@mnd8t/sdk 0.1.2 → 0.3.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Glencorse Ltd
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Glencorse Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,65 +1,130 @@
-# @mnd8t/sdk
-
-A typed TypeScript client for the [mnd8t](https://mnd8t.com) authority API.
-
-mnd8t decides whether a proposed financial action falls within authority you
-defined, and records signed evidence of that decision. It holds no funds, no
-payment credentials and no private keys — you, or a provider you choose,
-execute every action.
-
-No runtime dependencies. Node 22 or newer.
-
-```bash
-npm install @mnd8t/sdk
-```
-
-## Usage
-
-```ts
-import { MandateClient } from "@mnd8t/sdk";
-
-const mandate = new MandateClient({
-  apiKey: process.env.MANDATE_API_KEY!,
-  baseUrl: process.env.MANDATE_API_URL!, // your workspace URL, from the dashboard
-});
-
-const decision = await mandate.decisions.authorize({
-  agent_external_id: "procurement_agent_12",
-  amount: { asset: "USDC", asset_amount_minor: 675_000_000 },
-  valuation: { policy_amount_minor: 50_000, policy_currency: "GBP", source: "CUSTOMER_SYSTEM" },
-  counterparty_external_id: "supplier_acme_cloud",
-  purpose: "cloud_infrastructure",
-});
-
-if (decision.effective_decision === "APPROVE") {
-  // Execute with your own credentials, then confirm.
-} else if (decision.effective_decision === "ESCALATE") {
-  console.log("send this to a human:", decision.approval?.approval_url);
-}
-```
-
-There is no shared public endpoint: `baseUrl` is the URL of your own
-workspace, shown in the dashboard. Omit it and the client talks to
-`http://localhost:4000`, which is what `pnpm dev` serves locally.
-
-Every decision returns `APPROVE`, `REJECT` or `ESCALATE` with a rule-by-rule
-trace, and produces an Ed25519-signed, hash-chained evidence receipt you can
-verify without calling us — `verifyReceiptSignature` is exported for exactly
-that.
-
-## Documentation
-
-- [SDK reference](https://mnd8t.com/docs/sdk) — every method, type and error
-- [Quickstart](https://mnd8t.com/docs/quickstart) — first decision in under 30 minutes
-- [Developer guide](https://mnd8t.com/docs/developer-guide) — the full integration path
-- [Evidence receipts](https://mnd8t.com/docs/evidence-receipts) — format and verification
-
-## Support
-
-mnd8t is in early access. Speak to your account contact, or report a security
-issue under the [responsible disclosure
-policy](https://mnd8t.com/legal/responsible-disclosure).
-
-## Licence
-
-MIT © Glencorse Ltd
+# @mnd8t/sdk
+
+A typed TypeScript client for the [mnd8t](https://mnd8t.com) authority API.
+
+mnd8t decides whether a proposed financial action falls within authority you
+defined, and records signed evidence of that decision. It holds no funds, no
+payment credentials and no private keys — you, or a provider you choose,
+execute every action.
+
+No runtime dependencies. Node 22 or newer.
+
+```bash
+npm install @mnd8t/sdk
+```
+
+## Usage
+
+```ts
+import { MandateClient } from "@mnd8t/sdk";
+
+const mandate = new MandateClient({
+  apiKey: process.env.MANDATE_API_KEY!,
+  baseUrl: process.env.MANDATE_API_URL!, // your workspace URL, from the dashboard
+});
+
+const decision = await mandate.decisions.authorize({
+  agent_external_id: "procurement_agent_12",
+  amount: { asset: "USDC", asset_amount_minor: 675_000_000 },
+  valuation: { policy_amount_minor: 50_000, policy_currency: "GBP", source: "CUSTOMER_SYSTEM" },
+  counterparty_external_id: "supplier_acme_cloud",
+  purpose: "cloud_infrastructure",
+});
+
+if (decision.effective_decision === "APPROVE") {
+  // Execute with your own credentials, then confirm.
+} else if (decision.effective_decision === "ESCALATE") {
+  console.log("send this to a human:", decision.approval?.approval_url);
+}
+```
+
+There is no shared public endpoint: `baseUrl` is the URL of your own
+workspace, shown in the dashboard. Omit it and the client talks to
+`http://localhost:4000`, which is what `pnpm dev` serves locally.
+
+Every decision returns `APPROVE`, `REJECT` or `ESCALATE` with a rule-by-rule
+trace, and produces an Authority Record: an Ed25519-signed, hash-chained
+evidence receipt you can verify without calling us.
+
+## Verifying an Authority Record
+
+The record carries an `action_hash`, a digest of the exact action that was
+evaluated. An executor can check that the record it was handed authorises the
+payment it is about to make, and not a similar one:
+
+```ts
+import { MandateClient, actionDigest } from "@mnd8t/sdk";
+
+const mandate = new MandateClient({ apiKey: process.env.MANDATE_API_KEY!, baseUrl: process.env.MANDATE_API_URL! });
+
+const instruction = {
+  action_type: "PAYMENT",
+  financial_account_id: null,
+  asset: "GBP",
+  amount_minor: 500_000,
+  counterparty: "supplier_a",
+  destination: null,
+  purpose: "invoice_payment",
+  external_reference: "INV-123",
+};
+
+const decision = await mandate.decisions.authorize({
+  agent_external_id: "procurement_agent_12",
+  amount: { asset: "GBP", asset_amount_minor: 500_000 },
+  valuation: { policy_amount_minor: 500_000, policy_currency: "GBP" },
+  counterparty_external_id: "supplier_a",
+  purpose: "invoice_payment",
+  external_reference: "INV-123",
+});
+
+const record = decision.authority_record;
+if (record && record.action_hash === (await actionDigest(instruction))) {
+  const { receipt } = await mandate.receipts.get(record.receipt_id);
+  const result = await mandate.receipts.verify(receipt, { expectedAction: instruction });
+  console.log(result.valid, result.signature_valid, result.record_integrity, result.action_match);
+}
+```
+
+A valid record proves what mnd8t decided at the time. It does not mean the
+agent is still authorised: `receipts.verifyPresented(receipt)` reports the
+mandate's current state separately.
+
+## Checking an AP2 payment against its Authority Record
+
+If you hold an AP2 payment (the open and closed Payment Mandates) and the
+Authority Record of the mnd8t decision behind it, check that they describe
+the same payment. Run AP2's own signature and constraint checks first.
+
+```ts
+import { MandateClient, verifyAp2PaymentAgainstRecord, type Ap2PaymentMandate } from "@mnd8t/sdk";
+
+const mandate = new MandateClient({ apiKey: process.env.MANDATE_API_KEY!, baseUrl: process.env.MANDATE_API_URL! });
+
+declare const openMandate: Record<string, unknown>; // the user-signed open Payment Mandate's claims
+declare const closedMandate: Ap2PaymentMandate; // the agent-signed closed Payment Mandate's claims
+declare const record: Record<string, unknown>; // the Authority Record presented with it
+
+const keys = await mandate.receipts.keys();
+const check = await verifyAp2PaymentAgainstRecord({ openMandate, closedMandate, record, keys });
+if (!check.valid) console.log(check.mismatches);
+```
+
+AP2 support is adapter v0.1, written against AP2 v0.2.0. It is a versioned
+mapping, not certified AP2 conformance.
+
+## Documentation
+
+- [SDK reference](https://mnd8t.com/docs/sdk) — every method, type and error
+- [Quickstart](https://mnd8t.com/docs/quickstart) — first decision in under 30 minutes
+- [Developer guide](https://mnd8t.com/docs/developer-guide) — the full integration path
+- [Evidence receipts](https://mnd8t.com/docs/evidence-receipts) — format and verification
+
+## Support
+
+mnd8t is in early access. Speak to your account contact, or report a security
+issue under the [responsible disclosure
+policy](https://mnd8t.com/legal/responsible-disclosure).
+
+## Licence
+
+MIT © Glencorse Ltd

package/dist/ap2.d.ts

@@ -0,0 +1,104 @@
+import type { AuthorityRecordVerification, AuthorizeRequest, VerificationKey } from "./types.js";
+export declare const AP2_ADAPTER_VERSION = "0.1";
+export declare const AP2_PAYMENT_MANDATE_VCT = "mandate.payment.1";
+/** AP2 `types/merchant.json`. */
+export interface Ap2Merchant {
+    id: string;
+    name: string;
+    website?: string;
+}
+/** AP2 `types/amount.json`: integer minor units of an ISO 4217 currency. */
+export interface Ap2Amount {
+    amount: number;
+    currency: string;
+}
+/** A closed AP2 Payment Mandate (`payment_mandate.json`), as a verifier holds it. */
+export interface Ap2PaymentMandate {
+    vct: string;
+    transaction_id: string;
+    payee: Ap2Merchant;
+    payment_amount: Ap2Amount;
+    payment_instrument: {
+        id: string;
+        type: string;
+        description?: string;
+    };
+    pisp?: Record<string, unknown>;
+    execution_date?: string;
+    risk_data?: Record<string, unknown>;
+    iat?: number;
+    exp?: number;
+}
+/** Open Payment Mandate content, as the gateway projects it for you to sign. */
+export interface Ap2OpenPaymentMandate {
+    vct: "mandate.payment.open.1";
+    constraints: Array<Record<string, unknown>>;
+    cnf: Record<string, unknown>;
+    payee: Ap2Merchant;
+    payment_amount: Ap2Amount;
+    iat: number;
+    exp: number;
+}
+/** What `decisions.projectAp2` returns. */
+export interface Ap2Projection {
+    /** The claims your AP2 Trusted Surface or Trusted Agent Provider signs. */
+    mandate_content: Ap2OpenPaymentMandate;
+    /** `sha256:` digest of `mandate_content`; the artifact's executor reference is `ap2:<digest>`. */
+    content_digest: string;
+    /** The artifact this projection claimed. Report the AP2 outcome against it. */
+    authorisation_artifact_id: string;
+    /** Where the content came from. Not part of the AP2 claims. */
+    source: {
+        adapter: "AP2";
+        adapter_version: string;
+        target: Record<string, string>;
+        decision_id: string;
+        mandate_id: string;
+        mandate_version: number;
+        policy_hash: string;
+        /** The receipt that records this projection, in the decision's chain. */
+        authority_record: {
+            receipt_id: string;
+            action_hash: string;
+        };
+    };
+}
+export interface Ap2PaymentCheck {
+    /** The record verifies, it authorised this payment, and every field matched. */
+    valid: boolean;
+    record: AuthorityRecordVerification;
+    /** Each way the payment differs from what the record authorised. Empty when valid. */
+    mismatches: string[];
+}
+/**
+ * The fields to put on `decisions.authorize` before an AP2 payment, so the
+ * mnd8t decision and the AP2 mandates describe one payment: the merchant id
+ * as the counterparty, and the open Checkout Mandate digest (the value AP2's
+ * `payment.reference` carries) as `external_reference`. Spread it into the
+ * rest of the request (agent, purpose, valuation and so on).
+ */
+export declare function ap2DecisionRequest(input: {
+    checkoutReference: string;
+    payee: Pick<Ap2Merchant, "id">;
+    amount: Ap2Amount;
+}): Pick<AuthorizeRequest, "action_type" | "amount" | "counterparty_external_id" | "external_reference">;
+/**
+ * For a credential provider, merchant or executor holding an AP2 payment and
+ * the Authority Record it claims: do they describe the same payment, and did
+ * the record authorise it?
+ *
+ * Run AP2's own checks first (signatures, key binding, constraints). This
+ * adds the mnd8t side: the record's signature and integrity, an enforced and
+ * authorised decision that was not revoked, and payee, currency, amount and
+ * checkout reference field by field. v0.1 binds immediate payments only.
+ *
+ * A valid result proves what mnd8t decided when the record was signed. It
+ * does not say the authority still stands; `receipts.verifyPresented`
+ * reports that, to the record's own organisation.
+ */
+export declare function verifyAp2PaymentAgainstRecord(input: {
+    openMandate: Record<string, unknown>;
+    closedMandate: Ap2PaymentMandate;
+    record: Record<string, unknown>;
+    keys: readonly VerificationKey[];
+}): Promise<Ap2PaymentCheck>;

package/dist/ap2.js

@@ -0,0 +1,88 @@
+/**
+ * AP2 helpers, dependency-free. Mirrors the gateway's AP2 adapter v0.1
+ * (`@mandate/authority-adapters`) exactly; a contract test in the gateway
+ * runs both against the same records.
+ *
+ * Written against AP2 v0.2.0. This is a versioned mapping, not certified AP2
+ * conformance.
+ */
+import { verifyAuthorityRecord } from "./record.js";
+export const AP2_ADAPTER_VERSION = "0.1";
+export const AP2_PAYMENT_MANDATE_VCT = "mandate.payment.1";
+/**
+ * The fields to put on `decisions.authorize` before an AP2 payment, so the
+ * mnd8t decision and the AP2 mandates describe one payment: the merchant id
+ * as the counterparty, and the open Checkout Mandate digest (the value AP2's
+ * `payment.reference` carries) as `external_reference`. Spread it into the
+ * rest of the request (agent, purpose, valuation and so on).
+ */
+export function ap2DecisionRequest(input) {
+    return {
+        action_type: "PAYMENT",
+        amount: { asset: input.amount.currency, asset_amount_minor: input.amount.amount },
+        counterparty_external_id: input.payee.id,
+        external_reference: input.checkoutReference,
+    };
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function checkoutReferenceOf(openMandate) {
+    const constraints = Array.isArray(openMandate["constraints"]) ? openMandate["constraints"] : [];
+    const ref = constraints.map(asRecord).find((c) => c["type"] === "payment.reference");
+    const id = ref?.["conditional_transaction_id"];
+    return typeof id === "string" ? id : null;
+}
+/**
+ * For a credential provider, merchant or executor holding an AP2 payment and
+ * the Authority Record it claims: do they describe the same payment, and did
+ * the record authorise it?
+ *
+ * Run AP2's own checks first (signatures, key binding, constraints). This
+ * adds the mnd8t side: the record's signature and integrity, an enforced and
+ * authorised decision that was not revoked, and payee, currency, amount and
+ * checkout reference field by field. v0.1 binds immediate payments only.
+ *
+ * A valid result proves what mnd8t decided when the record was signed. It
+ * does not say the authority still stands; `receipts.verifyPresented`
+ * reports that, to the record's own organisation.
+ */
+export async function verifyAp2PaymentAgainstRecord(input) {
+    const { closedMandate: closed } = input;
+    const record = await verifyAuthorityRecord(input.record, input.keys);
+    const mismatches = [];
+    if (!record.valid)
+        mismatches.push(`authority record does not verify: ${record.reason ?? "invalid"}`);
+    const decision = asRecord(input.record["decision"]);
+    const approval = asRecord(input.record["approval"]);
+    const intent = asRecord(input.record["intent"]);
+    if (decision["mode"] !== "ENFORCE")
+        mismatches.push("the record is a shadow-mode decision and authorises nothing");
+    const authorised = decision["status"] === "APPROVE" || (decision["status"] === "ESCALATE" && approval["status"] === "APPROVED");
+    if (!authorised)
+        mismatches.push(`the record does not authorise a payment (decision ${String(decision["status"])})`);
+    if (input.record["revocation"] != null)
+        mismatches.push("the record shows the authority was revoked");
+    if (closed.vct !== AP2_PAYMENT_MANDATE_VCT)
+        mismatches.push(`unsupported payment mandate vct ${String(closed.vct)}`);
+    if (intent["action_type"] !== "PAYMENT")
+        mismatches.push("the record is not for a PAYMENT");
+    if (intent["asset"] !== closed.payment_amount?.currency)
+        mismatches.push("currency differs from the authorised asset");
+    if (intent["amount_minor"] !== closed.payment_amount?.amount)
+        mismatches.push("amount differs from the authorised amount");
+    if (intent["counterparty"] !== closed.payee?.id)
+        mismatches.push("payee differs from the authorised counterparty");
+    const checkoutReference = checkoutReferenceOf(input.openMandate);
+    if (checkoutReference === null) {
+        mismatches.push("the open Payment Mandate has no payment.reference constraint");
+    }
+    else if (intent["external_reference"] !== checkoutReference) {
+        mismatches.push("checkout reference differs from the authorised external_reference");
+    }
+    if (closed.execution_date !== undefined) {
+        mismatches.push("adapter v0.1 binds immediate payments only; this payment carries an execution_date");
+    }
+    return { valid: mismatches.length === 0, record, mismatches };
+}
+//# sourceMappingURL=ap2.js.map

package/dist/ap2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ap2.js","sourceRoot":"","sources":["../src/ap2.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAsE3D;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAIlC;IACC,OAAO;QACL,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;QACjF,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;QACxC,kBAAkB,EAAE,KAAK,CAAC,iBAAiB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAoC;IAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAE,WAAW,CAAC,aAAa,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,mBAAmB,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAC/C,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,qCAAqC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IAEtG,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACnH,MAAM,UAAU,GACd,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,CAAC;IAC/G,IAAI,CAAC,UAAU;QAAE,UAAU,CAAC,IAAI,CAAC,qDAAqD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC;IACrH,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAEtG,IAAI,MAAM,CAAC,GAAG,KAAK,uBAAuB;QAAE,UAAU,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrH,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC3H,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAEnH,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,UAAU,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;SAAM,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC9D,UAAU,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;IACxG,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChE,CAAC"}

package/dist/client.d.ts

@@ -1,4 +1,5 @@
-import type { Agent, AuthorizeRequest, AuthorizeResponse, ConfirmRequest, Counterparty, CounterpartyAuthorityStatus, CreateAgentRequest, CreateCounterpartyRequest, CreateMandateRequest, EvidenceReceiptEnvelope, Mandate, PublishMandateOptions, PublishResult } from "./types.js";
+import type { Agent, AssertValuationRequest, AuthorizeRequest, AuthorizeResponse, ConfirmRequest, Counterparty, CounterpartyAuthorityStatus, CreateAgentRequest, CreateCounterpartyRequest, CreateMandateRequest, EvidenceReceiptEnvelope, Mandate, PublishMandateOptions, PublishResult, ActionFields, AuthorityRecordVerification, PresentedRecordVerification, Valuation, VerificationKey } from "./types.js";
+import type { Ap2Projection } from "./ap2.js";
 export interface MandateClientOptions {
     apiKey: string;
     /** Your workspace URL. Defaults to http://localhost:4000, what `pnpm dev` serves. */
@@ -61,6 +62,15 @@ export declare class MandateClient {
             data: Mandate[];
         }>;
     };
+    /**
+     * Asserting what an action is worth. Requires the `valuations:assert`
+     * scope, which the AGENT preset does not carry: call this from the backend
+     * that knows the rate, then hand the id to the agent.
+     */
+    readonly valuations: {
+        assert: (body: AssertValuationRequest) => Promise<Valuation>;
+        get: (id: string) => Promise<Record<string, unknown>>;
+    };
     readonly decisions: {
         /**
          * Submits a proposed financial action. Generates an idempotency key
@@ -71,6 +81,18 @@ export declare class MandateClient {
         confirm: (intentId: string, body: ConfirmRequest) => Promise<Record<string, unknown>>;
         cancel: (intentId: string, reason?: string) => Promise<Record<string, unknown>>;
         get: (intentId: string) => Promise<Record<string, unknown>>;
+        /**
+         * Spends an approved decision as AP2 v0.2 Open Payment Mandate content,
+         * for your AP2 Trusted Surface or Trusted Agent Provider to sign
+         * (deployment flag ENABLE_AP2_MAPPING). This claims the decision's
+         * authorisation artifact, so it succeeds once per decision and is never
+         * retried automatically. Report the outcome with `decisions.confirm`
+         * or `artifacts.fail`, using the returned `authorisation_artifact_id`.
+         */
+        projectAp2: (intentId: string, body: {
+            cnf: Record<string, unknown>;
+            ttl_seconds?: number;
+        }) => Promise<Ap2Projection>;
         list: (params?: {
             status?: string;
             decision?: string;
@@ -102,21 +124,29 @@ export declare class MandateClient {
     };
     readonly receipts: {
         get: (receiptId: string) => Promise<EvidenceReceiptEnvelope>;
-        /** Server-side verification. */
+        /** Server-side verification of a stored receipt, by id. */
         verifyRemote: (receiptId: string) => Promise<{
             valid: boolean;
             reason: string | null;
         }>;
         /**
-         * Independent local verification: fetches the public key from the
-         * gateway's well-known document (or accepts a pinned PEM) and checks the
-         * Ed25519 signature locally.
+         * Server-side verification of a record you hold (someone else's
+         * included), optionally against the action you are about to execute.
+         * Also reports the mandate's current state, separately, when the record
+         * belongs to your organisation.
+         */
+        verifyPresented: (receipt: Record<string, unknown>, expectedAction?: Partial<ActionFields>) => Promise<PresentedRecordVerification>;
+        /** The published verification keys, retired ones included. */
+        keys: () => Promise<VerificationKey[]>;
+        /**
+         * Independent local verification: checks the Ed25519 signature against
+         * the key the record names (from the gateway's well-known document, or a
+         * pinned PEM), that its action_hash binds the action it records, and,
+         * with `expectedAction`, that it is the action you hold.
          */
         verify: (receipt: Record<string, unknown>, opts?: {
             publicKeyPem?: string;
-        }) => Promise<{
-            valid: boolean;
-            reason: string | null;
-        }>;
+            expectedAction?: Partial<ActionFields>;
+        }) => Promise<AuthorityRecordVerification>;
     };
 }

package/dist/client.js

@@ -1,5 +1,5 @@
 import { errorFromResponse, MandateError } from "./errors.js";
-import { verifyReceiptSignature } from "./verify.js";
+import { verifyAuthorityRecord } from "./record.js";
 function randomIdempotencyKey() {
     const bytes = new Uint8Array(16);
     crypto.getRandomValues(bytes);
@@ -96,6 +96,15 @@ export class MandateClient {
         get: (id) => this.request("GET", `/v1/mandates/${id}`),
         list: () => this.request("GET", "/v1/mandates"),
     };
+    /**
+     * Asserting what an action is worth. Requires the `valuations:assert`
+     * scope, which the AGENT preset does not carry: call this from the backend
+     * that knows the rate, then hand the id to the agent.
+     */
+    valuations = {
+        assert: (body) => this.request("POST", "/v1/valuations", { body }),
+        get: (id) => this.request("GET", `/v1/valuations/${encodeURIComponent(id)}`),
+    };
     decisions = {
         /**
          * Submits a proposed financial action. Generates an idempotency key
@@ -113,6 +122,15 @@ export class MandateClient {
         confirm: (intentId, body) => this.request("POST", `/v1/decision-intents/${intentId}/confirm`, { body }),
         cancel: (intentId, reason) => this.request("POST", `/v1/decision-intents/${intentId}/cancel`, { body: { reason } }),
         get: (intentId) => this.request("GET", `/v1/decision-intents/${intentId}`),
+        /**
+         * Spends an approved decision as AP2 v0.2 Open Payment Mandate content,
+         * for your AP2 Trusted Surface or Trusted Agent Provider to sign
+         * (deployment flag ENABLE_AP2_MAPPING). This claims the decision's
+         * authorisation artifact, so it succeeds once per decision and is never
+         * retried automatically. Report the outcome with `decisions.confirm`
+         * or `artifacts.fail`, using the returned `authorisation_artifact_id`.
+         */
+        projectAp2: (intentId, body) => this.request("POST", `/v1/decision-intents/${intentId}/ap2-open-payment-mandate`, { body }),
         list: (params = {}) => {
             const qs = new URLSearchParams(Object.entries(params).filter(([, v]) => v !== undefined)).toString();
             return this.request("GET", `/v1/decision-intents${qs ? `?${qs}` : ""}`);
@@ -134,24 +152,42 @@ export class MandateClient {
     };
     receipts = {
         get: (receiptId) => this.request("GET", `/v1/evidence-receipts/${receiptId}`),
-        /** Server-side verification. */
+        /** Server-side verification of a stored receipt, by id. */
         verifyRemote: (receiptId) => this.request("GET", `/v1/evidence-receipts/${receiptId}/verify`),
         /**
-         * Independent local verification: fetches the public key from the
-         * gateway's well-known document (or accepts a pinned PEM) and checks the
-         * Ed25519 signature locally.
+         * Server-side verification of a record you hold (someone else's
+         * included), optionally against the action you are about to execute.
+         * Also reports the mandate's current state, separately, when the record
+         * belongs to your organisation.
+         */
+        verifyPresented: (receipt, expectedAction) => this.request("POST", "/v1/evidence-receipts/verify", {
+            body: { receipt, ...(expectedAction ? { expected_action: expectedAction } : {}) },
+            retryable: true,
+        }),
+        /** The published verification keys, retired ones included. */
+        keys: async () => {
+            const res = await this.fetchImpl(`${this.baseUrl}/.well-known/mandate-keys.json`);
+            if (!res.ok)
+                throw new MandateError(res.status, "KEYS_UNAVAILABLE", `Could not fetch verification keys (HTTP ${res.status})`);
+            return (await res.json()).keys;
+        },
+        /**
+         * Independent local verification: checks the Ed25519 signature against
+         * the key the record names (from the gateway's well-known document, or a
+         * pinned PEM), that its action_hash binds the action it records, and,
+         * with `expectedAction`, that it is the action you hold.
          */
         verify: async (receipt, opts = {}) => {
-            let pem = opts.publicKeyPem;
-            if (!pem) {
-                const res = await this.fetchImpl(`${this.baseUrl}/.well-known/mandate-keys.json`);
-                const doc = (await res.json());
-                const keyId = receipt.signature?.key_id;
-                pem = (doc.keys.find((k) => k.key_id === keyId) ?? doc.keys[0])?.public_key_pem;
+            let keys;
+            if (opts.publicKeyPem) {
+                // A pinned key verifies whatever key_id the record names.
+                const keyId = receipt.signature?.key_id ?? "pinned";
+                keys = [{ key_id: keyId, public_key_pem: opts.publicKeyPem }];
+            }
+            else {
+                keys = await this.receipts.keys();
             }
-            if (!pem)
-                return { valid: false, reason: "no verification key available" };
-            return verifyReceiptSignature(receipt, pem);
+            return verifyAuthorityRecord(receipt, keys, { expectedAction: opts.expectedAction });
         },
     };
 }

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAarD,SAAS,oBAAoB;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,OAAO,aAAa;IACP,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,SAAS,CAAe;IAEzC,YAAY,OAA6B;QACvC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,OAAyE,EAAE;QAE3E,qEAAqE;QACrE,yCAAyC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,iEAAiE;gBACjE,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;oBACzD,MAAM;oBACN,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;wBACtC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1D,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC3E;oBACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;iBAC5C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;oBAAE,OAAO,IAAS,CAAC;gBAC5D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;oBAChD,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAChD,SAAS;gBACX,CAAC;gBACD,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,YAAY;oBAAE,MAAM,GAAG,CAAC;gBAC3C,SAAS,GAAG,GAAG,CAAC;gBAChB,IAAI,OAAO,IAAI,QAAQ,GAAG,CAAC;oBAAE,MAAM;YACrC,CAAC;QACH,CAAC;QACD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEQ,MAAM,GAAG;QAChB,MAAM,EAAE,CAAC,IAAwB,EAAkB,EAAE,CACnD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,EAAE,GAA+B,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC;QACzE,GAAG,EAAE,CAAC,EAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;KAC7E,CAAC;IAEO,cAAc,GAAG;QACxB,MAAM,EAAE,CAAC,IAA+B,EAAyB,EAAE,CACjE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;QACtD,IAAI,EAAE,GAAsC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACxF,MAAM,EAAE,CAAC,EAAU,EAAE,IAA4F,EAAyB,EAAE,CAC1I,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAC9D,CAAC;IAEO,QAAQ,GAAG;QAClB,MAAM,EAAE,CAAC,IAA0B,EAAoB,EAAE,CACvD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC;QAChD;;;;;WAKG;QACH,OAAO,EAAE,CAAC,SAAiB,EAAE,OAA8B,EAA0B,EAAE,CACrF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,SAAS,UAAU,EAAE;YACxD,IAAI,EAAE;gBACJ,WAAW,EAAE,OAAO,CAAC,UAAU;gBAC/B,UAAU,EAAE;oBACV,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa;oBAChD,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,eAAe;oBACpD,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,eAAe;oBACpD,QAAQ,EAAE,IAAI;iBACf;aACF;SACF,CAAC;QACJ,MAAM,EAAE,CAAC,SAAiB,EAAoC,EAAE,CAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,SAAS,SAAS,CAAC;QAC1D,QAAQ,EAAE,CACR,SAAiB,EACjB,IAA+G,EACpD,EAAE,CAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,SAAS,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;QACtE,GAAG,EAAE,CAAC,EAAU,EAA8C,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAC1G,IAAI,EAAE,GAAiC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;KAC9E,CAAC;IAEO,SAAS,GAAG;QACnB;;;;WAIG;QACH,SAAS,EAAE,CAAC,IAAsB,EAA8B,EAAE;YAChE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;YAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE;gBAClD,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,cAAc,IAAI,oBAAoB,EAAE;gBACxD,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,CAAC,QAAgB,EAAE,IAAoB,EAAoC,EAAE,CACpF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,QAAQ,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5E,MAAM,EAAE,CAAC,QAAgB,EAAE,MAAe,EAAoC,EAAE,CAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,QAAQ,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvF,GAAG,EAAE,CAAC,QAAgB,EAAoC,EAAE,CAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,wBAAwB,QAAQ,EAAE,CAAC;QACzD,IAAI,EAAE,CAAC,SAAiE,EAAE,EAAgC,EAAE;YAC1G,MAAM,EAAE,GAAG,IAAI,eAAe,CAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAuB,CAChF,CAAC,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC;IAEO,SAAS,GAAG;QACnB,GAAG,EAAE,CAAC,UAAkB,EAA+D,EAAE,CACvF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,+BAA+B,UAAU,EAAE,CAAC;QAClE,mEAAmE;QACnE,KAAK,EAAE,CACL,UAAkB,EAClB,iBAAyB,EACmD,EAAE,CAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,UAAU,QAAQ,EAAE;YACtE,IAAI,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;YAC/C,cAAc,EAAE,oBAAoB,EAAE;SACvC,CAAC;QACJ,IAAI,EAAE,CAAC,UAAkB,EAAE,UAAkB,EAA2C,EAAE,CACxF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,UAAU,OAAO,EAAE;YACrE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE;SACpE,CAAC;QACJ,OAAO,EAAE,CAAC,QAAgB,EAA8D,EAAE,CACxF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,QAAQ,mBAAmB,CAAC;QAC3E,wEAAwE;QACxE,MAAM,EAAE,KAAK,EACX,QAAiC,EACjC,OAAkC,EAAE,EACgB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC9F,CAAC;IAEO,QAAQ,GAAG;QAClB,GAAG,EAAE,CAAC,SAAiB,EAAoC,EAAE,CAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,SAAS,EAAE,CAAC;QAC3D,gCAAgC;QAChC,YAAY,EAAE,CAAC,SAAiB,EAAsD,EAAE,CACtF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,SAAS,SAAS,CAAC;QAClE;;;;WAIG;QACH,MAAM,EAAE,KAAK,EACX,OAAgC,EAChC,OAAkC,EAAE,EACgB,EAAE;YACtD,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;YAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,gCAAgC,CAAC,CAAC;gBAClF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgE,CAAC;gBAC9F,MAAM,KAAK,GAAI,OAAO,CAAC,SAA6C,EAAE,MAAM,CAAC;gBAC7E,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;YAClF,CAAC;YACD,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;YAC3E,OAAO,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;CACH"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAsB9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAcpD,SAAS,oBAAoB;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,OAAO,aAAa;IACP,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,SAAS,CAAe;IAEzC,YAAY,OAA6B;QACvC,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,OAAyE,EAAE;QAE3E,qEAAqE;QACrE,yCAAyC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,iEAAiE;gBACjE,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;oBACzD,MAAM;oBACN,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;wBACtC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1D,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC3E;oBACD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;iBAC5C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;oBAAE,OAAO,IAAS,CAAC;gBAC5D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;oBAChD,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAChD,SAAS;gBACX,CAAC;gBACD,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,YAAY;oBAAE,MAAM,GAAG,CAAC;gBAC3C,SAAS,GAAG,GAAG,CAAC;gBAChB,IAAI,OAAO,IAAI,QAAQ,GAAG,CAAC;oBAAE,MAAM;YACrC,CAAC;QACH,CAAC;QACD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEQ,MAAM,GAAG;QAChB,MAAM,EAAE,CAAC,IAAwB,EAAkB,EAAE,CACnD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,EAAE,GAA+B,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC;QACzE,GAAG,EAAE,CAAC,EAAU,EAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;KAC7E,CAAC;IAEO,cAAc,GAAG;QACxB,MAAM,EAAE,CAAC,IAA+B,EAAyB,EAAE,CACjE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;QACtD,IAAI,EAAE,GAAsC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACxF,MAAM,EAAE,CAAC,EAAU,EAAE,IAA4F,EAAyB,EAAE,CAC1I,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAC9D,CAAC;IAEO,QAAQ,GAAG;QAClB,MAAM,EAAE,CAAC,IAA0B,EAAoB,EAAE,CACvD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC;QAChD;;;;;WAKG;QACH,OAAO,EAAE,CAAC,SAAiB,EAAE,OAA8B,EAA0B,EAAE,CACrF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,SAAS,UAAU,EAAE;YACxD,IAAI,EAAE;gBACJ,WAAW,EAAE,OAAO,CAAC,UAAU;gBAC/B,UAAU,EAAE;oBACV,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa;oBAChD,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,eAAe;oBACpD,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,eAAe;oBACpD,QAAQ,EAAE,IAAI;iBACf;aACF;SACF,CAAC;QACJ,MAAM,EAAE,CAAC,SAAiB,EAAoC,EAAE,CAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,SAAS,SAAS,CAAC;QAC1D,QAAQ,EAAE,CACR,SAAiB,EACjB,IAA+G,EACpD,EAAE,CAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,SAAS,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;QACtE,GAAG,EAAE,CAAC,EAAU,EAA8C,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAC1G,IAAI,EAAE,GAAiC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;KAC9E,CAAC;IAEF;;;;OAIG;IACM,UAAU,GAAG;QACpB,MAAM,EAAE,CAAC,IAA4B,EAAsB,EAAE,CAC3D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC;QAClD,GAAG,EAAE,CAAC,EAAU,EAAoC,EAAE,CACpD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;KAClE,CAAC;IAEO,SAAS,GAAG;QACnB;;;;WAIG;QACH,SAAS,EAAE,CAAC,IAAsB,EAA8B,EAAE;YAChE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;YAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE;gBAClD,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,cAAc,IAAI,oBAAoB,EAAE;gBACxD,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,CAAC,QAAgB,EAAE,IAAoB,EAAoC,EAAE,CACpF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,QAAQ,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5E,MAAM,EAAE,CAAC,QAAgB,EAAE,MAAe,EAAoC,EAAE,CAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,QAAQ,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvF,GAAG,EAAE,CAAC,QAAgB,EAAoC,EAAE,CAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,wBAAwB,QAAQ,EAAE,CAAC;QACzD;;;;;;;WAOG;QACH,UAAU,EAAE,CACV,QAAgB,EAChB,IAA4D,EACpC,EAAE,CAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,QAAQ,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7F,IAAI,EAAE,CAAC,SAAiE,EAAE,EAAgC,EAAE;YAC1G,MAAM,EAAE,GAAG,IAAI,eAAe,CAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAuB,CAChF,CAAC,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC;IAEO,SAAS,GAAG;QACnB,GAAG,EAAE,CAAC,UAAkB,EAA+D,EAAE,CACvF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,+BAA+B,UAAU,EAAE,CAAC;QAClE,mEAAmE;QACnE,KAAK,EAAE,CACL,UAAkB,EAClB,iBAAyB,EACmD,EAAE,CAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,UAAU,QAAQ,EAAE;YACtE,IAAI,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;YAC/C,cAAc,EAAE,oBAAoB,EAAE;SACvC,CAAC;QACJ,IAAI,EAAE,CAAC,UAAkB,EAAE,UAAkB,EAA2C,EAAE,CACxF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,UAAU,OAAO,EAAE;YACrE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE;SACpE,CAAC;QACJ,OAAO,EAAE,CAAC,QAAgB,EAA8D,EAAE,CACxF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,wBAAwB,QAAQ,mBAAmB,CAAC;QAC3E,wEAAwE;QACxE,MAAM,EAAE,KAAK,EACX,QAAiC,EACjC,OAAkC,EAAE,EACgB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC9F,CAAC;IAEO,QAAQ,GAAG;QAClB,GAAG,EAAE,CAAC,SAAiB,EAAoC,EAAE,CAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,SAAS,EAAE,CAAC;QAC3D,2DAA2D;QAC3D,YAAY,EAAE,CAAC,SAAiB,EAAsD,EAAE,CACtF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,SAAS,SAAS,CAAC;QAClE;;;;;WAKG;QACH,eAAe,EAAE,CACf,OAAgC,EAChC,cAAsC,EACA,EAAE,CACxC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE;YACnD,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACjF,SAAS,EAAE,IAAI;SAChB,CAAC;QACJ,8DAA8D;QAC9D,IAAI,EAAE,KAAK,IAAgC,EAAE;YAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,gCAAgC,CAAC,CAAC;YAClF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,2CAA2C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9H,OAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC,IAAI,CAAC;QAClE,CAAC;QACD;;;;;WAKG;QACH,MAAM,EAAE,KAAK,EACX,OAAgC,EAChC,OAA0E,EAAE,EACtC,EAAE;YACxC,IAAI,IAAuB,CAAC;YAC5B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,0DAA0D;gBAC1D,MAAM,KAAK,GAAI,OAAO,CAAC,SAA6C,EAAE,MAAM,IAAI,QAAQ,CAAC;gBACzF,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,CAAC;YACD,OAAO,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;CACH"}

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { MandateClient, type MandateClientOptions } from "./client.js";
 export { verifyReceiptSignature } from "./verify.js";
+export { ACTION_DIGEST_VERSION, actionDigest, canonicalAction, verifyAuthorityRecord } from "./record.js";
+export { AP2_ADAPTER_VERSION, AP2_PAYMENT_MANDATE_VCT, ap2DecisionRequest, verifyAp2PaymentAgainstRecord, type Ap2Amount, type Ap2Merchant, type Ap2OpenPaymentMandate, type Ap2Projection, type Ap2PaymentCheck, type Ap2PaymentMandate, } from "./ap2.js";
 export * from "./types.js";
 export * from "./errors.js";

package/dist/index.js

@@ -1,5 +1,7 @@
 export { MandateClient } from "./client.js";
 export { verifyReceiptSignature } from "./verify.js";
+export { ACTION_DIGEST_VERSION, actionDigest, canonicalAction, verifyAuthorityRecord } from "./record.js";
+export { AP2_ADAPTER_VERSION, AP2_PAYMENT_MANDATE_VCT, ap2DecisionRequest, verifyAp2PaymentAgainstRecord, } from "./ap2.js";
 export * from "./types.js";
 export * from "./errors.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA6B,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA6B,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,GAO9B,MAAM,UAAU,CAAC;AAClB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/record.d.ts

@@ -0,0 +1,25 @@
+import type { ActionFields, AuthorityRecordVerification, VerificationKey } from "./types.js";
+export declare const ACTION_DIGEST_VERSION = "1";
+/**
+ * The canonical action object: the fixed key set plus `digest_version`.
+ * Absent optional fields are null. Values are used exactly as given: no
+ * trimming, case folding or Unicode normalisation.
+ */
+export declare function canonicalAction(fields: Readonly<Record<string, unknown>>): Record<string, unknown>;
+/**
+ * `sha256:<hex>` of the canonical action: the value an Authority Record
+ * carries as `action_hash`. Compute it from the instruction you are about to
+ * execute and compare.
+ */
+export declare function actionDigest(fields: Partial<ActionFields> | Readonly<Record<string, unknown>>): Promise<string>;
+/**
+ * Verifies an Authority Record locally: the signature against the published
+ * key the record names, that its `action_hash` binds the action it records,
+ * and, if you pass `expectedAction`, that it is the action you hold.
+ *
+ * A valid record proves what mnd8t decided then. It does not say the agent
+ * is authorised now.
+ */
+export declare function verifyAuthorityRecord(receipt: Record<string, unknown>, keys: readonly VerificationKey[], options?: {
+    expectedAction?: Partial<ActionFields>;
+}): Promise<AuthorityRecordVerification>;

package/dist/record.js

@@ -0,0 +1,117 @@
+/**
+ * Authority Record verification, dependency-free (WebCrypto). Mirrors the
+ * gateway's `@mandate/evidence` record checks exactly, and is tested against
+ * the same action-digest vectors.
+ */
+import { canonicalJson, verifyReceiptSignature } from "./verify.js";
+export const ACTION_DIGEST_VERSION = "1";
+const OPTIONAL_KEYS = ["financial_account_id", "counterparty", "destination", "purpose", "external_reference"];
+/**
+ * The canonical action object: the fixed key set plus `digest_version`.
+ * Absent optional fields are null. Values are used exactly as given: no
+ * trimming, case folding or Unicode normalisation.
+ */
+export function canonicalAction(fields) {
+    const amount = fields["amount_minor"];
+    if (typeof amount !== "number" || !Number.isSafeInteger(amount) || amount < 0) {
+        throw new Error("action digest: amount_minor must be a non-negative safe integer");
+    }
+    const out = { digest_version: ACTION_DIGEST_VERSION, amount_minor: amount };
+    for (const key of ["action_type", "asset"]) {
+        const value = fields[key];
+        if (typeof value !== "string" || value.length === 0)
+            throw new Error(`action digest: ${key} is required`);
+        out[key] = value;
+    }
+    for (const key of OPTIONAL_KEYS) {
+        const value = fields[key];
+        if (value !== undefined && value !== null && typeof value !== "string") {
+            throw new Error(`action digest: ${key} must be a string or null`);
+        }
+        out[key] = value ?? null;
+    }
+    return out;
+}
+/**
+ * `sha256:<hex>` of the canonical action: the value an Authority Record
+ * carries as `action_hash`. Compute it from the instruction you are about to
+ * execute and compare.
+ */
+export async function actionDigest(fields) {
+    const bytes = new TextEncoder().encode(canonicalJson(canonicalAction(fields)));
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    return `sha256:${Array.from(digest, (b) => b.toString(16).padStart(2, "0")).join("")}`;
+}
+function recordedAction(receipt) {
+    const intent = (receipt["intent"] ?? {});
+    const out = {};
+    for (const key of ["action_type", "asset", "amount_minor", ...OPTIONAL_KEYS])
+        out[key] = intent[key];
+    return out;
+}
+async function digestOrNull(fields) {
+    try {
+        return await actionDigest(fields);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verifies an Authority Record locally: the signature against the published
+ * key the record names, that its `action_hash` binds the action it records,
+ * and, if you pass `expectedAction`, that it is the action you hold.
+ *
+ * A valid record proves what mnd8t decided then. It does not say the agent
+ * is authorised now.
+ */
+export async function verifyAuthorityRecord(receipt, keys, options = {}) {
+    const signature = receipt["signature"];
+    const keyId = typeof signature?.key_id === "string" ? signature.key_id : null;
+    const recordedHash = typeof receipt["action_hash"] === "string" ? receipt["action_hash"] : null;
+    const result = {
+        valid: false,
+        signature_valid: false,
+        record_integrity: null,
+        action_match: null,
+        key_id: keyId,
+        key_status: null,
+        action_hash: recordedHash,
+        reason: null,
+    };
+    const key = keyId ? keys.find((k) => k.key_id === keyId) : undefined;
+    if (!key) {
+        result.reason = keyId ? `unknown key_id ${keyId}` : "receipt has no signature";
+        return result;
+    }
+    result.key_status = key.status ?? null;
+    const sig = await verifyReceiptSignature(receipt, key.public_key_pem);
+    result.signature_valid = sig.valid;
+    if (!sig.valid) {
+        result.reason = sig.reason;
+        return result;
+    }
+    if (recordedHash !== null) {
+        result.record_integrity = (await digestOrNull(recordedAction(receipt))) === recordedHash;
+        if (!result.record_integrity)
+            result.reason = "action_hash does not match the recorded action";
+    }
+    else if ("action_hash" in receipt) {
+        result.record_integrity = false;
+        result.reason = "action_hash is not a string";
+    }
+    if (options.expectedAction) {
+        if (recordedHash === null) {
+            result.action_match = false;
+            result.reason ??= "record has no action_hash to compare against";
+        }
+        else {
+            result.action_match = (await digestOrNull(options.expectedAction)) === recordedHash;
+            if (!result.action_match)
+                result.reason ??= "expected action does not match the recorded action_hash";
+        }
+    }
+    result.valid = result.signature_valid && result.record_integrity !== false && result.action_match !== false;
+    return result;
+}
+//# sourceMappingURL=record.js.map

package/dist/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC,MAAM,aAAa,GAAG,CAAC,sBAAsB,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,oBAAoB,CAAU,CAAC;AAExH;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IACrG,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,CAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,cAAc,CAAC,CAAC;QAC1G,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,2BAA2B,CAAC,CAAC;QACpE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAiE;IAClG,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,MAAiC,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,cAAc,CAAC,OAAgC;IACtD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IACpE,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACrG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAA+B;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgC,EAChC,IAAgC,EAChC,UAAsD,EAAE;IAExD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAqC,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,SAAS,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAO,CAAC,aAAa,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,MAAM,MAAM,GAAgC;QAC1C,KAAK,EAAE,KAAK;QACZ,eAAe,EAAE,KAAK;QACtB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,IAAI;KACb,CAAC;IAEF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAC/E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,gBAAgB,GAAG,CAAC,MAAM,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,MAAM,CAAC,MAAM,GAAG,gDAAgD,CAAC;IACjG,CAAC;SAAM,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAChC,MAAM,CAAC,MAAM,GAAG,6BAA6B,CAAC;IAChD,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;YAC5B,MAAM,CAAC,MAAM,KAAK,8CAA8C,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,YAAY,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,cAAyC,CAAC,CAAC,KAAK,YAAY,CAAC;YAC/G,IAAI,CAAC,MAAM,CAAC,YAAY;gBAAE,MAAM,CAAC,MAAM,KAAK,yDAAyD,CAAC;QACxG,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC;IAC5G,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/types.d.ts

@@ -46,9 +46,48 @@ export interface MandatePolicy {
         start: string;
         end: string;
     };
+    /**
+     * What this mandate requires of an external identity / session attestation
+     * presented with each request. Can only refuse; never widens authority.
+     */
+    identity_attestation?: {
+        required?: boolean;
+        protocols?: IdentityAttestationProtocol[];
+        trusted_issuers?: string[];
+        bind_agent?: boolean;
+    };
     effective_at: string;
     expires_at: string;
 }
+/** Identity and session protocols mnd8t models as attestation sources. */
+export type IdentityAttestationProtocol = "AFSP" | "OTHER";
+/**
+ * An external identity / session attestation: who the agent is and which
+ * session was cleared. Issued by an admission layer such as AFSP, not by
+ * mnd8t. Field names follow the AFSP v0.1 session token where it defines
+ * one. Recorded in the Authority Record beside the mandate; not verified by
+ * mnd8t.
+ */
+export interface IdentityAttestation {
+    protocol: IdentityAttestationProtocol;
+    protocol_version: string;
+    issuer: string;
+    clearing_institution?: string;
+    agent_id: string;
+    /** Optional: AFSP tokens carry no principal identifier. */
+    principal_id?: string;
+    session_id: string;
+    package_id?: string;
+    /** AFSP: PROCEED_TO_KYC, REQUEST_ADDITIONAL_VERIFICATION or DECLINE_SESSION. */
+    clearance_decision?: string;
+    /** AFSP: READ, DISCOVER, PRESENT, INITIATE, EXECUTE. */
+    action_classes?: string[];
+    not_before?: string;
+    not_after: string;
+    single_use?: boolean;
+    /** `sha256:<hex>` of the raw attestation token; the token itself is never sent. */
+    token_digest?: string;
+}
 export interface CreateMandateRequest {
     agent_id: string;
     name: string;
@@ -165,6 +204,8 @@ export interface AuthorizeRequest {
         counterparty_country?: string;
         customer_classification?: string;
     };
+    /** External identity / session attestation (AFSP or another protocol). */
+    identity_attestation?: IdentityAttestation;
     /** Deprecated: prefer `amount.asset_amount_minor`. */
     amount_minor?: number;
     policy_amount_minor?: number;
@@ -181,9 +222,35 @@ export interface AuthorizeRequest {
     purpose?: string;
     occurred_at?: string;
     metadata?: Record<string, unknown>;
+    /**
+     * Reference to a valuation asserted by a credential holding
+     * `valuations:assert`. Takes precedence over an inline `valuation`, and is
+     * required by mandates with `require_asserted_valuation` — an agent key
+     * cannot mint one, which is the point.
+     */
+    valuation_id?: string;
     /** Overrides the automatically generated idempotency key. */
     idempotencyKey?: string;
 }
+export interface AssertValuationRequest {
+    asset: string;
+    asset_amount_minor: number;
+    policy_amount_minor: number;
+    policy_currency: string;
+    source?: string;
+    rate_reference?: string;
+    valued_at?: string;
+    /** 30–3600, default 300. */
+    ttl_seconds?: number;
+}
+export interface Valuation {
+    id: string;
+    asset: string;
+    asset_amount_minor: number;
+    policy_amount_minor: number;
+    policy_currency: string;
+    expires_at: string;
+}
 export interface AuthorizeResponse {
     id: string;
     mode: "SHADOW" | "ENFORCE";
@@ -201,6 +268,85 @@ export interface AuthorizeResponse {
     } | null;
     authorisation_artifact: AuthorisationArtifactSummary | null;
     evidence_receipt_id: string | null;
+    /** The signed Authority Record this decision produced (gateway ≥ receipt 1.1). */
+    authority_record?: AuthorityRecordSummary;
+}
+export interface AuthorityRecordSummary {
+    receipt_id: string;
+    receipt_version: string;
+    /** `sha256:` digest of the proposed action; see `actionDigest`. */
+    action_hash: string;
+    key_id: string;
+    /** GET: the signed record. */
+    url: string;
+    /** POST { receipt, expected_action? }: verify a presented record. */
+    verify_url: string;
+}
+/** The fields an Authority Record's `action_hash` is computed over. */
+export interface ActionFields {
+    action_type: string;
+    financial_account_id: string | null;
+    asset: string;
+    /** Integer minor units of the asset that moves. */
+    amount_minor: number;
+    counterparty: string | null;
+    destination: string | null;
+    purpose: string | null;
+    external_reference: string | null;
+}
+/** A key from /.well-known/mandate-keys.json. */
+export interface VerificationKey {
+    key_id: string;
+    public_key_pem: string;
+    /** Older gateways omit it. Retired keys verify; only the active key signs. */
+    status?: "ACTIVE" | "RETIRED";
+}
+export interface AuthorityRecordVerification {
+    /** signature_valid, and neither record_integrity nor action_match is false. */
+    valid: boolean;
+    signature_valid: boolean;
+    /** The recorded action_hash is the digest of the recorded action. Null on a
+     *  1.0 receipt, which predates action hashes. */
+    record_integrity: boolean | null;
+    /** Your expected action produces the recorded action_hash. Null if none given. */
+    action_match: boolean | null;
+    key_id: string | null;
+    key_status: "ACTIVE" | "RETIRED" | null;
+    action_hash: string | null;
+    reason: string | null;
+}
+export type CurrentAuthority = {
+    status: "NOT_CHECKED";
+    reason: "RECORD_NOT_VERIFIED" | "AUTHENTICATION_REQUIRED" | "NOT_PERMITTED" | "NO_MANDATE";
+} | {
+    status: "CHECKED";
+    checked_at: string;
+    mandate_status: string;
+    current_version: number | null;
+    recorded_version_is_current: boolean;
+    expires_at: string | null;
+    expired: boolean;
+    revoked_at: string | null;
+    note: string;
+};
+/** Response of POST /v1/evidence-receipts/verify. */
+export interface PresentedRecordVerification extends AuthorityRecordVerification {
+    receipt_id: string | null;
+    receipt_version: string | null;
+    decision: {
+        status: string;
+        effective_status: string;
+        mode: string;
+        reasons: string[];
+        decided_at: string;
+    } | null;
+    mandate_reference: {
+        id: string | null;
+        version: number | null;
+        policy_hash: string | null;
+    } | null;
+    /** The mandate now, reported apart from the record's validity. */
+    current_authority: CurrentAuthority;
 }
 export interface ConfirmRequest {
     provider: string;

package/dist/verify.d.ts

@@ -3,6 +3,7 @@
  * browsers via WebCrypto. Mirrors the gateway's canonicalisation exactly:
  * sorted keys, no whitespace, integers only, undefined members dropped.
  */
+export declare function canonicalJson(value: unknown): string;
 export declare function verifyReceiptSignature(receipt: Record<string, unknown>, publicKeyPem: string): Promise<{
     valid: boolean;
     reason: string | null;

package/dist/verify.js

@@ -3,7 +3,7 @@
  * browsers via WebCrypto. Mirrors the gateway's canonicalisation exactly:
  * sorted keys, no whitespace, integers only, undefined members dropped.
  */
-function canonicalJson(value) {
+export function canonicalJson(value) {
     if (value === null)
         return "null";
     switch (typeof value) {

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACtF,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;iBAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9F,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;SACrB,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC;SAChD,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgC,EAChC,YAAoB;IAEpB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAExB,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnF,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAqB,EAAE,SAAS,EAAE,KAAK,EAAE;YAClG,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACtF,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;iBAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9F,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;SACrB,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC;SAChD,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgC,EAChC,YAAoB;IAEpB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAExB,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnF,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAqB,EAAE,SAAS,EAAE,KAAK,EAAE;YAClG,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}

package/package.json

@@ -1,46 +1,46 @@
-{
-  "name": "@mnd8t/sdk",
-  "version": "0.1.2",
-  "description": "TypeScript SDK for the Mandate Gateway authority API",
-  "keywords": [
-    "ai-agents",
-    "authority",
-    "payments",
-    "policy",
-    "evidence",
-    "mnd8t"
-  ],
-  "license": "MIT",
-  "homepage": "https://mnd8t.com/docs/sdk",
-  "author": "Glencorse Ltd",
-  "type": "module",
-  "engines": {
-    "node": ">=22"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run && node ../../scripts/check-readme-compiles.mjs"
-  },
-  "devDependencies": {
-    "@types/node": "^22.10.5",
-    "typescript": "^5.7.3",
-    "vitest": "^3.0.5"
-  }
-}
+{
+  "name": "@mnd8t/sdk",
+  "version": "0.3.1",
+  "description": "TypeScript SDK for the Mandate Gateway authority API",
+  "keywords": [
+    "ai-agents",
+    "authority",
+    "payments",
+    "policy",
+    "evidence",
+    "mnd8t"
+  ],
+  "license": "MIT",
+  "homepage": "https://mnd8t.com/docs/sdk",
+  "author": "Glencorse Ltd",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run && node ../../scripts/check-readme-compiles.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.3",
+    "vitest": "^3.0.5"
+  }
+}