@naulon/wayfarer 0.5.4 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -18,8 +18,8 @@ npm run -w @naulon/wayfarer start -- "payment and passage" # the agent
18
18
 
19
19
  ```text
20
20
  decisions:
21
- [PAY] the-naulon — relevance 1.00 @ $0.005; $0.095 left
22
- [SKIP] on-stillness — relevance 0.00 below floor 0.35
21
+ [PAY] the-naulon, relevance 1.00 @ $0.005; $0.095 left
22
+ [SKIP] on-stillness, relevance 0.00 below floor 0.35
23
23
  ✓ paid $0.005000 for the-naulon
24
24
  ```
25
25
 
@@ -1 +1 @@
1
- {"version":3,"file":"licence.d.ts","sourceRoot":"","sources":["../src/licence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGjD,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;2FACuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;IAC3D;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,wDAAwD;IACxD,WAAW,IAAI,MAAM,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,sBAA2B,GAAG,eAAe,CAiGtF"}
1
+ {"version":3,"file":"licence.d.ts","sourceRoot":"","sources":["../src/licence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAcjD,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;2FACuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;IAC3D;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,wDAAwD;IACxD,WAAW,IAAI,MAAM,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,sBAA2B,GAAG,eAAe,CAkGtF"}
package/dist/licence.js CHANGED
@@ -20,8 +20,18 @@
20
20
  * rather than ten. That matters twice: it is a stranger's server, and a research run that hammers a
21
21
  * publisher to ask permission has answered its own question badly.
22
22
  */
23
- import { acquireLicenseToken, locateFromObserved, locateFromRobots, termsForUrl, } from "@naulon/sdk/rsl";
23
+ import { acquireLicenseToken, tokenEndpoint, locateFromObserved, locateFromRobots, termsForUrl, } from "@naulon/sdk/rsl";
24
24
  import { licenseTokenFor, rememberLicenseToken } from "./license-token.js";
25
+ import { botAuthHeadersFor } from "./sign.js";
26
+ /**
27
+ * Our Web Bot Auth signature over the `/token` request itself, when a signing identity is
28
+ * configured. A server that verifies it can bind the token to our key and refuse it bare later.
29
+ */
30
+ function tokenSignature(server) {
31
+ const endpoint = tokenEndpoint(server);
32
+ const signed = endpoint ? botAuthHeadersFor(endpoint, { coverPath: true }) : null;
33
+ return signed ? { extraHeaders: signed } : null;
34
+ }
25
35
  const DEFAULT_TTL_MS = 10 * 60 * 1000;
26
36
  /** Nothing published — a shared frozen value, so a caller cannot mutate one lookup into another. */
27
37
  const NONE = Object.freeze({ terms: null, tokenHeld: true });
@@ -90,6 +100,7 @@ export function makeLicenceResolver(opts = {}) {
90
100
  resource: terms.read.scope,
91
101
  credentials,
92
102
  ...(opts.fetcherFor ? { fetcherFor: opts.fetcherFor } : {}),
103
+ ...(tokenSignature(terms.server) ?? {}),
93
104
  });
94
105
  if (!acquired.ok) {
95
106
  return { ...base, tokenHeld: false, tokenFailure: `the licence server answered ${acquired.failure.code}` };
@@ -1 +1 @@
1
- {"version":3,"file":"licence.js","sourceRoot":"","sources":["../src/licence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,GAMZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAsC3E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,oGAAoG;AACpG,MAAM,IAAI,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAa5E,MAAM,UAAU,mBAAmB,CAAC,OAA+B,EAAE;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,iFAAiF;IACjF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0D,CAAC;IAChF,uFAAuF;IACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAC;IAEnE,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAkC,EAAE;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,KAAK;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aAC1J,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;YACF,4FAA4F;YAC5F,yFAAyF;YACzF,8FAA8F;YAC9F,0FAA0F;YAC1F,kCAAkC;aACjC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,OAA8B,EAAE,GAAW,EAA0B,EAAE;QAC5F,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,+FAA+F;QAC/F,8FAA8F;QAC9F,qFAAqF;QACrF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG;YACX,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAEhG,+FAA+F;QAC/F,4FAA4F;QAC5F,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAChE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,4CAA4C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;YAC5B,4FAA4F;YAC5F,wDAAwD;YACxD,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,yDAAyD,EAAE,CAAC;QAChH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YAC1B,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,+BAA+B,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7G,CAAC;QACD,oBAAoB,CAAC;YACnB,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;YAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ;YACxB,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,gFAAgF;gBAChF,wFAAwF;gBACxF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,GAAG,EACH,QAAQ,EACR,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CACvD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACpB,IAAI,KAAK;oBAAE,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,MAAM,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI;KAC9B,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"licence.js","sourceRoot":"","sources":["../src/licence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,GAMZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAsCD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,oGAAoG;AACpG,MAAM,IAAI,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAa5E,MAAM,UAAU,mBAAmB,CAAC,OAA+B,EAAE;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,iFAAiF;IACjF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0D,CAAC;IAChF,uFAAuF;IACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAC;IAEnE,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAkC,EAAE;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,KAAK;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aAC1J,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;YACF,4FAA4F;YAC5F,yFAAyF;YACzF,8FAA8F;YAC9F,0FAA0F;YAC1F,kCAAkC;aACjC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,OAA8B,EAAE,GAAW,EAA0B,EAAE;QAC5F,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,+FAA+F;QAC/F,8FAA8F;QAC9F,qFAAqF;QACrF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG;YACX,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAEhG,+FAA+F;QAC/F,4FAA4F;QAC5F,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAChE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,4CAA4C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;YAC5B,4FAA4F;YAC5F,wDAAwD;YACxD,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,yDAAyD,EAAE,CAAC;QAChH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YAC1B,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,+BAA+B,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7G,CAAC;QACD,oBAAoB,CAAC;YACnB,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;YAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ;YACxB,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,gFAAgF;gBAChF,wFAAwF;gBACxF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,GAAG,EACH,QAAQ,EACR,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CACvD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACpB,IAAI,KAAK;oBAAE,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,MAAM,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI;KAC9B,CAAC;AACJ,CAAC"}
package/dist/sign.d.ts CHANGED
@@ -3,7 +3,9 @@ export declare function resetAgentIdentity(): void;
3
3
  /** The three Web Bot Auth headers for a request to `url`, or null when the
4
4
  * signing identity isn't configured. Signed per call — the ~1-minute validity
5
5
  * window means a signature is never reusable across a slow run. */
6
- export declare function botAuthHeadersFor(url: string): Record<string, string> | null;
6
+ export declare function botAuthHeadersFor(url: string, opts?: {
7
+ coverPath?: boolean;
8
+ }): Record<string, string> | null;
7
9
  /**
8
10
  * fetch with the wayfarer's Web Bot Auth identity attached (when configured).
9
11
  * Caller headers win on collision — not that anything else sets these — and an
@@ -1 +1 @@
1
- {"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAiCA,+EAA+E;AAC/E,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;oEAEoE;AACpE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAK5E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAanF"}
1
+ {"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAiCA,+EAA+E;AAC/E,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;oEAEoE;AACpE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAWhH;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAcnF"}
package/dist/sign.js CHANGED
@@ -31,12 +31,18 @@ export function resetAgentIdentity() {
31
31
  /** The three Web Bot Auth headers for a request to `url`, or null when the
32
32
  * signing identity isn't configured. Signed per call — the ~1-minute validity
33
33
  * window means a signature is never reusable across a slow run. */
34
- export function botAuthHeadersFor(url) {
34
+ export function botAuthHeadersFor(url, opts = {}) {
35
35
  const id = resolveIdentity();
36
36
  if (!id)
37
37
  return null;
38
- const authority = new URL(url).host;
39
- return { ...signBotAuth({ key: id.key, authority, tag: "web-bot-auth", agent: id.agent }) };
38
+ const u = new URL(url);
39
+ // Covering the path makes the signature a witness of THIS request: it cannot be lifted onto
40
+ // another URL of the same host. Required whenever the signature is what a charge rests on.
41
+ // `@path` is the path alone (RFC 9421), which is how the verifier rebuilds it.
42
+ const path = opts.coverPath ? u.pathname : undefined;
43
+ return {
44
+ ...signBotAuth({ key: id.key, authority: u.host, tag: "web-bot-auth", agent: id.agent, ...(path !== undefined ? { path } : {}) }),
45
+ };
40
46
  }
41
47
  /**
42
48
  * fetch with the wayfarer's Web Bot Auth identity attached (when configured).
@@ -44,7 +50,6 @@ export function botAuthHeadersFor(url) {
44
50
  * unconfigured agent falls through to the exact fetch it always made.
45
51
  */
46
52
  export async function agentFetch(url, init) {
47
- const signed = botAuthHeadersFor(url);
48
53
  // An OLP licence token, if we hold one for this URL. Attached HERE because every request the
49
54
  // agent makes passes through this function, and four separate places in buyer.ts build headers of
50
55
  // their own — a token remembered at each is a token forgotten at one. A caller that set its own
@@ -53,6 +58,8 @@ export async function agentFetch(url, init) {
53
58
  const caller = init?.headers ?? {};
54
59
  const hasOwnAuth = Object.keys(caller).some((k) => k.toLowerCase() === "authorization");
55
60
  const license = licenseToken && !hasOwnAuth ? { authorization: `License ${licenseToken}` } : {};
61
+ // A licence read can be charged on the strength of this signature, so it covers the path too.
62
+ const signed = botAuthHeadersFor(url, { coverPath: Boolean(licenseToken && !hasOwnAuth) });
56
63
  if (!signed && !licenseToken)
57
64
  return fetch(url, init);
58
65
  const headers = { ...signed, ...license, ...caller };
package/dist/sign.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAOrD;uCACuC;AACvC,IAAI,QAA0C,CAAC;AAE/C,SAAS,eAAe;IACtB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,QAAQ;QACN,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,wBAAwB;YACtD,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,wBAAwB,EAAE;YAC5F,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB;IAChC,QAAQ,GAAG,SAAS,CAAC;AACvB,CAAC;AAED;;oEAEoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO,EAAE,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAkB;IAC9D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,6FAA6F;IAC7F,kGAAkG;IAClG,gGAAgG;IAChG,sDAAsD;IACtD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAI,IAAI,EAAE,OAA8C,IAAI,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC"}
1
+ {"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAOrD;uCACuC;AACvC,IAAI,QAA0C,CAAC;AAE/C,SAAS,eAAe;IACtB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,QAAQ;QACN,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,wBAAwB;YACtD,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,wBAAwB,EAAE;YAC5F,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB;IAChC,QAAQ,GAAG,SAAS,CAAC;AACvB,CAAC;AAED;;oEAEoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAgC,EAAE;IAC/E,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,4FAA4F;IAC5F,2FAA2F;IAC3F,+EAA+E;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,OAAO;QACL,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAClI,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAkB;IAC9D,6FAA6F;IAC7F,kGAAkG;IAClG,gGAAgG;IAChG,sDAAsD;IACtD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAI,IAAI,EAAE,OAA8C,IAAI,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,8FAA8F;IAC9F,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@naulon/wayfarer",
3
- "version": "0.5.4",
3
+ "version": "0.6.0",
4
4
  "description": "The naulon paying agent: discover → quote → appraise → decide → pay → ground. Budgeted x402 buying over Circle Gateway on Arc, with reusable Citation Licenses (pay once, re-read free).",
5
5
  "keywords": [
6
6
  "x402",
@@ -45,7 +45,7 @@
45
45
  "@circle-fin/x402-batching": "^3.5.0",
46
46
  "@langchain/core": "^1.2.9",
47
47
  "@langchain/openai": "^1.5.10",
48
- "@naulon/shared": "^0.5.4",
48
+ "@naulon/shared": "^0.6.0",
49
49
  "@x402/core": "^2.23.0",
50
50
  "@x402/evm": "^2.23.0",
51
51
  "viem": "^2.56.0"