@balchemyai/agent-sdk 0.1.0

package/dist/agent-loop/telemetry-reporter.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * TelemetryReporter
+ *
+ * Reports SDK-side agent activity (LLM calls, decisions, model routing) to
+ * the Balchemy server for ClickHouse analytics.
+ *
+ * Design principles:
+ * - All sends are fire-and-forget — errors are silently swallowed.
+ * - Events are batched; the flush runs every flushIntervalMs (default 30 s).
+ * - A final flush is triggered synchronously on stop().
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TelemetryReporter = void 0;
+class TelemetryReporter {
+    endpoint;
+    apiKey;
+    flushIntervalMs;
+    buffer = [];
+    timer = null;
+    constructor(
+    /** Full URL: e.g. https://api.balchemy.ai/api/agent-telemetry/abc123 */
+    endpoint, apiKey, flushIntervalMs = 30_000) {
+        this.endpoint = endpoint;
+        this.apiKey = apiKey;
+        this.flushIntervalMs = flushIntervalMs;
+    }
+    start() {
+        if (this.timer !== null)
+            return;
+        this.timer = setInterval(() => {
+            void this.flush();
+        }, this.flushIntervalMs);
+        // Allow the process to exit even if this timer is still active
+        if (this.timer.unref) {
+            this.timer.unref();
+        }
+    }
+    stop() {
+        if (this.timer !== null) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        // Best-effort final flush — do not await; caller should not block on telemetry
+        void this.flush();
+    }
+    reportLlmCall(data) {
+        this.buffer.push({ type: 'llm_call', timestamp: Date.now(), ...data });
+    }
+    reportDecision(data) {
+        this.buffer.push({ type: 'decision', timestamp: Date.now(), ...data });
+    }
+    reportModelRoute(data) {
+        this.buffer.push({ type: 'model_route', timestamp: Date.now(), ...data });
+    }
+    async flush() {
+        if (this.buffer.length === 0)
+            return;
+        // Drain atomically — if fetch throws, events are lost (intentional: telemetry
+        // must never block the agent loop or accumulate indefinitely on a dead server).
+        const batch = this.buffer.splice(0);
+        try {
+            await fetch(this.endpoint, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ events: batch }),
+            });
+        }
+        catch {
+            // Fire-and-forget — telemetry failures must not propagate to the agent loop
+        }
+    }
+}
+exports.TelemetryReporter = TelemetryReporter;
+//# sourceMappingURL=telemetry-reporter.js.map

package/dist/agent-loop/telemetry-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-reporter.js","sourceRoot":"","sources":["../../src/agent-loop/telemetry-reporter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAgCH,MAAa,iBAAiB;IAMT;IACA;IACA;IAPF,MAAM,GAAqB,EAAE,CAAC;IACvC,KAAK,GAA0C,IAAI,CAAC;IAE5D;IACE,wEAAwE;IACvD,QAAgB,EAChB,MAAc,EACd,kBAA0B,MAAM;QAFhC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,oBAAe,GAAf,eAAe,CAAiB;IAChD,CAAC;IAEJ,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QAChC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACzB,+DAA+D;QAC/D,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,+EAA+E;QAC/E,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAED,aAAa,CAAC,IAAiB;QAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,cAAc,CAAC,IAAkB;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,gBAAgB,CAAC,IAAoB;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrC,8EAA8E;QAC9E,gFAAgF;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;CACF;AA7DD,8CA6DC"}

package/dist/agent-loop/types.d.ts

@@ -0,0 +1,125 @@
+export type LlmProvider = 'anthropic' | 'openai' | 'custom';
+export interface LlmMessage {
+    role: 'system' | 'user' | 'assistant';
+    content: string;
+}
+export interface LlmResponse {
+    text: string;
+    model: string;
+    inputTokens: number;
+    outputTokens: number;
+}
+export interface LlmAdapter {
+    chat(messages: LlmMessage[], maxTokens?: number): Promise<LlmResponse>;
+    /** Override the active model for the next call(s). Used by ModelRouter. */
+    setModel(model: string): void;
+}
+export interface AgentLoopConfig {
+    /** Balchemy MCP endpoint (e.g., https://api.balchemy.ai/mcp/abc123) */
+    mcpEndpoint: string;
+    /** Balchemy MCP API key */
+    apiKey: string;
+    /** LLM provider */
+    llmProvider: LlmProvider;
+    /** LLM API key */
+    llmApiKey: string;
+    /** LLM model name (e.g., claude-haiku-4-5, gpt-4o-mini) */
+    llmModel?: string;
+    /** Custom LLM API base URL (for Gemini, Grok, OpenRouter, or self-hosted). Defaults to provider's official URL. */
+    llmBaseUrl?: string;
+    /**
+     * Cheap model for low-significance events (score < 60).
+     * E.g. claude-haiku-4-5, gpt-5-nano. Defaults to llmModel.
+     */
+    cheapModel?: string;
+    /**
+     * Full model for high-significance events (score >= 60).
+     * E.g. claude-sonnet-4, gpt-5.4-mini. Defaults to llmModel.
+     */
+    fullModel?: string;
+    /** Path to behavior rules YAML file */
+    behaviorRulesPath?: string;
+    /** Inline behavior rules (alternative to file path) */
+    behaviorRules?: Record<string, unknown>;
+    /** Max daily LLM spend in USD. Default: 5 */
+    maxDailyLlmCost?: number;
+    /** SSE event stream endpoint. Derived from mcpEndpoint if omitted. */
+    sseEndpoint?: string;
+    /** Webhook server port. 0 = disabled. Default: 0 (disabled) */
+    webhookPort?: number;
+    /** Webhook HMAC secret (from Balchemy dashboard) */
+    webhookSecret?: string;
+    /** Custom fetch function for MCP requests (e.g., to inject replay protection headers). */
+    mcpFetchFn?: typeof fetch;
+    /** LLM call timeout in ms. Default: 10000 */
+    llmTimeoutMs?: number;
+    /** Max consecutive LLM failures before pausing. Default: 3 */
+    maxConsecutiveFailures?: number;
+    /** Callback: event received */
+    onEvent?: (event: AgentEvent) => void;
+    /** Callback: decision made */
+    onDecision?: (decision: AgentDecision) => void;
+    /** Callback: error */
+    onError?: (error: Error) => void;
+    /** Callback: status changed */
+    onStatusChange?: (status: AgentStatus) => void;
+    /** Callback: trade result (after trade_command executes) */
+    onTradeResult?: (result: {
+        action: string;
+        token?: string;
+        amount?: string;
+        response: string;
+    }) => void;
+}
+/** Lightweight portfolio snapshot returned by agent_portfolio MCP tool. */
+export interface AgentPortfolioSnapshot {
+    /** Total portfolio value in SOL */
+    totalValueSol?: number;
+    /** Total portfolio value in USD */
+    totalValueUsd?: number;
+    /** Summary description for LLM context */
+    summary?: string;
+    [key: string]: unknown;
+}
+export interface AgentEvent {
+    id?: string;
+    type: string;
+    data: unknown;
+    timestamp: number;
+    source: 'sse' | 'webhook';
+}
+export interface AgentDecision {
+    action: string;
+    token?: string;
+    amount?: string;
+    reasoning?: string;
+    confidence?: number;
+    ruleCorrection?: {
+        original: string;
+        corrected: string;
+        reason: string;
+    };
+}
+export type AgentLoopStatus = 'starting' | 'running' | 'paused' | 'budget_exhausted' | 'llm_failing' | 'stopped' | 'error';
+export interface AgentStatus {
+    status: AgentLoopStatus;
+    uptime: number;
+    eventsReceived: number;
+    decisionsExecuted: number;
+    tradesExecuted: number;
+    llmCallsToday: number;
+    llmCostToday: number;
+    maxDailyLlmCost: number;
+    consecutiveLlmFailures: number;
+    lastEventAt?: number;
+    lastTradeAt?: number;
+    sseConnected: boolean;
+    webhookActive: boolean;
+}
+export declare const DEFAULT_AGENT_LOOP_CONFIG: {
+    readonly maxDailyLlmCost: 5;
+    readonly llmTimeoutMs: 10000;
+    readonly maxConsecutiveFailures: 3;
+    readonly webhookPort: 0;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/agent-loop/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent-loop/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,kBAAkB;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mHAAmH;IACnH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;IAC1B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,+BAA+B;IAC/B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,8BAA8B;IAC9B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C,sBAAsB;IACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,+BAA+B;IAC/B,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IAC/C,4DAA4D;IAC5D,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzG;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,SAAS,GACT,QAAQ,GACR,kBAAkB,GAClB,aAAa,GACb,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,eAAO,MAAM,yBAAyB;;;;;CAK5B,CAAC"}

package/dist/agent-loop/types.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_AGENT_LOOP_CONFIG = void 0;
+exports.DEFAULT_AGENT_LOOP_CONFIG = {
+    maxDailyLlmCost: 5,
+    llmTimeoutMs: 10_000,
+    maxConsecutiveFailures: 3,
+    webhookPort: 0,
+};
+//# sourceMappingURL=types.js.map

package/dist/agent-loop/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent-loop/types.ts"],"names":[],"mappings":";;;AAkIa,QAAA,yBAAyB,GAAG;IACvC,eAAe,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM;IACpB,sBAAsB,EAAE,CAAC;IACzB,WAAW,EAAE,CAAC;CACN,CAAC"}

package/dist/agent-loop/webhook-receiver.d.ts

@@ -0,0 +1,22 @@
+import type { AgentEvent } from './types';
+export interface WebhookReceiverConfig {
+    secret: string;
+    port: number;
+    dedupTtlMs?: number;
+}
+export declare class WebhookReceiver {
+    private readonly secret;
+    private readonly port;
+    private readonly dedupTtlMs;
+    private readonly seen;
+    private server;
+    private onEvent;
+    private cleanupTimer;
+    constructor(config: WebhookReceiverConfig);
+    verifySignature(body: string, signature: string): boolean;
+    isDuplicate(traceId: string): boolean;
+    cleanup(): void;
+    start(handler: (event: AgentEvent) => void): Promise<void>;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=webhook-receiver.d.ts.map

package/dist/agent-loop/webhook-receiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-receiver.d.ts","sourceRoot":"","sources":["../../src/agent-loop/webhook-receiver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,OAAO,CAA8C;IAC7D,OAAO,CAAC,YAAY,CAA+C;gBAEvD,MAAM,EAAE,qBAAqB;IAMzC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAezD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAMrC,OAAO,IAAI,IAAI;IAOT,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IA8D1D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAU5B"}

package/dist/agent-loop/webhook-receiver.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookReceiver = void 0;
+const crypto = __importStar(require("node:crypto"));
+const http = __importStar(require("node:http"));
+class WebhookReceiver {
+    secret;
+    port;
+    dedupTtlMs;
+    seen = new Map();
+    server = null;
+    onEvent = null;
+    cleanupTimer = null;
+    constructor(config) {
+        this.secret = config.secret;
+        this.port = config.port;
+        this.dedupTtlMs = config.dedupTtlMs ?? 300_000; // 5 minutes
+    }
+    verifySignature(body, signature) {
+        const expected = crypto
+            .createHmac('sha256', this.secret)
+            .update(body)
+            .digest('hex');
+        try {
+            return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(signature, 'hex'));
+        }
+        catch {
+            return false;
+        }
+    }
+    isDuplicate(traceId) {
+        if (this.seen.has(traceId))
+            return true;
+        this.seen.set(traceId, Date.now());
+        return false;
+    }
+    cleanup() {
+        const cutoff = Date.now() - this.dedupTtlMs;
+        for (const [id, ts] of this.seen) {
+            if (ts < cutoff)
+                this.seen.delete(id);
+        }
+    }
+    async start(handler) {
+        if (this.port === 0)
+            return;
+        this.onEvent = handler;
+        this.server = http.createServer((req, res) => {
+            if (req.method === 'GET' && req.url === '/health') {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: true }));
+                return;
+            }
+            if (req.method !== 'POST' || req.url !== '/webhook') {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            let body = '';
+            req.on('data', (chunk) => { body += chunk.toString(); });
+            req.on('end', () => {
+                const signature = req.headers['x-balchemy-signature'];
+                if (!signature || !this.verifySignature(body, signature)) {
+                    res.writeHead(401);
+                    res.end('Invalid signature');
+                    return;
+                }
+                try {
+                    const parsed = JSON.parse(body);
+                    const traceId = parsed.trace_id;
+                    if (traceId && this.isDuplicate(traceId)) {
+                        res.writeHead(200);
+                        res.end('Duplicate');
+                        return;
+                    }
+                    const event = {
+                        id: traceId,
+                        type: parsed.type ?? 'unknown',
+                        data: parsed,
+                        timestamp: Date.now(),
+                        source: 'webhook',
+                    };
+                    this.onEvent?.(event);
+                    res.writeHead(200);
+                    res.end('OK');
+                }
+                catch {
+                    res.writeHead(400);
+                    res.end('Invalid JSON');
+                }
+            });
+        });
+        this.cleanupTimer = setInterval(() => this.cleanup(), 60_000);
+        return new Promise((resolve) => {
+            this.server.listen(this.port, () => resolve());
+        });
+    }
+    async stop() {
+        if (this.cleanupTimer)
+            clearInterval(this.cleanupTimer);
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+}
+exports.WebhookReceiver = WebhookReceiver;
+//# sourceMappingURL=webhook-receiver.js.map

package/dist/agent-loop/webhook-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-receiver.js","sourceRoot":"","sources":["../../src/agent-loop/webhook-receiver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AACtC,gDAAkC;AASlC,MAAa,eAAe;IACT,MAAM,CAAS;IACf,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,GAAuB,IAAI,CAAC;IAClC,OAAO,GAAyC,IAAI,CAAC;IACrD,YAAY,GAA0C,IAAI,CAAC;IAEnE,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,YAAY;IAC9D,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,SAAiB;QAC7C,MAAM,QAAQ,GAAG,MAAM;aACpB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;aACjC,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAC5B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAoC;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAW,CAAC;gBAChE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;oBACzD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;oBAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAkB,CAAC;oBAE1C,IAAI,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;wBACzC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBACrB,OAAO;oBACT,CAAC;oBAED,MAAM,KAAK,GAAe;wBACxB,EAAE,EAAE,OAAO;wBACX,IAAI,EAAG,MAAM,CAAC,IAAe,IAAI,SAAS;wBAC1C,IAAI,EAAE,MAAM;wBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;wBACrB,MAAM,EAAE,SAAS;qBAClB,CAAC;oBAEF,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QAE9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY;YAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAnHD,0CAmHC"}

package/dist/auth/onboarding.d.ts

@@ -0,0 +1,12 @@
+import { HttpClient } from "../client/http-client";
+import type { IdentityTokenRevokeResponse, IdentityTokenRevokeStatusInput, OnboardWithIdentityInput, OnboardWithSiweInput, OnboardingResponse, RevokeIdentityTokenInput, RequestSiweNonceInput, SiweNonceResponse } from "../types";
+export declare class AgentOnboardingClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    requestSiweNonce(input: RequestSiweNonceInput): Promise<SiweNonceResponse>;
+    onboardWithSiwe(input: OnboardWithSiweInput): Promise<OnboardingResponse>;
+    onboardWithIdentity(input: OnboardWithIdentityInput): Promise<OnboardingResponse>;
+    revokeIdentityToken(input: RevokeIdentityTokenInput): Promise<IdentityTokenRevokeResponse>;
+    getIdentityTokenRevokeStatus(input: IdentityTokenRevokeStatusInput): Promise<IdentityTokenRevokeResponse>;
+}
+//# sourceMappingURL=onboarding.d.ts.map

package/dist/auth/onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/auth/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EACV,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,UAAU,CAAC;AAElB,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAY1E,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAazE,mBAAmB,CACvB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,kBAAkB,CAAC;IAcxB,mBAAmB,CACvB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,2BAA2B,CAAC;IAUjC,4BAA4B,CAChC,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,2BAA2B,CAAC;CAQxC"}

package/dist/auth/onboarding.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentOnboardingClient = void 0;
+class AgentOnboardingClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    async requestSiweNonce(input) {
+        return this.http.post("/nest/auth/evm/nonce", {
+            address: input.address,
+            chainId: input.chainId,
+            domain: input.domain,
+            uri: input.uri,
+            statement: input.statement ??
+                "Sign in to Balchemy external agent onboarding",
+        });
+    }
+    async onboardWithSiwe(input) {
+        return this.http.post("/public/erc8004/onboarding/siwe", {
+            message: input.message,
+            signature: input.signature,
+            agentId: input.agentId,
+            ...(input.botId !== undefined ? { botId: input.botId } : {}),
+            ...(input.scope !== undefined ? { scope: input.scope } : {}),
+        });
+    }
+    async onboardWithIdentity(input) {
+        return this.http.post("/public/erc8004/onboarding/identity", {
+            provider: input.provider,
+            identityToken: input.identityToken,
+            agentId: input.agentId,
+            ...(input.botId !== undefined ? { botId: input.botId } : {}),
+            chainId: input.chainId ?? 8453,
+            ...(input.scope !== undefined ? { scope: input.scope } : {}),
+        });
+    }
+    async revokeIdentityToken(input) {
+        return this.http.post("/public/erc8004/onboarding/tokens/revoke", {
+            jti: input.jti,
+            ...(input.ttlSeconds !== undefined ? { ttlSeconds: input.ttlSeconds } : {}),
+        });
+    }
+    async getIdentityTokenRevokeStatus(input) {
+        return this.http.post("/public/erc8004/onboarding/tokens/revoke-status", {
+            jti: input.jti,
+        });
+    }
+}
+exports.AgentOnboardingClient = AgentOnboardingClient;
+//# sourceMappingURL=onboarding.js.map

package/dist/auth/onboarding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../src/auth/onboarding.ts"],"names":[],"mappings":";;;AAYA,MAAa,qBAAqB;IACH;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAoB,sBAAsB,EAAE;YAC/D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EACP,KAAK,CAAC,SAAS;gBACf,+CAA+C;SAClD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAA2B;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,iCAAiC,EACjC;YACE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,qCAAqC,EACrC;YACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,0CAA0C,EAC1C;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,4BAA4B,CAChC,KAAqC;QAErC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,iDAAiD,EACjD;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CACF,CAAC;IACJ,CAAC;CACF;AAlED,sDAkEC"}

package/dist/auth/token-store.d.ts

@@ -0,0 +1,44 @@
+/**
+ * TokenStore — in-memory token lifecycle manager.
+ *
+ * Holds the current identityAccess token and refreshes it automatically
+ * before expiry. The refresh callback is provided by the consumer
+ * (typically AgentOnboardingClient.onboardWithIdentity / onboardWithSiwe).
+ *
+ * Token is considered stale when less than `refreshBufferSec` seconds remain.
+ * Default buffer: 30 seconds.
+ */
+export type StoredToken = {
+    token: string;
+    tokenType: "Bearer";
+    expiresAt: Date;
+    kid: string;
+    issuer: string;
+    scope: "read" | "trade";
+};
+export type TokenRefreshFn = () => Promise<StoredToken>;
+export type TokenStoreOptions = {
+    /** Seconds before expiry to proactively refresh. Default: 30 */
+    refreshBufferSec?: number;
+};
+export declare class TokenStore {
+    private readonly refreshFn;
+    private current;
+    private refreshing;
+    private readonly refreshBufferMs;
+    constructor(refreshFn: TokenRefreshFn, options?: TokenStoreOptions);
+    /**
+     * Returns the current valid token, refreshing if necessary.
+     * Concurrent calls during an in-flight refresh share the same Promise.
+     */
+    getToken(): Promise<string>;
+    /** Returns the full stored token object (or null if never set). */
+    getCurrent(): StoredToken | null;
+    /** Forcefully sets the current token (e.g. from an onboarding response). */
+    set(token: StoredToken): void;
+    /** Invalidates the current token, forcing the next call to refresh. */
+    invalidate(): void;
+    private isStale;
+    private ensureRefresh;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/auth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAExD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,qBAAa,UAAU;IAMnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAL5B,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAGtB,SAAS,EAAE,cAAc,EAC1C,OAAO,CAAC,EAAE,iBAAiB;IAK7B;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAOjC,mEAAmE;IACnE,UAAU,IAAI,WAAW,GAAG,IAAI;IAIhC,4EAA4E;IAC5E,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAI7B,uEAAuE;IACvE,UAAU,IAAI,IAAI;IAMlB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,aAAa;CAgBtB"}

package/dist/auth/token-store.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * TokenStore — in-memory token lifecycle manager.
+ *
+ * Holds the current identityAccess token and refreshes it automatically
+ * before expiry. The refresh callback is provided by the consumer
+ * (typically AgentOnboardingClient.onboardWithIdentity / onboardWithSiwe).
+ *
+ * Token is considered stale when less than `refreshBufferSec` seconds remain.
+ * Default buffer: 30 seconds.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenStore = void 0;
+class TokenStore {
+    refreshFn;
+    current = null;
+    refreshing = null;
+    refreshBufferMs;
+    constructor(refreshFn, options) {
+        this.refreshFn = refreshFn;
+        this.refreshBufferMs = (options?.refreshBufferSec ?? 30) * 1000;
+    }
+    /**
+     * Returns the current valid token, refreshing if necessary.
+     * Concurrent calls during an in-flight refresh share the same Promise.
+     */
+    async getToken() {
+        if (this.current && !this.isStale(this.current)) {
+            return this.current.token;
+        }
+        return (await this.ensureRefresh()).token;
+    }
+    /** Returns the full stored token object (or null if never set). */
+    getCurrent() {
+        return this.current;
+    }
+    /** Forcefully sets the current token (e.g. from an onboarding response). */
+    set(token) {
+        this.current = token;
+    }
+    /** Invalidates the current token, forcing the next call to refresh. */
+    invalidate() {
+        this.current = null;
+    }
+    // ── private ──────────────────────────────────────────────────────────────
+    isStale(token) {
+        return token.expiresAt.getTime() - Date.now() < this.refreshBufferMs;
+    }
+    ensureRefresh() {
+        if (this.refreshing) {
+            return this.refreshing;
+        }
+        this.refreshing = this.refreshFn()
+            .then((token) => {
+            this.current = token;
+            this.refreshing = null;
+            return token;
+        })
+            .catch((err) => {
+            this.refreshing = null;
+            throw err;
+        });
+        return this.refreshing;
+    }
+}
+exports.TokenStore = TokenStore;
+//# sourceMappingURL=token-store.js.map

package/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAkBH,MAAa,UAAU;IAMF;IALX,OAAO,GAAuB,IAAI,CAAC;IACnC,UAAU,GAAgC,IAAI,CAAC;IACtC,eAAe,CAAS;IAEzC,YACmB,SAAyB,EAC1C,OAA2B;QADV,cAAS,GAAT,SAAS,CAAgB;QAG1C,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,mEAAmE;IACnE,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,KAAkB;QACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,uEAAuE;IACvE,UAAU;QACR,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,4EAA4E;IAEpE,OAAO,CAAC,KAAkB;QAChC,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;IACvE,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE;aAC/B,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF;AA5DD,gCA4DC"}

package/dist/client/http-client.d.ts

@@ -0,0 +1,22 @@
+import { type RetryOptions } from "../utils/retry";
+export type HttpClientConfig = {
+    baseUrl: string;
+    timeoutMs: number;
+    fetchFn?: typeof fetch;
+    /** Retry options. Set maxAttempts=1 to disable retries. Default: 3 attempts. */
+    retry?: RetryOptions;
+};
+export declare class HttpClient {
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private readonly fetchFn;
+    private readonly retryOptions;
+    constructor(config: HttpClientConfig);
+    get<T>(path: string, headers?: Record<string, string>): Promise<T>;
+    post<T>(path: string, body: Record<string, unknown>, headers?: Record<string, string>): Promise<T>;
+    private request;
+    private safeJsonParse;
+    private unwrapCanonicalEnvelope;
+    private mapHttpError;
+}
+//# sourceMappingURL=http-client.d.ts.map

package/dist/client/http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/client/http-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,gFAAgF;IAChF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,MAAM,EAAE,gBAAgB;IAO9B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAOlE,IAAI,CAAC,CAAC,EACV,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC;YAYC,OAAO;YAsDP,aAAa;IAY3B,OAAO,CAAC,uBAAuB;IA+B/B,OAAO,CAAC,YAAY;CAmBrB"}