@opendatalabs/vana-sdk 3.22.0-pr.208.fee4237 → 3.22.0-pr.209.70d3733

package/dist/crypto/envelope/job.cjs

@@ -0,0 +1,197 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var job_exports = {};
+__export(job_exports, {
+  JobEnvelopeError: () => JobEnvelopeError,
+  openJobRequest: () => openJobRequest,
+  openJobResult: () => openJobResult,
+  sealJobRequest: () => sealJobRequest,
+  sealJobResult: () => sealJobResult
+});
+module.exports = __toCommonJS(job_exports);
+var import_sha2 = require("@noble/hashes/sha2");
+var import_viem = require("viem");
+var import_interface = require("../ecies/interface");
+var import_encoding = require("../../utils/encoding");
+const textDecoder = new TextDecoder();
+const textEncoder = new TextEncoder();
+class JobEnvelopeError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+}
+function requestPlaintext(envelope) {
+  const { request, auth } = envelope;
+  return textEncoder.encode(
+    JSON.stringify({
+      request: {
+        v: request.v,
+        jobId: request.jobId,
+        owner: request.owner,
+        builder: request.builder,
+        builderPublicKey: request.builderPublicKey,
+        grantId: request.grantId,
+        scope: request.scope,
+        operation: request.operation,
+        pinnedVersion: request.pinnedVersion,
+        deadline: request.deadline
+      },
+      auth
+    })
+  );
+}
+function resultPlaintext(result) {
+  return textEncoder.encode(
+    JSON.stringify({
+      v: result.v,
+      jobId: result.jobId,
+      scope: result.scope,
+      version: result.version,
+      contentType: result.contentType,
+      body: result.body
+    })
+  );
+}
+function encryptedBytesToBase64(encrypted) {
+  return (0, import_encoding.toBase64)((0, import_viem.fromHex)(`0x${(0, import_interface.serializeECIES)(encrypted)}`, "bytes"));
+}
+function base64ToEncrypted(ciphertext) {
+  return (0, import_interface.deserializeECIES)((0, import_viem.toHex)((0, import_encoding.fromBase64)(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateRequestEnvelope(value) {
+  const request = value.request;
+  if (request === null || typeof request !== "object" || Array.isArray(request)) {
+    throw new JobEnvelopeError("Invalid job request envelope: missing request");
+  }
+  const fields = request;
+  if (fields.v !== 1) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(fields.v)}`
+    );
+  }
+  for (const field of [
+    "jobId",
+    "owner",
+    "builder",
+    "builderPublicKey",
+    "grantId",
+    "scope",
+    "operation",
+    "deadline"
+  ]) {
+    requireString(fields[field], field, "job request");
+  }
+  if (fields.pinnedVersion !== null && typeof fields.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResult(value) {
+  if (value.v !== 1) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (typeof value.body !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+async function sealJobRequest(e, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    (0, import_viem.fromHex)(enclavePublicKey, "bytes"),
+    requestPlaintext(e)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResult(r, builderPublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    (0, import_viem.fromHex)(builderPublicKey, "bytes"),
+    resultPlaintext(r)
+  );
+  const ciphertext = encryptedBytesToBase64(encrypted);
+  const bytes = (0, import_encoding.fromBase64)(ciphertext);
+  return { ciphertext, hash: (0, import_viem.bytesToHex)((0, import_sha2.sha256)(bytes)), size: bytes.length };
+}
+async function openJobResult(ciphertext, builderPrivateKey, ecies, expect) {
+  const plaintext = await ecies.decrypt(
+    (0, import_viem.fromHex)(builderPrivateKey, "bytes"),
+    base64ToEncrypted(ciphertext)
+  );
+  const result = validateResult(parseObject(plaintext, "job result"));
+  if (result.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && result.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+  return result;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  JobEnvelopeError,
+  openJobRequest,
+  openJobResult,
+  sealJobRequest,
+  sealJobResult
+});
+//# sourceMappingURL=job.cjs.map

package/dist/crypto/envelope/job.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/crypto/envelope/job.ts"],"sourcesContent":["/**\n * ECIES envelopes for encrypted job requests and results.\n *\n * Plaintext is the UTF-8 encoding of `JSON.stringify(value)`, with properties\n * emitted in the order declared by the corresponding interface. The wire\n * ciphertext is base64 of `iv || ephemPub || ct || mac`, as specified by the\n * ECIES provider interface. This ordering is canonical enough for a plaintext\n * hash, although the Gateway hashes the raw ciphertext bytes, not plaintext.\n * Per the jobs flow in contract section 1, the builder verifies the decrypted\n * result's job ID, scope, and version bindings.\n *\n * @category Cryptography\n */\n\nimport { sha256 } from \"@noble/hashes/sha2\";\nimport { bytesToHex, fromHex, toHex, type Hex } from \"viem\";\nimport {\n  deserializeECIES,\n  serializeECIES,\n  type ECIESProvider,\n} from \"../ecies/interface\";\nimport type { JobRequestEnvelope, JobResult } from \"../../protocol/jobs\";\nimport { fromBase64, toBase64 } from \"../../utils/encoding\";\n\nconst textDecoder = new TextDecoder();\nconst textEncoder = new TextEncoder();\n\n/** A decrypted job envelope did not match the jobs protocol. */\nexport class JobEnvelopeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"JobEnvelopeError\";\n  }\n}\n\nfunction requestPlaintext(envelope: JobRequestEnvelope): Uint8Array {\n  const { request, auth } = envelope;\n  return textEncoder.encode(\n    JSON.stringify({\n      request: {\n        v: request.v,\n        jobId: request.jobId,\n        owner: request.owner,\n        builder: request.builder,\n        builderPublicKey: request.builderPublicKey,\n        grantId: request.grantId,\n        scope: request.scope,\n        operation: request.operation,\n        pinnedVersion: request.pinnedVersion,\n        deadline: request.deadline,\n      },\n      auth,\n    }),\n  );\n}\n\nfunction resultPlaintext(result: JobResult): Uint8Array {\n  return textEncoder.encode(\n    JSON.stringify({\n      v: result.v,\n      jobId: result.jobId,\n      scope: result.scope,\n      version: result.version,\n      contentType: result.contentType,\n      body: result.body,\n    }),\n  );\n}\n\nfunction encryptedBytesToBase64(\n  encrypted: Awaited<ReturnType<ECIESProvider[\"encrypt\"]>>,\n): string {\n  return toBase64(fromHex(`0x${serializeECIES(encrypted)}`, \"bytes\"));\n}\n\nfunction base64ToEncrypted(ciphertext: string) {\n  return deserializeECIES(toHex(fromBase64(ciphertext)));\n}\n\nfunction parseObject(\n  plaintext: Uint8Array,\n  kind: string,\n): Record<string, unknown> {\n  try {\n    const value: unknown = JSON.parse(textDecoder.decode(plaintext));\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);\n    }\n    return value as Record<string, unknown>;\n  } catch (error) {\n    if (error instanceof JobEnvelopeError) throw error;\n    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);\n  }\n}\n\nfunction requireString(\n  value: unknown,\n  field: string,\n  kind: string,\n): asserts value is string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);\n  }\n}\n\nfunction validateRequestEnvelope(\n  value: Record<string, unknown>,\n): JobRequestEnvelope {\n  const request = value.request;\n  if (\n    request === null ||\n    typeof request !== \"object\" ||\n    Array.isArray(request)\n  ) {\n    throw new JobEnvelopeError(\"Invalid job request envelope: missing request\");\n  }\n  const fields = request as Record<string, unknown>;\n  if (fields.v !== 1) {\n    throw new JobEnvelopeError(\n      `Unsupported job request version: ${String(fields.v)}`,\n    );\n  }\n  for (const field of [\n    \"jobId\",\n    \"owner\",\n    \"builder\",\n    \"builderPublicKey\",\n    \"grantId\",\n    \"scope\",\n    \"operation\",\n    \"deadline\",\n  ]) {\n    requireString(fields[field], field, \"job request\");\n  }\n  if (\n    fields.pinnedVersion !== null &&\n    typeof fields.pinnedVersion !== \"string\"\n  ) {\n    throw new JobEnvelopeError(\"Invalid job request: missing pinnedVersion\");\n  }\n  requireString(value.auth, \"auth\", \"job request envelope\");\n  return value as unknown as JobRequestEnvelope;\n}\n\nfunction validateResult(value: Record<string, unknown>): JobResult {\n  if (value.v !== 1) {\n    throw new JobEnvelopeError(\n      `Unsupported job result version: ${String(value.v)}`,\n    );\n  }\n  for (const field of [\"jobId\", \"scope\", \"contentType\"]) {\n    requireString(value[field], field, \"job result\");\n  }\n  if (typeof value.body !== \"string\") {\n    throw new JobEnvelopeError(\"Invalid job result: missing body\");\n  }\n  if (value.version !== null && typeof value.version !== \"string\") {\n    throw new JobEnvelopeError(\"Invalid job result: missing version\");\n  }\n  return value as unknown as JobResult;\n}\n\nexport async function sealJobRequest(\n  e: JobRequestEnvelope,\n  enclavePublicKey: Hex,\n  ecies: ECIESProvider,\n): Promise<string> {\n  const encrypted = await ecies.encrypt(\n    fromHex(enclavePublicKey, \"bytes\"),\n    requestPlaintext(e),\n  );\n  return encryptedBytesToBase64(encrypted);\n}\n\nexport async function openJobRequest(\n  ciphertext: string,\n  privateKey: Uint8Array,\n  ecies: ECIESProvider,\n): Promise<JobRequestEnvelope> {\n  const plaintext = await ecies.decrypt(\n    privateKey,\n    base64ToEncrypted(ciphertext),\n  );\n  return validateRequestEnvelope(\n    parseObject(plaintext, \"job request envelope\"),\n  );\n}\n\nexport async function sealJobResult(\n  r: JobResult,\n  builderPublicKey: Hex,\n  ecies: ECIESProvider,\n): Promise<{ ciphertext: string; hash: Hex; size: number }> {\n  const encrypted = await ecies.encrypt(\n    fromHex(builderPublicKey, \"bytes\"),\n    resultPlaintext(r),\n  );\n  const ciphertext = encryptedBytesToBase64(encrypted);\n  const bytes = fromBase64(ciphertext);\n  return { ciphertext, hash: bytesToHex(sha256(bytes)), size: bytes.length };\n}\n\nexport async function openJobResult(\n  ciphertext: string,\n  builderPrivateKey: Hex,\n  ecies: ECIESProvider,\n  expect: { jobId: string; scope?: string; version?: string | null },\n): Promise<JobResult> {\n  const plaintext = await ecies.decrypt(\n    fromHex(builderPrivateKey, \"bytes\"),\n    base64ToEncrypted(ciphertext),\n  );\n  const result = validateResult(parseObject(plaintext, \"job result\"));\n  if (result.jobId !== expect.jobId) {\n    throw new JobEnvelopeError(\n      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`,\n    );\n  }\n  if (expect.scope !== undefined && result.scope !== expect.scope) {\n    throw new JobEnvelopeError(\n      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`,\n    );\n  }\n  if (expect.version !== undefined && result.version !== expect.version) {\n    throw new JobEnvelopeError(\n      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`,\n    );\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,kBAAuB;AACvB,kBAAqD;AACrD,uBAIO;AAEP,sBAAqC;AAErC,MAAM,cAAc,IAAI,YAAY;AACpC,MAAM,cAAc,IAAI,YAAY;AAG7B,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,iBAAiB,UAA0C;AAClE,QAAM,EAAE,SAAS,KAAK,IAAI;AAC1B,SAAO,YAAY;AAAA,IACjB,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,QACP,GAAG,QAAQ;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ;AAAA,QACjB,kBAAkB,QAAQ;AAAA,QAC1B,SAAS,QAAQ;AAAA,QACjB,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,eAAe,QAAQ;AAAA,QACvB,UAAU,QAAQ;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,gBAAgB,QAA+B;AACtD,SAAO,YAAY;AAAA,IACjB,KAAK,UAAU;AAAA,MACb,GAAG,OAAO;AAAA,MACV,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,MAAM,OAAO;AAAA,IACf,CAAC;AAAA,EACH;AACF;AAEA,SAAS,uBACP,WACQ;AACR,aAAO,8BAAS,qBAAQ,SAAK,iCAAe,SAAS,CAAC,IAAI,OAAO,CAAC;AACpE;AAEA,SAAS,kBAAkB,YAAoB;AAC7C,aAAO,uCAAiB,uBAAM,4BAAW,UAAU,CAAC,CAAC;AACvD;AAEA,SAAS,YACP,WACA,MACyB;AACzB,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,YAAY,OAAO,SAAS,CAAC;AAC/D,QAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,YAAM,IAAI,iBAAiB,WAAW,IAAI,sBAAsB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAkB,OAAM;AAC7C,UAAM,IAAI,iBAAiB,WAAW,IAAI,kBAAkB;AAAA,EAC9D;AACF;AAEA,SAAS,cACP,OACA,OACA,MACyB;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,EAAE;AAAA,EAChE;AACF;AAEA,SAAS,wBACP,OACoB;AACpB,QAAM,UAAU,MAAM;AACtB,MACE,YAAY,QACZ,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,GACrB;AACA,UAAM,IAAI,iBAAiB,+CAA+C;AAAA,EAC5E;AACA,QAAM,SAAS;AACf,MAAI,OAAO,MAAM,GAAG;AAClB,UAAM,IAAI;AAAA,MACR,oCAAoC,OAAO,OAAO,CAAC,CAAC;AAAA,IACtD;AAAA,EACF;AACA,aAAW,SAAS;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AACD,kBAAc,OAAO,KAAK,GAAG,OAAO,aAAa;AAAA,EACnD;AACA,MACE,OAAO,kBAAkB,QACzB,OAAO,OAAO,kBAAkB,UAChC;AACA,UAAM,IAAI,iBAAiB,4CAA4C;AAAA,EACzE;AACA,gBAAc,MAAM,MAAM,QAAQ,sBAAsB;AACxD,SAAO;AACT;AAEA,SAAS,eAAe,OAA2C;AACjE,MAAI,MAAM,MAAM,GAAG;AACjB,UAAM,IAAI;AAAA,MACR,mCAAmC,OAAO,MAAM,CAAC,CAAC;AAAA,IACpD;AAAA,EACF;AACA,aAAW,SAAS,CAAC,SAAS,SAAS,aAAa,GAAG;AACrD,kBAAc,MAAM,KAAK,GAAG,OAAO,YAAY;AAAA,EACjD;AACA,MAAI,OAAO,MAAM,SAAS,UAAU;AAClC,UAAM,IAAI,iBAAiB,kCAAkC;AAAA,EAC/D;AACA,MAAI,MAAM,YAAY,QAAQ,OAAO,MAAM,YAAY,UAAU;AAC/D,UAAM,IAAI,iBAAiB,qCAAqC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,eAAsB,eACpB,GACA,kBACA,OACiB;AACjB,QAAM,YAAY,MAAM,MAAM;AAAA,QAC5B,qBAAQ,kBAAkB,OAAO;AAAA,IACjC,iBAAiB,CAAC;AAAA,EACpB;AACA,SAAO,uBAAuB,SAAS;AACzC;AAEA,eAAsB,eACpB,YACA,YACA,OAC6B;AAC7B,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B;AAAA,IACA,kBAAkB,UAAU;AAAA,EAC9B;AACA,SAAO;AAAA,IACL,YAAY,WAAW,sBAAsB;AAAA,EAC/C;AACF;AAEA,eAAsB,cACpB,GACA,kBACA,OAC0D;AAC1D,QAAM,YAAY,MAAM,MAAM;AAAA,QAC5B,qBAAQ,kBAAkB,OAAO;AAAA,IACjC,gBAAgB,CAAC;AAAA,EACnB;AACA,QAAM,aAAa,uBAAuB,SAAS;AACnD,QAAM,YAAQ,4BAAW,UAAU;AACnC,SAAO,EAAE,YAAY,UAAM,4BAAW,oBAAO,KAAK,CAAC,GAAG,MAAM,MAAM,OAAO;AAC3E;AAEA,eAAsB,cACpB,YACA,mBACA,OACA,QACoB;AACpB,QAAM,YAAY,MAAM,MAAM;AAAA,QAC5B,qBAAQ,mBAAmB,OAAO;AAAA,IAClC,kBAAkB,UAAU;AAAA,EAC9B;AACA,QAAM,SAAS,eAAe,YAAY,WAAW,YAAY,CAAC;AAClE,MAAI,OAAO,UAAU,OAAO,OAAO;AACjC,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,KAAK,mCAAmC,OAAO,KAAK;AAAA,IAC9E;AAAA,EACF;AACA,MAAI,OAAO,UAAU,UAAa,OAAO,UAAU,OAAO,OAAO;AAC/D,UAAM,IAAI;AAAA,MACR,oBAAoB,OAAO,KAAK,kCAAkC,OAAO,KAAK;AAAA,IAChF;AAAA,EACF;AACA,MAAI,OAAO,YAAY,UAAa,OAAO,YAAY,OAAO,SAAS;AACrE,UAAM,IAAI;AAAA,MACR,sBAAsB,OAAO,OAAO,OAAO,CAAC,oCAAoC,OAAO,OAAO,OAAO,CAAC;AAAA,IACxG;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/crypto/envelope/job.d.ts

@@ -0,0 +1,32 @@
+/**
+ * ECIES envelopes for encrypted job requests and results.
+ *
+ * Plaintext is the UTF-8 encoding of `JSON.stringify(value)`, with properties
+ * emitted in the order declared by the corresponding interface. The wire
+ * ciphertext is base64 of `iv || ephemPub || ct || mac`, as specified by the
+ * ECIES provider interface. This ordering is canonical enough for a plaintext
+ * hash, although the Gateway hashes the raw ciphertext bytes, not plaintext.
+ * Per the jobs flow in contract section 1, the builder verifies the decrypted
+ * result's job ID, scope, and version bindings.
+ *
+ * @category Cryptography
+ */
+import { type Hex } from "viem";
+import { type ECIESProvider } from "../ecies/interface.js";
+import type { JobRequestEnvelope, JobResult } from "../../protocol/jobs.js";
+/** A decrypted job envelope did not match the jobs protocol. */
+export declare class JobEnvelopeError extends Error {
+    constructor(message: string);
+}
+export declare function sealJobRequest(e: JobRequestEnvelope, enclavePublicKey: Hex, ecies: ECIESProvider): Promise<string>;
+export declare function openJobRequest(ciphertext: string, privateKey: Uint8Array, ecies: ECIESProvider): Promise<JobRequestEnvelope>;
+export declare function sealJobResult(r: JobResult, builderPublicKey: Hex, ecies: ECIESProvider): Promise<{
+    ciphertext: string;
+    hash: Hex;
+    size: number;
+}>;
+export declare function openJobResult(ciphertext: string, builderPrivateKey: Hex, ecies: ECIESProvider, expect: {
+    jobId: string;
+    scope?: string;
+    version?: string | null;
+}): Promise<JobResult>;

package/dist/crypto/envelope/job.js

@@ -0,0 +1,172 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { bytesToHex, fromHex, toHex } from "viem";
+import {
+  deserializeECIES,
+  serializeECIES
+} from "../ecies/interface.js";
+import { fromBase64, toBase64 } from "../../utils/encoding.js";
+const textDecoder = new TextDecoder();
+const textEncoder = new TextEncoder();
+class JobEnvelopeError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JobEnvelopeError";
+  }
+}
+function requestPlaintext(envelope) {
+  const { request, auth } = envelope;
+  return textEncoder.encode(
+    JSON.stringify({
+      request: {
+        v: request.v,
+        jobId: request.jobId,
+        owner: request.owner,
+        builder: request.builder,
+        builderPublicKey: request.builderPublicKey,
+        grantId: request.grantId,
+        scope: request.scope,
+        operation: request.operation,
+        pinnedVersion: request.pinnedVersion,
+        deadline: request.deadline
+      },
+      auth
+    })
+  );
+}
+function resultPlaintext(result) {
+  return textEncoder.encode(
+    JSON.stringify({
+      v: result.v,
+      jobId: result.jobId,
+      scope: result.scope,
+      version: result.version,
+      contentType: result.contentType,
+      body: result.body
+    })
+  );
+}
+function encryptedBytesToBase64(encrypted) {
+  return toBase64(fromHex(`0x${serializeECIES(encrypted)}`, "bytes"));
+}
+function base64ToEncrypted(ciphertext) {
+  return deserializeECIES(toHex(fromBase64(ciphertext)));
+}
+function parseObject(plaintext, kind) {
+  try {
+    const value = JSON.parse(textDecoder.decode(plaintext));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof JobEnvelopeError) throw error;
+    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);
+  }
+}
+function requireString(value, field, kind) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);
+  }
+}
+function validateRequestEnvelope(value) {
+  const request = value.request;
+  if (request === null || typeof request !== "object" || Array.isArray(request)) {
+    throw new JobEnvelopeError("Invalid job request envelope: missing request");
+  }
+  const fields = request;
+  if (fields.v !== 1) {
+    throw new JobEnvelopeError(
+      `Unsupported job request version: ${String(fields.v)}`
+    );
+  }
+  for (const field of [
+    "jobId",
+    "owner",
+    "builder",
+    "builderPublicKey",
+    "grantId",
+    "scope",
+    "operation",
+    "deadline"
+  ]) {
+    requireString(fields[field], field, "job request");
+  }
+  if (fields.pinnedVersion !== null && typeof fields.pinnedVersion !== "string") {
+    throw new JobEnvelopeError("Invalid job request: missing pinnedVersion");
+  }
+  requireString(value.auth, "auth", "job request envelope");
+  return value;
+}
+function validateResult(value) {
+  if (value.v !== 1) {
+    throw new JobEnvelopeError(
+      `Unsupported job result version: ${String(value.v)}`
+    );
+  }
+  for (const field of ["jobId", "scope", "contentType"]) {
+    requireString(value[field], field, "job result");
+  }
+  if (typeof value.body !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing body");
+  }
+  if (value.version !== null && typeof value.version !== "string") {
+    throw new JobEnvelopeError("Invalid job result: missing version");
+  }
+  return value;
+}
+async function sealJobRequest(e, enclavePublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    fromHex(enclavePublicKey, "bytes"),
+    requestPlaintext(e)
+  );
+  return encryptedBytesToBase64(encrypted);
+}
+async function openJobRequest(ciphertext, privateKey, ecies) {
+  const plaintext = await ecies.decrypt(
+    privateKey,
+    base64ToEncrypted(ciphertext)
+  );
+  return validateRequestEnvelope(
+    parseObject(plaintext, "job request envelope")
+  );
+}
+async function sealJobResult(r, builderPublicKey, ecies) {
+  const encrypted = await ecies.encrypt(
+    fromHex(builderPublicKey, "bytes"),
+    resultPlaintext(r)
+  );
+  const ciphertext = encryptedBytesToBase64(encrypted);
+  const bytes = fromBase64(ciphertext);
+  return { ciphertext, hash: bytesToHex(sha256(bytes)), size: bytes.length };
+}
+async function openJobResult(ciphertext, builderPrivateKey, ecies, expect) {
+  const plaintext = await ecies.decrypt(
+    fromHex(builderPrivateKey, "bytes"),
+    base64ToEncrypted(ciphertext)
+  );
+  const result = validateResult(parseObject(plaintext, "job result"));
+  if (result.jobId !== expect.jobId) {
+    throw new JobEnvelopeError(
+      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`
+    );
+  }
+  if (expect.scope !== void 0 && result.scope !== expect.scope) {
+    throw new JobEnvelopeError(
+      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`
+    );
+  }
+  if (expect.version !== void 0 && result.version !== expect.version) {
+    throw new JobEnvelopeError(
+      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`
+    );
+  }
+  return result;
+}
+export {
+  JobEnvelopeError,
+  openJobRequest,
+  openJobResult,
+  sealJobRequest,
+  sealJobResult
+};
+//# sourceMappingURL=job.js.map

package/dist/crypto/envelope/job.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/crypto/envelope/job.ts"],"sourcesContent":["/**\n * ECIES envelopes for encrypted job requests and results.\n *\n * Plaintext is the UTF-8 encoding of `JSON.stringify(value)`, with properties\n * emitted in the order declared by the corresponding interface. The wire\n * ciphertext is base64 of `iv || ephemPub || ct || mac`, as specified by the\n * ECIES provider interface. This ordering is canonical enough for a plaintext\n * hash, although the Gateway hashes the raw ciphertext bytes, not plaintext.\n * Per the jobs flow in contract section 1, the builder verifies the decrypted\n * result's job ID, scope, and version bindings.\n *\n * @category Cryptography\n */\n\nimport { sha256 } from \"@noble/hashes/sha2\";\nimport { bytesToHex, fromHex, toHex, type Hex } from \"viem\";\nimport {\n  deserializeECIES,\n  serializeECIES,\n  type ECIESProvider,\n} from \"../ecies/interface\";\nimport type { JobRequestEnvelope, JobResult } from \"../../protocol/jobs\";\nimport { fromBase64, toBase64 } from \"../../utils/encoding\";\n\nconst textDecoder = new TextDecoder();\nconst textEncoder = new TextEncoder();\n\n/** A decrypted job envelope did not match the jobs protocol. */\nexport class JobEnvelopeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"JobEnvelopeError\";\n  }\n}\n\nfunction requestPlaintext(envelope: JobRequestEnvelope): Uint8Array {\n  const { request, auth } = envelope;\n  return textEncoder.encode(\n    JSON.stringify({\n      request: {\n        v: request.v,\n        jobId: request.jobId,\n        owner: request.owner,\n        builder: request.builder,\n        builderPublicKey: request.builderPublicKey,\n        grantId: request.grantId,\n        scope: request.scope,\n        operation: request.operation,\n        pinnedVersion: request.pinnedVersion,\n        deadline: request.deadline,\n      },\n      auth,\n    }),\n  );\n}\n\nfunction resultPlaintext(result: JobResult): Uint8Array {\n  return textEncoder.encode(\n    JSON.stringify({\n      v: result.v,\n      jobId: result.jobId,\n      scope: result.scope,\n      version: result.version,\n      contentType: result.contentType,\n      body: result.body,\n    }),\n  );\n}\n\nfunction encryptedBytesToBase64(\n  encrypted: Awaited<ReturnType<ECIESProvider[\"encrypt\"]>>,\n): string {\n  return toBase64(fromHex(`0x${serializeECIES(encrypted)}`, \"bytes\"));\n}\n\nfunction base64ToEncrypted(ciphertext: string) {\n  return deserializeECIES(toHex(fromBase64(ciphertext)));\n}\n\nfunction parseObject(\n  plaintext: Uint8Array,\n  kind: string,\n): Record<string, unknown> {\n  try {\n    const value: unknown = JSON.parse(textDecoder.decode(plaintext));\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n      throw new JobEnvelopeError(`Invalid ${kind}: expected an object`);\n    }\n    return value as Record<string, unknown>;\n  } catch (error) {\n    if (error instanceof JobEnvelopeError) throw error;\n    throw new JobEnvelopeError(`Invalid ${kind}: malformed JSON`);\n  }\n}\n\nfunction requireString(\n  value: unknown,\n  field: string,\n  kind: string,\n): asserts value is string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new JobEnvelopeError(`Invalid ${kind}: missing ${field}`);\n  }\n}\n\nfunction validateRequestEnvelope(\n  value: Record<string, unknown>,\n): JobRequestEnvelope {\n  const request = value.request;\n  if (\n    request === null ||\n    typeof request !== \"object\" ||\n    Array.isArray(request)\n  ) {\n    throw new JobEnvelopeError(\"Invalid job request envelope: missing request\");\n  }\n  const fields = request as Record<string, unknown>;\n  if (fields.v !== 1) {\n    throw new JobEnvelopeError(\n      `Unsupported job request version: ${String(fields.v)}`,\n    );\n  }\n  for (const field of [\n    \"jobId\",\n    \"owner\",\n    \"builder\",\n    \"builderPublicKey\",\n    \"grantId\",\n    \"scope\",\n    \"operation\",\n    \"deadline\",\n  ]) {\n    requireString(fields[field], field, \"job request\");\n  }\n  if (\n    fields.pinnedVersion !== null &&\n    typeof fields.pinnedVersion !== \"string\"\n  ) {\n    throw new JobEnvelopeError(\"Invalid job request: missing pinnedVersion\");\n  }\n  requireString(value.auth, \"auth\", \"job request envelope\");\n  return value as unknown as JobRequestEnvelope;\n}\n\nfunction validateResult(value: Record<string, unknown>): JobResult {\n  if (value.v !== 1) {\n    throw new JobEnvelopeError(\n      `Unsupported job result version: ${String(value.v)}`,\n    );\n  }\n  for (const field of [\"jobId\", \"scope\", \"contentType\"]) {\n    requireString(value[field], field, \"job result\");\n  }\n  if (typeof value.body !== \"string\") {\n    throw new JobEnvelopeError(\"Invalid job result: missing body\");\n  }\n  if (value.version !== null && typeof value.version !== \"string\") {\n    throw new JobEnvelopeError(\"Invalid job result: missing version\");\n  }\n  return value as unknown as JobResult;\n}\n\nexport async function sealJobRequest(\n  e: JobRequestEnvelope,\n  enclavePublicKey: Hex,\n  ecies: ECIESProvider,\n): Promise<string> {\n  const encrypted = await ecies.encrypt(\n    fromHex(enclavePublicKey, \"bytes\"),\n    requestPlaintext(e),\n  );\n  return encryptedBytesToBase64(encrypted);\n}\n\nexport async function openJobRequest(\n  ciphertext: string,\n  privateKey: Uint8Array,\n  ecies: ECIESProvider,\n): Promise<JobRequestEnvelope> {\n  const plaintext = await ecies.decrypt(\n    privateKey,\n    base64ToEncrypted(ciphertext),\n  );\n  return validateRequestEnvelope(\n    parseObject(plaintext, \"job request envelope\"),\n  );\n}\n\nexport async function sealJobResult(\n  r: JobResult,\n  builderPublicKey: Hex,\n  ecies: ECIESProvider,\n): Promise<{ ciphertext: string; hash: Hex; size: number }> {\n  const encrypted = await ecies.encrypt(\n    fromHex(builderPublicKey, \"bytes\"),\n    resultPlaintext(r),\n  );\n  const ciphertext = encryptedBytesToBase64(encrypted);\n  const bytes = fromBase64(ciphertext);\n  return { ciphertext, hash: bytesToHex(sha256(bytes)), size: bytes.length };\n}\n\nexport async function openJobResult(\n  ciphertext: string,\n  builderPrivateKey: Hex,\n  ecies: ECIESProvider,\n  expect: { jobId: string; scope?: string; version?: string | null },\n): Promise<JobResult> {\n  const plaintext = await ecies.decrypt(\n    fromHex(builderPrivateKey, \"bytes\"),\n    base64ToEncrypted(ciphertext),\n  );\n  const result = validateResult(parseObject(plaintext, \"job result\"));\n  if (result.jobId !== expect.jobId) {\n    throw new JobEnvelopeError(\n      `Job result ID ${result.jobId} does not match expected job ID ${expect.jobId}`,\n    );\n  }\n  if (expect.scope !== undefined && result.scope !== expect.scope) {\n    throw new JobEnvelopeError(\n      `Job result scope ${result.scope} does not match expected scope ${expect.scope}`,\n    );\n  }\n  if (expect.version !== undefined && result.version !== expect.version) {\n    throw new JobEnvelopeError(\n      `Job result version ${String(result.version)} does not match expected version ${String(expect.version)}`,\n    );\n  }\n  return result;\n}\n"],"mappings":"AAcA,SAAS,cAAc;AACvB,SAAS,YAAY,SAAS,aAAuB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAEP,SAAS,YAAY,gBAAgB;AAErC,MAAM,cAAc,IAAI,YAAY;AACpC,MAAM,cAAc,IAAI,YAAY;AAG7B,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,iBAAiB,UAA0C;AAClE,QAAM,EAAE,SAAS,KAAK,IAAI;AAC1B,SAAO,YAAY;AAAA,IACjB,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,QACP,GAAG,QAAQ;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ;AAAA,QACf,SAAS,QAAQ;AAAA,QACjB,kBAAkB,QAAQ;AAAA,QAC1B,SAAS,QAAQ;AAAA,QACjB,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,eAAe,QAAQ;AAAA,QACvB,UAAU,QAAQ;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,gBAAgB,QAA+B;AACtD,SAAO,YAAY;AAAA,IACjB,KAAK,UAAU;AAAA,MACb,GAAG,OAAO;AAAA,MACV,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,MAAM,OAAO;AAAA,IACf,CAAC;AAAA,EACH;AACF;AAEA,SAAS,uBACP,WACQ;AACR,SAAO,SAAS,QAAQ,KAAK,eAAe,SAAS,CAAC,IAAI,OAAO,CAAC;AACpE;AAEA,SAAS,kBAAkB,YAAoB;AAC7C,SAAO,iBAAiB,MAAM,WAAW,UAAU,CAAC,CAAC;AACvD;AAEA,SAAS,YACP,WACA,MACyB;AACzB,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,YAAY,OAAO,SAAS,CAAC;AAC/D,QAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,YAAM,IAAI,iBAAiB,WAAW,IAAI,sBAAsB;AAAA,IAClE;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAkB,OAAM;AAC7C,UAAM,IAAI,iBAAiB,WAAW,IAAI,kBAAkB;AAAA,EAC9D;AACF;AAEA,SAAS,cACP,OACA,OACA,MACyB;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,EAAE;AAAA,EAChE;AACF;AAEA,SAAS,wBACP,OACoB;AACpB,QAAM,UAAU,MAAM;AACtB,MACE,YAAY,QACZ,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,GACrB;AACA,UAAM,IAAI,iBAAiB,+CAA+C;AAAA,EAC5E;AACA,QAAM,SAAS;AACf,MAAI,OAAO,MAAM,GAAG;AAClB,UAAM,IAAI;AAAA,MACR,oCAAoC,OAAO,OAAO,CAAC,CAAC;AAAA,IACtD;AAAA,EACF;AACA,aAAW,SAAS;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AACD,kBAAc,OAAO,KAAK,GAAG,OAAO,aAAa;AAAA,EACnD;AACA,MACE,OAAO,kBAAkB,QACzB,OAAO,OAAO,kBAAkB,UAChC;AACA,UAAM,IAAI,iBAAiB,4CAA4C;AAAA,EACzE;AACA,gBAAc,MAAM,MAAM,QAAQ,sBAAsB;AACxD,SAAO;AACT;AAEA,SAAS,eAAe,OAA2C;AACjE,MAAI,MAAM,MAAM,GAAG;AACjB,UAAM,IAAI;AAAA,MACR,mCAAmC,OAAO,MAAM,CAAC,CAAC;AAAA,IACpD;AAAA,EACF;AACA,aAAW,SAAS,CAAC,SAAS,SAAS,aAAa,GAAG;AACrD,kBAAc,MAAM,KAAK,GAAG,OAAO,YAAY;AAAA,EACjD;AACA,MAAI,OAAO,MAAM,SAAS,UAAU;AAClC,UAAM,IAAI,iBAAiB,kCAAkC;AAAA,EAC/D;AACA,MAAI,MAAM,YAAY,QAAQ,OAAO,MAAM,YAAY,UAAU;AAC/D,UAAM,IAAI,iBAAiB,qCAAqC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,eAAsB,eACpB,GACA,kBACA,OACiB;AACjB,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B,QAAQ,kBAAkB,OAAO;AAAA,IACjC,iBAAiB,CAAC;AAAA,EACpB;AACA,SAAO,uBAAuB,SAAS;AACzC;AAEA,eAAsB,eACpB,YACA,YACA,OAC6B;AAC7B,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B;AAAA,IACA,kBAAkB,UAAU;AAAA,EAC9B;AACA,SAAO;AAAA,IACL,YAAY,WAAW,sBAAsB;AAAA,EAC/C;AACF;AAEA,eAAsB,cACpB,GACA,kBACA,OAC0D;AAC1D,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B,QAAQ,kBAAkB,OAAO;AAAA,IACjC,gBAAgB,CAAC;AAAA,EACnB;AACA,QAAM,aAAa,uBAAuB,SAAS;AACnD,QAAM,QAAQ,WAAW,UAAU;AACnC,SAAO,EAAE,YAAY,MAAM,WAAW,OAAO,KAAK,CAAC,GAAG,MAAM,MAAM,OAAO;AAC3E;AAEA,eAAsB,cACpB,YACA,mBACA,OACA,QACoB;AACpB,QAAM,YAAY,MAAM,MAAM;AAAA,IAC5B,QAAQ,mBAAmB,OAAO;AAAA,IAClC,kBAAkB,UAAU;AAAA,EAC9B;AACA,QAAM,SAAS,eAAe,YAAY,WAAW,YAAY,CAAC;AAClE,MAAI,OAAO,UAAU,OAAO,OAAO;AACjC,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,KAAK,mCAAmC,OAAO,KAAK;AAAA,IAC9E;AAAA,EACF;AACA,MAAI,OAAO,UAAU,UAAa,OAAO,UAAU,OAAO,OAAO;AAC/D,UAAM,IAAI;AAAA,MACR,oBAAoB,OAAO,KAAK,kCAAkC,OAAO,KAAK;AAAA,IAChF;AAAA,EACF;AACA,MAAI,OAAO,YAAY,UAAa,OAAO,YAAY,OAAO,SAAS;AACrE,UAAM,IAAI;AAAA,MACR,sBAAsB,OAAO,OAAO,OAAO,CAAC,oCAAoC,OAAO,OAAO,OAAO,CAAC;AAAA,IACxG;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/direct/escrow-payment.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/direct/escrow-payment.ts"],"sourcesContent":["/**\n * Escrow-backed payment authorization for the Direct Data Controller.\n *\n * @remarks\n * Builds on the DPv2 escrow surface added in `protocol/escrow`. When a Personal\n * Server read returns `402 Payment Required`, the controller settles the\n * challenged operation through the escrow gateway:\n *\n *  1. Sign the challenge's `GenericPayment` EIP-712 message with the app key.\n *  2. POST it to the gateway's `/v1/escrow/pay` via {@link EscrowGatewayClient}.\n *  3. Map the gateway's {@link EscrowPayResult} into a typed\n *     {@link DirectPaymentReceipt} for the caller to inspect.\n *\n * This module supports legacy `\"grant\"` operations and receipt-bound\n * `\"data_access\"` operations. It adapts the escrow `payForOp` flow to the\n * direct-read use case; it does not define its own payment scheme.\n *\n * @category Direct\n * @module direct/escrow-payment\n */\n\nimport {\n  GENERIC_PAYMENT_TYPES,\n  NATIVE_ASSET_ADDRESS,\n  genericPaymentDomain,\n  type EscrowAccessRecord,\n  type EscrowPaymentClient,\n  type EscrowPayResult,\n  type PaymentBreakdown,\n} from \"../protocol/escrow\";\nimport type {\n  DirectFeeBreakdown,\n  DirectPaymentReceipt,\n  DirectPaymentResponseMetadata,\n  PersonalServerPaymentOperation,\n  PersonalServerPaymentRequired,\n} from \"./types\";\n\n/** The escrow `GenericPayment.opType` used for grant-lifecycle payments. */\nexport const GRANT_OP_TYPE = \"grant\" as const;\n/** The escrow `GenericPayment.opType` used for receipt-bound data access. */\nexport const DATA_ACCESS_OP_TYPE = \"data_access\" as const;\n\n/**\n * EIP-712 typed-data signer (e.g. viem `account.signTypedData`).\n *\n * @remarks\n * Kept structurally minimal so any viem account/wallet client satisfies it\n * without the SDK depending on viem's exact `signTypedData` overload set.\n */\nexport type SignTypedDataFn = (args: {\n  domain: ReturnType<typeof genericPaymentDomain>;\n  types: typeof GENERIC_PAYMENT_TYPES;\n  primaryType: \"GenericPayment\";\n  message: {\n    payerAddress: `0x${string}`;\n    opType: string;\n    opId: `0x${string}`;\n    asset: `0x${string}`;\n    amount: bigint;\n    paymentNonce: bigint;\n  };\n}) => Promise<`0x${string}`>;\n\n/** Supplies a monotonically-increasing payment nonce per payer. */\nexport type PaymentNonceSource = (\n  payerAddress: string,\n) => Promise<bigint> | bigint;\n\ninterface EscrowPaymentMessage {\n  payerAddress: `0x${string}`;\n  opType: typeof GRANT_OP_TYPE | typeof DATA_ACCESS_OP_TYPE;\n  opId: `0x${string}`;\n  asset: `0x${string}`;\n  amount: string;\n  paymentNonce: string;\n}\n\ninterface SignedEscrowPayment {\n  message: EscrowPaymentMessage;\n  signature: `0x${string}`;\n  accessRecord?: EscrowAccessRecord;\n}\n\ninterface X402PaymentHeader {\n  x402Version: 1;\n  scheme: \"vana-escrow-grant\";\n  network: string;\n  payload: SignedEscrowPayment;\n}\n\n/** Configuration required to sign an escrow X-PAYMENT header. */\nexport interface EscrowPaymentHeaderConfig {\n  /** Deployed `DataPortabilityEscrow` contract address. */\n  escrowContract: `0x${string}`;\n  /** Chain id for the EIP-712 domain (1480 mainnet, 14800 moksha). */\n  chainId: number;\n  /** App EIP-712 signer. */\n  signTypedData: SignTypedDataFn;\n  /**\n   * Supplies the next payment nonce for a payer. Defaults to a process-local\n   * monotonic counter seeded at 1. Provide a durable source in production so\n   * nonces survive restarts (the gateway rejects reused (payer, nonce) pairs).\n   */\n  nonceSource?: PaymentNonceSource;\n}\n\n/**\n * Escrow settlement configuration for gateway authorization.\n *\n * @remarks\n * Extends the header-signing boundary with the gateway client used by\n * {@link authorizeEscrowPayment}. Existing controller and legacy wrapper\n * callers can continue to provide this full configuration.\n */\nexport interface EscrowPaymentConfig extends EscrowPaymentHeaderConfig {\n  /** Client for the gateway escrow endpoints (`/v1/escrow/*`). */\n  client: EscrowPaymentClient;\n}\n\n/** Map the gateway {@link PaymentBreakdown} into the public {@link DirectFeeBreakdown}. */\nexport function toDirectFeeBreakdown(\n  breakdown: PaymentBreakdown,\n): DirectFeeBreakdown {\n  return {\n    registrationFee: breakdown.registrationFee,\n    dataAccessFee: breakdown.dataAccessFee,\n    registrationPaid: breakdown.registrationPaid,\n  };\n}\n\n/** Map a gateway {@link EscrowPayResult} into the public {@link DirectPaymentReceipt}. */\nexport function toDirectPaymentReceipt(\n  result: EscrowPayResult,\n): DirectPaymentReceipt {\n  return {\n    opType: result.opType,\n    opId: result.opId,\n    asset: result.asset,\n    amount: result.amount,\n    paymentNonce: result.paymentNonce,\n    breakdown: toDirectFeeBreakdown(result.breakdown),\n    paidAt: result.paidAt,\n  };\n}\n\n/** Default in-process monotonic nonce counter (seeded at 1 per payer). */\nexport function createDefaultNonceSource(): PaymentNonceSource {\n  const counters = new Map<string, bigint>();\n  return (payerAddress: string): bigint => {\n    const key = payerAddress.toLowerCase();\n    const next = (counters.get(key) ?? 0n) + 1n;\n    counters.set(key, next);\n    return next;\n  };\n}\n\nconst processLocalNonceSource = createDefaultNonceSource();\nconst UINT256_MAX = (1n << 256n) - 1n;\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\nconst BYTES32_RE = /^0x[0-9a-fA-F]{64}$/;\nconst SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;\n\nfunction isUint256Decimal(value: string, allowZero: boolean): boolean {\n  const pattern = allowZero ? /^(0|[1-9]\\d*)$/ : /^[1-9]\\d*$/;\n  return (\n    value.length <= UINT256_MAX.toString().length &&\n    pattern.test(value) &&\n    BigInt(value) <= UINT256_MAX\n  );\n}\n\nfunction isValidAccessRecord(record: EscrowAccessRecord): boolean {\n  return (\n    BYTES32_RE.test(record.dataPointId) &&\n    isUint256Decimal(record.version, false) &&\n    ADDRESS_RE.test(record.accessor) &&\n    BYTES32_RE.test(record.recordId) &&\n    SIGNATURE_RE.test(record.signature)\n  );\n}\n\nfunction validateSigningOperation(\n  payerAddress: `0x${string}`,\n  required: PersonalServerPaymentOperation,\n): void {\n  if (!ADDRESS_RE.test(payerAddress)) {\n    throw new Error(\"Payment payer must be a 20-byte EVM address\");\n  }\n  if (!BYTES32_RE.test(required.opId)) {\n    throw new Error(\"Payment operation id must be a 32-byte hex value\");\n  }\n  if (!ADDRESS_RE.test(required.asset || NATIVE_ASSET_ADDRESS)) {\n    throw new Error(\"Payment asset must be a 20-byte EVM address\");\n  }\n  if (!isUint256Decimal(required.amount, true)) {\n    throw new Error(\"Payment amount must be a canonical uint256 decimal\");\n  }\n  if (\n    required.paymentNonce !== undefined &&\n    !isUint256Decimal(required.paymentNonce, false)\n  ) {\n    throw new Error(\"Payment nonce must be a positive uint256 decimal\");\n  }\n\n  const accessRecord = required.accessRecord;\n  if (required.opType === DATA_ACCESS_OP_TYPE) {\n    if (!accessRecord || !isValidAccessRecord(accessRecord)) {\n      throw new Error(\"Data-access payment requires a valid access record\");\n    }\n    if (required.opId.toLowerCase() !== accessRecord.recordId.toLowerCase()) {\n      throw new Error(\n        \"Data-access payment operation id must equal the access record id\",\n      );\n    }\n    if (accessRecord.accessor.toLowerCase() !== payerAddress.toLowerCase()) {\n      throw new Error(\n        \"Data-access payment accessor must equal the payment payer address\",\n      );\n    }\n    return;\n  }\n\n  if (required.amount === \"0\") {\n    if (\n      !accessRecord ||\n      !isValidAccessRecord(accessRecord) ||\n      accessRecord.accessor.toLowerCase() !== payerAddress.toLowerCase()\n    ) {\n      throw new Error(\n        \"Zero-amount grant payments require a valid access record for the payer\",\n      );\n    }\n  }\n}\n\nfunction base64EncodeJson(value: unknown): string {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nfunction base64DecodeJson(value: string): unknown {\n  const binary = atob(value);\n  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));\n  return JSON.parse(new TextDecoder().decode(bytes));\n}\n\nasync function signEscrowPayment(params: {\n  payerAddress: `0x${string}`;\n  required: PersonalServerPaymentOperation;\n  config: EscrowPaymentHeaderConfig;\n}): Promise<SignedEscrowPayment> {\n  const { payerAddress, required, config } = params;\n  validateSigningOperation(payerAddress, required);\n  const nonceSource = config.nonceSource ?? processLocalNonceSource;\n  const paymentNonce = BigInt(\n    required.paymentNonce ?? (await nonceSource(payerAddress)),\n  );\n  const asset = (required.asset || NATIVE_ASSET_ADDRESS) as `0x${string}`;\n  const opId = required.opId as `0x${string}`;\n  const amount = BigInt(required.amount);\n  if (amount < 0n || amount > UINT256_MAX) {\n    throw new Error(\"Payment amount must be a uint256\");\n  }\n  if (paymentNonce <= 0n || paymentNonce > UINT256_MAX) {\n    throw new Error(\"Payment nonce must be a positive uint256\");\n  }\n\n  const message = {\n    payerAddress,\n    opType: required.opType,\n    opId,\n    asset,\n    amount,\n    paymentNonce,\n  };\n\n  const signature = await config.signTypedData({\n    domain: genericPaymentDomain(config.chainId, config.escrowContract),\n    types: GENERIC_PAYMENT_TYPES,\n    primaryType: \"GenericPayment\",\n    message,\n  });\n\n  return {\n    message: {\n      ...message,\n      amount: amount.toString(),\n      paymentNonce: paymentNonce.toString(),\n    },\n    signature,\n    ...(required.accessRecord ? { accessRecord: required.accessRecord } : {}),\n  };\n}\n\n/**\n * Build the canonical X-PAYMENT header for a validated escrow operation.\n *\n * @remarks\n * Supports both legacy grant payments and receipt-bound data-access payments.\n * Signing is injected through {@link EscrowPaymentHeaderConfig.signTypedData}.\n */\nexport async function buildEscrowPaymentHeader(params: {\n  /** Address whose escrow balance pays for the operation. */\n  payerAddress: `0x${string}`;\n  /** Validated operation parsed from the Personal Server challenge. */\n  required: PersonalServerPaymentOperation;\n  /** Escrow contract, chain, signer, and nonce configuration. */\n  config: EscrowPaymentHeaderConfig;\n}): Promise<string> {\n  const network = params.required.network ?? `vana:${params.config.chainId}`;\n  if (network !== `vana:${params.config.chainId}`) {\n    throw new Error(\"Payment network must match the configured chain\");\n  }\n\n  const signed = await signEscrowPayment(params);\n  const payment: X402PaymentHeader = {\n    x402Version: 1,\n    scheme: \"vana-escrow-grant\",\n    network,\n    payload: signed,\n  };\n  return base64EncodeJson(payment);\n}\n\n/** Build a legacy grant X-PAYMENT header. */\nexport async function buildGrantPaymentHeader(params: {\n  payerAddress: `0x${string}`;\n  required: PersonalServerPaymentRequired;\n  config: EscrowPaymentConfig;\n}): Promise<string> {\n  return buildEscrowPaymentHeader({\n    ...params,\n    required: {\n      ...params.required,\n      opType: GRANT_OP_TYPE,\n      opId: params.required.grantId,\n    },\n  });\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : undefined;\n}\n\nfunction stringField(\n  value: Record<string, unknown> | undefined,\n  key: string,\n): string | undefined {\n  const field = value?.[key];\n  return typeof field === \"string\" ? field : undefined;\n}\n\nfunction isCanonicalIsoTimestamp(value: string): boolean {\n  try {\n    return new Date(value).toISOString() === value;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Parse shape-validated payment response metadata echoed by a Personal Server.\n *\n * @remarks\n * This metadata is not authenticated by the gateway. It is suitable for\n * display and debugging, not as proof that a payment occurred.\n */\nexport function paymentResponseMetadataFromHeader(\n  header: string | null | undefined,\n): DirectPaymentResponseMetadata | undefined {\n  if (!header) return undefined;\n  try {\n    const result = asRecord(base64DecodeJson(header));\n    const breakdown = asRecord(result?.breakdown);\n    const opType = stringField(result, \"opType\");\n    const opId = stringField(result, \"opId\");\n    const payerAddress = stringField(result, \"payerAddress\");\n    const asset = stringField(result, \"asset\");\n    const amount = stringField(result, \"amount\");\n    const paymentNonce = stringField(result, \"paymentNonce\");\n    const registrationFee = stringField(breakdown, \"registrationFee\");\n    const dataAccessFee = stringField(breakdown, \"dataAccessFee\");\n    const paidAt = stringField(result, \"paidAt\");\n    if (\n      result?.success !== true ||\n      !opType ||\n      !opId ||\n      !BYTES32_RE.test(opId) ||\n      !payerAddress ||\n      !ADDRESS_RE.test(payerAddress) ||\n      !asset ||\n      !ADDRESS_RE.test(asset) ||\n      !amount ||\n      !isUint256Decimal(amount, true) ||\n      !paymentNonce ||\n      !isUint256Decimal(paymentNonce, false) ||\n      !registrationFee ||\n      !isUint256Decimal(registrationFee, true) ||\n      !dataAccessFee ||\n      !isUint256Decimal(dataAccessFee, true) ||\n      typeof breakdown?.registrationPaid !== \"boolean\" ||\n      !paidAt ||\n      !isCanonicalIsoTimestamp(paidAt)\n    ) {\n      return undefined;\n    }\n    return {\n      opType,\n      opId,\n      asset,\n      amount,\n      paymentNonce,\n      breakdown: {\n        registrationFee,\n        dataAccessFee,\n        registrationPaid: breakdown.registrationPaid,\n      },\n      paidAt,\n    };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * @deprecated Use {@link paymentResponseMetadataFromHeader}. A Personal\n * Server response header is untrusted metadata, not a gateway-authenticated\n * receipt.\n */\nexport function paymentReceiptFromHeader(\n  header: string | null | undefined,\n): DirectPaymentResponseMetadata | undefined {\n  return paymentResponseMetadataFromHeader(header);\n}\n\n/**\n * Authorize an escrow payment for a grant data-access fee.\n *\n * @param params - The payment requirement, the payer address, and escrow config.\n * @returns The gateway's {@link EscrowPayResult} as a typed\n * {@link DirectPaymentReceipt}.\n */\nexport async function authorizeGrantPayment(params: {\n  payerAddress: `0x${string}`;\n  required: PersonalServerPaymentRequired;\n  config: EscrowPaymentConfig;\n}): Promise<DirectPaymentReceipt> {\n  return authorizeEscrowPayment({\n    ...params,\n    required: {\n      ...params.required,\n      opType: GRANT_OP_TYPE,\n      opId: params.required.grantId,\n    },\n  });\n}\n\n/**\n * Authorize a validated grant or data-access operation through the escrow\n * gateway.\n */\nexport async function authorizeEscrowPayment(params: {\n  /** Address whose escrow balance pays for the operation. */\n  payerAddress: `0x${string}`;\n  /** Validated operation to authorize. */\n  required: PersonalServerPaymentOperation;\n  /** Escrow gateway and signing configuration. */\n  config: EscrowPaymentConfig;\n}): Promise<DirectPaymentReceipt> {\n  const { payerAddress, config } = params;\n  const signed = await signEscrowPayment(params);\n\n  const result = await config.client.payForOp({\n    payerAddress,\n    opType: signed.message.opType,\n    opId: signed.message.opId,\n    asset: signed.message.asset,\n    amount: signed.message.amount,\n    paymentNonce: signed.message.paymentNonce,\n    signature: signed.signature,\n    accessRecord: signed.accessRecord,\n  });\n\n  return toDirectPaymentReceipt(result);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBA,oBAQO;AAUA,MAAM,gBAAgB;AAEtB,MAAM,sBAAsB;AAgF5B,SAAS,qBACd,WACoB;AACpB,SAAO;AAAA,IACL,iBAAiB,UAAU;AAAA,IAC3B,eAAe,UAAU;AAAA,IACzB,kBAAkB,UAAU;AAAA,EAC9B;AACF;AAGO,SAAS,uBACd,QACsB;AACtB,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,MAAM,OAAO;AAAA,IACb,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,cAAc,OAAO;AAAA,IACrB,WAAW,qBAAqB,OAAO,SAAS;AAAA,IAChD,QAAQ,OAAO;AAAA,EACjB;AACF;AAGO,SAAS,2BAA+C;AAC7D,QAAM,WAAW,oBAAI,IAAoB;AACzC,SAAO,CAAC,iBAAiC;AACvC,UAAM,MAAM,aAAa,YAAY;AACrC,UAAM,QAAQ,SAAS,IAAI,GAAG,KAAK,MAAM;AACzC,aAAS,IAAI,KAAK,IAAI;AACtB,WAAO;AAAA,EACT;AACF;AAEA,MAAM,0BAA0B,yBAAyB;AACzD,MAAM,eAAe,MAAM,QAAQ;AACnC,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,eAAe;AAErB,SAAS,iBAAiB,OAAe,WAA6B;AACpE,QAAM,UAAU,YAAY,mBAAmB;AAC/C,SACE,MAAM,UAAU,YAAY,SAAS,EAAE,UACvC,QAAQ,KAAK,KAAK,KAClB,OAAO,KAAK,KAAK;AAErB;AAEA,SAAS,oBAAoB,QAAqC;AAChE,SACE,WAAW,KAAK,OAAO,WAAW,KAClC,iBAAiB,OAAO,SAAS,KAAK,KACtC,WAAW,KAAK,OAAO,QAAQ,KAC/B,WAAW,KAAK,OAAO,QAAQ,KAC/B,aAAa,KAAK,OAAO,SAAS;AAEtC;AAEA,SAAS,yBACP,cACA,UACM;AACN,MAAI,CAAC,WAAW,KAAK,YAAY,GAAG;AAClC,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,MAAI,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG;AACnC,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,MAAI,CAAC,WAAW,KAAK,SAAS,SAAS,kCAAoB,GAAG;AAC5D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,MAAI,CAAC,iBAAiB,SAAS,QAAQ,IAAI,GAAG;AAC5C,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,MACE,SAAS,iBAAiB,UAC1B,CAAC,iBAAiB,SAAS,cAAc,KAAK,GAC9C;AACA,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,QAAM,eAAe,SAAS;AAC9B,MAAI,SAAS,WAAW,qBAAqB;AAC3C,QAAI,CAAC,gBAAgB,CAAC,oBAAoB,YAAY,GAAG;AACvD,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,QAAI,SAAS,KAAK,YAAY,MAAM,aAAa,SAAS,YAAY,GAAG;AACvE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,SAAS,YAAY,MAAM,aAAa,YAAY,GAAG;AACtE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,QACE,CAAC,gBACD,CAAC,oBAAoB,YAAY,KACjC,aAAa,SAAS,YAAY,MAAM,aAAa,YAAY,GACjE;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,OAAwB;AAChD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,iBAAiB,OAAwB;AAChD,QAAM,SAAS,KAAK,KAAK;AACzB,QAAM,QAAQ,WAAW,KAAK,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AAClE,SAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACnD;AAEA,eAAe,kBAAkB,QAIA;AAC/B,QAAM,EAAE,cAAc,UAAU,OAAO,IAAI;AAC3C,2BAAyB,cAAc,QAAQ;AAC/C,QAAM,cAAc,OAAO,eAAe;AAC1C,QAAM,eAAe;AAAA,IACnB,SAAS,gBAAiB,MAAM,YAAY,YAAY;AAAA,EAC1D;AACA,QAAM,QAAS,SAAS,SAAS;AACjC,QAAM,OAAO,SAAS;AACtB,QAAM,SAAS,OAAO,SAAS,MAAM;AACrC,MAAI,SAAS,MAAM,SAAS,aAAa;AACvC,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,MAAI,gBAAgB,MAAM,eAAe,aAAa;AACpD,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,OAAO,cAAc;AAAA,IAC3C,YAAQ,oCAAqB,OAAO,SAAS,OAAO,cAAc;AAAA,IAClE,OAAO;AAAA,IACP,aAAa;AAAA,IACb;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,SAAS;AAAA,MACP,GAAG;AAAA,MACH,QAAQ,OAAO,SAAS;AAAA,MACxB,cAAc,aAAa,SAAS;AAAA,IACtC;AAAA,IACA;AAAA,IACA,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;AAAA,EACzE;AACF;AASA,eAAsB,yBAAyB,QAO3B;AAClB,QAAM,UAAU,OAAO,SAAS,WAAW,QAAQ,OAAO,OAAO,OAAO;AACxE,MAAI,YAAY,QAAQ,OAAO,OAAO,OAAO,IAAI;AAC/C,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,QAAM,SAAS,MAAM,kBAAkB,MAAM;AAC7C,QAAM,UAA6B;AAAA,IACjC,aAAa;AAAA,IACb,QAAQ;AAAA,IACR;AAAA,IACA,SAAS;AAAA,EACX;AACA,SAAO,iBAAiB,OAAO;AACjC;AAGA,eAAsB,wBAAwB,QAI1B;AAClB,SAAO,yBAAyB;AAAA,IAC9B,GAAG;AAAA,IACH,UAAU;AAAA,MACR,GAAG,OAAO;AAAA,MACV,QAAQ;AAAA,MACR,MAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,SAAS,OAAqD;AACrE,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD;AACN;AAEA,SAAS,YACP,OACA,KACoB;AACpB,QAAM,QAAQ,QAAQ,GAAG;AACzB,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,wBAAwB,OAAwB;AACvD,MAAI;AACF,WAAO,IAAI,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,kCACd,QAC2C;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,SAAS,SAAS,iBAAiB,MAAM,CAAC;AAChD,UAAM,YAAY,SAAS,QAAQ,SAAS;AAC5C,UAAM,SAAS,YAAY,QAAQ,QAAQ;AAC3C,UAAM,OAAO,YAAY,QAAQ,MAAM;AACvC,UAAM,eAAe,YAAY,QAAQ,cAAc;AACvD,UAAM,QAAQ,YAAY,QAAQ,OAAO;AACzC,UAAM,SAAS,YAAY,QAAQ,QAAQ;AAC3C,UAAM,eAAe,YAAY,QAAQ,cAAc;AACvD,UAAM,kBAAkB,YAAY,WAAW,iBAAiB;AAChE,UAAM,gBAAgB,YAAY,WAAW,eAAe;AAC5D,UAAM,SAAS,YAAY,QAAQ,QAAQ;AAC3C,QACE,QAAQ,YAAY,QACpB,CAAC,UACD,CAAC,QACD,CAAC,WAAW,KAAK,IAAI,KACrB,CAAC,gBACD,CAAC,WAAW,KAAK,YAAY,KAC7B,CAAC,SACD,CAAC,WAAW,KAAK,KAAK,KACtB,CAAC,UACD,CAAC,iBAAiB,QAAQ,IAAI,KAC9B,CAAC,gBACD,CAAC,iBAAiB,cAAc,KAAK,KACrC,CAAC,mBACD,CAAC,iBAAiB,iBAAiB,IAAI,KACvC,CAAC,iBACD,CAAC,iBAAiB,eAAe,IAAI,KACrC,OAAO,WAAW,qBAAqB,aACvC,CAAC,UACD,CAAC,wBAAwB,MAAM,GAC/B;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,QACT;AAAA,QACA;AAAA,QACA,kBAAkB,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,yBACd,QAC2C;AAC3C,SAAO,kCAAkC,MAAM;AACjD;AASA,eAAsB,sBAAsB,QAIV;AAChC,SAAO,uBAAuB;AAAA,IAC5B,GAAG;AAAA,IACH,UAAU;AAAA,MACR,GAAG,OAAO;AAAA,MACV,QAAQ;AAAA,MACR,MAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF,CAAC;AACH;AAMA,eAAsB,uBAAuB,QAOX;AAChC,QAAM,EAAE,cAAc,OAAO,IAAI;AACjC,QAAM,SAAS,MAAM,kBAAkB,MAAM;AAE7C,QAAM,SAAS,MAAM,OAAO,OAAO,SAAS;AAAA,IAC1C;AAAA,IACA,QAAQ,OAAO,QAAQ;AAAA,IACvB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO,QAAQ;AAAA,IACtB,QAAQ,OAAO,QAAQ;AAAA,IACvB,cAAc,OAAO,QAAQ;AAAA,IAC7B,WAAW,OAAO;AAAA,IAClB,cAAc,OAAO;AAAA,EACvB,CAAC;AAED,SAAO,uBAAuB,MAAM;AACtC;","names":[]}
+{"version":3,"sources":["../../src/direct/escrow-payment.ts"],"sourcesContent":["/**\n * Escrow-backed payment authorization for the Direct Data Controller.\n *\n * @remarks\n * Builds on the DPv2 escrow surface added in `protocol/escrow`. When a Personal\n * Server read returns `402 Payment Required`, the controller settles the\n * challenged operation through the escrow gateway:\n *\n *  1. Sign the challenge's `GenericPayment` EIP-712 message with the app key.\n *  2. POST it to the gateway's `/v1/escrow/pay` via {@link EscrowGatewayClient}.\n *  3. Map the gateway's {@link EscrowPayResult} into a typed\n *     {@link DirectPaymentReceipt} for the caller to inspect.\n *\n * This module supports legacy `\"grant\"` operations and receipt-bound\n * `\"data_access\"` operations. It adapts the escrow `payForOp` flow to the\n * direct-read use case; it does not define its own payment scheme.\n *\n * @category Direct\n * @module direct/escrow-payment\n */\n\nimport {\n  GENERIC_PAYMENT_TYPES,\n  NATIVE_ASSET_ADDRESS,\n  genericPaymentDomain,\n  type EscrowAccessRecord,\n  type EscrowGatewayClient,\n  type EscrowPayResult,\n  type PaymentBreakdown,\n} from \"../protocol/escrow\";\nimport type {\n  DirectFeeBreakdown,\n  DirectPaymentReceipt,\n  DirectPaymentResponseMetadata,\n  PersonalServerPaymentOperation,\n  PersonalServerPaymentRequired,\n} from \"./types\";\n\n/** The escrow `GenericPayment.opType` used for grant-lifecycle payments. */\nexport const GRANT_OP_TYPE = \"grant\" as const;\n/** The escrow `GenericPayment.opType` used for receipt-bound data access. */\nexport const DATA_ACCESS_OP_TYPE = \"data_access\" as const;\n\n/**\n * EIP-712 typed-data signer (e.g. viem `account.signTypedData`).\n *\n * @remarks\n * Kept structurally minimal so any viem account/wallet client satisfies it\n * without the SDK depending on viem's exact `signTypedData` overload set.\n */\nexport type SignTypedDataFn = (args: {\n  domain: ReturnType<typeof genericPaymentDomain>;\n  types: typeof GENERIC_PAYMENT_TYPES;\n  primaryType: \"GenericPayment\";\n  message: {\n    payerAddress: `0x${string}`;\n    opType: string;\n    opId: `0x${string}`;\n    asset: `0x${string}`;\n    amount: bigint;\n    paymentNonce: bigint;\n  };\n}) => Promise<`0x${string}`>;\n\n/** Supplies a monotonically-increasing payment nonce per payer. */\nexport type PaymentNonceSource = (\n  payerAddress: string,\n) => Promise<bigint> | bigint;\n\ninterface EscrowPaymentMessage {\n  payerAddress: `0x${string}`;\n  opType: typeof GRANT_OP_TYPE | typeof DATA_ACCESS_OP_TYPE;\n  opId: `0x${string}`;\n  asset: `0x${string}`;\n  amount: string;\n  paymentNonce: string;\n}\n\ninterface SignedEscrowPayment {\n  message: EscrowPaymentMessage;\n  signature: `0x${string}`;\n  accessRecord?: EscrowAccessRecord;\n}\n\ninterface X402PaymentHeader {\n  x402Version: 1;\n  scheme: \"vana-escrow-grant\";\n  network: string;\n  payload: SignedEscrowPayment;\n}\n\n/** Configuration required to sign an escrow X-PAYMENT header. */\nexport interface EscrowPaymentHeaderConfig {\n  /** Deployed `DataPortabilityEscrow` contract address. */\n  escrowContract: `0x${string}`;\n  /** Chain id for the EIP-712 domain (1480 mainnet, 14800 moksha). */\n  chainId: number;\n  /** App EIP-712 signer. */\n  signTypedData: SignTypedDataFn;\n  /**\n   * Supplies the next payment nonce for a payer. Defaults to a process-local\n   * monotonic counter seeded at 1. Provide a durable source in production so\n   * nonces survive restarts (the gateway rejects reused (payer, nonce) pairs).\n   */\n  nonceSource?: PaymentNonceSource;\n}\n\n/**\n * Escrow settlement configuration for gateway authorization.\n *\n * @remarks\n * Extends the header-signing boundary with the gateway client used by\n * {@link authorizeEscrowPayment}. Existing controller and legacy wrapper\n * callers can continue to provide this full configuration.\n */\nexport interface EscrowPaymentConfig extends EscrowPaymentHeaderConfig {\n  /** Client for the gateway escrow endpoints (`/v1/escrow/*`). */\n  client: EscrowGatewayClient;\n}\n\n/** Map the gateway {@link PaymentBreakdown} into the public {@link DirectFeeBreakdown}. */\nexport function toDirectFeeBreakdown(\n  breakdown: PaymentBreakdown,\n): DirectFeeBreakdown {\n  return {\n    registrationFee: breakdown.registrationFee,\n    dataAccessFee: breakdown.dataAccessFee,\n    registrationPaid: breakdown.registrationPaid,\n  };\n}\n\n/** Map a gateway {@link EscrowPayResult} into the public {@link DirectPaymentReceipt}. */\nexport function toDirectPaymentReceipt(\n  result: EscrowPayResult,\n): DirectPaymentReceipt {\n  return {\n    opType: result.opType,\n    opId: result.opId,\n    asset: result.asset,\n    amount: result.amount,\n    paymentNonce: result.paymentNonce,\n    breakdown: toDirectFeeBreakdown(result.breakdown),\n    paidAt: result.paidAt,\n  };\n}\n\n/** Default in-process monotonic nonce counter (seeded at 1 per payer). */\nexport function createDefaultNonceSource(): PaymentNonceSource {\n  const counters = new Map<string, bigint>();\n  return (payerAddress: string): bigint => {\n    const key = payerAddress.toLowerCase();\n    const next = (counters.get(key) ?? 0n) + 1n;\n    counters.set(key, next);\n    return next;\n  };\n}\n\nconst processLocalNonceSource = createDefaultNonceSource();\nconst UINT256_MAX = (1n << 256n) - 1n;\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\nconst BYTES32_RE = /^0x[0-9a-fA-F]{64}$/;\nconst SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;\n\nfunction isUint256Decimal(value: string, allowZero: boolean): boolean {\n  const pattern = allowZero ? /^(0|[1-9]\\d*)$/ : /^[1-9]\\d*$/;\n  return (\n    value.length <= UINT256_MAX.toString().length &&\n    pattern.test(value) &&\n    BigInt(value) <= UINT256_MAX\n  );\n}\n\nfunction isValidAccessRecord(record: EscrowAccessRecord): boolean {\n  return (\n    BYTES32_RE.test(record.dataPointId) &&\n    isUint256Decimal(record.version, false) &&\n    ADDRESS_RE.test(record.accessor) &&\n    BYTES32_RE.test(record.recordId) &&\n    SIGNATURE_RE.test(record.signature)\n  );\n}\n\nfunction validateSigningOperation(\n  payerAddress: `0x${string}`,\n  required: PersonalServerPaymentOperation,\n): void {\n  if (!ADDRESS_RE.test(payerAddress)) {\n    throw new Error(\"Payment payer must be a 20-byte EVM address\");\n  }\n  if (!BYTES32_RE.test(required.opId)) {\n    throw new Error(\"Payment operation id must be a 32-byte hex value\");\n  }\n  if (!ADDRESS_RE.test(required.asset || NATIVE_ASSET_ADDRESS)) {\n    throw new Error(\"Payment asset must be a 20-byte EVM address\");\n  }\n  if (!isUint256Decimal(required.amount, true)) {\n    throw new Error(\"Payment amount must be a canonical uint256 decimal\");\n  }\n  if (\n    required.paymentNonce !== undefined &&\n    !isUint256Decimal(required.paymentNonce, false)\n  ) {\n    throw new Error(\"Payment nonce must be a positive uint256 decimal\");\n  }\n\n  const accessRecord = required.accessRecord;\n  if (required.opType === DATA_ACCESS_OP_TYPE) {\n    if (!accessRecord || !isValidAccessRecord(accessRecord)) {\n      throw new Error(\"Data-access payment requires a valid access record\");\n    }\n    if (required.opId.toLowerCase() !== accessRecord.recordId.toLowerCase()) {\n      throw new Error(\n        \"Data-access payment operation id must equal the access record id\",\n      );\n    }\n    if (accessRecord.accessor.toLowerCase() !== payerAddress.toLowerCase()) {\n      throw new Error(\n        \"Data-access payment accessor must equal the payment payer address\",\n      );\n    }\n    return;\n  }\n\n  if (required.amount === \"0\") {\n    if (\n      !accessRecord ||\n      !isValidAccessRecord(accessRecord) ||\n      accessRecord.accessor.toLowerCase() !== payerAddress.toLowerCase()\n    ) {\n      throw new Error(\n        \"Zero-amount grant payments require a valid access record for the payer\",\n      );\n    }\n  }\n}\n\nfunction base64EncodeJson(value: unknown): string {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary);\n}\n\nfunction base64DecodeJson(value: string): unknown {\n  const binary = atob(value);\n  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));\n  return JSON.parse(new TextDecoder().decode(bytes));\n}\n\nasync function signEscrowPayment(params: {\n  payerAddress: `0x${string}`;\n  required: PersonalServerPaymentOperation;\n  config: EscrowPaymentHeaderConfig;\n}): Promise<SignedEscrowPayment> {\n  const { payerAddress, required, config } = params;\n  validateSigningOperation(payerAddress, required);\n  const nonceSource = config.nonceSource ?? processLocalNonceSource;\n  const paymentNonce = BigInt(\n    required.paymentNonce ?? (await nonceSource(payerAddress)),\n  );\n  const asset = (required.asset || NATIVE_ASSET_ADDRESS) as `0x${string}`;\n  const opId = required.opId as `0x${string}`;\n  const amount = BigInt(required.amount);\n  if (amount < 0n || amount > UINT256_MAX) {\n    throw new Error(\"Payment amount must be a uint256\");\n  }\n  if (paymentNonce <= 0n || paymentNonce > UINT256_MAX) {\n    throw new Error(\"Payment nonce must be a positive uint256\");\n  }\n\n  const message = {\n    payerAddress,\n    opType: required.opType,\n    opId,\n    asset,\n    amount,\n    paymentNonce,\n  };\n\n  const signature = await config.signTypedData({\n    domain: genericPaymentDomain(config.chainId, config.escrowContract),\n    types: GENERIC_PAYMENT_TYPES,\n    primaryType: \"GenericPayment\",\n    message,\n  });\n\n  return {\n    message: {\n      ...message,\n      amount: amount.toString(),\n      paymentNonce: paymentNonce.toString(),\n    },\n    signature,\n    ...(required.accessRecord ? { accessRecord: required.accessRecord } : {}),\n  };\n}\n\n/**\n * Build the canonical X-PAYMENT header for a validated escrow operation.\n *\n * @remarks\n * Supports both legacy grant payments and receipt-bound data-access payments.\n * Signing is injected through {@link EscrowPaymentHeaderConfig.signTypedData}.\n */\nexport async function buildEscrowPaymentHeader(params: {\n  /** Address whose escrow balance pays for the operation. */\n  payerAddress: `0x${string}`;\n  /** Validated operation parsed from the Personal Server challenge. */\n  required: PersonalServerPaymentOperation;\n  /** Escrow contract, chain, signer, and nonce configuration. */\n  config: EscrowPaymentHeaderConfig;\n}): Promise<string> {\n  const network = params.required.network ?? `vana:${params.config.chainId}`;\n  if (network !== `vana:${params.config.chainId}`) {\n    throw new Error(\"Payment network must match the configured chain\");\n  }\n\n  const signed = await signEscrowPayment(params);\n  const payment: X402PaymentHeader = {\n    x402Version: 1,\n    scheme: \"vana-escrow-grant\",\n    network,\n    payload: signed,\n  };\n  return base64EncodeJson(payment);\n}\n\n/** Build a legacy grant X-PAYMENT header. */\nexport async function buildGrantPaymentHeader(params: {\n  payerAddress: `0x${string}`;\n  required: PersonalServerPaymentRequired;\n  config: EscrowPaymentConfig;\n}): Promise<string> {\n  return buildEscrowPaymentHeader({\n    ...params,\n    required: {\n      ...params.required,\n      opType: GRANT_OP_TYPE,\n      opId: params.required.grantId,\n    },\n  });\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : undefined;\n}\n\nfunction stringField(\n  value: Record<string, unknown> | undefined,\n  key: string,\n): string | undefined {\n  const field = value?.[key];\n  return typeof field === \"string\" ? field : undefined;\n}\n\nfunction isCanonicalIsoTimestamp(value: string): boolean {\n  try {\n    return new Date(value).toISOString() === value;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Parse shape-validated payment response metadata echoed by a Personal Server.\n *\n * @remarks\n * This metadata is not authenticated by the gateway. It is suitable for\n * display and debugging, not as proof that a payment occurred.\n */\nexport function paymentResponseMetadataFromHeader(\n  header: string | null | undefined,\n): DirectPaymentResponseMetadata | undefined {\n  if (!header) return undefined;\n  try {\n    const result = asRecord(base64DecodeJson(header));\n    const breakdown = asRecord(result?.breakdown);\n    const opType = stringField(result, \"opType\");\n    const opId = stringField(result, \"opId\");\n    const payerAddress = stringField(result, \"payerAddress\");\n    const asset = stringField(result, \"asset\");\n    const amount = stringField(result, \"amount\");\n    const paymentNonce = stringField(result, \"paymentNonce\");\n    const registrationFee = stringField(breakdown, \"registrationFee\");\n    const dataAccessFee = stringField(breakdown, \"dataAccessFee\");\n    const paidAt = stringField(result, \"paidAt\");\n    if (\n      result?.success !== true ||\n      !opType ||\n      !opId ||\n      !BYTES32_RE.test(opId) ||\n      !payerAddress ||\n      !ADDRESS_RE.test(payerAddress) ||\n      !asset ||\n      !ADDRESS_RE.test(asset) ||\n      !amount ||\n      !isUint256Decimal(amount, true) ||\n      !paymentNonce ||\n      !isUint256Decimal(paymentNonce, false) ||\n      !registrationFee ||\n      !isUint256Decimal(registrationFee, true) ||\n      !dataAccessFee ||\n      !isUint256Decimal(dataAccessFee, true) ||\n      typeof breakdown?.registrationPaid !== \"boolean\" ||\n      !paidAt ||\n      !isCanonicalIsoTimestamp(paidAt)\n    ) {\n      return undefined;\n    }\n    return {\n      opType,\n      opId,\n      asset,\n      amount,\n      paymentNonce,\n      breakdown: {\n        registrationFee,\n        dataAccessFee,\n        registrationPaid: breakdown.registrationPaid,\n      },\n      paidAt,\n    };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * @deprecated Use {@link paymentResponseMetadataFromHeader}. A Personal\n * Server response header is untrusted metadata, not a gateway-authenticated\n * receipt.\n */\nexport function paymentReceiptFromHeader(\n  header: string | null | undefined,\n): DirectPaymentResponseMetadata | undefined {\n  return paymentResponseMetadataFromHeader(header);\n}\n\n/**\n * Authorize an escrow payment for a grant data-access fee.\n *\n * @param params - The payment requirement, the payer address, and escrow config.\n * @returns The gateway's {@link EscrowPayResult} as a typed\n * {@link DirectPaymentReceipt}.\n */\nexport async function authorizeGrantPayment(params: {\n  payerAddress: `0x${string}`;\n  required: PersonalServerPaymentRequired;\n  config: EscrowPaymentConfig;\n}): Promise<DirectPaymentReceipt> {\n  return authorizeEscrowPayment({\n    ...params,\n    required: {\n      ...params.required,\n      opType: GRANT_OP_TYPE,\n      opId: params.required.grantId,\n    },\n  });\n}\n\n/**\n * Authorize a validated grant or data-access operation through the escrow\n * gateway.\n */\nexport async function authorizeEscrowPayment(params: {\n  /** Address whose escrow balance pays for the operation. */\n  payerAddress: `0x${string}`;\n  /** Validated operation to authorize. */\n  required: PersonalServerPaymentOperation;\n  /** Escrow gateway and signing configuration. */\n  config: EscrowPaymentConfig;\n}): Promise<DirectPaymentReceipt> {\n  const { payerAddress, config } = params;\n  const signed = await signEscrowPayment(params);\n\n  const result = await config.client.payForOp({\n    payerAddress,\n    opType: signed.message.opType,\n    opId: signed.message.opId,\n    asset: signed.message.asset,\n    amount: signed.message.amount,\n    paymentNonce: signed.message.paymentNonce,\n    signature: signed.signature,\n    accessRecord: signed.accessRecord,\n  });\n\n  return toDirectPaymentReceipt(result);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBA,oBAQO;AAUA,MAAM,gBAAgB;AAEtB,MAAM,sBAAsB;AAgF5B,SAAS,qBACd,WACoB;AACpB,SAAO;AAAA,IACL,iBAAiB,UAAU;AAAA,IAC3B,eAAe,UAAU;AAAA,IACzB,kBAAkB,UAAU;AAAA,EAC9B;AACF;AAGO,SAAS,uBACd,QACsB;AACtB,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,MAAM,OAAO;AAAA,IACb,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,cAAc,OAAO;AAAA,IACrB,WAAW,qBAAqB,OAAO,SAAS;AAAA,IAChD,QAAQ,OAAO;AAAA,EACjB;AACF;AAGO,SAAS,2BAA+C;AAC7D,QAAM,WAAW,oBAAI,IAAoB;AACzC,SAAO,CAAC,iBAAiC;AACvC,UAAM,MAAM,aAAa,YAAY;AACrC,UAAM,QAAQ,SAAS,IAAI,GAAG,KAAK,MAAM;AACzC,aAAS,IAAI,KAAK,IAAI;AACtB,WAAO;AAAA,EACT;AACF;AAEA,MAAM,0BAA0B,yBAAyB;AACzD,MAAM,eAAe,MAAM,QAAQ;AACnC,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,eAAe;AAErB,SAAS,iBAAiB,OAAe,WAA6B;AACpE,QAAM,UAAU,YAAY,mBAAmB;AAC/C,SACE,MAAM,UAAU,YAAY,SAAS,EAAE,UACvC,QAAQ,KAAK,KAAK,KAClB,OAAO,KAAK,KAAK;AAErB;AAEA,SAAS,oBAAoB,QAAqC;AAChE,SACE,WAAW,KAAK,OAAO,WAAW,KAClC,iBAAiB,OAAO,SAAS,KAAK,KACtC,WAAW,KAAK,OAAO,QAAQ,KAC/B,WAAW,KAAK,OAAO,QAAQ,KAC/B,aAAa,KAAK,OAAO,SAAS;AAEtC;AAEA,SAAS,yBACP,cACA,UACM;AACN,MAAI,CAAC,WAAW,KAAK,YAAY,GAAG;AAClC,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,MAAI,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG;AACnC,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,MAAI,CAAC,WAAW,KAAK,SAAS,SAAS,kCAAoB,GAAG;AAC5D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,MAAI,CAAC,iBAAiB,SAAS,QAAQ,IAAI,GAAG;AAC5C,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,MACE,SAAS,iBAAiB,UAC1B,CAAC,iBAAiB,SAAS,cAAc,KAAK,GAC9C;AACA,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAEA,QAAM,eAAe,SAAS;AAC9B,MAAI,SAAS,WAAW,qBAAqB;AAC3C,QAAI,CAAC,gBAAgB,CAAC,oBAAoB,YAAY,GAAG;AACvD,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,QAAI,SAAS,KAAK,YAAY,MAAM,aAAa,SAAS,YAAY,GAAG;AACvE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,aAAa,SAAS,YAAY,MAAM,aAAa,YAAY,GAAG;AACtE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,QACE,CAAC,gBACD,CAAC,oBAAoB,YAAY,KACjC,aAAa,SAAS,YAAY,MAAM,aAAa,YAAY,GACjE;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,OAAwB;AAChD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC;AAC5D,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,iBAAiB,OAAwB;AAChD,QAAM,SAAS,KAAK,KAAK;AACzB,QAAM,QAAQ,WAAW,KAAK,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AAClE,SAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACnD;AAEA,eAAe,kBAAkB,QAIA;AAC/B,QAAM,EAAE,cAAc,UAAU,OAAO,IAAI;AAC3C,2BAAyB,cAAc,QAAQ;AAC/C,QAAM,cAAc,OAAO,eAAe;AAC1C,QAAM,eAAe;AAAA,IACnB,SAAS,gBAAiB,MAAM,YAAY,YAAY;AAAA,EAC1D;AACA,QAAM,QAAS,SAAS,SAAS;AACjC,QAAM,OAAO,SAAS;AACtB,QAAM,SAAS,OAAO,SAAS,MAAM;AACrC,MAAI,SAAS,MAAM,SAAS,aAAa;AACvC,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,MAAI,gBAAgB,MAAM,eAAe,aAAa;AACpD,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,OAAO,cAAc;AAAA,IAC3C,YAAQ,oCAAqB,OAAO,SAAS,OAAO,cAAc;AAAA,IAClE,OAAO;AAAA,IACP,aAAa;AAAA,IACb;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,SAAS;AAAA,MACP,GAAG;AAAA,MACH,QAAQ,OAAO,SAAS;AAAA,MACxB,cAAc,aAAa,SAAS;AAAA,IACtC;AAAA,IACA;AAAA,IACA,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;AAAA,EACzE;AACF;AASA,eAAsB,yBAAyB,QAO3B;AAClB,QAAM,UAAU,OAAO,SAAS,WAAW,QAAQ,OAAO,OAAO,OAAO;AACxE,MAAI,YAAY,QAAQ,OAAO,OAAO,OAAO,IAAI;AAC/C,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,QAAM,SAAS,MAAM,kBAAkB,MAAM;AAC7C,QAAM,UAA6B;AAAA,IACjC,aAAa;AAAA,IACb,QAAQ;AAAA,IACR;AAAA,IACA,SAAS;AAAA,EACX;AACA,SAAO,iBAAiB,OAAO;AACjC;AAGA,eAAsB,wBAAwB,QAI1B;AAClB,SAAO,yBAAyB;AAAA,IAC9B,GAAG;AAAA,IACH,UAAU;AAAA,MACR,GAAG,OAAO;AAAA,MACV,QAAQ;AAAA,MACR,MAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,SAAS,OAAqD;AACrE,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD;AACN;AAEA,SAAS,YACP,OACA,KACoB;AACpB,QAAM,QAAQ,QAAQ,GAAG;AACzB,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,wBAAwB,OAAwB;AACvD,MAAI;AACF,WAAO,IAAI,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,kCACd,QAC2C;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,SAAS,SAAS,iBAAiB,MAAM,CAAC;AAChD,UAAM,YAAY,SAAS,QAAQ,SAAS;AAC5C,UAAM,SAAS,YAAY,QAAQ,QAAQ;AAC3C,UAAM,OAAO,YAAY,QAAQ,MAAM;AACvC,UAAM,eAAe,YAAY,QAAQ,cAAc;AACvD,UAAM,QAAQ,YAAY,QAAQ,OAAO;AACzC,UAAM,SAAS,YAAY,QAAQ,QAAQ;AAC3C,UAAM,eAAe,YAAY,QAAQ,cAAc;AACvD,UAAM,kBAAkB,YAAY,WAAW,iBAAiB;AAChE,UAAM,gBAAgB,YAAY,WAAW,eAAe;AAC5D,UAAM,SAAS,YAAY,QAAQ,QAAQ;AAC3C,QACE,QAAQ,YAAY,QACpB,CAAC,UACD,CAAC,QACD,CAAC,WAAW,KAAK,IAAI,KACrB,CAAC,gBACD,CAAC,WAAW,KAAK,YAAY,KAC7B,CAAC,SACD,CAAC,WAAW,KAAK,KAAK,KACtB,CAAC,UACD,CAAC,iBAAiB,QAAQ,IAAI,KAC9B,CAAC,gBACD,CAAC,iBAAiB,cAAc,KAAK,KACrC,CAAC,mBACD,CAAC,iBAAiB,iBAAiB,IAAI,KACvC,CAAC,iBACD,CAAC,iBAAiB,eAAe,IAAI,KACrC,OAAO,WAAW,qBAAqB,aACvC,CAAC,UACD,CAAC,wBAAwB,MAAM,GAC/B;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,QACT;AAAA,QACA;AAAA,QACA,kBAAkB,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,yBACd,QAC2C;AAC3C,SAAO,kCAAkC,MAAM;AACjD;AASA,eAAsB,sBAAsB,QAIV;AAChC,SAAO,uBAAuB;AAAA,IAC5B,GAAG;AAAA,IACH,UAAU;AAAA,MACR,GAAG,OAAO;AAAA,MACV,QAAQ;AAAA,MACR,MAAM,OAAO,SAAS;AAAA,IACxB;AAAA,EACF,CAAC;AACH;AAMA,eAAsB,uBAAuB,QAOX;AAChC,QAAM,EAAE,cAAc,OAAO,IAAI;AACjC,QAAM,SAAS,MAAM,kBAAkB,MAAM;AAE7C,QAAM,SAAS,MAAM,OAAO,OAAO,SAAS;AAAA,IAC1C;AAAA,IACA,QAAQ,OAAO,QAAQ;AAAA,IACvB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO,QAAQ;AAAA,IACtB,QAAQ,OAAO,QAAQ;AAAA,IACvB,cAAc,OAAO,QAAQ;AAAA,IAC7B,WAAW,OAAO;AAAA,IAClB,cAAc,OAAO;AAAA,EACvB,CAAC;AAED,SAAO,uBAAuB,MAAM;AACtC;","names":[]}

package/dist/direct/escrow-payment.d.ts

@@ -18,7 +18,7 @@
  * @category Direct
  * @module direct/escrow-payment
  */
-import { GENERIC_PAYMENT_TYPES, genericPaymentDomain, type EscrowPaymentClient, type EscrowPayResult, type PaymentBreakdown } from "../protocol/escrow.js";
+import { GENERIC_PAYMENT_TYPES, genericPaymentDomain, type EscrowGatewayClient, type EscrowPayResult, type PaymentBreakdown } from "../protocol/escrow.js";
 import type { DirectFeeBreakdown, DirectPaymentReceipt, DirectPaymentResponseMetadata, PersonalServerPaymentOperation, PersonalServerPaymentRequired } from "./types.js";
 /** The escrow `GenericPayment.opType` used for grant-lifecycle payments. */
 export declare const GRANT_OP_TYPE: "grant";
@@ -71,7 +71,7 @@ export interface EscrowPaymentHeaderConfig {
  */
 export interface EscrowPaymentConfig extends EscrowPaymentHeaderConfig {
     /** Client for the gateway escrow endpoints (`/v1/escrow/*`). */
-    client: EscrowPaymentClient;
+    client: EscrowGatewayClient;
 }
 /** Map the gateway {@link PaymentBreakdown} into the public {@link DirectFeeBreakdown}. */
 export declare function toDirectFeeBreakdown(breakdown: PaymentBreakdown): DirectFeeBreakdown;