@arc402/daemon 1.2.0

package/dist/credentials.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIALS_PATH = void 0;
+exports.loadCredentials = loadCredentials;
+exports.getEnabledProviders = getEnabledProviders;
+exports.getDockerEnvFlags = getDockerEnvFlags;
+exports.getProviderHosts = getProviderHosts;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+exports.CREDENTIALS_PATH = path.join(os.homedir(), ".arc402", "worker", "credentials.toml");
+async function loadCredentials() {
+    if (!fs.existsSync(exports.CREDENTIALS_PATH))
+        return null;
+    const { parse } = await Promise.resolve().then(() => __importStar(require("smol-toml")));
+    const raw = fs.readFileSync(exports.CREDENTIALS_PATH, "utf-8");
+    return parse(raw);
+}
+async function getEnabledProviders() {
+    const creds = await loadCredentials();
+    if (!creds?.providers)
+        return [];
+    return Object.entries(creds.providers)
+        .filter(([_name, p]) => p.enabled)
+        .map(([name, p]) => ({
+        name,
+        env: p.env,
+        hosts: p.hosts || [],
+        auth: p.auth || "api_key",
+        hasKey: p.env ? !!process.env[p.env] : false,
+    }));
+}
+async function getDockerEnvFlags() {
+    const providers = await getEnabledProviders();
+    const flags = [];
+    for (const p of providers) {
+        if (p.env && process.env[p.env]) {
+            flags.push("-e", `${p.env}=${process.env[p.env]}`);
+        }
+    }
+    return flags;
+}
+async function getProviderHosts() {
+    const providers = await getEnabledProviders();
+    return providers.flatMap(p => p.hosts);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,0CAKC;AAED,kDAmBC;AAED,8CASC;AAED,4CAGC;AA7DD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAeZ,QAAA,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAE1F,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,wBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,KAAK,EAAE,GAAG,wDAAa,WAAW,GAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,wBAAgB,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,GAAG,CAAiC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,mBAAmB;IAOvC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,SAAS;QAAE,OAAO,EAAE,CAAC;IAEjC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,IAAI;QACJ,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK;KAC7C,CAAC,CAAC,CAAC;AACR,CAAC;AAEM,KAAK,UAAU,iBAAiB;IACrC,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,gBAAgB;IACpC,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/delivery-client.d.ts

@@ -0,0 +1,35 @@
+export interface VerificationResult {
+    ok: boolean;
+    agreementId: string;
+    rootHashMatch: boolean;
+    fileResults: Array<{
+        name: string;
+        hashMatch: boolean;
+        expected: string;
+        actual: string;
+    }>;
+    error?: string;
+}
+export declare class DeliveryClient {
+    private readonly autoDownload;
+    log: (entry: Record<string, unknown>) => void;
+    constructor(opts?: {
+        autoDownload?: boolean;
+    });
+    /**
+     * Handle an incoming delivery notification.
+     * If auto_download is true, downloads and verifies the files.
+     * Returns a VerificationResult.
+     */
+    handleDeliveryNotification(params: {
+        agreementId: string;
+        deliverableHash: string;
+        filesUrl?: string;
+    }): Promise<VerificationResult | null>;
+    private deriveManifestUrl;
+    private downloadAndVerify;
+    private computeRootHash;
+    private fetchJson;
+    private fetchBytes;
+}
+//# sourceMappingURL=delivery-client.d.ts.map

package/dist/delivery-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-client.d.ts","sourceRoot":"","sources":["../src/delivery-client.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAY;gBAE7C,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO;IAIjD;;;;OAIG;IACG,0BAA0B,CAAC,MAAM,EAAE;QACvC,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IA8EtC,OAAO,CAAC,iBAAiB;YAiBX,iBAAiB;IAuB/B,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,SAAS;IA6BjB,OAAO,CAAC,UAAU;CAiCnB"}

package/dist/delivery-client.js

@@ -0,0 +1,231 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeliveryClient = void 0;
+/**
+ * ARC-402 Delivery Client
+ *
+ * When this agent receives a /delivery notification with a files_url, this
+ * module fetches the manifest, downloads each file, verifies all keccak256
+ * hashes, and verifies the root hash against the on-chain delivery hash.
+ *
+ * Flow:
+ *   1. Receive POST /delivery { agreementId, deliverableHash, files_url }
+ *   2. Fetch manifest from <files_url base>/manifest
+ *   3. Download each file to local job dir
+ *   4. Verify keccak256 of each file matches manifest
+ *   5. Verify root hash matches on-chain deliverableHash
+ *   6. Return verification result
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const ethers_1 = require("ethers");
+const job_lifecycle_js_1 = require("./job-lifecycle.js");
+// ─── DeliveryClient ───────────────────────────────────────────────────────────
+class DeliveryClient {
+    constructor(opts = {}) {
+        this.log = () => { };
+        this.autoDownload = opts.autoDownload ?? true;
+    }
+    /**
+     * Handle an incoming delivery notification.
+     * If auto_download is true, downloads and verifies the files.
+     * Returns a VerificationResult.
+     */
+    async handleDeliveryNotification(params) {
+        const { agreementId, deliverableHash, filesUrl } = params;
+        if (!this.autoDownload) {
+            this.log({ event: "delivery_client_skipped", agreement_id: agreementId, reason: "auto_download_disabled" });
+            return null;
+        }
+        if (!filesUrl) {
+            this.log({ event: "delivery_client_skipped", agreement_id: agreementId, reason: "no_files_url" });
+            return null;
+        }
+        this.log({ event: "delivery_download_start", agreement_id: agreementId, files_url: filesUrl });
+        try {
+            // Derive manifest URL from files_url
+            // files_url = https://host/job/abc/files  → manifest = https://host/job/abc/manifest
+            const manifestUrl = this.deriveManifestUrl(filesUrl);
+            // Fetch manifest
+            const manifest = await this.fetchJson(manifestUrl);
+            this.log({ event: "manifest_fetched", agreement_id: agreementId, file_count: manifest.files.length, root_hash: manifest.root_hash });
+            // Create local job directory for client
+            const jobDir = (0, job_lifecycle_js_1.createJobDirectory)(agreementId);
+            // Download and verify each file
+            const fileResults = [];
+            let allFilesMatch = true;
+            for (const fileEntry of manifest.files) {
+                const fileUrl = `${filesUrl.replace(/\/$/, "")}/${encodeURIComponent(fileEntry.name)}`;
+                const result = await this.downloadAndVerify(fileUrl, fileEntry, jobDir);
+                fileResults.push(result);
+                if (!result.hashMatch)
+                    allFilesMatch = false;
+            }
+            // Verify root hash
+            const actualRootHash = this.computeRootHash(manifest.files.map(f => f.hash));
+            const rootHashMatch = actualRootHash.toLowerCase() === deliverableHash.toLowerCase() &&
+                actualRootHash.toLowerCase() === manifest.root_hash.toLowerCase();
+            const ok = allFilesMatch && rootHashMatch;
+            const result = {
+                ok,
+                agreementId,
+                rootHashMatch,
+                fileResults,
+            };
+            this.log({
+                event: "delivery_verified",
+                agreement_id: agreementId,
+                ok,
+                root_hash_match: rootHashMatch,
+                files_verified: fileResults.length,
+                files_ok: fileResults.filter(f => f.hashMatch).length,
+            });
+            return result;
+        }
+        catch (err) {
+            const error = String(err instanceof Error ? err.message : err);
+            this.log({ event: "delivery_verify_error", agreement_id: agreementId, error });
+            return {
+                ok: false,
+                agreementId,
+                rootHashMatch: false,
+                fileResults: [],
+                error,
+            };
+        }
+    }
+    // ── Private helpers ───────────────────────────────────────────────────────
+    deriveManifestUrl(filesUrl) {
+        // Strip trailing slash
+        const base = filesUrl.replace(/\/$/, "");
+        // Replace /files at end with /manifest, or append /manifest
+        if (base.endsWith("/files")) {
+            return base.slice(0, -6) + "/manifest";
+        }
+        // Fallback: try stripping /files/ prefix from last segment
+        const parts = base.split("/");
+        const lastPart = parts[parts.length - 1];
+        if (lastPart === "files") {
+            parts[parts.length - 1] = "manifest";
+            return parts.join("/");
+        }
+        return base + "/manifest";
+    }
+    async downloadAndVerify(url, expected, destDir) {
+        const data = await this.fetchBytes(url);
+        const actual = ethers_1.ethers.keccak256(data);
+        const hashMatch = actual.toLowerCase() === expected.hash.toLowerCase();
+        if (hashMatch) {
+            // Write to job dir
+            const destPath = path.join(destDir, path.basename(expected.name));
+            fs.writeFileSync(destPath, data);
+        }
+        return {
+            name: expected.name,
+            hashMatch,
+            expected: expected.hash,
+            actual,
+        };
+    }
+    computeRootHash(fileHashes) {
+        if (fileHashes.length === 0) {
+            return ethers_1.ethers.keccak256(new Uint8Array(0));
+        }
+        const sorted = [...fileHashes].sort();
+        const allBytes = Buffer.concat(sorted.map(h => Buffer.from(ethers_1.ethers.getBytes(h))));
+        return ethers_1.ethers.keccak256(allBytes);
+    }
+    fetchJson(url) {
+        return new Promise((resolve, reject) => {
+            const parsed = new URL(url);
+            const mod = parsed.protocol === "https:" ? https : http;
+            const req = mod.get(url, { headers: { "Accept": "application/json" } }, (res) => {
+                if (res.statusCode !== 200) {
+                    reject(new Error(`fetch_manifest_failed: HTTP ${res.statusCode} for ${url}`));
+                    res.resume();
+                    return;
+                }
+                let raw = "";
+                res.on("data", (c) => { raw += c.toString(); });
+                res.on("end", () => {
+                    try {
+                        resolve(JSON.parse(raw));
+                    }
+                    catch {
+                        reject(new Error(`invalid_manifest_json from ${url}`));
+                    }
+                });
+            });
+            req.on("error", (err) => reject(new Error(`network_error: ${err.message}`)));
+            req.setTimeout(30000, () => {
+                req.destroy(new Error("fetch_timeout"));
+            });
+        });
+    }
+    fetchBytes(url) {
+        return new Promise((resolve, reject) => {
+            const parsed = new URL(url);
+            const mod = parsed.protocol === "https:" ? https : http;
+            const MAX_FILE_BYTES = 200 * 1024 * 1024; // 200MB hard cap for downloads
+            const req = mod.get(url, (res) => {
+                if (res.statusCode !== 200) {
+                    reject(new Error(`fetch_file_failed: HTTP ${res.statusCode} for ${url}`));
+                    res.resume();
+                    return;
+                }
+                const chunks = [];
+                let total = 0;
+                res.on("data", (chunk) => {
+                    total += chunk.length;
+                    if (total > MAX_FILE_BYTES) {
+                        req.destroy(new Error("file_too_large"));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                res.on("end", () => resolve(Buffer.concat(chunks)));
+            });
+            req.on("error", (err) => reject(new Error(`network_error: ${err.message}`)));
+            req.setTimeout(120000, () => {
+                req.destroy(new Error("download_timeout"));
+            });
+        });
+    }
+}
+exports.DeliveryClient = DeliveryClient;
+//# sourceMappingURL=delivery-client.js.map

package/dist/delivery-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-client.js","sourceRoot":"","sources":["../src/delivery-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;GAcG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,2CAA6B;AAC7B,6CAA+B;AAC/B,mCAAgC;AAChC,yDAAwD;AAkBxD,iFAAiF;AAEjF,MAAa,cAAc;IAIzB,YAAY,OAAmC,EAAE;QAFjD,QAAG,GAA6C,GAAG,EAAE,GAAE,CAAC,CAAC;QAGvD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,0BAA0B,CAAC,MAIhC;QACC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAE1D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC5G,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE/F,IAAI,CAAC;YACH,qCAAqC;YACrC,qFAAqF;YACrF,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAErD,iBAAiB;YACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAmB,WAAW,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YAErI,wCAAwC;YACxC,MAAM,MAAM,GAAG,IAAA,qCAAkB,EAAC,WAAW,CAAC,CAAC;YAE/C,gCAAgC;YAChC,MAAM,WAAW,GAAsC,EAAE,CAAC;YAC1D,IAAI,aAAa,GAAG,IAAI,CAAC;YAEzB,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACxE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,SAAS;oBAAE,aAAa,GAAG,KAAK,CAAC;YAC/C,CAAC;YAED,mBAAmB;YACnB,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,WAAW,EAAE;gBAC/D,cAAc,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAEvF,MAAM,EAAE,GAAG,aAAa,IAAI,aAAa,CAAC;YAE1C,MAAM,MAAM,GAAuB;gBACjC,EAAE;gBACF,WAAW;gBACX,aAAa;gBACb,WAAW;aACZ,CAAC;YAEF,IAAI,CAAC,GAAG,CAAC;gBACP,KAAK,EAAE,mBAAmB;gBAC1B,YAAY,EAAE,WAAW;gBACzB,EAAE;gBACF,eAAe,EAAE,aAAa;gBAC9B,cAAc,EAAE,WAAW,CAAC,MAAM;gBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;aACtD,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAEhB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,WAAW;gBACX,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,EAAE;gBACf,KAAK;aACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAErE,iBAAiB,CAAC,QAAgB;QACxC,uBAAuB;QACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,4DAA4D;QAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC;QACzC,CAAC;QACD,2DAA2D;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC;YACrC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,GAAG,WAAW,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,GAAW,EACX,QAA2B,EAC3B,OAAe;QAEf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,eAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAEvE,IAAI,SAAS,EAAE,CAAC;YACd,mBAAmB;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS;YACT,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,MAAM;SACP,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,UAAoB;QAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,eAAM,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,eAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEO,SAAS,CAAI,GAAW;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAExD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9E,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC9E,GAAG,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7E,GAAG,CAAC,UAAU,CAAC,KAAM,EAAE,GAAG,EAAE;gBAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,+BAA+B;YAEzE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC1E,GAAG,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;gBAEd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;oBACtB,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;wBAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;wBACzC,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7E,GAAG,CAAC,UAAU,CAAC,MAAO,EAAE,GAAG,EAAE;gBAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA9MD,wCA8MC"}

package/dist/endpoint-policy.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingHttpHeaders } from "http";
+export declare function resolveJobId(headers: IncomingHttpHeaders): string | null;
+export declare function hasExplicitCommerceDelegation(payload: unknown, endpoint: string): boolean;
+export declare class EndpointPolicy {
+    private readonly activeJobLocks;
+    lockForJob(jobId: string): void;
+    grantCommerceDelegate(jobId: string): void;
+    releaseJob(jobId: string): void;
+    isAllowed(jobId: string | null, endpoint: string): boolean;
+}
+//# sourceMappingURL=endpoint-policy.d.ts.map

package/dist/endpoint-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-policy.d.ts","sourceRoot":"","sources":["../src/endpoint-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAkChD,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAKxE;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkCzF;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAEjE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI/B,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI1C,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI/B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;CAU3D"}

package/dist/endpoint-policy.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EndpointPolicy = void 0;
+exports.resolveJobId = resolveJobId;
+exports.hasExplicitCommerceDelegation = hasExplicitCommerceDelegation;
+const LOCKED_COMMERCE_ENDPOINTS = new Set([
+    "/hire",
+    "/subscribe",
+    "/compute/propose",
+    "/compute/hire",
+]);
+function isTruthy(value) {
+    if (typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        return value !== 0;
+    }
+    if (typeof value === "string") {
+        return ["1", "true", "yes", "allow", "granted", "*"].includes(value.trim().toLowerCase());
+    }
+    return false;
+}
+function objectHasEndpointDelegate(value, endpoint) {
+    if (isTruthy(value.commerce))
+        return true;
+    if (isTruthy(value.allowCommerce))
+        return true;
+    if (isTruthy(value.allow_commerce))
+        return true;
+    if (isTruthy(value.allowed))
+        return true;
+    if (isTruthy(value.all))
+        return true;
+    if (Array.isArray(value.endpoints)) {
+        return value.endpoints.some((entry) => typeof entry === "string" && (entry === endpoint || entry === "*"));
+    }
+    return false;
+}
+function resolveJobId(headers) {
+    const raw = headers["x-arc402-job-id"];
+    if (typeof raw === "string" && raw.trim())
+        return raw.trim();
+    if (Array.isArray(raw) && raw[0]?.trim())
+        return raw[0].trim();
+    return null;
+}
+function hasExplicitCommerceDelegation(payload, endpoint) {
+    if (!payload || typeof payload !== "object") {
+        return false;
+    }
+    const record = payload;
+    const directKeys = [
+        "commerceDelegation",
+        "grantCommerceDelegation",
+        "allowCommerceDelegation",
+        "allow_commerce_delegation",
+        "commerceDelegate",
+    ];
+    for (const key of directKeys) {
+        if (isTruthy(record[key])) {
+            return true;
+        }
+        const value = record[key];
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            if (objectHasEndpointDelegate(value, endpoint)) {
+                return true;
+            }
+        }
+    }
+    if (Array.isArray(record.delegatedEndpoints)) {
+        return record.delegatedEndpoints.some((value) => typeof value === "string" && (value === endpoint || value === "*"));
+    }
+    if (Array.isArray(record.allowedEndpoints)) {
+        return record.allowedEndpoints.some((value) => typeof value === "string" && (value === endpoint || value === "*"));
+    }
+    if (record.delegation && typeof record.delegation === "object" && !Array.isArray(record.delegation)) {
+        return objectHasEndpointDelegate(record.delegation, endpoint);
+    }
+    return false;
+}
+class EndpointPolicy {
+    constructor() {
+        this.activeJobLocks = new Map();
+    }
+    lockForJob(jobId) {
+        this.activeJobLocks.set(jobId, new Set(LOCKED_COMMERCE_ENDPOINTS));
+    }
+    grantCommerceDelegate(jobId) {
+        this.activeJobLocks.get(jobId)?.clear();
+    }
+    releaseJob(jobId) {
+        this.activeJobLocks.delete(jobId);
+    }
+    isAllowed(jobId, endpoint) {
+        if (!jobId) {
+            return true;
+        }
+        const locks = this.activeJobLocks.get(jobId);
+        if (!locks) {
+            return true;
+        }
+        return !locks.has(endpoint);
+    }
+}
+exports.EndpointPolicy = EndpointPolicy;
+//# sourceMappingURL=endpoint-policy.js.map

package/dist/endpoint-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-policy.js","sourceRoot":"","sources":["../src/endpoint-policy.ts"],"names":[],"mappings":";;;AAkCA,oCAKC;AAED,sEAkCC;AAzED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,OAAO;IACP,YAAY;IACZ,kBAAkB;IAClB,eAAe;CAChB,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,KAA8B,EAAE,QAAgB;IACjF,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,YAAY,CAAC,OAA4B;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,6BAA6B,CAAC,OAAgB,EAAE,QAAgB;IAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,UAAU,GAAG;QACjB,oBAAoB;QACpB,yBAAyB;QACzB,yBAAyB;QACzB,2BAA2B;QAC3B,kBAAkB;KACnB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,IAAI,yBAAyB,CAAC,KAAgC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC1E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACpG,OAAO,yBAAyB,CAAC,MAAM,CAAC,UAAqC,EAAE,QAAQ,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAa,cAAc;IAA3B;QACmB,mBAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAwBnE,CAAC;IAtBC,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,qBAAqB,CAAC,KAAa;QACjC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,KAAoB,EAAE,QAAgB;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF;AAzBD,wCAyBC"}

package/dist/event-watchers.d.ts

@@ -0,0 +1,11 @@
+export interface WatcherConfig {
+    rpcUrl: string;
+    wallet: `0x${string}`;
+    chainId: number;
+}
+export declare class ProtocolEventWatcher {
+    constructor(_config: WatcherConfig);
+    start(): void;
+    stop(): void;
+}
+//# sourceMappingURL=event-watchers.d.ts.map

package/dist/event-watchers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-watchers.d.ts","sourceRoot":"","sources":["../src/event-watchers.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,oBAAoB;gBACnB,OAAO,EAAE,aAAa;IAUlC,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,IAAI;CAGb"}

package/dist/event-watchers.js

@@ -0,0 +1,24 @@
+"use strict";
+// ProtocolEventWatcher — on-chain event subscriptions (Spec 46 §10)
+// TODO: implement ServiceAgreement, IntelligenceRegistry, ArenaPool event watchers
+// TODO: emit SSE events: exec.simulated, exec.signed, exec.submitted, exec.finalized, wallet.frozen
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProtocolEventWatcher = void 0;
+class ProtocolEventWatcher {
+    constructor(_config) {
+        // TODO: initialize ethers provider + event subscriptions
+    }
+    // TODO: watch ServiceAgreement: ProposalCreated, ProposalAccepted, WorkDelivered, PaymentReleased
+    // TODO: watch IntelligenceRegistry: AgentRegistered, AgentUpdated
+    // TODO: watch ArenaPool: PoolDeposit, PoolWithdrawal, HandshakeSent
+    // TODO: watch wallet: frozen state via guardian on-chain event (emit wallet.frozen SSE)
+    // TODO: watch verify window expiry for dispute evidence collection
+    start() {
+        // TODO: begin polling / websocket subscription
+    }
+    stop() {
+        // TODO: clean up subscriptions
+    }
+}
+exports.ProtocolEventWatcher = ProtocolEventWatcher;
+//# sourceMappingURL=event-watchers.js.map

package/dist/event-watchers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-watchers.js","sourceRoot":"","sources":["../src/event-watchers.ts"],"names":[],"mappings":";AAAA,oEAAoE;AACpE,mFAAmF;AACnF,oGAAoG;;;AAQpG,MAAa,oBAAoB;IAC/B,YAAY,OAAsB;QAChC,yDAAyD;IAC3D,CAAC;IAED,kGAAkG;IAClG,kEAAkE;IAClE,oEAAoE;IACpE,wFAAwF;IACxF,mEAAmE;IAEnE,KAAK;QACH,+CAA+C;IACjD,CAAC;IAED,IAAI;QACF,+BAA+B;IACjC,CAAC;CACF;AAlBD,oDAkBC"}

package/dist/exec-state.d.ts

@@ -0,0 +1,37 @@
+/**
+ * ExecState machine — UserOp execution lifecycle tracking.
+ * Spec 46 §16 Pattern 4.
+ * Persisted to SQLite per-transition.
+ */
+export declare enum ExecState {
+    RECEIVED = "received",
+    SESSION_OK = "session_ok",
+    POLICY_OK = "policy_ok",
+    BUILT = "built",
+    SIMULATED = "simulated",
+    SIGNED = "signed",
+    SUBMITTED = "submitted",
+    INCLUDED = "included",
+    FINALIZED = "finalized",
+    REJECTED = "rejected"
+}
+export declare const ALLOWED_TRANSITIONS: Record<ExecState, ExecState[]>;
+export interface ExecRecord {
+    requestId: string;
+    sessionId: string;
+    wallet: string;
+    target: string;
+    calldataHash: string;
+    state: ExecState;
+    reason?: string;
+    timestamp: number;
+}
+/**
+ * Validate a state transition. Throws if the transition is not allowed.
+ */
+export declare function validateTransition(from: ExecState, to: ExecState): void;
+/**
+ * Returns true if the given state is a terminal state (no further transitions).
+ */
+export declare function isTerminal(state: ExecState): boolean;
+//# sourceMappingURL=exec-state.d.ts.map

package/dist/exec-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-state.d.ts","sourceRoot":"","sources":["../src/exec-state.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,SAAS;IACnB,QAAQ,aAAc;IACtB,UAAU,eAAe;IACzB,SAAS,cAAe;IACxB,KAAK,UAAe;IACpB,SAAS,cAAe;IACxB,MAAM,WAAe;IACrB,SAAS,cAAe;IACxB,QAAQ,aAAe;IACvB,SAAS,cAAe;IACxB,QAAQ,aAAe;CACxB;AAGD,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,CAW9D,CAAC;AAGF,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAQvE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAEpD"}

package/dist/exec-state.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * ExecState machine — UserOp execution lifecycle tracking.
+ * Spec 46 §16 Pattern 4.
+ * Persisted to SQLite per-transition.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOWED_TRANSITIONS = exports.ExecState = void 0;
+exports.validateTransition = validateTransition;
+exports.isTerminal = isTerminal;
+var ExecState;
+(function (ExecState) {
+    ExecState["RECEIVED"] = "received";
+    ExecState["SESSION_OK"] = "session_ok";
+    ExecState["POLICY_OK"] = "policy_ok";
+    ExecState["BUILT"] = "built";
+    ExecState["SIMULATED"] = "simulated";
+    ExecState["SIGNED"] = "signed";
+    ExecState["SUBMITTED"] = "submitted";
+    ExecState["INCLUDED"] = "included";
+    ExecState["FINALIZED"] = "finalized";
+    ExecState["REJECTED"] = "rejected";
+})(ExecState || (exports.ExecState = ExecState = {}));
+// Allowed transitions only — any other transition throws
+exports.ALLOWED_TRANSITIONS = {
+    [ExecState.RECEIVED]: [ExecState.SESSION_OK, ExecState.REJECTED],
+    [ExecState.SESSION_OK]: [ExecState.POLICY_OK, ExecState.REJECTED],
+    [ExecState.POLICY_OK]: [ExecState.BUILT, ExecState.REJECTED],
+    [ExecState.BUILT]: [ExecState.SIMULATED, ExecState.REJECTED],
+    [ExecState.SIMULATED]: [ExecState.SIGNED, ExecState.REJECTED], // ← only state that may call signer
+    [ExecState.SIGNED]: [ExecState.SUBMITTED, ExecState.REJECTED],
+    [ExecState.SUBMITTED]: [ExecState.INCLUDED, ExecState.REJECTED],
+    [ExecState.INCLUDED]: [ExecState.FINALIZED, ExecState.REJECTED],
+    [ExecState.FINALIZED]: [],
+    [ExecState.REJECTED]: [],
+};
+/**
+ * Validate a state transition. Throws if the transition is not allowed.
+ */
+function validateTransition(from, to) {
+    const allowed = exports.ALLOWED_TRANSITIONS[from];
+    if (!allowed.includes(to)) {
+        throw new Error(`Invalid ExecState transition: ${from} → ${to}. ` +
+            `Allowed from ${from}: [${allowed.join(", ") || "none"}]`);
+    }
+}
+/**
+ * Returns true if the given state is a terminal state (no further transitions).
+ */
+function isTerminal(state) {
+    return exports.ALLOWED_TRANSITIONS[state].length === 0;
+}
+//# sourceMappingURL=exec-state.js.map

package/dist/exec-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-state.js","sourceRoot":"","sources":["../src/exec-state.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA4CH,gDAQC;AAKD,gCAEC;AAzDD,IAAY,SAWX;AAXD,WAAY,SAAS;IACnB,kCAAsB,CAAA;IACtB,sCAAyB,CAAA;IACzB,oCAAwB,CAAA;IACxB,4BAAoB,CAAA;IACpB,oCAAwB,CAAA;IACxB,8BAAqB,CAAA;IACrB,oCAAwB,CAAA;IACxB,kCAAuB,CAAA;IACvB,oCAAwB,CAAA;IACxB,kCAAuB,CAAA;AACzB,CAAC,EAXW,SAAS,yBAAT,SAAS,QAWpB;AAED,yDAAyD;AAC5C,QAAA,mBAAmB,GAAmC;IACjE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;IAClE,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAG,SAAS,CAAC,QAAQ,CAAC;IAClE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,SAAS,CAAC,KAAK,EAAO,SAAS,CAAC,QAAQ,CAAC;IAClE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAO,CAAC,SAAS,CAAC,SAAS,EAAG,SAAS,CAAC,QAAQ,CAAC;IAClE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,SAAS,CAAC,MAAM,EAAM,SAAS,CAAC,QAAQ,CAAC,EAAG,oCAAoC;IACzG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAM,CAAC,SAAS,CAAC,SAAS,EAAG,SAAS,CAAC,QAAQ,CAAC;IAClE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,SAAS,CAAC,QAAQ,EAAI,SAAS,CAAC,QAAQ,CAAC;IAClE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAI,CAAC,SAAS,CAAC,SAAS,EAAG,SAAS,CAAC,QAAQ,CAAC;IAClE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,EAAE;IAC1B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAI,EAAE;CAC3B,CAAC;AAcF;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAe,EAAE,EAAa;IAC/D,MAAM,OAAO,GAAG,2BAAmB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,MAAM,EAAE,IAAI;YACjD,gBAAgB,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAgB;IACzC,OAAO,2BAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACjD,CAAC"}