@daski/pay 0.1.0

package/dist/gateway/catalog.js

@@ -0,0 +1,161 @@
+/**
+ * §4.1 check 4 — independent splitter evidence.
+ *
+ * The address a challenge asks us to pay must be corroborated twice, by
+ * sources that are not the challenge: the outcome's own catalog entry, and
+ * the chain manifest at `.well-known/daski-chain.json`. Both are cached with a
+ * TTL so the check costs at most one round trip per outcome per window, and
+ * neither cache is ever consulted to *satisfy* the check when it is stale.
+ */
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getAddress } from "viem";
+import { CliError } from "../cli/errors.js";
+import { daskiHome } from "../paths.js";
+import { GatewayClient } from "./client.js";
+/** How long catalog evidence stays fresh. Short: splitters can be re-listed. */
+export const CATALOG_TTL_SECONDS = 300;
+const cachePath = () => join(daskiHome(), "cache.json");
+function readCache() {
+    try {
+        const parsed = JSON.parse(readFileSync(cachePath(), "utf8"));
+        if (parsed.version !== 1)
+            throw new Error("shape");
+        return { version: 1, outcomes: parsed.outcomes ?? {}, manifests: parsed.manifests ?? {} };
+    }
+    catch {
+        return { version: 1, outcomes: {}, manifests: {} };
+    }
+}
+function writeCache(file) {
+    const path = cachePath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temporary, path);
+}
+function fresh(entry, now) {
+    return entry && now - entry.fetchedAt < CATALOG_TTL_SECONDS ? entry.value : undefined;
+}
+/**
+ * The catalog reader. One instance per command run, so the TTL cache and the
+ * call budget are shared across every check a single purchase performs.
+ */
+export class Catalog {
+    #client;
+    #now;
+    constructor(client, now = () => Math.floor(Date.now() / 1_000)) {
+        this.#client = client;
+        this.#now = now;
+    }
+    /** `daski_get_outcome`, cached. This is also the price and terms source. */
+    async getOutcome(providerAgentId, outcomeId) {
+        const key = `${this.#client.gatewayUrl}|${providerAgentId}|${outcomeId}`;
+        const cache = readCache();
+        const cached = fresh(cache.outcomes[key], this.#now());
+        if (cached)
+            return cached;
+        const result = await this.#client.callTool("daski_get_outcome", {
+            providerAgentId,
+            outcomeId,
+        });
+        const body = GatewayClient.json(result);
+        if (result.isError || !body) {
+            throw new CliError({
+                code: "DASKI_OUTCOME_NOT_FOUND",
+                message: `The gateway has no outcome ${providerAgentId}/${outcomeId}.`,
+                remediation: "List what is purchasable with the gateway's daski_list_outcomes tool, " +
+                    "then retry with a provider id and outcome id from that list.",
+            });
+        }
+        const splitter = body.splitter;
+        if (typeof body.payTo !== "string" || typeof splitter?.splitterAddress !== "string") {
+            throw new CliError({
+                code: "DASKI_OUTCOME_MISSING_SPLITTER",
+                message: `Outcome ${providerAgentId}/${outcomeId} does not publish a splitter address.`,
+                remediation: "Without independent splitter evidence the purchase cannot be validated. " +
+                    "Report this to the gateway operator.",
+            });
+        }
+        const service = body.service;
+        const skill = body.skill;
+        const summary = {
+            providerAgentId,
+            outcomeId,
+            payTo: getAddress(body.payTo),
+            splitterAddress: getAddress(splitter.splitterAddress),
+            token: getAddress(String(body.token)),
+            pricingMode: String(body.pricingMode),
+            fixedGrossAmount: typeof body.fixedGrossAmount === "string" ? body.fixedGrossAmount : undefined,
+            bindingProfile: typeof body.bindingProfile === "string" ? body.bindingProfile : undefined,
+            providerAudience: typeof body.providerAudience === "string" ? body.providerAudience : undefined,
+            absoluteResourceUri: typeof body.absoluteResourceUri === "string" ? body.absoluteResourceUri : undefined,
+            terms: body.terms,
+            commissionBps: typeof body.commissionBps === "number" ? body.commissionBps : undefined,
+            serviceName: service?.name,
+            skillName: skill?.name,
+            requestSchema: body.requestSchema,
+        };
+        cache.outcomes[key] = { fetchedAt: this.#now(), value: summary };
+        writeCache(cache);
+        return summary;
+    }
+    /** `.well-known/daski-chain.json`, cached. The second, independent source. */
+    async chainManifest() {
+        const key = this.#client.gatewayUrl;
+        const cache = readCache();
+        const cached = fresh(cache.manifests[key], this.#now());
+        if (cached)
+            return cached;
+        let manifest;
+        try {
+            const response = await fetch(`${this.#client.gatewayUrl}/.well-known/daski-chain.json`);
+            if (!response.ok)
+                throw new Error(`HTTP ${response.status}`);
+            manifest = await response.json();
+        }
+        catch (error) {
+            throw new CliError({
+                code: "DASKI_CHAIN_MANIFEST_UNAVAILABLE",
+                message: `Could not read ${this.#client.gatewayUrl}/.well-known/daski-chain.json: ` +
+                    `${error.message}`,
+                remediation: "The splitter allowlist needs this manifest as its second, independent " +
+                    "source. Without it no purchase can be validated. Check connectivity, " +
+                    "then run: daski doctor --json",
+            });
+        }
+        if (!Array.isArray(manifest.outcomes)) {
+            throw new CliError({
+                code: "DASKI_CHAIN_MANIFEST_MALFORMED",
+                message: "The chain manifest does not list any outcomes.",
+                remediation: "Report this to the gateway operator; purchases cannot be validated.",
+            });
+        }
+        cache.manifests[key] = { fetchedAt: this.#now(), value: manifest };
+        writeCache(cache);
+        return manifest;
+    }
+    /** The two-source evidence the policy validator consumes. */
+    async splitterEvidence(providerAgentId, outcomeId) {
+        const [outcome, manifest] = await Promise.all([
+            this.getOutcome(providerAgentId, outcomeId),
+            this.chainManifest(),
+        ]);
+        const listed = manifest.outcomes.find((entry) => entry.providerAgentId === providerAgentId && entry.outcomeId === outcomeId);
+        if (!listed) {
+            throw new CliError({
+                code: "DASKI_OUTCOME_NOT_IN_CHAIN_MANIFEST",
+                message: `${providerAgentId}/${outcomeId} is offered by the gateway but is not ` +
+                    "listed in .well-known/daski-chain.json.",
+                remediation: "One source offers it and the other does not, so the splitter cannot be " +
+                    "corroborated. Do not purchase; report this to the gateway operator.",
+            });
+        }
+        const fromManifest = listed.splitter?.splitterAddress ?? listed.payTo;
+        return {
+            fromOutcome: outcome.splitterAddress,
+            fromChainManifest: getAddress(String(fromManifest)),
+        };
+    }
+}
+//# sourceMappingURL=catalog.js.map

package/dist/gateway/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/gateway/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AA0CvC,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;AAEhE,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAc,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAI,KAAgC,EAAE,GAAW;IAC7D,OAAO,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,OAAO;IACT,OAAO,CAAgB;IACvB,IAAI,CAAe;IAE5B,YAAY,MAAqB,EAAE,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACzF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,eAAuB,EAAE,SAAiB;QACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,eAAe,IAAI,SAAS,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,EAAE;YAC9D,eAAe;YACf,SAAS;SACV,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,8BAA8B,eAAe,IAAI,SAAS,GAAG;gBACtE,WAAW,EACT,wEAAwE;oBACxE,8DAA8D;aACjE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAoD,CAAC;QAC3E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,QAAQ,EAAE,eAAe,KAAK,QAAQ,EAAE,CAAC;YACpF,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,WAAW,eAAe,IAAI,SAAS,uCAAuC;gBACvF,WAAW,EACT,0EAA0E;oBAC1E,sCAAsC;aACzC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAwC,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAsC,CAAC;QAC1D,MAAM,OAAO,GAAmB;YAC9B,eAAe;YACf,SAAS;YACT,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YACrC,gBAAgB,EAAE,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC/F,cAAc,EAAE,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YACzF,gBAAgB,EAAE,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC/F,mBAAmB,EACjB,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;YACrF,KAAK,EAAE,IAAI,CAAC,KAA4C;YACxD,aAAa,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACtF,WAAW,EAAE,OAAO,EAAE,IAAI;YAC1B,SAAS,EAAE,KAAK,EAAE,IAAI;YACtB,aAAa,EAAE,IAAI,CAAC,aAAoD;SACzE,CAAC;QACF,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACjE,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,+BAA+B,CAAC,CAAC;YACxF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmB,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EACL,kBAAkB,IAAI,CAAC,OAAO,CAAC,UAAU,iCAAiC;oBAC1E,GAAI,KAAe,CAAC,OAAO,EAAE;gBAC/B,WAAW,EACT,wEAAwE;oBACxE,uEAAuE;oBACvE,+BAA+B;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,gDAAgD;gBACzD,WAAW,EAAE,qEAAqE;aACnF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACnE,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,gBAAgB,CAAC,eAAuB,EAAE,SAAiB;QAC/D,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,SAAS,CAAC;YAC3C,IAAI,CAAC,aAAa,EAAE;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,KAAK,eAAe,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,qCAAqC;gBAC3C,OAAO,EACL,GAAG,eAAe,IAAI,SAAS,wCAAwC;oBACvE,yCAAyC;gBAC3C,WAAW,EACT,yEAAyE;oBACzE,qEAAqE;aACxE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,IAAI,MAAM,CAAC,KAAK,CAAC;QACtE,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,eAAe;YACpC,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/gateway/client.d.ts

@@ -0,0 +1,80 @@
+import type { TransferAuthorization } from "@daski/x402-scheme";
+export interface McpToolResult {
+    content: {
+        type: string;
+        text?: string;
+    }[];
+    isError?: boolean | undefined;
+    _meta?: Record<string, unknown> | undefined;
+}
+export interface GatewayCallLog {
+    tool: string;
+    at: string;
+    /** Request arguments, already redacted by the caller. */
+    request: unknown;
+    response: unknown;
+    isError: boolean;
+}
+export interface GatewayClientOptions {
+    gatewayUrl: string;
+    /** Every call is appended here; the conformance suite byte-logs from it. */
+    onCall?: (entry: GatewayCallLog) => void;
+    clientName?: string;
+    clientVersion?: string;
+}
+/** The x402 v2 challenge as the gateway issues it. */
+export interface PaymentChallenge {
+    x402Version: number;
+    resource: Record<string, unknown>;
+    accepts: PaymentRequirement[];
+    extensions?: Record<string, unknown> | undefined;
+}
+export interface PaymentRequirement {
+    scheme: string;
+    network: string;
+    asset: string;
+    amount: string;
+    payTo: string;
+    maxTimeoutSeconds: number;
+    extra?: {
+        assetTransferMethod?: string;
+        name?: string;
+        version?: string;
+    } | undefined;
+}
+/** The exact five-key payload the gateway accepts. Any other shape is refused. */
+export interface PaymentSubmission {
+    x402Version: number;
+    resource: Record<string, unknown>;
+    accepted: PaymentRequirement;
+    payload: {
+        authorization: TransferAuthorization;
+        signature: string;
+    };
+    extensions: Record<string, unknown>;
+}
+export declare class GatewayClient {
+    #private;
+    readonly gatewayUrl: string;
+    constructor(options: GatewayClientOptions);
+    /** Daski tool calls made on this connection — the §6 budget is counted here. */
+    get callCount(): number;
+    connect(): Promise<void>;
+    close(): Promise<void>;
+    /** Tool names the gateway actually advertises, cached per connection. */
+    availableTools(): Promise<Set<string>>;
+    hasTool(name: string): Promise<boolean>;
+    callTool(name: string, args: Record<string, unknown>, meta?: Record<string, unknown>): Promise<McpToolResult>;
+    /** The first JSON object in a tool result's content, if there is one. */
+    static json(result: McpToolResult): Record<string, unknown> | undefined;
+    /** Reads the challenge from `_meta`, falling back to the content body. */
+    static challenge(result: McpToolResult): PaymentChallenge | undefined;
+}
+/** Health and version, for `doctor`. Plain HTTP; no MCP session needed. */
+export declare function readiness(gatewayUrl: string, timeoutMs?: number): Promise<{
+    reachable: boolean;
+    status?: string | undefined;
+    version?: string | undefined;
+    error?: string | undefined;
+}>;
+//# sourceMappingURL=client.d.ts.map

package/dist/gateway/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/gateway/client.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGhE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3C,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACvF;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE;QAAE,aAAa,EAAE,qBAAqB,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,qBAAa,aAAa;;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAMhB,OAAO,EAAE,oBAAoB;IAKzC,gFAAgF;IAChF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,yEAAyE;IACnE,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAQtC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,aAAa,CAAC;IAuBzB,yEAAyE;IACzE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAevE,0EAA0E;IAC1E,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,GAAG,SAAS;CAKtE;AAED,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC,CAcD"}

package/dist/gateway/client.js

@@ -0,0 +1,128 @@
+/**
+ * The gateway transport.
+ *
+ * Deliberately hand-rolled rather than delegated to `@x402/mcp`'s payment
+ * wrapper: the CLI must sit between the challenge and the signature to run
+ * §4, and must own the ambiguous-outcome path so an interrupted purchase gets
+ * reconciled instead of re-signed. A wrapper that signs for us would take
+ * both of those decisions away.
+ */
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CliError } from "../cli/errors.js";
+export class GatewayClient {
+    gatewayUrl;
+    #client;
+    #tools;
+    #callCount = 0;
+    #options;
+    constructor(options) {
+        this.gatewayUrl = options.gatewayUrl.replace(/\/$/, "");
+        this.#options = options;
+    }
+    /** Daski tool calls made on this connection — the §6 budget is counted here. */
+    get callCount() {
+        return this.#callCount;
+    }
+    async connect() {
+        if (this.#client)
+            return;
+        const client = new Client({
+            name: this.#options.clientName ?? "daski-pay",
+            version: this.#options.clientVersion ?? "0.1.0",
+        });
+        try {
+            await client.connect(new StreamableHTTPClientTransport(new URL(`${this.gatewayUrl}/mcp`)));
+        }
+        catch (error) {
+            throw new CliError({
+                code: "DASKI_GATEWAY_UNREACHABLE",
+                message: `Could not reach the gateway at ${this.gatewayUrl}: ${error.message}`,
+                remediation: "Check network access and the profile's gatewayUrl, then run: daski doctor --json",
+            });
+        }
+        this.#client = client;
+    }
+    async close() {
+        await this.#client?.close();
+        this.#client = undefined;
+    }
+    /** Tool names the gateway actually advertises, cached per connection. */
+    async availableTools() {
+        if (this.#tools)
+            return this.#tools;
+        await this.connect();
+        const listed = await this.#client.listTools();
+        this.#tools = new Set(listed.tools.map((tool) => tool.name));
+        return this.#tools;
+    }
+    async hasTool(name) {
+        return (await this.availableTools()).has(name);
+    }
+    async callTool(name, args, meta) {
+        await this.connect();
+        this.#callCount += 1;
+        const params = { name, arguments: args };
+        if (meta)
+            params._meta = meta;
+        let result;
+        try {
+            result = await this.#client.callTool(params);
+        }
+        catch (error) {
+            this.#options.onCall?.({
+                tool: name, at: new Date().toISOString(),
+                request: { args, meta }, response: { transportError: error.message },
+                isError: true,
+            });
+            throw error;
+        }
+        this.#options.onCall?.({
+            tool: name, at: new Date().toISOString(),
+            request: { args, meta }, response: result, isError: Boolean(result.isError),
+        });
+        return result;
+    }
+    /** The first JSON object in a tool result's content, if there is one. */
+    static json(result) {
+        for (const item of result.content ?? []) {
+            if (item.type !== "text" || typeof item.text !== "string")
+                continue;
+            try {
+                const parsed = JSON.parse(item.text);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                    return parsed;
+                }
+            }
+            catch {
+                // Non-JSON text content is informational; keep looking.
+            }
+        }
+        return undefined;
+    }
+    /** Reads the challenge from `_meta`, falling back to the content body. */
+    static challenge(result) {
+        const fromMeta = result._meta?.["x402/payment-required"];
+        const candidate = (fromMeta ?? GatewayClient.json(result));
+        return candidate && Array.isArray(candidate.accepts) ? candidate : undefined;
+    }
+}
+/** Health and version, for `doctor`. Plain HTTP; no MCP session needed. */
+export async function readiness(gatewayUrl, timeoutMs = 10_000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(`${gatewayUrl.replace(/\/$/, "")}/health/ready`, {
+            signal: controller.signal,
+        });
+        const body = await response.json();
+        return { reachable: response.ok, status: body.status, version: body.version };
+    }
+    catch (error) {
+        return { reachable: false, error: error.message };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/gateway/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/gateway/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAoD5C,MAAM,OAAO,aAAa;IACf,UAAU,CAAS;IAC5B,OAAO,CAAqB;IAC5B,MAAM,CAA0B;IAChC,UAAU,GAAG,CAAC,CAAC;IACN,QAAQ,CAAuB;IAExC,YAAY,OAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,gFAAgF;IAChF,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,WAAW;YAC7C,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO;SAChD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAClB,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,CAAC,CAAU,CAC9E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,kCAAkC,IAAI,CAAC,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE;gBACzF,WAAW,EACT,kFAAkF;aACrF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAA6B,EAC7B,IAA8B;QAE9B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,MAAM,MAAM,GAA4B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAClE,IAAI,IAAI;YAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QAC9B,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC,QAAQ,CAAC,MAAe,CAA6B,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAG,KAAe,CAAC,OAAO,EAAE;gBAC/E,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;SAC5E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,IAAI,CAAC,MAAqB;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACpE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,OAAO,MAAiC,CAAC;gBAC3C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0EAA0E;IAC1E,MAAM,CAAC,SAAS,CAAC,MAAqB;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAiC,CAAC;QAC3F,OAAO,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,SAAS,GAAG,MAAM;IAMpE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE;YAC5E,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA2C,CAAC;QAC5E,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/gateway/lifecycle.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The lifecycle round trip: ask, validate, sign, retry.
+ *
+ * The gateway hands out a short-lived challenge; §4.1 check 8 decides whether
+ * it describes the call we actually intend to make; only then does the wallet
+ * see it. The handle alone is never authority.
+ */
+import { type OrderAction, type SignerAdapter } from "@daski/x402-scheme";
+import type { Address } from "viem";
+import { GatewayClient } from "./client.js";
+export interface LifecycleCallOptions {
+    client: GatewayClient;
+    signer: SignerAdapter;
+    toolName: string;
+    action: OrderAction;
+    orderHandle: string;
+    request: Record<string, unknown>;
+    chainId: number;
+    /** The gateway URL, which is also the audience. */
+    gatewayUrl: string;
+    nowSeconds?: number;
+}
+/**
+ * Runs one authorized lifecycle call. Two gateway calls: the challenge, then
+ * the authorized retry.
+ */
+export declare function callAuthorizedLifecycleTool(options: LifecycleCallOptions): Promise<Record<string, unknown>>;
+export interface WalletQueryOptions {
+    client: GatewayClient;
+    signer: SignerAdapter;
+    toolName: string;
+    /** The wallet action name, e.g. `list-orders`. */
+    action: string;
+    payer: Address;
+    request: Record<string, unknown>;
+    chainId: number;
+    gatewayUrl: string;
+    nowSeconds?: number;
+}
+/**
+ * Runs one payer-scoped wallet query. The unbound variant is asserted: a
+ * wallet challenge must not smuggle a provider binding past a read.
+ */
+export declare function callWalletQuery(options: WalletQueryOptions): Promise<Record<string, unknown>>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/gateway/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/gateway/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAsB,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgClC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2BlC"}

package/dist/gateway/lifecycle.js

@@ -0,0 +1,96 @@
+/**
+ * The lifecycle round trip: ask, validate, sign, retry.
+ *
+ * The gateway hands out a short-lived challenge; §4.1 check 8 decides whether
+ * it describes the call we actually intend to make; only then does the wallet
+ * see it. The handle alone is never authority.
+ */
+import { orderActionTypedData, validateOrderActionChallenge, validateWalletActionChallenge, walletActionTypedData, } from "@daski/x402-scheme";
+import { CliError } from "../cli/errors.js";
+import { GatewayClient } from "./client.js";
+/**
+ * Runs one authorized lifecycle call. Two gateway calls: the challenge, then
+ * the authorized retry.
+ */
+export async function callAuthorizedLifecycleTool(options) {
+    const { client, toolName, orderHandle, request } = options;
+    const challengeResult = await client.callTool(toolName, { orderHandle, request });
+    const challengeBody = GatewayClient.json(challengeResult);
+    if (!challengeBody) {
+        throw lifecycleFailure(toolName, challengeResult);
+    }
+    // A gateway that answers without asking for authorization has already done
+    // the work; there is nothing to sign.
+    if (challengeBody.authorizationRequired !== true) {
+        if (challengeResult.isError)
+            throw lifecycleFailure(toolName, challengeResult);
+        return challengeBody;
+    }
+    const challenge = validateOrderActionChallenge(challengeBody.challenge, {
+        orderHandle,
+        action: options.action,
+        gatewayUrl: options.gatewayUrl,
+        request,
+        ...(options.nowSeconds === undefined ? {} : { nowSeconds: options.nowSeconds }),
+    });
+    const signature = await options.signer.signTypedData(orderActionTypedData(challenge, options.chainId, options.gatewayUrl));
+    const authorized = await client.callTool(toolName, {
+        orderHandle,
+        request,
+        authorization: { ...challenge, signature },
+    });
+    const body = GatewayClient.json(authorized);
+    if (authorized.isError || !body)
+        throw lifecycleFailure(toolName, authorized);
+    return body;
+}
+/**
+ * Runs one payer-scoped wallet query. The unbound variant is asserted: a
+ * wallet challenge must not smuggle a provider binding past a read.
+ */
+export async function callWalletQuery(options) {
+    const { client, toolName, payer, request } = options;
+    const challengeResult = await client.callTool(toolName, { payer, ...request });
+    const challengeBody = GatewayClient.json(challengeResult);
+    if (!challengeBody)
+        throw lifecycleFailure(toolName, challengeResult);
+    if (challengeBody.authorizationRequired !== true) {
+        if (challengeResult.isError)
+            throw lifecycleFailure(toolName, challengeResult);
+        return challengeBody;
+    }
+    const challenge = validateWalletActionChallenge(challengeBody.challenge, options.chainId, {
+        payer,
+        action: options.action,
+        audience: options.gatewayUrl,
+        request,
+        requireProviderBinding: false,
+        ...(options.nowSeconds === undefined ? {} : { nowSeconds: options.nowSeconds }),
+    });
+    const signature = await options.signer.signTypedData(walletActionTypedData(challenge));
+    const authorized = await client.callTool(toolName, {
+        payer,
+        ...request,
+        authorization: { message: challenge.message, signature },
+    });
+    const body = GatewayClient.json(authorized);
+    if (authorized.isError || !body)
+        throw lifecycleFailure(toolName, authorized);
+    return body;
+}
+function lifecycleFailure(toolName, result) {
+    const body = GatewayClient.json(result);
+    const code = typeof body?.code === "string" ? body.code : "DASKI_LIFECYCLE_CALL_FAILED";
+    const message = typeof body?.message === "string"
+        ? body.message
+        : `${toolName} was rejected by the gateway.`;
+    return new CliError({
+        code,
+        message,
+        remediation: typeof body?.next_action === "string"
+            ? body.next_action
+            : `Run \`daski order status <handle>\` to see the order's current state.`,
+        details: { tool: toolName, gateway: body ?? null },
+    });
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/gateway/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/gateway/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,GAGtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAsB,MAAM,aAAa,CAAC;AAehE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6B;IAE7B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;IACD,2EAA2E;IAC3E,sCAAsC;IACtC,IAAI,aAAa,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,eAAe,CAAC,OAAO;YAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/E,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,aAAa,CAAC,SAAS,EAAE;QACtE,WAAW;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAChF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAClD,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CACrE,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE;QACjD,WAAW;QACX,OAAO;QACP,aAAa,EAAE,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,OAAO,IAAI,CAAC,IAAI;QAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,aAAa;QAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,eAAe,CAAC,OAAO;YAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/E,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,6BAA6B,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE;QACxF,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,OAAO;QACP,sBAAsB,EAAE,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAChF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE;QACjD,KAAK;QACL,GAAG,OAAO;QACV,aAAa,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE;KACzD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,OAAO,IAAI,CAAC,IAAI;QAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAqB;IAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;QAC/C,CAAC,CAAC,IAAI,CAAC,OAAO;QACd,CAAC,CAAC,GAAG,QAAQ,+BAA+B,CAAC;IAC/C,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI;QACJ,OAAO;QACP,WAAW,EAAE,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ;YAChD,CAAC,CAAC,IAAI,CAAC,WAAW;YAClB,CAAC,CAAC,uEAAuE;QAC3E,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE;KACnD,CAAC,CAAC;AACL,CAAC"}