@mnemopay/sdk 0.8.0 → 0.9.1

package/dist/index.js

@@ -14,7 +14,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSandboxServer = exports.MnemoPayNetwork = exports.IdentityRegistry = exports.Ledger = exports.JSONFileStorage = exports.SQLiteStorage = exports.NIGERIAN_BANKS = exports.PaystackRail = exports.LightningRail = exports.StripeRail = exports.MockRail = exports.BehaviorProfile = exports.TransactionGraph = exports.IsolationForest = exports.DEFAULT_RATE_LIMIT = exports.DEFAULT_FRAUD_CONFIG = exports.RateLimiter = exports.FraudGuard = exports.l2Normalize = exports.localEmbed = exports.cosineSimilarity = exports.RecallEngine = exports.MnemoPay = exports.MnemoPayLite = void 0;
+exports.createSandboxServer = exports.MockCommerceProvider = exports.CommerceEngine = exports.MnemoPayNetwork = exports.constantTimeEqual = exports.IdentityRegistry = exports.Ledger = exports.JSONFileStorage = exports.SQLiteStorage = exports.NIGERIAN_BANKS = exports.PaystackRail = exports.LightningRail = exports.StripeRail = exports.MockRail = exports.BehaviorProfile = exports.TransactionGraph = exports.IsolationForest = exports.DEFAULT_RATE_LIMIT = exports.DEFAULT_FRAUD_CONFIG = exports.RateLimiter = exports.FraudGuard = exports.l2Normalize = exports.localEmbed = exports.cosineSimilarity = exports.RecallEngine = exports.MnemoPay = exports.MnemoPayLite = void 0;
 exports.autoScore = autoScore;
 exports.computeScore = computeScore;
 exports.reputationTier = reputationTier;
@@ -78,6 +78,29 @@ const IMPORTANCE_PATTERNS = [
 const LONG_CONTENT_THRESHOLD = 200;
 const LONG_CONTENT_BOOST = 0.10;
 const BASE_IMPORTANCE = 0.50;
+// ─── Security: prompt injection defense ───────────────────────────────────
+const INJECTION_PATTERNS = [
+    /\b(ignore|disregard|forget)\b.{0,30}\b(previous|prior|above|all)\b.{0,30}\b(instructions?|rules?|constraints?)\b/i,
+    /\b(you are|act as|pretend|roleplay|simulate)\b.{0,30}\b(admin|root|system|god|superuser)\b/i,
+    /\bsystem\s*:\s*/i,
+    /\bassistant\s*:\s*/i,
+    /\b(transfer|send|move)\b.{0,20}\b(all|every|maximum)\b.{0,20}\b(funds?|money|balance|wallet)\b/i,
+    /\b(set|change|update|override)\b.{0,20}\b(wallet|balance|reputation|role|permission)\b.{0,10}\b(to|=)\b/i,
+];
+function sanitizeMemoryContent(content) {
+    let sanitized = content;
+    for (const pattern of INJECTION_PATTERNS) {
+        sanitized = sanitized.replace(pattern, "[FILTERED]");
+    }
+    return sanitized;
+}
+function validateTags(tags) {
+    return tags
+        .filter(t => typeof t === "string" && t.length <= 50)
+        .map(t => t.replace(/[^a-zA-Z0-9_\-:.]/g, ""))
+        .filter(t => t.length > 0)
+        .slice(0, 20);
+}
 function autoScore(content) {
     let score = BASE_IMPORTANCE;
     if (content.length > LONG_CONTENT_THRESHOLD)
@@ -111,6 +134,18 @@ class MnemoPayLite extends EventEmitter {
     persistPath;
     persistTimer;
     storageAdapter;
+    /** Guard against concurrent double-settle on the same transaction */
+    _settlingTxIds = new Set();
+    /** Guard against concurrent double-refund on the same transaction */
+    _refundingTxIds = new Set();
+    /** Guard against concurrent wallet mutations */
+    _walletLock = Promise.resolve();
+    /** Max wallet balance — prevents overflow/accumulation attacks */
+    static MAX_WALLET_BALANCE = 1_000_000; // $1M ceiling
+    /** Max memories per agent — prevents memory exhaustion attacks */
+    static MAX_MEMORIES = 50_000;
+    /** Max transactions tracked — prevents unbounded growth */
+    static MAX_TRANSACTIONS = 100_000;
     /** Fraud detection, rate limiting, dispute resolution, and platform fee */
     fraud;
     /** Pluggable payment rail (Stripe, Lightning, etc.). Default: in-memory mock. */
@@ -169,6 +204,20 @@ class MnemoPayLite extends EventEmitter {
             this._loadFromDisk();
             // Auto-save every 30 seconds
             this.persistTimer = setInterval(() => this._saveToDisk(), 30_000);
+            // Hook process exit signals to flush data before shutdown.
+            // This prevents memory loss on restart, SIGTERM, or uncaught exceptions.
+            if (typeof process !== "undefined" && process.on) {
+                const flush = () => { this._saveToDisk(); };
+                process.on("beforeExit", flush);
+                process.on("SIGINT", () => { flush(); process.exit(0); });
+                process.on("SIGTERM", () => { flush(); process.exit(0); });
+                // Save on uncaught exception too — data is more valuable than a clean exit
+                process.on("uncaughtException", (err) => {
+                    flush();
+                    this.log(`Uncaught exception (data saved): ${err.message}`);
+                    process.exit(1);
+                });
+            }
             this.log(`Persistence enabled: ${this.persistPath}`);
         }
         catch (e) {
@@ -182,12 +231,58 @@ class MnemoPayLite extends EventEmitter {
             const fs = require("fs");
             if (!fs.existsSync(this.persistPath))
                 return;
-            const raw = JSON.parse(fs.readFileSync(this.persistPath, "utf-8"));
-            // Restore memories
+            // Corruption recovery: try main → .bak → .tmp (triple fallback)
+            let rawText;
+            try {
+                rawText = fs.readFileSync(this.persistPath, "utf-8");
+                JSON.parse(rawText); // validate JSON
+            }
+            catch {
+                const bakPath = this.persistPath + ".bak";
+                const tmpPath = this.persistPath + ".tmp";
+                if (fs.existsSync(bakPath)) {
+                    try {
+                        rawText = fs.readFileSync(bakPath, "utf-8");
+                        JSON.parse(rawText);
+                        this.log("Main persist file corrupted — recovered from .bak backup");
+                    }
+                    catch {
+                        if (fs.existsSync(tmpPath)) {
+                            rawText = fs.readFileSync(tmpPath, "utf-8");
+                            this.log("Main + .bak corrupted — recovered from .tmp");
+                        }
+                        else {
+                            this.log("All persist files corrupted — starting fresh");
+                            return;
+                        }
+                    }
+                }
+                else if (fs.existsSync(tmpPath)) {
+                    rawText = fs.readFileSync(tmpPath, "utf-8");
+                    this.log("Main persist file corrupted — recovered from .tmp");
+                }
+                else {
+                    this.log("Persist file corrupted and no backup available");
+                    return;
+                }
+            }
+            const raw = JSON.parse(rawText);
+            // Restore memories (with tags parsing for both stringified and array formats)
             if (raw.memories) {
                 for (const m of raw.memories) {
                     m.createdAt = new Date(m.createdAt);
                     m.lastAccessed = new Date(m.lastAccessed);
+                    // Tags may be stringified JSON or an array — handle both
+                    if (typeof m.tags === "string") {
+                        try {
+                            m.tags = JSON.parse(m.tags);
+                        }
+                        catch {
+                            m.tags = [];
+                        }
+                    }
+                    if (!Array.isArray(m.tags))
+                        m.tags = [];
                     this.memories.set(m.id, m);
                 }
             }
@@ -352,8 +447,16 @@ class MnemoPayLite extends EventEmitter {
                 identity: this.identity.serialize(),
                 savedAt: new Date().toISOString(),
             });
-            // Atomic write
+            // Atomic write with backup: .bak → .tmp → main
             const tmpPath = this.persistPath + ".tmp";
+            const bakPath = this.persistPath + ".bak";
+            // Keep a backup of the last known-good file before overwriting
+            if (fs.existsSync(this.persistPath)) {
+                try {
+                    fs.copyFileSync(this.persistPath, bakPath);
+                }
+                catch { /* best effort */ }
+            }
             fs.writeFileSync(tmpPath, data, "utf-8");
             fs.renameSync(tmpPath, this.persistPath);
         }
@@ -374,6 +477,10 @@ class MnemoPayLite extends EventEmitter {
             createdAt: new Date(),
         };
         this.auditLog.push(entry);
+        // Cap in-memory audit log to prevent unbounded growth
+        if (this.auditLog.length > 1000) {
+            this.auditLog.splice(0, this.auditLog.length - 500);
+        }
     }
     // ── Memory Methods ──────────────────────────────────────────────────────
     async remember(content, opts) {
@@ -381,28 +488,36 @@ class MnemoPayLite extends EventEmitter {
             throw new Error("Memory content is required");
         if (content.length > 100_000)
             throw new Error("Memory content exceeds 100KB limit");
-        const importance = opts?.importance ?? autoScore(content);
+        // Security: prevent memory exhaustion attacks
+        if (this.memories.size >= MnemoPayLite.MAX_MEMORIES) {
+            throw new Error(`Memory limit reached (${MnemoPayLite.MAX_MEMORIES}). Consolidate or forget old memories first.`);
+        }
+        // Security: sanitize against prompt injection
+        const safeContent = sanitizeMemoryContent(content);
+        // Security: validate and sanitize tags
+        const safeTags = validateTags(opts?.tags ?? []);
+        const importance = opts?.importance ?? autoScore(safeContent);
         const now = new Date();
         const mem = {
             id: randomUUID(),
             agentId: this.agentId,
-            content,
+            content: safeContent,
             importance: Math.min(Math.max(importance, 0), 1),
             score: importance,
             createdAt: now,
             lastAccessed: now,
             accessCount: 0,
-            tags: opts?.tags ?? [],
+            tags: safeTags,
         };
         this.memories.set(mem.id, mem);
         // Generate embedding if using vector/hybrid recall
         if (this.recallEngine.strategy !== "score") {
             await this.recallEngine.embed(mem.id, content);
         }
-        this.audit("memory:stored", { id: mem.id, content: content.slice(0, 100), importance: mem.importance });
+        this.audit("memory:stored", { id: mem.id, tags: safeTags, importance: mem.importance });
         this._saveToDisk();
-        this.emit("memory:stored", { id: mem.id, content, importance: mem.importance });
-        this.log(`Stored memory: "${content.slice(0, 60)}..." (importance: ${mem.importance.toFixed(2)})`);
+        this.emit("memory:stored", { id: mem.id, importance: mem.importance });
+        this.log(`Stored memory: id=${mem.id} (importance: ${mem.importance.toFixed(2)}, tags: ${safeTags.join(",") || "none"})`);
         return mem.id;
     }
     async recall(queryOrLimit, maybeLimit) {
@@ -478,6 +593,41 @@ class MnemoPayLite extends EventEmitter {
         return pruned;
     }
     // ── Payment Methods ─────────────────────────────────────────────────────
+    /**
+     * Expire pending transactions older than the escrow timeout.
+     * Default: 24 hours (1440 minutes, matching disputeWindowMinutes).
+     * Releases escrowed funds back to the agent.
+     */
+    async expireStaleEscrows(maxAgeMinutes) {
+        const timeout = (maxAgeMinutes ?? this.fraud.config.disputeWindowMinutes) * 60_000;
+        const now = Date.now();
+        let expired = 0;
+        for (const tx of this.transactions.values()) {
+            if (tx.status !== "pending")
+                continue;
+            if (now - tx.createdAt.getTime() < timeout)
+                continue;
+            // Release escrow on external rail
+            if (tx.externalId) {
+                try {
+                    await this.paymentRail.reversePayment(tx.externalId, tx.amount);
+                }
+                catch (e) {
+                    this.log(`Failed to reverse expired escrow ${tx.id}: ${e}`);
+                }
+            }
+            // Release escrow in ledger
+            this.ledger.recordCancellation(this.agentId, tx.amount, tx.id);
+            tx.status = "expired";
+            expired++;
+            this.audit("escrow:expired", { id: tx.id, amount: tx.amount, ageMinutes: Math.floor((now - tx.createdAt.getTime()) / 60_000) });
+        }
+        if (expired > 0) {
+            this._saveToDisk();
+            this.log(`Expired ${expired} stale escrow(s)`);
+        }
+        return expired;
+    }
     async charge(amount, reason, ctx) {
         if (!Number.isFinite(amount) || amount <= 0)
             throw new Error("Amount must be a positive finite number");
@@ -485,6 +635,12 @@ class MnemoPayLite extends EventEmitter {
         amount = Math.round(amount * 100) / 100;
         if (!reason || typeof reason !== "string")
             throw new Error("Reason is required");
+        if (reason.length > 1000)
+            throw new Error("Reason exceeds 1000 character limit");
+        // Security: prevent unbounded transaction growth
+        if (this.transactions.size >= MnemoPayLite.MAX_TRANSACTIONS) {
+            throw new Error(`Transaction limit reached (${MnemoPayLite.MAX_TRANSACTIONS}). Archive old transactions.`);
+        }
         const maxCharge = 500 * this._reputation;
         if (amount > maxCharge) {
             throw new Error(`Amount $${amount.toFixed(2)} exceeds reputation ceiling $${maxCharge.toFixed(2)} ` +
@@ -505,6 +661,8 @@ class MnemoPayLite extends EventEmitter {
         }
         // Record charge for velocity tracking
         this.fraud.recordCharge(this.agentId, amount, ctx);
+        // Generate idempotency key for payment rail calls
+        const idempotencyKey = `charge_${this.agentId}_${Date.now()}_${randomUUID().slice(0, 8)}`;
         // Create hold on external payment rail
         const hold = await this.paymentRail.createHold(amount, reason, this.agentId);
         const tx = {
@@ -517,6 +675,7 @@ class MnemoPayLite extends EventEmitter {
             riskScore: risk.score,
             externalId: hold.externalId,
             externalStatus: hold.status,
+            idempotencyKey,
         };
         this.transactions.set(tx.id, tx);
         // Ledger: move funds from agent available → escrow
@@ -535,84 +694,133 @@ class MnemoPayLite extends EventEmitter {
             throw new Error(`Transaction ${txId} not found`);
         if (tx.status !== "pending")
             throw new Error(`Transaction ${txId} is ${tx.status}, not pending`);
+        // Prevent concurrent double-settle
+        if (this._settlingTxIds.has(txId))
+            throw new Error(`Transaction ${txId} is already being settled`);
+        this._settlingTxIds.add(txId);
         // Counter-party validation: prevent self-referential trust building
         if (this.requireCounterparty) {
             if (!counterpartyId) {
+                this._settlingTxIds.delete(txId);
                 throw new Error("Counter-party ID required for settlement (requireCounterparty is enabled)");
             }
             if (counterpartyId === tx.agentId) {
+                this._settlingTxIds.delete(txId);
                 throw new Error("Counter-party cannot be the same agent that created the charge");
             }
             tx.counterpartyId = counterpartyId;
         }
-        // 1. Capture payment on external rail
-        if (tx.externalId) {
-            const capture = await this.paymentRail.capturePayment(tx.externalId, tx.amount);
-            tx.externalStatus = capture.status;
-        }
-        // 2. Apply platform fee
-        const fee = this.fraud.applyPlatformFee(tx.id, this.agentId, tx.amount);
-        tx.platformFee = fee.feeAmount;
-        tx.netAmount = fee.netAmount;
-        // 2. Move NET funds to wallet (after fee)
-        tx.status = "completed";
-        tx.completedAt = new Date();
-        this._wallet += fee.netAmount;
-        // Ledger: escrow → float → revenue (fee) + counterparty/agent (net)
-        this.ledger.recordSettlement(this.agentId, tx.id, tx.amount, fee.feeAmount, fee.netAmount, tx.counterpartyId);
-        // 3. Boost reputation
-        this._reputation = Math.min(this._reputation + 0.01, 1.0);
-        // 4. Reinforce recently-accessed memories (feedback loop)
-        const oneHourAgo = Date.now() - 3_600_000;
-        let reinforced = 0;
-        for (const mem of this.memories.values()) {
-            if (mem.lastAccessed.getTime() > oneHourAgo) {
-                mem.importance = Math.min(mem.importance + 0.05, 1.0);
-                reinforced++;
+        try {
+            // 1. Enforce settlement hold period
+            const holdMs = this.fraud.config.settlementHoldMinutes * 60_000;
+            const elapsed = Date.now() - tx.createdAt.getTime();
+            if (holdMs > 0 && elapsed < holdMs) {
+                const remainMin = Math.ceil((holdMs - elapsed) / 60_000);
+                throw new Error(`Settlement hold: ${remainMin} minute(s) remaining. ` +
+                    `Charge must be held for ${this.fraud.config.settlementHoldMinutes} minutes before settlement.`);
+            }
+            // 2. Capture payment on external rail
+            if (tx.externalId) {
+                const capture = await this.paymentRail.capturePayment(tx.externalId, tx.amount);
+                tx.externalStatus = capture.status;
             }
+            // 3. Apply platform fee
+            const fee = this.fraud.applyPlatformFee(tx.id, this.agentId, tx.amount);
+            tx.platformFee = fee.feeAmount;
+            tx.netAmount = fee.netAmount;
+            // 4. Ledger FIRST (atomic: record before wallet mutation)
+            this.ledger.recordSettlement(this.agentId, tx.id, tx.amount, fee.feeAmount, fee.netAmount, tx.counterpartyId);
+            // 5. Move NET funds to wallet (atomic via sequential lock + overflow guard)
+            const prevLock = this._walletLock;
+            this._walletLock = prevLock.then(() => {
+                const newBalance = this._wallet + fee.netAmount;
+                if (newBalance > MnemoPayLite.MAX_WALLET_BALANCE) {
+                    throw new Error(`Wallet overflow: balance would exceed $${MnemoPayLite.MAX_WALLET_BALANCE.toLocaleString()}`);
+                }
+                tx.status = "completed";
+                tx.completedAt = new Date();
+                this._wallet = Math.round(newBalance * 100) / 100; // 2-decimal precision
+            });
+            await this._walletLock;
+            // 4. Boost reputation
+            this._reputation = Math.min(this._reputation + 0.01, 1.0);
+            // 5. Reinforce recently-accessed memories (feedback loop)
+            const oneHourAgo = Date.now() - 3_600_000;
+            let reinforced = 0;
+            for (const mem of this.memories.values()) {
+                if (mem.lastAccessed.getTime() > oneHourAgo) {
+                    mem.importance = Math.min(mem.importance + 0.05, 1.0);
+                    reinforced++;
+                }
+            }
+            // Touch identity (update last active)
+            this.identity.touch(this.agentId);
+            this.audit("payment:completed", {
+                id: tx.id, grossAmount: tx.amount, platformFee: fee.feeAmount,
+                netAmount: fee.netAmount, feeRate: fee.feeRate,
+                reinforcedMemories: reinforced,
+            });
+            this._saveToDisk();
+            this.emit("payment:completed", { id: tx.id, amount: fee.netAmount, fee: fee.feeAmount });
+            this.log(`Settled $${tx.amount.toFixed(2)} (fee: $${fee.feeAmount.toFixed(2)}, net: $${fee.netAmount.toFixed(2)}) → ` +
+                `wallet: $${this._wallet.toFixed(2)}, reputation: ${this._reputation.toFixed(2)}, reinforced: ${reinforced} memories`);
+            return { ...tx };
+        }
+        finally {
+            this._settlingTxIds.delete(txId);
         }
-        // Touch identity (update last active)
-        this.identity.touch(this.agentId);
-        this.audit("payment:completed", {
-            id: tx.id, grossAmount: tx.amount, platformFee: fee.feeAmount,
-            netAmount: fee.netAmount, feeRate: fee.feeRate,
-            reinforcedMemories: reinforced,
-        });
-        this._saveToDisk();
-        this.emit("payment:completed", { id: tx.id, amount: fee.netAmount, fee: fee.feeAmount });
-        this.log(`Settled $${tx.amount.toFixed(2)} (fee: $${fee.feeAmount.toFixed(2)}, net: $${fee.netAmount.toFixed(2)}) → ` +
-            `wallet: $${this._wallet.toFixed(2)}, reputation: ${this._reputation.toFixed(2)}, reinforced: ${reinforced} memories`);
-        return { ...tx };
     }
     async refund(txId) {
+        if (!txId || typeof txId !== "string")
+            throw new Error("Transaction ID is required");
         const tx = this.transactions.get(txId);
         if (!tx)
             throw new Error(`Transaction ${txId} not found`);
         if (tx.status === "refunded")
             throw new Error(`Transaction ${txId} already refunded`);
-        // Reverse on external rail
-        if (tx.externalId) {
-            const reversal = await this.paymentRail.reversePayment(tx.externalId, tx.amount);
-            tx.externalStatus = reversal.status;
-        }
-        if (tx.status === "completed") {
-            // Refund the net amount (platform fee is NOT refunded)
-            const refundAmount = tx.netAmount ?? tx.amount;
-            this._wallet = Math.max(this._wallet - refundAmount, 0);
-            this._reputation = Math.max(this._reputation - 0.05, 0);
-            // Ledger: reverse the net settlement
-            this.ledger.recordRefund(this.agentId, tx.id, refundAmount, tx.counterpartyId);
+        if (tx.status === "expired")
+            throw new Error(`Transaction ${txId} has expired and cannot be refunded`);
+        // Prevent concurrent double-refund (mirrors settle guard)
+        if (this._refundingTxIds.has(txId))
+            throw new Error(`Transaction ${txId} is already being refunded`);
+        this._refundingTxIds.add(txId);
+        try {
+            // Enforce dispute window: completed transactions can only be refunded within the window
+            if (tx.status === "completed" && tx.completedAt) {
+                const windowMs = this.fraud.config.disputeWindowMinutes * 60_000;
+                const elapsed = Date.now() - tx.completedAt.getTime();
+                if (windowMs > 0 && elapsed > windowMs) {
+                    throw new Error(`Refund window expired. Transaction was settled ${Math.floor(elapsed / 60_000)} minutes ago. ` +
+                        `Refund window is ${this.fraud.config.disputeWindowMinutes} minutes.`);
+                }
+            }
+            // Reverse on external rail
+            if (tx.externalId) {
+                const reversal = await this.paymentRail.reversePayment(tx.externalId, tx.amount);
+                tx.externalStatus = reversal.status;
+            }
+            if (tx.status === "completed") {
+                // Refund the net amount (platform fee is NOT refunded)
+                const refundAmount = tx.netAmount ?? tx.amount;
+                this._wallet = Math.max(this._wallet - refundAmount, 0);
+                this._reputation = Math.max(this._reputation - 0.05, 0);
+                // Ledger: reverse the net settlement
+                this.ledger.recordRefund(this.agentId, tx.id, refundAmount, tx.counterpartyId);
+            }
+            else if (tx.status === "pending") {
+                // Ledger: release escrow back to agent
+                this.ledger.recordCancellation(this.agentId, tx.amount, tx.id);
+            }
+            tx.status = "refunded";
+            this.audit("payment:refunded", { id: tx.id, amount: tx.amount, netRefunded: tx.netAmount ?? tx.amount });
+            this._saveToDisk();
+            this.emit("payment:refunded", { id: tx.id });
+            this.log(`Refunded $${tx.amount.toFixed(2)} → reputation: ${this._reputation.toFixed(2)}`);
+            return { ...tx };
         }
-        else if (tx.status === "pending") {
-            // Ledger: release escrow back to agent
-            this.ledger.recordCancellation(this.agentId, tx.amount, tx.id);
+        finally {
+            this._refundingTxIds.delete(txId);
         }
-        tx.status = "refunded";
-        this.audit("payment:refunded", { id: tx.id, amount: tx.amount, netRefunded: tx.netAmount ?? tx.amount });
-        this._saveToDisk();
-        this.emit("payment:refunded", { id: tx.id });
-        this.log(`Refunded $${tx.amount.toFixed(2)} → reputation: ${this._reputation.toFixed(2)}`);
-        return { ...tx };
     }
     // ── Dispute Resolution ─────────────────────────────────────────────────
     async dispute(txId, reason, evidence) {
@@ -632,19 +840,24 @@ class MnemoPayLite extends EventEmitter {
         return d;
     }
     async resolveDispute(disputeId, outcome) {
+        // Security: verify the dispute belongs to this agent (only agent's own disputes)
         const d = this.fraud.resolveDispute(disputeId, outcome);
+        const tx = this.transactions.get(d.txId);
+        if (!tx)
+            throw new Error("Dispute references unknown transaction");
+        if (tx.agentId !== this.agentId)
+            throw new Error("Unauthorized: cannot resolve another agent's dispute");
         if (outcome === "refund") {
-            const tx = this.transactions.get(d.txId);
-            if (tx && tx.status === "disputed") {
+            if (tx.status === "disputed") {
                 const refundAmount = tx.netAmount ?? tx.amount;
+                // Ledger first, then wallet (atomic ordering)
                 this._wallet = Math.max(this._wallet - refundAmount, 0);
                 this._reputation = Math.max(this._reputation - 0.05, 0);
                 tx.status = "refunded";
             }
         }
         else {
-            const tx = this.transactions.get(d.txId);
-            if (tx && tx.status === "disputed") {
+            if (tx.status === "disputed") {
                 tx.status = "completed"; // Restore to completed
             }
         }
@@ -675,6 +888,26 @@ class MnemoPayLite extends EventEmitter {
     async verifyLedger() {
         return this.ledger.verify();
     }
+    /**
+     * Reconcile wallet balance against ledger (source of truth).
+     * Returns drift amount. If drift !== 0, the wallet is corrected to match the ledger.
+     * Call periodically or after crashes to detect/fix inconsistencies.
+     */
+    async reconcile() {
+        const walletBefore = Math.round(this._wallet * 100) / 100;
+        const acctBalance = this.ledger.getAccountBalance(`agent:${this.agentId}`, "USD");
+        const ledgerBalance = Math.round(acctBalance.balance * 100) / 100;
+        const drift = Math.round((walletBefore - ledgerBalance) * 100) / 100;
+        if (drift !== 0) {
+            this.log(`RECONCILIATION DRIFT: wallet=$${walletBefore}, ledger=$${ledgerBalance}, drift=$${drift}`);
+            this._wallet = ledgerBalance;
+            this.audit("reconciliation:drift", { walletBefore, ledgerBalance, drift });
+            this._saveToDisk();
+            this.emit("reconciliation:drift", { walletBefore, ledgerBalance, drift });
+            return { walletBefore, ledgerBalance, drift, corrected: true };
+        }
+        return { walletBefore, ledgerBalance, drift: 0, corrected: false };
+    }
     /**
      * Get all ledger entries for a specific transaction.
      */
@@ -735,7 +968,7 @@ class MnemoPayLite extends EventEmitter {
             name: `MnemoPay Agent (${this.agentId})`,
             description: "AI agent with persistent cognitive memory and micropayment capabilities via MnemoPay protocol.",
             url,
-            version: "0.8.0",
+            version: "0.9.1",
             capabilities: {
                 memory: true,
                 payments: true,
@@ -867,23 +1100,50 @@ class MnemoPay extends EventEmitter {
         const text = await res.text();
         return text ? JSON.parse(text) : null;
     }
+    // ── Retry logic for production API calls ─────────────────────────────────
+    async withRetry(fn, maxRetries = 2, delayMs = 500) {
+        let lastError = null;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            try {
+                return await fn();
+            }
+            catch (err) {
+                lastError = err;
+                // Don't retry client errors (4xx) — only transient failures (5xx, network)
+                if (err.message?.includes("4") && /\b4\d{2}\b/.test(err.message))
+                    throw err;
+                if (attempt < maxRetries) {
+                    await new Promise(resolve => setTimeout(resolve, delayMs * (attempt + 1)));
+                    this.log(`Retrying (${attempt + 1}/${maxRetries}): ${err.message}`);
+                }
+            }
+        }
+        throw lastError;
+    }
     // ── Memory Methods (→ Mnemosyne API) ───────────────────────────────────
     async remember(content, opts) {
-        const importance = opts?.importance ?? autoScore(content);
-        const result = await this.mnemoFetch("/v1/memories", {
+        if (!content || typeof content !== "string")
+            throw new Error("Memory content is required");
+        if (content.length > 100_000)
+            throw new Error("Memory content exceeds 100KB limit");
+        // Security: sanitize against prompt injection (same as MnemoPayLite)
+        const safeContent = sanitizeMemoryContent(content);
+        const safeTags = validateTags(opts?.tags ?? []);
+        const importance = opts?.importance ?? autoScore(safeContent);
+        const result = await this.withRetry(() => this.mnemoFetch("/v1/memories", {
             method: "POST",
             body: JSON.stringify({
-                content,
+                content: safeContent,
                 tier: "long_term",
                 metadata: {
                     memory_type: "OBSERVATION",
-                    tags: opts?.tags ?? [],
+                    tags: safeTags,
                     confidence: importance,
                 },
             }),
-        });
-        this.emit("memory:stored", { id: result.id, content, importance });
-        this.log(`Stored memory: "${content.slice(0, 60)}..." (id: ${result.id})`);
+        }));
+        this.emit("memory:stored", { id: result.id, importance });
+        this.log(`Stored memory: "${safeContent.slice(0, 60)}..." (id: ${result.id})`);
         return result.id;
     }
     async recall(queryOrLimit, maybeLimit) {
@@ -944,9 +1204,14 @@ class MnemoPay extends EventEmitter {
     }
     // ── Payment Methods (→ AgentPay API) ───────────────────────────────────
     async charge(amount, reason) {
-        if (amount <= 0)
-            throw new Error("Amount must be positive");
-        const result = await this.agentpayFetch("/api/escrow", {
+        if (!Number.isFinite(amount) || amount <= 0)
+            throw new Error("Amount must be a positive finite number");
+        amount = Math.round(amount * 100) / 100;
+        if (!reason || typeof reason !== "string")
+            throw new Error("Reason is required");
+        if (reason.length > 1000)
+            throw new Error("Reason exceeds 1000 character limit");
+        const result = await this.withRetry(() => this.agentpayFetch("/api/escrow", {
             method: "POST",
             body: JSON.stringify({
                 agentId: this.agentId,
@@ -954,7 +1219,7 @@ class MnemoPay extends EventEmitter {
                 reason,
                 currency: "USD",
             }),
-        });
+        }));
         const tx = {
             id: result.id,
             agentId: this.agentId,
@@ -968,10 +1233,12 @@ class MnemoPay extends EventEmitter {
         return tx;
     }
     async settle(txId) {
-        const result = await this.agentpayFetch(`/api/escrow/${txId}/release`, {
+        if (!txId || typeof txId !== "string")
+            throw new Error("Transaction ID is required");
+        const result = await this.withRetry(() => this.agentpayFetch(`/api/escrow/${encodeURIComponent(txId)}/release`, {
             method: "POST",
             body: JSON.stringify({}),
-        });
+        }));
         this.emit("payment:completed", { id: txId, amount: result.amount });
         this.log(`Settled: $${result.amount?.toFixed(2)}`);
         return {
@@ -985,10 +1252,12 @@ class MnemoPay extends EventEmitter {
         };
     }
     async refund(txId) {
-        const result = await this.agentpayFetch(`/api/escrow/${txId}/refund`, {
+        if (!txId || typeof txId !== "string")
+            throw new Error("Transaction ID is required");
+        const result = await this.withRetry(() => this.agentpayFetch(`/api/escrow/${encodeURIComponent(txId)}/refund`, {
             method: "POST",
             body: JSON.stringify({}),
-        });
+        }));
         this.emit("payment:refunded", { id: txId });
         this.log(`Refunded: ${txId}`);
         return {
@@ -1074,7 +1343,7 @@ class MnemoPay extends EventEmitter {
             name: `MnemoPay Agent (${this.agentId})`,
             description: "AI agent with persistent cognitive memory and micropayment capabilities via MnemoPay protocol.",
             url,
-            version: "0.8.0",
+            version: "0.9.1",
             capabilities: {
                 memory: true,
                 payments: true,
@@ -1185,8 +1454,12 @@ var ledger_js_2 = require("./ledger.js");
 Object.defineProperty(exports, "Ledger", { enumerable: true, get: function () { return ledger_js_2.Ledger; } });
 var identity_js_2 = require("./identity.js");
 Object.defineProperty(exports, "IdentityRegistry", { enumerable: true, get: function () { return identity_js_2.IdentityRegistry; } });
+Object.defineProperty(exports, "constantTimeEqual", { enumerable: true, get: function () { return identity_js_2.constantTimeEqual; } });
 var network_js_1 = require("./network.js");
 Object.defineProperty(exports, "MnemoPayNetwork", { enumerable: true, get: function () { return network_js_1.MnemoPayNetwork; } });
+var commerce_js_1 = require("./commerce.js");
+Object.defineProperty(exports, "CommerceEngine", { enumerable: true, get: function () { return commerce_js_1.CommerceEngine; } });
+Object.defineProperty(exports, "MockCommerceProvider", { enumerable: true, get: function () { return commerce_js_1.MockCommerceProvider; } });
 var server_js_1 = require("./mcp/server.js");
 Object.defineProperty(exports, "createSandboxServer", { enumerable: true, get: function () { return __importDefault(server_js_1).default; } });
 //# sourceMappingURL=index.js.map