@absol-labs/agent 0.1.0

package/dist/zktls/reclaim.js

@@ -0,0 +1,245 @@
+import { getHttpProviderClaimParamsFromProof, getProviderHashRequirementsFromSpec, verifyProof, } from "@reclaimprotocol/js-sdk";
+import { z } from "zod";
+const addressSchema = z.string().regex(/^0x[0-9a-fA-F]{40}$/);
+const bytes32Schema = z.string().regex(/^0x[0-9a-fA-F]{64}$/);
+const httpMethodSchema = z.enum(["GET", "POST", "PUT"]);
+const responseMatchSchema = z.object({
+    type: z.enum(["regex", "contains"]),
+    value: z.string().min(1, "response match value is required"),
+    invert: z.boolean().optional(),
+    isOptional: z.boolean().optional(),
+});
+const responseRedactionSchema = z
+    .object({
+    regex: z.string().optional(),
+    jsonPath: z.string().optional(),
+    xPath: z.string().optional(),
+    hash: z.enum(["oprf", "oprf-raw", "oprf-mpc"]).optional(),
+})
+    .refine((value) => value.regex !== undefined ||
+    value.jsonPath !== undefined ||
+    value.xPath !== undefined, "response redaction needs regex, jsonPath, or xPath");
+export class ResponseProofUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ResponseProofUnavailableError";
+    }
+}
+export class ResponseProofVerificationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ResponseProofVerificationError";
+    }
+}
+const reclaimProofInputSchema = z.object({
+    url: z.string().url(),
+    method: httpMethodSchema.optional(),
+    headers: z.record(z.string()).optional(),
+    body: z.string().optional(),
+    secretHeaders: z.record(z.string()).optional(),
+    responseMatches: z
+        .array(responseMatchSchema)
+        .min(1, "at least one response match is required"),
+    responseRedactions: z.array(responseRedactionSchema).optional(),
+    cookie: z.string().optional(),
+    secretParamValues: z.record(z.string()).optional(),
+    geoLocation: z.string().optional(),
+    useTee: z.boolean().optional(),
+    zkEngine: z.enum(["snarkjs", "stwo"]).optional(),
+    delivery: z.object({
+        owner: addressSchema,
+        streamId: bytes32Schema.optional(),
+        operator: addressSchema.optional(),
+        serviceRef: bytes32Schema.optional(),
+        mandateId: bytes32Schema.optional(),
+    }),
+});
+export class ReclaimConsumerProofService {
+    client;
+    config;
+    verifyProofImpl;
+    constructor(config, options = {}) {
+        this.config = {
+            ...config,
+            logs: config.logs ?? false,
+        };
+        this.client = (options.createClient ?? defaultReclaimClientFactory)(this.config.applicationId, this.config.applicationSecret, this.config.logs ?? false);
+        this.verifyProofImpl = options.verifyProof ?? verifyProof;
+    }
+    async proveConsumedHttpsResponse(input) {
+        const parsed = reclaimProofInputSchema.parse(input);
+        const method = parsed.method ?? "GET";
+        const proof = await this.client
+            .zkFetch(parsed.url, {
+            method,
+            ...(parsed.body === undefined ? {} : { body: parsed.body }),
+            ...(parsed.headers === undefined ? {} : { headers: parsed.headers }),
+            ...(parsed.geoLocation === undefined
+                ? {}
+                : { geoLocation: parsed.geoLocation }),
+            context: buildRequestContext(parsed.delivery),
+            ...(parsed.useTee === undefined ? {} : { useTee: parsed.useTee }),
+            ...(parsed.zkEngine === undefined
+                ? {}
+                : { zkEngine: parsed.zkEngine }),
+        }, {
+            ...(parsed.secretHeaders === undefined
+                ? {}
+                : { headers: parsed.secretHeaders }),
+            responseMatches: parsed.responseMatches,
+            ...(parsed.responseRedactions === undefined
+                ? {}
+                : { responseRedactions: parsed.responseRedactions }),
+            ...(parsed.cookie === undefined ? {} : { cookieStr: parsed.cookie }),
+            ...(parsed.secretParamValues === undefined
+                ? {}
+                : { paramValues: parsed.secretParamValues }),
+        })
+            .catch((error) => {
+            throw new ResponseProofUnavailableError(`failed to generate zkTLS response proof: ${asErrorMessage(error)}`);
+        });
+        if (proof === undefined) {
+            throw new ResponseProofUnavailableError("reclaim returned no zkTLS response proof");
+        }
+        const verification = await this.verifyProofImpl(proof, {
+            ...getProviderHashRequirementsFromSpec({
+                requests: [toRequestSpec(parsed, method)],
+            }),
+            ...(parsed.useTee === true
+                ? {
+                    teeAttestation: {
+                        appSecret: this.config.applicationSecret,
+                    },
+                }
+                : {}),
+        });
+        if (!verification.isVerified) {
+            throw new ResponseProofVerificationError(`zkTLS response proof verification failed: ${asErrorMessage(verification.error)}`);
+        }
+        const trusted = verification.data[0];
+        if (trusted === undefined) {
+            throw new ResponseProofVerificationError("zkTLS response proof verification returned no trusted data");
+        }
+        const request = getHttpProviderClaimParamsFromProof(proof);
+        return {
+            proof,
+            request: {
+                url: request.url,
+                method: request.method,
+                body: request.body === "" ? null : (request.body ?? null),
+                responseMatches: request.responseMatches.map((match) => ({
+                    value: match.value,
+                    type: match.type,
+                    invert: match.invert,
+                    isOptional: match.isOptional,
+                })),
+                responseRedactions: request.responseRedactions.map((redaction) => ({
+                    regex: redaction.regex,
+                    jsonPath: redaction.jsonPath,
+                    xPath: redaction.xPath,
+                    hash: redaction.hash,
+                })),
+            },
+            verification: {
+                context: trusted.context,
+                extractedParameters: trusted.extractedParameters,
+                publicData: verification.publicData[0] ?? null,
+                isTeeAttestationVerified: verification.isTeeAttestationVerified ?? false,
+                isAttestorTeeAttestationVerified: verification.isAttestorTeeAttestationVerified ?? false,
+            },
+        };
+    }
+}
+export function parseReclaimProofEnv(env = process.env) {
+    const applicationId = env.RECLAIM_APP_ID;
+    const applicationSecret = env.RECLAIM_APP_SECRET;
+    if (applicationId === undefined && applicationSecret === undefined) {
+        return null;
+    }
+    if (applicationId === undefined ||
+        applicationId.trim() === "" ||
+        applicationSecret === undefined ||
+        applicationSecret.trim() === "") {
+        throw new Error("RECLAIM_APP_ID and RECLAIM_APP_SECRET must both be set");
+    }
+    return {
+        applicationId,
+        applicationSecret,
+        logs: env.METRIK_AGENT_RECLAIM_LOGS === "true",
+    };
+}
+export function createReclaimConsumerProofServiceFromEnv(env = process.env) {
+    const parsed = parseReclaimProofEnv(env);
+    if (parsed === null) {
+        return null;
+    }
+    return new ReclaimConsumerProofService(parsed);
+}
+function defaultReclaimClientFactory(applicationId, applicationSecret, logs) {
+    return new LazyReclaimClient(applicationId, applicationSecret, logs);
+}
+function buildRequestContext(binding) {
+    return {
+        contextAddress: binding.owner,
+        contextMessage: JSON.stringify({
+            kind: "metrik-l4-http-response/v1",
+            streamId: binding.streamId ?? null,
+            operator: binding.operator ?? null,
+            serviceRef: binding.serviceRef ?? null,
+            mandateId: binding.mandateId ?? null,
+        }),
+    };
+}
+function toRequestSpec(input, method) {
+    return {
+        url: input.url,
+        urlType: "full",
+        method,
+        bodySniff: {
+            enabled: input.body !== undefined,
+            template: input.body ?? "",
+        },
+        responseMatches: input.responseMatches.map((match) => ({
+            value: match.value,
+            type: match.type,
+            invert: match.invert,
+            isOptional: match.isOptional,
+        })),
+        responseRedactions: (input.responseRedactions ?? []).map((redaction) => ({
+            regex: redaction.regex ?? "",
+            jsonPath: redaction.jsonPath ?? "",
+            xPath: redaction.xPath ?? "",
+            ...(redaction.hash === undefined ? {} : { hash: redaction.hash }),
+        })),
+        required: true,
+        multiple: false,
+    };
+}
+function asErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+class LazyReclaimClient {
+    applicationId;
+    applicationSecret;
+    logs;
+    clientPromise;
+    constructor(applicationId, applicationSecret, logs) {
+        this.applicationId = applicationId;
+        this.applicationSecret = applicationSecret;
+        this.logs = logs;
+    }
+    async zkFetch(url, options, secretOptions) {
+        const client = await this.getClient();
+        return await client.zkFetch(url, options, secretOptions);
+    }
+    async getClient() {
+        if (this.clientPromise === undefined) {
+            this.clientPromise = import("@reclaimprotocol/zk-fetch").then((module) => {
+                const client = new module.ReclaimClient(this.applicationId, this.applicationSecret, this.logs);
+                return client;
+            });
+        }
+        return await this.clientPromise;
+    }
+}
+//# sourceMappingURL=reclaim.js.map

package/dist/zktls/reclaim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reclaim.js","sourceRoot":"","sources":["../../src/zktls/reclaim.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,WAAW,GAIZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAC9D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACxD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kCAAkC,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,KAAK,SAAS;IACzB,KAAK,CAAC,QAAQ,KAAK,SAAS;IAC5B,KAAK,CAAC,KAAK,KAAK,SAAS,EAC3B,oDAAoD,CACrD,CAAC;AA4FJ,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,EAAE,yCAAyC,CAAC;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;QAClC,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE;QACpC,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;KACpC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAoB;IAC1B,MAAM,CAA4B;IAClC,eAAe,CAAgB;IAEhD,YACE,MAAiC,EACjC,UAOI,EAAE;QAEN,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,KAAK;SAC3B,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,2BAA2B,CAAC,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,EACzB,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAC1B,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,KAAsC;QAEtC,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM;aAC5B,OAAO,CACN,MAAM,CAAC,GAAG,EACV;YACE,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACxC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;SACnC,EACD;YACE,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;YACtC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;SAC/C,CACF;aACA,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,6BAA6B,CACrC,4CAA4C,cAAc,CAAC,KAAK,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,6BAA6B,CACrC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE;YACrD,GAAG,mCAAmC,CAAC;gBACrC,QAAQ,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aAC1C,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI;gBACxB,CAAC,CAAC;oBACE,cAAc,EAAE;wBACd,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;qBACzC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,8BAA8B,CACtC,6CAA6C,cAAc,CACzD,YAAY,CAAC,KAAK,CACnB,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,8BAA8B,CACtC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,CAAC;QAC3D,OAAO;YACL,KAAK;YACL,OAAO,EAAE;gBACP,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM,EAAE,OAAO,CAAC,MAAgC;gBAChD,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;gBACzD,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACvD,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;gBACH,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACjE,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,IAAI,EAAE,SAAS,CAAC,IAAI;iBACrB,CAAC,CAAC;aACJ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI;gBAC9C,wBAAwB,EACtB,YAAY,CAAC,wBAAwB,IAAI,KAAK;gBAChD,gCAAgC,EAC9B,YAAY,CAAC,gCAAgC,IAAI,KAAK;aACzD;SACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC;IACzC,MAAM,iBAAiB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACjD,IAAI,aAAa,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,aAAa,KAAK,SAAS;QAC3B,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;QAC3B,iBAAiB,KAAK,SAAS;QAC/B,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,aAAa;QACb,iBAAiB;QACjB,IAAI,EAAE,GAAG,CAAC,yBAAyB,KAAK,MAAM;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,2BAA2B,CAClC,aAAqB,EACrB,iBAAyB,EACzB,IAAa;IAEb,OAAO,IAAI,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA4D;IAK5D,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,KAAK;QAC7B,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;SACrC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAA8C,EAC9C,MAA8B;IAE9B,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,MAAM;QACf,MAAM;QACN,SAAS,EAAE;YACT,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS;YACjC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;SAC3B;QACD,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,kBAAkB,EAAE,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACvE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;YAClC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC5B,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,iBAAiB;IAIF;IACA;IACA;IALX,aAAa,CAA8B;IAEnD,YACmB,aAAqB,EACrB,iBAAyB,EACzB,IAAa;QAFb,kBAAa,GAAb,aAAa,CAAQ;QACrB,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,GAAW,EACX,OAAqD,EACrD,aAA2D;QAE3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAC3D,CAAC,MAAM,EAAE,EAAE;gBACT,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CACrC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,IAAI,CACV,CAAC;gBACF,OAAO,MAA2B,CAAC;YACrC,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC;IAClC,CAAC;CACF"}

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@absol-labs/agent",
+  "version": "0.1.0",
+  "description": "Metrik agent layer: x402 verified-streaming payments, an MCP server, framework tools, and spend mandates so AI agents can hire and pay verified services safely.",
+  "license": "MIT",
+  "author": "Absol Labs",
+  "keywords": [
+    "metrik",
+    "x402",
+    "mcp",
+    "ai-agents",
+    "spend-mandate",
+    "base",
+    "usdc"
+  ],
+  "private": false,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json",
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "import": "./dist/*.js"
+    }
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "src"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Absol-Labs/metrik-agent.git"
+  },
+  "homepage": "https://github.com/Absol-Labs/metrik-agent#readme",
+  "bugs": {
+    "url": "https://github.com/Absol-Labs/metrik-agent/issues"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20 <21",
+    "pnpm": "9.15.x"
+  },
+  "dependencies": {
+    "@absol-labs/sdk": "^0.4.0",
+    "@absol-labs/shared": "^0.7.1",
+    "@coinbase/agentkit": "^0.10.4",
+    "@coinbase/cdp-sdk": "^1.51.2",
+    "@elizaos/core": "^1.7.2",
+    "@langchain/core": "^1.2.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@reclaimprotocol/js-sdk": "^5.6.0",
+    "@reclaimprotocol/zk-fetch": "^1.0.0",
+    "reflect-metadata": "^0.2.2",
+    "viem": "^2.21.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@swc/core": "^1.10.0",
+    "@types/node": "^20.17.0",
+    "prettier": "^3.4.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "build:e2e": "tsc -p tsconfig.e2e.build.json",
+    "mcp:stdio": "tsx src/mcp/stdio.ts",
+    "mcp:http": "tsx src/mcp/http-server.ts",
+    "e2e:cdp": "node dist-e2e/scripts/e2e-cdp.js",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck:e2e": "tsc -p tsconfig.e2e.json --noEmit",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "format": "prettier --write ."
+  }
+}

package/src/discovery/registry.ts

@@ -0,0 +1,255 @@
+import {
+  deriveServiceRef,
+  recoverServiceBindingSigner,
+  serviceBindingSchema,
+} from "@absol-labs/shared";
+import { isHex } from "viem";
+import { z } from "zod";
+
+/**
+ * Service discovery for the Metrik verified-service marketplace.
+ *
+ * Before this module every agent surface (SDK, MCP, framework tools) assumed the
+ * caller already knew a seller's `operator` + `serviceRef`. There was no way to
+ * DISCOVER a service. {@link discoverServices} closes that gap: it reads the same
+ * Supabase `listings` registry the oracle reads and returns typed, VERIFIED
+ * listings an agent can hire directly.
+ *
+ * ## Fail-closed trust model
+ * The security-critical envelope lives entirely inside each row's `signed_binding`
+ * (`{ binding, signature, serviceRef, targetMetadata }`). The flat `service_ref` /
+ * `operator` / `public_url` columns are UNSIGNED denormalised copies for querying
+ * only — never trusted. A row is DROPPED (and logged) unless BOTH hold:
+ *   1. its EIP-712 signature recovers to `binding.operator`; and
+ *   2. `deriveServiceRef(binding)` equals the envelope's own `serviceRef`.
+ * `discoverServices` therefore NEVER returns an unverifiable listing.
+ *
+ * The unsigned `category` column is carried through as informational metadata only
+ * (used for the optional client-side category filter); it is never part of the
+ * trust decision.
+ */
+
+/** A verified, hireable service listing. `serviceRef`/`operator`/`publicUrl` are
+ * derived from the SIGNED binding, not the unsigned flat columns. */
+export interface ServiceListing {
+  readonly serviceRef: `0x${string}`;
+  readonly operator: `0x${string}`;
+  readonly publicUrl: string;
+  /** Unsigned informational category from the listings row (may be absent). */
+  readonly category: string | null;
+  /** Optional signed operator-supplied target metadata (e.g. resolver hints). */
+  readonly targetMetadata?: Record<string, string>;
+}
+
+export interface DiscoverServicesOptions {
+  /** Registry endpoint. Defaults to {@link DEFAULT_METRIK_REGISTRY_URL} (env override:
+   * `METRIK_AGENT_REGISTRY_URL`). Pass the full PostgREST `?select=...&order=...` URL. */
+  readonly registryUrl?: string;
+  /** PostgREST apikey (Supabase anon key). Env override: `METRIK_AGENT_REGISTRY_APIKEY`.
+   * Sent as both the `apikey` header and `Authorization: Bearer`. */
+  readonly apiKey?: string;
+  /** Optional client-side filter on the unsigned `category` column. */
+  readonly category?: string;
+  /** Optional cap on the number of verified listings returned. */
+  readonly limit?: number;
+  /** Injected fetch (tests / custom transports). Defaults to `globalThis.fetch`. */
+  readonly fetch?: typeof fetch;
+  /** Request timeout in milliseconds. Defaults to 5000. */
+  readonly timeoutMs?: number;
+  /** Warning sink for dropped rows / registry failures. Defaults to `console`. */
+  readonly logger?: { warn: (...args: unknown[]) => void };
+}
+
+/**
+ * Default Metrik listings registry (Supabase PostgREST). Selects the columns the
+ * oracle and the agent both need and orders newest-first.
+ */
+export const DEFAULT_METRIK_REGISTRY_URL =
+  "https://pzvnacjolaipeobmptsb.supabase.co/rest/v1/listings?select=service_ref,operator,public_url,category,signed_binding&order=created_at.desc";
+
+const DEFAULT_TIMEOUT_MS = 5_000;
+
+const signature65HexSchema = z
+  .string()
+  .refine(
+    (value) => isHex(value, { strict: true }) && value.length === 132,
+    "must be a 65-byte hex signature",
+  );
+
+const bytes32HexSchema = z
+  .string()
+  .refine(
+    (value) => isHex(value, { strict: true }) && value.length === 66,
+    "must be bytes32 hex",
+  );
+
+/** The signed envelope inside a listings row. Mirrors the oracle's ingest schema
+ * (includes the optional operator-supplied `targetMetadata`). */
+const signedBindingRecordSchema = z.object({
+  serviceRef: bytes32HexSchema,
+  binding: serviceBindingSchema,
+  signature: signature65HexSchema,
+  targetMetadata: z.record(z.string()).optional(),
+});
+
+/** A Supabase `listings` row. Only `signed_binding` is trusted; `category` is
+ * carried through as unsigned informational metadata. Unknown columns are ignored. */
+const listingRowSchema = z
+  .object({
+    category: z.string().nullish(),
+    signed_binding: signedBindingRecordSchema,
+  })
+  .passthrough();
+
+/**
+ * Discover verified services from the Metrik listings registry.
+ *
+ * Fail-closed: any row whose signed binding is malformed, whose signature does not
+ * recover to its operator, or whose `serviceRef` does not match `deriveServiceRef`
+ * is dropped and logged. Degrades gracefully: any network/registry failure returns
+ * `[]` (with a logged warning) rather than throwing to the caller.
+ */
+export async function discoverServices(
+  opts: DiscoverServicesOptions = {},
+): Promise<ServiceListing[]> {
+  const logger = opts.logger ?? console;
+  const registryUrl =
+    opts.registryUrl ??
+    process.env.METRIK_AGENT_REGISTRY_URL ??
+    DEFAULT_METRIK_REGISTRY_URL;
+  const apiKey = opts.apiKey ?? process.env.METRIK_AGENT_REGISTRY_APIKEY;
+  const fetchImpl = opts.fetch ?? globalThis.fetch;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+
+  if (typeof fetchImpl !== "function") {
+    logger.warn(
+      "metrik discovery: no fetch implementation available; returning no listings",
+    );
+    return [];
+  }
+
+  let rows: unknown[];
+  try {
+    rows = await fetchListingRows(fetchImpl, registryUrl, apiKey, timeoutMs);
+  } catch (error) {
+    // Fail-safe / buyer-favouring: a down or unreachable registry must never throw
+    // into the agent's hire flow — it degrades to "no services discovered".
+    logger.warn(
+      `metrik discovery: listings registry unreachable (${errorMessage(error)}); returning no listings`,
+    );
+    return [];
+  }
+
+  const listings: ServiceListing[] = [];
+  for (const [index, row] of rows.entries()) {
+    const listing = await verifyRow(row, index, logger);
+    if (listing === null) {
+      continue;
+    }
+    if (opts.category !== undefined && listing.category !== opts.category) {
+      continue;
+    }
+    listings.push(listing);
+    if (opts.limit !== undefined && listings.length >= opts.limit) {
+      break;
+    }
+  }
+  return listings;
+}
+
+async function fetchListingRows(
+  fetchImpl: typeof fetch,
+  url: string,
+  apiKey: string | undefined,
+  timeoutMs: number,
+): Promise<unknown[]> {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const headers: Record<string, string> = {};
+    if (apiKey !== undefined && apiKey.length > 0) {
+      headers.apikey = apiKey;
+      headers.Authorization = `Bearer ${apiKey}`;
+    }
+    const response = await fetchImpl(url, {
+      signal: controller.signal,
+      ...(Object.keys(headers).length === 0 ? {} : { headers }),
+    });
+    if (!response.ok) {
+      throw new Error(
+        `listings registry responded with status ${response.status}`,
+      );
+    }
+    const body: unknown = await response.json();
+    if (!Array.isArray(body)) {
+      throw new Error("listings registry response was not a JSON array");
+    }
+    return body;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+/**
+ * Verify one raw registry row into a {@link ServiceListing}, or `null` if it fails
+ * the fail-closed checks. Never throws.
+ */
+async function verifyRow(
+  row: unknown,
+  index: number,
+  logger: { warn: (...args: unknown[]) => void },
+): Promise<ServiceListing | null> {
+  const parsed = listingRowSchema.safeParse(row);
+  if (!parsed.success) {
+    logger.warn(
+      `metrik discovery: row ${index} dropped — invalid listing envelope (${parsed.error.issues[0]?.message ?? "schema error"})`,
+    );
+    return null;
+  }
+  const { signed_binding: record, category } = parsed.data;
+
+  let signer: `0x${string}` | null;
+  try {
+    signer = (await recoverServiceBindingSigner(
+      record.binding,
+      record.signature as `0x${string}`,
+    )) as `0x${string}` | null;
+  } catch (error) {
+    logger.warn(
+      `metrik discovery: row ${index} dropped — signature recovery threw (${errorMessage(error)})`,
+    );
+    return null;
+  }
+  if (signer === null || !eqHex(signer, record.binding.operator)) {
+    logger.warn(
+      `metrik discovery: row ${index} dropped — signature does not recover to operator (recovered ${signer ?? "null"})`,
+    );
+    return null;
+  }
+
+  const derivedRef = deriveServiceRef(record.binding);
+  if (!eqHex(derivedRef, record.serviceRef)) {
+    logger.warn(
+      `metrik discovery: row ${index} dropped — serviceRef ${record.serviceRef} does not match derived ${derivedRef}`,
+    );
+    return null;
+  }
+
+  return {
+    serviceRef: derivedRef,
+    operator: record.binding.operator as `0x${string}`,
+    publicUrl: record.binding.publicUrl,
+    category: category ?? null,
+    ...(record.targetMetadata === undefined
+      ? {}
+      : { targetMetadata: record.targetMetadata }),
+  };
+}
+
+function eqHex(a: string, b: string): boolean {
+  return a.toLowerCase() === b.toLowerCase();
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}