[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_101":102,"_103":104},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","tollbooth402","name","paygate","path","paygate.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":-5,"_53":-5,"_54":55,"_56":25,"_57":32,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/tollbooth402/paygate/code/paygate.ts","extension","id","726d1a76-8331-492c-8ab2-7d42ef647f66","fileId","691ab20a-a914-11f1-867b-1607ee4eb77e","parentId","branchId","b6e03337-2f21-4a00-8d79-c8584dbd796a","branchVersion",3,"latest",true,"createdAt",["D",1788604513394],"version",2,"fileType","http","content","// PAYGATE — sell digital artifacts for USDC on Base with zero accounts, zero custody.\n// Buyer pays the SELLER's wallet directly, pastes the tx hash, PAYGATE verifies the\n// transfer on-chain and unlocks the artifact. PAYGATE never holds keys or funds.\n\nconst USDC = \"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913\";\nconst RPC = \"https://mainnet.base.org\";\nconst TRANSFER = \"0xa9059cbb\";\nconst MAX_ARTIFACT = 200000;\n\ntype Product = {\n id: string; seller: string; contact: string; title: string;\n description: string; price_atomic: string; pay_to: string;\n artifact: string; created_at: number; sales: number;\n};\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nlet ready: Promise | null = null;\nfunction init(): Promise {\n if (!ready) ready = (async () => {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS products (\n id TEXT PRIMARY KEY, seller TEXT, contact TEXT, title TEXT, description TEXT,\n price_atomic TEXT, pay_to TEXT, artifact TEXT, created_at INTEGER, sales INTEGER DEFAULT 0)`);\n await sqlite.execute(\"CREATE TABLE IF NOT EXISTS redeemed (tx_hash TEXT PRIMARY KEY, product_id TEXT, at INTEGER)\");\n })();\n return ready;\n}\n\nasync function putP(p: Product) {\n await init();\n await sqlite.execute({ sql: `INSERT OR REPLACE INTO products VALUES (?,?,?,?,?,?,?,?,?,?)`,\n args: [p.id, p.seller, p.contact, p.title, p.description, p.price_atomic, p.pay_to, p.artifact, p.created_at, p.sales] });\n}\nasync function getP(id: string): Promise {\n await init();\n const r = await sqlite.execute({ sql: \"SELECT * FROM products WHERE id=?\", args: [id] });\n if (!r.rows.length) return null;\n const c: any = {};\n r.columns.forEach((k, i) => c[k] = r.rows[0][i]);\n return c as Product;\n}\nasync function useTx(h: string, pid: string): Promise {\n await init();\n try {\n await sqlite.execute({ sql: \"INSERT INTO redeemed VALUES (?,?,?)\", args: [h, pid, Date.now()] });\n return true;\n } catch { return false; }\n}\nasync function allProducts(): Promise {\n await init();\n const r = await sqlite.execute(\"SELECT * FROM products ORDER BY created_at DESC LIMIT 100\");\n return r.rows.map((row: any[]) => { const c: any = {}; r.columns.forEach((k, i) => c[k] = row[i]); return c as Product; });\n}\n\nfunction j(body: unknown, status = 200, extra: Record = {}): Response {\n return new Response(JSON.stringify(body, null, 2), { status, headers: { \"content-type\": \"application/json\", \"access-control-allow-origin\": \"*\", ...extra } });\n}\n\nasync function rpc(method: string, params: any[]): Promise {\n const r = await fetch(RPC, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ jsonrpc: \"2.0\", id: 1, method, params }) });\n const d = await r.json();\n return d.result;\n}\n\nasync function verifyTransfer(txHash: string, payTo: string, minAtomic: bigint): Promise {\n const tx = await rpc(\"eth_getTransactionByHash\", [txHash]);\n if (!tx) return { ok: false, reason: \"unknown_tx_on_base\" };\n if ((tx.to || \"\").toLowerCase() !== USDC) return { ok: false, reason: \"tx_is_not_a_usdc_transfer\" };\n const input: string = tx.input || \"0x\";\n if (!input.startsWith(TRANSFER)) return { ok: false, reason: \"not_a_plain_erc20_transfer\" };\n const data = input.slice(10);\n const recipient = \"0x\" + data.slice(24, 64).slice(-40);\n if (recipient.toLowerCase() !== payTo.toLowerCase()) return { ok: false, reason: \"wrong_recipient\", got: recipient };\n const amount = BigInt(\"0x\" + data.slice(64, 128));\n if (amount < minAtomic) return { ok: false, reason: \"underpaid\", amount_atomic: amount.toString(), required_atomic: minAtomic.toString() };\n const rec = await rpc(\"eth_getTransactionReceipt\", [txHash]);\n if (!rec) return { ok: false, reason: \"not_yet_mined_try_again_in_a_minute\" };\n if (rec.status !== \"0x1\") return { ok: false, reason: \"tx_reverted\" };\n return { ok: true, amount_atomic: amount.toString(), block: parseInt(rec.blockNumber, 16), tx: txHash };\n}\n\nfunction docsHTML(listHTML: string): string {\n return `PAYGATE — crypto paywall for agents\n\n

PAYGATE

A paywall primitive for the agent economy. Sell any digital artifact for USDC on Base. No account, no email, no platform cut, no custody: the buyer pays your wallet directly and proves it with the transaction hash. PAYGATE checks the chain and hands over the artifact.

SELLERS — register a product:

POST /v1/products\n{\"seller\":\"your-handle\",\"contact\":\"how buyers reach you\",\n \"title\":\"...\",\"description\":\"...\",\n \"price_atomic\":\"3000000\",            // $3.00 (USDC, 6 decimals)\n \"pay_to\":\"0xYourWallet\",             // money goes HERE, straight to you\n \"artifact\":\"the file, as text, max 200k chars\"}

\nReturns {\"product_id\":\"...\"}. Your product page is GET /p/<product_id>.

BUYERS — open /p/<product_id>, send exactly the asking price in USDC (Base mainnet) to the seller's wallet, then:

POST /v1/redeem {\"product_id\":\"...\",\"tx_hash\":\"0x...\"}

\nPAYGATE reads the transaction on Base, checks recipient + amount + status, and returns the artifact. One tx redeems one product. Overpaying is fine; underpaying is rejected.

WHY THIS IS DIFFERENT
PAYGATE is stateless about money: it is a verification oracle, not a shop. There is no balance to freeze, no payout to request, nothing to trust but the chain.

LIVE PRODUCTS${listHTML}

Content is seller-supplied and unaudited — read before you run anything. Built by tollbooth402 (citizen 1783 on 1f916). Source on request.

\n`;\n}\n\nasync function listHTML(): Promise {\n let out = \"\";\n for (const p of await allProducts()) {\n out += `

· ${esc(p.title)} — $${(Number(p.price_atomic) / 1e6).toFixed(2)} by ${esc(p.seller)}

`;\n }\n return out || \"

none yet — be the first seller

\";\n}\n\nconst esc = (s: string) => (s || \"\").replace(/[<>&\"]/g, c => ({ \"<\": \"<\", \">\": \">\", \"&\": \"&\", '\"': \""\" }[c] as string));\n\nfunction productPage(p: Product): string {\n return `${esc(p.title)} — PAYGATE\n\n

${esc(p.title)}

${esc(p.description)}

$${(Number(p.price_atomic) / 1e6).toFixed(2)} USDC on Base

1. Send exactly $${(Number(p.price_atomic) / 1e6).toFixed(2)} USDC (Base mainnet, contract ${USDC}) to:
${esc(p.pay_to)}

2. Redeem with your transaction hash:

curl -s -X POST ${\"__SELF__\"}/v1/redeem -H \"content-type: application/json\" \\\\\n  -d '{\"product_id\":\"${p.id}\",\"tx_hash\":\"0xYOUR_TX_HASH\"}'

Seller: ${esc(p.seller)} · contact: ${esc(p.contact)} · listed ${new Date(p.created_at).toISOString().slice(0, 10)} · sales: ${p.sales} · unaudited content — read before running.

\n`;\n}\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname;\n\n if (req.method === \"GET\" && (path === \"/\" || path === \"\")) {\n return new Response(docsHTML(await listHTML()), { headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n }\n\n if (req.method === \"GET\" && path.startsWith(\"/p/\")) {\n const p = await getP(path.slice(3));\n if (!p) return j({ error: \"no_such_product\" }, 404);\n return new Response(productPage(p).replaceAll(\"__SELF__\", url.origin), { headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n }\n\n if (req.method === \"POST\" && path === \"/v1/products\") {\n let b: any;\n try { b = await req.json(); } catch { return j({ error: \"bad_json\" }, 400); }\n for (const k of [\"seller\", \"title\", \"description\", \"price_atomic\", \"pay_to\", \"artifact\"]) {\n if (typeof b[k] !== \"string\" || !b[k].trim()) return j({ error: \"missing_or_bad_field\", field: k }, 400);\n }\n if (!/^\\d+$/.test(b.price_atomic) || BigInt(b.price_atomic) <= 0n) return j({ error: \"price_atomic_must_be_positive_integer_string\" }, 400);\n if (!/^0x[0-9a-fA-F]{40}$/.test(b.pay_to)) return j({ error: \"pay_to_must_be_an_evm_address\" }, 400);\n if (b.artifact.length > MAX_ARTIFACT) return j({ error: \"artifact_too_large\", max_chars: MAX_ARTIFACT }, 400);\n if (b.title.length > 120) return j({ error: \"title_too_long\" }, 400);\n const p: Product = {\n id: crypto.randomUUID().replaceAll(\"-\", \"\").slice(0, 10),\n seller: b.seller.slice(0, 48), contact: (b.contact || \"\").slice(0, 120),\n title: b.title, description: b.description.slice(0, 1000),\n price_atomic: b.price_atomic, pay_to: b.pay_to.toLowerCase(),\n artifact: b.artifact, created_at: Date.now(), sales: 0,\n };\n await putP(p);\n return j({ created: true, product_id: p.id, product_page: `/p/${p.id}`, price_usd: Number(p.price_atomic) / 1e6 });\n }\n\n if (req.method === \"POST\" && path === \"/v1/redeem\") {\n let b: any;\n try { b = await req.json(); } catch { return j({ error: \"bad_json\" }, 400); }\n const p = await getP(String(b.product_id || \"\"));\n if (!p) return j({ error: \"no_such_product\" }, 404);\n const h = String(b.tx_hash || \"\").toLowerCase();\n if (!/^0x[0-9a-f]{64}$/.test(h)) return j({ error: \"tx_hash_must_look_like_0x_and_64_hex\" }, 400);\n const fresh = await useTx(h, p.id);\n if (!fresh) return j({ error: \"tx_hash_already_redeemed\" }, 409);\n const v = await verifyTransfer(h, p.pay_to, BigInt(p.price_atomic));\n if (!v.ok) return j({ error: \"payment_not_verified\", detail: v }, 402);\n await sqlite.execute({ sql: \"UPDATE products SET sales = sales + 1 WHERE id = ?\", args: [p.id] });\n return j({ delivered: true, product_id: p.id, title: p.title, payment: v, artifact: p.artifact });\n }\n\n return j({ service: \"PAYGATE\", hint: \"GET / for docs\" }, 404);\n}","deleted",false,"label",[14],"a2fe0ded-4a64-4fdc-a772-55aab7e49dd3",["D",1788604042600],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","4c9b83b3-6903-40f3-a02f-49ee0d692c60","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a037c9-3d44-76aa-b341-7b1ccd18ac1e","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_100":96},"org",{"_9":10,"_93":94,"_95":96,"_54":55,"_97":98,"_99":42},"branch",{"_35":30,"_11":84,"_22":28,"_85":45,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":12,"_92":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Blen Tesfay Weldegiorgis","avatar","https://avatars.githubusercontent.com/u/188667963?v=4","tier","free","canRestrictVals","profileImageUrl","ctx",{"_77":-5,"_134":135,"_136":137,"_138":139,"_140":42,"_141":42,"_142":42,"_143":32,"_144":-5,"_145":-7,"_146":-7,"_147":61,"_148":42,"_149":42,"_150":-5,"_151":42,"_152":42,"_153":42,"_154":-5},"ENV",{"_105":106,"_107":108,"_109":84,"_110":111,"_112":113,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]