@myzonerocks/pact 0.1.0

package/dist/src/fake.js

@@ -0,0 +1,79 @@
+import { State } from "./state.js";
+import { RefundKind } from "./adapter.js";
+// FakeLeg is a deterministic, in-memory pay-in and pay-out leg. It settles
+// instantly with no network and implements both sides so a test can build a
+// direct corridor from one leg or a bridged corridor from two. failPayout makes
+// its disburse fail so a test can exercise the escrow-unwind path.
+export class FakeLeg {
+    id;
+    rail;
+    currency;
+    ids;
+    failPayout = false;
+    constructor(id, rail, currency, ids) {
+        this.id = id;
+        this.rail = rail;
+        this.currency = currency;
+        this.ids = ids;
+    }
+    payInCapabilities() {
+        return { rails: [this.rail], currencies: [this.currency], refunds: RefundKind.Full };
+    }
+    // collect takes the payer's funds. received is the net the bridge converts —
+    // the source the payer paid less the corridor fees.
+    async collect(_intentId, quote, _auth, _deliverTo) {
+        return { providerRef: this.ids(), received: quote.srcAmount.sub(quote.fees) };
+    }
+    async refundIn(intentId, _kind, reason) {
+        return this.terminal(intentId, reason);
+    }
+    payOutCapabilities() {
+        return { rails: [this.rail], currencies: [this.currency], reversible: false };
+    }
+    async disburse(_intentId, _quote, _recipientRef) {
+        if (this.failPayout) {
+            throw new Error("fake: payout failed");
+        }
+        return { providerRef: this.ids() };
+    }
+    async reverseOut(intentId, reason) {
+        return this.terminal(intentId, reason);
+    }
+    terminal(intentId, reason) {
+        return {
+            intentId,
+            state: State.Refunded,
+            adapterId: this.id,
+            providerTxRef: this.ids(),
+            onchainTxHash: "",
+            receiptHash: new Uint8Array(0),
+            reason,
+            settledAt: 0,
+        };
+    }
+}
+// FakeRates is an in-memory rate source keyed by "FROM:TO", standing in for a
+// price feed so a bridge can be tested without a live market.
+export class FakeRates {
+    table;
+    constructor(table) {
+        this.table = table;
+    }
+    async rate(from, to) {
+        const rate = this.table[`${from}:${to}`];
+        if (rate === undefined) {
+            throw new Error(`fake: no rate for ${from}:${to}`);
+        }
+        return rate;
+    }
+}
+// FakeVault is an in-memory escrow that records holds and releases, standing in
+// for the custody a real bridge relies on.
+export class FakeVault {
+    async hold(intentId, _amount) {
+        return `escrow-${intentId}`;
+    }
+    async release(_intentId) {
+        // Nothing to release in memory.
+    }
+}

package/dist/src/index.d.ts

@@ -0,0 +1,16 @@
+export { ID, VERSION, domain, DEFAULT_SKEW_MILLIS } from "./protocol.js";
+export { Money } from "./money.js";
+export { State, stateName, canTransition, isTerminal, TransitionError } from "./state.js";
+export { CanonicalWriter, hashPreimage } from "./canonical.js";
+export { type Intent, type Quote, type Authorization, type Settlement, BRIDGE_PASSTHROUGH, intentPreimage, intentHash, quotePreimage, quoteHash, isDirect, signingPreimage, authorizationHash, receiptHash, corridorReceipt, } from "./message.js";
+export { type Signer, type Verifier, authorize, verifyAuthorization, Ed25519Signer, Ed25519Verifier, BadSignatureError, } from "./signing.js";
+export { RefundKind, type AdapterEvent, type WebhookParser } from "./adapter.js";
+export { railInList, type PayInLeg, type PayOutLeg, type PayInCapabilities, type PayOutCapabilities, type CollectResult, type DisburseResult, } from "./leg.js";
+export { BRIDGE_USDC, PassThroughBridge, UsdcBridge, applyRate, applyInverseRate, parseRate, type Bridge, type BridgeQuote, type ConvertResult, type RateSource, type EscrowVault, } from "./bridge.js";
+export { type KycProvider, type KycStatus, type KycLimits, type RiskHook, type RiskDecision, permissiveKyc, allowRisk, withinLimits, } from "./compliance.js";
+export { PolicyKind, type Policy, route, isExpired, NoQuoteError } from "./router.js";
+export { MemoryLedger, eventReceipt, chainLeaf, IdempotencyConflictError, type Ledger, type LedgerEvent, type Transition, } from "./ledger.js";
+export { Client, type ClientConfig, type IntentSpec, type Funding, type Clock, type IdGen, systemClock, randomId, recipientDestination, } from "./client.js";
+export { FakeLeg, FakeRates, FakeVault } from "./fake.js";
+export { WireKind, type WireMessage, encodeIntent, encodeQuote, encodeAuthorization, encodeSettlement, encodeMessage, decodeMessage, decodeIntent, decodeQuote, decodeAuthorization, decodeSettlement, } from "./wire.js";
+export { PAYLOAD_VERSION, encodePayload, decodePayload, isPayload, NotPayloadError, UnsupportedPayloadVersionError, } from "./payload.js";

package/dist/src/index.js

@@ -0,0 +1,16 @@
+export { ID, VERSION, domain, DEFAULT_SKEW_MILLIS } from "./protocol.js";
+export { Money } from "./money.js";
+export { State, stateName, canTransition, isTerminal, TransitionError } from "./state.js";
+export { CanonicalWriter, hashPreimage } from "./canonical.js";
+export { BRIDGE_PASSTHROUGH, intentPreimage, intentHash, quotePreimage, quoteHash, isDirect, signingPreimage, authorizationHash, receiptHash, corridorReceipt, } from "./message.js";
+export { authorize, verifyAuthorization, Ed25519Signer, Ed25519Verifier, BadSignatureError, } from "./signing.js";
+export { RefundKind } from "./adapter.js";
+export { railInList, } from "./leg.js";
+export { BRIDGE_USDC, PassThroughBridge, UsdcBridge, applyRate, applyInverseRate, parseRate, } from "./bridge.js";
+export { permissiveKyc, allowRisk, withinLimits, } from "./compliance.js";
+export { PolicyKind, route, isExpired, NoQuoteError } from "./router.js";
+export { MemoryLedger, eventReceipt, chainLeaf, IdempotencyConflictError, } from "./ledger.js";
+export { Client, systemClock, randomId, recipientDestination, } from "./client.js";
+export { FakeLeg, FakeRates, FakeVault } from "./fake.js";
+export { WireKind, encodeIntent, encodeQuote, encodeAuthorization, encodeSettlement, encodeMessage, decodeMessage, decodeIntent, decodeQuote, decodeAuthorization, decodeSettlement, } from "./wire.js";
+export { PAYLOAD_VERSION, encodePayload, decodePayload, isPayload, NotPayloadError, UnsupportedPayloadVersionError, } from "./payload.js";

package/dist/src/ledger.d.ts

@@ -0,0 +1,47 @@
+import { State } from "./state.js";
+import type { Intent, Quote, Authorization, Settlement } from "./message.js";
+import type { CollectResult } from "./leg.js";
+import type { ConvertResult } from "./bridge.js";
+export interface LedgerEvent {
+    seq: number;
+    intentId: string;
+    state: State;
+    payloadHash: Uint8Array;
+    receipt: Uint8Array;
+    leaf: Uint8Array;
+    intent?: Intent;
+    quote?: Quote;
+    authorization?: Authorization;
+    settlement?: Settlement;
+    collect?: CollectResult;
+    bridge?: ConvertResult;
+}
+export interface Transition {
+    intentId: string;
+    to: State;
+    payloadHash: Uint8Array;
+    intent?: Intent;
+    quote?: Quote;
+    authorization?: Authorization;
+    settlement?: Settlement;
+    collect?: CollectResult;
+    bridge?: ConvertResult;
+}
+export declare class IdempotencyConflictError extends Error {
+    constructor();
+}
+export interface Ledger {
+    apply(t: Transition): LedgerEvent;
+    state(intentId: string): State;
+    events(intentId: string): LedgerEvent[];
+    head(intentId: string): Uint8Array | undefined;
+}
+export declare class MemoryLedger implements Ledger {
+    private readonly byIntent;
+    apply(t: Transition): LedgerEvent;
+    state(intentId: string): State;
+    events(intentId: string): LedgerEvent[];
+    head(intentId: string): Uint8Array | undefined;
+}
+export declare function eventReceipt(seq: number, intentId: string, state: State, payloadHash: Uint8Array): Uint8Array;
+export declare function chainLeaf(prevLeaf: Uint8Array, receipt: Uint8Array): Uint8Array;

package/dist/src/ledger.js

@@ -0,0 +1,84 @@
+import { State, stateName, canTransition, TransitionError } from "./state.js";
+import { CanonicalWriter, hashPreimage } from "./canonical.js";
+import { domain } from "./protocol.js";
+import { bytesEqual } from "./crypto.js";
+export class IdempotencyConflictError extends Error {
+    constructor() {
+        super("pact: idempotency conflict: step already recorded with a different payload");
+        this.name = "IdempotencyConflictError";
+    }
+}
+const zeroLeaf = new Uint8Array(32);
+// MemoryLedger is the in-memory reference ledger.
+export class MemoryLedger {
+    byIntent = new Map();
+    apply(t) {
+        const history = this.byIntent.get(t.intentId) ?? [];
+        // A repeat of the same step is a no-op returning the first result; the same
+        // step with a different payload is a conflict.
+        for (const e of history) {
+            if (e.state === t.to) {
+                if (bytesEqual(e.payloadHash, t.payloadHash))
+                    return e;
+                throw new IdempotencyConflictError();
+            }
+        }
+        const current = history.length > 0 ? history[history.length - 1].state : State.Unspecified;
+        if (!canTransition(current, t.to)) {
+            throw new TransitionError(current, t.to);
+        }
+        const prevLeaf = history.length > 0 ? history[history.length - 1].leaf : zeroLeaf;
+        const seq = history.length + 1;
+        const receipt = eventReceipt(seq, t.intentId, t.to, t.payloadHash);
+        const leaf = chainLeaf(prevLeaf, receipt);
+        const event = {
+            seq,
+            intentId: t.intentId,
+            state: t.to,
+            payloadHash: t.payloadHash.slice(),
+            receipt,
+            leaf,
+            ...(t.intent ? { intent: t.intent } : {}),
+            ...(t.quote ? { quote: t.quote } : {}),
+            ...(t.authorization ? { authorization: t.authorization } : {}),
+            ...(t.settlement ? { settlement: t.settlement } : {}),
+            ...(t.collect ? { collect: t.collect } : {}),
+            ...(t.bridge ? { bridge: t.bridge } : {}),
+        };
+        this.byIntent.set(t.intentId, [...history, event]);
+        return event;
+    }
+    state(intentId) {
+        const history = this.byIntent.get(intentId);
+        if (!history || history.length === 0)
+            return State.Unspecified;
+        return history[history.length - 1].state;
+    }
+    events(intentId) {
+        return [...(this.byIntent.get(intentId) ?? [])];
+    }
+    head(intentId) {
+        const history = this.byIntent.get(intentId);
+        if (!history || history.length === 0)
+            return undefined;
+        return history[history.length - 1].leaf;
+    }
+}
+// eventReceipt commits to an event's identity independent of the Merkle chaining,
+// so a single event can be shown and checked on its own.
+export function eventReceipt(seq, intentId, state, payloadHash) {
+    return hashPreimage(new CanonicalWriter()
+        .str(domain("event"))
+        .u64(seq)
+        .str(intentId)
+        .str(stateName[state])
+        .bytes(payloadHash)
+        .preimage());
+}
+// chainLeaf folds one event's receipt into the running Merkle head.
+export function chainLeaf(prevLeaf, receipt) {
+    const joined = new Uint8Array(prevLeaf.length + receipt.length);
+    joined.set(prevLeaf, 0);
+    joined.set(receipt, prevLeaf.length);
+    return hashPreimage(joined);
+}

package/dist/src/leg.d.ts

@@ -0,0 +1,34 @@
+import type { Money } from "./money.js";
+import type { Quote, Authorization, Settlement } from "./message.js";
+import type { RefundKind } from "./adapter.js";
+export interface PayInCapabilities {
+    rails: string[];
+    currencies: string[];
+    methods?: string[];
+    refunds: RefundKind;
+}
+export interface CollectResult {
+    providerRef: string;
+    received: Money;
+}
+export interface PayInLeg {
+    id: string;
+    payInCapabilities(): PayInCapabilities;
+    collect(intentId: string, quote: Quote, auth: Authorization, deliverTo: string): Promise<CollectResult>;
+    refundIn(intentId: string, kind: RefundKind, reason: string): Promise<Settlement>;
+}
+export interface PayOutCapabilities {
+    rails: string[];
+    currencies: string[];
+    reversible: boolean;
+}
+export interface DisburseResult {
+    providerRef: string;
+}
+export interface PayOutLeg {
+    id: string;
+    payOutCapabilities(): PayOutCapabilities;
+    disburse(intentId: string, quote: Quote, recipientRef: string): Promise<DisburseResult>;
+    reverseOut(intentId: string, reason: string): Promise<Settlement>;
+}
+export declare function railInList(rails: string[], rail: string): boolean;

package/dist/src/leg.js

@@ -0,0 +1,4 @@
+// railInList reports whether a set of rails contains the requested rail.
+export function railInList(rails, rail) {
+    return rails.includes(rail);
+}

package/dist/src/message.d.ts

@@ -0,0 +1,55 @@
+import { Money } from "./money.js";
+import { State } from "./state.js";
+export interface Intent {
+    id: string;
+    senderRef: string;
+    recipientRef: string;
+    amount: Money;
+    memo: string;
+    expiresAt: number;
+    allowedRails: string[];
+    metadata: Record<string, string>;
+}
+export declare function intentPreimage(i: Intent): Uint8Array;
+export declare function intentHash(i: Intent): Uint8Array;
+export declare const BRIDGE_PASSTHROUGH = "passthrough";
+export interface Quote {
+    id: string;
+    intentId: string;
+    payInAdapterId: string;
+    payInRail: string;
+    payOutAdapterId: string;
+    payOutRail: string;
+    bridgeId: string;
+    srcAmount: Money;
+    dstAmount: Money;
+    fees: Money;
+    fxRate: string;
+    expiresAt: number;
+    providerQuoteRef: string;
+    latencyEstimateMs: number;
+}
+export declare function quotePreimage(q: Quote): Uint8Array;
+export declare function quoteHash(q: Quote): Uint8Array;
+export declare function isDirect(q: Quote): boolean;
+export interface Authorization {
+    intentId: string;
+    quoteId: string;
+    signerIdentity: string;
+    signedAt: number;
+    signature: Uint8Array;
+}
+export declare function signingPreimage(intentHashBytes: Uint8Array, quoteHashBytes: Uint8Array, signerIdentity: string, signedAt: number): Uint8Array;
+export declare function authorizationHash(intentHashBytes: Uint8Array, quoteHashBytes: Uint8Array, signerIdentity: string, signedAt: number): Uint8Array;
+export interface Settlement {
+    intentId: string;
+    state: State;
+    adapterId: string;
+    providerTxRef: string;
+    onchainTxHash: string;
+    receiptHash: Uint8Array;
+    reason: string;
+    settledAt: number;
+}
+export declare function receiptHash(authHash: Uint8Array, providerTxRef: string, state: State): Uint8Array;
+export declare function corridorReceipt(authHash: Uint8Array, payInProviderRef: string, payOutProviderRef: string, fxRate: string, bridgeReceiptRef: string, state: State): Uint8Array;

package/dist/src/message.js

@@ -0,0 +1,88 @@
+import { stateName } from "./state.js";
+import { CanonicalWriter, hashPreimage } from "./canonical.js";
+import { domain } from "./protocol.js";
+export function intentPreimage(i) {
+    return new CanonicalWriter()
+        .str(domain("intent"))
+        .str(i.id)
+        .str(i.senderRef)
+        .str(i.recipientRef)
+        .money(i.amount)
+        .str(i.memo)
+        .u64(i.expiresAt)
+        .list(i.allowedRails)
+        .stringMap(i.metadata)
+        .preimage();
+}
+export function intentHash(i) {
+    return hashPreimage(intentPreimage(i));
+}
+// The bridge that moves value unchanged when the payer and recipient already
+// share a currency. Its identifier is a stable wire value carried in a quote.
+export const BRIDGE_PASSTHROUGH = "passthrough";
+export function quotePreimage(q) {
+    return new CanonicalWriter()
+        .str(domain("quote"))
+        .str(q.id)
+        .str(q.intentId)
+        .str(q.payInAdapterId)
+        .str(q.payInRail)
+        .str(q.payOutAdapterId)
+        .str(q.payOutRail)
+        .str(q.bridgeId)
+        .money(q.srcAmount)
+        .money(q.dstAmount)
+        .money(q.fees)
+        .str(q.fxRate)
+        .u64(q.expiresAt)
+        .str(q.providerQuoteRef)
+        .u64(q.latencyEstimateMs)
+        .preimage();
+}
+export function quoteHash(q) {
+    return hashPreimage(quotePreimage(q));
+}
+// isDirect reports whether a corridor settles in one phase: the same provider
+// serves both legs and the bridge is pass-through.
+export function isDirect(q) {
+    return q.payInAdapterId === q.payOutAdapterId && q.bridgeId === BRIDGE_PASSTHROUGH;
+}
+// signingPreimage returns the bytes an authorization signs over.
+export function signingPreimage(intentHashBytes, quoteHashBytes, signerIdentity, signedAt) {
+    return new CanonicalWriter()
+        .str(domain("authorize"))
+        .bytes(intentHashBytes)
+        .bytes(quoteHashBytes)
+        .str(signerIdentity)
+        .u64(signedAt)
+        .preimage();
+}
+export function authorizationHash(intentHashBytes, quoteHashBytes, signerIdentity, signedAt) {
+    return hashPreimage(signingPreimage(intentHashBytes, quoteHashBytes, signerIdentity, signedAt));
+}
+// receiptHash derives a settlement's receipt commitment from the authorization
+// hash it settles, the provider's transaction reference, and the resulting
+// state. Revealing it plus a ledger inclusion proof lets a recipient prove a
+// settlement without exposing any surrounding conversation.
+export function receiptHash(authHash, providerTxRef, state) {
+    return hashPreimage(new CanonicalWriter()
+        .str(domain("receipt"))
+        .bytes(authHash)
+        .str(providerTxRef)
+        .str(stateName[state])
+        .preimage());
+}
+// corridorReceipt binds both legs of a bridged corridor and the FX rate into one
+// commitment, so the payer can prove they funded X and the recipient can prove
+// they received Y as a single transaction, without revealing anything else.
+export function corridorReceipt(authHash, payInProviderRef, payOutProviderRef, fxRate, bridgeReceiptRef, state) {
+    return hashPreimage(new CanonicalWriter()
+        .str(domain("corridor"))
+        .bytes(authHash)
+        .str(payInProviderRef)
+        .str(payOutProviderRef)
+        .str(fxRate)
+        .str(bridgeReceiptRef)
+        .str(stateName[state])
+        .preimage());
+}

package/dist/src/money.d.ts

@@ -0,0 +1,16 @@
+export declare class Money {
+    readonly currency: string;
+    readonly exponent: number;
+    private readonly amount;
+    private constructor();
+    static create(currency: string, exponent: number, amount: bigint): Money;
+    static parse(currency: string, exponent: number, minor: string): Money;
+    minor(): string;
+    value(): bigint;
+    private sameKind;
+    add(other: Money): Money;
+    sub(other: Money): Money;
+    cmp(other: Money): number;
+    isZero(): boolean;
+    toString(): string;
+}

package/dist/src/money.js

@@ -0,0 +1,81 @@
+// Money is an exact count of minor units in a single currency. The amount is a
+// bigint, never a number: an 18-decimal token counted in its smallest unit
+// overflows a 64-bit integer at roughly nine whole tokens, and floating point
+// has no place near money.
+const currencyPattern = /^[A-Z0-9]{1,16}$/;
+const maxExponent = 30;
+export class Money {
+    currency;
+    exponent;
+    amount;
+    constructor(currency, exponent, amount) {
+        this.currency = currency;
+        this.exponent = exponent;
+        this.amount = amount;
+    }
+    static create(currency, exponent, amount) {
+        if (!currencyPattern.test(currency)) {
+            throw new Error("pact: currency must match [A-Z0-9]{1,16}");
+        }
+        if (!Number.isInteger(exponent) || exponent < 0 || exponent > maxExponent) {
+            throw new Error(`pact: exponent must be 0..${maxExponent}`);
+        }
+        if (amount < 0n) {
+            throw new Error("pact: amount must be non-negative");
+        }
+        return new Money(currency, exponent, amount);
+    }
+    // parse builds Money from a decimal-ASCII minor-unit string, the form used on
+    // the wire.
+    static parse(currency, exponent, minor) {
+        if (!/^\d+$/.test(minor)) {
+            throw new Error(`pact: ${minor} is not a base-10 integer`);
+        }
+        return Money.create(currency, exponent, BigInt(minor));
+    }
+    // minor renders the amount as canonical decimal ASCII: no leading zeros, "0"
+    // for zero. This is the exact string the canonical writer and the wire use.
+    minor() {
+        return this.amount.toString();
+    }
+    value() {
+        return this.amount;
+    }
+    sameKind(other) {
+        return this.currency === other.currency && this.exponent === other.exponent;
+    }
+    add(other) {
+        if (!this.sameKind(other)) {
+            throw new Error("pact: money operands differ in currency or exponent");
+        }
+        return new Money(this.currency, this.exponent, this.amount + other.amount);
+    }
+    // sub errors when the result would be negative: Money has no negative range,
+    // and a refund is a settlement, not a negative sum.
+    sub(other) {
+        if (!this.sameKind(other)) {
+            throw new Error("pact: money operands differ in currency or exponent");
+        }
+        const diff = this.amount - other.amount;
+        if (diff < 0n) {
+            throw new Error("pact: amount must be non-negative");
+        }
+        return new Money(this.currency, this.exponent, diff);
+    }
+    cmp(other) {
+        if (!this.sameKind(other)) {
+            throw new Error("pact: money operands differ in currency or exponent");
+        }
+        if (this.amount < other.amount)
+            return -1;
+        if (this.amount > other.amount)
+            return 1;
+        return 0;
+    }
+    isZero() {
+        return this.amount === 0n;
+    }
+    toString() {
+        return `${this.minor()} ${this.currency}/${this.exponent}`;
+    }
+}

package/dist/src/payload.d.ts

@@ -0,0 +1,11 @@
+import { type WireMessage } from "./wire.js";
+export declare const PAYLOAD_VERSION = 1;
+export declare class NotPayloadError extends Error {
+    constructor();
+}
+export declare class UnsupportedPayloadVersionError extends Error {
+    constructor(version: number);
+}
+export declare function encodePayload(msg: WireMessage): Uint8Array;
+export declare function isPayload(bytes: Uint8Array): boolean;
+export declare function decodePayload(bytes: Uint8Array): WireMessage;

package/dist/src/payload.js

@@ -0,0 +1,52 @@
+import { ID } from "./protocol.js";
+import { encodeMessage, decodeMessage } from "./wire.js";
+// A payload is how a payment message rides inside a host's own envelope — a chat
+// message, a queue entry, any transport. It wraps a wire frame with a small
+// self-identifying header so a receiver can tell a PACT payload apart from other
+// envelope content and reject a version it does not understand. The host carries
+// opaque bytes and stays oblivious to the message inside.
+const payloadMagic = new TextEncoder().encode(ID);
+// PAYLOAD_VERSION is the framing version, independent of the wire version, so the
+// envelope format can evolve without breaking a decoder.
+export const PAYLOAD_VERSION = 1;
+export class NotPayloadError extends Error {
+    constructor() {
+        super("pact: not a pact payload");
+        this.name = "NotPayloadError";
+    }
+}
+export class UnsupportedPayloadVersionError extends Error {
+    constructor(version) {
+        super(`pact: unsupported payload version ${version}`);
+        this.name = "UnsupportedPayloadVersionError";
+    }
+}
+export function encodePayload(msg) {
+    const frame = encodeMessage(msg);
+    const out = new Uint8Array(payloadMagic.length + 1 + frame.length);
+    out.set(payloadMagic, 0);
+    out[payloadMagic.length] = PAYLOAD_VERSION;
+    out.set(frame, payloadMagic.length + 1);
+    return out;
+}
+// isPayload reports whether bytes carry the PACT payload header, so an envelope
+// decoder can route them to decodePayload without attempting a full parse.
+export function isPayload(bytes) {
+    if (bytes.length <= payloadMagic.length)
+        return false;
+    for (let i = 0; i < payloadMagic.length; i++) {
+        if (bytes[i] !== payloadMagic[i])
+            return false;
+    }
+    return true;
+}
+export function decodePayload(bytes) {
+    if (!isPayload(bytes)) {
+        throw new NotPayloadError();
+    }
+    const version = bytes[payloadMagic.length];
+    if (version !== PAYLOAD_VERSION) {
+        throw new UnsupportedPayloadVersionError(version);
+    }
+    return decodeMessage(bytes.subarray(payloadMagic.length + 1));
+}

package/dist/src/policy.d.ts

@@ -0,0 +1,26 @@
+import { Money } from "./money.js";
+import type { Intent, Quote } from "./message.js";
+import type { KycProvider, KycStatus, RiskHook, RiskDecision } from "./compliance.js";
+export interface Tier {
+    name: string;
+    jurisdiction: string;
+    perPayment?: Money;
+    windowSpend?: Money;
+    allowedRails?: string[];
+}
+export declare class TieredKyc implements KycProvider {
+    private readonly assigned;
+    private readonly fallback;
+    private readonly tiers;
+    constructor(tiers: Tier[], assigned: Record<string, string>, fallback: Tier);
+    tierFor(identity: string): Tier;
+    status(identity: string): Promise<KycStatus>;
+}
+export declare class WindowRisk implements RiskHook {
+    private readonly kyc;
+    private readonly windowMillis;
+    private readonly now;
+    private readonly spend;
+    constructor(kyc: TieredKyc, windowMillis: number, now: () => number);
+    evaluate(identity: string, _intent: Intent, quote: Quote): RiskDecision;
+}