAAA;AACD,IAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,IAAA,CAAK,MAAM,IAAI,MAAM,IAAA,CAAK,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,IACxF;AACA,IAAA,OAAO,KAAK,IAAA,EAAK;AAAA,EACrB;AACJ;;;ACvCA,SAAS,YAAY,OAAA,EAAqC;AACtD,EAAA,OAAO,UAAU,OAAO,CAAA,CAAA;AAC5B;AAEO,IAAM,aAAN,MAAiB;AAAA,EACH,OAAA;AAAA,EACA,MAAA;AAAA,EACA,iBAAA;AAAA,EAEjB,YAAY,MAAA,EAA0B;AAClC,IAAA,IAAI,CAAC,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS;AAC9B,MAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAAA,IAClE;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAEd,IAAA,IAAA,CAAK,UAAUC,6BAAA,CAAY,MAAA,CAAO,qBAAqB,CAAA,CAAE,OAAO,YAAY,CAAA;AAC5E,IAAA,IAAI,OAAO,WAAA,EAAa;AACpB,MAAA,IAAA,CAAK,iBAAA,GAAoB,IAAI,iBAAA,CAAkB,MAAA,CAAO,WAAW,CAAA;AAAA,IACrE;AAAA,EACJ;AAAA;AAAA,EAGQ,mBAAA,GAA+B;AACnC,IAAA,OAAO,KAAK,MAAA,CAAO,mBAAA,IAAuB,0BAAA,CAA2B,IAAA,CAAK,OAAO,OAAO,CAAA;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,MAAA,EAIjB;AACC,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,YAAA;AAC3B,IAAA,MAAM,UAAU,MAAA,CAAO,OAAA;AACvB,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,OAAA;AAC5B,IAAA,MAAM,GAAA,GAAM,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAC,CAAA;AAChD,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,UAAA,IAAe,GAAA,GAAM,IAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,WAAA,IAAgB,GAAA,GAAM,KAAA;AACjD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,MAAA;AAC3C,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,GAAA;AACjD,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,MAAA,CAAO,MAAA;AACvC,IAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,UAAA;AACxC,IAAA,MAAM,WAAA,GAAc,KAAK,mBAAA,EAAoB;AAE7C,IAAA,MAAM,YAAA,GAAe;AAAA,MACjB,MAAA,EAAQ,OAAA;AAAA,MACR,OAAA,EAAS,YAAY,OAAO,CAAA;AAAA,MAC5B,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,QAAA,EAAS;AAAA,MAC/B,OAAO,MAAA,CAAO,EAAA;AAAA,MACd,iBAAA,EAAmB;AAAA,KACvB;AAEA,IAAA,IAAI,eAAe,QAAA,EAAU;AAEzB,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,IAAS,aAAA,EAAc;AAC5C,MAAA,MAAMC,UAAAA,GAAY,MAAM,4BAAA,CAA6B,MAAA,EAAQ;AAAA,QACzD,MAAM,MAAA,CAAO,IAAA;AAAA,QAAM,IAAI,MAAA,CAAO,EAAA;AAAA,QAAI,OAAO,MAAA,CAAO,KAAA;AAAA,QAAO,QAAQ,MAAA,CAAO,MAAA;AAAA,QACtE,MAAA;AAAA,QAAQ,WAAA;AAAA,QAAa,KAAA;AAAA,QAAO,OAAA;AAAA,QAAS;AAAA,OACxC,CAAA;AACD,MAAA,MAAMC,QAAAA,GAA0B;AAAA,QAC5B,WAAA,EAAa,CAAA;AAAA,QACb,UAAU,EAAE,GAAG,YAAA,EAAc,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,YAAA,EAAc,YAAY,QAAA,EAAU,MAAA,EAAQ,MAAA,CAAO,QAAA,IAAW,EAAE;AAAA,QAChI,OAAA,EAAS;AAAA,UACL,SAAA,EAAAD,UAAAA;AAAA,UACA,aAAA,EAAe;AAAA,YACX,MAAM,MAAA,CAAO,IAAA;AAAA,YAAM,IAAI,MAAA,CAAO,EAAA;AAAA,YAAI,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,QAAA,EAAS;AAAA,YAChE,UAAA,EAAY,GAAA;AAAA,YAAK,WAAA,EAAa,YAAY,QAAA,EAAS;AAAA,YAAG;AAAA;AAC1D;AACJ,OACJ;AACA,MAAA,OAAO,EAAE,OAAA,EAAAC,QAAAA,EAAS,SAAS,oBAAA,CAAqBA,QAAO,GAAG,KAAA,EAAM;AAAA,IACpE;AAGA,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,IAAQ,aAAA,EAAc;AAC1C,IAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,MAAA,CAAO,EAAA,EAAI,QAAQ,IAAI,CAAA;AAC/D,IAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,aAAA,CAAc;AAAA,MACzC,OAAA;AAAA,MACA,QAAQ,gBAAA,CAAiB,SAAA,EAAW,YAAA,EAAc,OAAA,EAAS,OAAO,KAAK,CAAA;AAAA,MACvE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0BAAA;AAAA,MACb,OAAA,EAAS;AAAA,QACL,MAAM,MAAA,CAAO,IAAA;AAAA,QAAM,EAAA,EAAI,WAAA;AAAA,QAAa,OAAO,MAAA,CAAO,MAAA;AAAA,QAClD,UAAA;AAAA,QAAY,WAAA;AAAA,QAAa,KAAA,EAAO;AAAA;AACpC,KACH,CAAA;AACD,IAAA,MAAM,OAAA,GAA0B;AAAA,MAC5B,WAAA,EAAa,CAAA;AAAA,MACb,UAAU,EAAE,GAAG,YAAA,EAAc,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,YAAA,EAAc,YAAY,UAAA,EAAY,MAAA,EAAQ,OAAO,QAAA,EAAS,EAAG,MAAK,EAAE;AAAA,MACxI,OAAA,EAAS;AAAA,QACL,SAAA;AAAA,QACA,aAAA,EAAe;AAAA,UACX,MAAM,MAAA,CAAO,IAAA;AAAA,UAAM,EAAA,EAAI,WAAA;AAAA,UAAa,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,QAAA,EAAS;AAAA,UAClE,UAAA,EAAY,WAAW,QAAA,EAAS;AAAA,UAAG,WAAA,EAAa,YAAY,QAAA,EAAS;AAAA,UAAG,KAAA,EAAO;AAAA;AACnF;AACJ,KACJ;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,qBAAqB,OAAO,CAAA,EAAG,OAAO,YAAA,EAAa;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,MAAA,EAGH;AACb,IAAA,OAAO,IAAA,CAAK,QAAQ,iBAAA,CAAkB;AAAA,MAClC,GAAG,MAAA;AAAA,MACH,OAAA,EAAS,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa;AAAA,KACrC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,MAAA,EAET;AACb,IAAA,OAAO,IAAA,CAAK,QAAQ,uBAAA,CAAwB;AAAA,MACxC,GAAG,MAAA;AAAA,MACH,OAAA,EAAS,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa;AAAA,KACrC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAA,GAAwC;AAC1C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA,CAAQ,iBAAA,EAAkB;AACpD,IAAA,OAAO,EAAE,MAAA,EAAO;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,KAAA,EAA8B;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,oBAAA,CAAqB,EAAE,OAAO,CAAA;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,0BAAA,CAA2B,SAAyB,YAAA,EAAyD;AACjH,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,OAAA,CAAQ,QAAA;AAClC,IAAA,OAAO,EAAE,GAAG,YAAA,EAAc,KAAA,EAAO,EAAE,GAAG,YAAA,CAAa,KAAA,EAAO,GAAG,OAAA,CAAQ,QAAA,CAAS,KAAA,EAAM,EAAE;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CAAqB,OAAA,EAAyB,YAAA,EAAoC;AACpF,IAAA,IAAI,CAAC,KAAK,iBAAA,EAAmB;AACzB,MAAA,MAAM,IAAI,MAAM,+EAA+E,CAAA;AAAA,IACnG;AACA,IAAA,OAAO,IAAA,CAAK,kBAAkB,MAAA,CAAO,OAAA,EAAS,KAAK,0BAAA,CAA2B,OAAA,EAAS,YAAY,CAAC,CAAA;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CAAqB,OAAA,EAAyB,YAAA,EAA6D;AAC7G,IAAA,IAAI,CAAC,KAAK,iBAAA,EAAmB;AACzB,MAAA,MAAM,IAAI,MAAM,+EAA+E,CAAA;AAAA,IACnG;AACA,IAAA,OAAO,IAAA,CAAK,kBAAkB,MAAA,CAAO,OAAA,EAAS,KAAK,0BAAA,CAA2B,OAAA,EAAS,YAAY,CAAC,CAAA;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,SAAA,CAAU,GAAA,EAAa,IAAA,EAAuC;AAChE,IAAA,MAAM,aAAA,GAAgB,MAAM,KAAA,CAAM,GAAA,EAAK,IAAI,CAAA;AAE3C,IAAA,IAAI,aAAA,CAAc,WAAW,GAAA,EAAK;AAC9B,MAAA,OAAO,aAAA;AAAA,IACX;AAIA,IAAA,MAAM,eAAA,GAAkB,uBAAuB,aAAa,CAAA;AAC5D,IAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,eAAA,CAAgB,SAAS,MAAA,EAAQ;AACtD,MAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,IACnF;AAGA,IAAA,MAAM,SAAA,GAAY,WAAA,CAAY,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AACjD,IAAA,IAAI,QAAA,GAAW,gBAAgB,OAAA,CAAQ,IAAA;AAAA,MACnC,CAAC,CAAA,KAAM,CAAA,CAAE,OAAA,KAAY,SAAA,IAAa,EAAE,MAAA,KAAW;AAAA,KACnD;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AAEX,MAAA,QAAA,GAAW,eAAA,CAAgB,QAAQ,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,OAAA,CAAQ,UAAA,CAAW,SAAS,CAAC,CAAA;AAAA,IAClF;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AACX,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,SAAS,CAAA,CAAE,CAAA;AAAA,IAC3E;AAGA,IAAA,IAAI,IAAA,CAAK,OAAO,mBAAA,IAAuB,MAAA,CAAO,SAAS,MAAM,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,mBAAA,EAAqB;AAC9F,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,kBAAkB,QAAA,CAAS,MAAM,CAAA,aAAA,EAAgB,IAAA,CAAK,OAAO,mBAAmB,CAAA;AAAA,OACpF;AAAA,IACJ;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,OAAA;AACzC,IAAA,IAAI,CAAC,OAAA,EAAS;AACV,MAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,IAC7E;AAGA,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,KAAK,aAAA,CAAc;AAAA,MACzC,MAAM,OAAA,CAAQ,OAAA;AAAA,MACd,IAAI,QAAA,CAAS,KAAA;AAAA,MACb,OAAO,QAAA,CAAS,KAAA;AAAA,MAChB,MAAA,EAAQ,MAAA,CAAO,QAAA,CAAS,MAAM;AAAA,KACjC,CAAA;AAGD,IAAA,MAAM,YAAA,GAAe,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAC9C,IAAA,YAAA,CAAa,GAAA,CAAI,0BAA0B,OAAO,CAAA;AAElD,IAAA,OAAO,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,cAAc,CAAA;AAAA,EACxD;AACJ;;;ACnSA,eAAsB,aAAA,CAAc,QAAgB,OAAA,EAAkC;AACpF,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAC5B,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,IAAI,MAAA,CAAO,MAAM,GAAG,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AACvH,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,GAAA,CAAI,MAAA,CAAO,OAAO,CAAC,CAAA;AACrE,EAAA,OAAO,CAAC,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACrF;AAgBO,SAAS,qBAAA,CACd,QACA,IAAA,EACqD;AACrD,EAAA,MAAM,GAAA,GAAM,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AACzC,EAAA,OAAO,OAAO,EAAE,QAAA,EAAU,IAAA,EAAK,KAAuC;AACpE,IAAA,IAAI,QAAA,KAAa,QAAA,EAAU,OAAO,EAAC;AACnC,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,EAAK,CAAA;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,CAAc,MAAA,EAAQ,GAAG,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAC9D,IAAA,OAAO,EAAE,kBAAA,EAAoB,SAAA,EAAW,aAAA,EAAe,GAAA,EAAI;AAAA,EAC7D,CAAA;AACF","file":"chunk-PTHQ3JLP.cjs","sourcesContent":["import { type Address, type Hex, type WalletClient, toHex } from 'viem';\n\nexport const EIP3009_TYPES = {\n    TransferWithAuthorization: [\n        { name: 'from', type: 'address' },\n        { name: 'to', type: 'address' },\n        { name: 'value', type: 'uint256' },\n        { name: 'validAfter', type: 'uint256' },\n        { name: 'validBefore', type: 'uint256' },\n        { name: 'nonce', type: 'bytes32' },\n    ],\n    // Distinct typehash from TransferWithAuthorization — prevents replay across variants.\n    // msg.sender must equal `to` on-chain (CallerMustBeRecipient error if violated).\n    ReceiveWithAuthorization: [\n        { name: 'from', type: 'address' },\n        { name: 'to', type: 'address' },\n        { name: 'value', type: 'uint256' },\n        { name: 'validAfter', type: 'uint256' },\n        { name: 'validBefore', type: 'uint256' },\n        { name: 'nonce', type: 'bytes32' },\n    ],\n    CancelAuthorization: [\n        { name: 'authorizer', type: 'address' },\n        { name: 'nonce', type: 'bytes32' },\n    ],\n} as const;\n\nexport function getEIP3009Domain(tokenName: string, tokenVersion: string, chainId: number, verifyingContract: Address) {\n    return {\n        name: tokenName,\n        version: tokenVersion,\n        chainId,\n        verifyingContract,\n    };\n}\n\nexport function generateNonce(): Hex {\n    const bytes = new Uint8Array(32);\n    globalThis.crypto.getRandomValues(bytes);\n    return toHex(bytes);\n}\n\n// GToken EIP-712 domain constants (GTokenAuthorization v2.2.0)\nexport const GTOKEN_EIP712_DOMAIN = { name: 'GToken', version: '1' } as const;\n\nexport async function signTransferWithAuthorization(\n    walletClient: WalletClient,\n    params: {\n        from: Address;\n        to: Address;\n        value: bigint;\n        validAfter: bigint;\n        validBefore: bigint;\n        nonce: Hex;\n        tokenName: string;\n        tokenVersion: string;\n        chainId: number;\n        verifyingContract: Address;\n    }\n): Promise<Hex> {\n    const domain = getEIP3009Domain(\n        params.tokenName,\n        params.tokenVersion,\n        params.chainId,\n        params.verifyingContract\n    );\n\n    const account = walletClient.account;\n    if (!account) {\n        throw new Error('WalletClient must have an account');\n    }\n\n    return walletClient.signTypedData({\n        account,\n        domain,\n        types: EIP3009_TYPES,\n        primaryType: 'TransferWithAuthorization',\n        message: {\n            from: params.from,\n            to: params.to,\n            value: params.value,\n            validAfter: params.validAfter,\n            validBefore: params.validBefore,\n            nonce: params.nonce,\n        },\n    });\n}\n\n/**\n * Sign a TransferWithAuthorization for GTokenAuthorization (EIP-3009).\n * GToken-specific wrapper: enforces MAX_AUTH_VALIDITY = 300s before signing.\n * Use this instead of the generic signTransferWithAuthorization when the\n * verifying contract is GTokenAuthorization.\n */\nexport async function signGTokenTransferWithAuthorization(\n    walletClient: WalletClient,\n    params: {\n        from: Address;\n        to: Address;\n        value: bigint;\n        validAfter: bigint;\n        validBefore: bigint;\n        nonce: Hex;\n        tokenName: string;\n        tokenVersion: string;\n        chainId: number;\n        verifyingContract: Address;\n    }\n): Promise<Hex> {\n    const account = walletClient.account;\n    if (!account) {\n        throw new Error('WalletClient must have an account');\n    }\n    if (account.address.toLowerCase() !== params.from.toLowerCase()) {\n        throw new Error(`Signer ${account.address} does not match from ${params.from}`);\n    }\n    // GTokenAuthorization enforces MAX_AUTH_VALIDITY = 300s on-chain.\n    if (params.validBefore <= params.validAfter) {\n        throw new Error('validBefore must be greater than validAfter');\n    }\n    if (params.validBefore - params.validAfter > 300n) {\n        throw new Error(\n            `Authorization window ${params.validBefore - params.validAfter}s exceeds MAX_AUTH_VALIDITY (300s)`\n        );\n    }\n    return signTransferWithAuthorization(walletClient, params);\n}\n\n/**\n * Sign a ReceiveWithAuthorization for GTokenAuthorization (EIP-3009).\n * The signed `to` address must be the one submitting the transaction on-chain.\n * Note: `xPNTsToken` is NOT included in the signature (it's a relay-supplied hint for RC-2).\n */\nexport async function signReceiveWithAuthorization(\n    walletClient: WalletClient,\n    params: {\n        from: Address;\n        to: Address;\n        value: bigint;\n        validAfter: bigint;\n        validBefore: bigint;\n        nonce: Hex;\n        tokenName: string;\n        tokenVersion: string;\n        chainId: number;\n        verifyingContract: Address;\n    }\n): Promise<Hex> {\n    const account = walletClient.account;\n    if (!account) {\n        throw new Error('WalletClient must have an account');\n    }\n    if (account.address.toLowerCase() !== params.from.toLowerCase()) {\n        throw new Error(`Signer ${account.address} does not match from ${params.from}`);\n    }\n    // GTokenAuthorization enforces MAX_AUTH_VALIDITY = 300s on-chain (RC-1).\n    if (params.validBefore <= params.validAfter) {\n        throw new Error('validBefore must be greater than validAfter');\n    }\n    if (params.validBefore - params.validAfter > 300n) {\n        throw new Error(\n            `Authorization window ${params.validBefore - params.validAfter}s exceeds MAX_AUTH_VALIDITY (300s)`\n        );\n    }\n\n    return walletClient.signTypedData({\n        account,\n        domain: getEIP3009Domain(params.tokenName, params.tokenVersion, params.chainId, params.verifyingContract),\n        types: EIP3009_TYPES,\n        primaryType: 'ReceiveWithAuthorization',\n        message: {\n            from: params.from,\n            to: params.to,\n            value: params.value,\n            validAfter: params.validAfter,\n            validBefore: params.validBefore,\n            nonce: params.nonce,\n        },\n    });\n}\n\n/**\n * Sign a CancelAuthorization for GTokenAuthorization (EIP-3009).\n * Must be signed by the original `authorizer` address.\n */\nexport async function signCancelAuthorization(\n    walletClient: WalletClient,\n    params: {\n        authorizer: Address;\n        nonce: Hex;\n        tokenName: string;\n        tokenVersion: string;\n        chainId: number;\n        verifyingContract: Address;\n    }\n): Promise<Hex> {\n    const account = walletClient.account;\n    if (!account) {\n        throw new Error('WalletClient must have an account');\n    }\n    if (account.address.toLowerCase() !== params.authorizer.toLowerCase()) {\n        throw new Error(`Signer ${account.address} does not match authorizer ${params.authorizer}`);\n    }\n\n    return walletClient.signTypedData({\n        account,\n        domain: getEIP3009Domain(params.tokenName, params.tokenVersion, params.chainId, params.verifyingContract),\n        types: EIP3009_TYPES,\n        primaryType: 'CancelAuthorization',\n        message: {\n            authorizer: params.authorizer,\n            nonce: params.nonce,\n        },\n    });\n}\n","import {\n  type Address, type Hex, type WalletClient,\n  encodeAbiParameters, keccak256,\n} from 'viem';\n\n// ============================================================\n// x402 settlement-authorization signing — aligned with the deployed\n// SuperPaymaster `X402Facilitator.sol` (DVT#130 / aastar-sdk#39).\n//\n// Two settlement paths, two distinct signatures:\n//   - \"direct\"   (xPNTs): payer signs an X402PaymentAuthorization (EIP-712 over the\n//                 facilitator), submitted via settleX402PaymentDirect(..., signature).\n//   - \"eip-3009\" (USDC):  payer signs an EIP-3009 ReceiveWithAuthorization over the\n//                 TOKEN, with recipient = the facilitator and a DERIVED nonce that binds\n//                 the final recipient (payTo) + maxFee + salt — the C-03 recipient-lock.\n// ============================================================\n\n/** EIP-712 type for the direct-settlement payer authorization (X402Facilitator domain). */\nexport const X402_PAYMENT_AUTHORIZATION_TYPES = {\n  X402PaymentAuthorization: [\n    { name: 'from', type: 'address' },\n    { name: 'to', type: 'address' },\n    { name: 'asset', type: 'address' },\n    { name: 'amount', type: 'uint256' },\n    { name: 'maxFee', type: 'uint256' },\n    { name: 'validBefore', type: 'uint256' },\n    { name: 'nonce', type: 'bytes32' },\n  ],\n} as const;\n\n/**\n * Derived EIP-3009 nonce for the USDC settle path — MUST equal the contract's\n * `keccak256(abi.encode(to, maxFee, salt))` (`X402Facilitator.settleX402Payment`), where\n * `to` is the FINAL recipient (payTo). Binding the recipient into the nonce is the C-03 fix\n * (a facilitator can't redirect the payout without invalidating the signature).\n */\nexport function deriveEip3009Nonce(payTo: Address, maxFee: bigint, salt: Hex): Hex {\n  return keccak256(\n    encodeAbiParameters(\n      [{ type: 'address' }, { type: 'uint256' }, { type: 'bytes32' }],\n      [payTo, maxFee, salt],\n    ),\n  );\n}\n\n/**\n * Sign the direct-path `X402PaymentAuthorization` (EIP-712). Domain is the FACILITATOR\n * contract — `{ name: \"X402Facilitator\", version: \"1\", chainId, verifyingContract: facilitator }`\n * (matches `X402Facilitator._x402DomainSeparator()`; verified on-chain via settleX402PaymentDirect).\n * EOA or AirAccount passkey (ERC-1271) — the contract uses `SignatureCheckerLib.isValidSignatureNow`.\n */\nexport async function signX402PaymentAuthorization(\n  walletClient: WalletClient,\n  params: {\n    from: Address; to: Address; asset: Address; amount: bigint;\n    maxFee: bigint; validBefore: bigint; nonce: Hex;\n    chainId: number; facilitator: Address;\n  },\n): Promise<Hex> {\n  const account = walletClient.account;\n  if (!account) throw new Error('WalletClient must have an account');\n  if (account.address.toLowerCase() !== params.from.toLowerCase()) {\n    throw new Error(`Signer ${account.address} does not match from ${params.from}`);\n  }\n  return walletClient.signTypedData({\n    account,\n    domain: { name: 'X402Facilitator', version: '1', chainId: params.chainId, verifyingContract: params.facilitator },\n    types: X402_PAYMENT_AUTHORIZATION_TYPES,\n    primaryType: 'X402PaymentAuthorization',\n    message: {\n      from: params.from, to: params.to, asset: params.asset, amount: params.amount,\n      maxFee: params.maxFee, validBefore: params.validBefore, nonce: params.nonce,\n    },\n  });\n}\n","import type { Address } from 'viem';\n\n/**\n * Default x402 facilitator registry (mirrors `@aastar/core` `DEFAULT_DVT_NODES`).\n *\n * `contract` is the deployed `X402Facilitator` (used as the EIP-712 `verifyingContract` for the\n * direct-path `X402PaymentAuthorization`, and as the on-chain recipient for the eip-3009 path).\n * `urls` are the hosted facilitator HTTP services (`/x402/{verify,settle,supported}`) — these are\n * operated by DVT nodes (migration tracked in YetAnotherAA-Validator#130) and are filled in once\n * dvt1/2/3 deploy the `x402-facilitator` module. A developer can always override via\n * `new X402Client({ facilitator: { url } })`.\n */\nexport interface X402FacilitatorEnv {\n  chainId: number;\n  /** Deployed X402Facilitator contract (EIP-712 domain verifyingContract + eip-3009 recipient). */\n  contract: Address;\n  /** Hosted facilitator service base URLs (each appends `/x402/...`). Empty until DVT deploys. */\n  urls: string[];\n}\n\nexport const DEFAULT_X402_FACILITATORS: Readonly<Record<number, X402FacilitatorEnv>> = {\n  // Sepolia — X402Facilitator v5.4.1 (X402Facilitator-1.0.0), proven on-chain via settleX402PaymentDirect.\n  // Hosted facilitator services run on the AAStar DVT nodes (YetAnotherAA-Validator#130, x402-facilitator\n  // module). Load-balanced + fail over on 5xx — each node has its own operator (all approvedFacilitators).\n  11155111: {\n    chainId: 11155111,\n    contract: '0xfe1DB01e1d6622e722B92ed5993af61325DB92aF',\n    urls: ['https://dvt1.aastar.io/x402', 'https://dvt2.aastar.io/x402', 'https://dvt3.aastar.io/x402'],\n  },\n};\n\n/** The deployed X402Facilitator contract for a chain (throws if unknown — callers must pass one). */\nexport function getX402FacilitatorContract(chainId: number): Address {\n  const env = DEFAULT_X402_FACILITATORS[chainId];\n  if (!env) throw new Error(`x402: no default X402Facilitator for chainId ${chainId}; pass facilitatorContract explicitly`);\n  return env.contract;\n}\n\n/** Hosted facilitator service URLs for a chain (empty until DVT deploys the module). */\nexport function getX402FacilitatorUrls(chainId: number): string[] {\n  return DEFAULT_X402_FACILITATORS[chainId]?.urls ?? [];\n}\n","import type { PaymentRequired, PaymentPayload, SettleResponse } from './types.js';\n\n// ============================================================\n// x402 v2 HTTP Header Names\n// Ref: github.com/coinbase/x402/blob/main/specs/x402-specification-v2.md\n// ============================================================\n\n/** v2 header names (standard) */\nexport const HEADER_PAYMENT_REQUIRED = 'PAYMENT-REQUIRED';\nexport const HEADER_PAYMENT_SIGNATURE = 'PAYMENT-SIGNATURE';\nexport const HEADER_PAYMENT_RESPONSE = 'PAYMENT-RESPONSE';\n\n/** v1 header names (backward compat) */\nexport const HEADER_V1_PAYMENT = 'X-PAYMENT';\nexport const HEADER_V1_PAYMENT_RESPONSE = 'X-PAYMENT-RESPONSE';\n\n// ============================================================\n// Encoding / Decoding (Base64 JSON — per x402 spec)\n// ============================================================\n\nfunction toBase64(data: unknown): string {\n    const json = JSON.stringify(data);\n    if (typeof Buffer !== 'undefined') {\n        return Buffer.from(json).toString('base64');\n    }\n    return btoa(json);\n}\n\nfunction fromBase64<T>(encoded: string): T {\n    let json: string;\n    if (typeof Buffer !== 'undefined') {\n        json = Buffer.from(encoded, 'base64').toString('utf-8');\n    } else {\n        json = atob(encoded);\n    }\n    return JSON.parse(json) as T;\n}\n\n// --- PaymentRequired (402 response) ---\n\nexport function encodePaymentRequired(req: PaymentRequired): string {\n    return toBase64(req);\n}\n\nexport function decodePaymentRequired(encoded: string): PaymentRequired {\n    return fromBase64<PaymentRequired>(encoded);\n}\n\n// --- PaymentPayload (client → server) ---\n\nexport function encodePaymentPayload(payload: PaymentPayload): string {\n    return toBase64(payload);\n}\n\nexport function decodePaymentPayload(encoded: string): PaymentPayload {\n    return fromBase64<PaymentPayload>(encoded);\n}\n\n// --- SettleResponse (server → client) ---\n\nexport function encodeSettleResponse(resp: SettleResponse): string {\n    return toBase64(resp);\n}\n\nexport function decodeSettleResponse(encoded: string): SettleResponse {\n    return fromBase64<SettleResponse>(encoded);\n}\n\n// ============================================================\n// Header Extraction Helpers\n// ============================================================\n\n/**\n * Extract PaymentRequired from a 402 Response.\n * Tries v2 header first, falls back to v1.\n */\nexport function extractPaymentRequired(response: Response): PaymentRequired | null {\n    const v2 = response.headers.get(HEADER_PAYMENT_REQUIRED);\n    if (v2) return decodePaymentRequired(v2);\n\n    // v1 fallback: check body or X-PAYMENT-REQUIRED\n    const v1 = response.headers.get('X-PAYMENT-REQUIRED');\n    if (v1) return decodePaymentRequired(v1);\n\n    return null;\n}\n\n/**\n * Extract SettleResponse from a successful response.\n */\nexport function extractSettleResponse(response: Response): SettleResponse | null {\n    const v2 = response.headers.get(HEADER_PAYMENT_RESPONSE);\n    if (v2) return decodeSettleResponse(v2);\n\n    const v1 = response.headers.get(HEADER_V1_PAYMENT_RESPONSE);\n    if (v1) return decodeSettleResponse(v1);\n\n    return null;\n}\n","import type {\n    PaymentPayload,\n    PaymentRequirements,\n    VerifyResponse,\n    SettleResponse,\n    FacilitatorSupported,\n    FacilitatorConfig,\n} from './types.js';\n\n/**\n * HTTP Facilitator Client — standard x402 v2 facilitator API.\n * Compatible with Coinbase hosted facilitator and self-hosted instances.\n *\n * Ref: coinbase/x402 HTTPFacilitatorClient pattern\n */\nexport class FacilitatorClient {\n    private readonly url: string;\n    private readonly createAuthHeaders: FacilitatorConfig['createAuthHeaders'];\n\n    constructor(config: FacilitatorConfig) {\n        this.url = config.url.replace(/\\/$/, '');\n        this.createAuthHeaders = config.createAuthHeaders;\n    }\n\n    /** Headers for a request, signing the EXACT `body` bytes (so the §4 HMAC matches what's sent). */\n    private async getHeaders(endpoint: 'verify' | 'settle' | 'supported', body: string): Promise<Record<string, string>> {\n        const base: Record<string, string> = { 'Content-Type': 'application/json' };\n        if (!this.createAuthHeaders) return base;\n        return { ...base, ...(await this.createAuthHeaders({ endpoint, body })) };\n    }\n\n    /**\n     * POST /verify — validate payment signature off-chain (~100ms).\n     */\n    async verify(\n        paymentPayload: PaymentPayload,\n        paymentRequirements: PaymentRequirements,\n    ): Promise<VerifyResponse> {\n        const body = JSON.stringify({ x402Version: 2, paymentPayload, paymentRequirements });\n        const resp = await fetch(`${this.url}/verify`, {\n            method: 'POST',\n            headers: await this.getHeaders('verify', body),\n            body,\n        });\n        if (!resp.ok) {\n            throw new Error(`Facilitator /verify failed: ${resp.status} ${await resp.text()}`);\n        }\n        return resp.json() as Promise<VerifyResponse>;\n    }\n\n    /**\n     * POST /settle — execute on-chain settlement (~2s on Base).\n     */\n    async settle(\n        paymentPayload: PaymentPayload,\n        paymentRequirements: PaymentRequirements,\n    ): Promise<SettleResponse> {\n        const body = JSON.stringify({ x402Version: 2, paymentPayload, paymentRequirements });\n        const resp = await fetch(`${this.url}/settle`, {\n            method: 'POST',\n            headers: await this.getHeaders('settle', body),\n            body,\n        });\n        if (!resp.ok) {\n            throw new Error(`Facilitator /settle failed: ${resp.status} ${await resp.text()}`);\n        }\n        return resp.json() as Promise<SettleResponse>;\n    }\n\n    /**\n     * GET /supported — query facilitator capabilities.\n     */\n    async supported(): Promise<FacilitatorSupported> {\n        const resp = await fetch(`${this.url}/supported`, {\n            method: 'GET',\n            headers: await this.getHeaders('supported', ''),\n        });\n        if (!resp.ok) {\n            throw new Error(`Facilitator /supported failed: ${resp.status} ${await resp.text()}`);\n        }\n        return resp.json() as Promise<FacilitatorSupported>;\n    }\n}\n","import { type Address, type Hex, type Hash, type PublicClient, type WalletClient } from 'viem';\nimport { x402Actions } from '@aastar/core';\nimport type {\n    X402PaymentParams, PaymentRequired, PaymentPayload,\n    PaymentRequirements, SettleResponse, FacilitatorConfig,\n} from './types.js';\nimport { EIP3009_TYPES, getEIP3009Domain, generateNonce } from './eip3009.js';\nimport { signX402PaymentAuthorization, deriveEip3009Nonce } from './x402auth.js';\nimport { getX402FacilitatorContract } from './facilitators.js';\nimport {\n    encodePaymentPayload,\n    extractPaymentRequired,\n    extractSettleResponse,\n    HEADER_PAYMENT_SIGNATURE,\n} from './payment-header.js';\nimport { FacilitatorClient } from './facilitator.js';\n\n// ============================================================\n// x402 Client — aligned with @x402/fetch + @x402/core patterns\n// Ref: coinbase/x402, Cloudflare Workers x402, MPP mppx\n// ============================================================\n\nexport type X402ClientConfig = {\n    publicClient: PublicClient;\n    walletClient: WalletClient;\n    superPaymasterAddress: Address;\n    chainId: number;\n    /**\n     * The deployed `X402Facilitator` contract — the EIP-712 `verifyingContract` for the direct-path\n     * `X402PaymentAuthorization` AND the on-chain recipient for the eip-3009 path. Defaults to\n     * `DEFAULT_X402_FACILITATORS[chainId].contract`.\n     */\n    facilitatorContract?: Address;\n    /** Facilitator endpoint (default: self-facilitated via SuperPaymaster) */\n    facilitator?: FacilitatorConfig;\n    /** EIP-712 domain for asset token (defaults: USDC / version \"2\") */\n    tokenName?: string;\n    tokenVersion?: string;\n    /** Payment policy: max amount per request (in atomic units) */\n    maxAmountPerRequest?: bigint;\n};\n\n/** CAIP-2 network identifier from chainId */\nfunction toNetworkId(chainId: number): `eip155:${number}` {\n    return `eip155:${chainId}`;\n}\n\nexport class X402Client {\n    private readonly actions;\n    private readonly config: X402ClientConfig;\n    private readonly facilitatorClient?: FacilitatorClient;\n\n    constructor(config: X402ClientConfig) {\n        if (!config.walletClient.account) {\n            throw new Error('WalletClient must have an account configured');\n        }\n        this.config = config;\n        // walletClient supports both readContract and writeContract — single instance suffices\n        this.actions = x402Actions(config.superPaymasterAddress)(config.walletClient);\n        if (config.facilitator) {\n            this.facilitatorClient = new FacilitatorClient(config.facilitator);\n        }\n    }\n\n    /** Resolve the deployed X402Facilitator contract (config override → DEFAULT_X402_FACILITATORS). */\n    private facilitatorContract(): Address {\n        return this.config.facilitatorContract ?? getX402FacilitatorContract(this.config.chainId);\n    }\n\n    /**\n     * Create a signed payment payload, aligned with the deployed `X402Facilitator` (DVT#130).\n     * Two settlement paths:\n     *  - `\"direct\"`   (xPNTs): payer signs an `X402PaymentAuthorization` (EIP-712 over the facilitator),\n     *                 settled via `settleX402PaymentDirect(..., signature)`.\n     *  - `\"eip-3009\"` (USDC, default): payer signs a `ReceiveWithAuthorization` over the TOKEN, with\n     *                 recipient = the facilitator and a DERIVED nonce `keccak256(abi.encode(payTo,maxFee,salt))`\n     *                 that binds the final recipient (C-03). The facilitator submits `settleX402Payment`.\n     * Returns a base64-encoded PaymentPayload ready for the PAYMENT-SIGNATURE header.\n     */\n    async createPayment(params: X402PaymentParams): Promise<{\n        payload: PaymentPayload;\n        encoded: string;\n        nonce: Hex;\n    }> {\n        const wallet = this.config.walletClient;\n        const account = wallet.account!;\n        const chainId = this.config.chainId;\n        const now = BigInt(Math.floor(Date.now() / 1000));\n        const validAfter = params.validAfter ?? (now - 600n); // 10 min grace (per x402 spec)\n        const validBefore = params.validBefore ?? (now + 3600n);\n        const tokenName = this.config.tokenName || 'USDC';\n        const tokenVersion = this.config.tokenVersion || '2';\n        const maxFee = params.maxFee ?? params.amount;\n        const settlement = params.settlement ?? 'eip-3009';\n        const facilitator = this.facilitatorContract();\n\n        const acceptedBase = {\n            scheme: 'exact' as const,\n            network: toNetworkId(chainId),\n            asset: params.asset,\n            amount: params.amount.toString(),\n            payTo: params.to,\n            maxTimeoutSeconds: 3600,\n        };\n\n        if (settlement === 'direct') {\n            // xPNTs path — X402PaymentAuthorization over the facilitator (EIP-712).\n            const nonce = params.nonce || generateNonce();\n            const signature = await signX402PaymentAuthorization(wallet, {\n                from: params.from, to: params.to, asset: params.asset, amount: params.amount,\n                maxFee, validBefore, nonce, chainId, facilitator,\n            });\n            const payload: PaymentPayload = {\n                x402Version: 2,\n                accepted: { ...acceptedBase, extra: { name: tokenName, version: tokenVersion, settlement: 'direct', maxFee: maxFee.toString() } },\n                payload: {\n                    signature,\n                    authorization: {\n                        from: params.from, to: params.to, value: params.amount.toString(),\n                        validAfter: '0', validBefore: validBefore.toString(), nonce,\n                    },\n                },\n            };\n            return { payload, encoded: encodePaymentPayload(payload), nonce };\n        }\n\n        // eip-3009 path (USDC) — ReceiveWithAuthorization, recipient = facilitator, recipient-bound nonce.\n        const salt = params.salt || generateNonce();\n        const derivedNonce = deriveEip3009Nonce(params.to, maxFee, salt);\n        const signature = await wallet.signTypedData({\n            account,\n            domain: getEIP3009Domain(tokenName, tokenVersion, chainId, params.asset),\n            types: EIP3009_TYPES,\n            primaryType: 'ReceiveWithAuthorization',\n            message: {\n                from: params.from, to: facilitator, value: params.amount,\n                validAfter, validBefore, nonce: derivedNonce,\n            },\n        });\n        const payload: PaymentPayload = {\n            x402Version: 2,\n            accepted: { ...acceptedBase, extra: { name: tokenName, version: tokenVersion, settlement: 'eip-3009', maxFee: maxFee.toString(), salt } },\n            payload: {\n                signature,\n                authorization: {\n                    from: params.from, to: facilitator, value: params.amount.toString(),\n                    validAfter: validAfter.toString(), validBefore: validBefore.toString(), nonce: derivedNonce,\n                },\n            },\n        };\n        return { payload, encoded: encodePaymentPayload(payload), nonce: derivedNonce };\n    }\n\n    /**\n     * Settle payment on-chain via SuperPaymaster (self-facilitated).\n     * Uses EIP-3009 transferWithAuthorization path.\n     */\n    async settleOnChain(params: {\n        from: Address; to: Address; asset: Address; amount: bigint;\n        validAfter: bigint; validBefore: bigint; nonce: Hex; signature: Hex;\n    }): Promise<Hex> {\n        return this.actions.settleX402Payment({\n            ...params,\n            account: this.config.walletClient.account!,\n        });\n    }\n\n    /**\n     * Settle payment on-chain via direct transfer (for xPNTs and pre-approved tokens).\n     */\n    async settleDirectOnChain(params: {\n        from: Address; to: Address; asset: Address; amount: bigint; nonce: Hex;\n    }): Promise<Hex> {\n        return this.actions.settleX402PaymentDirect({\n            ...params,\n            account: this.config.walletClient.account!,\n        });\n    }\n\n    /**\n     * Get facilitator fee quote from on-chain contract.\n     */\n    async getQuote(): Promise<{ feeBPS: bigint }> {\n        const feeBPS = await this.actions.facilitatorFeeBPS();\n        return { feeBPS };\n    }\n\n    /**\n     * Check if a nonce has been used.\n     */\n    async checkNonce(nonce: Hex): Promise<boolean> {\n        return this.actions.x402SettlementNonces({ nonce });\n    }\n\n    /**\n     * Merge the settlement `extra` (`settlement`/`maxFee`/`salt`) from the signed payload into the\n     * requirements the facilitator actually reads. In the `x402Fetch` path the server's 402 is a bare\n     * requirements object (no settlement fields), so the facilitator can't pick the path/fee/salt unless\n     * we carry them across from `payload.accepted.extra`. Defaults the whole requirements to\n     * `payload.accepted` when none is supplied.\n     */\n    private requirementsForFacilitator(payload: PaymentPayload, requirements?: PaymentRequirements): PaymentRequirements {\n        if (!requirements) return payload.accepted;\n        return { ...requirements, extra: { ...requirements.extra, ...payload.accepted.extra } };\n    }\n\n    /**\n     * Verify a payment via the external facilitator (`POST /x402/verify`). `requirements` defaults to\n     * the signed `payload.accepted` (which carries the settlement `extra`).\n     */\n    async verifyViaFacilitator(payload: PaymentPayload, requirements?: PaymentRequirements) {\n        if (!this.facilitatorClient) {\n            throw new Error('No facilitator configured. Pass facilitator config to X402Client constructor.');\n        }\n        return this.facilitatorClient.verify(payload, this.requirementsForFacilitator(payload, requirements));\n    }\n\n    /**\n     * Settle via external facilitator (`POST /x402/settle`). `requirements` defaults to the signed\n     * `payload.accepted`, so the settlement `extra` (settlement/maxFee/salt) always reaches the facilitator.\n     */\n    async settleViaFacilitator(payload: PaymentPayload, requirements?: PaymentRequirements): Promise<SettleResponse> {\n        if (!this.facilitatorClient) {\n            throw new Error('No facilitator configured. Pass facilitator config to X402Client constructor.');\n        }\n        return this.facilitatorClient.settle(payload, this.requirementsForFacilitator(payload, requirements));\n    }\n\n    /**\n     * x402-aware fetch wrapper.\n     * Automatically handles 402 → sign → retry flow per x402 v2 spec.\n     *\n     * Pattern from: @x402/fetch wrapFetchWithPayment\n     *\n     * Flow:\n     * 1. Make initial request\n     * 2. If 402, extract PaymentRequired from PAYMENT-REQUIRED header\n     * 3. Select best payment option (applies policy: max amount check)\n     * 4. Sign EIP-3009 authorization\n     * 5. Retry with PAYMENT-SIGNATURE header\n     */\n    async x402Fetch(url: string, init?: RequestInit): Promise<Response> {\n        const firstResponse = await fetch(url, init);\n\n        if (firstResponse.status !== 402) {\n            return firstResponse;\n        }\n\n        // Step 2: Extract payment requirements\n        // TODO: some server implementations put PaymentRequired in the response body instead of headers\n        const paymentRequired = extractPaymentRequired(firstResponse);\n        if (!paymentRequired || !paymentRequired.accepts?.length) {\n            throw new Error('402 response missing PAYMENT-REQUIRED header or empty accepts');\n        }\n\n        // Step 3: Select payment option (filter by network + policy)\n        const myNetwork = toNetworkId(this.config.chainId);\n        let selected = paymentRequired.accepts.find(\n            (a) => a.network === myNetwork && a.scheme === 'exact'\n        );\n        if (!selected) {\n            // Fallback: any EVM option\n            selected = paymentRequired.accepts.find((a) => a.network.startsWith('eip155:'));\n        }\n        if (!selected) {\n            throw new Error(`No compatible payment option for network ${myNetwork}`);\n        }\n\n        // Policy check: max amount\n        if (this.config.maxAmountPerRequest && BigInt(selected.amount) > this.config.maxAmountPerRequest) {\n            throw new Error(\n                `Payment amount ${selected.amount} exceeds max ${this.config.maxAmountPerRequest}`\n            );\n        }\n\n        const account = this.config.walletClient.account;\n        if (!account) {\n            throw new Error('WalletClient must have an account for automatic payment');\n        }\n\n        // Step 4: Sign\n        const { encoded } = await this.createPayment({\n            from: account.address,\n            to: selected.payTo,\n            asset: selected.asset as Address,\n            amount: BigInt(selected.amount),\n        });\n\n        // Step 5: Retry with payment signature\n        const retryHeaders = new Headers(init?.headers);\n        retryHeaders.set(HEADER_PAYMENT_SIGNATURE, encoded);\n\n        return fetch(url, { ...init, headers: retryHeaders });\n    }\n}\n","import type { FacilitatorConfig } from './types.js';\n\n/** HMAC-SHA256(secret, message) as lowercase hex, via Web Crypto (Node 18+ / browser). */\nexport async function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const enc = new TextEncoder();\n  const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n  const sig = await crypto.subtle.sign('HMAC', key, enc.encode(message));\n  return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Build a `FacilitatorConfig.createAuthHeaders` for the DVT facilitator's optional stateless-HMAC\n * gate (x402-facilitator spec §4). Only emits headers for `POST /x402/settle` (the only guarded\n * endpoint); other endpoints get no auth headers. Use ONLY when the target node runs with\n * `X402_AUTH_ENABLED=true` and shares `X402_AUTH_SECRET`:\n *\n *   X-X402-Timestamp: <unix epoch ms>\n *   X-X402-Auth:      hex HMAC-SHA256(secret, `${timestamp}.${rawBody}`)\n *\n * The node accepts iff `|now − timestamp| ≤ X402_AUTH_TTL_MS` and the HMAC matches over the raw body.\n *\n * @param secret  the shared `X402_AUTH_SECRET`.\n * @param opts.now injectable clock (ms) for tests; defaults to `Date.now`.\n */\nexport function createX402AuthHeaders(\n  secret: string,\n  opts?: { now?: () => number },\n): NonNullable<FacilitatorConfig['createAuthHeaders']> {\n  const now = opts?.now ?? (() => Date.now());\n  return async ({ endpoint, body }): Promise<Record<string, string>> => {\n    if (endpoint !== 'settle') return {}; // only /x402/settle is HMAC-gated\n    const timestamp = String(now());\n    const mac = await hmacSha256Hex(secret, `${timestamp}.${body}`);\n    return { 'X-X402-Timestamp': timestamp, 'X-X402-Auth': mac };\n  };\n}\n"]}