@curless/agentbank-core 0.0.1

package/README.md

@@ -0,0 +1,27 @@
+# @curless/agentbank-core
+
+Shared, **edge-safe** runtime primitives for the agentbank SDKs. Built on the
+Web Crypto API (`globalThis.crypto`) with **no `node:crypto` dependency**, so
+every SDK that depends on it runs unchanged on Node 18+, Vercel Edge,
+Cloudflare Workers and Deno.
+
+Most apps don't install this directly — it comes in as a dependency of
+`@curless/agentbank-sdk`, `@curless/agentbank-merchant-sdk` and
+`@curless/agentbank-protocols`.
+
+## Crypto
+
+```ts
+import { hmacSha256Hex, randomHex, timingSafeEqualHex } from '@curless/agentbank-core';
+
+const nonce = randomHex(32);                          // 64-char hex, sync
+const sig = await hmacSha256Hex(secret, `${ts}.${body}`); // HMAC-SHA256, async
+const ok = timingSafeEqualHex(sig, expected);         // constant-time compare
+```
+
+`hmacSha256Hex` is byte-for-byte identical to
+`node:crypto.createHmac('sha256', secret).update(message).digest('hex')`, so
+signatures stay compatible with the agentbank server. It is async because
+`crypto.subtle.sign` has no synchronous form on edge runtimes.
+
+MIT

package/dist/crypto.d.ts

@@ -0,0 +1,4 @@
+export declare const randomHex: (bytes?: number) => string;
+export declare const hmacSha256Hex: (secret: string, message: string) => Promise<string>;
+export declare const timingSafeEqualHex: (a: string, b: string) => boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,SAAS,GAAI,cAAU,KAAG,MAC0B,CAAC;AAOlE,eAAO,MAAM,aAAa,GAAU,QAAQ,MAAM,EAAE,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAUnF,CAAC;AAKF,eAAO,MAAM,kBAAkB,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAKzD,CAAC"}

package/dist/crypto.js

@@ -0,0 +1,40 @@
+// Edge-safe crypto for the agentbank SDKs.
+//
+// Uses the Web Crypto API (`globalThis.crypto`) instead of `node:crypto`, so
+// the SDKs that depend on this run unchanged on Node 18+, Vercel Edge,
+// Cloudflare Workers and Deno — none of which expose `node:crypto`. The HMAC
+// helper is async because `crypto.subtle.sign` is Promise-based (there is no
+// synchronous form on the edge); random + compare stay synchronous.
+const encoder = new TextEncoder();
+const toHex = (buf) => {
+    const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+    let out = '';
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, '0');
+    return out;
+};
+// Cryptographically strong random hex string of `bytes` bytes (default 32 →
+// 64 hex chars). Synchronous — `getRandomValues` is sync on every runtime.
+export const randomHex = (bytes = 32) => toHex(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
+// HMAC-SHA256 of `message` under `secret`, hex-encoded. Byte-for-byte
+// identical to `node:crypto.createHmac('sha256', secret).update(message)
+// .digest('hex')`, so signatures stay compatible with the agentbank server
+// (which signs with node:crypto). Note: WebCrypto rejects a zero-length key
+// (`secret`) — a misconfiguration we throw on rather than sign with.
+export const hmacSha256Hex = async (secret, message) => {
+    const key = await globalThis.crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(message));
+    return toHex(signature);
+};
+// Constant-time comparison of two hex strings. Returns false on a length
+// mismatch; otherwise compares every char so timing doesn't leak where they
+// differ. Use for verifying HMAC signatures (never `===`).
+export const timingSafeEqualHex = (a, b) => {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+};
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,6EAA6E;AAC7E,oEAAoE;AAEpE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,KAAK,GAAG,CAAC,GAA6B,EAAU,EAAE;IACtD,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAC9C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAElE,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAAE,OAAe,EAAmB,EAAE;IACtF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,yEAAyE;AACzE,4EAA4E;AAC5E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAClE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,7 @@
+export declare class AgentbankError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: unknown;
+    constructor(status: number, code: string, message: string, details?: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAOA,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAO7E"}

package/dist/errors.js

@@ -0,0 +1,20 @@
+// Thrown for any non-2xx agentbank response. `code` is the agentbank error
+// code (e.g. CONFLICT, FORBIDDEN, NOT_FOUND) or the OAuth error code
+// (e.g. invalid_client); `status` is the HTTP status.
+//
+// Lives in @curless/agentbank-core so every SDK throws the SAME class —
+// `err instanceof AgentbankError` works whether the error came from the
+// buyer SDK, the merchant SDK, or a protocol helper.
+export class AgentbankError extends Error {
+    status;
+    code;
+    details;
+    constructor(status, code, message, details) {
+        super(message);
+        this.name = 'AgentbankError';
+        this.status = status;
+        this.code = code;
+        this.details = details;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,qEAAqE;AACrE,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,qDAAqD;AACrD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAW;IAE3B,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/dist/http.d.ts

@@ -0,0 +1,12 @@
+import { AgentbankError } from './errors.js';
+export type FetchLike = typeof fetch;
+export type RequestOptions = {
+    query?: Record<string, string | number | undefined>;
+    body?: unknown;
+    idempotencyKey?: string;
+    skipAuth?: boolean;
+};
+export declare const buildUrl: (baseUrl: string, path: string, query?: RequestOptions["query"]) => string;
+export declare const toError: (status: number, json: unknown) => AgentbankError;
+export declare const sendJson: <T>(fetchImpl: FetchLike, url: string, method: string, headers: Record<string, string>, body: unknown) => Promise<T>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAO7C,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAGF,eAAO,MAAM,QAAQ,GACnB,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,QAAQ,cAAc,CAAC,OAAO,CAAC,KAC9B,MAQF,CAAC;AAIF,eAAO,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,MAAM,OAAO,KAAG,cAiBvD,CAAC;AAKF,eAAO,MAAM,QAAQ,GAAU,CAAC,EAC9B,WAAW,SAAS,EACpB,KAAK,MAAM,EACX,QAAQ,MAAM,EACd,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,OAAO,KACZ,OAAO,CAAC,CAAC,CAUX,CAAC"}

package/dist/http.js

@@ -0,0 +1,43 @@
+import { AgentbankError } from './errors.js';
+// Build a fully-qualified URL with query params (undefined values dropped).
+export const buildUrl = (baseUrl, path, query) => {
+    const url = new URL(`${baseUrl}${path}`);
+    if (query) {
+        for (const [k, v] of Object.entries(query)) {
+            if (v !== undefined)
+                url.searchParams.set(k, String(v));
+        }
+    }
+    return url.toString();
+};
+// Map both agentbank's `{ error: { code, message, details } }` and the OAuth
+// `{ error, error_description }` shapes to AgentbankError.
+export const toError = (status, json) => {
+    if (json && typeof json === 'object') {
+        const o = json;
+        if (o.error && typeof o.error === 'object') {
+            const e = o.error;
+            return new AgentbankError(status, String(e.code ?? 'error'), String(e.message ?? 'request failed'), e.details);
+        }
+        if (typeof o.error === 'string') {
+            return new AgentbankError(status, o.error, String(o.error_description ?? o.error));
+        }
+    }
+    return new AgentbankError(status, 'error', `request failed with status ${status}`);
+};
+// Send a JSON request, parse the JSON response, and throw AgentbankError on a
+// non-2xx. Headers (incl. auth) are built by the caller. Body is JSON-encoded
+// unless undefined.
+export const sendJson = async (fetchImpl, url, method, headers, body) => {
+    const res = await fetchImpl(url, {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    const text = await res.text();
+    const json = text ? JSON.parse(text) : undefined;
+    if (!res.ok)
+        throw toError(res.status, json);
+    return json;
+};
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAkB7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,OAAe,EACf,IAAY,EACZ,KAA+B,EACvB,EAAE;IACV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAkB,EAAE;IACvE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgC,CAAC;YAC7C,OAAO,IAAI,cAAc,CACvB,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EACzB,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,EACrC,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,8BAA8B,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,8EAA8E;AAC9E,8EAA8E;AAC9E,oBAAoB;AACpB,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,SAAoB,EACpB,GAAW,EACX,MAAc,EACd,OAA+B,EAC/B,IAAa,EACD,EAAE;IACd,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM;QACN,OAAO;QACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { hmacSha256Hex, randomHex, timingSafeEqualHex } from './crypto.js';
+export { AgentbankError } from './errors.js';
+export { type FetchLike, type RequestOptions, buildUrl, sendJson, toError } from './http.js';
+export type { BalanceTransaction, Customer, CustomerStatus, LedgerEntryView, Paginated, PaymentIntent, PaymentIntentLedger, PaymentIntentStatus, PaymentLink, PaymentLinkItem, PaymentLinkStatus, PaymentProtocol, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7F,YAAY,EACV,kBAAkB,EAClB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+// @curless/agentbank-core — shared, edge-safe runtime primitives for the
+// agentbank SDKs. The buyer / merchant / protocol packages build on this so
+// there's one implementation: one crypto path, one error class, one HTTP +
+// type surface.
+export { hmacSha256Hex, randomHex, timingSafeEqualHex } from './crypto.js';
+export { AgentbankError } from './errors.js';
+export { buildUrl, sendJson, toError } from './http.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,gBAAgB;AAChB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAuC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,80 @@
+export type PaymentIntentStatus = 'initiated' | 'authorized' | 'authorizing' | 'captured' | 'settled' | 'reconciled' | 'failed' | 'partially_refunded' | 'refunded' | 'disputed';
+export type PaymentProtocol = 'a2a' | 'acp' | 'ap2' | 'ucp' | 'mcp' | 'x402' | 'tap' | 'skyfire' | 'mpp' | 'mc' | 'direct';
+export type PaymentIntent = {
+    id: string;
+    organizationId: string | null;
+    agentId?: string | null;
+    curlessMerchantId: string;
+    protocol: PaymentProtocol;
+    rail?: string | null;
+    status: PaymentIntentStatus;
+    amount: number;
+    currency: string;
+    railReference?: string | null;
+    idempotencyKey?: string | null;
+    createdAt: string;
+    updatedAt: string;
+    settledAt?: string | null;
+};
+export type CustomerStatus = 'active' | 'disabled';
+export type Customer = {
+    id: string;
+    organizationId: string;
+    externalId?: string | null;
+    email?: string | null;
+    name?: string | null;
+    status: CustomerStatus;
+    curlessWalletId?: string | null;
+    metadata: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+};
+export type PaymentLinkStatus = 'active' | 'inactive' | 'expired';
+export type PaymentLinkItem = {
+    catalogItemId: string;
+    quantity: number;
+    unitPrice: number;
+};
+export type PaymentLink = {
+    id: string;
+    url: string;
+    mode: 'test' | 'live';
+    curlessMerchantId: string;
+    amount: number;
+    currency: string;
+    description?: string | null;
+    items: PaymentLinkItem[];
+    status: PaymentLinkStatus;
+    maxUses?: number | null;
+    useCount: number;
+    expiresAt?: string | null;
+    createdAt: string;
+};
+export type Paginated<T> = {
+    data: T[];
+    pagination: {
+        limit: number;
+        offset: number;
+        count: number;
+    };
+};
+export type LedgerEntryView = {
+    transactionId: string;
+    purpose: string;
+    referenceType?: string | null;
+    referenceId?: string | null;
+    walletId: string;
+    walletKind?: string | null;
+    direction: 'debit' | 'credit';
+    amount: number;
+    currency: string;
+    createdAt: string;
+};
+export type PaymentIntentLedger = {
+    paymentIntentId: string;
+    data: LedgerEntryView[];
+};
+export type BalanceTransaction = LedgerEntryView & {
+    paymentIntentId: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,YAAY,GACZ,QAAQ,GACR,oBAAoB,GACpB,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,MAAM,GACN,KAAK,GACL,SAAS,GACT,KAAK,GACL,IAAI,GACJ,QAAQ,CAAC;AAEb,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAGnD,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IAEX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI;IACzB,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D,CAAC;AAKF,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAGF,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB,CAAC;AAGF,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/types.js

@@ -0,0 +1,6 @@
+// Shared API resource types — the shapes both the buyer and merchant SDKs
+// return. Kept loose (some fields optional) so a minor server-side addition
+// doesn't break consumers. SDK-specific types (Agent, SpendAuthorization,
+// WebhookEndpoint, …) live in each SDK's own types module.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,2DAA2D"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@curless/agentbank-core",
+  "version": "0.0.1",
+  "description": "Shared runtime primitives for the agentbank SDKs. Edge-safe crypto (Web Crypto API, no node:crypto) so the buyer / merchant / protocol SDKs run unchanged on Node 18+, Vercel Edge, Cloudflare Workers and Deno.",
+  "license": "MIT",
+  "type": "module",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./crypto": {
+      "types": "./dist/crypto.d.ts",
+      "default": "./dist/crypto.js"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.1",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.9"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "agentbank",
+    "curless",
+    "webcrypto",
+    "edge-runtime",
+    "hmac"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}