@curless/agentbank-merchant-sdk 0.0.1

package/README.md

@@ -0,0 +1,48 @@
+# @curless/agentbank-merchant-sdk
+
+Merchant-side SDK for [agentbank](https://gitlab.com/robin-ruan/agentbank).
+Drop into a merchant's backend (Shopify storefront, ClubMed booking flow,
+TikTok Shop seller service, anything that wants to **accept agent payments**)
+and you get:
+
+- **`AgentbankMerchant`** — typed client for `PaymentIntents` (create/get/capture/list across ACP / x402 / AP2 / UCP / A2A) and `WebhookEndpoints`.
+- **`verifyWebhook` / `parseVerifiedWebhook`** — HMAC-SHA256 signature verification (Stripe-style `t=…,v1=…`), constant-time.
+- **`x402`** — `buildChallenge()` to emit your own canonical 402 from your route, `decodeXPaymentHeader()` to parse what the agent paid with.
+
+Zero runtime dependencies (pure `fetch` + `node:crypto`). Node 18+.
+
+```ts
+import { AgentbankMerchant, parseVerifiedWebhook, x402 } from '@curless/agentbank-merchant-sdk';
+
+const client = new AgentbankMerchant({
+  baseUrl: 'https://api.agentbank.dev',
+  apiKey: process.env.AGENTBANK_KEY!, // merchant:write
+});
+
+// Create a PaymentIntent the agent will pay against
+const pi = await client.paymentIntents.create({
+  organizationId: 'org_123',
+  curlessMerchantId: 'curless_mch_clubmed_bali',
+  amount: 1160,
+  currency: 'USD',
+  protocol: 'x402',
+  items: [{ catalogItemId: 'room-suite', quantity: 1, unitPrice: 1160 }],
+  idempotencyKey: req.headers['idempotency-key'],
+});
+
+// Verify an inbound agentbank webhook
+const event = parseVerifiedWebhook(
+  process.env.WEBHOOK_SECRET!, // whsec_… from /v1/webhook-endpoints
+  await req.text(),            // RAW body, NOT JSON-parsed
+  req.headers['x-agentbank-signature'],
+);
+
+// Or emit your own 402 challenge from your route
+return new Response(JSON.stringify(x402.buildChallenge({
+  asset: '0x036CbD…F7e',         // base-sepolia USDC
+  network: 'base-sepolia',
+  payTo: '0xMerchantAddr',
+  amount: '6200000',              // 6.20 USDC
+  resource: 'https://shop.example/api/checkout',
+})), { status: 402, headers: { 'content-type': 'application/json' } });
+```

package/dist/client.d.ts

@@ -0,0 +1,24 @@
+import { PaymentIntentsResource } from './resources/payment-intents.js';
+import { WebhookEndpointsResource } from './resources/webhook-endpoints.js';
+export type FetchLike = typeof fetch;
+export type RequestOptions = {
+    query?: Record<string, string | number | undefined>;
+    body?: unknown;
+    idempotencyKey?: string;
+};
+export type AgentbankMerchantOptions = {
+    baseUrl: string;
+    apiKey: string;
+    fetch?: FetchLike;
+};
+export declare class AgentbankMerchant {
+    readonly baseUrl: string;
+    private readonly fetchImpl;
+    private readonly apiKey;
+    readonly paymentIntents: PaymentIntentsResource;
+    readonly webhookEndpoints: WebhookEndpointsResource;
+    constructor(opts: AgentbankMerchantOptions);
+    /** @internal */
+    request<T>(method: string, path: string, opts?: RequestOptions): Promise<T>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAEhB,MAAM,EAAE,MAAM,CAAC;IAEf,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAOF,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;gBAExC,IAAI,EAAE,wBAAwB;IAQ1C,gBAAgB;IACV,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;CAyBtF"}

package/dist/client.js

@@ -0,0 +1,59 @@
+import { AgentbankError } from './errors.js';
+import { PaymentIntentsResource } from './resources/payment-intents.js';
+import { WebhookEndpointsResource } from './resources/webhook-endpoints.js';
+// Merchant-side client for agentbank. Wraps the HTTP surface a merchant
+// integrates against: create + capture PaymentIntents (any protocol),
+// manage webhook subscriptions, query PI status. Webhook verification
+// + x402 challenge helpers live in ./webhooks and ./x402 as pure
+// functions (no client needed).
+export class AgentbankMerchant {
+    baseUrl;
+    fetchImpl;
+    apiKey;
+    paymentIntents;
+    webhookEndpoints;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
+        this.apiKey = opts.apiKey;
+        this.fetchImpl = opts.fetch ?? fetch;
+        this.paymentIntents = new PaymentIntentsResource(this);
+        this.webhookEndpoints = new WebhookEndpointsResource(this);
+    }
+    /** @internal */
+    async request(method, path, opts = {}) {
+        const url = new URL(`${this.baseUrl}${path}`);
+        if (opts.query) {
+            for (const [k, v] of Object.entries(opts.query)) {
+                if (v !== undefined)
+                    url.searchParams.set(k, String(v));
+            }
+        }
+        const headers = {
+            'content-type': 'application/json',
+            authorization: `Bearer ${this.apiKey}`,
+        };
+        if (opts.idempotencyKey)
+            headers['idempotency-key'] = opts.idempotencyKey;
+        const res = await this.fetchImpl(url.toString(), {
+            method,
+            headers,
+            body: opts.body === undefined ? undefined : JSON.stringify(opts.body),
+        });
+        const text = await res.text();
+        const json = text ? JSON.parse(text) : undefined;
+        if (!res.ok)
+            throw toError(res.status, json);
+        return json;
+    }
+}
+const toError = (status, json) => {
+    if (json && typeof json === 'object') {
+        const o = json;
+        if (o.error && typeof o.error === 'object') {
+            const e = o.error;
+            return new AgentbankError(status, String(e.code ?? 'error'), String(e.message ?? 'request failed'), e.details);
+        }
+    }
+    return new AgentbankError(status, 'error', `request failed with status ${status}`);
+};
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAmB5E,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,iEAAiE;AACjE,gCAAgC;AAChC,MAAM,OAAO,iBAAiB;IACnB,OAAO,CAAS;IACR,SAAS,CAAY;IACrB,MAAM,CAAS;IAEvB,cAAc,CAAyB;IACvC,gBAAgB,CAA2B;IAEpD,YAAY,IAA8B;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAuB,EAAE;QACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;SACvC,CAAC;QACF,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAE1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC/C,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAkB,EAAE;IAChE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgC,CAAC;YAC7C,OAAO,IAAI,cAAc,CACvB,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EACzB,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,EACrC,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,8BAA8B,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,7 @@
+export declare class AgentbankError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: unknown;
+    constructor(status: number, code: string, message: string, details?: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAO7E"}

package/dist/errors.js

@@ -0,0 +1,15 @@
+// Thrown for any non-2xx agentbank response. `code` is the agentbank
+// error code (e.g. CONFLICT, FORBIDDEN, NOT_FOUND) and `status` is HTTP.
+export class AgentbankError extends Error {
+    status;
+    code;
+    details;
+    constructor(status, code, message, details) {
+        super(message);
+        this.name = 'AgentbankError';
+        this.status = status;
+        this.code = code;
+        this.details = details;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,yEAAyE;AACzE,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAW;IAE3B,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { AgentbankMerchant } from './client.js';
+export type { AgentbankMerchantOptions, FetchLike, RequestOptions, } from './client.js';
+export { AgentbankError } from './errors.js';
+export type { Paginated, PaymentIntent, PaymentIntentStatus, PaymentProtocol, WebhookEndpoint, WebhookEndpointWithSecret, X402PaymentRequirements, } from './types.js';
+export type { CreatePaymentIntentInput } from './resources/payment-intents.js';
+export type { CreateWebhookEndpointInput } from './resources/webhook-endpoints.js';
+export { WEBHOOK_SIGNATURE_HEADER, parseVerifiedWebhook, verifyWebhook, } from './webhooks.js';
+export type { VerifyWebhookOptions, WebhookEvent } from './webhooks.js';
+import * as x402 from './x402.js';
+export { x402 };
+export type { BuildChallengeInput, DecodedXPayment, X402ChallengeBody, } from './x402.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,YAAY,EACV,wBAAwB,EACxB,SAAS,EACT,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EACV,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,CAAC;AAChB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { AgentbankMerchant } from './client.js';
+export { AgentbankError } from './errors.js';
+export { WEBHOOK_SIGNATURE_HEADER, parseVerifiedWebhook, verifyWebhook, } from './webhooks.js';
+// x402 helpers — namespaced so consumers `import { x402 } from ...`.
+import * as x402 from './x402.js';
+export { x402 };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMhD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAY7C,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,qEAAqE;AACrE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/resources/payment-intents.d.ts

@@ -0,0 +1,30 @@
+import type { AgentbankMerchant } from '../client.js';
+import type { Paginated, PaymentIntent, PaymentIntentStatus, PaymentProtocol } from '../types.js';
+export type CreatePaymentIntentInput = {
+    organizationId: string;
+    agentId?: string;
+    curlessMerchantId: string;
+    amount: number;
+    currency: string;
+    protocol: PaymentProtocol;
+    items: Array<{
+        catalogItemId: string;
+        quantity: number;
+        unitPrice: number;
+    }>;
+    metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
+};
+export declare class PaymentIntentsResource {
+    private readonly client;
+    constructor(client: AgentbankMerchant);
+    create(input: CreatePaymentIntentInput): Promise<PaymentIntent>;
+    get(id: string): Promise<PaymentIntent>;
+    capture(id: string): Promise<PaymentIntent>;
+    list(params?: {
+        limit?: number;
+        offset?: number;
+        status?: PaymentIntentStatus;
+    }): Promise<Paginated<PaymentIntent>>;
+}
+//# sourceMappingURL=payment-intents.d.ts.map

package/dist/resources/payment-intents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-intents.d.ts","sourceRoot":"","sources":["../../src/resources/payment-intents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAElG,MAAM,MAAM,wBAAwB,GAAG;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAIF,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD,MAAM,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC;IAQ/D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAOvC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAO3C,IAAI,CACF,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,mBAAmB,CAAA;KAAO,GAC7E,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;CAKrC"}

package/dist/resources/payment-intents.js

@@ -0,0 +1,27 @@
+// PaymentIntents — the rail-agnostic create/capture/get/list a merchant
+// uses regardless of protocol (ACP / x402 / AP2 / UCP / A2A / direct).
+export class PaymentIntentsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    create(input) {
+        const { idempotencyKey, ...body } = input;
+        return this.client.request('POST', '/v1/payment-intents', {
+            body,
+            idempotencyKey,
+        });
+    }
+    get(id) {
+        return this.client.request('GET', `/v1/payment-intents/${encodeURIComponent(id)}`);
+    }
+    capture(id) {
+        return this.client.request('POST', `/v1/payment-intents/${encodeURIComponent(id)}/capture`);
+    }
+    list(params = {}) {
+        return this.client.request('GET', '/v1/payment-intents', {
+            query: params,
+        });
+    }
+}
+//# sourceMappingURL=payment-intents.js.map

package/dist/resources/payment-intents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-intents.js","sourceRoot":"","sources":["../../src/resources/payment-intents.ts"],"names":[],"mappings":"AAeA,wEAAwE;AACxE,uEAAuE;AACvE,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAE1D,MAAM,CAAC,KAA+B;QACpC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAgB,MAAM,EAAE,qBAAqB,EAAE;YACvE,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,KAAK,EACL,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,MAAM,EACN,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,UAAU,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,CACF,SAA4E,EAAE;QAE9E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAA2B,KAAK,EAAE,qBAAqB,EAAE;YACjF,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/resources/webhook-endpoints.d.ts

@@ -0,0 +1,20 @@
+import type { AgentbankMerchant } from '../client.js';
+import type { Paginated, WebhookEndpoint, WebhookEndpointWithSecret } from '../types.js';
+export type CreateWebhookEndpointInput = {
+    url: string;
+    description?: string;
+    eventTypes?: string[];
+};
+export declare class WebhookEndpointsResource {
+    private readonly client;
+    constructor(client: AgentbankMerchant);
+    create(input: CreateWebhookEndpointInput): Promise<WebhookEndpointWithSecret>;
+    list(params?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<Paginated<WebhookEndpoint>>;
+    delete(endpointId: string): Promise<{
+        deleted: string;
+    }>;
+}
+//# sourceMappingURL=webhook-endpoints.d.ts.map

package/dist/resources/webhook-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-endpoints.d.ts","sourceRoot":"","sources":["../../src/resources/webhook-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAEzF,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAMF,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAM7E,IAAI,CAAC,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAM3F,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAMzD"}

package/dist/resources/webhook-endpoints.js

@@ -0,0 +1,24 @@
+// Webhook endpoint subscriptions. agentbank fans payment events out to
+// enabled endpoints (signed via HMAC, retried via outbox). The signing
+// secret is returned ONLY on create — store it; you'll need it for
+// verifyWebhook(). See ../webhooks.ts.
+export class WebhookEndpointsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    create(input) {
+        return this.client.request('POST', '/v1/webhook-endpoints', {
+            body: input,
+        });
+    }
+    list(params = {}) {
+        return this.client.request('GET', '/v1/webhook-endpoints', {
+            query: params,
+        });
+    }
+    delete(endpointId) {
+        return this.client.request('DELETE', `/v1/webhook-endpoints/${encodeURIComponent(endpointId)}`);
+    }
+}
+//# sourceMappingURL=webhook-endpoints.js.map

package/dist/resources/webhook-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-endpoints.js","sourceRoot":"","sources":["../../src/resources/webhook-endpoints.ts"],"names":[],"mappings":"AAUA,uEAAuE;AACvE,uEAAuE;AACvE,mEAAmE;AACnE,uCAAuC;AACvC,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAE1D,MAAM,CAAC,KAAiC;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAA4B,MAAM,EAAE,uBAAuB,EAAE;YACrF,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,SAA8C,EAAE;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAA6B,KAAK,EAAE,uBAAuB,EAAE;YACrF,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,QAAQ,EACR,yBAAyB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,53 @@
+export type PaymentIntentStatus = 'initiated' | 'authorized' | 'authorizing' | 'captured' | 'settled' | 'reconciled' | 'failed' | 'refunded' | 'disputed';
+export type PaymentProtocol = 'a2a' | 'acp' | 'ap2' | 'ucp' | 'mcp' | 'x402' | 'tap' | 'mc' | 'direct';
+export type PaymentIntent = {
+    id: string;
+    organizationId: string | null;
+    agentId?: string | null;
+    curlessMerchantId: string;
+    protocol: PaymentProtocol;
+    rail?: string | null;
+    status: PaymentIntentStatus;
+    amount: number;
+    currency: string;
+    railReference?: string | null;
+    idempotencyKey?: string | null;
+    createdAt: string;
+    updatedAt: string;
+    settledAt?: string | null;
+};
+export type WebhookEndpoint = {
+    id: string;
+    url: string;
+    description?: string | null;
+    enabled: boolean;
+    eventTypes: string[];
+    createdAt: string;
+};
+export type WebhookEndpointWithSecret = WebhookEndpoint & {
+    secret: string;
+};
+export type Paginated<T> = {
+    data: T[];
+    pagination: {
+        limit: number;
+        offset: number;
+        count: number;
+    };
+};
+export type X402PaymentRequirements = {
+    scheme: 'exact';
+    network: string;
+    maxAmountRequired: string;
+    resource: string;
+    description: string;
+    mimeType: string;
+    payTo: string;
+    maxTimeoutSeconds: number;
+    asset: string;
+    extra?: {
+        name?: string;
+        version?: string;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,KAAK,GACL,MAAM,GACN,KAAK,GACL,IAAI,GACJ,QAAQ,CAAC;AAEb,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAGF,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI;IACzB,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D,CAAC;AAIF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C,CAAC"}

package/dist/types.js

@@ -0,0 +1,4 @@
+// Resource types mirror the agentbank API. Kept loose (some fields
+// optional) so a minor server-side addition doesn't break consumers.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qEAAqE"}

package/dist/webhooks.d.ts

@@ -0,0 +1,14 @@
+export declare const WEBHOOK_SIGNATURE_HEADER = "x-agentbank-signature";
+export type VerifyWebhookOptions = {
+    toleranceSec?: number;
+    nowSec?: number;
+};
+export declare const verifyWebhook: (secret: string, rawBody: string, signatureHeader: string | undefined | null, opts?: VerifyWebhookOptions) => boolean;
+export type WebhookEvent = {
+    id: string;
+    type: string;
+    data: Record<string, unknown>;
+    createdAt?: string;
+};
+export declare const parseVerifiedWebhook: (secret: string, rawBody: string, signatureHeader: string | undefined | null, opts?: VerifyWebhookOptions) => WebhookEvent;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAAG;IAEjC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,SAAS,MAAM,EACf,iBAAiB,MAAM,GAAG,SAAS,GAAG,IAAI,EAC1C,OAAM,oBAAyB,KAC9B,OAeF,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,MAAM,EACd,SAAS,MAAM,EACf,iBAAiB,MAAM,GAAG,SAAS,GAAG,IAAI,EAC1C,OAAM,oBAAyB,KAC9B,YAYF,CAAC"}

package/dist/webhooks.js

@@ -0,0 +1,41 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+// HMAC-SHA256 webhook signature verification (Stripe-style). The signed
+// content is `${timestamp}.${rawBody}` and the header value is
+// `t=<unix seconds>,v1=<hex hmac>`. Header name: `x-agentbank-signature`.
+//
+// Always verify against the RAW request body — DO NOT parse JSON first
+// or you'll re-serialize differently and the HMAC won't match.
+export const WEBHOOK_SIGNATURE_HEADER = 'x-agentbank-signature';
+export const verifyWebhook = (secret, rawBody, signatureHeader, opts = {}) => {
+    if (!signatureHeader)
+        return false;
+    const toleranceSec = opts.toleranceSec ?? 300;
+    const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000);
+    const fields = new Map(signatureHeader.split(',').map((p) => p.split('=')));
+    const t = Number(fields.get('t'));
+    const v1 = fields.get('v1');
+    if (!Number.isFinite(t) || !v1)
+        return false;
+    if (Math.abs(nowSec - t) > toleranceSec)
+        return false;
+    const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
+    const got = Buffer.from(v1);
+    const want = Buffer.from(expected);
+    return got.length === want.length && timingSafeEqual(got, want);
+};
+export const parseVerifiedWebhook = (secret, rawBody, signatureHeader, opts = {}) => {
+    if (!verifyWebhook(secret, rawBody, signatureHeader, opts)) {
+        throw new Error('invalid webhook signature');
+    }
+    let event;
+    try {
+        event = JSON.parse(rawBody);
+    }
+    catch {
+        throw new Error('malformed webhook body');
+    }
+    if (!event.id || !event.type)
+        throw new Error('webhook missing id/type');
+    return event;
+};
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,wEAAwE;AACxE,+DAA+D;AAC/D,0EAA0E;AAC1E,EAAE;AACF,uEAAuE;AACvE,+DAA+D;AAE/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAShE,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAc,EACd,OAAe,EACf,eAA0C,EAC1C,OAA6B,EAAE,EACtB,EAAE;IACX,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC;IAEtD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,OAAe,EACf,eAA0C,EAC1C,OAA6B,EAAE,EACjB,EAAE;IAChB,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/x402.d.ts

@@ -0,0 +1,39 @@
+import type { X402PaymentRequirements } from './types.js';
+export type BuildChallengeInput = {
+    asset: string;
+    network: string;
+    payTo: string;
+    amount: string | number | bigint;
+    resource: string;
+    description?: string;
+    mimeType?: string;
+    maxTimeoutSeconds?: number;
+    extra?: {
+        name?: string;
+        version?: string;
+    };
+};
+export type X402ChallengeBody = {
+    x402Version: 1;
+    accepts: X402PaymentRequirements[];
+    error?: string;
+};
+export declare const buildChallenge: (input: BuildChallengeInput) => X402ChallengeBody;
+export type DecodedXPayment = {
+    x402Version: number;
+    scheme: string;
+    network: string;
+    payload: {
+        signature: string;
+        authorization: {
+            from: string;
+            to: string;
+            value: string;
+            validAfter: string;
+            validBefore: string;
+            nonce: string;
+        };
+    };
+};
+export declare const decodeXPaymentHeader: (header: string | undefined | null) => DecodedXPayment;
+//# sourceMappingURL=x402.d.ts.map

package/dist/x402.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402.d.ts","sourceRoot":"","sources":["../src/x402.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAO1D,MAAM,MAAM,mBAAmB,GAAG;IAEhC,KAAK,EAAE,MAAM,CAAC;IAEd,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAEjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,eAAO,MAAM,cAAc,GAAI,OAAO,mBAAmB,KAAG,iBAc3D,CAAC;AAIF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YACb,IAAI,EAAE,MAAM,CAAC;YACb,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,MAAM,CAAC;YACnB,WAAW,EAAE,MAAM,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,eAmBxE,CAAC"}

package/dist/x402.js

@@ -0,0 +1,40 @@
+// Build the canonical body for a 402 response.
+export const buildChallenge = (input) => {
+    const requirements = {
+        scheme: 'exact',
+        network: input.network,
+        maxAmountRequired: String(input.amount),
+        resource: input.resource,
+        description: input.description ?? '',
+        mimeType: input.mimeType ?? 'application/json',
+        payTo: input.payTo,
+        maxTimeoutSeconds: input.maxTimeoutSeconds ?? 300,
+        asset: input.asset,
+        extra: { name: input.extra?.name ?? 'USDC', version: input.extra?.version ?? '2' },
+    };
+    return { x402Version: 1, accepts: [requirements] };
+};
+export const decodeXPaymentHeader = (header) => {
+    if (!header)
+        throw new Error('missing X-PAYMENT header');
+    let decoded;
+    try {
+        decoded = Buffer.from(header, 'base64').toString('utf8');
+    }
+    catch {
+        throw new Error('X-PAYMENT is not valid base64');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(decoded);
+    }
+    catch {
+        throw new Error('X-PAYMENT does not decode to JSON');
+    }
+    const p = parsed;
+    if (!p?.payload?.signature || !p?.payload?.authorization?.from) {
+        throw new Error('X-PAYMENT missing payload.signature / payload.authorization');
+    }
+    return p;
+};
+//# sourceMappingURL=x402.js.map

package/dist/x402.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402.js","sourceRoot":"","sources":["../src/x402.ts"],"names":[],"mappings":"AA+BA,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAA0B,EAAqB,EAAE;IAC9E,MAAM,YAAY,GAA4B;QAC5C,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,kBAAkB;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,GAAG;QACjD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,EAAE;KACnF,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;AACrD,CAAC,CAAC;AAqBF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAiC,EAAmB,EAAE;IACzF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,GAAG,MAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@curless/agentbank-merchant-sdk",
+  "version": "0.0.1",
+  "description": "Merchant-side SDK for agentbank — accept agent payments: PaymentIntents, webhook verification, x402 challenge helpers.",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "README.md"],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.1",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.9"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": ["agentbank", "curless", "agent", "payments", "merchant", "x402", "webhook"]
+}