@absol-labs/agent 0.10.0 → 0.12.0-rc.1

package/dist/gateway/probe-auth.d.ts

@@ -0,0 +1,112 @@
+import type { Address } from "viem";
+/**
+ * Seller-side plumbing for oracle-signed probe verification.
+ *
+ * Two pieces, both deliberately small and both fail-closed:
+ *
+ * 1. {@link OracleSignerSetReader} — WHO may mint a `ProbeCapability`. Read
+ *    straight off the escrow's `getOracleSigners()`, which is a public `view`.
+ *    There is no registration step, no shared secret, and no trust in the
+ *    oracle's own say-so: a third-party seller performs the identical read.
+ * 2. {@link ProbeRateLimiter} — how often a probe may be served for free.
+ *    Without a bound, an oracle-signed capability is a licence to consume the
+ *    seller's service indefinitely at no cost.
+ */
+/** Resolves the escrow's current oracle signer set (lowercased). */
+export interface OracleSignerSetReader {
+    getOracleSigners(): Promise<readonly Address[]>;
+}
+/** Default reader: a read-only `getOracleSigners()` call. No wallet, no writes. */
+export declare function createSdkOracleSignerSetReader(options: {
+    readonly escrowAddress: Address;
+    readonly rpcUrl: string;
+    /** Chain of the escrow; must be a registered network. Default: the registry default. */
+    readonly chainId?: number;
+}): OracleSignerSetReader;
+/**
+ * Default freshness bound for the cached signer set, in seconds. The set only
+ * changes by an explicit escrow transaction, so a short cache costs nothing in
+ * correctness while keeping one RPC read off every probe.
+ */
+export declare const DEFAULT_ORACLE_SIGNER_CACHE_SECONDS = 60;
+/**
+ * Bounded-staleness cache over {@link OracleSignerSetReader}.
+ *
+ * FAIL-CLOSED by construction: once the cached set is older than its TTL it is
+ * discarded, and a refresh that fails resolves to `undefined` rather than
+ * serving the stale set. A probe is a free call, so "the RPC is down" must deny
+ * — which the oracle then reports as unverifiable, never as passing.
+ *
+ * Concurrent callers share one in-flight refresh, so a burst of probes cannot
+ * fan out into a burst of RPC reads.
+ */
+export declare class CachedOracleSignerSet {
+    private readonly reader;
+    private readonly ttlSeconds;
+    private readonly now;
+    private cached;
+    private inFlight;
+    constructor(reader: OracleSignerSetReader, ttlSeconds?: number, now?: () => number);
+    /** The current set, or `undefined` when it could not be read fresh enough. */
+    resolve(): Promise<ReadonlySet<string> | undefined>;
+}
+/** Bounds how many probes this gateway will serve for free. */
+export interface ProbeRateLimiter {
+    /** Returns `true` (and consumes budget) IFF a probe may be served now. */
+    tryConsume(): boolean;
+}
+/**
+ * Default probe budget, in probes per minute.
+ *
+ * Derived from the real cadence, not picked round: the oracle checkpoints every
+ * ~15-22s, so a single vantage probes a given service at most ~4 times a
+ * minute. T1 multi-vantage fans that out across at most 9 vantages (the
+ * coordinator plus the 8-worker cap in the oracle's vantage config), giving a
+ * worst-case honest load of ~36 probes/minute. 60 leaves headroom for a
+ * re-execution sample and clock jitter while capping the free-service surface
+ * at one request per second — orders of magnitude below what would make this an
+ * economically interesting way to get the service for nothing.
+ */
+export declare const DEFAULT_MAX_PROBES_PER_MINUTE = 60;
+/**
+ * Fixed-window probe limiter. One counter for the whole gateway (which fronts
+ * one service), so the bound holds no matter how many oracle signers exist or
+ * how many vantages a coordinator runs.
+ *
+ * A useful secondary effect: because every probe capability is single-use and
+ * short-lived, this limiter is also what bounds the shared nonce replay cache —
+ * at most `maxPerMinute x ttl/60` probe nonces can be live at once.
+ */
+export declare class FixedWindowProbeRateLimiter implements ProbeRateLimiter {
+    private readonly maxPerMinute;
+    private readonly now;
+    private windowStart;
+    private count;
+    constructor(maxPerMinute?: number, now?: () => number);
+    tryConsume(): boolean;
+}
+/** Opt-in probe verification mode for {@link CallerAuthGateway}. */
+export interface GatewayProbeMode {
+    /**
+     * Who may mint. Defaults to a read-only `getOracleSigners()` reader built
+     * from the gateway's own escrow + RPC.
+     */
+    readonly signerSetReader?: OracleSignerSetReader;
+    /** Freshness bound for the cached signer set. Default {@link DEFAULT_ORACLE_SIGNER_CACHE_SECONDS}. */
+    readonly signerCacheSeconds?: number;
+    /** Probe budget. Default {@link DEFAULT_MAX_PROBES_PER_MINUTE}. */
+    readonly maxProbesPerMinute?: number;
+    /** Override the limiter entirely (tests, or a shared multi-instance store). */
+    readonly rateLimiter?: ProbeRateLimiter;
+    /** Probe capability header name. Default `x-metrik-probe-capability`. */
+    readonly headerName?: string;
+}
+/** What an authorized probe tells the caller. Carries NO stream and NO payment. */
+export interface ProbeAuthorization {
+    /** The oracle signer that minted the capability. */
+    readonly oracle: Address;
+    readonly serviceRef: `0x${string}`;
+    /** Unix seconds the capability expires at. */
+    readonly expiry: number;
+}
+//# sourceMappingURL=probe-auth.d.ts.map

package/dist/gateway/probe-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-auth.d.ts","sourceRoot":"","sources":["../../src/gateway/probe-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC;;;;;;;;;;;;GAYG;AAEH,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,IAAI,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;CACjD;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,qBAAqB,CAWxB;AAED;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,OAAO,CAAC,MAAM,CAEA;IACd,OAAO,CAAC,QAAQ,CAAuD;gBAGpD,MAAM,EAAE,qBAAqB,EAC7B,UAAU,GAAE,MAA4C,EACxD,GAAG,GAAE,MAAM,MAA4C;IAS1E,8EAA8E;IACxE,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CA4B1D;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,IAAI,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;;;;GAQG;AACH,qBAAa,2BAA4B,YAAW,gBAAgB;IAKhE,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,KAAK,CAAK;gBAGC,YAAY,GAAE,MAAsC,EACpD,GAAG,GAAE,MAAM,MAA4C;IAQ1E,UAAU,IAAI,OAAO;CAYtB;AAED,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IACjC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;IACnC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB"}

package/dist/gateway/probe-auth.js

@@ -0,0 +1,127 @@
+import { streamEscrowV2Abi } from "@absol-labs/shared";
+import { readOnlyMetrikClient } from "../network.js";
+/** Default reader: a read-only `getOracleSigners()` call. No wallet, no writes. */
+export function createSdkOracleSignerSetReader(options) {
+    const metrik = readOnlyMetrikClient(options);
+    return {
+        async getOracleSigners() {
+            return (await metrik.publicClient.readContract({
+                address: options.escrowAddress,
+                abi: streamEscrowV2Abi,
+                functionName: "getOracleSigners",
+            }));
+        },
+    };
+}
+/**
+ * Default freshness bound for the cached signer set, in seconds. The set only
+ * changes by an explicit escrow transaction, so a short cache costs nothing in
+ * correctness while keeping one RPC read off every probe.
+ */
+export const DEFAULT_ORACLE_SIGNER_CACHE_SECONDS = 60;
+/**
+ * Bounded-staleness cache over {@link OracleSignerSetReader}.
+ *
+ * FAIL-CLOSED by construction: once the cached set is older than its TTL it is
+ * discarded, and a refresh that fails resolves to `undefined` rather than
+ * serving the stale set. A probe is a free call, so "the RPC is down" must deny
+ * — which the oracle then reports as unverifiable, never as passing.
+ *
+ * Concurrent callers share one in-flight refresh, so a burst of probes cannot
+ * fan out into a burst of RPC reads.
+ */
+export class CachedOracleSignerSet {
+    reader;
+    ttlSeconds;
+    now;
+    cached;
+    inFlight;
+    constructor(reader, ttlSeconds = DEFAULT_ORACLE_SIGNER_CACHE_SECONDS, now = () => Math.floor(Date.now() / 1000)) {
+        this.reader = reader;
+        this.ttlSeconds = ttlSeconds;
+        this.now = now;
+        if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {
+            throw new Error("oracle signer cache ttlSeconds must be a positive number");
+        }
+    }
+    /** The current set, or `undefined` when it could not be read fresh enough. */
+    async resolve() {
+        const cached = this.cached;
+        if (cached !== undefined && this.now() - cached.at <= this.ttlSeconds) {
+            return cached.signers;
+        }
+        if (this.inFlight !== undefined) {
+            return this.inFlight;
+        }
+        const refresh = (async () => {
+            try {
+                const signers = await this.reader.getOracleSigners();
+                const set = new Set(signers.map((signer) => signer.toLowerCase()));
+                // An empty set is a real answer, and it means nobody may probe.
+                this.cached = { signers: set, at: this.now() };
+                return set;
+            }
+            catch {
+                // Drop the stale entry rather than serving it: a signer REMOVED from
+                // the escrow must stop being able to probe within one TTL, not within
+                // "however long the RPC stays down".
+                this.cached = undefined;
+                return undefined;
+            }
+            finally {
+                this.inFlight = undefined;
+            }
+        })();
+        this.inFlight = refresh;
+        return refresh;
+    }
+}
+/**
+ * Default probe budget, in probes per minute.
+ *
+ * Derived from the real cadence, not picked round: the oracle checkpoints every
+ * ~15-22s, so a single vantage probes a given service at most ~4 times a
+ * minute. T1 multi-vantage fans that out across at most 9 vantages (the
+ * coordinator plus the 8-worker cap in the oracle's vantage config), giving a
+ * worst-case honest load of ~36 probes/minute. 60 leaves headroom for a
+ * re-execution sample and clock jitter while capping the free-service surface
+ * at one request per second — orders of magnitude below what would make this an
+ * economically interesting way to get the service for nothing.
+ */
+export const DEFAULT_MAX_PROBES_PER_MINUTE = 60;
+/**
+ * Fixed-window probe limiter. One counter for the whole gateway (which fronts
+ * one service), so the bound holds no matter how many oracle signers exist or
+ * how many vantages a coordinator runs.
+ *
+ * A useful secondary effect: because every probe capability is single-use and
+ * short-lived, this limiter is also what bounds the shared nonce replay cache —
+ * at most `maxPerMinute x ttl/60` probe nonces can be live at once.
+ */
+export class FixedWindowProbeRateLimiter {
+    maxPerMinute;
+    now;
+    windowStart;
+    count = 0;
+    constructor(maxPerMinute = DEFAULT_MAX_PROBES_PER_MINUTE, now = () => Math.floor(Date.now() / 1000)) {
+        this.maxPerMinute = maxPerMinute;
+        this.now = now;
+        if (!Number.isInteger(maxPerMinute) || maxPerMinute <= 0) {
+            throw new Error("maxProbesPerMinute must be a positive integer");
+        }
+        this.windowStart = this.now();
+    }
+    tryConsume() {
+        const nowSeconds = this.now();
+        if (nowSeconds - this.windowStart >= 60) {
+            this.windowStart = nowSeconds;
+            this.count = 0;
+        }
+        if (this.count >= this.maxPerMinute) {
+            return false;
+        }
+        this.count += 1;
+        return true;
+    }
+}
+//# sourceMappingURL=probe-auth.js.map

package/dist/gateway/probe-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-auth.js","sourceRoot":"","sources":["../../src/gateway/probe-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAqBrD,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAAC,OAK9C;IACC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,CAAC,gBAAgB;YACpB,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC7C,OAAO,EAAE,OAAO,CAAC,aAAa;gBAC9B,GAAG,EAAE,iBAAiB;gBACtB,YAAY,EAAE,kBAAkB;aACjC,CAAC,CAAuB,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IAOb;IACA;IACA;IARX,MAAM,CAEA;IACN,QAAQ,CAAuD;IAEvE,YACmB,MAA6B,EAC7B,aAAqB,mCAAmC,EACxD,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAFvD,WAAM,GAAN,MAAM,CAAuB;QAC7B,eAAU,GAAV,UAAU,CAA8C;QACxD,QAAG,GAAH,GAAG,CAAoD;QAExE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAA8C,EAAE;YACpE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACnE,gEAAgE;gBAChE,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,sEAAsE;gBACtE,qCAAqC;gBACrC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACxB,OAAO,SAAS,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IAKnB;IACA;IALX,WAAW,CAAS;IACpB,KAAK,GAAG,CAAC,CAAC;IAElB,YACmB,eAAuB,6BAA6B,EACpD,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QADvD,iBAAY,GAAZ,YAAY,CAAwC;QACpD,QAAG,GAAH,GAAG,CAAoD;QAExE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,UAAU;QACR,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;YAC9B,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/gateway/signed-rate-bounds.d.ts

@@ -0,0 +1,51 @@
+import { type Address, type Hex } from "viem";
+/**
+ * Operator-SIGNED rate bounds for the gateway's capability path
+ * (metrik-agent#121 item 5, metrik-contracts#41).
+ *
+ * `StreamEscrowV2.openStream` only requires `ratePerSecond != 0`; the seller's
+ * signed `minRatePerSecond` / `maxRatePerSecond` are checked by the buyer-side
+ * SDK and the marketplace, not by the contract. A buyer who calls the escrow
+ * directly can therefore open a stream at 1 base unit per second. The gateway
+ * is the seller's own trust boundary, so it refuses to SERVE such a stream:
+ * the on-chain `ratePerSecond` must fall inside the band the operator signed.
+ *
+ * Bounds are only ever taken from a signed descriptor that verifies here — the
+ * serviceRef re-derives from the signed content and the EIP-712 signature
+ * recovers to the descriptor's operator. `CallerAuthGateway` accepts only
+ * objects this module produced, so a hand-built `{ minRatePerSecond: 0n }`
+ * cannot slip through as "signed".
+ */
+export interface SignedRateBounds {
+    /** The serviceRef the bounds were signed for (re-derived, lower-case). */
+    readonly serviceRef: Hex;
+    /** The operator whose EIP-712 signature was recovered. */
+    readonly operator: Address;
+    /** Signed minimum rate, USDC base units per second; `null` = none signed. */
+    readonly minRatePerSecond: bigint | null;
+    /** Signed maximum rate, USDC base units per second; `null` = none signed. */
+    readonly maxRatePerSecond: bigint | null;
+}
+export declare class SignedRateBoundsError extends Error {
+    constructor(message: string, options?: {
+        readonly cause?: unknown;
+    });
+}
+/** Whether `bounds` came out of {@link verifySignedRateBounds} in this process. */
+export declare function isVerifiedSignedRateBounds(bounds: unknown): bounds is SignedRateBounds;
+/**
+ * Verify a signed service descriptor and extract its operator-signed rate band.
+ * Throws {@link SignedRateBoundsError} unless the schema parses, the serviceRef
+ * re-derives from the signed content, and the signature recovers to the
+ * descriptor's operator.
+ */
+export declare function verifySignedRateBounds(signedDescriptor: unknown): Promise<SignedRateBounds>;
+/**
+ * Load and verify the signed descriptor(s) in a JSON file: one signed
+ * descriptor object, or an array of them (one per served serviceRef, e.g. a
+ * migration alias). Fail closed on any read, parse or verification error.
+ */
+export declare function loadSignedRateBoundsFile(path: string): Promise<SignedRateBounds[]>;
+/** `undefined` when `rate` is inside the band, otherwise why it is not. */
+export declare function rateOutsideBounds(rate: bigint, bounds: SignedRateBounds): string | undefined;
+//# sourceMappingURL=signed-rate-bounds.d.ts.map

package/dist/gateway/signed-rate-bounds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-rate-bounds.d.ts","sourceRoot":"","sources":["../../src/gateway/signed-rate-bounds.ts"],"names":[],"mappings":"AAOA,OAAO,EAAc,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIpE;AAID,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,GACd,MAAM,IAAI,gBAAgB,CAE5B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,gBAAgB,EAAE,OAAO,GACxB,OAAO,CAAC,gBAAgB,CAAC,CAmD3B;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA4B7B;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,GACvB,MAAM,GAAG,SAAS,CAQpB"}

package/dist/gateway/signed-rate-bounds.js

@@ -0,0 +1,94 @@
+import { readFile } from "node:fs/promises";
+import { deriveServiceRef, recoverServiceDescriptorSigner, signedServiceDescriptorSchema, } from "@absol-labs/shared";
+import { getAddress } from "viem";
+export class SignedRateBoundsError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "SignedRateBoundsError";
+    }
+}
+const verified = new WeakSet();
+/** Whether `bounds` came out of {@link verifySignedRateBounds} in this process. */
+export function isVerifiedSignedRateBounds(bounds) {
+    return typeof bounds === "object" && bounds !== null && verified.has(bounds);
+}
+/**
+ * Verify a signed service descriptor and extract its operator-signed rate band.
+ * Throws {@link SignedRateBoundsError} unless the schema parses, the serviceRef
+ * re-derives from the signed content, and the signature recovers to the
+ * descriptor's operator.
+ */
+export async function verifySignedRateBounds(signedDescriptor) {
+    const parsed = signedServiceDescriptorSchema.safeParse(signedDescriptor);
+    if (!parsed.success) {
+        throw new SignedRateBoundsError(`not a signed service descriptor: ${parsed.error.issues
+            .map((issue) => `${issue.path.join(".")}: ${issue.message}`)
+            .join("; ")}`);
+    }
+    const signed = parsed.data;
+    const derived = deriveServiceRef(signed.descriptor).toLowerCase();
+    if (signed.serviceRef.toLowerCase() !== derived) {
+        throw new SignedRateBoundsError(`the signed descriptor's serviceRef ${signed.serviceRef} does not derive from its content (${derived}); it was tampered with or re-labelled`);
+    }
+    let signer;
+    try {
+        signer = await recoverServiceDescriptorSigner(signed.descriptor, signed.signature);
+    }
+    catch (cause) {
+        throw new SignedRateBoundsError("the signed descriptor's signature could not be recovered", { cause });
+    }
+    if (signer === null ||
+        signer.toLowerCase() !== signed.descriptor.operator.toLowerCase()) {
+        throw new SignedRateBoundsError(`the descriptor for ${derived} is not signed by its operator ${signed.descriptor.operator}`);
+    }
+    const commercial = signed.descriptor.commercial;
+    const bounds = Object.freeze({
+        serviceRef: derived,
+        operator: getAddress(signed.descriptor.operator),
+        minRatePerSecond: commercial?.minRatePerSecond === undefined
+            ? null
+            : BigInt(commercial.minRatePerSecond),
+        maxRatePerSecond: commercial?.maxRatePerSecond === undefined
+            ? null
+            : BigInt(commercial.maxRatePerSecond),
+    });
+    verified.add(bounds);
+    return bounds;
+}
+/**
+ * Load and verify the signed descriptor(s) in a JSON file: one signed
+ * descriptor object, or an array of them (one per served serviceRef, e.g. a
+ * migration alias). Fail closed on any read, parse or verification error.
+ */
+export async function loadSignedRateBoundsFile(path) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (cause) {
+        throw new SignedRateBoundsError(`could not read the signed descriptor file ${path}`, { cause });
+    }
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch (cause) {
+        throw new SignedRateBoundsError(`the signed descriptor file ${path} is not valid JSON`, { cause });
+    }
+    const entries = Array.isArray(json) ? json : [json];
+    if (entries.length === 0) {
+        throw new SignedRateBoundsError(`the signed descriptor file ${path} holds no descriptor`);
+    }
+    return await Promise.all(entries.map((entry) => verifySignedRateBounds(entry)));
+}
+/** `undefined` when `rate` is inside the band, otherwise why it is not. */
+export function rateOutsideBounds(rate, bounds) {
+    if (bounds.minRatePerSecond !== null && rate < bounds.minRatePerSecond) {
+        return `rate ${rate} is below the operator-signed minimum ${bounds.minRatePerSecond}`;
+    }
+    if (bounds.maxRatePerSecond !== null && rate > bounds.maxRatePerSecond) {
+        return `rate ${rate} is above the operator-signed maximum ${bounds.maxRatePerSecond}`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=signed-rate-bounds.js.map

package/dist/gateway/signed-rate-bounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-rate-bounds.js","sourceRoot":"","sources":["../../src/gateway/signed-rate-bounds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EACL,gBAAgB,EAChB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAA0B,MAAM,MAAM,CAAC;AA8B1D,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,OAAsC;QACjE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAU,CAAC;AAEvC,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CACxC,MAAe;IAEf,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,gBAAyB;IAEzB,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,MAAM,CAAC,KAAK,CAAC,MAAM;aACpD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAS,CAAC;IACzE,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,qBAAqB,CAC7B,sCAAsC,MAAM,CAAC,UAAU,sCAAsC,OAAO,wCAAwC,CAC7I,CAAC;IACJ,CAAC;IACD,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,8BAA8B,CAC3C,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,SAAgB,CACxB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,EAC1D,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,IACE,MAAM,KAAK,IAAI;QACf,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,EACjE,CAAC;QACD,MAAM,IAAI,qBAAqB,CAC7B,sBAAsB,OAAO,kCAAkC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,MAAM,GAAqB,MAAM,CAAC,MAAM,CAAC;QAC7C,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAChD,gBAAgB,EACd,UAAU,EAAE,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACzC,gBAAgB,EACd,UAAU,EAAE,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;KAC1C,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY;IAEZ,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAC7B,6CAA6C,IAAI,EAAE,EACnD,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAC7B,8BAA8B,IAAI,oBAAoB,EACtD,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAC7B,8BAA8B,IAAI,sBAAsB,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAAwB;IAExB,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACvE,OAAO,QAAQ,IAAI,yCAAyC,MAAM,CAAC,gBAAgB,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACvE,OAAO,QAAQ,IAAI,yCAAyC,MAAM,CAAC,gBAAgB,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/gateway/x402-opener-mode.d.ts

@@ -0,0 +1,215 @@
+import { x402HTTPResourceServer, type FacilitatorClient } from "@x402/core/server";
+import type { Network } from "@x402/core/types";
+import { type Address, type PublicClient } from "viem";
+import { type OperatorSignedListingResolver } from "../x402-opener/listing-resolver.js";
+import { type OpenerTerms, type X402SchemaDeclaration } from "../x402-opener/terms.js";
+/**
+ * The gateway's x402 v2 mode (metrik-agent#116): answer an uncapabilitied
+ * request with a standard x402 v2 `402` whose `payTo` is the listing's
+ * `X402StreamOpener` address, and settle every accepted payment INTO a
+ * `StreamEscrowV2` stream through the Metrik opener facilitator.
+ *
+ * The wire format is the official `@x402/core` resource server's, not a
+ * re-implementation: `x402HTTPResourceServer` builds `PAYMENT-REQUIRED`,
+ * matches `PAYMENT-SIGNATURE`, verifies and settles through the facilitator and
+ * builds `PAYMENT-RESPONSE`.
+ *
+ * ## The opener payTo must ONLY ever be settled by the Metrik opener facilitator
+ *
+ * A stock x402 `exact` facilitator settles by calling
+ * `USDC.transferWithAuthorization(to = payTo)` directly. Pointed at an opener,
+ * that strands 100% of the payer's funds in the opener permanently (there is,
+ * deliberately, no sweep). So this mode:
+ *
+ * - refuses to START unless the configured facilitator's `GET /supported`
+ *   advertises the opener marker for exactly this factory, escrow, token and
+ *   chain; and re-checks that marker on a timer, failing CLOSED (503, no
+ *   `payTo` quoted, nothing verified or settled) whenever it cannot;
+ * - uses exactly one facilitator client, never a fallback list;
+ * - registers no discovery (Bazaar) extension and never submits the route to
+ *   any catalog. When (and only when) the operator configures an input/output
+ *   schema, it is DECLARED in the 402 in the standard `extensions.bazaar`
+ *   shape so a client can read what to send; only the Metrik opener
+ *   facilitator ever sees the payment, and it catalogs nothing;
+ * - states plainly in the 402 `description` what is bought (the stream
+ *   window, rate, that the seller earns only verified seconds, and that
+ *   unearned money is refundable without ETH through the facilitator's
+ *   refund relay) and refuses to start unless that facilitator advertises
+ *   the relay (`refundRelay: true` in its marker) — the 402 never promises a
+ *   refund path that is not there. Refunds are not automatic;
+ * - authenticates the opener only as `factory.predict(terms)` — never by code
+ *   or codehash, which a clone outside the factory can reproduce;
+ * - serves one EIP-3009 authorization at most once: a `PAYMENT-SIGNATURE`
+ *   whose authorization is in flight or already settled gets `409` WITHOUT an
+ *   upstream call (in-memory, per gateway instance). A retry after
+ *   `settlement_pending` is let through so it can reconcile;
+ * - refuses to start if its price is below the facilitator's advertised
+ *   minimum, or if its facilitator timeout would not outlast the facilitator's
+ *   receipt wait.
+ */
+/** How long a successful `/supported` marker check is trusted, seconds. */
+export declare const DEFAULT_FACILITATOR_MARKER_TTL_SECONDS = 300;
+/** Default per-request facilitator HTTP timeout. Must outlast its receipt wait. */
+export declare const DEFAULT_FACILITATOR_TIMEOUT_MS = 120000;
+export interface GatewayX402OpenerModeConfig {
+    /** Base URL of the Metrik opener facilitator (e.g. `https://facilitator.example`). */
+    readonly facilitatorUrl: string;
+    /** Bearer token the facilitator requires on `/settle`. */
+    readonly facilitatorToken: string;
+    /** CAIP-2 network (`eip155:<chainId>`), as the registry gives it. */
+    readonly network: Network;
+    readonly factoryAddress: Address;
+    /** The escrow this gateway checks streams against; the factory must point at it. */
+    readonly escrowAddress: Address;
+    /** Settlement token; must equal the factory's. */
+    readonly asset: Address;
+    /** EIP-712 domain of the token (Circle USDC: `USDC` / `2`). */
+    readonly assetName: string;
+    readonly assetVersion: string;
+    /** Opener terms. `operator` + `serviceRef` must resolve to one operator-signed listing. */
+    readonly terms: OpenerTerms;
+    /** Price per paid request in token base units. Becomes the stream deposit. */
+    readonly price: bigint;
+    /** Authorization validity the client signs for. Default 300s. */
+    readonly maxTimeoutSeconds?: number;
+    /** Public origin clients reach this gateway at, for the 402 `resource.url`. */
+    readonly resourceBaseUrl?: string;
+    /**
+     * What the service does, in one sentence. Prefixed to the fixed disclosure
+     * of what the payment buys ({@link describeOpenerPurchase}); it can never
+     * replace that disclosure.
+     */
+    readonly description?: string;
+    /**
+     * Public base URL of the facilitator's refund relay (`/streams/:streamId`).
+     * Default `facilitatorUrl`. When different, its `/supported` must advertise
+     * the same opener marker with `refundRelay: true` (checked at startup).
+     */
+    readonly refundBaseUrl?: string;
+    /** Docs link carried in the 402. Default {@link DEFAULT_OPENER_DOCS_URL}. */
+    readonly docsUrl?: string;
+    /** Token decimals for the human-readable amounts in the description. Default 6 (USDC). */
+    readonly assetDecimals?: number;
+    /**
+     * Optional input/output schema, declared in the 402 as
+     * `extensions.bazaar` (`{info: {input, output}, schema}`). Declared only;
+     * never registered with any discovery catalog.
+     */
+    readonly schemaDeclaration?: X402SchemaDeclaration;
+    /** Registry used to prove the listing at startup. Default the public registry. */
+    readonly registryUrl?: string;
+    readonly markerTtlSeconds?: number;
+    /**
+     * Per-request facilitator HTTP timeout, ms. Default
+     * {@link DEFAULT_FACILITATOR_TIMEOUT_MS}. Must exceed the facilitator's
+     * advertised receipt timeout by 30 s, so the gateway never gives up on a
+     * settlement the facilitator is still waiting for.
+     */
+    readonly facilitatorTimeoutMs?: number;
+}
+/**
+ * The plain statement of what one payment buys, used as the 402 resource
+ * `description`. It names the window, the rate, that the seller earns only for
+ * seconds Metrik's verifier confirms, and where unearned money is refundable
+ * without ETH. It says that refunds are not automatic, because they are not:
+ * someone has to call the refund relay.
+ */
+export declare function describeOpenerPurchase(input: {
+    readonly terms: OpenerTerms;
+    readonly price: bigint;
+    readonly assetDecimals: number;
+    readonly assetSymbol: string;
+    /** Refund URL template containing `{streamId}`. */
+    readonly refundUrlTemplate: string;
+    readonly docsUrl: string;
+    readonly serviceDescription?: string;
+}): string;
+export interface GatewayX402OpenerModeDeps {
+    /** Read client for the factory. Default built from `rpcUrl`. */
+    readonly publicClient?: PublicClient;
+    readonly rpcUrl?: string;
+    readonly listingResolver?: OperatorSignedListingResolver;
+    /** Override the facilitator transport (tests). Default {@link HTTPFacilitatorClient}. */
+    readonly facilitatorClient?: FacilitatorClient;
+    readonly now?: () => number;
+    /** HTTP client for checking a separate `refundBaseUrl`. Default global fetch. */
+    readonly fetch?: typeof fetch;
+}
+export interface GatewayX402OpenerMode {
+    /** The predicted opener address quoted as `payTo`. */
+    readonly payTo: Address;
+    readonly network: Network;
+    readonly terms: OpenerTerms;
+    readonly price: bigint;
+    readonly resourceBaseUrl: string | undefined;
+    /** The 402 `description` (what the payment buys). */
+    readonly description: string;
+    /** Refund relay base; a stream's refund page is `${refundBaseUrl}/streams/:streamId`. */
+    readonly refundBaseUrl: string;
+    readonly httpServer: x402HTTPResourceServer;
+    /** One-use accounting of authorizations this gateway has seen. */
+    readonly authorizations: GatewayAuthorizationLedger;
+    /**
+     * Resolves once the facilitator is proven to be the Metrik opener
+     * facilitator for this factory (cached for the marker TTL) and the resource
+     * server is initialized. Rejects otherwise — callers must fail closed.
+     */
+    ready(): Promise<void>;
+    /** Serves one x402-mode request over the supplied transport. Never throws. */
+    handle(io: X402GatewayRequestIO): Promise<void>;
+}
+/** JSON reasons the x402 path can answer with, beyond the gateway's own. */
+export type X402GatewayResponseReason = "x402-facilitator-unavailable" | "x402-settlement-failed" | "internal-error" | "upstream-unavailable" | "x402-payment-already-used";
+export interface X402UpstreamResult {
+    readonly status: number;
+    readonly headers: Record<string, string>;
+    readonly body: Buffer;
+}
+/** The transport the HTTP server hands the x402 path. */
+export interface X402GatewayRequestIO {
+    readonly requestUrl: URL;
+    readonly method: string;
+    /** Lower-cased request headers. */
+    readonly headers: Readonly<Record<string, string | undefined>>;
+    /** Proxies the request upstream (payment headers stripped) and buffers the response. */
+    callUpstream(): Promise<X402UpstreamResult>;
+    writeJson(status: number, reason: X402GatewayResponseReason): void;
+    write(status: number, headers: Record<string, string>, body: Buffer | string): void;
+    logError(context: string, error: unknown): void;
+}
+/**
+ * Per-gateway, in-memory record of EIP-3009 authorizations (chain + asset +
+ * payer + nonce): `in-flight` while a request is being verified/served/
+ * settled, `pending` after a `settlement_pending` (a retry may reconcile), and
+ * `settled` once a success was delivered. In-flight and settled
+ * authorizations are refused before the upstream is ever called. Entries are
+ * dropped once the authorization's `validBefore` has passed (plus a grace).
+ */
+export declare class GatewayAuthorizationLedger {
+    private readonly now;
+    private readonly maxEntries;
+    private readonly entries;
+    constructor(now: () => number, maxEntries?: number);
+    /** Claims the authorization for one request; false if it is in flight or settled. */
+    claim(key: string, validBefore: bigint): boolean;
+    release(key: string): void;
+    markPending(key: string, validBefore: bigint): void;
+    markSettled(key: string, validBefore: bigint): void;
+    private prune;
+}
+export declare class X402OpenerModeConfigError extends Error {
+    constructor(message: string);
+}
+export declare class X402OpenerFacilitatorUnverifiedError extends Error {
+    constructor(message: string, options?: {
+        readonly cause?: unknown;
+    });
+}
+/**
+ * Builds the x402 mode and proves, before returning, every fact it will quote:
+ * valid terms and price, one operator-signed listing for the terms, the
+ * factory's escrow and token, the predicted `payTo`, and the facilitator's
+ * opener marker. Throws on any doubt; the gateway then refuses to start.
+ */
+export declare function buildGatewayX402OpenerMode(config: GatewayX402OpenerModeConfig, deps?: GatewayX402OpenerModeDeps): Promise<GatewayX402OpenerMode>;
+//# sourceMappingURL=x402-opener-mode.d.ts.map

package/dist/gateway/x402-opener-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402-opener-mode.d.ts","sourceRoot":"","sources":["../../src/gateway/x402-opener-mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EAEtB,KAAK,iBAAiB,EAQvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,YAAY,EAClB,MAAM,MAAM,CAAC;AAGd,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAWL,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,mFAAmF;AACnF,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAKtD,MAAM,WAAW,2BAA2B;IAC1C,sFAAsF;IACtF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,MAAM,CAqBT;AAoCD,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,6BAA6B,CAAC;IACzD,yFAAyF;IACzF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,0BAA0B,CAAC;IACpD;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,4EAA4E;AAC5E,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,wBAAwB,GACxB,gBAAgB,GAChB,sBAAsB,GACtB,2BAA2B,CAAC;AAEhC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,wFAAwF;IACxF,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5C,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnE,KAAK,CACH,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,IAAI,CAAC;IACR,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACjD;AAID;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IAOnC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAP7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGpB;gBAGe,GAAG,EAAE,MAAM,MAAM,EACjB,UAAU,SAAU;IAGvC,qFAAqF;IACrF,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAUhD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI1B,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAInD,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAInD,OAAO,CAAC,KAAK;CAQd;AA2CD,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,oCAAqC,SAAQ,KAAK;gBACjD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIpE;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,2BAA2B,EACnC,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA8ShC"}