@aifinpay/agent 0.3.0-alpha.5 → 1.0.1

package/dist/unifiedAgent.js

@@ -42,6 +42,31 @@ const EVM_CHAIN_OBJECTS = {
     optimism,
     base,
 };
+// Mainnet USDC SPL mint on Solana (Circle native, not Wormhole-wrapped USDCet)
+const USDC_SOLANA_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+// Native Polygon USDC ERC20 (Circle-native, not bridged USDC.e)
+const USDC_POLYGON_ERC20 = "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359";
+// Minimal ERC20 balanceOf ABI fragment
+const ERC20_BALANCE_OF_ABI = [
+    {
+        type: "function",
+        name: "balanceOf",
+        stateMutability: "view",
+        inputs: [{ type: "address", name: "owner" }],
+        outputs: [{ type: "uint256" }],
+    },
+];
+// B2BSplitter.treasury() view — used to route the ipCreator royalty slot
+// when the bridge challenge doesn't name a recipient.
+const SPLITTER_TREASURY_ABI = [
+    {
+        type: "function",
+        name: "treasury",
+        stateMutability: "view",
+        inputs: [],
+        outputs: [{ type: "address" }],
+    },
+];
 // ── Errors ─────────────────────────────────────────────────────────────────
 export class ProviderUnknownError extends AiFinPayError {
 }
@@ -131,9 +156,8 @@ export class AiFinPayAgent {
             ?? "https://api.mainnet-beta.solana.com";
         // Optional RPC overrides for non-Polygon EVM chains used in bridge flows.
         // Falls back to viem's chain.rpcUrls.default if not provided.
-        const evmOpts = opts;
-        if (evmOpts.evmRpcUrls)
-            this.evmRpcUrls = evmOpts.evmRpcUrls;
+        if (opts.evmRpcUrls)
+            this.evmRpcUrls = opts.evmRpcUrls;
         if (this.polygonRpc)
             this.evmRpcUrls.polygon = this.polygonRpc;
     }
@@ -193,9 +217,11 @@ export class AiFinPayAgent {
      * chains.
      *
      * Solana key = nacl.sign.keyPair.fromSeed(seed)
-     * EVM key    = keccak256(seed)[:32]    (independent path; not BIP-44
-     *                                       compatible — see design notes
-     *                                       in 23 - Unified SDK Design).
+     * EVM key    = SHA-256("aifinpay:evm:v1\0" || seed)
+     *              (domain-separated; independent path; not BIP-44 — see
+     *               design notes in 23 - Unified SDK Design. This is the
+     *               canonical derivation both SDKs implement — the Python
+     *               SDK mirrors it byte-for-byte.)
      *
      * TODO(phase-1): replace with BIP-39/BIP-44 derivation
      *   m/44'/501'/0'/0' (Solana) + m/44'/60'/0'/0/0 (EVM) once the
@@ -215,12 +241,21 @@ export class AiFinPayAgent {
         return new AiFinPayAgent(inner, evmAccount, opts);
     }
     /**
-     * Legacy: load the Solana side from an existing keypair, then either
-     * generate a fresh EVM key or import one with `attachEvmKey`.
+     * Legacy: load the Solana side from an existing keypair. The EVM key is
+     * derived deterministically from the Solana secret's 32-byte seed
+     * (domain-separated SHA-256, same path as `fromSeed`) unless an explicit
+     * `opts.evmPrivateKey` is provided.
+     *
+     * Why deterministic: a random key here would change the EVM address on
+     * every process restart — anything sent to the previous address becomes
+     * unrecoverable because the key was never persisted or printed. With
+     * derivation, the same AIFINPAY_AGENT_SECRET always reproduces the same
+     * EVM address (this is what the MCP server relies on).
      */
     static async fromSolanaSecret(secretB58, opts = {}) {
         const inner = Agent.fromSecretB58(secretB58, opts);
-        const evmKey = opts.evmPrivateKey ?? generatePrivateKey();
+        const evmKey = opts.evmPrivateKey
+            ?? ("0x" + bytesToHex(crypto32(inner.secretKey.subarray(0, 32))));
         const evmAccount = privateKeyToAccount(evmKey);
         return new AiFinPayAgent(inner, evmAccount, opts);
     }
@@ -251,6 +286,194 @@ export class AiFinPayAgent {
         }
         return hit;
     }
+    // ── Discovery + routing (Gateway) ───────────────────────────────────────────
+    //
+    // The vision: an agent asks AiFinPay for a *capability* ("search this",
+    // "voice this") and AiFinPay finds the best provider, pays, and returns the
+    // result. Provider selection is server-side (`/api/registry/best`) so the
+    // ranking is identical whether you call via the SDK, MCP, or raw HTTP. These
+    // methods are the convenience layer over those endpoints.
+    /**
+     * Browse the provider catalog. Filter by `category` (e.g. "search",
+     * "inference", "image", "speech") and/or free-text `q`. Each entry carries
+     * live connectivity (`status`, `latency_ms`) so you can rank client-side too.
+     *
+     * Note: this discovers *services* (the marketplace). To discover *agents*
+     * published on the public network, use `search()`.
+     */
+    async discover(opts = {}) {
+        const base = this.inner.baseUrl;
+        const params = new URLSearchParams();
+        if (opts.category)
+            params.set("category", opts.category);
+        if (opts.q)
+            params.set("q", opts.q);
+        const r = await fetch(`${base}/api/registry?${params.toString()}`);
+        if (!r.ok)
+            throw new AiFinPayError(`discover ${base} → ${r.status}`);
+        const j = (await r.json());
+        const list = j.providers ?? [];
+        return opts.limit != null ? list.slice(0, Math.max(0, opts.limit)) : list;
+    }
+    /**
+     * Automatic provider selection. Asks the gateway for the single best
+     * available provider in a category (ranked by price, latency, liveness,
+     * on-chain trust). Throws `ProviderUnknownError` when nothing payable
+     * matches. Pass `maxPriceUsd` to cap the candidate set.
+     */
+    async pickProvider(category, opts = {}) {
+        const base = this.inner.baseUrl;
+        const params = new URLSearchParams();
+        if (category)
+            params.set("category", category);
+        if (opts.q)
+            params.set("q", opts.q);
+        if (opts.maxPriceUsd != null)
+            params.set("max_price_usd", String(opts.maxPriceUsd));
+        const r = await fetch(`${base}/api/registry/best?${params.toString()}`);
+        if (r.status === 404) {
+            throw new ProviderUnknownError(`No available provider for category "${category}"${opts.q ? ` matching "${opts.q}"` : ""}`);
+        }
+        if (!r.ok)
+            throw new AiFinPayError(`pickProvider ${base} → ${r.status}`);
+        const j = (await r.json());
+        if (!j.best)
+            throw new ProviderUnknownError(`No best provider returned for "${category}"`);
+        return j.best;
+    }
+    /**
+     * Capability-first paid call: pick the best provider for `category`, pay it,
+     * and return the upstream response — the "agent talks only to AiFinPay" flow.
+     * Pass `opts.provider` to skip routing and force a specific provider.
+     * Resolves to `null` only when a budget cap is hit in "skip" mode (see call()).
+     */
+    async capability(category, body, opts = {}) {
+        let providerName = opts.provider;
+        if (!providerName) {
+            const chosen = await this.pickProvider(category, { q: opts.q, maxPriceUsd: opts.maxPriceUsd });
+            providerName = chosen.name || chosen.slug;
+        }
+        return this.call({
+            provider: providerName,
+            body,
+            cost: opts.cost,
+            chain: opts.chain,
+            method: opts.method,
+            timeoutMs: opts.timeoutMs,
+            signal: opts.signal,
+        });
+    }
+    /**
+     * Web search via the best available search provider.
+     *
+     * Named `webSearch` (not `search`) on purpose: `search()` already searches
+     * the public *agent* network directory and is part of the published 1.0 API.
+     * `webSearch()` is the marketplace capability the vision calls `search()`.
+     */
+    async webSearch(query, opts = {}) {
+        const body = typeof query === "string" ? { query } : query;
+        return this.capability("search", body, opts);
+    }
+    /** Image generation via the best available image provider. */
+    async image(prompt, opts = {}) {
+        const body = typeof prompt === "string" ? { prompt } : prompt;
+        return this.capability("image", body, opts);
+    }
+    /** Text-to-speech via the best available speech provider. */
+    async voice(text, opts = {}) {
+        const body = typeof text === "string" ? { input: text } : text;
+        return this.capability("speech", body, opts);
+    }
+    /** LLM inference via the best available inference/compute provider. */
+    async infer(body, opts = {}) {
+        return this.capability("inference", body, opts);
+    }
+    // ── Network directory ─────────────────────────────────────────────────────
+    /**
+     * Publish this agent to the public AiFinPay network so other agents can
+     * discover and call it. Self-sovereign: proves control of the EVM address by
+     * signing a one-time nonce with the agent's own key (EIP-191) — no partner
+     * account needed.
+     */
+    async register(opts) {
+        const base = this.inner.baseUrl;
+        const addr = this.evmAddress.toLowerCase();
+        const nonce = await this.networkNonce();
+        const message = `AiFinPay-network-publish:polygon:${addr}:${nonce}`;
+        const signature = await this.evmAccount.signMessage({ message });
+        const r = await fetch(`${base}/api/network/agents/${addr}/publish`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                name: opts.name,
+                description: opts.description ?? null,
+                endpoint: opts.endpoint,
+                capabilities: opts.capabilities ?? [],
+                pricing: opts.pricing
+                    ? { per_call: opts.pricing.perCall, currency: opts.pricing.currency ?? "USDC" }
+                    : null,
+                nonce,
+                signature,
+            }),
+        });
+        const j = (await r.json().catch(() => ({})));
+        if (!r.ok || !j.ok || !j.agent) {
+            throw new AiFinPayError(`network publish failed: ${j.error ?? r.status}`);
+        }
+        return j.agent;
+    }
+    /** Remove this agent from the public network directory (same signature proof). */
+    async unregister() {
+        const base = this.inner.baseUrl;
+        const addr = this.evmAddress.toLowerCase();
+        const nonce = await this.networkNonce();
+        const message = `AiFinPay-network-unpublish:polygon:${addr}:${nonce}`;
+        const signature = await this.evmAccount.signMessage({ message });
+        const r = await fetch(`${base}/api/network/agents/${addr}/unpublish`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ nonce, signature }),
+        });
+        if (!r.ok) {
+            const j = (await r.json().catch(() => ({})));
+            throw new AiFinPayError(`network unpublish failed: ${j.error ?? r.status}`);
+        }
+    }
+    /**
+     * Search the public network for agents advertising a capability or matching a
+     * free-text query. Pass a bare string to search by capability
+     * (`agent.search("weather")`) or an object for finer control. Returns the
+     * directory entries; invoking one (pay + call) lands in a later release.
+     */
+    async search(query) {
+        const base = this.inner.baseUrl;
+        const params = new URLSearchParams();
+        if (typeof query === "string") {
+            params.set("capability", query);
+        }
+        else {
+            if (query.capability)
+                params.set("capability", query.capability);
+            if (query.q)
+                params.set("q", query.q);
+            if (query.limit)
+                params.set("limit", String(query.limit));
+        }
+        const r = await fetch(`${base}/api/network/agents?${params.toString()}`);
+        if (!r.ok)
+            throw new AiFinPayError(`network search ${base} → ${r.status}`);
+        const j = (await r.json());
+        return j.agents ?? [];
+    }
+    async networkNonce() {
+        const r = await fetch(`${this.inner.baseUrl}/api/network/nonce`);
+        if (!r.ok)
+            throw new AiFinPayError(`network nonce → ${r.status}`);
+        const { nonce } = (await r.json());
+        if (!nonce)
+            throw new AiFinPayError("network nonce: empty response");
+        return nonce;
+    }
     // ── Budget caps ─────────────────────────────────────────────────────────
     setBudget(caps) {
         this.budgetCaps = caps;
@@ -285,6 +508,38 @@ export class AiFinPayAgent {
     getSpend24h() {
         return this.spend24h.total24h();
     }
+    /**
+     * Sanity-check the USD estimate of an on-chain challenge amount against
+     * the declared cost and the per-call cap BEFORE signing the tx.
+     *
+     * The estimate uses env-priced MATIC/SOL (AIFINPAY_MATIC_USD /
+     * AIFINPAY_SOL_USD — same stopgap as balance()), so it is approximate.
+     * A 2x + $0.05 tolerance absorbs oracle drift while still catching the
+     * dangerous case: a bridge that quotes $0.01 in the registry and then
+     * demands 100x in the 402 challenge.
+     *
+     * Returns false (skip) instead of throwing when on_limit_exceeded="skip".
+     */
+    guardChallengeAmount(estUsd, declaredCost, providerName) {
+        if (!Number.isFinite(estUsd) || estUsd <= 0)
+            return true; // can't estimate — don't block
+        const limits = [];
+        if (declaredCost > 0)
+            limits.push(Math.max(declaredCost * 2, declaredCost + 0.05));
+        if (this.budgetCaps.per_call_usd !== undefined)
+            limits.push(this.budgetCaps.per_call_usd);
+        if (!limits.length)
+            return true; // no cap declared anywhere — caller opted out
+        const limit = Math.min(...limits);
+        if (estUsd <= limit)
+            return true;
+        const err = new BudgetCapExceededError("per_call", `bridge ${providerName} challenge demands ≈$${estUsd.toFixed(4)} on-chain, ` +
+            `above the allowed $${limit.toFixed(4)} (declared cost/per-call cap). ` +
+            `Set AIFINPAY_MATIC_USD / AIFINPAY_SOL_USD for a tighter estimate.`);
+        if ((this.budgetCaps.on_limit_exceeded ?? "throw") === "skip")
+            return false;
+        throw err;
+    }
     // ── Routing — chain selection ───────────────────────────────────────────
     /**
      * Chain selection heuristic — see Obsidian/23 - Unified SDK Design §Routing.
@@ -419,7 +674,10 @@ export class AiFinPayAgent {
     async call(opts) {
         const provider = await this.resolveProvider(opts.provider);
         const chain = this.pickChain(provider, opts);
-        const cost = opts.cost ?? provider.price_usd;
+        // Registry may carry price_usd: null — normalise to a finite number so a
+        // null/NaN cost can't poison the SpendTracker and silently disable caps.
+        const rawCost = opts.cost ?? provider.price_usd;
+        const cost = typeof rawCost === "number" && Number.isFinite(rawCost) ? rawCost : 0;
         const withinBudget = this.checkBudget(cost);
         if (!withinBudget)
             return null;
@@ -439,20 +697,26 @@ export class AiFinPayAgent {
                 return "/run";
             if (provider.service_type === "analytics")
                 return "/query";
+            if (provider.service_type === "image")
+                return "/images/generations";
+            if (provider.service_type === "speech")
+                return "/audio/speech";
             return "/";
         })();
         const buildInit = (extraHeaders = {}) => ({
             method: opts.method ?? "POST",
             headers: { "content-type": "application/json", ...extraHeaders },
             body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
-            signal: opts.signal,
+            // CallOptions.timeoutMs was previously declared but never applied.
+            signal: opts.signal
+                ?? (opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined),
         });
         // 1. Initial unauthenticated POST → expect 402 challenge from the bridge.
         const fullUrl = url.replace(/\/$/, "") + path;
         const initialResp = await this.inner.fetchImpl(fullUrl, buildInit());
         if (initialResp.status !== 402) {
             // Bridge didn't ask for payment — pass response through unchanged.
-            this.spend24h.add(cost);
+            // Nothing was paid, so the call does NOT count against budget caps.
             if (this.telemetry)
                 this.reportTelemetry({ kind: "call", provider: provider.name, chain, cost, free: true });
             return initialResp;
@@ -472,6 +736,17 @@ export class AiFinPayAgent {
                     `BRIDGE_MERCHANT_SOLANA on the bridge service.`);
             }
             const ps = challenge.pay_solana;
+            // Guard: the bridge controls the challenge — verify the demanded
+            // amount is in the same ballpark as the declared cost / caps before
+            // signing anything. Stops a misquoting bridge from draining the agent.
+            {
+                const lamports = Number(ps.total_lamports ?? ps.merchant_amount_lamports);
+                const solUsd = parseFloat(process.env.AIFINPAY_SOL_USD ?? "200");
+                const estUsd = (Number.isFinite(lamports) ? lamports / 1e9 : 0) * solUsd;
+                const guarded = this.guardChallengeAmount(estUsd, cost, provider.name);
+                if (!guarded)
+                    return null;
+            }
             const solTxSig = await this.submitSolanaB2BPayWithSplit(ps);
             const paidResp = await this.inner.fetchImpl(fullUrl, buildInit({
                 "x-solana-tx": solTxSig,
@@ -484,6 +759,12 @@ export class AiFinPayAgent {
             this.spend24h.add(cost);
             if (this.telemetry)
                 this.reportTelemetry({ kind: "call", provider: provider.name, chain, cost, tx: solTxSig });
+            // @internal — attach settlement metadata for consumers (MCP, telemetry
+            // dashboards) that need to surface the tx hash without an extra RPC
+            // call. Response headers are read-only after construction so we use
+            // an instance property + cast on the read side.
+            paidResp.aifinpayTx = solTxSig;
+            paidResp.aifinpayChain = "solana";
             return paidResp;
         }
         // ── Polygon branch (B2BSplitter.payMatic atomic split, legacy default) ──
@@ -491,7 +772,24 @@ export class AiFinPayAgent {
             throw new X402Error(`bridge ${provider.name} returned 402 but no pay_matic block — only legacy AiFinPay/Coinbase facilitators not yet wired into AiFinPayAgent.call()`);
         }
         const pm = challenge.pay_matic;
+        // Guard: same ballpark check as the Solana branch — never sign for an
+        // amount wildly above the declared cost / per-call cap.
+        {
+            const wei = Number(pm.total_wei);
+            const maticUsd = parseFloat(process.env.AIFINPAY_MATIC_USD ?? "0.70");
+            const estUsd = (Number.isFinite(wei) ? wei / 1e18 : 0) * maticUsd;
+            const guarded = this.guardChallengeAmount(estUsd, cost, provider.name);
+            if (!guarded)
+                return null;
+        }
         // 2. Submit B2BSplitter.payMatic on Polygon mainnet.
+        // ipCreator routing: prefer the challenge's explicit ip_creator; else
+        // route the royalty slot to the splitter's treasury (mirrors the Solana
+        // branch). Passing address(0) would skip the transfer and permanently
+        // strand the 1bp inside B2BSplitter — the contract has no sweep function.
+        const ipCreator = pm.ip_creator
+            ?? await this.splitterTreasury(pm.splitter)
+            ?? "0x0000000000000000000000000000000000000000";
         const { publicClient, walletClient } = this.polygonClients();
         const txHash = await walletClient.writeContract({
             address: pm.splitter,
@@ -499,7 +797,7 @@ export class AiFinPayAgent {
             functionName: "payMatic",
             args: [
                 pm.merchant_wallet,
-                "0x0000000000000000000000000000000000000000",
+                ipCreator,
                 pm.order_id,
             ],
             value: BigInt(pm.total_wei),
@@ -523,6 +821,9 @@ export class AiFinPayAgent {
         this.spend24h.add(cost);
         if (this.telemetry)
             this.reportTelemetry({ kind: "call", provider: provider.name, chain, cost, tx: txHash });
+        // @internal — see Solana branch above for rationale on property-attach.
+        paidResp.aifinpayTx = txHash;
+        paidResp.aifinpayChain = "polygon";
         return paidResp;
     }
     // ── Solana b2b_pay_with_split — build, sign, send via @solana/web3.js ───
@@ -606,13 +907,17 @@ export class AiFinPayAgent {
         const solUsd = parseFloat(process.env.AIFINPAY_SOL_USD ?? "200");
         const polygon = await this.fetchPolygonNative().catch(() => 0);
         const solana = await this.fetchSolanaNative().catch(() => 0);
+        const solana_usdc = await this.fetchSolanaUsdc().catch(() => 0);
+        const polygon_usdc = await this.fetchPolygonUsdc().catch(() => 0);
         const polygonUsd = polygon * maticUsd;
         const solanaUsd = solana * solUsd;
+        const solanaUsdcUsd = solana_usdc; // USDC ≈ $1
+        const polygonUsdcUsd = polygon_usdc; // USDC ≈ $1
         return {
-            agent_balance_usd: polygonUsd + solanaUsd,
+            agent_balance_usd: polygonUsd + solanaUsd + solanaUsdcUsd + polygonUsdcUsd,
             chains: {
-                solana: { sol: solana, usdc: 0, msecco_balance: 0 },
-                polygon: { matic: polygon, usdc: 0, msecco_balance: 0 },
+                solana: { sol: solana, usdc: solana_usdc, msecco_balance: 0 },
+                polygon: { matic: polygon, usdc: polygon_usdc, msecco_balance: 0 },
             },
             spend_24h_usd: this.spend24h.total24h(),
             budget_caps: this.budgetCaps,
@@ -627,8 +932,9 @@ export class AiFinPayAgent {
         return Number(wei) / 1e18;
     }
     async fetchSolanaNative() {
-        // Use raw JSON-RPC to avoid pulling @solana/web3.js as a dep.
-        const rpc = process.env.AIFINPAY_SOLANA_RPC || "https://api.mainnet.solana.com";
+        // Raw JSON-RPC; honours the constructor's solanaRpc option (previously
+        // re-read env here with a different default endpoint).
+        const rpc = this.solanaRpc;
         const r = await this.inner.fetchImpl(rpc, {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -645,6 +951,91 @@ export class AiFinPayAgent {
         const lamports = j.result?.value ?? 0;
         return lamports / 1e9;
     }
+    /**
+     * Sum SPL USDC balances across all token accounts owned by the agent's
+     * Solana pubkey. Uses raw JSON-RPC `getTokenAccountsByOwner` so we don't
+     * pull `@solana/spl-token` as a dep. Returns 0 (never throws) when the
+     * RPC is unreachable or returns nothing — `balance()` must remain a
+     * non-blocking introspection call.
+     */
+    async fetchSolanaUsdc() {
+        const rpc = this.solanaRpc;
+        try {
+            const r = await this.inner.fetchImpl(rpc, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: 1,
+                    method: "getTokenAccountsByOwner",
+                    params: [
+                        this.solanaAddress,
+                        { mint: USDC_SOLANA_MINT },
+                        { encoding: "jsonParsed" },
+                    ],
+                }),
+            });
+            if (!r.ok)
+                return 0;
+            const j = (await r.json());
+            // Sum all USDC token accounts (usually just one, but be safe)
+            const accounts = j.result?.value ?? [];
+            let total = 0;
+            for (const acc of accounts) {
+                const ui = acc.account?.data?.parsed?.info?.tokenAmount?.uiAmount;
+                if (typeof ui === "number")
+                    total += ui;
+            }
+            return total;
+        }
+        catch {
+            return 0; // never block balance() on Solana RPC issues
+        }
+    }
+    // Cache: splitter address → treasury address (constant per deployment).
+    splitterTreasuryCache = new Map();
+    /** Read + cache B2BSplitter.treasury(). Returns null on RPC failure. */
+    async splitterTreasury(splitter) {
+        const cached = this.splitterTreasuryCache.get(splitter.toLowerCase());
+        if (cached)
+            return cached;
+        try {
+            const { publicClient } = this.polygonClients();
+            const treasury = await publicClient.readContract({
+                address: splitter,
+                abi: SPLITTER_TREASURY_ABI,
+                functionName: "treasury",
+            });
+            if (!treasury || treasury === "0x0000000000000000000000000000000000000000")
+                return null;
+            this.splitterTreasuryCache.set(splitter.toLowerCase(), treasury);
+            return treasury;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Read the native Polygon USDC (Circle-issued, 6 decimals) balance for the
+     * agent's EVM address via the existing viem publicClient. Returns 0
+     * (never throws) on RPC failure — see fetchSolanaUsdc rationale.
+     */
+    async fetchPolygonUsdc() {
+        try {
+            const { publicClient } = this.polygonClients();
+            const raw = await publicClient.readContract({
+                address: USDC_POLYGON_ERC20,
+                abi: ERC20_BALANCE_OF_ABI,
+                functionName: "balanceOf",
+                args: [this.evmAccount.address],
+            });
+            // USDC has 6 decimals on Polygon
+            return Number(raw) / 1e6;
+        }
+        catch {
+            return 0;
+        }
+    }
     // ── Reputation ──────────────────────────────────────────────────────────
     /**
      * TODO(phase-4 / phase-5): query operator backend reputation engine.
@@ -695,15 +1086,10 @@ function bytesToHex(b) {
  * before audit-grade derivation lands.
  */
 function crypto32(seed) {
-    // Lazy require to avoid pulling node:crypto into bundlers that don't need it.
-    const c = globalThis.crypto;
-    if (c?.subtle) {
-        // Browser / modern Node — but subtle is async, and we're sync here.
-        // Fall through to the node:crypto path.
-    }
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const nodeCrypto = require("node:crypto");
-    const h = nodeCrypto.createHash("sha256");
+    // Must stay sync (constructors call it). Uses the createHash imported at
+    // the top of this file — a bare `require()` is a ReferenceError here
+    // because this package ships as ESM ("type": "module").
+    const h = createHash("sha256");
     h.update("aifinpay:evm:v1\0");
     h.update(seed);
     return new Uint8Array(h.digest());