@odingard/guardian-x402 0.0.0-stage → 0.1.1

package/dist/chunk-DJIAG2IA.js

@@ -0,0 +1,58 @@
+// src/context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var requestStorage = new AsyncLocalStorage();
+var flowStorage = new AsyncLocalStorage();
+
+// src/version.ts
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+var TESTED_X402_MAJOR = 2;
+var TESTED_X402_MINOR = 30;
+var TESTED_X402_RANGE = "~2.30.0";
+var require2 = createRequire(import.meta.url);
+var checked = /* @__PURE__ */ new Map();
+function installedVersion(name) {
+  let dir;
+  try {
+    dir = dirname(require2.resolve(name));
+  } catch {
+    return null;
+  }
+  for (let i = 0; i < 8; i += 1) {
+    try {
+      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      if (pkg.name === name && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function isSupportedX402Version(version) {
+  const parts = typeof version === "string" ? version.match(/^(\d+)\.(\d+)\.(\d+)$/) : null;
+  if (!parts) return false;
+  return Number(parts[1]) === TESTED_X402_MAJOR && Number(parts[2]) === TESTED_X402_MINOR;
+}
+function assertSupportedX402(name, readVersion = installedVersion) {
+  const cached = checked.get(name);
+  if (cached && readVersion === installedVersion) return cached;
+  const version = readVersion(name);
+  if (!isSupportedX402Version(version)) {
+    throw new Error(
+      `guardian-x402 supports ${name} ${TESTED_X402_RANGE}; found ${version ?? "none"}.`
+    );
+  }
+  if (readVersion === installedVersion) checked.set(name, version);
+  return version;
+}
+
+export {
+  requestStorage,
+  flowStorage,
+  assertSupportedX402
+};

package/dist/fetch.js

@@ -0,0 +1,62 @@
+import {
+  assertSupportedX402,
+  requestStorage
+} from "./chunk-DJIAG2IA.js";
+
+// src/fetch.ts
+import { randomBytes } from "node:crypto";
+import { decodePaymentResponseHeader } from "@x402/core/http";
+import { wrapFetchWithPayment } from "@x402/fetch";
+function readSettle(headers) {
+  const raw = headers.get("X-PAYMENT-RESPONSE");
+  if (!raw) return null;
+  try {
+    return decodePaymentResponseHeader(raw);
+  } catch {
+    return null;
+  }
+}
+function guardedFetch(guard, fetchImpl = globalThis.fetch) {
+  assertSupportedX402("@x402/fetch");
+  const paying = wrapFetchWithPayment(fetchImpl, guard.httpClient());
+  const guarded = async (input, init) => {
+    const isRequest = typeof Request !== "undefined" && input instanceof Request;
+    let originalUrl = "";
+    try {
+      originalUrl = isRequest ? input.url : new URL(String(input)).href;
+    } catch {
+      originalUrl = "";
+    }
+    const method = (init?.method ?? (isRequest ? input.method : "GET")).toUpperCase();
+    const ctx = {
+      id: `x4r_${randomBytes(8).toString("hex")}`,
+      info: {
+        transport: "http",
+        method,
+        originalUrl,
+        finalUrl: null
+      },
+      signedEntries: [],
+      versions: /* @__PURE__ */ new Map()
+    };
+    return requestStorage.run(ctx, async () => {
+      let response;
+      try {
+        response = await paying(input, init);
+      } catch (error) {
+        if (error instanceof Error && error.message === "Payment already attempted") {
+          await guard.markSignedNotSent(ctx);
+        }
+        throw error;
+      }
+      if (ctx.signedEntries.some((id) => ctx.versions.get(id) === 1)) {
+        await guard.recordV1Settlement(ctx, readSettle(response.headers));
+      }
+      return response;
+    });
+  };
+  return guarded;
+}
+export {
+  guardedFetch
+};

package/dist/index.js

@@ -0,0 +1,57 @@
+import {
+  BASE_MAINNET,
+  BASE_SEPOLIA,
+  EIP3009_TYPES,
+  GuardedX402Client,
+  PAY_ABOVE_CAP_TOOL,
+  PAY_TOOL,
+  PINNED_ASSETS,
+  X402Guard,
+  X402GuardRefused,
+  createX402Guard,
+  readTerms
+} from "./chunk-C2QTXTL6.js";
+import "./chunk-DJIAG2IA.js";
+
+// src/index.ts
+var AUTHORIZATION_STATE_ABI = [
+  {
+    type: "function",
+    name: "authorizationState",
+    stateMutability: "view",
+    inputs: [
+      { name: "authorizer", type: "address" },
+      { name: "nonce", type: "bytes32" }
+    ],
+    outputs: [{ name: "", type: "bool" }]
+  }
+];
+function authorizationStateReader(readContractFor) {
+  return async ({ network, asset, from, nonce }) => {
+    const read = readContractFor(network);
+    if (!read) throw new Error(`no reader for ${network}`);
+    const used = await read({
+      address: asset,
+      abi: AUTHORIZATION_STATE_ABI,
+      functionName: "authorizationState",
+      args: [from, nonce]
+    });
+    if (typeof used !== "boolean") throw new Error("authorizationState is not a boolean");
+    return used;
+  };
+}
+export {
+  AUTHORIZATION_STATE_ABI,
+  BASE_MAINNET,
+  BASE_SEPOLIA,
+  EIP3009_TYPES,
+  GuardedX402Client,
+  PAY_ABOVE_CAP_TOOL,
+  PAY_TOOL,
+  PINNED_ASSETS,
+  X402Guard,
+  X402GuardRefused,
+  authorizationStateReader,
+  createX402Guard,
+  readTerms
+};

package/dist/mcp.js

@@ -0,0 +1,60 @@
+import {
+  GuardedX402Client,
+  X402GuardRefused
+} from "./chunk-C2QTXTL6.js";
+import {
+  assertSupportedX402,
+  requestStorage
+} from "./chunk-DJIAG2IA.js";
+
+// src/mcp.ts
+import { randomBytes } from "node:crypto";
+import { x402MCPClient } from "@x402/mcp";
+var GuardedX402MCPClient = class extends x402MCPClient {
+  serverUrl;
+  constructor(guard, mcpClient, options = {}) {
+    const paymentClient = guard.client;
+    super(mcpClient, paymentClient, {
+      autoPayment: true,
+      // A local check only: never approves anything by itself and never
+      // asks Guardian. The decision is the core hook's.
+      onPaymentRequested: () => paymentClient instanceof GuardedX402Client && paymentClient.guard === guard,
+      ...options.maxRequestTimeoutSeconds !== void 0 ? { maxRequestTimeoutSeconds: options.maxRequestTimeoutSeconds } : {}
+    });
+    this.serverUrl = options.serverUrl ?? null;
+  }
+  /**
+   * Refused: an `onPaymentRequired` hook can hand x402 a ready-made payment
+   * that skips the guard.
+   */
+  onPaymentRequired(_hook) {
+    throw new X402GuardRefused(
+      "GUARD_SEALED",
+      "onPaymentRequired hooks are refused on a guarded MCP client."
+    );
+  }
+  async callTool(name, args = {}, options) {
+    const ctx = {
+      id: `x4r_${randomBytes(8).toString("hex")}`,
+      info: {
+        transport: "mcp",
+        method: "tools/call",
+        originalUrl: `mcp://tool/${name}`,
+        finalUrl: null,
+        toolName: name,
+        serverUrl: this.serverUrl
+      },
+      signedEntries: [],
+      versions: /* @__PURE__ */ new Map()
+    };
+    return requestStorage.run(ctx, () => super.callTool(name, args, options));
+  }
+};
+function guardedMcpClient(guard, mcpClient, options = {}) {
+  assertSupportedX402("@x402/mcp");
+  return new GuardedX402MCPClient(guard, mcpClient, options);
+}
+export {
+  GuardedX402MCPClient,
+  guardedMcpClient
+};

package/dist-dts/axios.d.ts

@@ -0,0 +1,9 @@
+import type { AxiosInstance } from "axios";
+import type { X402Guard } from "./guard.js";
+/**
+ * The official `wrapAxiosWithPayment` on the given instance, built on the
+ * guard's client. Use only the returned instance: calls made on the
+ * original instance carry no original URL and every payment they attempt
+ * is refused.
+ */
+export declare function guardedAxios(guard: X402Guard, instance: AxiosInstance): AxiosInstance;

package/dist-dts/constants.d.ts

@@ -0,0 +1,58 @@
+/** Guardian tool names the guard proposes (`tool.invoke`, record transport). */
+export declare const PAY_TOOL = "x402.pay";
+export declare const PAY_ABOVE_CAP_TOOL = "x402.pay.above_cap";
+export declare const BASE_SEPOLIA = "eip155:84532";
+export declare const BASE_MAINNET = "eip155:8453";
+export type SupportedNetwork = typeof BASE_SEPOLIA | typeof BASE_MAINNET;
+export type PinnedAsset = Readonly<{
+    network: SupportedNetwork;
+    chainId: number;
+    networkName: string;
+    /** Lowercase token contract address. */
+    asset: string;
+    /** EIP-712 domain name and version of the token. */
+    name: string;
+    version: string;
+    decimals: number;
+    symbol: string;
+}>;
+/**
+ * The only assets the guard pays in. Values are the guard's own pins, not
+ * read from the 402 response.
+ */
+export declare const PINNED_ASSETS: readonly PinnedAsset[];
+/** x402 v1 network names the guard maps. Nothing else is mapped. */
+export declare const V1_NETWORK_NAMES: Readonly<Record<string, SupportedNetwork>>;
+/** The EIP-3009 typed-data types, exactly as signed. */
+export declare const EIP3009_TYPES: Readonly<{
+    TransferWithAuthorization: readonly (Readonly<{
+        name: "from";
+        type: "address";
+    }> | Readonly<{
+        name: "to";
+        type: "address";
+    }> | Readonly<{
+        name: "value";
+        type: "uint256";
+    }> | Readonly<{
+        name: "validAfter";
+        type: "uint256";
+    }> | Readonly<{
+        name: "validBefore";
+        type: "uint256";
+    }> | Readonly<{
+        name: "nonce";
+        type: "bytes32";
+    }>)[];
+}>;
+export declare const DEFAULT_MAX_TIMEOUT_SECONDS_LIMIT = 300;
+export declare const DEFAULT_SIGNING_WINDOW_MS = 30000;
+export declare const DEFAULT_CLAIM_POLL_INTERVAL_MS = 2000;
+export declare const DEFAULT_GUARDIAN_CALL_TIMEOUT_MS = 15000;
+export declare const MAX_SIGNING_WINDOW_MS = 120000;
+export declare const MAX_CLAIM_POLL_INTERVAL_MS = 60000;
+export declare const MAX_GUARDIAN_CALL_TIMEOUT_MS = 60000;
+/** How long past `validBefore` reconcile waits before reading the nonce. */
+export declare const RECONCILE_MARGIN_MS = 300000;
+export declare function pinnedAsset(network: string, asset: string): PinnedAsset | undefined;
+export declare function pinnedAssetsOn(network: string): PinnedAsset[];

package/dist-dts/context.d.ts

@@ -0,0 +1,56 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { CanonicalTerms, PaymentRequestInfo } from "./terms.js";
+import type { PinnedAsset } from "./constants.js";
+/** One request the agent made through a guarded transport. */
+export type RequestContext = {
+    readonly id: string;
+    readonly info: PaymentRequestInfo;
+    /** Ledger ids of authorizations signed while serving this request. */
+    readonly signedEntries: string[];
+    /** x402 version of each signed flow, by ledger id. */
+    readonly versions: Map<string, number>;
+};
+export type SigningToken = {
+    readonly terms: CanonicalTerms;
+    readonly pinned: PinnedAsset;
+    /** Snapshot of the selected entry at decision time. */
+    readonly requirementSnapshot: unknown;
+    readonly requestId: string;
+    readonly receiptReference: string;
+    readonly expiresAtMs: number;
+    used: boolean;
+};
+/** One `createPaymentPayload` call. */
+export type PaymentFlow = {
+    readonly id: string;
+    readonly paymentRequired: unknown;
+    readonly request: PaymentRequestInfo | null;
+    readonly requestContext: RequestContext | null;
+    /** Policy-time refusal reasons, first one wins in errors. */
+    readonly dropped: {
+        code: string;
+        detail: string;
+    }[];
+    /** The live entry x402 selected (a reference, not a copy). */
+    selectedRequirements?: unknown;
+    decided: boolean;
+    ledgerId?: string;
+    /** Set once Guardian's execute redeemed the decision. */
+    redeemed?: {
+        requestId: string;
+        receiptReference: string;
+    };
+    /** Set when `execute` was sent but its outcome is unknown (may be redeemed). */
+    executeOutcomeUnknown?: {
+        requestId: string;
+    };
+    token?: SigningToken;
+    signed?: {
+        nonce: string;
+        from: string;
+        validBefore: number;
+    };
+    signAttempted: boolean;
+};
+export declare const requestStorage: AsyncLocalStorage<RequestContext>;
+export declare const flowStorage: AsyncLocalStorage<PaymentFlow>;

package/dist-dts/fetch.d.ts

@@ -0,0 +1,9 @@
+import type { X402Guard } from "./guard.js";
+/**
+ * The official `wrapFetchWithPayment`, built on the guard's client. Every
+ * payment it makes is decided by Guardian before the wallet signs.
+ *
+ * The guard records the URL and method the agent asked for (before any
+ * redirect); a payment whose resource host differs is refused.
+ */
+export declare function guardedFetch(guard: X402Guard, fetchImpl?: typeof globalThis.fetch): typeof globalThis.fetch;

package/dist-dts/guard.d.ts

@@ -0,0 +1,209 @@
+import { type GuardianClient } from "@odingard/guardian-sdk";
+import { x402Client, x402HTTPClient, type PaymentCreatedContext, type PaymentCreationContext, type PaymentPolicy, type PaymentResponseContext, type SelectPaymentRequirements, type SpendControls } from "@x402/core/client";
+import type { PaymentPayload, PaymentRequired, SettleResponse } from "@x402/core/types";
+import { type SupportedNetwork } from "./constants.js";
+import { requestStorage, type PaymentFlow, type RequestContext } from "./context.js";
+import { type AuthorizationStateReader, type BudgetConfig, type LedgerEntry, type X402GuardStore } from "./ledger.js";
+import { type CanonicalTerms, type PaymentRequestInfo } from "./terms.js";
+import { X402GuardRefused, type RefusalCode } from "./util.js";
+/** The wallet the guard signs with. A viem local account fits. */
+export type X402WalletSigner = {
+    readonly address: `0x${string}`;
+    signTypedData(message: {
+        domain: Record<string, unknown>;
+        types: Record<string, unknown>;
+        primaryType: string;
+        message: Record<string, unknown>;
+    }): Promise<`0x${string}`>;
+};
+/** Local limits for one pinned asset, in its atomic units. */
+export type AssetLimit = Readonly<{
+    network: SupportedNetwork;
+    asset: string;
+    /** Above this, the payment needs a person's approval. */
+    askAbove: string;
+    /** Above this, the payment is refused locally. */
+    max: string;
+    /** Optional: the only recipients allowed for this asset. */
+    payTo?: readonly string[];
+}>;
+export type X402GuardConfig = Readonly<{
+    /** A Guardian client (`createGuardianClient`). */
+    guardian: GuardianClient;
+    /** The tool connection holding the `x402.pay` and `x402.pay.above_cap` entries. */
+    connectionId: string;
+    /** The wallet. The guard never exposes it; it hands x402 a wrapped signer. */
+    signer: X402WalletSigner;
+    /**
+     * Networks the guard pays on. Default: Base Sepolia only. Base mainnet
+     * (`eip155:8453`) must be named here to be used.
+     */
+    enabledNetworks?: readonly SupportedNetwork[];
+    /** Per-asset `askAbove` and `max`. An asset with none: every payment needs a person. */
+    limits?: readonly AssetLimit[];
+    /** Local budgets. Need `store`. */
+    budgets?: readonly BudgetConfig[];
+    /** Durable store with compare-and-set, for budgets and live authorizations. */
+    store?: X402GuardStore;
+    /** On-chain `authorizationState` reader, used by `reconcile()` to release budgets. */
+    authorizationState?: AuthorizationStateReader;
+    /** x402's own spend controls. Cannot be turned off. */
+    spendControls?: SpendControls;
+    paymentRequirementsSelector?: SelectPaymentRequirements;
+    /** Highest `maxTimeoutSeconds` accepted. Default 300. */
+    maxTimeoutSecondsLimit?: number;
+    /** How long a Guardian request stays open (an ASK expires after it). Default 120 s, max 300 s. */
+    requestTtlMs?: number;
+    /** How long a signing token lasts after `execute`. Default 30 s, max 120 s. */
+    signingWindowMs?: number;
+    /** How often `claim` is polled while a person decides. Default 2 s, max 60 s. */
+    claimPollIntervalMs?: number;
+    /** Per-call limit on each Guardian call. Default 15 s, max 60 s. */
+    guardianCallTimeoutMs?: number;
+    /**
+     * Optional receipt verification keys (from `fetchReceiptVerificationKeys`).
+     * When given, the receipt checked for an above-cap payment must verify
+     * offline.
+     */
+    receiptVerificationKeys?: unknown;
+    /** Called with each local record. Records never hold keys or signatures. */
+    onRecord?: (record: X402GuardRecord) => void;
+    /** Clock, for tests. */
+    now?: () => number;
+}>;
+export type X402GuardRecord = Readonly<{
+    at: number;
+    event: "refused" | "redeemed" | "signed" | "redeemed-not-signed" | "signed-not-sent" | "settlement" | "released" | "spent";
+    flowId?: string;
+    tool?: string;
+    requestId?: string;
+    receiptReference?: string;
+    code?: RefusalCode;
+    guardianReasonCode?: string;
+    detail?: string;
+    terms?: CanonicalTerms;
+    reviewReasons?: readonly string[];
+    approvedByPerson?: boolean;
+    /** `execute` was sent but its outcome is unknown; the decision may be spent. */
+    outcomeUnknown?: boolean;
+    nonce?: string;
+    from?: string;
+    validBefore?: number;
+    network?: string;
+    transaction?: string;
+    success?: boolean;
+    errorReason?: string;
+}>;
+/**
+ * Builds and guards the official x402 client. Create one with
+ * `createX402Guard`, then use its `client` with the fetch, axios or MCP
+ * builders.
+ */
+export declare class X402Guard {
+    readonly client: GuardedX402Client;
+    private readonly config;
+    private readonly ledger;
+    private readonly durable;
+    private readonly startedAtMs;
+    private readonly now;
+    private readonly termsOptions;
+    private readonly requestTtlMs;
+    private readonly signingWindowMs;
+    private readonly pollMs;
+    private readonly callTimeoutMs;
+    private readonly walletAddress;
+    private readonly wallet;
+    private readonly log;
+    /** PaymentRequired object → the request it answered (set by the HTTP hook). */
+    private readonly pending;
+    constructor(config: X402GuardConfig);
+    /** Local records (newest last). No keys, signatures or payment payloads. */
+    records(): readonly X402GuardRecord[];
+    /** @internal */
+    record(r: Omit<X402GuardRecord, "at">): void;
+    /** Authorizations the guard signed that may still be settled. */
+    liveAuthorizations(): Promise<LedgerEntry[]>;
+    /**
+     * Releases budget held by authorizations whose `validBefore` has passed
+     * and whose nonce the chain shows unused. Needs `authorizationState`.
+     */
+    reconcile(): Promise<{
+        released: number;
+        spent: number;
+    }>;
+    /**
+     * An x402 HTTP client for this guard. Its only `onPaymentRequired` hook
+     * records which request the 402 answered; it never returns headers.
+     */
+    httpClient(): x402HTTPClient;
+    /** @internal */
+    requestInfoFor(paymentRequired: object): {
+        info: PaymentRequestInfo | null;
+        ctx: RequestContext | null;
+    };
+    /** @internal Fetch: "Payment already attempted" after the payload was signed. */
+    markSignedNotSent(ctx: RequestContext): Promise<void>;
+    /** @internal v1 settlement, read by the transport wrapper. */
+    recordV1Settlement(ctx: RequestContext, settle: SettleResponse | null): Promise<void>;
+    private recordSettlement;
+    /** @internal Drops entries the guard cannot pay before x402 selects one. */
+    policy: PaymentPolicy;
+    /** @internal Pre-check before x402 runs: refuse what nothing can pay. */
+    precheck(paymentRequired: unknown, request: PaymentRequestInfo | null): void;
+    /** @internal The decision point: x402's onBeforePaymentCreation. */
+    beforePaymentCreation: (ctx: PaymentCreationContext) => Promise<void | {
+        abort: true;
+        reason: string;
+    }>;
+    private limitFor;
+    private decide;
+    /** The longest a flow can hold a reservation before it signs. */
+    private longestFlowMs;
+    private guardianCall;
+    private askGuardian;
+    /** The receipt must show a person approved this exact request. */
+    private checkApprovedByPerson;
+    /** @internal The only signer x402 gets: EIP-3009 typed data, nothing else. */
+    readonly guardedSigner: Readonly<{
+        address: `0x${string}`;
+        signTypedData: X402WalletSigner["signTypedData"];
+        signTransaction: () => Promise<`0x${string}`>;
+    }>;
+    private readonly recordedRefusals;
+    /** @internal Records a refusal once. */
+    recordRefusal(err: X402GuardRefused, flowId?: string): void;
+    private signGuarded;
+    private signChecked;
+    private checkTypedData;
+    /** @internal */
+    afterPaymentCreation: (ctx: PaymentCreatedContext) => Promise<void>;
+    /** @internal v2 only (x402 skips this hook for v1). */
+    paymentResponse: (ctx: PaymentResponseContext) => Promise<void>;
+    /** @internal Called when a flow ends. */
+    endFlow(flow: PaymentFlow): Promise<void>;
+    /** @internal */
+    newFlow(paymentRequired: unknown): PaymentFlow;
+}
+/**
+ * The official `x402Client`, built and sealed by the guard. Every payment
+ * runs in its own flow; the guard's hooks and wrapped signer read it.
+ */
+export declare class GuardedX402Client extends x402Client {
+    /** @internal */
+    readonly guard: X402Guard;
+    private sealed;
+    constructor(guard: X402Guard, config: X402GuardConfig);
+    register(...args: Parameters<x402Client["register"]>): x402Client;
+    registerV1(...args: Parameters<x402Client["registerV1"]>): x402Client;
+    registerExtension(...args: Parameters<x402Client["registerExtension"]>): x402Client;
+    /**
+     * Refused once sealed: a failure hook can return its own payload, which
+     * x402 would send in place of a guard refusal.
+     */
+    onPaymentCreationFailure(...args: Parameters<x402Client["onPaymentCreationFailure"]>): x402Client;
+    setSpendControls(controls: SpendControls | false): x402Client;
+    createPaymentPayload(paymentRequired: PaymentRequired): Promise<PaymentPayload>;
+}
+/** Builds the guard and its guarded x402 client. */
+export declare function createX402Guard(config: X402GuardConfig): X402Guard;
+export { requestStorage };

package/dist-dts/index.d.ts

@@ -0,0 +1,32 @@
+export { createX402Guard, GuardedX402Client, X402Guard, type AssetLimit, type X402GuardConfig, type X402GuardRecord, type X402WalletSigner, } from "./guard.js";
+export { BASE_MAINNET, BASE_SEPOLIA, EIP3009_TYPES, PAY_ABOVE_CAP_TOOL, PAY_TOOL, PINNED_ASSETS, type PinnedAsset, type SupportedNetwork, } from "./constants.js";
+export { type AuthorizationStateReader, type BudgetConfig, type LedgerEntry, type X402GuardStore, } from "./ledger.js";
+export { readTerms, type CanonicalTerms, type PaymentRequestInfo } from "./terms.js";
+export { X402GuardRefused, type RefusalCode } from "./util.js";
+/** ABI fragment for EIP-3009 `authorizationState(address,bytes32)`. */
+export declare const AUTHORIZATION_STATE_ABI: readonly [{
+    readonly type: "function";
+    readonly name: "authorizationState";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [{
+        readonly name: "authorizer";
+        readonly type: "address";
+    }, {
+        readonly name: "nonce";
+        readonly type: "bytes32";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bool";
+    }];
+}];
+/**
+ * An `authorizationState` reader from a `readContract` function (a viem
+ * public client's, for example) per network. Used by `reconcile()`.
+ */
+export declare function authorizationStateReader(readContractFor: (network: string) => ((args: {
+    address: `0x${string}`;
+    abi: typeof AUTHORIZATION_STATE_ABI;
+    functionName: "authorizationState";
+    args: readonly [`0x${string}`, `0x${string}`];
+}) => Promise<unknown>) | undefined): import("./ledger.js").AuthorizationStateReader;