402mob-merchant-sdk 0.4.2 → 0.6.0

package/dist/index.js

@@ -4,6 +4,7 @@ function requireEip191Signature(signature) {
     }
     return signature;
 }
+const disputeConsent = "This signature authorizes only this statement or private read. It does not authorize payment, refund or adjudication. Response targets: seller 48 hours after opening; buyer 7 days after first response. Silence is not acceptance.";
 function buyerRequestKey(key) {
     if (!/^[A-Za-z0-9_-]{16,128}$/.test(key))
         throw new TypeError("Persist an idempotency key of 16–128 letters, digits, underscores or hyphens.");
@@ -249,6 +250,23 @@ export class MerchantClient {
         return this.request("POST", `/v1/agent/work-tickets/${checkedWorkTicketId(ticketId)}/results`, input, true);
     }
     /** Free public demand. Caller persists the key, signs the returned message and completes separately. */
+    createWorkRequestChallenge(input, idempotencyKey) { return this.request("POST", "/v1/work-requests/challenges", input, false, { "Idempotency-Key": idempotencyKey }); }
+    completeWorkRequest(input, idempotencyKey) { return this.request("POST", "/v1/work-requests", input, false, { "Idempotency-Key": idempotencyKey }); }
+    listWorkRequests(input = {}) {
+        const q = new URLSearchParams();
+        if (input.query !== undefined)
+            q.set("q", input.query);
+        if (input.limit !== undefined)
+            q.set("limit", String(input.limit));
+        if (input.cursor !== undefined)
+            q.set("cursor", String(input.cursor));
+        return this.request("GET", "/v1/work-requests?" + q);
+    }
+    getWorkRequest(id) { return this.request("GET", `/v1/work-requests/${encodeURIComponent(id)}`); }
+    proposeWorkRequest(id, input) { return this.request("POST", `/v1/agent/work-requests/${encodeURIComponent(id)}/proposals`, input, true); }
+    declineWorkRequest(id, input) { return this.request("POST", `/v1/agent/work-requests/${encodeURIComponent(id)}/declines`, input, true); }
+    createWorkRequestSelectionChallenge(id, input) { return this.request("POST", `/v1/work-requests/${encodeURIComponent(id)}/selection-challenges`, input); }
+    selectWorkRequestProposal(id, input) { return this.request("POST", `/v1/work-requests/${encodeURIComponent(id)}/selections`, input); }
     createBuyerRequestChallenge(input, idempotencyKey) {
         return this.request("POST", "/v1/buyer-requests/challenges", input, false, { "Idempotency-Key": buyerRequestKey(idempotencyKey) });
     }
@@ -274,6 +292,18 @@ export class MerchantClient {
     selectBuyerRequestOffer(requestId, input) {
         return this.request("POST", `/v1/buyer-requests/${checkedWorkTicketId(requestId)}/selections`, { ...input, signature: requireEip191Signature(input.signature) });
     }
+    /** Free, wallet-signed complaint/response/closure/read. No bearer key or payment is sent. */
+    createDeliveryDisputeChallenge(operationId, input) {
+        if (!isDisputeRequest(input))
+            throw new TypeError("Provide a participant wallet, supported action, current revision and bounded statement/evidence hashes.");
+        return this.request("POST", `/v1/operations/${checkedWorkTicketId(operationId)}/dispute-challenges`, input);
+    }
+    /** Retry the same signed write after interruption; private reads require a fresh challenge. */
+    submitDeliveryDisputeAction(operationId, input) {
+        if (!digest(input.challengeId) || !disputeToken(input.challengeToken))
+            throw new TypeError("Return the exact challengeId and challengeToken from the challenge response.");
+        return this.request("POST", `/v1/operations/${checkedWorkTicketId(operationId)}/dispute-actions`, { ...input, signature: requireEip191Signature(input.signature) });
+    }
     async request(method, path, body, authenticated = false, extraHeaders = {}) {
         if (authenticated && !this.#apiKey) {
             throw new Error("This request requires a merchant API key. Use client.withApiKey(apiKey).");
@@ -305,6 +335,17 @@ export class MerchantClient {
         const invalidResponse = () => new MerchantApiError(response.status, "invalid_response", "402Mob returned an incomplete response. The request may have completed; preserve recovery data. If enrollment or rotation completed without a usable key, use credential rotation.");
         if (!isRecord(payload))
             throw invalidResponse();
+        if (path.endsWith("/dispute-challenges")) {
+            const expected = path.replace(/dispute-challenges$/, "dispute-actions"), id = path.split("/")[3];
+            if (!digest(payload.challengeId) || !disputeToken(payload.challengeToken) || !nonempty(payload.message) || !timestamp(payload.expiresAt) || payload.submit !== expected || !isDisputeRequest(body))
+                throw invalidResponse();
+            const statement = { ...body, wallet: body.wallet.toLowerCase(), ...(body.action !== "read" ? { detail: body.detail.trim(), binding: { ...body.binding, payer: body.binding.payer.toLowerCase(), recipient: body.binding.recipient.toLowerCase(), asset: body.binding.asset.toLowerCase() } } : {}) };
+            const fields = disputeMessage(payload.message);
+            if (!fields || fields.origin !== new URL(this.baseUrl).origin || fields.operation !== id || fields.nonce !== payload.challengeId || fields.expires !== payload.expiresAt || stableJson(fields.statement) !== stableJson(statement) || stableJson(fields.binding) !== stableJson(body.action === "read" ? null : statement.binding))
+                throw invalidResponse();
+        }
+        if (path.endsWith("/dispute-actions") && !isDisputeResponse(payload, path.split("/")[3], body, new URL(this.baseUrl).origin))
+            throw invalidResponse();
         if (path.startsWith("/v1/worker-directory?")) {
             if (!Array.isArray(payload.items) || !payload.items.every(item => isWorkerProfileView(item) && item.workerProfile.discoverable && item.workerProfile.availability === "accepting") || !(payload.nextCursor === null || Number.isSafeInteger(payload.nextCursor) && Number(payload.nextCursor) >= 0))
                 throw invalidResponse();
@@ -322,6 +363,8 @@ export class MerchantClient {
             if (method === "PUT" && JSON.stringify(normalizedWorkerProfile(payload.workerProfile)) !== JSON.stringify(body))
                 throw invalidResponse();
         }
+        if ((path.startsWith("/v1/work-requests") || path.startsWith("/v1/agent/work-requests/")) && !isFreshWorkResponse(method, path, payload, body))
+            throw invalidResponse();
         if ((path.startsWith("/v1/buyer-requests") || path.startsWith("/v1/agent/buyer-requests/")) && !isBuyerRequestResponse(method, path, payload, body))
             throw invalidResponse();
         if (path === "/v1/merchants/enrollment-challenges" || path === "/v1/merchants/credential-challenges") {
@@ -479,3 +522,199 @@ function checkedWorkTicketId(id) {
     }
     return id;
 }
+function isDisputeRequest(v) {
+    if (!isRecord(v) || !address(v.wallet))
+        return false;
+    if (v.action === "read")
+        return onlyKeys(v, ["wallet", "action"]);
+    if (!["open", "respond", "close"].includes(String(v.action)) || !Number.isInteger(v.expectedRevision) || Number(v.expectedRevision) < 0 || Number(v.expectedRevision) > 32 || !boundedWorkerText(v.detail, 2000) || !isRecord(v.binding) || !validMessageBinding(v.binding) || !Array.isArray(v.evidenceHashes) || v.evidenceHashes.length > 8 || !v.evidenceHashes.every(digest))
+        return false;
+    const common = ["wallet", "action", "expectedRevision", "binding", "detail", "evidenceHashes"];
+    if (v.action === "open")
+        return v.expectedRevision === 0 && ["not_delivered", "unreadable", "terms_mismatch"].includes(String(v.reason)) && onlyKeys(v, [...common, "reason"]);
+    if (v.action === "close")
+        return ["resolved", "unresolved"].includes(String(v.outcome)) && onlyKeys(v, [...common, "outcome"]);
+    return onlyKeys(v, common);
+}
+function disputeToken(v) { return typeof v === "string" && /^[A-Za-z0-9_-]{40,40000}$/.test(v); }
+function stableJson(v) {
+    if (Array.isArray(v))
+        return `[${v.map(stableJson).join(",")}]`;
+    if (isRecord(v))
+        return `{${Object.keys(v).sort().map(k => JSON.stringify(k) + ":" + stableJson(v[k])).join(",")}}`;
+    return JSON.stringify(v);
+}
+function disputeMessage(v) {
+    if (typeof v !== "string")
+        return;
+    const lines = v.split("\n");
+    if (lines.length !== 8 || lines[7] !== disputeConsent || lines[0] !== "402Mob delivery dispute authorization" || !lines[1]?.startsWith("Origin: ") || !lines[2]?.startsWith("Operation: ") || !lines[3]?.startsWith("Statement: ") || !lines[4]?.startsWith("Binding: ") || !lines[5]?.startsWith("Nonce: ") || !lines[6]?.startsWith("Expires: "))
+        return;
+    try {
+        const binding = JSON.parse(lines[4].slice(9));
+        if (binding !== null && !isRecord(binding))
+            return;
+        return { origin: lines[1].slice(8), operation: lines[2].slice(11), nonce: lines[5].slice(7), expires: lines[6].slice(9), statement: JSON.parse(lines[3].slice(11)), binding };
+    }
+    catch {
+        return;
+    }
+}
+function validDisputeBinding(b) {
+    return isRecord(b) && onlyKeys(b, ["requestHash", "workTicketId", "quoteTermsHash", "resultHashAtOpen", "transaction", "amountAtomic", "asset", "network"]) && digest(b.requestHash) &&
+        ((b.workTicketId === null && b.quoteTermsHash === null) || (uuid(b.workTicketId) && digest(b.quoteTermsHash))) && (b.resultHashAtOpen === null || digest(b.resultHashAtOpen)) &&
+        (b.transaction === null || typeof b.transaction === "string" && /^0x[0-9a-fA-F]{64}$/.test(b.transaction)) && atomicAmount(b.amountAtomic) && address(b.asset) && b.asset.toLowerCase() === baseUsdc && b.network === "eip155:8453";
+}
+function validMessageBinding(b) {
+    const { payer, recipient, ...rest } = b;
+    return address(payer) && address(recipient) && validDisputeBinding(rest);
+}
+function isDisputeResponse(v, operationId, proof, origin) {
+    if (v.protocol !== "402mob.delivery-dispute.v1" || v.operationId !== operationId || !isRecord(proof) || typeof v.replay !== "boolean")
+        return false;
+    if (v.kind === "acknowledgment") {
+        const r = v.receipt;
+        return onlyKeys(v, ["protocol", "kind", "operationId", "receipt", "replay"]) && isRecord(r) && onlyKeys(r, ["challengeId", "action", "revision", "createdAt"]) && r.challengeId === proof.challengeId && ["open", "respond", "close"].includes(String(r.action)) && Number.isInteger(r.revision) && Number(r.revision) >= 1 && Number(r.revision) <= 32 && timestamp(r.createdAt);
+    }
+    if (v.kind !== "evidence" || v.replay !== false || !onlyKeys(v, ["protocol", "kind", "operationId", "operationState", "binding", "dispute", "payment", "delivery", "responseOverdue", "buyerReviewOverdue", "scope", "replay"]) || !["executing", "staged", "settling", "pending", "settled", "failed", "expired"].includes(String(v.operationState)) || !isRecord(v.payment) || !onlyKeys(v.payment, ["state", "transaction"]) || !["settled", "pending", "failed", "unconfirmed"].includes(String(v.payment.state)) || !(v.payment.transaction === null || typeof v.payment.transaction === "string" && /^0x[0-9a-fA-F]{64}$/.test(v.payment.transaction)) || !isRecord(v.delivery) || !onlyKeys(v.delivery, ["resultHash", "resultAvailable"]) || typeof v.delivery.resultAvailable !== "boolean" || !(v.delivery.resultHash === null || digest(v.delivery.resultHash)) || typeof v.responseOverdue !== "boolean" || typeof v.buyerReviewOverdue !== "boolean" || !nonempty(v.scope))
+        return false;
+    if (!isRecord(v.binding) || !validMessageBinding(v.binding) || v.binding.transaction !== v.payment.transaction || v.binding.resultHashAtOpen !== v.delivery.resultHash)
+        return false;
+    if (v.payment.state === "settled" && v.payment.transaction === null)
+        return false;
+    const expectedPayment = { executing: "unconfirmed", staged: "unconfirmed", settling: "pending", pending: "pending", settled: "settled", failed: "failed" };
+    if (v.operationState !== "expired" && v.payment.state !== expectedPayment[String(v.operationState)])
+        return false;
+    if (v.operationState === "expired" && !["settled", "unconfirmed"].includes(String(v.payment.state)))
+        return false;
+    if (v.delivery.resultAvailable && (v.delivery.resultHash === null || v.payment.state !== "settled"))
+        return false;
+    if (v.binding.workTicketId === null && v.delivery.resultAvailable && v.operationState !== "settled")
+        return false;
+    if (v.dispute === null)
+        return !v.responseOverdue && !v.buyerReviewOverdue;
+    const d = v.dispute;
+    if (!isRecord(d) || d.operationId !== operationId || !address(d.buyer) || !address(d.seller) || !["open", "responded", "closed"].includes(String(d.status)) || !(d.outcome === null || ["resolved", "unresolved"].includes(String(d.outcome))) || !Number.isInteger(d.revision) || Number(d.revision) < 1 || Number(d.revision) > 32 || !timestamp(d.openedAt) || !timestamp(d.expiresAt) || !timestamp(d.responseDueAt) || !(d.buyerReviewDueAt === null || timestamp(d.buyerReviewDueAt)) || !validDisputeBinding(d.binding) || !Array.isArray(d.events) || d.events.length !== d.revision || v.payment.state !== "settled" || d.binding.transaction !== v.payment.transaction)
+        return false;
+    const currentBinding = v.binding, caseBinding = d.binding;
+    const immutable = ["requestHash", "workTicketId", "quoteTermsHash", "transaction", "amountAtomic", "asset", "network"];
+    if (v.binding.payer !== d.buyer || v.binding.recipient !== d.seller || immutable.some(k => currentBinding[k] !== caseBinding[k]))
+        return false;
+    if (Date.parse(d.expiresAt) !== Date.parse(d.openedAt) + 2592000000 || Date.parse(d.responseDueAt) !== Date.parse(d.openedAt) + 172800000)
+        return false;
+    let closed, firstResponse, lastTime = Date.parse(d.openedAt);
+    const seen = new Set();
+    for (let i = 0; i < d.events.length; i++) {
+        const e = d.events[i];
+        if (!isRecord(e) || e.revision !== i + 1 || !address(e.wallet) || !timestamp(e.createdAt) || !isDisputeRequest(e.statement) || e.statement.action === "read" || e.statement.action !== e.action || e.statement.expectedRevision !== i || e.wallet.toLowerCase() !== e.statement.wallet.toLowerCase() || typeof e.signature !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(e.signature) || !digest(e.challengeId) || seen.has(e.challengeId))
+            return false;
+        seen.add(e.challengeId);
+        const at = Date.parse(e.createdAt);
+        if (at < lastTime || at >= Date.parse(d.expiresAt))
+            return false;
+        lastTime = at;
+        const m = disputeMessage(e.message);
+        if (!m || m.origin !== origin || m.operation !== operationId || m.nonce !== e.challengeId || !timestamp(m.expires) || !isRecord(m.binding) || !validMessageBinding(m.binding) || m.binding.payer !== d.buyer || m.binding.recipient !== d.seller || m.binding.requestHash !== d.binding.requestHash || m.binding.quoteTermsHash !== d.binding.quoteTermsHash || immutable.some(k => m.binding[k] !== caseBinding[k]) || stableJson(m.binding) !== stableJson(e.statement.binding) || stableJson(m.statement) !== stableJson(e.statement))
+            return false;
+        if (i === 0) {
+            const { payer: _payer, recipient: _recipient, ...binding } = m.binding;
+            if (e.action !== "open" || e.wallet.toLowerCase() !== d.buyer.toLowerCase() || e.createdAt !== d.openedAt || stableJson(binding) !== stableJson(d.binding))
+                return false;
+        }
+        else if (e.action === "respond") {
+            if (e.wallet.toLowerCase() !== d.seller.toLowerCase())
+                return false;
+            if (!closed)
+                firstResponse ??= e;
+        }
+        else if (e.action === "close") {
+            if (closed || e.wallet.toLowerCase() !== d.buyer.toLowerCase())
+                return false;
+            closed = e;
+        }
+        else
+            return false;
+    }
+    if (d.status !== (closed ? "closed" : firstResponse ? "responded" : "open"))
+        return false;
+    if (d.outcome !== (closed ? closed.statement.outcome : null))
+        return false;
+    if (d.buyerReviewDueAt !== (firstResponse ? new Date(Date.parse(firstResponse.createdAt) + 604800000).toISOString() : null))
+        return false;
+    if ((d.status !== "open" && v.responseOverdue) || (d.status !== "responded" && v.buyerReviewOverdue))
+        return false;
+    return true;
+}
+export { ProtectedWorkClient, ProtectedWorkApiError } from "./protected-work.js";
+function isFreshRequest(v) {
+    if (!isRecord(v) || Object.hasOwn(v, "buyer"))
+        return false;
+    return uuid(v.id) && v.kind === "fresh" && publicText(v.title, 100) && publicText(v.description, 2000) && usdcAtomic(v.maxPriceUSDC) !== undefined && Number(usdcAtomic(v.maxPriceUSDC)) > 0 && artifactType(v.contentType) && Array.isArray(v.acceptanceCriteria) && v.acceptanceCriteria.length >= 1 && v.acceptanceCriteria.length <= 10 && v.acceptanceCriteria.every(x => publicText(x, 300)) && Number.isInteger(v.expiresInSeconds) && Number(v.expiresInSeconds) >= 60 && Number(v.expiresInSeconds) <= 86400 && timestamp(v.createdAt) && timestamp(v.expiresAt) && ["open", "selected", "expired"].includes(String(v.state)) && (v.state === "selected" ? uuid(v.selectedProposalId) : v.selectedProposalId === null);
+}
+function isInspectionPlan(v) {
+    if (!isRecord(v) || !freshExactKeys(v, ["version", "targetUrl", "method", "paymentRecipient", "maxTestAmountAtomic", "maxPaidAttempts"]) || v.version !== "buyer-probe-v1" || v.method !== "GET" || !address(v.paymentRecipient) || v.maxPaidAttempts !== 1 || typeof v.maxTestAmountAtomic !== "string" || !/^(?:0|[1-9][0-9]{0,5}|1000000)$/.test(v.maxTestAmountAtomic) || typeof v.targetUrl !== "string" || v.targetUrl.length > 2048)
+        return false;
+    try {
+        const u = new URL(v.targetUrl);
+        return u.protocol === "https:" && !u.username && !u.password && !u.hash && (!u.port || u.port === "443") && u.href === v.targetUrl;
+    }
+    catch {
+        return false;
+    }
+}
+function sameInspectionPlan(a, b) { return isInspectionPlan(a) && isInspectionPlan(b) && Object.entries(a).every(([key, value]) => value === b[key]); }
+function isFreshProposal(v) {
+    if (!isRecord(v) || !uuid(v.id) || !uuid(v.requestId) || !uuid(v.merchantId) || !address(v.payoutAddress) || !digest(v.termsHash) || !timestamp(v.createdAt) || !isRecord(v.terms) || !publicText(v.terms.note, 300))
+        return false;
+    const t = v.terms;
+    if (v.kind === "decline")
+        return ["endpoint_unavailable", "unsupported_payment", "scope_unsupported", "capacity_unavailable", "other"].includes(String(t.reason));
+    return v.kind === "proposal" && typeof t.capability === "string" && /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(t.capability) && publicText(t.deliverable, 300) && usdcAtomic(t.priceUSDC) !== undefined && Number(usdcAtomic(t.priceUSDC)) > 0 && timestamp(t.deliveryDeadline) && usdcAtomic(t.testPurchaseBudgetUSDC) !== undefined && (t.settlementMode === "protected_inspection" ? t.testPurchasePayer === "buyer" && isInspectionPlan(t.inspection) && t.inspection.maxTestAmountAtomic === usdcAtomic(t.testPurchaseBudgetUSDC) : t.settlementMode === undefined && t.inspection === undefined && t.testPurchasePayer === "seller");
+}
+function freshExactKeys(value, keys) {
+    return Object.keys(value).length === keys.length && keys.every(k => Object.hasOwn(value, k));
+}
+function isFreshDetail(v, id) {
+    if (!isRecord(v) || !isFreshRequest(v.request) || id && v.request.id !== id || !Array.isArray(v.responses) || v.responses.length > 20 || !v.responses.every(isFreshProposal))
+        return false;
+    const r = v.request, responses = v.responses;
+    if (new Set(responses.map(p => p.merchantId)).size !== responses.length || new Set(responses.map(p => p.id)).size !== responses.length || responses.some(p => p.requestId !== r.id || p.kind === "proposal" && BigInt(usdcAtomic(p.terms.priceUSDC)) > BigInt(usdcAtomic(r.maxPriceUSDC))))
+        return false;
+    if (r.state !== "selected")
+        return v.workTicketHandoff === null && v.protectedWorkHandoff === null;
+    const p = responses.find(p => p.id === r.selectedProposalId), h = v.workTicketHandoff;
+    if (p?.kind === "proposal" && p.terms.settlementMode === "protected_inspection") {
+        const x = v.protectedWorkHandoff;
+        if (h !== null || !isRecord(x) || x.kind !== "protected_inspection" || x.path !== "/v1/protected-inspections/prepare" || !isRecord(x.task))
+            return false;
+        return r.contentType === "application/json" && x.seller === p.payoutAddress && x.amountAtomic === usdcAtomic(p.terms.priceUSDC) && x.deliveryDeadline === Math.floor(Date.parse(p.terms.deliveryDeadline) / 1000) && x.fundingRequired === true && x.buyerProbeRequired === true && x.paymentAuthorized === false && x.task.version === "funded-inspection-v1" && x.task.requestId === r.id && x.task.proposalId === p.id && x.task.proposalTermsHash === p.termsHash && sameInspectionPlan(x.task.plan, p.terms.inspection) && freshExactKeys(x, ["kind", "path", "task", "seller", "amountAtomic", "deliveryDeadline", "fundingRequired", "buyerProbeRequired", "paymentAuthorized"]) && freshExactKeys(x.task, ["version", "requestId", "proposalId", "proposalTermsHash", "plan"]);
+    }
+    if (v.protectedWorkHandoff !== null)
+        return false;
+    if (!p || p.kind !== "proposal" || !isRecord(h) || h.kind !== "work_ticket_grant" || h.method !== "POST" || h.path !== "/v1/work-tickets/challenges" || h.buyerWalletRequired !== true || h.grantSignatureRequired !== true || h.paymentAuthorized !== false || h.quoteAcceptanceRequired !== true || h.tracksTicketCreation !== false || !isRecord(h.body) || !isRecord(h.body.input))
+        return false;
+    const b = h.body, i = b.input;
+    if (!freshExactKeys(h, ["kind", "method", "path", "body", "buyerWalletRequired", "grantSignatureRequired", "paymentAuthorized", "quoteAcceptanceRequired", "tracksTicketCreation"]) || !freshExactKeys(b, ["merchantId", "capability", "input", "maxPriceUSDC", "expiresInSeconds"]) || !freshExactKeys(i, ["workRequestId", "proposalId", "proposalTermsHash", "title", "scope", "contentType", "acceptanceCriteria", "payoutAddress", "deliverable", "proposalNote", "deliveryDeadline", "testPurchaseBudgetUSDC", "testPurchasePayer"]))
+        return false;
+    return i.title === r.title && i.contentType === r.contentType && i.payoutAddress === p.payoutAddress && i.proposalNote === p.terms.note && b.merchantId === p.merchantId && b.capability === p.terms.capability && b.maxPriceUSDC === p.terms.priceUSDC && b.expiresInSeconds === 3600 && !Object.hasOwn(b, "buyer") && i.workRequestId === r.id && i.proposalId === p.id && i.proposalTermsHash === p.termsHash && i.scope === r.description && JSON.stringify(i.acceptanceCriteria) === JSON.stringify(r.acceptanceCriteria) && i.deliverable === p.terms.deliverable && i.deliveryDeadline === p.terms.deliveryDeadline && i.testPurchaseBudgetUSDC === p.terms.testPurchaseBudgetUSDC && i.testPurchasePayer === "seller";
+}
+function isFreshWorkResponse(method, path, v, body) {
+    const args = isRecord(body) ? body : {}, id = path.match(/^\/v1\/(?:agent\/)?work-requests\/([^/?]+)/)?.[1];
+    const challenge = () => uuid(v.challengeId) && nonempty(v.message) && timestamp(v.expiresAt);
+    if (path === "/v1/work-requests/challenges")
+        return challenge() && timestamp(v.requestExpiresAt) && digest(v.policyHash) && Date.parse(String(v.expiresAt)) <= Date.parse(String(v.requestExpiresAt));
+    if (path === "/v1/work-requests" && method === "POST")
+        return isFreshDetail(v) && typeof v.replay === "boolean" && v.request.title === String(args.title).trim() && v.request.description === String(args.description).trim() && v.request.contentType === args.contentType && v.request.expiresInSeconds === args.expiresInSeconds && usdcAtomic(v.request.maxPriceUSDC) === usdcAtomic(args.maxPriceUSDC) && JSON.stringify(v.request.acceptanceCriteria) === JSON.stringify(args.acceptanceCriteria?.map(x => typeof x === 'string' ? x.trim() : x));
+    if (path.startsWith("/v1/work-requests?") || path === "/v1/work-requests" && method === "GET")
+        return Array.isArray(v.items) && v.items.length <= 50 && v.items.every(isFreshRequest) && (v.nextCursor === null || Number.isSafeInteger(v.nextCursor) && Number(v.nextCursor) >= 0);
+    if (path.endsWith("/selection-challenges"))
+        return challenge() && isFreshProposal(v.proposal) && v.proposal.kind === "proposal" && v.proposal.requestId === id && v.proposal.id === args.proposalId;
+    if (path.endsWith("/proposals") || path.endsWith("/declines")) {
+        if (!isFreshProposal(v.response) || v.response.requestId !== id || v.response.kind !== (path.endsWith("/proposals") ? "proposal" : "decline") || typeof v.replay !== "boolean")
+            return false;
+        const terms = v.response.terms;
+        return Object.entries(args).every(([k, x]) => k === "inspection" ? sameInspectionPlan(terms[k], x) : ["priceUSDC", "testPurchaseBudgetUSDC"].includes(k) ? usdcAtomic(terms[k]) === usdcAtomic(x) : JSON.stringify(terms[k]) === JSON.stringify(typeof x === 'string' ? x.trim() : x));
+    }
+    return isFreshDetail(v, id) && (method === "GET" || v.request.state === "selected" && typeof v.replay === "boolean");
+}
+export { ProtectedInspectionClient, ProtectedInspectionApiError } from "./protected-inspection.js";

package/dist/protected-inspection-schemas.d.ts

@@ -0,0 +1,2 @@
+export declare const inspectionSchemaHash = "8ce432ff8bb61355db7c2d01e7a5048ec20ed0688087df7094134788a81c81e7";
+export declare const inspectionSchemas: Record<string, unknown>;