@integraledger/lcp-binding-evm-common 0.9.0

package/dist/eip3009.js

@@ -0,0 +1,73 @@
+/**
+ * The EIP-3009 `TransferWithAuthorization` typed-data machinery for the LCP canonical EVM binding
+ * `LCP-X402-EVM-NONCE-1`: the buyer signs an EIP-3009 authorization whose `nonce` field IS the
+ * `atrHash`, so the fingerprint is committed on-chain in the token's `AuthorizationUsed(authorizer,
+ * indexed nonce)` event — no overlay contract.
+ *
+ * The x402-client scheme class is deliberately NOT here; it lives in binding-evm-x402. This module is
+ * protocol-agnostic typed-data construction, viem-only.
+ */
+import { getAddress } from "viem";
+/** EIP-3009 TransferWithAuthorization typed-data field layout (USDC FiatTokenV2). */
+export const TRANSFER_WITH_AUTHORIZATION_TYPE = {
+    TransferWithAuthorization: [
+        { name: "from", type: "address" },
+        { name: "to", type: "address" },
+        { name: "value", type: "uint256" },
+        { name: "validAfter", type: "uint256" },
+        { name: "validBefore", type: "uint256" },
+        { name: "nonce", type: "bytes32" },
+    ],
+};
+/** Parse the EIP-155 chain id out of a CAIP-2 network string; throws on anything that is not
+ *  `eip155:<digits>` (never defaults — the chain id binds the EIP-712 domain). */
+export function eip155ChainId(network) {
+    const m = /^eip155:(\d+)$/.exec(network);
+    if (!m)
+        throw new Error(`expected CAIP-2 network "eip155:<id>", got "${network}"`);
+    return Number(m[1]);
+}
+/** The atrHash rides the EIP-3009 nonce as a 0x-prefixed 32-byte value. Any-case digits accepted
+ *  (ATR canon), then lowercased for the on-chain nonce (the nonce is matched lowercase on decode). */
+export function assertBytes32(value) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(value))
+        throw new Error(`atrHash must be a 0x-prefixed 32-byte (64 hex) value to ride as the EIP-3009 nonce, got "${value}"`);
+    return value.toLowerCase();
+}
+/**
+ * Build the EIP-3009 authorization + the EIP-712 typed-data to sign, with `nonce = atrHash`.
+ * `authorization` is the wire payload; `typedData` is what the signer signs.
+ */
+export function buildEip3009TypedData(i) {
+    const nonce = assertBytes32(i.atrHash);
+    const from = getAddress(i.from);
+    const to = getAddress(i.to);
+    const authorization = {
+        from,
+        to,
+        value: i.value,
+        validAfter: i.validAfter,
+        validBefore: i.validBefore,
+        nonce,
+    };
+    const typedData = {
+        domain: {
+            name: i.tokenName,
+            version: i.tokenVersion,
+            chainId: i.chainId,
+            verifyingContract: getAddress(i.verifyingContract),
+        },
+        types: TRANSFER_WITH_AUTHORIZATION_TYPE,
+        primaryType: "TransferWithAuthorization",
+        message: {
+            from,
+            to,
+            value: BigInt(i.value),
+            validAfter: BigInt(i.validAfter),
+            validBefore: BigInt(i.validBefore),
+            nonce,
+        },
+    };
+    return { authorization, typedData };
+}
+//# sourceMappingURL=eip3009.js.map

package/dist/eip3009.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip3009.js","sourceRoot":"","sources":["../src/eip3009.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAgB,UAAU,EAAkC,MAAM,MAAM,CAAC;AAEhF,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,yBAAyB,EAAE;QACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;KACnC;CACO,CAAC;AAEX;kFACkF;AAClF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;sGACsG;AACtG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4FAA4F,KAAK,GAAG,CACrG,CAAC;IACJ,OAAO,KAAK,CAAC,WAAW,EAAS,CAAC;AACpC,CAAC;AAoDD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAoB;IAIxD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,aAAa,GAAyB;QAC1C,IAAI;QACJ,EAAE;QACF,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK;KACN,CAAC;IACF,MAAM,SAAS,GAAqB;QAClC,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,OAAO,EAAE,CAAC,CAAC,YAAY;YACvB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;SACnD;QACD,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE;YACP,IAAI;YACJ,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;YAChC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;YAClC,KAAK;SACN;KACF,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC"}

package/dist/eip712.d.ts

@@ -0,0 +1,8 @@
+import type { Eip3009TypedData } from "./eip3009.js";
+/**
+ * The EIP-712 digest of an EIP-3009 typed-data message — viem's reference EIP-712 hashing
+ * (keccak256(0x1901 ‖ domainSeparator ‖ hashStruct(message))). This is what the signer signs over
+ * and what pins the typed-data structure in the vector fixtures.
+ */
+export declare function hashEip712(typedData: Eip3009TypedData): `0x${string}`;
+//# sourceMappingURL=eip712.d.ts.map

package/dist/eip712.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip712.d.ts","sourceRoot":"","sources":["../src/eip712.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,gBAAgB,GAAG,KAAK,MAAM,EAAE,CAErE"}

package/dist/eip712.js

@@ -0,0 +1,10 @@
+import { hashTypedData } from "viem";
+/**
+ * The EIP-712 digest of an EIP-3009 typed-data message — viem's reference EIP-712 hashing
+ * (keccak256(0x1901 ‖ domainSeparator ‖ hashStruct(message))). This is what the signer signs over
+ * and what pins the typed-data structure in the vector fixtures.
+ */
+export function hashEip712(typedData) {
+    return hashTypedData(typedData);
+}
+//# sourceMappingURL=eip712.js.map

package/dist/eip712.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip712.js","sourceRoot":"","sources":["../src/eip712.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAGrC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAA2B;IACpD,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/erc1271.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Acceptance-signature verification (TRM-6) — the EVM implementation of `authority`'s `SignatureVerifier`
+ * port. viem lives here. It verifies the LCP acceptance envelope: a stock
+ * Coinbase Smart Wallet (CDP Server Wallet v2) exposes only `signTypedData`, so raw-`atrHash` signing is
+ * refused and the acceptance rides an EIP-712 envelope `Acceptance{ bytes32 atrHash, uint256 signedAt }`
+ * under domain `{ name: "LCP Acceptance", version: "1", chainId }` (no verifyingContract). Note:
+ * `verifyTypedData` returns true for the stock-SDK signature — counterfactual accounts wrap it ERC-6492,
+ * deployed accounts return a plain ERC-1271 sig; both verify through viem's universal validator.
+ *
+ * Two verification paths, split by scheme:
+ *  - EOA (`evm:eip191`/`evm:eip712`) — recovered OFFLINE (no chain), so these are the schemes the
+ *    deterministic conformance corpus and this package's tests exercise;
+ *  - smart account (`evm:erc1271`/`evm:erc6492`) — verified on-chain through the injected `PublicClient`
+ *    (viem's universal `verifyTypedData`/`verifyMessage` handle ERC-1271 and the ERC-6492 counterfactual
+ *    wrapper). No client → fail-loud (never a silent false — that would impeach a valid smart-account
+ *    signature).
+ *
+ * `AcceptanceScheme` is an OPEN namespaced set and `signer` is scheme-canonical (rail-neutral core); THIS
+ * adapter is where the narrowing happens: it accepts exactly the four `evm:*` schemes and the 0x-address
+ * signer form, and throws — never a silent false — on a record that belongs to a different family.
+ */
+import type { SignatureVerifier } from "@integraledger/lcp-authority";
+import { type Hex, type PublicClient } from "viem";
+import { type LcpEvmSigner } from "./eip3009.js";
+/** The EIP-712 acceptance-envelope struct. */
+export declare const ACCEPTANCE_ENVELOPE_TYPE: {
+    readonly Acceptance: readonly [{
+        readonly name: "atrHash";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "signedAt";
+        readonly type: "uint256";
+    }];
+};
+/** The acceptance envelope's EIP-712 domain — name/version pinned, chainId per network, no verifyingContract. */
+export declare const ACCEPTANCE_DOMAIN_NAME = "LCP Acceptance";
+/** The acceptance envelope's EIP-712 domain `version`. Pinned, and part of what every acceptance
+ *  signature commits to — changing it invalidates every signature made under the old value, so it moves
+ *  only alongside a deliberate envelope revision. */
+export declare const ACCEPTANCE_DOMAIN_VERSION = "1";
+/** The typed-data object the accepting party signs (message.signedAt is unix seconds — the on-chain uint256). */
+export type AcceptanceTypedData = {
+    domain: {
+        name: string;
+        version: string;
+        chainId: number;
+    };
+    types: typeof ACCEPTANCE_ENVELOPE_TYPE;
+    primaryType: "Acceptance";
+    message: {
+        atrHash: Hex;
+        signedAt: bigint;
+    };
+};
+/**
+ * Convert TRM-6's RFC 3339 `signedAt` (the acceptance record's timestamp) into the uint256 unix seconds the
+ * EIP-712 envelope commits to. Fail-loud on anything Date cannot parse — a mis-parsed timestamp would build
+ * a different envelope and silently fail verification, hiding a malformed record behind a bad-signature error.
+ */
+export declare function rfc3339ToUnixSeconds(signedAt: string): bigint;
+/** Build the acceptance envelope typed-data for a fixed atrHash + unix-seconds signedAt + chainId. */
+export declare function buildAcceptanceTypedData(i: {
+    atrHash: string;
+    signedAt: bigint;
+    chainId: number;
+}): AcceptanceTypedData;
+/** The four schemes this port implements — the EVM half of the open `AcceptanceScheme` set. */
+export declare const EVM_ACCEPTANCE_SCHEMES: readonly ["evm:eip191", "evm:eip712", "evm:erc1271", "evm:erc6492"];
+/** How an acceptance was signed. Two are EOA schemes (`eip191`, `eip712`) and verify offline; two are
+ *  smart-account schemes (`erc1271`, `erc6492`) and REQUIRE a chain read, which is why
+ *  {@link AcceptanceVerifyOpts.client} is conditionally required. */
+export type EvmAcceptanceScheme = (typeof EVM_ACCEPTANCE_SCHEMES)[number];
+/** Narrow a string to an {@link EvmAcceptanceScheme}. The set is closed — an unrecognised scheme is not a
+ *  scheme this port can verify, and treating it as one would mean reporting an unchecked signature. */
+export declare function isEvmAcceptanceScheme(v: string): v is EvmAcceptanceScheme;
+/** The two payload formats this port can reconstruct for recovery. */
+export declare const EVM_PAYLOAD_TYPES: readonly ["atrHash", "eip712-acceptance-envelope"];
+/** WHAT was signed, as distinct from HOW. `atrHash` means the bare hash was signed;
+ *  `eip712-acceptance-envelope` means the structured envelope was, and that form additionally needs a
+ *  `chainId` to reconstruct its domain. The two are not interchangeable — verifying under the wrong one
+ *  reconstructs a different payload and fails. */
+export type EvmPayloadType = (typeof EVM_PAYLOAD_TYPES)[number];
+/** Narrow a string to an {@link EvmPayloadType}. Closed set, same reason as the scheme guard. */
+export declare function isEvmPayloadType(v: string): v is EvmPayloadType;
+/** The fields the EVM verifier reads off an acceptance record (a structural subset of `SignedAcceptance`). */
+export interface AcceptanceSignatureInput {
+    atrHash: string;
+    signer: string;
+    scheme: EvmAcceptanceScheme;
+    signature: string;
+    /** RFC 3339 — converted to the envelope's uint256 signedAt. */
+    signedAt: string;
+    payloadType: EvmPayloadType;
+}
+/** The context an acceptance check may need. Both fields are optional in the TYPE and conditionally
+ *  REQUIRED in fact: `chainId` for the `eip712-acceptance-envelope` payload, `client` for the
+ *  smart-account schemes. Omitting a required one is refused rather than defaulted — a signature verified
+ *  against a guessed domain, or not verified at all, must never read as verified. */
+export interface AcceptanceVerifyOpts {
+    /** The EIP-155 chain id binding the envelope domain — REQUIRED for the eip712-acceptance-envelope payload. */
+    chainId?: number;
+    /** A viem public client — REQUIRED for smart-account (erc1271/erc6492) schemes; unused for EOA schemes. */
+    client?: PublicClient;
+}
+/**
+ * Verify an acceptance signature. EOA schemes recover offline; smart-account schemes verify on-chain through
+ * `opts.client`. Returns a boolean (the port contract).
+ *
+ * THREE OUTCOMES, and keeping them distinct is the whole point:
+ *
+ *  - **A malformed CONFIGURATION throws** (absent `chainId` for the envelope, absent client for a smart
+ *    account) — an integration error the caller must fix, not a fact about the record.
+ *  - **A malformed RECORD throws** (an unparseable `signedAt`, a non-32-byte `atrHash`) — a garbled
+ *    timestamp is a different fact from a forged signature, and `rfc3339ToUnixSeconds` exists precisely to
+ *    stop a malformed record hiding behind a bad-signature verdict. These are normalized BEFORE the guard
+ *    below, so they stay loud.
+ *  - **A malformed SIGNATURE returns `false`.** Recovery over forged or corrupted bytes fails deep in the
+ *    curve math ("Point is not on curve"), and a verifier that crashes on a forgery cannot report the
+ *    forgery — the adversarial case is exactly the one verification exists for. An unrecoverable signature
+ *    is definitively not a valid signature, so the walk records an honest `failed(verification-failure)`.
+ *
+ * The guard therefore wraps ONLY the recovery/verification calls. Widening it to cover the normalization
+ * above would collapse the second outcome into the third.
+ */
+export declare function verifyAcceptanceSignature(input: AcceptanceSignatureInput, opts?: AcceptanceVerifyOpts): Promise<boolean>;
+/**
+ * Adapt the EVM verifier to `authority`'s `SignatureVerifier` port (hexagonal: the adapter depends on the
+ * domain's port). `authority`'s pure `verifyAcceptance` composes this to check the cryptographic gate.
+ *
+ * This is where the OPEN acceptance surface narrows to the closed set this port implements. A scheme or
+ * payload type outside that set is a ROUTING error — the caller wired the wrong port for the record — and
+ * throws loud (the configuration outcome of the three-outcomes doctrine above). Returning `false` instead
+ * would report "forged signature" about a signature this port never examined, collapsing "we cannot check
+ * this family" into "checked, and it failed" — the exact distinction fail-closed verification exists to keep.
+ */
+export declare function makeEvmAcceptanceVerifier(opts?: AcceptanceVerifyOpts): SignatureVerifier;
+/**
+ * A local EOA `LcpEvmSigner` over a raw private key (viem's `privateKeyToAccount`). The producer-side
+ * counterpart to `makeEvmAcceptanceVerifier`: it keeps viem isolated in this package so a producer
+ * can sign the acceptance envelope through the injected `LcpEvmSigner` port without importing viem. The
+ * returned signer's `signTypedData` is viem's `LocalAccount.signTypedData`, which produces the exact
+ * EIP-712 signature `verifyAcceptanceSignature` recovers offline (eip191/eip712) — producer and verifier
+ * agree by construction. This is a reference/test signer: production buyer wallets inject their own
+ * `LcpEvmSigner` (a viem account, a CDP server account, or any wallet exposing address + signTypedData).
+ */
+export declare function makeLocalEvmSigner(privateKey: Hex): LcpEvmSigner;
+//# sourceMappingURL=erc1271.d.ts.map

package/dist/erc1271.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erc1271.d.ts","sourceRoot":"","sources":["../src/erc1271.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,iBAAiB,EAElB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,GAAG,EAER,KAAK,YAAY,EAGlB,MAAM,MAAM,CAAC;AAEd,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAEhE,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB;aACnC,UAAU;iBACN,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,SAAS;;iBAChC,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,SAAS;;CAE7B,CAAC;AAEX,iHAAiH;AACjH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD;;qDAEqD;AACrD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,iHAAiH;AACjH,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,KAAK,EAAE,OAAO,wBAAwB,CAAC;IACvC,WAAW,EAAE,YAAY,CAAC;IAC1B,OAAO,EAAE;QAAE,OAAO,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO7D;AAED,sGAAsG;AACtG,wBAAgB,wBAAwB,CAAC,CAAC,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,mBAAmB,CAWtB;AAED,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,CACL,CAAC;AACX;;qEAEqE;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;uGACuG;AACvG,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAEzE;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,YAC5B,SAAS,EACT,4BAA4B,CACpB,CAAC;AACX;;;kDAGkD;AAClD,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,cAAc,CAE/D;AAED,8GAA8G;AAC9G,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,mBAAmB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED;;;qFAGqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2GAA2G;IAC3G,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,wBAAwB,EAC/B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAgFD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,CAAC,EAAE,oBAAoB,GAC1B,iBAAiB,CA0BnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,GAAG,GAAG,YAAY,CAchE"}

package/dist/erc1271.js

@@ -0,0 +1,197 @@
+import { isAddress, recoverMessageAddress, recoverTypedDataAddress, } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { assertBytes32 } from "./eip3009.js";
+/** The EIP-712 acceptance-envelope struct. */
+export const ACCEPTANCE_ENVELOPE_TYPE = {
+    Acceptance: [
+        { name: "atrHash", type: "bytes32" },
+        { name: "signedAt", type: "uint256" },
+    ],
+};
+/** The acceptance envelope's EIP-712 domain — name/version pinned, chainId per network, no verifyingContract. */
+export const ACCEPTANCE_DOMAIN_NAME = "LCP Acceptance";
+/** The acceptance envelope's EIP-712 domain `version`. Pinned, and part of what every acceptance
+ *  signature commits to — changing it invalidates every signature made under the old value, so it moves
+ *  only alongside a deliberate envelope revision. */
+export const ACCEPTANCE_DOMAIN_VERSION = "1";
+/**
+ * Convert TRM-6's RFC 3339 `signedAt` (the acceptance record's timestamp) into the uint256 unix seconds the
+ * EIP-712 envelope commits to. Fail-loud on anything Date cannot parse — a mis-parsed timestamp would build
+ * a different envelope and silently fail verification, hiding a malformed record behind a bad-signature error.
+ */
+export function rfc3339ToUnixSeconds(signedAt) {
+    const ms = Date.parse(signedAt);
+    if (Number.isNaN(ms))
+        throw new Error(`acceptance signedAt is not a parseable RFC 3339 timestamp: "${signedAt}"`);
+    return BigInt(Math.floor(ms / 1000));
+}
+/** Build the acceptance envelope typed-data for a fixed atrHash + unix-seconds signedAt + chainId. */
+export function buildAcceptanceTypedData(i) {
+    return {
+        domain: {
+            name: ACCEPTANCE_DOMAIN_NAME,
+            version: ACCEPTANCE_DOMAIN_VERSION,
+            chainId: i.chainId,
+        },
+        types: ACCEPTANCE_ENVELOPE_TYPE,
+        primaryType: "Acceptance",
+        message: { atrHash: assertBytes32(i.atrHash), signedAt: i.signedAt },
+    };
+}
+/** The four schemes this port implements — the EVM half of the open `AcceptanceScheme` set. */
+export const EVM_ACCEPTANCE_SCHEMES = [
+    "evm:eip191",
+    "evm:eip712",
+    "evm:erc1271",
+    "evm:erc6492",
+];
+/** Narrow a string to an {@link EvmAcceptanceScheme}. The set is closed — an unrecognised scheme is not a
+ *  scheme this port can verify, and treating it as one would mean reporting an unchecked signature. */
+export function isEvmAcceptanceScheme(v) {
+    return EVM_ACCEPTANCE_SCHEMES.includes(v);
+}
+/** The two payload formats this port can reconstruct for recovery. */
+export const EVM_PAYLOAD_TYPES = [
+    "atrHash",
+    "eip712-acceptance-envelope",
+];
+/** Narrow a string to an {@link EvmPayloadType}. Closed set, same reason as the scheme guard. */
+export function isEvmPayloadType(v) {
+    return EVM_PAYLOAD_TYPES.includes(v);
+}
+/**
+ * Verify an acceptance signature. EOA schemes recover offline; smart-account schemes verify on-chain through
+ * `opts.client`. Returns a boolean (the port contract).
+ *
+ * THREE OUTCOMES, and keeping them distinct is the whole point:
+ *
+ *  - **A malformed CONFIGURATION throws** (absent `chainId` for the envelope, absent client for a smart
+ *    account) — an integration error the caller must fix, not a fact about the record.
+ *  - **A malformed RECORD throws** (an unparseable `signedAt`, a non-32-byte `atrHash`) — a garbled
+ *    timestamp is a different fact from a forged signature, and `rfc3339ToUnixSeconds` exists precisely to
+ *    stop a malformed record hiding behind a bad-signature verdict. These are normalized BEFORE the guard
+ *    below, so they stay loud.
+ *  - **A malformed SIGNATURE returns `false`.** Recovery over forged or corrupted bytes fails deep in the
+ *    curve math ("Point is not on curve"), and a verifier that crashes on a forgery cannot report the
+ *    forgery — the adversarial case is exactly the one verification exists for. An unrecoverable signature
+ *    is definitively not a valid signature, so the walk records an honest `failed(verification-failure)`.
+ *
+ * The guard therefore wraps ONLY the recovery/verification calls. Widening it to cover the normalization
+ * above would collapse the second outcome into the third.
+ */
+export async function verifyAcceptanceSignature(input, opts) {
+    // Normalization + configuration: OUTSIDE the guard, so both stay loud.
+    const recover = prepareRecovery(input, opts);
+    try {
+        return await recover();
+    }
+    catch {
+        return false; // the signature itself did not recover — not a valid signature
+    }
+}
+/** Raised for integration errors (absent chainId/client). */
+class ConfigurationError extends Error {
+}
+/**
+ * Normalize the record's fields and bind the scheme-appropriate recovery call, returning it UNEXECUTED so
+ * the caller can guard the recovery alone. Anything wrong with the configuration or the record's own fields
+ * throws from here, before the guard exists.
+ */
+function prepareRecovery(input, opts) {
+    // A signer that is not an address is a malformed RECORD, not a forgery — thrown here, before the guard,
+    // for the same reason rfc3339ToUnixSeconds throws: recovery over it would fail deep in viem and read as
+    // a bad-signature verdict about a signature nobody could have examined.
+    if (!isAddress(input.signer, { strict: false }))
+        throw new Error(`evm:* acceptance signer must be a 0x-address (the scheme's canonical form); got "${input.signer}"`);
+    const signer = input.signer;
+    const isContract = input.scheme === "evm:erc1271" || input.scheme === "evm:erc6492";
+    const signature = input.signature;
+    if (input.payloadType === "eip712-acceptance-envelope") {
+        if (opts?.chainId === undefined)
+            throw new ConfigurationError("eip712-acceptance-envelope verification requires opts.chainId to bind the envelope domain");
+        // Throws loud on an unparseable signedAt or a malformed atrHash — a malformed RECORD, not a forgery.
+        const typedData = buildAcceptanceTypedData({
+            atrHash: input.atrHash,
+            signedAt: rfc3339ToUnixSeconds(input.signedAt),
+            chainId: opts.chainId,
+        });
+        if (isContract) {
+            // `opts` (not `opts?.`): the chainId gate above already proved it defined — an optional chain here
+            // would be dead syntax guarding an impossible state, and the mutation run flags it as equivalent.
+            const client = requireClient(opts.client, input.scheme);
+            return () => client.verifyTypedData({ address: signer, ...typedData, signature });
+        }
+        return async () => {
+            const recovered = await recoverTypedDataAddress({
+                ...typedData,
+                signature,
+            });
+            return recovered.toLowerCase() === signer.toLowerCase();
+        };
+    }
+    // payloadType === "atrHash": the raw 32-byte atrHash signed as a personal_sign message.
+    const raw = assertBytes32(input.atrHash); // throws loud on a malformed atrHash
+    if (isContract) {
+        const client = requireClient(opts?.client, input.scheme);
+        return () => client.verifyMessage({ address: signer, message: { raw }, signature });
+    }
+    return async () => {
+        const recovered = await recoverMessageAddress({
+            message: { raw },
+            signature,
+        });
+        return recovered.toLowerCase() === signer.toLowerCase();
+    };
+}
+function requireClient(client, scheme) {
+    if (client === undefined)
+        throw new ConfigurationError(`${scheme} verification requires a chain client (opts.client) — smart-account signatures verify on-chain (ERC-1271/6492)`);
+    return client;
+}
+/**
+ * Adapt the EVM verifier to `authority`'s `SignatureVerifier` port (hexagonal: the adapter depends on the
+ * domain's port). `authority`'s pure `verifyAcceptance` composes this to check the cryptographic gate.
+ *
+ * This is where the OPEN acceptance surface narrows to the closed set this port implements. A scheme or
+ * payload type outside that set is a ROUTING error — the caller wired the wrong port for the record — and
+ * throws loud (the configuration outcome of the three-outcomes doctrine above). Returning `false` instead
+ * would report "forged signature" about a signature this port never examined, collapsing "we cannot check
+ * this family" into "checked, and it failed" — the exact distinction fail-closed verification exists to keep.
+ */
+export function makeEvmAcceptanceVerifier(opts) {
+    return {
+        // async so the routing throws below surface as REJECTIONS — the same channel the
+        // configuration/record throws inside `verifyAcceptanceSignature` already use.
+        verify: async (acceptance) => {
+            if (!isEvmAcceptanceScheme(acceptance.scheme))
+                throw new ConfigurationError(`scheme "${acceptance.scheme}" is not an EVM acceptance scheme (${EVM_ACCEPTANCE_SCHEMES.join(", ")}) — route the record to the port that implements its family`);
+            if (!isEvmPayloadType(acceptance.payloadType))
+                throw new ConfigurationError(`payloadType "${acceptance.payloadType}" is not one this port reconstructs (${EVM_PAYLOAD_TYPES.join(", ")})`);
+            return verifyAcceptanceSignature({
+                atrHash: acceptance.atrHash,
+                signer: acceptance.signer,
+                scheme: acceptance.scheme,
+                signature: acceptance.signature,
+                signedAt: acceptance.signedAt,
+                payloadType: acceptance.payloadType,
+            }, opts);
+        },
+    };
+}
+/**
+ * A local EOA `LcpEvmSigner` over a raw private key (viem's `privateKeyToAccount`). The producer-side
+ * counterpart to `makeEvmAcceptanceVerifier`: it keeps viem isolated in this package so a producer
+ * can sign the acceptance envelope through the injected `LcpEvmSigner` port without importing viem. The
+ * returned signer's `signTypedData` is viem's `LocalAccount.signTypedData`, which produces the exact
+ * EIP-712 signature `verifyAcceptanceSignature` recovers offline (eip191/eip712) — producer and verifier
+ * agree by construction. This is a reference/test signer: production buyer wallets inject their own
+ * `LcpEvmSigner` (a viem account, a CDP server account, or any wallet exposing address + signTypedData).
+ */
+export function makeLocalEvmSigner(privateKey) {
+    const account = privateKeyToAccount(privateKey);
+    return {
+        address: account.address,
+        signTypedData: (message) => account.signTypedData(message),
+    };
+}
+//# sourceMappingURL=erc1271.js.map

package/dist/erc1271.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erc1271.js","sourceRoot":"","sources":["../src/erc1271.ts"],"names":[],"mappings":"AAyBA,OAAO,EAEL,SAAS,EAET,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,aAAa,EAAqB,MAAM,cAAc,CAAC;AAEhE,8CAA8C;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;KACtC;CACO,CAAC;AAEX,iHAAiH;AACjH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AACvD;;qDAEqD;AACrD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAU7C;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,+DAA+D,QAAQ,GAAG,CAC3E,CAAC;IACJ,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,wBAAwB,CAAC,CAIxC;IACC,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB;QACD,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,aAAa;CACL,CAAC;AAMX;uGACuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,CAAS;IAC7C,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,4BAA4B;CACpB,CAAC;AAOX,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA+B,EAC/B,IAA2B;IAE3B,uEAAuE;IACvE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,+DAA+D;IAC/E,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,kBAAmB,SAAQ,KAAK;CAAG;AAEzC;;;;GAIG;AACH,SAAS,eAAe,CACtB,KAA+B,EAC/B,IAA2B;IAE3B,wGAAwG;IACxG,wGAAwG;IACxG,wEAAwE;IACxE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,oFAAoF,KAAK,CAAC,MAAM,GAAG,CACpG,CAAC;IACJ,MAAM,MAAM,GAAG,KAAK,CAAC,MAAa,CAAC;IACnC,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAgB,CAAC;IAEzC,IAAI,KAAK,CAAC,WAAW,KAAK,4BAA4B,EAAE,CAAC;QACvD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS;YAC7B,MAAM,IAAI,kBAAkB,CAC1B,2FAA2F,CAC5F,CAAC;QACJ,qGAAqG;QACrG,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,mGAAmG;YACnG,kGAAkG;YAClG,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO,GAAG,EAAE,CACV,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;gBAC9C,GAAG,SAAS;gBACZ,SAAS;aACV,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1D,CAAC,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC;IAC/E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,GAAG,EAAE,CACV,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;YAC5C,OAAO,EAAE,EAAE,GAAG,EAAE;YAChB,SAAS;SACV,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAgC,EAChC,MAAc;IAEd,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,kBAAkB,CAC1B,GAAG,MAAM,gHAAgH,CAC1H,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAA2B;IAE3B,OAAO;QACL,iFAAiF;QACjF,8EAA8E;QAC9E,MAAM,EAAE,KAAK,EAAE,UAA4B,EAAoB,EAAE;YAC/D,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,WAAW,UAAU,CAAC,MAAM,sCAAsC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CACjK,CAAC;YACJ,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,UAAU,CAAC,WAAW,wCAAwC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;YACJ,OAAO,yBAAyB,CAC9B;gBACE,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC,EACD,IAAI,CACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAe;IAChD,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,CAAC,OAKf,EAAgB,EAAE,CACjB,OAAO,CAAC,aAAa,CACnB,OAAsD,CACvD;KACJ,CAAC;AACJ,CAAC"}

package/dist/erc20.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The one piece of ERC-20 knowledge the EVM welds share: did this transaction move a given token at all?
+ *
+ * It lives here because two rails need the same answer for the same reason, and the reason is not
+ * MPP-specific or x402-specific. Every EVM weld reads its binding out of an event the settlement emits. When
+ * that event is absent, the absence has TWO meanings and they are not the same report:
+ *
+ * - the token did not move ⇒ this transaction settled none of that asset. A true, useful answer.
+ * - the token DID move ⇒ the transaction settled, through a path this binding cannot read the weld from.
+ *   Reporting that as an absence is a silent wrong answer at a verification boundary.
+ *
+ * The rails differ in WHICH unreadable path they are looking at — MPP's three non-`authorization` credential
+ * types, x402's Permit2 fallback — so each states its own refusal in its own vocabulary. What they share is
+ * this predicate, and duplicating it once per rail is how the two drift.
+ *
+ * Topic-0 identity only, deliberately: this module classifies, it never decodes amounts or recipients.
+ * Matching a transfer against an offer's terms is the settle path's job (`executedTransferCoversOffer`), and
+ * doing it here would be a second, weaker copy of a check that already has an owner.
+ */
+import type { Log } from "viem";
+/**
+ * `keccak256("Transfer(address,address,uint256)")` — ERC-20's `Transfer` event topic0.
+ *
+ * Derived by two independent keccak-256 oracles that agree byte-for-byte, neither of them viem:
+ * `cast keccak 'Transfer(address,address,uint256)'` and pycryptodome `keccak(digest_bits=256)`.
+ */
+export declare const ERC20_TRANSFER_TOPIC0 = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
+/**
+ * Did this transaction move the configured token at all?
+ *
+ * Topic-0 identity only — no `decodeEventLog`, because the question is "did this asset move", not "how much,
+ * to whom". An indexed-parameter count is not checked either: any log the token emitted under ERC-20's
+ * `Transfer` signature settles the question this predicate is asked.
+ */
+export declare function assetWasTransferred(logs: readonly Log[], asset: string): boolean;
+//# sourceMappingURL=erc20.d.ts.map

package/dist/erc20.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erc20.d.ts","sourceRoot":"","sources":["../src/erc20.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,uEACoC,CAAC;AAEvE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,SAAS,GAAG,EAAE,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAOT"}

package/dist/erc20.js

@@ -0,0 +1,20 @@
+/**
+ * `keccak256("Transfer(address,address,uint256)")` — ERC-20's `Transfer` event topic0.
+ *
+ * Derived by two independent keccak-256 oracles that agree byte-for-byte, neither of them viem:
+ * `cast keccak 'Transfer(address,address,uint256)'` and pycryptodome `keccak(digest_bits=256)`.
+ */
+export const ERC20_TRANSFER_TOPIC0 = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
+/**
+ * Did this transaction move the configured token at all?
+ *
+ * Topic-0 identity only — no `decodeEventLog`, because the question is "did this asset move", not "how much,
+ * to whom". An indexed-parameter count is not checked either: any log the token emitted under ERC-20's
+ * `Transfer` signature settles the question this predicate is asked.
+ */
+export function assetWasTransferred(logs, asset) {
+    const want = asset.toLowerCase();
+    return logs.some((log) => log.address.toLowerCase() === want &&
+        log.topics[0]?.toLowerCase() === ERC20_TRANSFER_TOPIC0);
+}
+//# sourceMappingURL=erc20.js.map

package/dist/erc20.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erc20.js","sourceRoot":"","sources":["../src/erc20.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,oEAAoE,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAoB,EACpB,KAAa;IAEb,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI;QAClC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,qBAAqB,CACzD,CAAC;AACJ,CAAC"}

package/dist/events.d.ts

@@ -0,0 +1,67 @@
+/**
+ * On-chain event helpers for the EIP-3009 binding: the `AuthorizationUsed` ABI and the transport-free
+ * atrHash-recovery scan (the caller fetches the receipt with its own viem client and passes `{ logs }`).
+ */
+import type { SettlementRef } from "@integraledger/lcp-binding-core";
+import { type Hex, type Log } from "viem";
+/** Build a `SettlementRef` without materializing absent fields — `exactOptionalPropertyTypes` forbids
+ *  `txHash: undefined`, so the spreads keep the ref exactly as sparse as the caller's knowledge. Shared
+ *  by the EVM adapters (it was byte-identical in two of them and inlined in the third). */
+export declare function refOf(chainId: number, txHash: `0x${string}` | undefined, logIndex: number | null): SettlementRef;
+/** USDC `AuthorizationUsed(authorizer, nonce)` — both indexed; the on-chain artifact of every EIP-3009
+ *  settlement. `nonce` carries the atrHash (WLD-3: recoverable, forward-indexable on the nonce topic). */
+export declare const AUTHORIZATION_USED_ABI: readonly [{
+    readonly type: "event";
+    readonly name: "AuthorizationUsed";
+    readonly inputs: readonly [{
+        readonly name: "authorizer";
+        readonly type: "address";
+        readonly indexed: true;
+    }, {
+        readonly name: "nonce";
+        readonly type: "bytes32";
+        readonly indexed: true;
+    }];
+    readonly anonymous: false;
+}];
+/** The answer to one question: did this settlement transaction commit this atrHash as an EIP-3009 nonce?
+ *  `ok` is the whole verdict and `onChainNonce` is the matched value for a report to quote. It proves the
+ *  NONCE matched — it says nothing about which token moved, or how much, which is a separate check. */
+export interface OnChainAtrHashProof {
+    /** True iff the settlement tx emitted `AuthorizationUsed` with `nonce === atrHash`. */
+    ok: boolean;
+    /** The on-chain nonce that matched (lowercase 0x hex), or `null` if none did. */
+    onChainNonce: Hex | null;
+}
+/** A decoded `AuthorizationUsed` occurrence: the nonce it committed and where it sat in the tx. */
+export interface AuthorizationUsedEvent {
+    /** The committed nonce (lowercase 0x hex) — the atrHash on the x402 binding. */
+    nonce: Hex;
+    /** The authorizing account (lowercase 0x hex) — EIP-3009's `authorizer`, the account the executed
+     *  transfer draws from. Faithful decoding of the event's first indexed argument, NOT an identity
+     *  attestation: who the counterparty IS remains the acceptance/authority layer's claim. Carried so a
+     *  consumer can pair this authorization with the `Transfer` it executed in the same settlement. */
+    authorizer: Hex;
+    /** The log's position in the transaction, or `null` if the source log carried none. */
+    logIndex: number | null;
+    /** The emitting contract (lowercase 0x hex) — the payment token. */
+    address: Hex;
+}
+/**
+ * Decode every `AuthorizationUsed(authorizer, indexed nonce)` in a set of logs (a single settlement's
+ * logs, from `ChainReader.getTransactionLogs`, or a range query). This is the EXTRACT path (recover the
+ * committed nonce), distinct from `verifyAtrHashOnChain`'s CHECK path (assert a known nonce is present).
+ * When `asset` is supplied only that token's events are read; otherwise every AuthorizationUsed is decoded.
+ */
+export declare function readAuthorizationUsed(logs: readonly Log[], asset?: string): AuthorizationUsedEvent[];
+/**
+ * Confirm the atrHash was committed on-chain: scan a settlement tx receipt for the token's
+ * `AuthorizationUsed(authorizer, indexed nonce)` event and assert `nonce === atrHash` (case-insensitive).
+ */
+export declare function verifyAtrHashOnChain(receipt: {
+    logs: readonly Log[];
+}, params: {
+    asset: string;
+    atrHash: string;
+}): OnChainAtrHashProof;
+//# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAkB,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE1D;;2FAE2F;AAC3F,wBAAgB,KAAK,CACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,aAAa,CAMf;AAED;0GAC0G;AAC1G,eAAO,MAAM,sBAAsB;aAE/B,IAAI,EAAE,OAAO;aACb,IAAI,EAAE,mBAAmB;aACzB,MAAM;iBACF,IAAI,EAAE,YAAY;iBAAE,IAAI,EAAE,SAAS;iBAAE,OAAO;;iBAC5C,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;iBAAE,OAAO;;aAE3C,SAAS;EAEH,CAAC;AAEX;;uGAEuG;AACvG,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,EAAE,EAAE,OAAO,CAAC;IACZ,iFAAiF;IACjF,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;CAC1B;AAED,mGAAmG;AACnG,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,KAAK,EAAE,GAAG,CAAC;IACX;;;uGAGmG;IACnG,UAAU,EAAE,GAAG,CAAC;IAChB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,GAAG,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,SAAS,GAAG,EAAE,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,sBAAsB,EAAE,CAwB1B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE;IAAE,IAAI,EAAE,SAAS,GAAG,EAAE,CAAA;CAAE,EACjC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzC,mBAAmB,CAoBrB"}