@envarai/envarpay 0.1.0-alpha.2 → 0.2.0-alpha.1

package/dist/commerce/index.d.ts

@@ -0,0 +1,4 @@
+export * from './types.js';
+export * from './config.js';
+export * from './pricing.js';
+export * from './card.js';

package/dist/commerce/index.js

@@ -0,0 +1,4 @@
+export * from './types.js';
+export * from './config.js';
+export * from './pricing.js';
+export * from './card.js';

package/dist/commerce/management.d.ts

@@ -0,0 +1,14 @@
+import { CommerceBuyer } from './buyer.js';
+export interface BuyerManagementOptions {
+    buyer: CommerceBuyer;
+    authenticate: (request: Request) => Promise<string | null>;
+    origin: string;
+}
+/** Private API: authentication binds every purchase to its caller. No CORS or public wallet proxy. */
+export declare class BuyerManagement {
+    private readonly options;
+    readonly origin: string;
+    constructor(options: BuyerManagementOptions);
+    handle(request: Request): Promise<Response>;
+}
+export declare function listenBuyerManagement(management: BuyerManagement, origin?: string, host?: string, port?: number): import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>;

package/dist/commerce/management.js

@@ -0,0 +1,138 @@
+import { createServer } from 'node:http';
+import { Readable } from 'node:stream';
+import { CommerceError } from './types.js';
+import { validateUrl } from './config.js';
+const loopback = (host) => ['localhost', '127.0.0.1', '[::1]', '::1'].includes(host);
+const headers = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' };
+async function jsonBody(request) {
+    if (!request.headers.get('Content-Type')?.toLowerCase().startsWith('application/json'))
+        throw new CommerceError('invalid_content_type', 'Send application/json');
+    let size = 0;
+    const chunks = [];
+    if (request.body) {
+        const reader = request.body.getReader();
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > 1024 * 1024) {
+                await reader.cancel();
+                throw new CommerceError('request_too_large', 'Management request exceeds 1 MiB');
+            }
+            chunks.push(value);
+        }
+    }
+    let value;
+    try {
+        value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new CommerceError('invalid_json', 'Valid JSON object required');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new CommerceError('invalid_json', 'Valid JSON object required');
+    return value;
+}
+function exactKeys(value, expected) {
+    if (Object.keys(value).some(key => !expected.includes(key)) || expected.some(key => !Object.hasOwn(value, key)))
+        throw new CommerceError('invalid_request', 'Request fields do not match this management operation');
+}
+/** Private API: authentication binds every purchase to its caller. No CORS or public wallet proxy. */
+export class BuyerManagement {
+    options;
+    origin;
+    constructor(options) {
+        this.options = options;
+        const url = validateUrl(options.origin, true);
+        if (url.pathname !== '/' || url.search || (!loopback(url.hostname) && url.protocol !== 'https:'))
+            throw new CommerceError('management_origin', 'Use a loopback origin or an explicitly configured HTTPS management origin');
+        this.origin = url.origin;
+    }
+    async handle(request) {
+        const url = new URL(request.url);
+        if (url.origin !== this.origin || (request.headers.get('Host') && request.headers.get('Host') !== url.host))
+            return Response.json({ error: 'invalid_host' }, { status: 421, headers });
+        if (request.headers.get('Origin') && request.headers.get('Origin') !== this.origin)
+            return Response.json({ error: 'origin_not_allowed' }, { status: 403, headers });
+        if (request.method === 'OPTIONS')
+            return Response.json({ error: 'method_not_allowed' }, { status: 405, headers });
+        try {
+            const caller = await this.options.authenticate(request);
+            if (!caller)
+                return Response.json({ error: 'authentication_required' }, { status: 401, headers: { ...headers, 'WWW-Authenticate': 'Bearer' } });
+            if (url.search)
+                throw new CommerceError('invalid_request', 'Management query parameters are not supported');
+            if (request.method === 'GET' && url.pathname === '/management/v1/policy')
+                return Response.json(this.options.buyer.policySnapshot(), { headers });
+            if (request.method === 'POST' && url.pathname === '/management/v1/purchases/preview') {
+                const body = await jsonBody(request);
+                exactKeys(body, ['cardUrl', 'messageId', 'input', 'offerId']);
+                return Response.json(await this.options.buyer.preview(caller, body), { headers });
+            }
+            if (request.method === 'POST' && url.pathname === '/management/v1/purchases/confirm') {
+                const body = await jsonBody(request);
+                exactKeys(body, ['previewId', 'quoteToken', 'messageId']);
+                if (['previewId', 'quoteToken', 'messageId'].some(key => typeof body[key] !== 'string'))
+                    throw new CommerceError('invalid_request', 'Confirmation identifiers must be strings');
+                return Response.json(await this.options.buyer.confirm(caller, body), { headers });
+            }
+            const match = /^\/management\/v1\/purchases\/([0-9a-f-]{36})(\/(?:recover|continue))?$/.exec(url.pathname);
+            if (match && request.method === 'GET' && !match[2])
+                return Response.json(this.options.buyer.get(caller, match[1]), { headers });
+            if (match && request.method === 'POST' && match[2] === '/continue') {
+                const body = await jsonBody(request);
+                exactKeys(body, ['messageId', 'input']);
+                if (typeof body.messageId !== 'string')
+                    throw new CommerceError('invalid_request', 'Continuation message ID must be a string');
+                return Response.json(await this.options.buyer.continue(caller, match[1], body), { headers });
+            }
+            if (match && request.method === 'POST' && match[2] === '/recover') {
+                if (request.body) {
+                    const body = await jsonBody(request);
+                    exactKeys(body, []);
+                }
+                return Response.json(await this.options.buyer.recover(caller, match[1]), { headers });
+            }
+            return Response.json({ error: 'not_found' }, { status: 404, headers });
+        }
+        catch (error) {
+            const code = error instanceof CommerceError ? error.code : 'request_failed';
+            const status = code === 'purchase_not_found' ? 404 : code === 'request_too_large' ? 413 : ['purchase_conflict', 'quote_expired', 'approval_mismatch', 'budget_exceeded', 'payments_disabled'].includes(code) ? 409 : 400;
+            return Response.json({ error: code }, { status, headers });
+        }
+    }
+}
+export function listenBuyerManagement(management, origin = management.origin, host = '127.0.0.1', port = 4021) {
+    if (new URL(origin).origin !== management.origin || (!loopback(host) && new URL(origin).protocol !== 'https:'))
+        throw new CommerceError('management_bind', 'Remote management requires an explicit HTTPS reverse proxy origin');
+    const server = createServer(async (req, res) => {
+        try {
+            if (req.headers.host !== new URL(origin).host) {
+                res.writeHead(421, headers);
+                res.end('{"error":"invalid_host"}');
+                return;
+            }
+            const incoming = new Headers();
+            for (const [key, value] of Object.entries(req.headers))
+                if (value !== undefined)
+                    incoming.set(key, Array.isArray(value) ? value.join(',') : value);
+            const request = new Request(new URL(req.url ?? '/', origin), { method: req.method, headers: incoming, ...(req.method !== 'GET' && req.method !== 'HEAD' ? { body: Readable.toWeb(req), duplex: 'half' } : {}) });
+            const response = await management.handle(request);
+            res.writeHead(response.status, Object.fromEntries(response.headers));
+            if (response.body)
+                Readable.fromWeb(response.body).pipe(res);
+            else
+                res.end();
+        }
+        catch {
+            if (!res.headersSent)
+                res.writeHead(500, headers);
+            res.end('{"error":"request_failed"}');
+        }
+    });
+    server.requestTimeout = 30000;
+    server.headersTimeout = 15000;
+    server.listen(port, host);
+    return server;
+}

package/dist/commerce/mpp-client.d.ts

@@ -0,0 +1,59 @@
+import { Challenge, Receipt } from 'mppx';
+import { charge } from 'mppx/stripe/client';
+import type { BuyerQuote } from './buyer-store.js';
+export type MppReceipt = Receipt.Receipt & {
+    amount: string;
+    currency: 'usd';
+    merchant: string;
+    accountId?: string;
+    livemode: boolean;
+};
+export interface MppTokenOperation {
+    operationId: string;
+    idempotencyKey: string;
+    purchaseId: string;
+    quote: BuyerQuote;
+    mode: 'test' | 'live';
+    amount: string;
+    currency: string;
+    networkId: string;
+    expiresAt: number;
+    paymentMethod: string;
+    metadata?: Record<string, string>;
+    challenge: Challenge.Challenge;
+}
+export interface MppVerificationContext {
+    purchaseId: string;
+    quote: BuyerQuote;
+    mode: 'test' | 'live';
+    operationId: string;
+}
+export interface MppBuyerOptions {
+    /** Stable private buyer/PSP identity; never inferred from seller metadata. */
+    payer: string;
+    mode: 'test' | 'live';
+    paymentMethod: string;
+    createToken: (operation: MppTokenOperation) => Promise<string>;
+    /** Read the original operation only; never create another SPT on absence. */
+    recoverToken?: (operation: MppTokenOperation) => Promise<string | undefined>;
+    /** Independently read provider state and match account/mode/merchant/amount/order. */
+    verifyReceipt: (receipt: MppReceipt, context: MppVerificationContext) => Promise<boolean>;
+}
+export interface SavedMppAuthorization {
+    protocol: 'mpp';
+    credential: string;
+    challenge: Challenge.Challenge;
+    fingerprint: string;
+    operationId: string;
+}
+export interface SavedMppToken {
+    protocol: 'mpp-token';
+    token: string;
+    fingerprint: string;
+    operationId: string;
+}
+/** Native SDK preparation only; no fetch polyfill or automatic payment retry. */
+export declare function prepareMppCredential(challenge: Challenge.Challenge, paymentMethod: string, createToken: (parameters: charge.OnChallengeParameters) => Promise<string>): Promise<string>;
+export declare function validateMppCredential(value: string, challenge: Challenge.Challenge): void;
+export declare function assertMppDigest(challenge: Challenge.Challenge, body: string): void;
+export declare function publicMppReceipt(value: MppReceipt): MppReceipt;

package/dist/commerce/mpp-client.js

@@ -0,0 +1,24 @@
+import { Challenge, Credential } from 'mppx';
+import { Mppx } from 'mppx/client';
+import { charge } from 'mppx/stripe/client';
+import { createHash } from 'node:crypto';
+import { CommerceError } from './types.js';
+/** Native SDK preparation only; no fetch polyfill or automatic payment retry. */
+export async function prepareMppCredential(challenge, paymentMethod, createToken) {
+    const client = Mppx.create({ polyfill: false, maxPaymentRetries: 0, methods: [charge({ paymentMethod, createToken })] });
+    const payment = await client.preparePayment(new Response(null, { status: 402, headers: { 'WWW-Authenticate': Challenge.serialize(challenge) } }));
+    return payment.createCredential();
+}
+export function validateMppCredential(value, challenge) {
+    const credential = Credential.deserialize(value);
+    const payload = credential.payload;
+    if (Challenge.serialize(credential.challenge) !== Challenge.serialize(challenge) || payload.externalId !== challenge.request.externalId || typeof payload.spt !== 'string' || !/^spt_[A-Za-z0-9_]+$/.test(payload.spt))
+        throw new CommerceError('mpp_credential_binding', 'Native MPP credential differs from the original challenge');
+}
+export function assertMppDigest(challenge, body) {
+    if (challenge.digest && challenge.digest !== `sha-256=:${createHash('sha256').update(body).digest('base64')}:`)
+        throw new CommerceError('mpp_request_digest', 'MPP challenge is bound to different request bytes');
+}
+export function publicMppReceipt(value) {
+    return { method: value.method, status: value.status, reference: value.reference, timestamp: value.timestamp, ...(value.externalId ? { externalId: value.externalId } : {}), amount: value.amount, currency: value.currency, merchant: value.merchant, livemode: value.livemode, ...(value.accountId ? { accountId: value.accountId } : {}) };
+}

package/dist/commerce/mpp-runtime.d.ts

@@ -0,0 +1,3 @@
+/** Opt-in MPP server adapter. Account eligibility is checked at startup. */
+export * from './mpp.js';
+export * from './stripe-provider.js';

package/dist/commerce/mpp-runtime.js

@@ -0,0 +1,3 @@
+/** Opt-in MPP server adapter. Account eligibility is checked at startup. */
+export * from './mpp.js';
+export * from './stripe-provider.js';

package/dist/commerce/mpp.d.ts

@@ -0,0 +1,53 @@
+import { CommerceStore, type OrderRecord } from './store.js';
+import { CredentialVault } from './vault.js';
+import type { GateResult } from './x402.js';
+export interface StripeIntent {
+    id: string;
+    status: string;
+    amount: number;
+    amount_received?: number;
+    currency: string;
+    livemode: boolean;
+    metadata: Record<string, string>;
+    lastResponse?: {
+        headers?: Record<string, string>;
+    };
+}
+export interface StripeProvider {
+    accountId: string;
+    merchantProfile: string;
+    mode: 'test' | 'live';
+    assertReady(): Promise<void>;
+    create(params: Record<string, unknown>, options: {
+        idempotencyKey: string;
+        apiVersion: string;
+    }): Promise<StripeIntent>;
+    retrieve(id: string): Promise<StripeIntent>;
+    findOriginal(orderId: string): Promise<StripeIntent | undefined>;
+}
+export interface MppGateOptions {
+    store: CommerceStore;
+    vault: CredentialVault;
+    origin: string;
+    hmacSecret: string;
+    providers: Readonly<Record<string, StripeProvider>>;
+}
+/** Native MPP Stripe charge; only a verified PSP success may queue a task. */
+export declare class MppGate {
+    private options;
+    constructor(options: MppGateOptions);
+    merchantRecipient(accountRef: string): string | undefined;
+    check(): Promise<void>;
+    private provider;
+    private optionsFor;
+    private runtime;
+    private bound;
+    private verified;
+    private receipt;
+    private headers;
+    recover(orderId: string, caller: string): Promise<{
+        state: string;
+        taskId: string;
+    }>;
+    handle(request: Request, order: OrderRecord): Promise<GateResult>;
+}

package/dist/commerce/mpp.js

@@ -0,0 +1,163 @@
+import { Mppx } from 'mppx/server/core';
+import { charge } from 'mppx/stripe/server';
+import { Challenge, Credential, Receipt } from 'mppx';
+import { CommerceError } from './types.js';
+import { digest } from './config.js';
+/** Native MPP Stripe charge; only a verified PSP success may queue a task. */
+export class MppGate {
+    options;
+    constructor(options) {
+        this.options = options;
+        if (Buffer.byteLength(options.hmacSecret) < 32)
+            throw new CommerceError('mpp_hmac_key', 'MPP challenge key must contain at least 32 bytes');
+    }
+    merchantRecipient(accountRef) { return this.options.providers[accountRef]?.merchantProfile; }
+    async check() {
+        for (const provider of Object.values(this.options.providers))
+            await provider.assertReady();
+    }
+    provider(order) {
+        const profile = order.quote.paymentProfile;
+        if (profile?.adapter !== 'mpp')
+            throw new CommerceError('payment_method_unavailable', 'Not an MPP offer');
+        const provider = this.options.providers[profile.accountRef];
+        if (!provider || provider.merchantProfile !== order.quote.recipient)
+            throw new CommerceError('merchant_not_ready', 'Configured merchant must match original quote');
+        return provider;
+    }
+    optionsFor(order, provider) {
+        const amount = BigInt(order.quote.amount);
+        if (amount < 50n || amount > 99999999n)
+            throw new CommerceError('stripe_amount', 'Stripe USD purchase must be 50–99999999 cents');
+        return {
+            amount: `${amount / 100n}.${(amount % 100n).toString().padStart(2, '0')}`,
+            currency: 'usd', decimals: 2, externalId: order.quote.quoteId,
+            recipient: provider.merchantProfile, networkId: provider.merchantProfile,
+            expires: order.quote.expiresAt,
+            scope: `service:${order.serviceRevision}/offer:${order.offerId}`,
+            meta: {
+                caller: digest(order.caller), inputDigest: order.inputDigest, termsDigest: order.quote.termsDigest,
+                messageId: order.messageId, quoteId: order.quote.quoteId, serviceId: order.quote.serviceId, serviceRevision: String(order.quote.serviceRevision),
+                offerId: order.offerId, amount: order.quote.amount, currency: 'usd', recipient: provider.merchantProfile, expiresAt: order.quote.expiresAt,
+            },
+            metadata: { envarpay_order: order.id, envarpay_quote: order.quote.quoteId, envarpay_terms: order.quote.termsDigest },
+        };
+    }
+    runtime(create) {
+        return Mppx.create({
+            methods: [charge({ client: { paymentIntents: { create } }, paymentMethodTypes: ['card'] })],
+            realm: new URL(this.options.origin).host, secretKey: this.options.hmacSecret, requiresAuth: true,
+        });
+    }
+    bound(intent, order, provider) {
+        return intent.livemode === (provider.mode === 'live') && Number.isSafeInteger(intent.amount) && String(intent.amount) === order.quote.amount &&
+            intent.currency === 'usd' && intent.metadata?.envarpay_order === order.id && intent.metadata.envarpay_quote === order.quote.quoteId && intent.metadata.envarpay_terms === order.quote.termsDigest;
+    }
+    verified(intent, order, provider) {
+        return this.bound(intent, order, provider) && intent.status === 'succeeded' && intent.livemode === (provider.mode === 'live') &&
+            Number.isSafeInteger(intent.amount) && String(intent.amount) === order.quote.amount &&
+            Number.isSafeInteger(intent.amount_received) && String(intent.amount_received) === order.quote.amount &&
+            intent.currency === 'usd' && intent.metadata?.envarpay_order === order.id &&
+            intent.metadata.envarpay_quote === order.quote.quoteId && intent.metadata.envarpay_terms === order.quote.termsDigest;
+    }
+    receipt(intent, order, provider) {
+        return {
+            method: 'stripe', status: 'success', reference: intent.id, externalId: order.quote.quoteId,
+            timestamp: new Date().toISOString(), amount: order.quote.amount, currency: 'usd',
+            merchant: provider.merchantProfile, accountId: provider.accountId, livemode: intent.livemode,
+        };
+    }
+    headers(receipt) {
+        return { headers: { 'Payment-Receipt': Receipt.serialize(receipt) } };
+    }
+    async recover(orderId, caller) {
+        const order = this.options.store.getOrder(orderId, caller);
+        if (!order)
+            throw new CommerceError('order_not_found', 'Original order not found');
+        const attempt = this.options.store.paymentForOrder(order.id);
+        if (!attempt)
+            throw new CommerceError('attempt_not_found', 'No original MPP attempt');
+        if (attempt.state === 'confirmed' || attempt.state === 'rejected')
+            return { state: attempt.state, taskId: order.taskId };
+        const provider = this.provider(order);
+        const saved = this.options.vault.get(attempt.credentialRef);
+        if (saved.quoteId !== order.quote.quoteId || saved.accountId !== provider.accountId || saved.mode !== provider.mode)
+            throw new CommerceError('recovery_conflict', 'Original provider binding changed');
+        // Read only: Stripe idempotency cache expiry must never cause a second charge.
+        const reference = attempt.receipt?.reference;
+        const intent = typeof reference === 'string' && /^pi_[A-Za-z0-9]+$/.test(reference)
+            ? await provider.retrieve(reference) : await provider.findOriginal(order.id);
+        if (!intent)
+            return { state: 'unknown', taskId: order.taskId };
+        if (this.verified(intent, order, provider)) {
+            this.options.store.recordSettlement(attempt.id, 'confirmed', this.receipt(intent, order, provider));
+            return { state: 'confirmed', taskId: order.taskId };
+        }
+        // An action-required or declined intent might still change later. Only a
+        // canceled PSP intent is definitive non-payment; do not release on timeout.
+        const canceled = this.bound(intent, order, provider) && intent.status === 'canceled' && intent.amount_received === 0;
+        const state = canceled ? 'rejected' : 'unknown';
+        this.options.store.recordSettlement(attempt.id, state, { reference: intent.id, providerState: intent.status, livemode: intent.livemode });
+        return { state, taskId: order.taskId };
+    }
+    async handle(request, order) {
+        const provider = this.provider(order);
+        const prior = this.options.store.paymentForOrder(order.id);
+        if (order.paymentState === 'confirmed' && prior?.receipt)
+            return this.headers(prior.receipt);
+        if (['settling', 'unknown'].includes(order.paymentState)) {
+            const recovered = await this.recover(order.id, order.caller);
+            if (recovered.state === 'confirmed')
+                return this.headers(this.options.store.paymentForOrder(order.id).receipt);
+            return { response: Response.json({ error: 'payment_reconciliation_required', state: recovered.state }, { status: 503 }) };
+        }
+        if (Date.now() >= Date.parse(order.quote.expiresAt))
+            return { response: Response.json({ error: 'quote_expired' }, { status: 409 }) };
+        await provider.assertReady();
+        const runtime = this.runtime(provider.create.bind(provider));
+        const options = this.optionsFor(order, provider);
+        let challenge = this.options.store.paymentChallenge(order.id);
+        if (!challenge)
+            challenge = this.options.store.freezePaymentChallenge(order.id, await runtime.challenge.stripe.charge(options));
+        const unpaid = () => ({ response: new Response('{}', { status: 402, headers: {
+                    'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'WWW-Authenticate': Challenge.serialize(challenge),
+                } }) });
+        const header = request.headers.get('Payment-Authorization');
+        if (!header)
+            return unpaid();
+        if (header.length > 32768)
+            throw new CommerceError('payment_payload_size', 'Payment credential exceeds limit');
+        let credential;
+        try {
+            credential = Credential.deserialize(header);
+        }
+        catch {
+            throw new CommerceError('invalid_payment', 'Malformed MPP credential');
+        }
+        // Equality against a server-persisted native challenge complements the SDK HMAC.
+        if (Challenge.serialize(credential.challenge) !== Challenge.serialize(challenge) || !Challenge.verify(credential.challenge, { secretKey: this.options.hmacSecret }) ||
+            credential.payload.externalId !== order.quote.quoteId || !/^spt_[A-Za-z0-9_]+$/.test(credential.payload.spt)) {
+            throw new CommerceError('quote_mismatch', 'MPP credential does not match the original order');
+        }
+        const saved = { quoteId: order.quote.quoteId, accountId: provider.accountId, mode: provider.mode, credential };
+        const ref = this.options.vault.put(saved);
+        const attempt = this.options.store.reservePayment(order.id, order.caller, digest({ protocol: 'mpp', spt: credential.payload.spt }), ref);
+        const wrapped = this.runtime(async (params, requestOptions) => {
+            const intent = await provider.create(params, requestOptions);
+            // Preserve original PI even if SDK reports requires_action or replay.
+            this.options.store.recordSettlement(attempt, 'unknown', { reference: intent.id, providerState: intent.status, livemode: intent.livemode });
+            return intent;
+        });
+        try {
+            await wrapped.broadcastCredential(credential, { realm: new URL(this.options.origin).host, request: options, scope: options.scope, meta: options.meta });
+        }
+        catch {
+            if (this.options.store.paymentForOrder(order.id)?.state === 'settling')
+                this.options.store.recordSettlement(attempt, 'unknown', {});
+        }
+        const recovered = await this.recover(order.id, order.caller);
+        if (recovered.state === 'confirmed')
+            return this.headers(this.options.store.paymentForOrder(order.id).receipt);
+        return { response: Response.json({ error: 'payment_not_confirmed', state: recovered.state }, { status: 503 }) };
+    }
+}

package/dist/commerce/peer-proxy.d.ts

@@ -0,0 +1,44 @@
+import { AgentCard, Task, type SendMessageRequest } from "@a2a-js/sdk";
+import { CommerceBuyer } from "./buyer.js";
+export interface PeerProxyOptions {
+    buyer: CommerceBuyer;
+    buyerCaller: string;
+    peerId: string;
+    offerId: string;
+    origin: string;
+    stateDirectory: string;
+    tokens: Readonly<Record<string, string>>;
+    label?: string;
+    waitMilliseconds?: number;
+    /** Explicit opt-in for an isolated Docker/private HTTP network; public deployments require HTTPS. */
+    allowPrivateHttp?: boolean;
+}
+/** The proxy token is never a wallet-management token. One proxy is bound to one approved peer/offer. */
+export declare class A2APeerProxy {
+    private readonly options;
+    readonly origin: string;
+    readonly card: AgentCard;
+    private readonly db;
+    private readonly lock;
+    private readonly rpc;
+    private readonly authenticate;
+    private readonly cardUrl;
+    private readonly waitMs;
+    private readonly active;
+    private stopped;
+    private closed;
+    constructor(options: PeerProxyOptions);
+    private row;
+    private phase;
+    private projection;
+    private exclusive;
+    private snapshot;
+    private wait;
+    send(params: SendMessageRequest, caller: string): Promise<Task>;
+    read(id: string, caller: string): Promise<Task>;
+    handle(request: Request): Promise<Response>;
+    assertListenHost(host: string): void;
+    stop(): Promise<void>;
+    close(): void;
+}
+export declare function listenPeerProxy(proxy: A2APeerProxy, host?: string, port?: number): import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>;