@agentsbank/sdk 1.0.10 → 1.0.13

package/dist/security-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-config.d.ts","sourceRoot":"","sources":["../security-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAwIP,MAAM,GAAG,SAAS,KAAG,OAAO;sCAU5B,MAAM,GAAG,SAAS,KAAG,OAAO;mDAKf,MAAM,KAAG,OAAO;yCAI1B,MAAM,KAAG,OAAO;;CAKlC,CAAC;AAEX;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA4B1E;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI,CAgC/D;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,IAAI,CAoBN"}

package/dist/security-config.js

@@ -0,0 +1,229 @@
+/**
+ * AgentsBank SDK Security Configuration
+ *
+ * Defines security constraints and validation rules for the SDK
+ * To be used during development and deployment validation
+ */
+export const SDK_SECURITY_CONFIG = {
+    // ============================================
+    // Required Credentials
+    // ============================================
+    requiredCredentials: [
+        'AGENTSBANK_API_URL',
+        'AGENTSBANK_API_KEY | (AGENTSBANK_AGENT_USERNAME + AGENTSBANK_AGENT_PASSWORD)'
+    ],
+    // ============================================
+    // Risk Assessment
+    // ============================================
+    riskLevel: 'HIGH', // Financial transaction platform
+    financialOperations: true,
+    autonomousExecutionAllowed: false, // DEFAULT: Must not be autonomously invocable
+    autonomousModeSupportedButOptional: true, // Can be enabled via config flag if needed
+    defaultRequiresApproval: true, // By default, all transactions require approval
+    // ============================================
+    // Credential Scope & Constraints
+    // ============================================
+    credentialScopes: {
+        'AGENTSBANK_API_URL': {
+            required: true,
+            type: 'url',
+            description: 'Base URL of AgentsBank API',
+            example: 'https://api.agentsbank.ai',
+            defaultIfMissing: null, // NO DEFAULT - must be explicit
+        },
+        'AGENTSBANK_API_KEY': {
+            required: false,
+            type: 'secret',
+            description: 'API Key for authentication (recommended)',
+            example: 'sk_live_...',
+            rotationInterval: 30 * 24 * 60 * 60 * 1000, // 30 days in ms
+            defaultIfMissing: null,
+        },
+        'AGENTSBANK_AGENT_USERNAME': {
+            required: false,
+            type: 'string',
+            description: 'Agent username (alternative auth method)',
+            example: 'agent_123',
+            defaultIfMissing: null,
+        },
+        'AGENTSBANK_AGENT_PASSWORD': {
+            required: false,
+            type: 'secret',
+            description: 'Agent password (alternative auth method)',
+            example: 'secret_password',
+            defaultIfMissing: null,
+        },
+    },
+    // ============================================
+    // Financial Operation Constraints
+    // ============================================
+    financialOperationConstraints: {
+        sendTransaction: {
+            requiresUserApprovalContext: true, // DEFAULT: Always required
+            canBypassApprovalInAutonomousMode: true, // Can be disabled if autonomousMode=true in SDKConfig
+            requiresUserId: true,
+            requiresApprovalTimestamp: true,
+            auditLoggingRequired: true,
+            atomicity: 'required', // Must succeed or fail completely
+            rollbackOnFailure: true,
+            warningIfAutonomous: 'Executing financial transaction WITHOUT human approval',
+        },
+        createWallet: {
+            requiresUserApprovalContext: false, // Optional for wallet creation
+            auditLoggingRequired: true,
+            typeValidation: ['custodial', 'non-custodial'],
+        },
+        estimateGas: {
+            requiresUserApprovalContext: false,
+            auditLoggingRequired: false, // Informational only
+            cacheable: true, // Can cache results for same params
+        },
+    },
+    // ============================================
+    // Audit Trail Requirements
+    // ============================================
+    auditRequirements: {
+        requiredFields: [
+            'timestamp',
+            'operation',
+            'status',
+            'userId', // For financial operations
+            'walletId', // For wallet operations
+        ],
+        retention: {
+            production: 7 * 365 * 24 * 60 * 60 * 1000, // 7 years
+            development: 90 * 24 * 60 * 60 * 1000, // 90 days
+        },
+        sensitiveOperations: [
+            'transaction_send',
+            'auth_login',
+            'token_refresh',
+            'wallet_create'
+        ],
+    },
+    // ============================================
+    // Deployment Constraints
+    // ============================================
+    deploymentConstraints: {
+        allowedEnvironments: ['development', 'staging', 'production'],
+        productionRequirements: [
+            'Credentials stored in secrets manager',
+            'Custom audit logger configured',
+            'Rate limiting enabled',
+            'Error monitoring (Sentry, DataDog, etc.)',
+            'Credential rotation scheduled',
+        ],
+        forbiddenPatternsInCode: [
+            'sk_live_', // API keys should not be in code
+            'sk_sandbox_',
+            'password:',
+            'secret:',
+            'token:',
+        ],
+    },
+    // ============================================
+    // Rate Limiting Defaults
+    // ============================================
+    rateLimiting: {
+        transactionsPerMinute: 5,
+        maxAmountPerTransaction: '1000', // Max 1000 of currency
+        maxDailyAmount: '10000', // Max 10000 per day per agent
+    },
+    // ============================================
+    // Validation Functions
+    // ============================================
+    validators: {
+        isValidApiUrl: (url) => {
+            if (!url)
+                return false;
+            try {
+                new URL(url);
+                return url.startsWith('https://');
+            }
+            catch {
+                return false;
+            }
+        },
+        isValidApiKey: (key) => {
+            if (!key)
+                return false;
+            return key.startsWith('sk_') && key.length > 20;
+        },
+        isValidEthereumAddress: (address) => {
+            return /^0x[a-fA-F0-9]{40}$/.test(address);
+        },
+        isValidAmount: (amount) => {
+            const num = parseFloat(amount);
+            return !isNaN(num) && num > 0;
+        },
+    },
+};
+/**
+ * Validates SDK configuration before use
+ * Throws error if validation fails
+ */
+export function validateSDKConfiguration(config) {
+    // Check required API URL
+    if (!config.apiUrl) {
+        throw new Error('SECURITY VALIDATION FAILED: AGENTSBANK_API_URL is required. ' +
+            'See SKILL.md for credential requirements.');
+    }
+    if (!SDK_SECURITY_CONFIG.validators.isValidApiUrl(config.apiUrl)) {
+        throw new Error('SECURITY VALIDATION FAILED: Invalid API URL. ' +
+            'Must be HTTPS URL. Example: https://api.agentsbank.ai');
+    }
+    // Check at least one authentication method
+    const hasApiKey = !!config.apiKey && SDK_SECURITY_CONFIG.validators.isValidApiKey(config.apiKey);
+    const hasCredentials = config.agentUsername && config.agentPassword;
+    const hasToken = !!config.token;
+    if (!hasApiKey && !hasCredentials && !hasToken) {
+        throw new Error('SECURITY VALIDATION FAILED: No authentication provided. ' +
+            'Provide one of: apiKey, (agentUsername + agentPassword), or token. ' +
+            'See SKILL.md for setup instructions.');
+    }
+}
+/**
+ * Validates user approval context for financial operations
+ */
+export function validateUserApprovalContext(approval) {
+    if (!approval) {
+        throw new Error('SECURITY ERROR: User approval context required for financial operations. ' +
+            'Cannot execute financial operations autonomously.');
+    }
+    if (!approval.userId) {
+        throw new Error('SECURITY ERROR: approval.userId required. ' +
+            'Must identify human who approved this operation.');
+    }
+    if (!approval.approvedAt || !(approval.approvedAt instanceof Date)) {
+        throw new Error('SECURITY ERROR: approval.approvedAt required (Date object). ' +
+            'Must have timestamp of when approval was granted.');
+    }
+    // Check approval is recent (within last hour)
+    const ageMs = Date.now() - approval.approvedAt.getTime();
+    const maxAgeMs = 60 * 60 * 1000; // 1 hour
+    if (ageMs > maxAgeMs) {
+        throw new Error(`SECURITY ERROR: Approval too old (${Math.round(ageMs / 1000)}s). ` +
+            'User approval must be renewed within 1 hour of transaction.');
+    }
+}
+/**
+ * Validates financial operation parameters
+ */
+export function validateFinancialOperationParams(walletId, toAddress, amount) {
+    if (!walletId) {
+        throw new Error('walletId is required');
+    }
+    if (!toAddress) {
+        throw new Error('toAddress is required');
+    }
+    if (!SDK_SECURITY_CONFIG.validators.isValidEthereumAddress(toAddress)) {
+        throw new Error(`Invalid Ethereum address: ${toAddress}`);
+    }
+    if (!amount) {
+        throw new Error('amount is required');
+    }
+    if (!SDK_SECURITY_CONFIG.validators.isValidAmount(amount)) {
+        throw new Error(`Invalid amount: ${amount}. Must be a positive number.`);
+    }
+}
+//# sourceMappingURL=security-config.js.map

package/dist/security-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-config.js","sourceRoot":"","sources":["../security-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+CAA+C;IAC/C,uBAAuB;IACvB,+CAA+C;IAC/C,mBAAmB,EAAE;QACnB,oBAAoB;QACpB,8EAA8E;KAC/E;IAED,+CAA+C;IAC/C,kBAAkB;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAe,EAAE,iCAAiC;IAC7D,mBAAmB,EAAE,IAAI;IACzB,0BAA0B,EAAE,KAAK,EAAE,8CAA8C;IACjF,kCAAkC,EAAE,IAAI,EAAE,2CAA2C;IACrF,uBAAuB,EAAE,IAAI,EAAE,gDAAgD;IAE/E,+CAA+C;IAC/C,iCAAiC;IACjC,+CAA+C;IAC/C,gBAAgB,EAAE;QAChB,oBAAoB,EAAE;YACpB,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,KAAc;YACpB,WAAW,EAAE,4BAA4B;YACzC,OAAO,EAAE,2BAA2B;YACpC,gBAAgB,EAAE,IAAI,EAAE,gCAAgC;SACzD;QACD,oBAAoB,EAAE;YACpB,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,QAAiB;YACvB,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,aAAa;YACtB,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,gBAAgB;YAC5D,gBAAgB,EAAE,IAAI;SACvB;QACD,2BAA2B,EAAE;YAC3B,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,QAAiB;YACvB,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,WAAW;YACpB,gBAAgB,EAAE,IAAI;SACvB;QACD,2BAA2B,EAAE;YAC3B,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,QAAiB;YACvB,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,iBAAiB;YAC1B,gBAAgB,EAAE,IAAI;SACvB;KACF;IAED,+CAA+C;IAC/C,kCAAkC;IAClC,+CAA+C;IAC/C,6BAA6B,EAAE;QAC7B,eAAe,EAAE;YACf,2BAA2B,EAAE,IAAI,EAAE,2BAA2B;YAC9D,iCAAiC,EAAE,IAAI,EAAE,sDAAsD;YAC/F,cAAc,EAAE,IAAI;YACpB,yBAAyB,EAAE,IAAI;YAC/B,oBAAoB,EAAE,IAAI;YAC1B,SAAS,EAAE,UAAmB,EAAE,kCAAkC;YAClE,iBAAiB,EAAE,IAAI;YACvB,mBAAmB,EAAE,wDAAwD;SAC9E;QACD,YAAY,EAAE;YACZ,2BAA2B,EAAE,KAAK,EAAE,+BAA+B;YACnE,oBAAoB,EAAE,IAAI;YAC1B,cAAc,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;SAC/C;QACD,WAAW,EAAE;YACX,2BAA2B,EAAE,KAAK;YAClC,oBAAoB,EAAE,KAAK,EAAE,qBAAqB;YAClD,SAAS,EAAE,IAAI,EAAE,oCAAoC;SACtD;KACF;IAED,+CAA+C;IAC/C,2BAA2B;IAC3B,+CAA+C;IAC/C,iBAAiB,EAAE;QACjB,cAAc,EAAE;YACd,WAAW;YACX,WAAW;YACX,QAAQ;YACR,QAAQ,EAAE,2BAA2B;YACrC,UAAU,EAAE,wBAAwB;SACrC;QACD,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU;YACrD,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAM,UAAU;SACtD;QACD,mBAAmB,EAAE;YACnB,kBAAkB;YAClB,YAAY;YACZ,eAAe;YACf,eAAe;SAChB;KACF;IAED,+CAA+C;IAC/C,yBAAyB;IACzB,+CAA+C;IAC/C,qBAAqB,EAAE;QACrB,mBAAmB,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC;QAC7D,sBAAsB,EAAE;YACtB,uCAAuC;YACvC,gCAAgC;YAChC,uBAAuB;YACvB,0CAA0C;YAC1C,+BAA+B;SAChC;QACD,uBAAuB,EAAE;YACvB,UAAU,EAAE,iCAAiC;YAC7C,aAAa;YACb,WAAW;YACX,SAAS;YACT,QAAQ;SACT;KACF;IAED,+CAA+C;IAC/C,yBAAyB;IACzB,+CAA+C;IAC/C,YAAY,EAAE;QACZ,qBAAqB,EAAE,CAAC;QACxB,uBAAuB,EAAE,MAAM,EAAE,uBAAuB;QACxD,cAAc,EAAE,OAAO,EAAE,8BAA8B;KACxD;IAED,+CAA+C;IAC/C,uBAAuB;IACvB,+CAA+C;IAC/C,UAAU,EAAE;QACV,aAAa,EAAE,CAAC,GAAuB,EAAW,EAAE;YAClD,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBACb,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,aAAa,EAAE,CAAC,GAAuB,EAAW,EAAE;YAClD,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAClD,CAAC;QAED,sBAAsB,EAAE,CAAC,OAAe,EAAW,EAAE;YACnD,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,aAAa,EAAE,CAAC,MAAc,EAAW,EAAE;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAChC,CAAC;KACF;CACO,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,yBAAyB;IACzB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC9D,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,+CAA+C;YAC/C,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjG,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;IACpE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAEhC,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0DAA0D;YAC1D,qEAAqE;YACrE,sCAAsC,CACvC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAa;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,2EAA2E;YAC3E,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,4CAA4C;YAC5C,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,YAAY,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;IAE1C,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM;YACnE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAgB,EAChB,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,8BAA8B,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsbank/sdk",
-  "version": "1.0.10",
+  "version": "1.0.13",
   "description": "🔒 Secure Financial SDK for AgentsBank - Multi-chain wallet & transaction management. Requires explicit credentials and user authorization for financial operations.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,6 +9,12 @@
     "build": "tsc",
     "publish": "npm publish"
   },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "package.json"
+  ],
   "keywords": [
     "ai-agents",
     "blockchain",

package/.env

@@ -1,38 +0,0 @@
-# AgentsBank SDK - Environment Variables
-# SECURITY WARNING: Never commit .env to version control
-
-# ============================================
-# API Configuration (REQUIRED)
-# ============================================
-# Base URL of AgentsBank API
-AGENTSBANK_API_URL=https://api.agentsbank.online
-
-# ============================================
-# Authentication (Choose ONE method)
-# ============================================
-
-# METHOD 1: API Key (Recommended for production)
-AGENTSBANK_API_KEY=your-api-key-here-do-not-share
-
-# METHOD 2: Agent Credentials (For testing/setup)
-# Uncomment and fill only if using credential-based auth
-# AGENTSBANK_AGENT_USERNAME=agent_name
-# AGENTSBANK_AGENT_PASSWORD=agent_password_secret
-
-# ============================================
-# Optional: Pre-authenticated Token
-# ============================================
-# Only needed if you have a pre-issued JWT token
-# AGENTSBANK_AUTH_TOKEN=jwt-token-here
-
-# ============================================
-# Optional: Runtime Configuration
-# ============================================
-# Timeout for API requests (in milliseconds)
-SDK_REQUEST_TIMEOUT=10000
-
-# Enable verbose logging for debugging
-SDK_DEBUG=false
-
-# Custom audit logging endpoint (optional)
-# SDK_AUDIT_LOG_ENDPOINT=https://logs.example.com/audit

package/.env.example

@@ -1,53 +0,0 @@
-# AgentsBank SDK - Environment Variables Template
-# Copy this to .env and fill in your actual credentials
-# SECURITY WARNING: Never commit .env to version control
-
-# ============================================
-# API Configuration (REQUIRED)
-# ============================================
-# Base URL of AgentsBank API
-# For local development: http://localhost:3000
-# For production: https://api.agentsbank.online
-AGENTSBANK_API_URL=https://api.agentsbank.online
-
-# ============================================
-# Authentication (Choose ONE method)
-# ============================================
-
-# METHOD 1: API Key (Recommended for production)
-AGENTSBANK_API_KEY=your-api-key-here-do-not-share
-
-# METHOD 2: Agent Credentials (For testing/setup)
-# Uncomment and fill only if using credential-based auth
-# AGENTSBANK_AGENT_USERNAME=agent_name
-# AGENTSBANK_AGENT_PASSWORD=agent_password_secret
-
-# ============================================
-# Optional: Pre-authenticated Token
-# ============================================
-# Only needed if you have a pre-issued JWT token
-# AGENTSBANK_AUTH_TOKEN=jwt-token-here
-
-# ============================================
-# Optional: Runtime Configuration
-# ============================================
-# Environment: 'production' or 'sandbox'
-AGENTSBANK_ENVIRONMENT=production
-
-# Request timeout in milliseconds
-AGENTSBANK_TIMEOUT_MS=10000
-
-# Enable audit logging
-AGENTSBANK_AUDIT_LOG=true
-
-# Webhook URL for transaction notifications (optional)
-# AGENTSBANK_WEBHOOK_URL=https://your-domain.com/webhooks/agentsbank
-
-# ============================================
-# Security Checklist
-# ============================================
-# ✓ API key obtained from https://dashboard.agentsbank.ai
-# ✓ Never commit this file to git (add to .gitignore)
-# ✓ Rotate API key monthly or when team member leaves
-# ✓ Use different credentials for development vs production
-# ✓ Enable audit logging in production

package/SKILL.md

@@ -1,250 +0,0 @@
-# AgentsBank SDK - Financial Operations Skill
-
-**Status:** Production-grade, requires explicit user invocation for financial operations  
-**Version:** 0.1.0  
-**Risk Level:** High (financial transactions)  
-**Autonomy:** ❌ Disabled for autonomous execution
-
----
-
-## ⚠️ Security & Credential Requirements
-
-This is a **financial transaction SDK** that requires explicit credentials and user authorization. It is **NOT autonomously invocable** for security reasons.
-
-### Required Environment Variables
-
-```env
-# API Configuration (REQUIRED - NO DEFAULT)
-AGENTSBANK_API_URL=https://api.agentsbank.ai
-
-# Authentication (Choose ONE)
-AGENTSBANK_API_KEY=your-api-key-here
-# OR
-AGENTSBANK_AGENT_USERNAME=agent_name
-AGENTSBANK_AGENT_PASSWORD=agent_password_secret
-
-# Optional runtime token (if pre-authenticated)
-AGENTSBANK_AUTH_TOKEN=jwt-token-here
-```
-
-- **`AGENTSBANK_API_URL`** (required): Base URL of the AgentsBank API endpoint
-  - No defaults → must be explicitly set
-  - Scope: API connectivity only
-
-- **`AGENTSBANK_API_KEY`** OR credentials (required for auth):
-  - Primary authentication method
-  - Scope: Wallet creation, transactions, balance queries
-  - Must be rotated regularly
-  - Cannot be embedded in code
-
-- **`AGENTSBANK_AUTH_TOKEN`** (optional): Pre-issued JWT token
-  - Use if already authenticated
-  - Shorter scope than API key
-
----
-
-## 🔐 Credential Security Boundaries
-
-| Operation | Credential Required | Scope | Risk |
-|-----------|-------------------|-------|------|
-| Wallet Management | API Key + Agent Auth | Read/Write | 🔴 High |
-| Transactions | API Key + Agent Auth | Write only | 🔴 Critical |
-| Balance Query | API Key | Read only | 🟡 Medium |
-| Gas Estimation | API Key | Informational | 🟢 Low |
-
----
-
-## 🚫 Autonomous Execution Policy
-
-**This SDK MUST NOT be autonomously invoked by AI agents.** Financial operations require:
-
-1. **Explicit User Confirmation** – User must authorize before any transaction
-2. **Human Review** – Transaction details must be reviewed and approved
-3. **Audit Trail** – All operations logged with timestamp and actor
-4. **Rate Limiting** – API enforces per-agent limits to prevent abuse
-
-### Enforce Constraints in Code
-
-```typescript
-// REQUIRED: Check for user authorization flag
-if (!context.userApproval) {
-  throw new Error('Financial operations require explicit user authorization');
-}
-
-// REQUIRED: Log transaction intent before execution
-logger.info('User authorized transaction', {
-  agentId: config.agentId,
-  recipient: toAddress,
-  amount: amount,
-  timestamp: new Date()
-});
-
-// REQUIRED: Never retry failed financial operations without user re-approval
-```
-
----
-
-## 📦 Installation
-
-```bash
-npm install @agentsbank/sdk
-```
-
-### Setup Steps
-
-1. **Obtain Credentials**
-   - Request API key from dashboard: https://dashboard.agentsbank.ai
-   - OR set `AGENTSBANK_AGENT_USERNAME` + `AGENTSBANK_AGENT_PASSWORD`
-   - Securely store credentials (never commit to git)
-
-2. **Configure Environment**
-   ```bash
-   cp .env.example .env
-   # Edit .env with your credentials
-   ```
-
-3. **Initialize SDK**
-   ```typescript
-   import { AgentsBankSDK } from '@agentsbank/sdk';
-   
-   const bank = new AgentsBankSDK({
-     apiUrl: process.env.AGENTSBANK_API_URL,
-     apiKey: process.env.AGENTSBANK_API_KEY,
-     // OR credentials:
-     agentUsername: process.env.AGENTSBANK_AGENT_USERNAME,
-     agentPassword: process.env.AGENTSBANK_AGENT_PASSWORD,
-   });
-   ```
-
----
-
-## 💰 Core Capabilities
-
-### Wallet Management
-- **`createWallet(chain, type)`** – Create new multi-chain wallet
-  - Chains: `ethereum`, `bsc`, `solana`
-  - Types: `custodial`, `non-custodial`
-  - ⚠️ Custodial wallets require setup confirmationSecurity
-
-- **`listWallets()`** – List all wallets for agent
-- **`getWallet(walletId)`** – Retrieve wallet details
-- **`getBalance(walletId)`** – Query wallet balance across assets
-
-### Transaction Operations
-- **`sendTransaction(walletId, toAddress, amount, currency)`** – Execute transfer
-  - **Requires:** Explicit user approval before execution
-  - **Returns:** Transaction ID for tracking
-  - **Timeout:** 300s default (configurable)
-
-- **`getTransaction(txId)`** – Retrieve transaction status
-- **`getTransactionHistory(walletId, limit)`** – List recent transactions
-- **`waitForConfirmation(txId)`** – Poll until confirmed or timeout
-
-### Utilities
-- **`estimateGas(walletId, toAddress, amount)`** – Get gas cost estimate (informational only)
-- **`getStats(walletId, days)`** – Historical transaction metrics
-- **`refreshToken()`** – Renew JWT token before expiry
-
----
-
-## 🔍 Audit & Compliance
-
-All financial operations trigger:
-
-- ✅ Agent authentication verification
-- ✅ Transaction signature & validation
-- ✅ Rate limit enforcement (per-agent per-minute)
-- ✅ Immutable audit log entry
-- ✅ Optional webhook notification to recipient
-
----
-
-## ⚡ Quick Example
-
-```typescript
-import { AgentsBankSDK } from '@agentsbank/sdk';
-
-// 1. Initialize with API Key
-const bank = new AgentsBankSDK({
-  apiUrl: 'https://api.agentsbank.ai',
-  apiKey: process.env.AGENTSBANK_API_KEY
-});
-
-// 2. Get or create wallet
-let wallet = await bank.listWallets().then(w => w[0]);
-if (!wallet) {
-  wallet = await bank.createWallet('ethereum', 'non-custodial');
-}
-
-// 3. Check balance
-const balance = await bank.getBalance(wallet.wallet_id);
-console.log('Balance:', balance);
-
-// 4. ONLY with user approval:
-if (userConfirmsTransaction) {
-  const tx = await bank.sendTransaction(
-    wallet.wallet_id,
-    '0xRecipient...',
-    '1.5',
-    'ETH'
-  );
-  console.log('Tx ID:', tx.tx_id);
-  
-  // 5. Wait for confirmation
-  const confirmed = await bank.waitForConfirmation(tx.tx_id);
-  console.log('Status:', confirmed.status);
-}
-```
-
----
-
-## 🛑 Error Handling
-
-```typescript
-try {
-  await bank.sendTransaction(walletId, recipient, amount, currency);
-} catch (error) {
-  if (error.message.includes('Invalid wallet')) {
-    console.error('Wallet not found');
-  } else if (error.message.includes('Insufficient balance')) {
-    console.error('Not enough funds');
-  } else if (error.message.includes('Rate limit exceeded')) {
-    console.error('Too many requests - try again later');
-  }
-}
-```
-
----
-
-## 🚀 Best Practices
-
-1. **Never store credentials in code** – Use environment variables only
-2. **Rotate API keys monthly** – Call `regenerateApiKey()` and update `.env`
-3. **Validate recipient addresses** – Always verify before transaction
-4. **Use non-custodial wallets** for agents when possible
-5. **Monitor transaction history** – Regular audits via `getTransactionHistory()`
-6. **Set low rate limits** – Start with 1-5 transactions/minute per agent
-7. **Enable webhook notifications** – Get real-time transaction confirmations
-
----
-
-## 📞 Support & Security Issues
-
-- Dashboard: https://dashboard.agentsbank.ai
-- Docs: https://docs.agentsbank.ai
-- Report security issues: security@agentsbank.ai (not public issues)
-
----
-
-## 📋 Compliance Notes
-
-- **OAuth2 Support**: Via API Key or JWT bearer token
-- **Webhook Support**: Transaction confirmations, balance updates
-- **Sandbox Mode**: Available via `AGENTSBANK_ENVIRONMENT=sandbox` env var
-- **Audit Trail**: All transactions immutably logged with actor, timestamp, amount
-- **PCI DSS Notes**: Private keys never transmitted over network; stored encrypted at rest
-
----
-
-**Last Updated:** February 2026  
-**Requires:** Node.js 18+, @agentsbank/sdk ^0.1.0