@1claw/sdk 0.2.1 → 0.6.1

package/README.md

@@ -32,6 +32,8 @@ const secret = await client.secrets.get("vault-id", "OPENAI_KEY");
 console.log(secret.data?.value);
 ```
 
+**API contract:** This SDK is built from the **OpenAPI 3.1** spec. The canonical spec is published as [@1claw/openapi-spec](https://www.npmjs.com/package/@1claw/openapi-spec) (YAML/JSON). Types are generated from it; the SDK stays in sync with the API. For a full endpoint list, see the [API reference](https://docs.1claw.xyz/docs/reference/api-reference) or the spec.
+
 ## Authentication
 
 The SDK supports three authentication modes:
@@ -69,14 +71,14 @@ await client.auth.google({ id_token: "..." });
 | `client.vault`     | `create`, `get`, `list`, `delete`                                                                                   |
 | `client.secrets`   | `set`, `get`, `delete`, `list`, `rotate`                                                                            |
 | `client.access`    | `grantHuman`, `grantAgent`, `update`, `revoke`, `listGrants`                                                        |
-| `client.agents`    | `create`, `get`, `list`, `update`, `delete`, `rotateKey`, `submitTransaction`, `getTransaction`, `listTransactions` |
+| `client.agents`    | `create`, `getSelf`, `get`, `list`, `update`, `delete`, `rotateKey`, `submitTransaction`, `getTransaction`, `listTransactions`, `simulateTransaction`, `simulateBundle` |
 | `client.chains`    | `list`, `get`, `adminList`, `create`, `update`, `delete`                                                            |
 | `client.sharing`   | `create`, `access`, `listOutbound`, `listInbound`, `accept`, `decline`, `revoke`                                    |
 | `client.approvals` | `request`, `list`, `approve`, `deny`, `check`, `subscribe`                                                          |
 | `client.billing`   | `usage`, `history`                                                                                                  |
 | `client.audit`     | `query`                                                                                                             |
 | `client.org`       | `listMembers`, `updateMemberRole`, `removeMember`                                                                   |
-| `client.auth`      | `login`, `agentToken`, `apiKeyToken`, `google`, `changePassword`, `logout`                                          |
+| `client.auth`      | `login`, `signup`, `agentToken`, `apiKeyToken`, `google`, `changePassword`, `logout`, `getMe`, `updateMe`, `deleteMe` |
 | `client.apiKeys`   | `create`, `list`, `revoke`                                                                                          |
 | `client.x402`      | `getPaymentRequirement`, `pay`, `verifyReceipt`, `withPayment`                                                      |
 
@@ -112,6 +114,7 @@ The SDK exports a typed error hierarchy for catch-based flows:
 | `OneclawError`          | any         | Base error class                                      |
 | `AuthError`             | 401, 403    | Authentication/authorization failure                  |
 | `PaymentRequiredError`  | 402         | x402 payment required (includes `paymentRequirement`) |
+| `ResourceLimitExceededError` | 403    | Tier limit reached (vaults, agents, secrets)          |
 | `ApprovalRequiredError` | 403         | Human approval gate triggered                         |
 | `NotFoundError`         | 404         | Resource not found                                    |
 | `RateLimitError`        | 429         | Rate limit exceeded                                   |
@@ -125,13 +128,30 @@ Agents can be granted the ability to sign and broadcast on-chain transactions th
 Toggle `crypto_proxy_enabled` when creating or updating an agent:
 
 ```typescript
-// Register an agent with crypto proxy access
+// Register an API key agent with crypto proxy access (default auth_method)
 const { data } = await client.agents.create({
     name: "defi-bot",
-    auth_method: "api_key",
+    auth_method: "api_key", // "api_key" | "mtls" | "oidc_client_credentials"
     scopes: ["vault:read", "tx:sign"],
     crypto_proxy_enabled: true,
 });
+// data.api_key is only returned for auth_method: "api_key"
+// All agents automatically receive an Ed25519 SSH keypair (data.agent.ssh_public_key)
+
+// Register an mTLS agent (no API key returned)
+const { data: mtlsAgent } = await client.agents.create({
+    name: "mtls-bot",
+    auth_method: "mtls",
+    client_cert_fingerprint: "sha256-fingerprint-hex",
+});
+
+// Register an OIDC agent (no API key returned)
+const { data: oidcAgent } = await client.agents.create({
+    name: "oidc-bot",
+    auth_method: "oidc_client_credentials",
+    oidc_issuer: "https://accounts.google.com",
+    oidc_client_id: "your-client-id",
+});
 
 // Or enable it later
 await client.agents.update(agentId, {
@@ -162,13 +182,69 @@ console.log(txRes.data?.signed_tx); // signed raw transaction hex
 
 The backend fetches the signing key from the vault, signs the EIP-155 transaction, and returns the signed transaction hex. The signing key is decrypted in-memory, used, and immediately zeroized — it never leaves the server.
 
+The SDK automatically generates an `Idempotency-Key` header (UUID v4) on each `submitTransaction` call, providing replay protection. Duplicate requests within 24 hours return the cached response instead of re-signing.
+
 Key properties:
 
 - **Disabled by default** — a human must explicitly enable per-agent
 - **Signing keys never leave the HSM** — same envelope encryption as secrets
+- **Idempotent by default** — each submission includes an auto-generated `Idempotency-Key` header
 - **Every transaction is audit-logged** with full calldata
 - **Revocable instantly** — set `crypto_proxy_enabled: false` to cut off access
 
+## Customer-Managed Encryption Keys (CMEK)
+
+For enterprises that require cryptographic proof that 1claw cannot access their secrets unilaterally, the SDK provides client-side CMEK utilities. Keys are generated and managed entirely on your side — only the SHA-256 fingerprint is stored on the server.
+
+```typescript
+import { cmek } from "@1claw/sdk";
+
+// Generate a 256-bit AES key (returns CryptoKey)
+const key = await cmek.generateCmekKey();
+
+// Compute fingerprint (SHA-256 hex)
+const fingerprint = await cmek.cmekFingerprint(key);
+
+// Enable CMEK on a vault
+await client.vault.enableCmek(vaultId, { fingerprint });
+
+// Encrypt a secret value before storing
+const encrypted = await cmek.cmekEncrypt(key, "my-secret-value");
+await client.secrets.set(vaultId, "path/to/secret", encrypted);
+
+// Decrypt after retrieving
+const res = await client.secrets.get(vaultId, "path/to/secret");
+const plaintext = await cmek.cmekDecrypt(key, res.data.value);
+```
+
+### Server-assisted key rotation
+
+```typescript
+await client.vault.rotateCmek(vaultId, oldKey, newKey, {
+    new_fingerprint: await cmek.cmekFingerprint(newKey),
+});
+```
+
+The server re-encrypts all secrets in batches of 100. Poll rotation status:
+
+```typescript
+const job = await client.vault.getRotationJobStatus(vaultId, jobId);
+console.log(job.data?.status, job.data?.processed, "/", job.data?.total_secrets);
+```
+
+## Agent Token Auto-Refresh
+
+When using agent credentials (`agentId` + `apiKey`), the SDK automatically refreshes tokens 60 seconds before expiry. No manual token management needed:
+
+```typescript
+const client = createClient({
+    baseUrl: "https://api.1claw.xyz",
+    apiKey: "ocv_...",
+    agentId: "agent-uuid",
+});
+// Tokens refresh transparently — just make API calls
+```
+
 ## x402 Payment Protocol
 
 When free-tier limits are exceeded, the API returns `402 Payment Required`. The SDK can automatically handle payments if you provide a signer:
@@ -195,6 +271,47 @@ const client = createClient({
 const secret = await client.x402.withPayment("vault-id", "key", signer);
 ```
 
+## Plugins
+
+The SDK supports optional plugin interfaces for extending behavior without modifying the core:
+
+```typescript
+import { createClient } from "@1claw/sdk";
+import type { CryptoProvider, AuditSink, PolicyEngine } from "@1claw/sdk";
+
+const client = createClient({
+    baseUrl: "https://api.1claw.xyz",
+    apiKey: "ocv_...",
+    plugins: {
+        cryptoProvider: myAwsKmsProvider,
+        auditSink: mySplunkSink,
+        policyEngine: myOpaEngine,
+    },
+});
+```
+
+| Interface        | Purpose                                                      | Default behavior              |
+| ---------------- | ------------------------------------------------------------ | ----------------------------- |
+| `CryptoProvider` | Client-side encryption (encrypt, decrypt, generateKey)       | Server-side HSM (no-op)       |
+| `AuditSink`      | Forward SDK events to external systems (Splunk, Datadog)     | No-op (server handles audit)  |
+| `PolicyEngine`   | Pre-evaluate policies locally before API calls               | No-op (server enforces)       |
+
+Implement any interface in your own package — no PRs to the SDK needed.
+
+## OpenAPI Types
+
+The SDK's request types are generated from the **OpenAPI 3.1** spec, published as [@1claw/openapi-spec](https://www.npmjs.com/package/@1claw/openapi-spec). Advanced users can access the raw generated types:
+
+```typescript
+import type { paths, components, operations, ApiSchemas } from "@1claw/sdk";
+
+// Access any schema from the spec
+type Vault = ApiSchemas["VaultResponse"];
+type Agent = ApiSchemas["AgentResponse"];
+```
+
+Regenerate types after spec changes: `npm run generate`
+
 ## MCP Integration (AI Agents)
 
 The SDK exposes MCP-compatible tool definitions for AI agents:

package/dist/__tests__/client.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=client.test.d.ts.map

package/dist/__tests__/client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/client.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/client.test.js

@@ -0,0 +1,99 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { OneclawClient, createClient } from "../core/client";
+const originalFetch = globalThis.fetch;
+afterEach(() => {
+    globalThis.fetch = originalFetch;
+});
+function mockFetch(status, body) {
+    return vi.fn().mockResolvedValue({
+        ok: status >= 200 && status < 300,
+        status,
+        headers: new Headers(),
+        json: () => Promise.resolve(body),
+    });
+}
+describe("OneclawClient", () => {
+    it("initializes all 14 resource properties", () => {
+        globalThis.fetch = mockFetch(200, {});
+        const client = new OneclawClient({ baseUrl: "https://api.test", token: "t" });
+        expect(client.vault).toBeDefined();
+        expect(client.secrets).toBeDefined();
+        expect(client.access).toBeDefined();
+        expect(client.agents).toBeDefined();
+        expect(client.sharing).toBeDefined();
+        expect(client.approvals).toBeDefined();
+        expect(client.billing).toBeDefined();
+        expect(client.audit).toBeDefined();
+        expect(client.org).toBeDefined();
+        expect(client.auth).toBeDefined();
+        expect(client.apiKeys).toBeDefined();
+        expect(client.chains).toBeDefined();
+        expect(client.x402).toBeDefined();
+    });
+    it("auto-authenticates with agent apiKey + agentId on first request", async () => {
+        const fetcher = vi.fn()
+            .mockResolvedValueOnce({
+            ok: true,
+            status: 200,
+            headers: new Headers(),
+            json: () => Promise.resolve({ access_token: "agent-jwt" }),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            status: 200,
+            headers: new Headers(),
+            json: () => Promise.resolve({ vaults: [] }),
+        });
+        globalThis.fetch = fetcher;
+        const client = new OneclawClient({
+            baseUrl: "https://api.test",
+            apiKey: "ocv_abc",
+            agentId: "agent-uuid",
+        });
+        // Agent auth is lazy — fires on first request, not constructor
+        await client.vault.list();
+        const [url, init] = fetcher.mock.calls[0];
+        expect(url).toContain("/v1/auth/agent-token");
+        const body = JSON.parse(init.body);
+        expect(body.agent_id).toBe("agent-uuid");
+        expect(body.api_key).toBe("ocv_abc");
+    });
+    it("auto-authenticates with user apiKey (no agentId)", async () => {
+        const fetcher = mockFetch(200, { access_token: "user-jwt" });
+        globalThis.fetch = fetcher;
+        new OneclawClient({
+            baseUrl: "https://api.test",
+            apiKey: "1ck_abc",
+        });
+        await vi.waitFor(() => expect(fetcher).toHaveBeenCalled());
+        const [url] = fetcher.mock.calls[0];
+        expect(url).toContain("/v1/auth/api-key-token");
+    });
+    it("skips auto-auth when token is already provided", () => {
+        const fetcher = mockFetch(200, {});
+        globalThis.fetch = fetcher;
+        new OneclawClient({
+            baseUrl: "https://api.test",
+            token: "existing-jwt",
+            apiKey: "ocv_abc",
+        });
+        expect(fetcher).not.toHaveBeenCalled();
+    });
+    it("skips auto-auth when no apiKey is provided", () => {
+        const fetcher = mockFetch(200, {});
+        globalThis.fetch = fetcher;
+        new OneclawClient({
+            baseUrl: "https://api.test",
+            token: "jwt",
+        });
+        expect(fetcher).not.toHaveBeenCalled();
+    });
+});
+describe("createClient", () => {
+    it("returns an OneclawClient instance", () => {
+        globalThis.fetch = mockFetch(200, {});
+        const client = createClient({ baseUrl: "https://api.test", token: "t" });
+        expect(client).toBeInstanceOf(OneclawClient);
+    });
+});
+//# sourceMappingURL=client.test.js.map

package/dist/__tests__/client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.test.js","sourceRoot":"","sources":["../../src/__tests__/client.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE7D,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AAEvC,SAAS,CAAC,GAAG,EAAE;IACX,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAc,EAAE,IAAa;IAC5C,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;QAC7B,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QACjC,MAAM;QACN,OAAO,EAAE,IAAI,OAAO,EAAE;QACtB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KACb,CAAC,CAAC;AAC9B,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAC9C,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAE9E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE;aAClB,qBAAqB,CAAC;YACnB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI,OAAO,EAAE;YACtB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;SACtC,CAAC;aACxB,qBAAqB,CAAC;YACnB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI,OAAO,EAAE;YACtB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SACvB,CAAC,CAAC;QAC9B,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;YAC7B,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,YAAY;SACxB,CAAC,CAAC;QAEH,+DAA+D;QAC/D,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAE1B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;QAE3B,IAAI,aAAa,CAAC;YACd,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,SAAS;SACpB,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACtD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;QAE3B,IAAI,aAAa,CAAC;YACd,OAAO,EAAE,kBAAkB;YAC3B,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;QAE3B,IAAI,aAAa,CAAC;YACd,OAAO,EAAE,kBAAkB;YAC3B,KAAK,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACzC,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/errors.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=errors.test.d.ts.map

package/dist/__tests__/errors.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/errors.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/errors.test.js

@@ -0,0 +1,125 @@
+import { describe, it, expect } from "vitest";
+import { OneclawError, AuthError, PaymentRequiredError, ApprovalRequiredError, NotFoundError, RateLimitError, ValidationError, ServerError, errorFromResponse, } from "../core/errors";
+describe("Error classes", () => {
+    it("OneclawError stores status, type, and detail", () => {
+        const err = new OneclawError("msg", 418, "teapot", "short and stout");
+        expect(err.message).toBe("msg");
+        expect(err.status).toBe(418);
+        expect(err.type).toBe("teapot");
+        expect(err.detail).toBe("short and stout");
+        expect(err.name).toBe("OneclawError");
+        expect(err).toBeInstanceOf(Error);
+    });
+    it("AuthError defaults to 401", () => {
+        const err = new AuthError("bad token");
+        expect(err.status).toBe(401);
+        expect(err.type).toBe("auth_error");
+    });
+    it("AuthError accepts 403", () => {
+        const err = new AuthError("forbidden", 403);
+        expect(err.status).toBe(403);
+    });
+    it("PaymentRequiredError includes paymentRequirement", () => {
+        const req = { x402Version: 1, accepts: [], description: "pay" };
+        const err = new PaymentRequiredError("pay up", req);
+        expect(err.status).toBe(402);
+        expect(err.paymentRequirement).toBe(req);
+    });
+    it("ApprovalRequiredError includes approvalRequestId", () => {
+        const err = new ApprovalRequiredError("req-123");
+        expect(err.status).toBe(403);
+        expect(err.approvalRequestId).toBe("req-123");
+        expect(err.message).toContain("approval");
+    });
+    it("NotFoundError defaults message", () => {
+        const err = new NotFoundError();
+        expect(err.status).toBe(404);
+        expect(err.message).toBe("Resource not found");
+    });
+    it("RateLimitError includes retryAfterMs", () => {
+        const err = new RateLimitError("slow down", 5000);
+        expect(err.status).toBe(429);
+        expect(err.retryAfterMs).toBe(5000);
+    });
+    it("ValidationError includes fields", () => {
+        const err = new ValidationError("bad input", { name: "required" });
+        expect(err.status).toBe(400);
+        expect(err.fields).toEqual({ name: "required" });
+    });
+    it("ServerError defaults to 500", () => {
+        const err = new ServerError();
+        expect(err.status).toBe(500);
+        expect(err.type).toBe("server_error");
+    });
+});
+describe("errorFromResponse", () => {
+    function fakeResponse(status, body, headers) {
+        return {
+            status,
+            ok: status >= 200 && status < 300,
+            headers: new Headers(headers),
+            json: () => Promise.resolve(body),
+        };
+    }
+    it("maps 400 to ValidationError", async () => {
+        const err = await errorFromResponse(fakeResponse(400, { detail: "bad field" }));
+        expect(err).toBeInstanceOf(ValidationError);
+        expect(err.message).toBe("bad field");
+    });
+    it("maps 401 to AuthError", async () => {
+        const err = await errorFromResponse(fakeResponse(401, { detail: "expired" }));
+        expect(err).toBeInstanceOf(AuthError);
+        expect(err.status).toBe(401);
+    });
+    it("maps 403 to AuthError", async () => {
+        const err = await errorFromResponse(fakeResponse(403, { detail: "forbidden" }));
+        expect(err).toBeInstanceOf(AuthError);
+        expect(err.status).toBe(403);
+    });
+    it("maps 402 to PaymentRequiredError", async () => {
+        const body = { x402Version: 1, accepts: [], description: "pay" };
+        const err = await errorFromResponse(fakeResponse(402, body));
+        expect(err).toBeInstanceOf(PaymentRequiredError);
+    });
+    it("maps 404 to NotFoundError", async () => {
+        const err = await errorFromResponse(fakeResponse(404, { detail: "gone" }));
+        expect(err).toBeInstanceOf(NotFoundError);
+    });
+    it("maps 429 to RateLimitError with Retry-After header", async () => {
+        const err = await errorFromResponse(fakeResponse(429, { detail: "too many" }, { "Retry-After": "5" }));
+        expect(err).toBeInstanceOf(RateLimitError);
+        expect(err.retryAfterMs).toBe(5000);
+    });
+    it("maps 500 to ServerError", async () => {
+        const err = await errorFromResponse(fakeResponse(500, { detail: "boom" }));
+        expect(err).toBeInstanceOf(ServerError);
+    });
+    it("maps 502 to ServerError", async () => {
+        const err = await errorFromResponse(fakeResponse(502, {}));
+        expect(err).toBeInstanceOf(ServerError);
+    });
+    it("maps unknown status to generic OneclawError", async () => {
+        const err = await errorFromResponse(fakeResponse(418, { detail: "teapot" }));
+        expect(err).toBeInstanceOf(OneclawError);
+        expect(err.type).toBe("unknown");
+    });
+    it("falls back to 'HTTP {status}' when body has no message", async () => {
+        const err = await errorFromResponse(fakeResponse(500, {}));
+        expect(err.message).toBe("HTTP 500");
+    });
+    it("reads message field as fallback", async () => {
+        const err = await errorFromResponse(fakeResponse(400, { message: "from message" }));
+        expect(err.message).toBe("from message");
+    });
+    it("handles non-JSON response gracefully", async () => {
+        const res = {
+            status: 500,
+            ok: false,
+            headers: new Headers(),
+            json: () => Promise.reject(new Error("not json")),
+        };
+        const err = await errorFromResponse(res);
+        expect(err.message).toBe("HTTP 500");
+    });
+});
+//# sourceMappingURL=errors.test.js.map

package/dist/__tests__/errors.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.test.js","sourceRoot":"","sources":["../../src/__tests__/errors.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACH,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,eAAe,EACf,WAAW,EACX,iBAAiB,GACpB,MAAM,gBAAgB,CAAC;AAExB,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACtC,MAAM,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAC/B,SAAS,YAAY,CAAC,MAAc,EAAE,IAAa,EAAE,OAAgC;QACjF,OAAO;YACH,MAAM;YACN,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;YACjC,OAAO,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC;YAC7B,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SACb,CAAC;IAC7B,CAAC;IAED,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAC/B,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CACpE,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,CAAE,GAAsB,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG;YACR,MAAM,EAAE,GAAG;YACX,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI,OAAO,EAAE;YACtB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;SAC7B,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/http.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=http.test.d.ts.map

package/dist/__tests__/http.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/http.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/http.test.js

@@ -0,0 +1,200 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { HttpClient } from "../core/http";
+import { PaymentRequiredError } from "../core/errors";
+function mockFetch(status, body, headers) {
+    return vi.fn().mockResolvedValue({
+        ok: status >= 200 && status < 300,
+        status,
+        headers: new Headers(headers),
+        json: () => Promise.resolve(body),
+    });
+}
+describe("HttpClient", () => {
+    const originalFetch = globalThis.fetch;
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+    it("sends GET with Bearer token", async () => {
+        const fetcher = mockFetch(200, { id: "v1" });
+        globalThis.fetch = fetcher;
+        const http = new HttpClient({ baseUrl: "https://api.test", token: "tok123" });
+        const res = await http.request("GET", "/v1/vaults");
+        expect(fetcher).toHaveBeenCalledOnce();
+        const [url, init] = fetcher.mock.calls[0];
+        expect(url).toBe("https://api.test/v1/vaults");
+        expect(init.method).toBe("GET");
+        expect(init.headers["Authorization"]).toBe("Bearer tok123");
+        expect(res.data).toEqual({ id: "v1" });
+        expect(res.error).toBeNull();
+        expect(res.meta?.status).toBe(200);
+    });
+    it("sends POST with JSON body", async () => {
+        const fetcher = mockFetch(201, { id: "new" });
+        globalThis.fetch = fetcher;
+        const http = new HttpClient({ baseUrl: "https://api.test", token: "t" });
+        await http.request("POST", "/v1/vaults", { body: { name: "test" } });
+        const [, init] = fetcher.mock.calls[0];
+        expect(init.body).toBe(JSON.stringify({ name: "test" }));
+        expect(init.headers["Content-Type"]).toBe("application/json");
+    });
+    it("omits Authorization when no token", async () => {
+        const fetcher = mockFetch(200, {});
+        globalThis.fetch = fetcher;
+        const http = new HttpClient({ baseUrl: "https://api.test" });
+        await http.request("GET", "/v1/health");
+        const [, init] = fetcher.mock.calls[0];
+        expect(init.headers["Authorization"]).toBeUndefined();
+    });
+    it("strips trailing slash from baseUrl", async () => {
+        const fetcher = mockFetch(200, {});
+        globalThis.fetch = fetcher;
+        const http = new HttpClient({ baseUrl: "https://api.test/" });
+        await http.request("GET", "/v1/health");
+        expect(fetcher.mock.calls[0][0]).toBe("https://api.test/v1/health");
+    });
+    it("appends query parameters and skips undefined values", async () => {
+        const fetcher = mockFetch(200, {});
+        globalThis.fetch = fetcher;
+        const http = new HttpClient({ baseUrl: "https://api.test", token: "t" });
+        await http.request("GET", "/v1/secrets", {
+            query: { prefix: "db", limit: 10, missing: undefined },
+        });
+        const url = new URL(fetcher.mock.calls[0][0]);
+        expect(url.searchParams.get("prefix")).toBe("db");
+        expect(url.searchParams.get("limit")).toBe("10");
+        expect(url.searchParams.has("missing")).toBe(false);
+    });
+    it("returns null data for 204 No Content", async () => {
+        globalThis.fetch = mockFetch(204, null);
+        const http = new HttpClient({ baseUrl: "https://api.test", token: "t" });
+        const res = await http.request("DELETE", "/v1/vaults/abc");
+        expect(res.data).toBeNull();
+        expect(res.error).toBeNull();
+        expect(res.meta?.status).toBe(204);
+    });
+    it("returns error envelope on non-ok responses", async () => {
+        globalThis.fetch = mockFetch(404, { detail: "Vault not found" });
+        const http = new HttpClient({ baseUrl: "https://api.test", token: "t" });
+        const res = await http.request("GET", "/v1/vaults/missing");
+        expect(res.data).toBeNull();
+        expect(res.error).toBeTruthy();
+        expect(res.error?.type).toBe("not_found");
+        expect(res.error?.message).toBe("Vault not found");
+        expect(res.meta?.status).toBe(404);
+    });
+    it("requestOrThrow throws on error responses", async () => {
+        globalThis.fetch = mockFetch(401, { detail: "Invalid token" });
+        const http = new HttpClient({ baseUrl: "https://api.test", token: "bad" });
+        await expect(http.requestOrThrow("GET", "/v1/vaults")).rejects.toThrow("Invalid token");
+    });
+    it("requestOrThrow returns data on success", async () => {
+        globalThis.fetch = mockFetch(200, { vaults: [] });
+        const http = new HttpClient({ baseUrl: "https://api.test", token: "t" });
+        const data = await http.requestOrThrow("GET", "/v1/vaults");
+        expect(data.vaults).toEqual([]);
+    });
+    it("setToken/getToken updates the auth header", async () => {
+        const fetcher = mockFetch(200, {});
+        globalThis.fetch = fetcher;
+        const http = new HttpClient({ baseUrl: "https://api.test" });
+        expect(http.getToken()).toBeUndefined();
+        http.setToken("new-jwt");
+        expect(http.getToken()).toBe("new-jwt");
+        await http.request("GET", "/v1/vaults");
+        expect(fetcher.mock.calls[0][1].headers["Authorization"]).toBe("Bearer new-jwt");
+    });
+    describe("x402 auto-payment", () => {
+        const paymentRequirement = {
+            x402Version: 1,
+            accepts: [
+                {
+                    scheme: "exact",
+                    network: "eip155:8453",
+                    payTo: "0xabc",
+                    price: "0.001",
+                    requiredDeadlineSeconds: 60,
+                },
+            ],
+            description: "Pay per query",
+        };
+        it("retries with X-PAYMENT header when signer is configured", async () => {
+            const signer = {
+                getAddress: vi.fn().mockResolvedValue("0xsigner"),
+                signPayment: vi.fn().mockResolvedValue("sig-bytes"),
+            };
+            let callCount = 0;
+            globalThis.fetch = vi.fn().mockImplementation(() => {
+                callCount++;
+                if (callCount === 1) {
+                    return Promise.resolve({
+                        ok: false,
+                        status: 402,
+                        headers: new Headers(),
+                        json: () => Promise.resolve(paymentRequirement),
+                    });
+                }
+                return Promise.resolve({
+                    ok: true,
+                    status: 200,
+                    headers: new Headers(),
+                    json: () => Promise.resolve({ value: "secret" }),
+                });
+            });
+            const http = new HttpClient({
+                baseUrl: "https://api.test",
+                token: "t",
+                x402Signer: signer,
+                maxAutoPayUsd: 1,
+            });
+            const res = await http.request("GET", "/v1/vaults/v1/secrets/key");
+            expect(signer.signPayment).toHaveBeenCalledWith(paymentRequirement.accepts[0]);
+            expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+            const retryHeaders = globalThis.fetch.mock.calls[1][1].headers;
+            expect(retryHeaders["X-PAYMENT"]).toBeDefined();
+            expect(res.data).toEqual({ value: "secret" });
+        });
+        it("throws PaymentRequiredError when maxAutoPayUsd is 0", async () => {
+            globalThis.fetch = vi.fn().mockResolvedValue({
+                ok: false,
+                status: 402,
+                headers: new Headers(),
+                json: () => Promise.resolve(paymentRequirement),
+            });
+            const signer = {
+                getAddress: vi.fn(),
+                signPayment: vi.fn(),
+            };
+            const http = new HttpClient({
+                baseUrl: "https://api.test",
+                token: "t",
+                x402Signer: signer,
+                maxAutoPayUsd: 0,
+            });
+            await expect(http.request("GET", "/v1/test")).rejects.toThrow(PaymentRequiredError);
+        });
+        it("throws when payment exceeds maxAutoPayUsd", async () => {
+            const expensiveRequirement = {
+                ...paymentRequirement,
+                accepts: [{ ...paymentRequirement.accepts[0], price: "100.0" }],
+            };
+            globalThis.fetch = vi.fn().mockResolvedValue({
+                ok: false,
+                status: 402,
+                headers: new Headers(),
+                json: () => Promise.resolve(expensiveRequirement),
+            });
+            const signer = {
+                getAddress: vi.fn(),
+                signPayment: vi.fn(),
+            };
+            const http = new HttpClient({
+                baseUrl: "https://api.test",
+                token: "t",
+                x402Signer: signer,
+                maxAutoPayUsd: 1,
+            });
+            await expect(http.request("GET", "/v1/test")).rejects.toThrow(/exceeds auto-pay limit/);
+        });
+    });
+});
+//# sourceMappingURL=http.test.js.map