@elisym/sdk 0.9.0 → 0.10.1

package/dist/index.d.cts

@@ -62,7 +62,16 @@ interface Agent {
     cards: CapabilityCard[];
     eventId: string;
     supportedKinds: number[];
+    /** Newest network signal of any kind: capability publish, result event, or feedback event. */
     lastSeen: number;
+    /** Unix seconds of the agent's most recent on-chain-verified paid job. Undefined if none. */
+    lastPaidJobAt?: number;
+    /** Solana tx signature of the verified paid job referenced by `lastPaidJobAt`. */
+    lastPaidJobTx?: string;
+    /** Count of `rating=1` feedback events targeting this agent (last 30 days). */
+    positiveCount?: number;
+    /** Count of all rated feedback events targeting this agent (last 30 days). */
+    totalRatingCount?: number;
     picture?: string;
     name?: string;
     about?: string;
@@ -88,6 +97,13 @@ interface Job {
     amount?: number;
     txHash?: string;
     createdAt: number;
+    /**
+     * Payment asset, derived from the `payment-required` feedback's embedded
+     * payment request when present. Undefined means either no payment-required
+     * feedback was observed for this job, or the embedded request was missing
+     * an `asset` field (treated as native SOL by callers).
+     */
+    asset?: PaymentAssetRef;
 }
 interface SubmitJobOptions {
     /** Job input text. Sent unencrypted if providerPubkey is not set. */
@@ -325,6 +341,19 @@ declare class NostrPool {
 
 /** Convert a capability name to its Nostr d-tag form (ASCII-only, lowercase, hyphen-separated). */
 declare function toDTag(name: string): string;
+/** Sort key derived from an Agent. Higher bucket / rate / lastPaidJobAt = ranks higher. */
+interface RankKey {
+    /** Floor-to-minute timestamp of the agent's last verified paid job. `-Infinity` for cold start. */
+    bucket: number;
+    /** Positive review rate in `[0, 1]`. 0 when the agent has no rated feedback. */
+    rate: number;
+    /** Raw `lastPaidJobAt` (Unix sec) for tiebreak inside a bucket. 0 for cold start. */
+    lastPaidJobAt: number;
+    /** Final tiebreak; orders cold-start agents by NIP-89 freshness. */
+    lastSeen: number;
+}
+declare function computeRankKey(agent: Agent): RankKey;
+declare function compareAgentsByRank(a: Agent, b: Agent): number;
 declare class DiscoveryService {
     private pool;
     constructor(pool: NostrPool);
@@ -345,7 +374,26 @@ declare class DiscoveryService {
     }>;
     /** Enrich agents with kind:0 metadata (name, picture, about). Mutates in place and returns the same array. */
     enrichWithMetadata(agents: Agent[]): Promise<Agent[]>;
-    /** Fetch elisym agents filtered by network. */
+    /**
+     * Fetch elisym agents filtered by network, ranked by paid-job recency and
+     * positive-feedback rate.
+     *
+     * Ranking algorithm:
+     * 1. Bucket each agent into 1-minute slots by `lastPaidJobAt` (newest
+     *    `payment-completed` feedback timestamp). Cold-start agents go into a
+     *    sentinel bucket below all populated buckets.
+     * 2. Within a bucket, sort by positive review rate descending.
+     * 3. Tiebreak by raw `lastPaidJobAt`, then `lastSeen` (NIP-89 freshness).
+     *
+     * NOTE: We trust the `payment-completed` feedback timestamp directly; we do
+     * not verify the embedded `tx` signature on-chain. Public Solana devnet RPC
+     * rate-limits trivially exceed what discovery needs (N agents * up-to-5
+     * candidates), and the resulting 429s blocked discovery entirely. This
+     * means a malicious customer can publish a fake `payment-completed` to lift
+     * an agent's ranking. Acceptable trade-off for devnet / MVP; tighten via
+     * recipient-tied checks when the network moves to mainnet with a paid RPC
+     * provider.
+     */
     fetchAgents(network?: Network, limit?: number): Promise<Agent[]>;
     /**
      * Publish a capability card (kind:31990) as a provider.
@@ -766,6 +814,27 @@ type ParseResult = {
  */
 declare function parsePaymentRequest(input: string, options?: ParseOptions): ParseResult;
 
+/**
+ * Lightweight payment verifier used by discovery ranking.
+ *
+ * Unlike `SolanaPaymentStrategy.verifyPayment`, this is a single-shot check
+ * with no retries: discovery cannot afford the 30-second confirmation budget
+ * the customer-side verifier uses. If the RPC has not seen the transaction
+ * yet, we treat the agent as "no verified paid job" rather than blocking.
+ *
+ * Positive results are cached forever (Solana txs are immutable once
+ * confirmed). Negative results expire after `NEGATIVE_CACHE_TTL_MS` so a
+ * just-confirmed tx will be picked up on the next discovery refresh.
+ */
+type QuickVerifyReason = 'not_found' | 'tx_failed' | 'recipient_mismatch' | 'rpc_error' | 'invalid_input';
+interface QuickVerifyResult {
+    verified: boolean;
+    txSignature: string;
+    reason?: QuickVerifyReason;
+}
+declare function clearQuickVerifyCache(): void;
+declare function verifyJobPaymentQuick(rpc: Rpc<SolanaRpcApi>, txSignature: string, expectedRecipient: Address): Promise<QuickVerifyResult>;
+
 /**
  * Snapshot of the on-chain elisym-config program state.
  *
@@ -952,7 +1021,7 @@ declare function getProtocolProgramId(cluster: ProtocolCluster): Address;
 /** Default values for timeouts, retries, and batch sizes. */
 declare const DEFAULTS: {
     readonly SUBSCRIPTION_TIMEOUT_MS: 120000;
-    readonly PING_TIMEOUT_MS: 15000;
+    readonly PING_TIMEOUT_MS: 3000;
     readonly PING_RETRIES: 2;
     readonly PING_CACHE_TTL_MS: 30000;
     readonly PAYMENT_EXPIRY_SECS: 600;
@@ -978,4 +1047,4 @@ declare const LIMITS: {
     readonly MAX_CAPABILITY_LENGTH: 64;
 };
 
-export { type Agent, Asset, BoundedSet, type BuildTransactionOptions, type CapabilityCard, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ElisymClient, type ElisymClientConfig, type ElisymClientFullConfig, ElisymIdentity, type EstimatePriorityFeeOptions, type EstimateSolFeeOptions, type GetProtocolConfigOptions, INPUT_REDACT_PATHS, type Job, type JobStatus, type JobSubscriptionOptions, type JobUpdateCallbacks, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_PING, KIND_PONG, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, type Network, type NetworkStats, NostrPool, PROTOCOL_FEE_BPS, PROTOCOL_PROGRAM_ID_DEVNET, PROTOCOL_TREASURY, type ParseOptions, type ParseResult, type ParsedPaymentRequest, type PaymentAssetRef, type PaymentInfo, type PaymentRequestData, PaymentRequestSchema, type PaymentStrategy, type PaymentValidationCode, type PaymentValidationError, type PingResult, PingService, type ProtocolCluster, type ProtocolConfig, type ProtocolConfigInput, RELAYS, type RateLimitDecision, SECRET_REDACT_PATHS, type Signer, type SlidingWindowLimiter, type SlidingWindowLimiterOptions, type SolFeeEstimate, SolanaPaymentStrategy, type SubCloser, type SubmitJobOptions, type VerifyOptions, type VerifyResult, assertExpiry, assertLamports, buildPaymentInstructions, calculateProtocolFee, clearPriorityFeeCache, clearProtocolConfigCache, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatFeeBreakdown, formatSol, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parsePaymentRequest, pickPercentileFee, timeAgo, toDTag, truncateKey, validateAgentName, validateExpiry };
+export { type Agent, Asset, BoundedSet, type BuildTransactionOptions, type CapabilityCard, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ElisymClient, type ElisymClientConfig, type ElisymClientFullConfig, ElisymIdentity, type EstimatePriorityFeeOptions, type EstimateSolFeeOptions, type GetProtocolConfigOptions, INPUT_REDACT_PATHS, type Job, type JobStatus, type JobSubscriptionOptions, type JobUpdateCallbacks, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_PING, KIND_PONG, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, type Network, type NetworkStats, NostrPool, PROTOCOL_FEE_BPS, PROTOCOL_PROGRAM_ID_DEVNET, PROTOCOL_TREASURY, type ParseOptions, type ParseResult, type ParsedPaymentRequest, type PaymentAssetRef, type PaymentInfo, type PaymentRequestData, PaymentRequestSchema, type PaymentStrategy, type PaymentValidationCode, type PaymentValidationError, type PingResult, PingService, type ProtocolCluster, type ProtocolConfig, type ProtocolConfigInput, type QuickVerifyReason, type QuickVerifyResult, RELAYS, type RankKey, type RateLimitDecision, SECRET_REDACT_PATHS, type Signer, type SlidingWindowLimiter, type SlidingWindowLimiterOptions, type SolFeeEstimate, SolanaPaymentStrategy, type SubCloser, type SubmitJobOptions, type VerifyOptions, type VerifyResult, assertExpiry, assertLamports, buildPaymentInstructions, calculateProtocolFee, clearPriorityFeeCache, clearProtocolConfigCache, clearQuickVerifyCache, compareAgentsByRank, computeRankKey, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatFeeBreakdown, formatSol, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parsePaymentRequest, pickPercentileFee, timeAgo, toDTag, truncateKey, validateAgentName, validateExpiry, verifyJobPaymentQuick };

package/dist/index.d.ts

@@ -62,7 +62,16 @@ interface Agent {
     cards: CapabilityCard[];
     eventId: string;
     supportedKinds: number[];
+    /** Newest network signal of any kind: capability publish, result event, or feedback event. */
     lastSeen: number;
+    /** Unix seconds of the agent's most recent on-chain-verified paid job. Undefined if none. */
+    lastPaidJobAt?: number;
+    /** Solana tx signature of the verified paid job referenced by `lastPaidJobAt`. */
+    lastPaidJobTx?: string;
+    /** Count of `rating=1` feedback events targeting this agent (last 30 days). */
+    positiveCount?: number;
+    /** Count of all rated feedback events targeting this agent (last 30 days). */
+    totalRatingCount?: number;
     picture?: string;
     name?: string;
     about?: string;
@@ -88,6 +97,13 @@ interface Job {
     amount?: number;
     txHash?: string;
     createdAt: number;
+    /**
+     * Payment asset, derived from the `payment-required` feedback's embedded
+     * payment request when present. Undefined means either no payment-required
+     * feedback was observed for this job, or the embedded request was missing
+     * an `asset` field (treated as native SOL by callers).
+     */
+    asset?: PaymentAssetRef;
 }
 interface SubmitJobOptions {
     /** Job input text. Sent unencrypted if providerPubkey is not set. */
@@ -325,6 +341,19 @@ declare class NostrPool {
 
 /** Convert a capability name to its Nostr d-tag form (ASCII-only, lowercase, hyphen-separated). */
 declare function toDTag(name: string): string;
+/** Sort key derived from an Agent. Higher bucket / rate / lastPaidJobAt = ranks higher. */
+interface RankKey {
+    /** Floor-to-minute timestamp of the agent's last verified paid job. `-Infinity` for cold start. */
+    bucket: number;
+    /** Positive review rate in `[0, 1]`. 0 when the agent has no rated feedback. */
+    rate: number;
+    /** Raw `lastPaidJobAt` (Unix sec) for tiebreak inside a bucket. 0 for cold start. */
+    lastPaidJobAt: number;
+    /** Final tiebreak; orders cold-start agents by NIP-89 freshness. */
+    lastSeen: number;
+}
+declare function computeRankKey(agent: Agent): RankKey;
+declare function compareAgentsByRank(a: Agent, b: Agent): number;
 declare class DiscoveryService {
     private pool;
     constructor(pool: NostrPool);
@@ -345,7 +374,26 @@ declare class DiscoveryService {
     }>;
     /** Enrich agents with kind:0 metadata (name, picture, about). Mutates in place and returns the same array. */
     enrichWithMetadata(agents: Agent[]): Promise<Agent[]>;
-    /** Fetch elisym agents filtered by network. */
+    /**
+     * Fetch elisym agents filtered by network, ranked by paid-job recency and
+     * positive-feedback rate.
+     *
+     * Ranking algorithm:
+     * 1. Bucket each agent into 1-minute slots by `lastPaidJobAt` (newest
+     *    `payment-completed` feedback timestamp). Cold-start agents go into a
+     *    sentinel bucket below all populated buckets.
+     * 2. Within a bucket, sort by positive review rate descending.
+     * 3. Tiebreak by raw `lastPaidJobAt`, then `lastSeen` (NIP-89 freshness).
+     *
+     * NOTE: We trust the `payment-completed` feedback timestamp directly; we do
+     * not verify the embedded `tx` signature on-chain. Public Solana devnet RPC
+     * rate-limits trivially exceed what discovery needs (N agents * up-to-5
+     * candidates), and the resulting 429s blocked discovery entirely. This
+     * means a malicious customer can publish a fake `payment-completed` to lift
+     * an agent's ranking. Acceptable trade-off for devnet / MVP; tighten via
+     * recipient-tied checks when the network moves to mainnet with a paid RPC
+     * provider.
+     */
     fetchAgents(network?: Network, limit?: number): Promise<Agent[]>;
     /**
      * Publish a capability card (kind:31990) as a provider.
@@ -766,6 +814,27 @@ type ParseResult = {
  */
 declare function parsePaymentRequest(input: string, options?: ParseOptions): ParseResult;
 
+/**
+ * Lightweight payment verifier used by discovery ranking.
+ *
+ * Unlike `SolanaPaymentStrategy.verifyPayment`, this is a single-shot check
+ * with no retries: discovery cannot afford the 30-second confirmation budget
+ * the customer-side verifier uses. If the RPC has not seen the transaction
+ * yet, we treat the agent as "no verified paid job" rather than blocking.
+ *
+ * Positive results are cached forever (Solana txs are immutable once
+ * confirmed). Negative results expire after `NEGATIVE_CACHE_TTL_MS` so a
+ * just-confirmed tx will be picked up on the next discovery refresh.
+ */
+type QuickVerifyReason = 'not_found' | 'tx_failed' | 'recipient_mismatch' | 'rpc_error' | 'invalid_input';
+interface QuickVerifyResult {
+    verified: boolean;
+    txSignature: string;
+    reason?: QuickVerifyReason;
+}
+declare function clearQuickVerifyCache(): void;
+declare function verifyJobPaymentQuick(rpc: Rpc<SolanaRpcApi>, txSignature: string, expectedRecipient: Address): Promise<QuickVerifyResult>;
+
 /**
  * Snapshot of the on-chain elisym-config program state.
  *
@@ -952,7 +1021,7 @@ declare function getProtocolProgramId(cluster: ProtocolCluster): Address;
 /** Default values for timeouts, retries, and batch sizes. */
 declare const DEFAULTS: {
     readonly SUBSCRIPTION_TIMEOUT_MS: 120000;
-    readonly PING_TIMEOUT_MS: 15000;
+    readonly PING_TIMEOUT_MS: 3000;
     readonly PING_RETRIES: 2;
     readonly PING_CACHE_TTL_MS: 30000;
     readonly PAYMENT_EXPIRY_SECS: 600;
@@ -978,4 +1047,4 @@ declare const LIMITS: {
     readonly MAX_CAPABILITY_LENGTH: 64;
 };
 
-export { type Agent, Asset, BoundedSet, type BuildTransactionOptions, type CapabilityCard, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ElisymClient, type ElisymClientConfig, type ElisymClientFullConfig, ElisymIdentity, type EstimatePriorityFeeOptions, type EstimateSolFeeOptions, type GetProtocolConfigOptions, INPUT_REDACT_PATHS, type Job, type JobStatus, type JobSubscriptionOptions, type JobUpdateCallbacks, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_PING, KIND_PONG, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, type Network, type NetworkStats, NostrPool, PROTOCOL_FEE_BPS, PROTOCOL_PROGRAM_ID_DEVNET, PROTOCOL_TREASURY, type ParseOptions, type ParseResult, type ParsedPaymentRequest, type PaymentAssetRef, type PaymentInfo, type PaymentRequestData, PaymentRequestSchema, type PaymentStrategy, type PaymentValidationCode, type PaymentValidationError, type PingResult, PingService, type ProtocolCluster, type ProtocolConfig, type ProtocolConfigInput, RELAYS, type RateLimitDecision, SECRET_REDACT_PATHS, type Signer, type SlidingWindowLimiter, type SlidingWindowLimiterOptions, type SolFeeEstimate, SolanaPaymentStrategy, type SubCloser, type SubmitJobOptions, type VerifyOptions, type VerifyResult, assertExpiry, assertLamports, buildPaymentInstructions, calculateProtocolFee, clearPriorityFeeCache, clearProtocolConfigCache, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatFeeBreakdown, formatSol, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parsePaymentRequest, pickPercentileFee, timeAgo, toDTag, truncateKey, validateAgentName, validateExpiry };
+export { type Agent, Asset, BoundedSet, type BuildTransactionOptions, type CapabilityCard, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ElisymClient, type ElisymClientConfig, type ElisymClientFullConfig, ElisymIdentity, type EstimatePriorityFeeOptions, type EstimateSolFeeOptions, type GetProtocolConfigOptions, INPUT_REDACT_PATHS, type Job, type JobStatus, type JobSubscriptionOptions, type JobUpdateCallbacks, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_PING, KIND_PONG, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, type Network, type NetworkStats, NostrPool, PROTOCOL_FEE_BPS, PROTOCOL_PROGRAM_ID_DEVNET, PROTOCOL_TREASURY, type ParseOptions, type ParseResult, type ParsedPaymentRequest, type PaymentAssetRef, type PaymentInfo, type PaymentRequestData, PaymentRequestSchema, type PaymentStrategy, type PaymentValidationCode, type PaymentValidationError, type PingResult, PingService, type ProtocolCluster, type ProtocolConfig, type ProtocolConfigInput, type QuickVerifyReason, type QuickVerifyResult, RELAYS, type RankKey, type RateLimitDecision, SECRET_REDACT_PATHS, type Signer, type SlidingWindowLimiter, type SlidingWindowLimiterOptions, type SolFeeEstimate, SolanaPaymentStrategy, type SubCloser, type SubmitJobOptions, type VerifyOptions, type VerifyResult, assertExpiry, assertLamports, buildPaymentInstructions, calculateProtocolFee, clearPriorityFeeCache, clearProtocolConfigCache, clearQuickVerifyCache, compareAgentsByRank, computeRankKey, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatFeeBreakdown, formatSol, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parsePaymentRequest, pickPercentileFee, timeAgo, toDTag, truncateKey, validateAgentName, validateExpiry, verifyJobPaymentQuick };

package/dist/index.js

@@ -1,6 +1,6 @@
 import { getTransferSolInstruction } from '@solana-program/system';
 import { findAssociatedTokenPda, TOKEN_PROGRAM_ADDRESS, getCreateAssociatedTokenIdempotentInstruction, ASSOCIATED_TOKEN_PROGRAM_ADDRESS, getTransferCheckedInstruction } from '@solana-program/token';
-import { pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, setTransactionMessageComputeUnitLimit, setTransactionMessageComputeUnitPrice, appendTransactionMessageInstructions, signTransactionMessageWithSigners, address, AccountRole, getProgramDerivedAddress, assertAccountExists, isAddress, getAddressDecoder, fetchEncodedAccount, decodeAccount, getStructDecoder, fixDecoderSize, getBytesDecoder, getU8Decoder, getOptionDecoder, getU16Decoder, getBooleanDecoder, getI64Decoder } from '@solana/kit';
+import { pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, setTransactionMessageComputeUnitLimit, setTransactionMessageComputeUnitPrice, appendTransactionMessageInstructions, signTransactionMessageWithSigners, address, AccountRole, isAddress, getProgramDerivedAddress, assertAccountExists, getAddressDecoder, fetchEncodedAccount, decodeAccount, getStructDecoder, fixDecoderSize, getBytesDecoder, getU8Decoder, getOptionDecoder, getU16Decoder, getBooleanDecoder, getI64Decoder } from '@solana/kit';
 import Decimal2 from 'decimal.js-light';
 import { z } from 'zod';
 import { verifyEvent, finalizeEvent, getPublicKey, nip19, generateSecretKey, SimplePool } from 'nostr-tools';
@@ -50,7 +50,7 @@ function getProtocolProgramId(cluster) {
 }
 var DEFAULTS = {
   SUBSCRIPTION_TIMEOUT_MS: 12e4,
-  PING_TIMEOUT_MS: 15e3,
+  PING_TIMEOUT_MS: 3e3,
   PING_RETRIES: 2,
   PING_CACHE_TTL_MS: 3e4,
   PAYMENT_EXPIRY_SECS: 600,
@@ -994,6 +994,9 @@ async function createPaymentRequestWithOnchainConfig(rpc, programId, recipient,
     options
   );
 }
+var RANKING_ACTIVITY_WINDOW_SECS = 30 * 24 * 60 * 60;
+var RANKING_BUCKET_SIZE_SECS = 60;
+var COLD_START_BUCKET = -Infinity;
 function toDTag(name) {
   const tag = name.toLowerCase().replace(/[^a-z0-9\s-]/g, (ch) => "_" + ch.charCodeAt(0).toString(16).padStart(2, "0")).replace(/\s+/g, "-").replace(/^-+|-+$/g, "");
   if (!tag) {
@@ -1001,6 +1004,28 @@ function toDTag(name) {
   }
   return tag;
 }
+function computeRankKey(agent) {
+  const lastPaidJobAt = agent.lastPaidJobAt ?? 0;
+  const total = agent.totalRatingCount ?? 0;
+  const positive = agent.positiveCount ?? 0;
+  const rate = total > 0 ? positive / total : 0;
+  const bucket = lastPaidJobAt > 0 ? Math.floor(lastPaidJobAt / RANKING_BUCKET_SIZE_SECS) * RANKING_BUCKET_SIZE_SECS : COLD_START_BUCKET;
+  return { bucket, rate, lastPaidJobAt, lastSeen: agent.lastSeen };
+}
+function compareAgentsByRank(a, b) {
+  const ka = computeRankKey(a);
+  const kb = computeRankKey(b);
+  if (kb.bucket !== ka.bucket) {
+    return kb.bucket - ka.bucket;
+  }
+  if (kb.rate !== ka.rate) {
+    return kb.rate - ka.rate;
+  }
+  if (kb.lastPaidJobAt !== ka.lastPaidJobAt) {
+    return kb.lastPaidJobAt - ka.lastPaidJobAt;
+  }
+  return kb.lastSeen - ka.lastSeen;
+}
 function buildAgentsFromEvents(events, network) {
   const latestByDTag = /* @__PURE__ */ new Map();
   for (const event of events) {
@@ -1185,7 +1210,26 @@ var DiscoveryService = class {
     }
     return agents;
   }
-  /** Fetch elisym agents filtered by network. */
+  /**
+   * Fetch elisym agents filtered by network, ranked by paid-job recency and
+   * positive-feedback rate.
+   *
+   * Ranking algorithm:
+   * 1. Bucket each agent into 1-minute slots by `lastPaidJobAt` (newest
+   *    `payment-completed` feedback timestamp). Cold-start agents go into a
+   *    sentinel bucket below all populated buckets.
+   * 2. Within a bucket, sort by positive review rate descending.
+   * 3. Tiebreak by raw `lastPaidJobAt`, then `lastSeen` (NIP-89 freshness).
+   *
+   * NOTE: We trust the `payment-completed` feedback timestamp directly; we do
+   * not verify the embedded `tx` signature on-chain. Public Solana devnet RPC
+   * rate-limits trivially exceed what discovery needs (N agents * up-to-5
+   * candidates), and the resulting 429s blocked discovery entirely. This
+   * means a malicious customer can publish a fake `payment-completed` to lift
+   * an agent's ranking. Acceptable trade-off for devnet / MVP; tighten via
+   * recipient-tied checks when the network moves to mainnet with a paid RPC
+   * provider.
+   */
   async fetchAgents(network = "devnet", limit) {
     const filter = {
       kinds: [KIND_APP_HANDLER],
@@ -1196,40 +1240,78 @@ var DiscoveryService = class {
     }
     const events = await this.pool.querySync(filter);
     const agentMap = buildAgentsFromEvents(events, network);
-    const agents = Array.from(agentMap.values()).sort((a, b) => b.lastSeen - a.lastSeen);
+    const agents = Array.from(agentMap.values());
     const agentPubkeys = Array.from(agentMap.keys());
-    if (agentPubkeys.length > 0) {
-      const activitySince = Math.floor(Date.now() / 1e3) - 24 * 60 * 60;
-      const resultKinds = /* @__PURE__ */ new Set();
-      for (const agent of agentMap.values()) {
-        for (const k of agent.supportedKinds) {
-          if (k >= KIND_JOB_REQUEST_BASE && k < KIND_JOB_RESULT_BASE) {
-            resultKinds.add(KIND_JOB_RESULT_BASE + (k - KIND_JOB_REQUEST_BASE));
-          }
+    if (agentPubkeys.length === 0) {
+      return agents;
+    }
+    const activitySince = Math.floor(Date.now() / 1e3) - RANKING_ACTIVITY_WINDOW_SECS;
+    const resultKinds = /* @__PURE__ */ new Set();
+    for (const agent of agentMap.values()) {
+      for (const k of agent.supportedKinds) {
+        if (k >= KIND_JOB_REQUEST_BASE && k < KIND_JOB_RESULT_BASE) {
+          resultKinds.add(KIND_JOB_RESULT_BASE + (k - KIND_JOB_REQUEST_BASE));
         }
       }
-      resultKinds.add(jobResultKind(DEFAULT_KIND_OFFSET));
-      const [activityEvents] = await Promise.all([
-        this.pool.queryBatched(
-          {
-            kinds: [...resultKinds, KIND_JOB_FEEDBACK],
-            since: activitySince
-          },
-          agentPubkeys
-        ),
-        this.enrichWithMetadata(agents)
-      ]);
-      for (const ev of activityEvents) {
-        if (!verifyEvent(ev)) {
-          continue;
+    }
+    resultKinds.add(jobResultKind(DEFAULT_KIND_OFFSET));
+    const [resultEvents, feedbackEvents] = await Promise.all([
+      this.pool.queryBatched(
+        {
+          kinds: [...resultKinds],
+          since: activitySince
+        },
+        agentPubkeys
+      ),
+      this.pool.queryBatchedByTag(
+        { kinds: [KIND_JOB_FEEDBACK], since: activitySince },
+        "p",
+        agentPubkeys
+      ),
+      this.enrichWithMetadata(agents)
+    ]);
+    for (const ev of resultEvents) {
+      if (!verifyEvent(ev)) {
+        continue;
+      }
+      const agent = agentMap.get(ev.pubkey);
+      if (agent && ev.created_at > agent.lastSeen) {
+        agent.lastSeen = ev.created_at;
+      }
+    }
+    for (const ev of feedbackEvents) {
+      if (!verifyEvent(ev)) {
+        continue;
+      }
+      const targetPubkey = ev.tags.find((t) => t[0] === "p")?.[1];
+      if (!targetPubkey) {
+        continue;
+      }
+      const agent = agentMap.get(targetPubkey);
+      if (!agent) {
+        continue;
+      }
+      if (ev.created_at > agent.lastSeen) {
+        agent.lastSeen = ev.created_at;
+      }
+      const rating = ev.tags.find((t) => t[0] === "rating")?.[1];
+      if (rating === "1" || rating === "0") {
+        agent.totalRatingCount = (agent.totalRatingCount ?? 0) + 1;
+        if (rating === "1") {
+          agent.positiveCount = (agent.positiveCount ?? 0) + 1;
         }
-        const agent = agentMap.get(ev.pubkey);
-        if (agent && ev.created_at > agent.lastSeen) {
-          agent.lastSeen = ev.created_at;
+      }
+      const status = ev.tags.find((t) => t[0] === "status")?.[1];
+      const txTag = ev.tags.find((t) => t[0] === "tx");
+      const txSignature = txTag?.[1];
+      if (status === "payment-completed" && typeof txSignature === "string" && txSignature) {
+        if (!agent.lastPaidJobAt || ev.created_at > agent.lastPaidJobAt) {
+          agent.lastPaidJobAt = ev.created_at;
+          agent.lastPaidJobTx = txSignature;
         }
       }
-      agents.sort((a, b) => b.lastSeen - a.lastSeen);
     }
+    agents.sort(compareAgentsByRank);
     return agents;
   }
   /**
@@ -1928,6 +2010,7 @@ var MarketplaceService = class {
       let status = "processing";
       let amount;
       let txHash;
+      let asset;
       if (result) {
         status = "success";
         const amtTag = result.tags.find((t) => t[0] === "amount");
@@ -1936,9 +2019,18 @@ var MarketplaceService = class {
       const allFeedbacksForReq = feedbacksByRequestId.get(req.id) ?? [];
       for (const fb of allFeedbacksForReq) {
         const txTag = fb.tags.find((t) => t[0] === "tx");
-        if (txTag?.[1]) {
+        if (txTag?.[1] && !txHash) {
           txHash = txTag[1];
-          break;
+        }
+        if (!asset) {
+          const amtTag = fb.tags.find((t) => t[0] === "amount");
+          const requestJson = amtTag?.[2];
+          if (requestJson) {
+            const parsed = parsePaymentRequest(requestJson);
+            if (parsed.ok && parsed.data.asset) {
+              asset = parsed.data.asset;
+            }
+          }
         }
       }
       if (feedback) {
@@ -1967,6 +2059,7 @@ var MarketplaceService = class {
         resultEventId: result?.id,
         amount,
         txHash,
+        asset,
         createdAt: req.created_at
       });
     }
@@ -2705,6 +2798,89 @@ function lamportsToSol(lamports) {
   const frac = lamports % LAMPORTS_PER_SOL2;
   return `${whole}.${frac.toString().padStart(9, "0")}`;
 }
+var NEGATIVE_CACHE_TTL_MS = 6e4;
+var verifyCache = /* @__PURE__ */ new Map();
+function clearQuickVerifyCache() {
+  verifyCache.clear();
+}
+async function verifyJobPaymentQuick(rpc, txSignature, expectedRecipient) {
+  if (!txSignature) {
+    return { verified: false, txSignature: "", reason: "invalid_input" };
+  }
+  if (!expectedRecipient || !isAddress(expectedRecipient)) {
+    return { verified: false, txSignature, reason: "invalid_input" };
+  }
+  const cacheKey2 = `${txSignature}:${expectedRecipient}`;
+  const cached = verifyCache.get(cacheKey2);
+  if (cached) {
+    if (cached.result.verified) {
+      return cached.result;
+    }
+    if (Date.now() - cached.cachedAt < NEGATIVE_CACHE_TTL_MS) {
+      return cached.result;
+    }
+  }
+  const result = await doVerifyOnce(rpc, txSignature, expectedRecipient);
+  verifyCache.set(cacheKey2, { result, cachedAt: Date.now() });
+  return result;
+}
+async function doVerifyOnce(rpc, txSignature, expectedRecipient) {
+  const sigStr = txSignature;
+  if (!rpc || typeof rpc.getTransaction !== "function") {
+    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
+  }
+  let tx;
+  try {
+    tx = await rpc.getTransaction(txSignature, {
+      commitment: "confirmed",
+      encoding: "json",
+      maxSupportedTransactionVersion: 0
+    }).send();
+  } catch {
+    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
+  }
+  if (!tx) {
+    return { verified: false, txSignature: sigStr, reason: "not_found" };
+  }
+  if (!tx.meta || tx.meta.err) {
+    return { verified: false, txSignature: sigStr, reason: "tx_failed" };
+  }
+  const accountKeys = tx.transaction.message.accountKeys;
+  const recipientStr = expectedRecipient;
+  const recipientIdx = accountKeys.indexOf(recipientStr);
+  if (recipientIdx !== -1) {
+    const preBalances = tx.meta.preBalances;
+    const postBalances = tx.meta.postBalances;
+    if (preBalances && postBalances) {
+      const pre = preBalances[recipientIdx];
+      const post = postBalances[recipientIdx];
+      if (pre !== void 0 && post !== void 0) {
+        const delta = BigInt(post) - BigInt(pre);
+        if (delta > 0n) {
+          return { verified: true, txSignature: sigStr };
+        }
+      }
+    }
+  }
+  const postTokenBalances = tx.meta.postTokenBalances;
+  const preTokenBalances = tx.meta.preTokenBalances;
+  if (postTokenBalances) {
+    for (const post of postTokenBalances) {
+      if (post.owner !== recipientStr) {
+        continue;
+      }
+      const pre = preTokenBalances?.find(
+        (entry) => entry.owner === recipientStr && entry.mint === post.mint
+      );
+      const preAmount = pre ? BigInt(pre.uiTokenAmount.amount) : 0n;
+      const postAmount = BigInt(post.uiTokenAmount.amount);
+      if (postAmount > preAmount) {
+        return { verified: true, txSignature: sigStr };
+      }
+    }
+  }
+  return { verified: false, txSignature: sigStr, reason: "recipient_mismatch" };
+}
 var SessionSpendLimitEntrySchema = z.object({
   chain: z.enum(["solana"]),
   token: z.string().min(1).max(16).regex(/^[a-z0-9]+$/, "token must be lowercase alphanumeric"),
@@ -2905,6 +3081,6 @@ function makeCensor() {
   };
 }
 
-export { BoundedSet, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ElisymClient, ElisymIdentity, GlobalConfigSchema, INPUT_REDACT_PATHS, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_PING, KIND_PONG, KNOWN_ASSETS, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, NATIVE_SOL, NostrPool, PROTOCOL_FEE_BPS, PROTOCOL_PROGRAM_ID_DEVNET, PROTOCOL_TREASURY, PaymentRequestSchema, PingService, RELAYS, SECRET_REDACT_PATHS, SessionSpendLimitEntrySchema, SolanaPaymentStrategy, USDC_SOLANA_DEVNET, assertExpiry, assertLamports, assetByKey, assetKey, buildPaymentInstructions, calculateProtocolFee, clearPriorityFeeCache, clearProtocolConfigCache, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatAssetAmount, formatFeeBreakdown, formatSol, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parseAssetAmount, parsePaymentRequest, pickPercentileFee, resolveAssetFromPaymentRequest, resolveKnownAsset, timeAgo, toDTag, truncateKey, validateAgentName, validateExpiry };
+export { BoundedSet, DEFAULTS, DEFAULT_KIND_OFFSET, DEFAULT_REDACT_PATHS, DiscoveryService, ElisymClient, ElisymIdentity, GlobalConfigSchema, INPUT_REDACT_PATHS, KIND_APP_HANDLER, KIND_JOB_FEEDBACK, KIND_JOB_REQUEST, KIND_JOB_REQUEST_BASE, KIND_JOB_RESULT, KIND_JOB_RESULT_BASE, KIND_PING, KIND_PONG, KNOWN_ASSETS, LAMPORTS_PER_SOL, LIMITS, MarketplaceService, MediaService, NATIVE_SOL, NostrPool, PROTOCOL_FEE_BPS, PROTOCOL_PROGRAM_ID_DEVNET, PROTOCOL_TREASURY, PaymentRequestSchema, PingService, RELAYS, SECRET_REDACT_PATHS, SessionSpendLimitEntrySchema, SolanaPaymentStrategy, USDC_SOLANA_DEVNET, assertExpiry, assertLamports, assetByKey, assetKey, buildPaymentInstructions, calculateProtocolFee, clearPriorityFeeCache, clearProtocolConfigCache, clearQuickVerifyCache, compareAgentsByRank, computeRankKey, createPaymentRequestWithOnchainConfig, createSlidingWindowLimiter, estimatePriorityFeeMicroLamports, estimateSolFeeLamports, formatAssetAmount, formatFeeBreakdown, formatSol, getProtocolConfig, getProtocolProgramId, jobRequestKind, jobResultKind, makeCensor, nip44Decrypt, nip44Encrypt, parseAssetAmount, parsePaymentRequest, pickPercentileFee, resolveAssetFromPaymentRequest, resolveKnownAsset, timeAgo, toDTag, truncateKey, validateAgentName, validateExpiry, verifyJobPaymentQuick };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map