@chainvue/v402-protocol 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,30 @@
+# @chainvue/v402-protocol
+
+Protocol core of [v402](https://github.com/chainvue/v402), the Verus-native
+payment layer for AI-agent APIs. Types, wire-format schemas (Zod), canonical
+payload serialization, amount utilities. Framework-agnostic and browser-safe —
+no Node-only APIs, `zod` is the only runtime dependency.
+
+```sh
+npm install @chainvue/v402-protocol
+```
+
+## What's in here
+
+- `canonicalize()` / `canonicalizeBalanceQuery()` — payload → canonical signing
+  string, byte-exact per [`spec/0.1/canonical-payload.md`](https://github.com/chainvue/v402/blob/main/spec/0.1/canonical-payload.md)
+- Wire-format schemas: 402 response body, discovery document, `X-V402-*`
+  headers (`V402_HEADERS`, `REQUIRED_PAYMENT_HEADERS`)
+- Amount utilities: `humanToSats()` / `satsToHuman()` — exact `bigint` sats,
+  minimal-decimal human form
+- `normalizeIdentityKey()` — chain-relative, case-insensitive identity keying
+- `V402ProtocolError` with typed error codes; every validation fails closed
+
+Conformance is defined by the spec plus
+[`@chainvue/v402-test-vectors`](https://www.npmjs.com/package/@chainvue/v402-test-vectors) —
+this package is the reference implementation of the canonical form.
+
+## License
+
+Apache-2.0. The protocol specification itself is CC-BY-4.0, see the
+[spec directory](https://github.com/chainvue/v402/tree/main/spec).

package/dist/amount.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Amount representation (Q3): `bigint` satoshis internally, human decimal
+ * strings at all boundaries. 1 VRSC = 100_000_000 sats, exact arithmetic only.
+ */
+export declare const AMOUNT_DECIMALS = 8;
+export declare const SATS_PER_COIN = 100000000n;
+export declare function isValidHumanAmount(value: string): boolean;
+/** "0.001" → 100000n. Throws `V402ProtocolError("invalid-amount")` on any deviation from the wire grammar. */
+export declare function humanToSats(value: string): bigint;
+/**
+ * 100000n → "0.001" — minimal form (trailing fraction zeros trimmed).
+ * Negative inputs are supported for internal ledger use; they are never valid
+ * on the wire.
+ */
+export declare function satsToHuman(sats: bigint): string;
+//# sourceMappingURL=amount.d.ts.map

package/dist/amount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"amount.d.ts","sourceRoot":"","sources":["../src/amount.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,aAAa,aAAe,CAAC;AAU1C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,8GAA8G;AAC9G,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQhD"}

package/dist/amount.js

@@ -0,0 +1,42 @@
+import { V402ProtocolError } from "./errors.js";
+/**
+ * Amount representation (Q3): `bigint` satoshis internally, human decimal
+ * strings at all boundaries. 1 VRSC = 100_000_000 sats, exact arithmetic only.
+ */
+export const AMOUNT_DECIMALS = 8;
+export const SATS_PER_COIN = 100000000n;
+/**
+ * Wire grammar for human amounts: non-negative decimal, no leading zeros in
+ * the integer part, `.` separator, 1–8 fraction digits. Trailing fraction
+ * zeros are allowed ("1.99999000") — amounts are compared/signed byte-verbatim,
+ * never normalized.
+ */
+const HUMAN_AMOUNT_RE = /^(?:0|[1-9]\d*)(?:\.\d{1,8})?$/;
+export function isValidHumanAmount(value) {
+    return HUMAN_AMOUNT_RE.test(value);
+}
+/** "0.001" → 100000n. Throws `V402ProtocolError("invalid-amount")` on any deviation from the wire grammar. */
+export function humanToSats(value) {
+    if (!HUMAN_AMOUNT_RE.test(value)) {
+        throw new V402ProtocolError("invalid-amount", `not a valid human amount string: ${JSON.stringify(value)}`);
+    }
+    const [whole, fraction = ""] = value.split(".");
+    const fractionPadded = fraction.padEnd(AMOUNT_DECIMALS, "0");
+    return BigInt(whole) * SATS_PER_COIN + BigInt(fractionPadded);
+}
+/**
+ * 100000n → "0.001" — minimal form (trailing fraction zeros trimmed).
+ * Negative inputs are supported for internal ledger use; they are never valid
+ * on the wire.
+ */
+export function satsToHuman(sats) {
+    const sign = sats < 0n ? "-" : "";
+    const abs = sats < 0n ? -sats : sats;
+    const whole = abs / SATS_PER_COIN;
+    const fraction = abs % SATS_PER_COIN;
+    if (fraction === 0n)
+        return `${sign}${whole}`;
+    const fractionStr = fraction.toString().padStart(AMOUNT_DECIMALS, "0").replace(/0+$/, "");
+    return `${sign}${whole}.${fractionStr}`;
+}
+//# sourceMappingURL=amount.js.map

package/dist/amount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"amount.js","sourceRoot":"","sources":["../src/amount.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAG,UAAY,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAEzD,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,QAAQ,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,KAAM,CAAC,GAAG,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,GAAG,aAAa,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,GAAG,aAAa,CAAC;IACrC,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,GAAG,IAAI,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC;AAC1C,CAAC"}

package/dist/canonical.d.ts

@@ -0,0 +1,18 @@
+import type { BalanceQueryPayload, CanonicalPayload } from "./types.js";
+export declare function isValidUlid(value: string): boolean;
+/**
+ * Build the exact byte string that gets signed (spec § Signed payload):
+ * line 1 `<scheme>/<schemeVersion>`, the 11 core fields in fixed order,
+ * then the alphabetically sorted extension section. LF separators, exact
+ * `key: value` form, no trailing newline.
+ *
+ * Every field is validated — a payload this function rejects must never be
+ * signed or verified.
+ */
+export declare function canonicalize(payload: CanonicalPayload): string;
+/**
+ * Canonical `v402-balance-query/0.1` payload (spec § Topup Instructions
+ * Endpoint) — domain-separated from payment payloads via its own line 1.
+ */
+export declare function canonicalizeBalanceQuery(payload: BalanceQueryPayload): string;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKxE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AA6CD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CA+B9D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAe7E"}

package/dist/canonical.js

@@ -0,0 +1,118 @@
+import { V402ProtocolError } from "./errors.js";
+import { isValidHumanAmount } from "./amount.js";
+import { serializeExtensionBlock } from "./extensions.js";
+import { BALANCE_QUERY_CONTEXT, schemeContextLine } from "./version.js";
+/** ULID: Crockford base32, 26 chars, 128 bit (first char therefore 0–7). */
+const ULID_RE = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+export function isValidUlid(value) {
+    return ULID_RE.test(value);
+}
+const SCHEME_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const SCHEME_VERSION_RE = /^\d+\.\d+$/;
+const METHOD_RE = /^[A-Z]+$/;
+const NETWORK_RE = /^[a-z0-9]+$/;
+/** Whitespace/control characters would corrupt the line-based canonical form. */
+const LINE_SAFE_RE = /^[^\s\x00-\x1f\x7f]+$/;
+function invalid(field, value, rule) {
+    throw new V402ProtocolError("invalid-field", `${field} ${rule}: ${JSON.stringify(value)}`);
+}
+function assertLineSafe(field, value) {
+    if (!LINE_SAFE_RE.test(value))
+        invalid(field, value, "must be non-empty without whitespace/control characters");
+}
+/** VerusID friendly name, e.g. "v402test.demoAgent@". Existence/charset rules are the verifier's job. */
+function assertIdentity(field, value) {
+    assertLineSafe(field, value);
+    if (!value.endsWith("@") || value.length < 2)
+        invalid(field, value, "must be a VerusID friendly name ending in '@'");
+}
+/**
+ * `path` verbatim rule (M1): request-target exactly as sent on the wire,
+ * incl. query string. No normalization on either side — but dot-segments and
+ * duplicate slashes are forbidden by spec, so both sides fail closed here.
+ */
+function assertPath(value) {
+    assertLineSafe("path", value);
+    if (!value.startsWith("/"))
+        invalid("path", value, "must start with '/'");
+    const pathPart = value.split("?", 1)[0];
+    if (pathPart.includes("//"))
+        invalid("path", value, "must not contain duplicate slashes");
+    if (pathPart.split("/").some((segment) => segment === "." || segment === "..")) {
+        invalid("path", value, "must not contain dot-segments");
+    }
+}
+function assertUnixSeconds(field, value) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        invalid(field, value, "must be a non-negative integer (Unix seconds)");
+}
+function assertRequestId(value) {
+    if (!ULID_RE.test(value))
+        invalid("requestId", value, "must be a ULID (26 chars, Crockford base32)");
+}
+/**
+ * Build the exact byte string that gets signed (spec § Signed payload):
+ * line 1 `<scheme>/<schemeVersion>`, the 11 core fields in fixed order,
+ * then the alphabetically sorted extension section. LF separators, exact
+ * `key: value` form, no trailing newline.
+ *
+ * Every field is validated — a payload this function rejects must never be
+ * signed or verified.
+ */
+export function canonicalize(payload) {
+    if (!SCHEME_NAME_RE.test(payload.scheme))
+        invalid("scheme", payload.scheme, "must match <network-family>-<mechanism>");
+    if (!SCHEME_VERSION_RE.test(payload.schemeVersion))
+        invalid("schemeVersion", payload.schemeVersion, "must be MAJOR.MINOR");
+    assertLineSafe("canonicalDomain", payload.canonicalDomain);
+    if (!METHOD_RE.test(payload.method))
+        invalid("method", payload.method, "must be an uppercase HTTP method");
+    assertPath(payload.path);
+    if (!NETWORK_RE.test(payload.network))
+        invalid("network", payload.network, "must be a lowercase network identifier");
+    assertLineSafe("asset", payload.asset);
+    if (!isValidHumanAmount(payload.amount))
+        invalid("amount", payload.amount, "must be a human decimal amount string");
+    assertIdentity("payer", payload.payer);
+    assertIdentity("payTo", payload.payTo);
+    assertRequestId(payload.requestId);
+    assertUnixSeconds("issuedAt", payload.issuedAt);
+    const lines = [
+        schemeContextLine(payload.scheme, payload.schemeVersion),
+        `canonicalDomain: ${payload.canonicalDomain}`,
+        `method: ${payload.method}`,
+        `path: ${payload.path}`,
+        `scheme: ${payload.scheme}`,
+        `network: ${payload.network}`,
+        `asset: ${payload.asset}`,
+        `amount: ${payload.amount}`,
+        `payer: ${payload.payer}`,
+        `payTo: ${payload.payTo}`,
+        `requestId: ${payload.requestId}`,
+        `issuedAt: ${payload.issuedAt}`,
+    ].join("\n");
+    if (payload.extensions === undefined || payload.extensions.length === 0)
+        return lines;
+    return `${lines}\n${serializeExtensionBlock(payload.extensions)}`;
+}
+/**
+ * Canonical `v402-balance-query/0.1` payload (spec § Topup Instructions
+ * Endpoint) — domain-separated from payment payloads via its own line 1.
+ */
+export function canonicalizeBalanceQuery(payload) {
+    assertLineSafe("canonicalDomain", payload.canonicalDomain);
+    if (!NETWORK_RE.test(payload.network))
+        invalid("network", payload.network, "must be a lowercase network identifier");
+    assertIdentity("payer", payload.payer);
+    assertRequestId(payload.requestId);
+    assertUnixSeconds("issuedAt", payload.issuedAt);
+    return [
+        BALANCE_QUERY_CONTEXT,
+        `canonicalDomain: ${payload.canonicalDomain}`,
+        `network: ${payload.network}`,
+        `payer: ${payload.payer}`,
+        `requestId: ${payload.requestId}`,
+        `issuedAt: ${payload.issuedAt}`,
+    ].join("\n");
+}
+//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGxE,4EAA4E;AAC5E,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAEhD,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AACD,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD,MAAM,iBAAiB,GAAG,YAAY,CAAC;AACvC,MAAM,SAAS,GAAG,UAAU,CAAC;AAC7B,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,iFAAiF;AACjF,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,SAAS,OAAO,CAAC,KAAa,EAAE,KAAc,EAAE,IAAY;IAC1D,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,GAAG,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,yDAAyD,CAAC,CAAC;AAClH,CAAC;AAED,yGAAyG;AACzG,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,+CAA+C,CAAC,CAAC;AACvH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,+CAA+C,CAAC,CAAC;AACxH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,6CAA6C,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAyB;IACpD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC;IACvH,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC3H,cAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IAC3G,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,wCAAwC,CAAC,CAAC;IACrH,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;IACpH,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG;QACZ,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC;QACxD,oBAAoB,OAAO,CAAC,eAAe,EAAE;QAC7C,WAAW,OAAO,CAAC,MAAM,EAAE;QAC3B,SAAS,OAAO,CAAC,IAAI,EAAE;QACvB,WAAW,OAAO,CAAC,MAAM,EAAE;QAC3B,YAAY,OAAO,CAAC,OAAO,EAAE;QAC7B,UAAU,OAAO,CAAC,KAAK,EAAE;QACzB,WAAW,OAAO,CAAC,MAAM,EAAE;QAC3B,UAAU,OAAO,CAAC,KAAK,EAAE;QACzB,UAAU,OAAO,CAAC,KAAK,EAAE;QACzB,cAAc,OAAO,CAAC,SAAS,EAAE;QACjC,aAAa,OAAO,CAAC,QAAQ,EAAE;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,GAAG,KAAK,KAAK,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA4B;IACnE,cAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,wCAAwC,CAAC,CAAC;IACrH,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhD,OAAO;QACL,qBAAqB;QACrB,oBAAoB,OAAO,CAAC,eAAe,EAAE;QAC7C,YAAY,OAAO,CAAC,OAAO,EAAE;QAC7B,UAAU,OAAO,CAAC,KAAK,EAAE;QACzB,cAAc,OAAO,CAAC,SAAS,EAAE;QACjC,aAAa,OAAO,CAAC,QAAQ,EAAE;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Error codes are stable identifiers — adapters map them to HTTP responses,
+ * so renaming one is a breaking change.
+ */
+export type V402ProtocolErrorCode = "invalid-amount" | "invalid-field" | "invalid-extension-key" | "invalid-extension-value" | "extensions-unsorted" | "extensions-duplicate-key" | "invalid-extension-block" | "invalid-signature-encoding";
+export declare class V402ProtocolError extends Error {
+    readonly code: V402ProtocolErrorCode;
+    constructor(code: V402ProtocolErrorCode, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,eAAe,GACf,uBAAuB,GACvB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,yBAAyB,GACzB,4BAA4B,CAAC;AAEjC,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;gBAEzB,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM;CAKzD"}

package/dist/errors.js

@@ -0,0 +1,9 @@
+export class V402ProtocolError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "V402ProtocolError";
+        this.code = code;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IAErC,YAAY,IAA2B,EAAE,OAAe;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/extensions.d.ts

@@ -0,0 +1,21 @@
+import type { ExtensionField } from "./types.js";
+/** Normative decoded size limit of the `X-V402-Extensions` block (B2). Enforced by servers. */
+export declare const MAX_EXTENSIONS_BYTES = 4096;
+export declare function isValidExtensionKey(key: string): boolean;
+/**
+ * Serialize extension fields to the exact byte block that gets signed and
+ * transmitted (base64-encoded) in `X-V402-Extensions`: `key: value` lines,
+ * sorted bytewise-ascending by key, LF-separated, no trailing newline.
+ *
+ * Input order does not matter — sorting happens here so all parties produce
+ * identical bytes. Duplicate keys are rejected.
+ */
+export declare function serializeExtensionBlock(fields: ExtensionField[]): string;
+/**
+ * Parse + validate a decoded `X-V402-Extensions` block (server side).
+ * The block must already be byte-identical to what was signed: LF-separated
+ * `key: value` lines, strictly ascending key order, no trailing newline.
+ * Semantic validation of known `scheme.*` fields is the verifier's job.
+ */
+export declare function parseExtensionBlock(block: string): ExtensionField[];
+//# sourceMappingURL=extensions.d.ts.map

package/dist/extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../src/extensions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,OAAO,CAAC;AASzC,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAcD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAcxE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAsBnE"}

package/dist/extensions.js

@@ -0,0 +1,74 @@
+import { V402ProtocolError } from "./errors.js";
+/** Normative decoded size limit of the `X-V402-Extensions` block (B2). Enforced by servers. */
+export const MAX_EXTENSIONS_BYTES = 4096;
+/**
+ * Extension key grammar: `<prefix>.<field>` where prefix is `scheme`, `iana`,
+ * or vendor-custom `x-<vendor>`. Field names are single alphanumeric segments
+ * starting with a letter (camelCase by convention, e.g. `scheme.bodyHash`).
+ */
+const EXTENSION_KEY_RE = /^(?:scheme|iana|x-[a-z0-9]+(?:-[a-z0-9]+)*)\.[A-Za-z][A-Za-z0-9]*$/;
+export function isValidExtensionKey(key) {
+    return EXTENSION_KEY_RE.test(key);
+}
+function assertValidField(field) {
+    if (!EXTENSION_KEY_RE.test(field.key)) {
+        throw new V402ProtocolError("invalid-extension-key", `invalid extension key: ${JSON.stringify(field.key)}`);
+    }
+    if (field.value.length === 0 || /[\r\n]/.test(field.value) || field.value.startsWith(" ")) {
+        throw new V402ProtocolError("invalid-extension-value", `extension value for ${field.key} must be non-empty, single-line, and must not start with a space`);
+    }
+}
+/**
+ * Serialize extension fields to the exact byte block that gets signed and
+ * transmitted (base64-encoded) in `X-V402-Extensions`: `key: value` lines,
+ * sorted bytewise-ascending by key, LF-separated, no trailing newline.
+ *
+ * Input order does not matter — sorting happens here so all parties produce
+ * identical bytes. Duplicate keys are rejected.
+ */
+export function serializeExtensionBlock(fields) {
+    const seen = new Set();
+    for (const field of fields) {
+        assertValidField(field);
+        if (seen.has(field.key)) {
+            throw new V402ProtocolError("extensions-duplicate-key", `duplicate extension key: ${field.key}`);
+        }
+        seen.add(field.key);
+    }
+    return fields
+        .slice()
+        .sort((a, b) => (a.key < b.key ? -1 : 1))
+        .map((f) => `${f.key}: ${f.value}`)
+        .join("\n");
+}
+/**
+ * Parse + validate a decoded `X-V402-Extensions` block (server side).
+ * The block must already be byte-identical to what was signed: LF-separated
+ * `key: value` lines, strictly ascending key order, no trailing newline.
+ * Semantic validation of known `scheme.*` fields is the verifier's job.
+ */
+export function parseExtensionBlock(block) {
+    if (block.length === 0)
+        return [];
+    if (/\r/.test(block) || block.endsWith("\n")) {
+        throw new V402ProtocolError("invalid-extension-block", "extension block must be LF-separated without trailing newline");
+    }
+    const fields = [];
+    let previousKey;
+    for (const line of block.split("\n")) {
+        const separator = line.indexOf(": ");
+        if (separator <= 0) {
+            throw new V402ProtocolError("invalid-extension-block", `malformed extension line: ${JSON.stringify(line)}`);
+        }
+        const field = { key: line.slice(0, separator), value: line.slice(separator + 2) };
+        assertValidField(field);
+        if (previousKey !== undefined && !(previousKey < field.key)) {
+            const code = previousKey === field.key ? "extensions-duplicate-key" : "extensions-unsorted";
+            throw new V402ProtocolError(code, `extension keys must be strictly ascending: ${previousKey} → ${field.key}`);
+        }
+        previousKey = field.key;
+        fields.push(field);
+    }
+    return fields;
+}
+//# sourceMappingURL=extensions.js.map

package/dist/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../src/extensions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,oEAAoE,CAAC;AAE9F,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uBAAuB,KAAK,CAAC,GAAG,kEAAkE,CACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAwB;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,4BAA4B,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM;SACV,KAAK,EAAE;SACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;SAClC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,+DAA+D,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,WAA+B,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,KAAK,GAAmB,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAClG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,WAAW,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC5F,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,8CAA8C,WAAW,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/headers.d.ts

@@ -0,0 +1,13 @@
+/** Canonical HTTP header names of the v402/0.1 wire format. */
+export declare const V402_HEADERS: {
+    readonly scheme: "X-V402-Scheme";
+    readonly payer: "X-V402-Payer";
+    readonly amount: "X-V402-Amount";
+    readonly requestId: "X-V402-Request-Id";
+    readonly issuedAt: "X-V402-Issued-At";
+    readonly signature: "X-V402-Signature";
+    readonly extensions: "X-V402-Extensions";
+};
+/** Headers a payment request MUST carry (`X-V402-Extensions` is optional). */
+export declare const REQUIRED_PAYMENT_HEADERS: readonly string[];
+//# sourceMappingURL=headers.d.ts.map

package/dist/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,eAAO,MAAM,YAAY;;;;;;;;CAQf,CAAC;AAEX,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAOrD,CAAC"}

package/dist/headers.js

@@ -0,0 +1,20 @@
+/** Canonical HTTP header names of the v402/0.1 wire format. */
+export const V402_HEADERS = {
+    scheme: "X-V402-Scheme",
+    payer: "X-V402-Payer",
+    amount: "X-V402-Amount",
+    requestId: "X-V402-Request-Id",
+    issuedAt: "X-V402-Issued-At",
+    signature: "X-V402-Signature",
+    extensions: "X-V402-Extensions",
+};
+/** Headers a payment request MUST carry (`X-V402-Extensions` is optional). */
+export const REQUIRED_PAYMENT_HEADERS = [
+    V402_HEADERS.scheme,
+    V402_HEADERS.payer,
+    V402_HEADERS.amount,
+    V402_HEADERS.requestId,
+    V402_HEADERS.issuedAt,
+    V402_HEADERS.signature,
+];
+//# sourceMappingURL=headers.js.map

package/dist/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,cAAc;IACrB,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,mBAAmB;IAC9B,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,mBAAmB;CACvB,CAAC;AAEX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,YAAY,CAAC,MAAM;IACnB,YAAY,CAAC,KAAK;IAClB,YAAY,CAAC,MAAM;IACnB,YAAY,CAAC,SAAS;IACtB,YAAY,CAAC,QAAQ;IACrB,YAAY,CAAC,SAAS;CACvB,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Canonical balance-account key for a VerusID friendly name.
+ *
+ * The Verus chain resolves identity names case-insensitively ("Fum@" and
+ * "fum@" are the same identity), but v402 keys balances by string. Every
+ * component that touches balance state (verifier lookups, deposit-watcher
+ * attribution) MUST key through this function, otherwise a deposit credited
+ * as "v402test.demoagent@" is invisible to a payer sending
+ * "v402test.demoAgent@".
+ *
+ * Signature verification is NOT affected — the canonical payload keeps the
+ * payer string exactly as the client signed it.
+ */
+export declare function normalizeIdentityKey(identity: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/identity.js

@@ -0,0 +1,17 @@
+/**
+ * Canonical balance-account key for a VerusID friendly name.
+ *
+ * The Verus chain resolves identity names case-insensitively ("Fum@" and
+ * "fum@" are the same identity), but v402 keys balances by string. Every
+ * component that touches balance state (verifier lookups, deposit-watcher
+ * attribution) MUST key through this function, otherwise a deposit credited
+ * as "v402test.demoagent@" is invisible to a payer sending
+ * "v402test.demoAgent@".
+ *
+ * Signature verification is NOT affected — the canonical payload keeps the
+ * payer string exactly as the client signed it.
+ */
+export function normalizeIdentityKey(identity) {
+    return identity.trim().toLowerCase();
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { V402ProtocolError, type V402ProtocolErrorCode } from "./errors.js";
+export { PROTOCOL_VERSION, SCHEME_VERUS_PREPAID_SIG, VERUS_PREPAID_SIG_VERSION, BALANCE_QUERY_CONTEXT, schemeContextLine, } from "./version.js";
+export { V402_HEADERS, REQUIRED_PAYMENT_HEADERS } from "./headers.js";
+export type { ExtensionField, CanonicalPayload, BalanceQueryPayload, PaymentRequirement, Payment402Response, PaymentClaim, DiscoveryDocument, } from "./types.js";
+export { AMOUNT_DECIMALS, SATS_PER_COIN, isValidHumanAmount, humanToSats, satsToHuman } from "./amount.js";
+export { MAX_EXTENSIONS_BYTES, isValidExtensionKey, serializeExtensionBlock, parseExtensionBlock, } from "./extensions.js";
+export { canonicalize, canonicalizeBalanceQuery, isValidUlid } from "./canonical.js";
+export { normalizeIdentityKey } from "./identity.js";
+export { isBase64Signature, assertBase64Signature } from "./signature.js";
+export { humanAmountSchema, ulidSchema, identitySchema, unixSecondsSchema, paymentRequirementSchema, payment402ResponseSchema, discoveryDocumentSchema, parsePaymentHeaders, type ParsePaymentHeadersResult, } from "./schemas.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,yBAAyB,GAC/B,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+export { V402ProtocolError } from "./errors.js";
+export { PROTOCOL_VERSION, SCHEME_VERUS_PREPAID_SIG, VERUS_PREPAID_SIG_VERSION, BALANCE_QUERY_CONTEXT, schemeContextLine, } from "./version.js";
+export { V402_HEADERS, REQUIRED_PAYMENT_HEADERS } from "./headers.js";
+export { AMOUNT_DECIMALS, SATS_PER_COIN, isValidHumanAmount, humanToSats, satsToHuman } from "./amount.js";
+export { MAX_EXTENSIONS_BYTES, isValidExtensionKey, serializeExtensionBlock, parseExtensionBlock, } from "./extensions.js";
+export { canonicalize, canonicalizeBalanceQuery, isValidUlid } from "./canonical.js";
+export { normalizeIdentityKey } from "./identity.js";
+export { isBase64Signature, assertBase64Signature } from "./signature.js";
+export { humanAmountSchema, ulidSchema, identitySchema, unixSecondsSchema, paymentRequirementSchema, payment402ResponseSchema, discoveryDocumentSchema, parsePaymentHeaders, } from "./schemas.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA8B,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAUtE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GAEpB,MAAM,cAAc,CAAC"}

package/dist/schemas.d.ts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+import type { PaymentClaim } from "./types.js";
+/**
+ * Wire validation (boundary only). Wire objects are parsed loose — a MINOR
+ * protocol version may add optional fields, and rejecting unknown keys would
+ * break forward compatibility.
+ */
+export declare const humanAmountSchema: z.ZodString;
+export declare const ulidSchema: z.ZodString;
+export declare const identitySchema: z.ZodString;
+export declare const unixSecondsSchema: z.ZodNumber;
+/** One fully validated `accepts` entry (validate the entry you picked, not the whole array). */
+export declare const paymentRequirementSchema: z.ZodObject<{
+    scheme: z.ZodString;
+    schemeVersion: z.ZodString;
+    network: z.ZodString;
+    asset: z.ZodString;
+    amount: z.ZodString;
+    amountUnit: z.ZodLiteral<"human">;
+    payTo: z.ZodString;
+    facilitator: z.ZodString;
+    requiredHeaders: z.ZodArray<z.ZodString>;
+    canonicalDomain: z.ZodString;
+    topup: z.ZodOptional<z.ZodObject<{
+        depositAddress: z.ZodString;
+        attribution: z.ZodLiteral<"sender-verusid">;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/**
+ * The 402 envelope. Entries are only shape-checked here — an unknown scheme
+ * with fields we can't interpret must not make the whole response unparseable.
+ */
+export declare const payment402ResponseSchema: z.ZodObject<{
+    version: z.ZodString;
+    accepts: z.ZodArray<z.ZodObject<{
+        scheme: z.ZodString;
+        schemeVersion: z.ZodString;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/** `.well-known/v402` discovery document. */
+export declare const discoveryDocumentSchema: z.ZodObject<{
+    specUrl: z.ZodOptional<z.ZodString>;
+    supportedVersions: z.ZodArray<z.ZodString>;
+    defaultVersion: z.ZodString;
+    deprecatedVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    sunsetDates: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    supportedExtensions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+export type ParsePaymentHeadersResult = {
+    ok: true;
+    claim: PaymentClaim;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Extract + validate the `X-V402-*` headers into a `PaymentClaim`.
+ * Case-insensitive lookup (Node lowercases incoming header names); repeated
+ * payment headers are rejected — fail closed, never pick one of two values.
+ */
+export declare function parsePaymentHeaders(headers: Record<string, string | string[] | undefined>): ParsePaymentHeadersResult;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;GAIG;AAEH,eAAO,MAAM,iBAAiB,aAAiF,CAAC;AAChH,eAAO,MAAM,UAAU,aAAgF,CAAC;AACxG,eAAO,MAAM,cAAc,aAEwD,CAAC;AACpF,eAAO,MAAM,iBAAiB,aAAiC,CAAC;AAEhE,gGAAgG;AAChG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAQnC,CAAC;AAEH,6CAA6C;AAC7C,eAAO,MAAM,uBAAuB;;;;;;;iBAOlC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAIjC;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,yBAAyB,CA2E3B"}

package/dist/schemas.js

@@ -0,0 +1,138 @@
+import { z } from "zod";
+import { isValidHumanAmount } from "./amount.js";
+import { isValidUlid } from "./canonical.js";
+import { isBase64Signature } from "./signature.js";
+import { V402_HEADERS } from "./headers.js";
+/**
+ * Wire validation (boundary only). Wire objects are parsed loose — a MINOR
+ * protocol version may add optional fields, and rejecting unknown keys would
+ * break forward compatibility.
+ */
+export const humanAmountSchema = z.string().refine(isValidHumanAmount, "must be a human decimal amount string");
+export const ulidSchema = z.string().refine(isValidUlid, "must be a ULID (26 chars, Crockford base32)");
+export const identitySchema = z
+    .string()
+    .regex(/^[^\s\x00-\x1f\x7f]+@$/, "must be a VerusID friendly name ending in '@'");
+export const unixSecondsSchema = z.number().int().nonnegative();
+/** One fully validated `accepts` entry (validate the entry you picked, not the whole array). */
+export const paymentRequirementSchema = z.looseObject({
+    scheme: z.string().min(1),
+    schemeVersion: z.string().regex(/^\d+\.\d+$/),
+    network: z.string().min(1),
+    asset: z.string().min(1),
+    amount: humanAmountSchema,
+    amountUnit: z.literal("human"),
+    payTo: identitySchema,
+    facilitator: z.string().min(1),
+    requiredHeaders: z.array(z.string().min(1)).min(1),
+    canonicalDomain: z.string().min(1),
+    topup: z
+        .looseObject({
+        depositAddress: identitySchema,
+        attribution: z.literal("sender-verusid"),
+    })
+        .optional(),
+});
+/**
+ * The 402 envelope. Entries are only shape-checked here — an unknown scheme
+ * with fields we can't interpret must not make the whole response unparseable.
+ */
+export const payment402ResponseSchema = z.looseObject({
+    version: z.string().min(1),
+    accepts: z.array(z.looseObject({
+        scheme: z.string().min(1),
+        schemeVersion: z.string().min(1),
+    })),
+});
+/** `.well-known/v402` discovery document. */
+export const discoveryDocumentSchema = z.looseObject({
+    specUrl: z.string().min(1).optional(),
+    supportedVersions: z.array(z.string().min(1)).min(1),
+    defaultVersion: z.string().min(1),
+    deprecatedVersions: z.array(z.string().min(1)).optional(),
+    sunsetDates: z.record(z.string(), z.string()).optional(),
+    supportedExtensions: z.array(z.string().min(1)).optional(),
+});
+const ISSUED_AT_RE = /^(?:0|[1-9]\d*)$/;
+/**
+ * Extract + validate the `X-V402-*` headers into a `PaymentClaim`.
+ * Case-insensitive lookup (Node lowercases incoming header names); repeated
+ * payment headers are rejected — fail closed, never pick one of two values.
+ */
+export function parsePaymentHeaders(headers) {
+    const byName = new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        if (value !== undefined)
+            byName.set(name.toLowerCase(), value);
+    }
+    const single = (name) => {
+        const value = byName.get(name.toLowerCase());
+        if (value === undefined)
+            return { error: `missing required header: ${name}` };
+        if (Array.isArray(value)) {
+            if (value.length !== 1)
+                return { error: `header must not repeat: ${name}` };
+            return value[0];
+        }
+        return value;
+    };
+    const read = {};
+    for (const name of [
+        V402_HEADERS.scheme,
+        V402_HEADERS.payer,
+        V402_HEADERS.amount,
+        V402_HEADERS.requestId,
+        V402_HEADERS.issuedAt,
+        V402_HEADERS.signature,
+    ]) {
+        const result = single(name);
+        if (typeof result !== "string")
+            return { ok: false, error: result.error };
+        read[name] = result;
+    }
+    const payer = read[V402_HEADERS.payer];
+    if (!identitySchema.safeParse(payer).success) {
+        return { ok: false, error: `${V402_HEADERS.payer} must be a VerusID friendly name ending in '@'` };
+    }
+    const amount = read[V402_HEADERS.amount];
+    if (!isValidHumanAmount(amount)) {
+        return { ok: false, error: `${V402_HEADERS.amount} must be a human decimal amount string` };
+    }
+    const requestId = read[V402_HEADERS.requestId];
+    if (!isValidUlid(requestId)) {
+        return { ok: false, error: `${V402_HEADERS.requestId} must be a ULID` };
+    }
+    const issuedAtRaw = read[V402_HEADERS.issuedAt];
+    if (!ISSUED_AT_RE.test(issuedAtRaw) || !Number.isSafeInteger(Number(issuedAtRaw))) {
+        return { ok: false, error: `${V402_HEADERS.issuedAt} must be Unix seconds (non-negative integer)` };
+    }
+    const signature = read[V402_HEADERS.signature];
+    if (!isBase64Signature(signature)) {
+        return { ok: false, error: `${V402_HEADERS.signature} must be standard Base64` };
+    }
+    const scheme = read[V402_HEADERS.scheme];
+    if (scheme.length === 0) {
+        return { ok: false, error: `${V402_HEADERS.scheme} must not be empty` };
+    }
+    const claim = {
+        scheme,
+        payer,
+        amount,
+        requestId,
+        issuedAt: Number(issuedAtRaw),
+        signature,
+    };
+    const extensions = byName.get(V402_HEADERS.extensions.toLowerCase());
+    if (extensions !== undefined) {
+        if (Array.isArray(extensions)) {
+            if (extensions.length !== 1)
+                return { ok: false, error: `header must not repeat: ${V402_HEADERS.extensions}` };
+            claim.extensionsRaw = extensions[0];
+        }
+        else {
+            claim.extensionsRaw = extensions;
+        }
+    }
+    return { ok: true, claim };
+}
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;AAChH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;AACxG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,wBAAwB,EAAE,+CAA+C,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAEhE,gGAAgG;AAChG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,iBAAiB;IACzB,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,KAAK,EAAE,cAAc;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC;SACL,WAAW,CAAC;QACX,cAAc,EAAE,cAAc;QAC9B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;KACzC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,WAAW,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC,CACH;CACF,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAMH,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAsD;IAEtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAA8B,EAAE;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,IAAI,EAAE,EAAE,CAAC;QAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,2BAA2B,IAAI,EAAE,EAAE,CAAC;YAC5E,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI;QACjB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,KAAK;QAClB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,SAAS;QACtB,YAAY,CAAC,QAAQ;QACrB,YAAY,CAAC,SAAS;KACvB,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAE,CAAC;IACxC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,gDAAgD,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAE,CAAC;IAC1C,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,wCAAwC,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAE,CAAC;IAChD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAE,CAAC;IACjD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,QAAQ,8CAA8C,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAE,CAAC;IAChD,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,SAAS,0BAA0B,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAE,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,oBAAoB,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,KAAK,GAAiB;QAC1B,MAAM;QACN,KAAK;QACL,MAAM;QACN,SAAS;QACT,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;QAC7B,SAAS;KACV,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC;YAC/G,KAAK,CAAC,aAAa,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,aAAa,GAAG,UAAU,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/signature.d.ts

@@ -0,0 +1,3 @@
+export declare function isBase64Signature(value: string): boolean;
+export declare function assertBase64Signature(value: string): void;
+//# sourceMappingURL=signature.d.ts.map

package/dist/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAUA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIzD"}

package/dist/signature.js

@@ -0,0 +1,17 @@
+import { V402ProtocolError } from "./errors.js";
+/**
+ * Signature encoding (Q4): Verus `signmessage` returns standard Base64 — the
+ * string travels bit-identically through `X-V402-Signature` into
+ * `verifymessage`. These helpers only gate the encoding; they never decode or
+ * re-encode.
+ */
+const BASE64_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/;
+export function isBase64Signature(value) {
+    return BASE64_RE.test(value);
+}
+export function assertBase64Signature(value) {
+    if (!BASE64_RE.test(value)) {
+        throw new V402ProtocolError("invalid-signature-encoding", "signature must be non-empty standard Base64 (not base64url)");
+    }
+}
+//# sourceMappingURL=signature.js.map

package/dist/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,SAAS,GAAG,kFAAkF,CAAC;AAErG,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,6DAA6D,CAAC,CAAC;IAC3H,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,82 @@
+/** One signed extension line, e.g. `{ key: "scheme.bodyHash", value: "sha256:…" }`. */
+export interface ExtensionField {
+    key: string;
+    value: string;
+}
+/**
+ * Input to `canonicalize()` — the 11 core fields plus optional extensions.
+ * On the server, core values come from server truth (config + request); only
+ * `path`, `payer`, `requestId`, `issuedAt` originate from the client.
+ */
+export interface CanonicalPayload {
+    scheme: string;
+    schemeVersion: string;
+    canonicalDomain: string;
+    method: string;
+    /** Request-target verbatim as sent on the wire, incl. query string (M1). */
+    path: string;
+    network: string;
+    asset: string;
+    /** Human decimal string, e.g. "0.001" — signed byte-verbatim. */
+    amount: string;
+    payer: string;
+    payTo: string;
+    /** ULID, Crockford base32, 26 chars. */
+    requestId: string;
+    /** Unix seconds. */
+    issuedAt: number;
+    extensions?: ExtensionField[];
+}
+/** Input to `canonicalizeBalanceQuery()` — see spec § Topup Instructions Endpoint. */
+export interface BalanceQueryPayload {
+    canonicalDomain: string;
+    network: string;
+    payer: string;
+    requestId: string;
+    issuedAt: number;
+}
+/** One entry of the 402 response's `accepts` array. */
+export interface PaymentRequirement {
+    scheme: string;
+    schemeVersion: string;
+    network: string;
+    asset: string;
+    amount: string;
+    amountUnit: "human";
+    payTo: string;
+    facilitator: string;
+    requiredHeaders: string[];
+    canonicalDomain: string;
+    topup?: {
+        depositAddress: string;
+        attribution: "sender-verusid";
+    };
+}
+/** The 402 Payment Required response body. */
+export interface Payment402Response {
+    version: string;
+    accepts: PaymentRequirement[];
+}
+/** Parsed + validated `X-V402-*` request headers. */
+export interface PaymentClaim {
+    scheme: string;
+    payer: string;
+    amount: string;
+    requestId: string;
+    issuedAt: number;
+    /** Standard Base64 as produced by Verus `signmessage` — pass-through, never re-encoded. */
+    signature: string;
+    /** Raw base64 value of `X-V402-Extensions`, if present. Decoded/validated by the verifier. */
+    extensionsRaw?: string;
+}
+/** The `.well-known/v402` discovery document. */
+export interface DiscoveryDocument {
+    specUrl?: string;
+    supportedVersions: string[];
+    defaultVersion: string;
+    deprecatedVersions?: string[];
+    /** version → ISO date */
+    sunsetDates?: Record<string, string>;
+    supportedExtensions?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;CAC/B;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,gBAAgB,CAAC;KAC/B,CAAC;CACH;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/version.d.ts

@@ -0,0 +1,18 @@
+/** Protocol (envelope) version — 402 response shape, discovery, headers. */
+export declare const PROTOCOL_VERSION = "v402/0.1";
+/** Registered scheme name of the Verus prepaid-signature scheme. */
+export declare const SCHEME_VERUS_PREPAID_SIG = "verus-prepaid-sig";
+/** Current scheme version of `verus-prepaid-sig`. Versions independently of the protocol. */
+export declare const VERUS_PREPAID_SIG_VERSION = "0.1";
+/**
+ * Line 1 of a signed payment payload: `<scheme>/<schemeVersion>`.
+ * For the MVP scheme: `verus-prepaid-sig/0.1`.
+ */
+export declare function schemeContextLine(scheme: string, schemeVersion: string): string;
+/**
+ * Line-1 context string of the signed balance query — deliberately distinct
+ * from every scheme context line so a payment signature can never verify as a
+ * balance query or vice versa (domain separation).
+ */
+export declare const BALANCE_QUERY_CONTEXT = "v402-balance-query/0.1";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D,6FAA6F;AAC7F,eAAO,MAAM,yBAAyB,QAAQ,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,2BAA2B,CAAC"}

package/dist/version.js

@@ -0,0 +1,20 @@
+/** Protocol (envelope) version — 402 response shape, discovery, headers. */
+export const PROTOCOL_VERSION = "v402/0.1";
+/** Registered scheme name of the Verus prepaid-signature scheme. */
+export const SCHEME_VERUS_PREPAID_SIG = "verus-prepaid-sig";
+/** Current scheme version of `verus-prepaid-sig`. Versions independently of the protocol. */
+export const VERUS_PREPAID_SIG_VERSION = "0.1";
+/**
+ * Line 1 of a signed payment payload: `<scheme>/<schemeVersion>`.
+ * For the MVP scheme: `verus-prepaid-sig/0.1`.
+ */
+export function schemeContextLine(scheme, schemeVersion) {
+    return `${scheme}/${schemeVersion}`;
+}
+/**
+ * Line-1 context string of the signed balance query — deliberately distinct
+ * from every scheme context line so a payment signature can never verify as a
+ * balance query or vice versa (domain separation).
+ */
+export const BALANCE_QUERY_CONTEXT = "v402-balance-query/0.1";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAE5D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,aAAqB;IACrE,OAAO,GAAG,MAAM,IAAI,aAAa,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC"}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@chainvue/v402-protocol",
+  "version": "0.1.0",
+  "description": "v402 protocol core: types, wire-format schemas, canonical payload serialization, amount utilities. Framework-agnostic, browser-safe.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chainvue/v402.git",
+    "directory": "packages/protocol"
+  },
+  "homepage": "https://github.com/chainvue/v402/tree/main/packages/protocol#readme",
+  "bugs": "https://github.com/chainvue/v402/issues",
+  "license": "Apache-2.0",
+  "author": "Robert Lech (chainvue)",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  }
+}