@brainai/satp-client 2.0.7 → 2.0.8

package/{node_modules/@solana/web3.js/node_modules/borsh/LICENSE-APACHE → LICENSE}

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2019 Near
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -3,7 +3,7 @@
 **Solana Agent Trust Protocol** - JavaScript/TypeScript SDK for reading and
 building reviewed SATP V3 program interactions.
 
-Current stable npm package: **@brainai/satp-client@2.0.6** | unpublished source candidate: **@brainai/satp-client@2.0.7** | rc dist-tag: **@brainai/satp-client@2.0.2** | Programs: **6**
+Current stable npm package: **@brainai/satp-client@2.0.8** | rc dist-tag: **@brainai/satp-client@2.0.2** | Programs: **6**
 
 ## Installation
 
@@ -11,29 +11,24 @@ Choose stable, rc, or Git based on what the consumer needs to prove:
 
 | Channel | Use when | Command |
 | --- | --- | --- |
-| Stable npm | Default production-style consumption of the stable public package. | `npm install @brainai/satp-client@2.0.6` |
+| Stable npm | Default production-style consumption of the stable public package. | `npm install @brainai/satp-client@2.0.8` |
 | Historical rc exact version | Explicit HQ-assigned reproduction or lockfile evidence for the historical pre-stable artifact. | `npm install @brainai/satp-client@2.0.2` |
 | Release candidate tag | Explicit HQ-assigned rc validation where a moving dist-tag is acceptable and the task names the tag as the target. | `npm install @brainai/satp-client@rc` |
 | Reviewed Git commit | PR coordination or source-review installs tied to an exact SATP commit. | `npm install git+https://github.com/brainAI-bot/satp.git#<SATP_COMMIT>` |
 
-Registry readback on 2026-08-20 shows npm `latest` resolves to
-`@brainai/satp-client@2.0.6` and the `rc` dist-tag resolves to `2.0.2`.
-Stable consumers should use `latest`/`2.0.6` unless HQ assigns an explicit
+Registry publish/readback on 2026-08-29 shows npm `latest` resolves to
+`@brainai/satp-client@2.0.8` and the `rc` dist-tag resolves to `2.0.2`.
+Stable consumers should use `latest`/`2.0.8` unless HQ assigns an explicit
 release-candidate validation task.
 
-Registry publish/readback on 2026-08-02 confirms `2.0.6` is the stable npm
-package. This documentation update does not publish the package or move any npm
-dist-tag.
-
-Source release-prep on 2026-08-20 advances package metadata to `2.0.7` as the
-next unpublished patch candidate containing the packed-consumer UUID advisory
-remediation merged in PR #145. This source candidate is not published and does
-not change the stable or `rc` registry tags.
+Version `2.0.8` replaces the oversized `2.0.7` artifact. It keeps runtime
+dependencies as normal npm dependencies and excludes `node_modules` from the
+published tarball.
 
 For stable consumer installs, pin the current published npm package:
 
 ```bash
-npm install @brainai/satp-client@2.0.6
+npm install @brainai/satp-client@2.0.8
 ```
 
 For rc validation:
@@ -60,11 +55,6 @@ current consumer package. Do not treat branch-only Git installs as npm latest.
 Continue to [Quick Start](#quick-start) for an installed-package flow that uses
 only files shipped in the package.
 
-The consumer-root `node` commands below use the stable npm package layout. For
-the reviewed Git-commit channel, insert `packages/satp-client/` after
-`node_modules/@brainai/satp-client/` because that channel installs the repository
-root package rather than the standalone npm artifact.
-
 Mainnet program IDs are present for the reviewed V3 registry, but availability
 is not action approval. Mainnet writes, deploys, keypair use, authority changes,
 value-bearing escrow actions, npm promotion, and production claims still require
@@ -91,11 +81,11 @@ escrow readiness, mainnet readiness, npm latest adoption, or product approval.
 This installed-package quickstart covers an offline read-only SDK flow.
 
 For copy-paste MCP, A2A/agent-runtime, and x402 paid-endpoint examples, see the
-packed [`examples/adoption-quickstarts.js`](examples/adoption-quickstarts.js)
-or run this command from the consumer project root after installation:
+source [`examples/adoption-quickstarts.js`](https://github.com/brainAI-bot/satp/blob/079f2a85ad912d4eff2bca5516d214829246784b/packages/satp-client/examples/adoption-quickstarts.js).
+From a SATP source checkout, run this command from the repository root:
 
 ```bash
-node node_modules/@brainai/satp-client/examples/adoption-quickstarts.js
+node packages/satp-client/examples/adoption-quickstarts.js
 ```
 
 ```javascript
@@ -229,12 +219,12 @@ read-only: x402 payment metadata can identify where evidence may be fetched, but
 it is discovery/evidence lookup only and never authorizes SATP action execution,
 spending, live payment, signing, transactions, or host policy bypass.
 
-Run the packed
-[`examples/x402-discovery-evidence-lookup.js`](./examples/x402-discovery-evidence-lookup.js)
-from the consumer project root:
+Run the source
+[`examples/x402-discovery-evidence-lookup.js`](https://github.com/brainAI-bot/satp/blob/079f2a85ad912d4eff2bca5516d214829246784b/packages/satp-client/examples/x402-discovery-evidence-lookup.js)
+from a SATP checkout's repository root:
 
 ```bash
-node node_modules/@brainai/satp-client/examples/x402-discovery-evidence-lookup.js
+node packages/satp-client/examples/x402-discovery-evidence-lookup.js
 ```
 
 The example parses discovery metadata, builds an evidence lookup descriptor, and
@@ -246,12 +236,12 @@ builds a runtime policy action descriptor. It asserts
 The proposed issue #14 Track C endpoint spec for third-party SATP reputation
 and evidence consumers lives in the
 [source repository](https://github.com/brainAI-bot/satp/blob/main/docs/x402-reputation-evidence-lookup-api.md).
-Its packed
-[`examples/x402-reputation-evidence-lookup-client.js`](./examples/x402-reputation-evidence-lookup-client.js)
-is runnable from the consumer project root with:
+Its source
+[`examples/x402-reputation-evidence-lookup-client.js`](https://github.com/brainAI-bot/satp/blob/079f2a85ad912d4eff2bca5516d214829246784b/packages/satp-client/examples/x402-reputation-evidence-lookup-client.js)
+is runnable from a SATP checkout's repository root with:
 
 ```bash
-node node_modules/@brainai/satp-client/examples/x402-reputation-evidence-lookup-client.js
+node packages/satp-client/examples/x402-reputation-evidence-lookup-client.js
 ```
 
 ### Runtime Policy Adapter Helper

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@brainai/satp-client",
-  "version": "2.0.7",
-  "description": "SATP client SDK surface prepared for release-candidate review; publish only after the release packet passes.",
+  "version": "2.0.8",
+  "description": "SATP client SDK for reviewed Solana Agent Trust Protocol integrations.",
   "main": "src/index.js",
   "types": "src/index.d.ts",
   "exports": {
@@ -28,8 +28,8 @@
   "files": [
     "src/",
     "idls/",
-    "examples/",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
     "prepack": "npm ci --workspaces=false --ignore-scripts --no-audit --no-fund --silent && node scripts/materialize-v3-idls.js",
@@ -68,9 +68,6 @@
     "bs58": "^6.0.0",
     "rpc-websockets": "9.3.5"
   },
-  "bundleDependencies": [
-    "@solana/web3.js"
-  ],
   "private": false,
   "overrides": {
     "ws": "^8.21.0",

package/examples/adoption-quickstarts.js

@@ -1,173 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-const {
-  buildRuntimePolicyActionDescriptorFromX402Discovery,
-  buildSatpTrustPacket,
-  createRuntimePolicyAdapter,
-  getV3ProgramIds,
-  validateSatpTrustPacket,
-} = require('../src');
-
-const METADATA_HASH = '93d122f8879fe87c186c10a00db8fbc80a73cecd2ede44b9ffa6410be3c2b805';
-
-async function mcpToolServerQuickstart() {
-  function createSatpMcpTools() {
-    return {
-      'satp.getPrograms': async ({ network = 'devnet' } = {}) => ({
-        network,
-        programs: getV3ProgramIds(network),
-        guardrails: {
-          readOnly: true,
-          writesSolanaState: false,
-          usesKeypairs: false,
-        },
-      }),
-
-      'satp.prepareAttestationRequest': async ({
-        subjectWallet,
-        agentId,
-        claimType = 'identity',
-        metadataHash,
-        network = 'devnet',
-      }) => {
-        const packet = buildSatpTrustPacket({
-          subjectWallet,
-          agentId,
-          claimType,
-          metadataHash,
-          network,
-        });
-        const validation = validateSatpTrustPacket(packet);
-        if (!validation.ok) throw new Error(validation.errors.join('; '));
-
-        return {
-          packet,
-          guardrails: {
-            readOnly: true,
-            livePaymentRequired: false,
-            transaction: null,
-          },
-        };
-      },
-    };
-  }
-
-  const tools = createSatpMcpTools();
-  const prepared = await tools['satp.prepareAttestationRequest']({
-    subjectWallet: '11111111111111111111111111111111',
-    agentId: 'example-mcp-agent',
-    metadataHash: METADATA_HASH,
-  });
-  return {
-    audience: 'mcp-tool-server-builders',
-    mode: prepared.packet.mode,
-    guardrails: prepared.guardrails,
-  };
-}
-
-function agentRuntimeQuickstart() {
-  const now = new Date().toISOString();
-  const adapter = createRuntimePolicyAdapter({
-    policy: {
-      minimumTrustScore: 70,
-      denyTrustScoreBelow: 25,
-      requireVerifiedIdentity: true,
-      maxAutoSpendUsd: 0,
-    },
-  });
-  const identity = {
-    agentId: 'partner-runtime-agent',
-    active: true,
-    satpVerified: true,
-    trustScore: 82,
-    capabilities: ['a2a:task.delegate'],
-    evidenceUpdatedAt: now,
-  };
-  const action = adapter.action({
-    type: 'a2a_agent_runtime',
-    resource: 'a2a://task/delegate',
-    operation: 'delegate',
-    capability: 'a2a:task.delegate',
-    requiresFreshEvidence: true,
-    operatorApprovalRequired: false,
-  });
-  const result = adapter.evaluate(identity, action, { now });
-  const auditTrace = adapter.auditTrace(identity, action, { result, now });
-
-  return {
-    audience: 'a2a-agent-runtime-builders',
-    decision: result.decision,
-    reasonCodes: result.reasonCodes,
-    localDecisionOnly: auditTrace.guardrails.localDecisionOnly,
-  };
-}
-
-function x402PaidEndpointQuickstart() {
-  const discovery = {
-    endpoint: 'https://api.example.test/satp/reputation',
-    action: 'lookup',
-    accepts: [{
-      scheme: 'exact',
-      network: 'solana-mainnet',
-      asset: 'USDC',
-      maxAmountRequired: '10000',
-      resource: 'https://api.example.test/satp/reputation',
-      description: 'SATP-backed reputation evidence lookup',
-    }],
-  };
-  const lookupAction = buildRuntimePolicyActionDescriptorFromX402Discovery(
-    discovery,
-    { maxCostUsd: 0.01 }
-  );
-  const adapter = createRuntimePolicyAdapter({
-    policy: { maxAutoSpendUsd: 0, minimumTrustScore: 70 },
-  });
-  const identity = {
-    agentId: 'x402-consumer-agent',
-    active: true,
-    satpVerified: true,
-    trustScore: 90,
-    capabilities: ['satp:evidence.lookup'],
-    evidenceUpdatedAt: '2026-05-21T00:00:00Z',
-  };
-  const result = adapter.evaluate(identity, lookupAction, {
-    evidenceLookupPaymentPreapproved: false,
-    now: '2026-07-31T00:00:00Z',
-  });
-
-  return {
-    audience: 'x402-paid-endpoint-builders',
-    decision: result.decision,
-    reasonCodes: result.reasonCodes,
-    guardrail: lookupAction.evidenceLookup.guardrail,
-    paymentBoundary: {
-      satpPackageUseIsFreeOpen: true,
-      x402OnlyForHostedReputationEvidenceLookup: true,
-      paymentIsNotActionAuthorization: true,
-      livePaymentRequired: false,
-    },
-  };
-}
-
-async function run() {
-  const examples = [
-    await mcpToolServerQuickstart(),
-    agentRuntimeQuickstart(),
-    x402PaidEndpointQuickstart(),
-  ];
-  console.log(JSON.stringify({ examples }, null, 2));
-}
-
-if (require.main === module) {
-  run().catch((err) => {
-    console.error(err);
-    process.exitCode = 1;
-  });
-}
-
-module.exports = {
-  agentRuntimeQuickstart,
-  mcpToolServerQuickstart,
-  x402PaidEndpointQuickstart,
-};