@recta/client 0.0.0-stage → 0.1.1

package/dist/client.js

@@ -0,0 +1,190 @@
+import { keccak256 } from "viem";
+import { checkExecutionArtifact } from "./artifact.js";
+import { ISSUED_AT_HEADER, PATHS, RECTA_ORIGIN, SIGNATURE_HEADER, SIGNED_REQUEST_PREFIX, SIGNER_HEADER } from "./constants.js";
+import { RectaCheckError, RectaDebtError, RectaHttpError } from "./errors.js";
+import { checkFeePermit } from "./fee.js";
+import { parseWalletPolicy } from "./policy.js";
+/** The text a sender signs for one request (EIP-191), exactly as Recta's server rebuilds it. */
+export function signedRequestMessage(f) {
+    return [
+        SIGNED_REQUEST_PREFIX,
+        `method: ${f.method.toUpperCase()}`,
+        `path: ${f.path}`,
+        `idempotency-key: ${f.idempotencyKey}`,
+        `body-keccak256: ${f.bodyKeccak256.toLowerCase()}`,
+        `issued-at: ${f.issuedAt}`,
+    ].join("\n");
+}
+const RESULT_ID = /^[A-Za-z0-9_-]+$/;
+const field = (v, k) => (typeof v === "object" && v !== null ? v[k] : undefined);
+const resultIdOf = (v) => {
+    if (!RESULT_ID.test(v))
+        throw new RectaCheckError("result_id", "not a Recta result id");
+    return v;
+};
+/**
+ * Recta's flow for an agent that holds its own EOA: evaluate → authorizeFee → execute → report. Every step can be
+ * called alone. Nothing is signed or sent before this package's own checks pass (see `checkFeePermit` and
+ * `checkExecutionArtifact`); they cannot be turned off.
+ */
+export function createRectaClient(options) {
+    const { signer, chain, limits } = options;
+    const doFetch = options.fetch ?? fetch;
+    const now = options.now ?? Date.now;
+    const nowUnix = () => BigInt(Math.floor(now() / 1000));
+    const payer = signer.address.toLowerCase();
+    let policyChecked = false;
+    async function call(method, path, body, idempotencyKey, signed = true) {
+        const bytes = body === undefined ? new Uint8Array() : new TextEncoder().encode(JSON.stringify(body));
+        const headers = { accept: "application/json" };
+        if (body !== undefined)
+            headers["content-type"] = "application/json";
+        if (idempotencyKey !== undefined)
+            headers["idempotency-key"] = idempotencyKey;
+        if (signed) {
+            const issuedAt = Math.floor(now() / 1000);
+            const message = signedRequestMessage({ method, path, idempotencyKey: idempotencyKey ?? "", bodyKeccak256: keccak256(bytes), issuedAt });
+            headers[SIGNER_HEADER] = signer.address;
+            headers[ISSUED_AT_HEADER] = String(issuedAt);
+            headers[SIGNATURE_HEADER] = await signer.signMessage(message);
+        }
+        const response = await doFetch(`${RECTA_ORIGIN}${path}`, { method, headers, ...(body === undefined ? {} : { body: bytes }) });
+        const text = await response.text();
+        let parsed = text;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch { /* not JSON: keep the text */ }
+        return { status: response.status, body: parsed };
+    }
+    /** Reads Recta's live wallet policy once and refuses to go on unless its fee block names this package's pins. */
+    async function walletPolicy() {
+        if (policyChecked)
+            return;
+        const a = await call("GET", PATHS.walletPolicy, undefined, undefined, false);
+        if (a.status !== 200)
+            throw new RectaHttpError(a.status, a.body);
+        parseWalletPolicy(a.body);
+        policyChecked = true;
+    }
+    /** Step 1: a durable decision (free). Throws RectaDebtError when the sender owes a fee first. */
+    async function evaluate(request, opts = {}) {
+        if (typeof request.sender !== "string" || request.sender.toLowerCase() !== payer)
+            throw new RectaCheckError("sender", "the request's sender must be the signer");
+        await walletPolicy();
+        const a = await call("POST", PATHS.evaluations, request, opts.idempotencyKey ?? crypto.randomUUID());
+        if (a.status === 402)
+            throw new RectaDebtError(a.body, field(a.body, "debt_offer") ?? null);
+        if (a.status !== 200)
+            throw new RectaHttpError(a.status, a.body);
+        return a.body;
+    }
+    /**
+     * Step 2: the decision's committed transactions. With Recta's collection on, the artifact first asks for the fee
+     * permit: it is checked, rebuilt and signed only if it passes, then stored, and the answer carries the artifact. With
+     * `dryRun`, it stops before signing and returns the typed data it would sign.
+     */
+    async function authorizeFee(resultId, opts = {}) {
+        const id = resultIdOf(resultId);
+        const artifactPath = `${PATHS.evaluations}/${id}/execution-artifact`;
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const a = await call("GET", artifactPath);
+            if (a.status === 200) {
+                const authorized = field(field(a.body, "fee_authorization"), "status") === "AUTHORIZED";
+                return { fee: { kind: authorized ? "ALREADY_AUTHORIZED" : "NOT_REQUIRED" }, artifact: field(a.body, "artifact") };
+            }
+            if (a.status !== 402 || field(a.body, "status") !== "SIGNATURE_REQUIRED")
+                throw new RectaHttpError(a.status, a.body);
+            const expiry = field(a.body, "commercial_expiry_unix");
+            const checked = checkFeePermit(field(a.body, "fee_authorization"), {
+                payer,
+                maxPermitUsdcAtomic: limits.maxPermitUsdcAtomic,
+                nowUnix: nowUnix(),
+                ...(typeof expiry === "string" && /^[0-9]+$/.test(expiry) ? { commercialExpiryUnix: BigInt(expiry) } : {}),
+            });
+            if (opts.dryRun === true)
+                return { fee: { kind: "DRY_RUN", amountUsdcAtomic: checked.amount, typedData: checked.typedData }, artifact: undefined };
+            const signature = await signer.signTypedData(checked.typedData);
+            const s = await call("POST", `${PATHS.evaluations}/${id}/fee-authorization`, { signature, amount_usdc_atomic: checked.amount.toString() });
+            if (s.status === 200 || s.status === 201)
+                return { fee: { kind: "AUTHORIZED", amountUsdcAtomic: checked.amount, signature }, artifact: field(s.body, "artifact") };
+            if (!(s.status === 409 && field(s.body, "reason_code") === "OFFER_STALE"))
+                throw new RectaHttpError(s.status, s.body);
+        }
+        throw new RectaHttpError(409, { reason_code: "OFFER_STALE" });
+    }
+    /** Checks the artifact against the request and the package's pinned routes; nothing is sent. */
+    async function check(resultId, artifact, request) {
+        await walletPolicy();
+        return checkExecutionArtifact(artifact, { resultId: resultIdOf(resultId), request, limits: { signer: payer, nowUnix: nowUnix(), maxNativeValueWei: limits.maxNativeValueWei, minOutputBps: limits.minOutputBps } });
+    }
+    /** Step 3: checks, then sends the transactions in order, each mined successfully before the next. */
+    async function execute(resultId, artifact, request) {
+        const checked = await check(resultId, artifact, request);
+        let approvalTxHash;
+        for (const tx of checked.transactions) {
+            const { role, ...send } = tx;
+            const hash = await signer.sendTransaction(send);
+            if (!(await chain.waitForSuccess(tx.chainId, hash)))
+                throw new RectaCheckError("transaction_failed", `${role} transaction ${hash} reverted`);
+            if (role === "APPROVAL")
+                approvalTxHash = hash;
+            else
+                return { ...(approvalTxHash === undefined ? {} : { approvalTxHash }), originTxHash: hash };
+        }
+        throw new RectaCheckError("transaction_order", "the artifact has no execution");
+    }
+    /**
+     * Step 4: reports the executed route; Recta verifies the delivery on chain and records the saving and its 5 %.
+     * `stage`: ACCRUED (verified and recorded), PENDING (not yet verifiable: report again later) or REFUSED (Recta will
+     * not accrue this execution; see `body.reason_code`).
+     */
+    async function report(resultId, originTxHash, approvalTxHash) {
+        const a = await call("POST", `${PATHS.evaluations}/${resultIdOf(resultId)}/execution`, { origin_tx_hash: originTxHash, ...(approvalTxHash === undefined ? {} : { approval_tx_hash: approvalTxHash }) });
+        const body = a.body;
+        if (a.status === 200 || a.status === 201)
+            return { stage: "ACCRUED", body };
+        if (a.status === 202)
+            return { stage: "PENDING", body };
+        if (a.status === 422)
+            return { stage: "REFUSED", body };
+        throw new RectaHttpError(a.status, a.body);
+    }
+    /** The signer's fees and whether each was collected. */
+    async function ledger() {
+        const a = await call("GET", `${PATHS.accruals}${payer}`);
+        if (a.status !== 200)
+            throw new RectaHttpError(a.status, a.body);
+        return a.body;
+    }
+    /** Signs and submits a debt permit Recta offered (RectaDebtError.offer), after the same checks as a fee permit. */
+    async function payDebt(offer) {
+        const checked = checkFeePermit(offer, { payer, maxPermitUsdcAtomic: limits.maxPermitUsdcAtomic, nowUnix: nowUnix() }, "DEBT");
+        const debtId = field(offer, "debt_id");
+        if (typeof debtId !== "string")
+            throw new RectaCheckError("debt", "the offer has no debt_id");
+        const signature = await signer.signTypedData(checked.typedData);
+        const a = await call("POST", PATHS.feeDebts, { debt_id: debtId, deadline_unix: checked.deadline.toString(), signature });
+        if (a.status !== 200 && a.status !== 201)
+            throw new RectaHttpError(a.status, a.body);
+        return a.body;
+    }
+    /**
+     * The four steps in a row. With `dryRun`, it evaluates and checks but signs no permit and sends no transaction: it
+     * stops at the permit (collection on) or after checking the artifact (collection off).
+     */
+    async function run(request, opts = {}) {
+        const decision = await evaluate(request, opts.idempotencyKey === undefined ? {} : { idempotencyKey: opts.idempotencyKey });
+        const resultId = field(decision, "result_id");
+        if (field(field(decision, "decision"), "state") !== "VERIFIED_POSITIVE" || typeof resultId !== "string")
+            return { stage: "NO_ROUTE", decision };
+        const { fee, artifact } = await authorizeFee(resultId, opts.dryRun === true ? { dryRun: true } : {});
+        if (fee.kind === "DRY_RUN")
+            return { stage: "DRY_RUN", decision, fee };
+        if (opts.dryRun === true)
+            return { stage: "DRY_RUN", decision, fee, checked: await check(resultId, artifact, request) };
+        const sent = await execute(resultId, artifact, request);
+        return { stage: "REPORTED", decision, fee, ...sent, report: await report(resultId, sent.originTxHash, sent.approvalTxHash) };
+    }
+    return { evaluate, authorizeFee, check, execute, report, ledger, payDebt, run, walletPolicy };
+}

package/dist/constants.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Values this package pins in its own code instead of trusting the server. A Recta server that served other values
+ * (a compromised deploy, a man in the middle, a wrong origin) makes every call refuse before anything is signed: moving
+ * the fee anywhere else would need a new release of this package as well.
+ *
+ * Every value is checked equal to the Recta server's own configuration by a test in the Recta repository.
+ */
+export declare const RECTA_ORIGIN = "https://api.recta.build";
+/** The fee: x402 `upto` on Base, a Permit2 `permitWitnessTransferFrom`. All lowercase. */
+export declare const FEE_CHAIN_ID = 8453;
+export declare const PERMIT2 = "0x000000000022d473030f116ddee9f6b43ac78ba3";
+export declare const UPTO_PROXY = "0x4020a4f3b7b90cca423b9fabcc0ce57c6c240002";
+export declare const USDC_BASE = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
+/** The only address a Recta fee can pay (`witness.to`). */
+export declare const FEE_RECEIVER = "0xae866c10e0f2d942da3cddddda082feb65faf108";
+/** The only address that can settle a Recta fee permit (`witness.facilitator`). */
+export declare const FEE_FACILITATOR = "0x993a2a880d20eae16dc65fec374dcadabef1098a";
+/** A permit may stay valid at most this long after its decision's commercial expiry (37 days). */
+export declare const PERMIT_DEADLINE_AFTER_EXPIRY_SECONDS: bigint;
+export declare const FEE_PERMIT_TYPES: {
+    readonly PermitWitnessTransferFrom: readonly [{
+        readonly name: "permitted";
+        readonly type: "TokenPermissions";
+    }, {
+        readonly name: "spender";
+        readonly type: "address";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "deadline";
+        readonly type: "uint256";
+    }, {
+        readonly name: "witness";
+        readonly type: "Witness";
+    }];
+    readonly TokenPermissions: readonly [{
+        readonly name: "token";
+        readonly type: "address";
+    }, {
+        readonly name: "amount";
+        readonly type: "uint256";
+    }];
+    readonly Witness: readonly [{
+        readonly name: "to";
+        readonly type: "address";
+    }, {
+        readonly name: "facilitator";
+        readonly type: "address";
+    }, {
+        readonly name: "validAfter";
+        readonly type: "uint256";
+    }];
+};
+/** Signed requests (EIP-191 `personal_sign` by the sender's EOA). */
+export declare const SIGNED_REQUEST_PREFIX = "Recta signed request v1";
+export declare const SIGNER_HEADER = "x-recta-signer";
+export declare const ISSUED_AT_HEADER = "x-recta-issued-at";
+export declare const SIGNATURE_HEADER = "x-recta-signature";
+export declare const PATHS: {
+    readonly evaluations: "/v1/golden-corridor/commercial-evaluations";
+    readonly accruals: "/v1/golden-corridor/commercial-accruals/";
+    readonly feeDebts: "/v1/golden-corridor/fee-debts";
+    readonly walletPolicy: "/v1/golden-corridor/wallet-policy";
+};
+export declare const WALLET_POLICY_SCHEMA = "RECTA_AGENT_WALLET_POLICY_V1";
+export declare const EXECUTION_ARTIFACT_SCHEMA = "RECTA_COMMERCIAL_EXECUTION_ARTIFACT_V2";

package/dist/constants.js

@@ -0,0 +1,50 @@
+/**
+ * Values this package pins in its own code instead of trusting the server. A Recta server that served other values
+ * (a compromised deploy, a man in the middle, a wrong origin) makes every call refuse before anything is signed: moving
+ * the fee anywhere else would need a new release of this package as well.
+ *
+ * Every value is checked equal to the Recta server's own configuration by a test in the Recta repository.
+ */
+export const RECTA_ORIGIN = "https://api.recta.build";
+/** The fee: x402 `upto` on Base, a Permit2 `permitWitnessTransferFrom`. All lowercase. */
+export const FEE_CHAIN_ID = 8453;
+export const PERMIT2 = "0x000000000022d473030f116ddee9f6b43ac78ba3";
+export const UPTO_PROXY = "0x4020a4f3b7b90cca423b9fabcc0ce57c6c240002";
+export const USDC_BASE = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
+/** The only address a Recta fee can pay (`witness.to`). */
+export const FEE_RECEIVER = "0xae866c10e0f2d942da3cddddda082feb65faf108";
+/** The only address that can settle a Recta fee permit (`witness.facilitator`). */
+export const FEE_FACILITATOR = "0x993a2a880d20eae16dc65fec374dcadabef1098a";
+/** A permit may stay valid at most this long after its decision's commercial expiry (37 days). */
+export const PERMIT_DEADLINE_AFTER_EXPIRY_SECONDS = 37n * 86400n;
+export const FEE_PERMIT_TYPES = {
+    PermitWitnessTransferFrom: [
+        { name: "permitted", type: "TokenPermissions" },
+        { name: "spender", type: "address" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint256" },
+        { name: "witness", type: "Witness" },
+    ],
+    TokenPermissions: [
+        { name: "token", type: "address" },
+        { name: "amount", type: "uint256" },
+    ],
+    Witness: [
+        { name: "to", type: "address" },
+        { name: "facilitator", type: "address" },
+        { name: "validAfter", type: "uint256" },
+    ],
+};
+/** Signed requests (EIP-191 `personal_sign` by the sender's EOA). */
+export const SIGNED_REQUEST_PREFIX = "Recta signed request v1";
+export const SIGNER_HEADER = "x-recta-signer";
+export const ISSUED_AT_HEADER = "x-recta-issued-at";
+export const SIGNATURE_HEADER = "x-recta-signature";
+export const PATHS = {
+    evaluations: "/v1/golden-corridor/commercial-evaluations",
+    accruals: "/v1/golden-corridor/commercial-accruals/",
+    feeDebts: "/v1/golden-corridor/fee-debts",
+    walletPolicy: "/v1/golden-corridor/wallet-policy",
+};
+export const WALLET_POLICY_SCHEMA = "RECTA_AGENT_WALLET_POLICY_V1";
+export const EXECUTION_ARTIFACT_SCHEMA = "RECTA_COMMERCIAL_EXECUTION_ARTIFACT_V2";

package/dist/errors.d.ts

@@ -0,0 +1,21 @@
+/** A local check refused to sign or send: nothing was signed or sent. `check` names the check. */
+export declare class RectaCheckError extends Error {
+    readonly check: string;
+    readonly name: string;
+    constructor(check: string, message: string);
+}
+/** Recta answered with an error. `body` is Recta's JSON answer when it sent one. */
+export declare class RectaHttpError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    readonly name: string;
+    readonly reasonCode: string | undefined;
+    constructor(status: number, body: unknown);
+}
+/** A new evaluation was refused because the sender owes a fee: `offer` is the debt permit Recta offers (or null while
+ *  a pull is pending). Pay it with `payDebt(offer)` only if you agree; this package never signs a debt by itself. */
+export declare class RectaDebtError extends RectaHttpError {
+    readonly offer: unknown;
+    readonly name: string;
+    constructor(body: unknown, offer: unknown);
+}

package/dist/errors.js

@@ -0,0 +1,33 @@
+/** A local check refused to sign or send: nothing was signed or sent. `check` names the check. */
+export class RectaCheckError extends Error {
+    check;
+    name = "RectaCheckError";
+    constructor(check, message) {
+        super(`${check}: ${message}`);
+        this.check = check;
+    }
+}
+/** Recta answered with an error. `body` is Recta's JSON answer when it sent one. */
+export class RectaHttpError extends Error {
+    status;
+    body;
+    name = "RectaHttpError";
+    reasonCode;
+    constructor(status, body) {
+        const reason = typeof body === "object" && body !== null && typeof body["reason_code"] === "string" ? body["reason_code"] : undefined;
+        super(`Recta answered HTTP ${status}${reason === undefined ? "" : ` (${reason})`}`);
+        this.status = status;
+        this.body = body;
+        this.reasonCode = reason;
+    }
+}
+/** A new evaluation was refused because the sender owes a fee: `offer` is the debt permit Recta offers (or null while
+ *  a pull is pending). Pay it with `payDebt(offer)` only if you agree; this package never signs a debt by itself. */
+export class RectaDebtError extends RectaHttpError {
+    offer;
+    name = "RectaDebtError";
+    constructor(body, offer) {
+        super(402, body);
+        this.offer = offer;
+    }
+}

package/dist/fee.d.ts

@@ -0,0 +1,26 @@
+import type { RectaTypedData } from "./signer.js";
+export interface FeePermitLimits {
+    /** The payer: the account that signs. */
+    readonly payer: string;
+    /** The most this agent agrees to authorize in one permit, in USDC atomic units (6 decimals). Required: a permit's
+     *  amount also covers earlier fees not yet collected, which Recta's server, not the chain, bounds. */
+    readonly maxPermitUsdcAtomic: bigint;
+    readonly nowUnix: bigint;
+    /** The decision's commercial expiry when the caller knows it from elsewhere (the artifact): must agree. */
+    readonly commercialExpiryUnix?: bigint;
+}
+/**
+ * Checks a fee permit Recta offers (`fee_authorization` of an execution artifact, or a debt's `debt_offer`) against
+ * the pinned values and the agent's own limit, and returns the typed data to sign, rebuilt from the checked fields
+ * only (never the server's object as it came).
+ *
+ * Refuses unless: the domain is Permit2 on Base; the types are exactly Recta's; the spender is x402's `upto` proxy; the
+ * token is USDC on Base; `witness.to` is Recta's receiver; `witness.facilitator` is Recta's sender; the amount is the
+ * offer's cap plus what it carries (for a decision) and at most `maxPermitUsdcAtomic`; and the deadline is in the
+ * future and no later than the commercial expiry plus 37 days (for a decision).
+ */
+export declare function checkFeePermit(offer: unknown, limits: FeePermitLimits, kind?: "DECISION" | "DEBT"): {
+    readonly typedData: RectaTypedData;
+    readonly amount: bigint;
+    readonly deadline: bigint;
+};

package/dist/fee.js

@@ -0,0 +1,98 @@
+import { FEE_CHAIN_ID, FEE_FACILITATOR, FEE_PERMIT_TYPES, FEE_RECEIVER, PERMIT2, PERMIT_DEADLINE_AFTER_EXPIRY_SECONDS, UPTO_PROXY, USDC_BASE } from "./constants.js";
+import { RectaCheckError } from "./errors.js";
+const UINT = /^(0|[1-9][0-9]{0,77})$/;
+const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+const obj = (v, check, what) => {
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        throw new RectaCheckError(check, `${what} is not an object`);
+    return v;
+};
+const uint = (v, check, what) => {
+    if (typeof v !== "string" || !UINT.test(v))
+        throw new RectaCheckError(check, `${what} is not a canonical unsigned integer`);
+    const n = BigInt(v);
+    if (n >= 2n ** 256n)
+        throw new RectaCheckError(check, `${what} exceeds uint256`);
+    return n;
+};
+const address = (v, check, what) => {
+    if (typeof v !== "string" || !ADDRESS.test(v))
+        throw new RectaCheckError(check, `${what} is not an address`);
+    return v.toLowerCase();
+};
+const expect = (actual, pinned, check, what) => {
+    if (actual !== pinned)
+        throw new RectaCheckError(check, `${what} is ${actual}, not ${pinned}`);
+};
+/**
+ * Checks a fee permit Recta offers (`fee_authorization` of an execution artifact, or a debt's `debt_offer`) against
+ * the pinned values and the agent's own limit, and returns the typed data to sign, rebuilt from the checked fields
+ * only (never the server's object as it came).
+ *
+ * Refuses unless: the domain is Permit2 on Base; the types are exactly Recta's; the spender is x402's `upto` proxy; the
+ * token is USDC on Base; `witness.to` is Recta's receiver; `witness.facilitator` is Recta's sender; the amount is the
+ * offer's cap plus what it carries (for a decision) and at most `maxPermitUsdcAtomic`; and the deadline is in the
+ * future and no later than the commercial expiry plus 37 days (for a decision).
+ */
+export function checkFeePermit(offer, limits, kind = "DECISION") {
+    const o = obj(offer, "fee_offer", "the fee offer");
+    const td = obj(o["typed_data"], "fee_typed_data", "typed_data");
+    const domain = obj(td["domain"], "fee_domain", "typed_data.domain");
+    if (domain["name"] !== "Permit2")
+        throw new RectaCheckError("fee_domain", "the domain is not Permit2's");
+    if (domain["chainId"] !== FEE_CHAIN_ID && domain["chainId"] !== String(FEE_CHAIN_ID))
+        throw new RectaCheckError("fee_domain", `the chain is ${String(domain["chainId"])}, not Base (${FEE_CHAIN_ID})`);
+    expect(address(domain["verifyingContract"], "fee_domain", "verifyingContract"), PERMIT2, "fee_domain", "the verifying contract");
+    if (td["primaryType"] !== "PermitWitnessTransferFrom" || JSON.stringify(td["types"]) !== JSON.stringify(FEE_PERMIT_TYPES))
+        throw new RectaCheckError("fee_types", "the typed data is not exactly Recta's PermitWitnessTransferFrom");
+    const m = obj(td["message"], "fee_message", "typed_data.message");
+    const permitted = obj(m["permitted"], "fee_message", "message.permitted");
+    const witness = obj(m["witness"], "fee_message", "message.witness");
+    expect(address(m["spender"], "fee_spender", "spender"), UPTO_PROXY, "fee_spender", "the spender");
+    expect(address(permitted["token"], "fee_token", "token"), USDC_BASE, "fee_token", "the token");
+    expect(address(witness["to"], "fee_recipient", "witness.to"), FEE_RECEIVER, "fee_recipient", "the fee recipient");
+    expect(address(witness["facilitator"], "fee_facilitator", "witness.facilitator"), FEE_FACILITATOR, "fee_facilitator", "the facilitator");
+    const amount = uint(permitted["amount"], "fee_amount", "the amount");
+    const nonce = uint(m["nonce"], "fee_message", "the nonce");
+    const deadline = uint(m["deadline"], "fee_deadline", "the deadline");
+    const validAfter = uint(witness["validAfter"], "fee_message", "validAfter");
+    const permit = o["permit"] === undefined ? undefined : obj(o["permit"], "fee_offer", "permit");
+    if (permit?.["payer"] !== undefined && address(permit["payer"], "fee_payer", "permit.payer") !== limits.payer.toLowerCase())
+        throw new RectaCheckError("fee_payer", "the permit is offered to another payer");
+    if (kind === "DECISION") {
+        const cap = uint(o["max_fee_authorization_usdc_atomic"], "fee_amount", "max_fee_authorization_usdc_atomic");
+        const carried = uint(o["carried_usdc_atomic"], "fee_amount", "carried_usdc_atomic");
+        if (amount !== cap + carried)
+            throw new RectaCheckError("fee_amount", `the permit amount ${amount} is not the cap ${cap} plus carried ${carried}`);
+        const expiry = uint(o["commercial_expiry_unix"], "fee_deadline", "commercial_expiry_unix");
+        if (limits.commercialExpiryUnix !== undefined && expiry !== limits.commercialExpiryUnix)
+            throw new RectaCheckError("fee_deadline", "the offer's commercial expiry is not the artifact's");
+        if (deadline > expiry + PERMIT_DEADLINE_AFTER_EXPIRY_SECONDS)
+            throw new RectaCheckError("fee_deadline", "the deadline is later than the commercial expiry plus 37 days");
+    }
+    else {
+        const owed = uint(o["amount_usdc_atomic"], "fee_amount", "amount_usdc_atomic");
+        if (amount !== owed)
+            throw new RectaCheckError("fee_amount", `the permit amount ${amount} is not the debt ${owed}`);
+    }
+    if (amount > limits.maxPermitUsdcAtomic)
+        throw new RectaCheckError("fee_amount_limit", `the permit amount ${amount} exceeds your limit ${limits.maxPermitUsdcAtomic}`);
+    if (deadline <= limits.nowUnix)
+        throw new RectaCheckError("fee_deadline", "the deadline has passed");
+    return {
+        amount,
+        deadline,
+        typedData: {
+            domain: { name: "Permit2", chainId: FEE_CHAIN_ID, verifyingContract: PERMIT2 },
+            types: FEE_PERMIT_TYPES,
+            primaryType: "PermitWitnessTransferFrom",
+            message: {
+                permitted: { token: USDC_BASE, amount },
+                spender: UPTO_PROXY,
+                nonce,
+                deadline,
+                witness: { to: FEE_RECEIVER, facilitator: FEE_FACILITATOR, validAfter },
+            },
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { createRectaClient, signedRequestMessage, type RectaClient, type RectaClientOptions, type FeeOutcome } from "./client.js";
+export { checkFeePermit, type FeePermitLimits } from "./fee.js";
+export { checkExecutionArtifact, pinnedRouteOf, type CheckedArtifact, type EvaluationRequestView, type ArtifactLimits } from "./artifact.js";
+export { PINNED_ROUTES, type PinnedRoute } from "./pinned-routes.js";
+export { parseWalletPolicy, type WalletPolicy, type WalletPolicyNetwork } from "./policy.js";
+export { viemSigner, viemChainReader, cdpSigner, CDP_SEND_NETWORKS, type CdpEvmAccountLike, type CdpSendNetwork, type RectaSigner, type RectaChainReader, type RectaTransaction, type RectaTypedData } from "./signer.js";
+export { RectaCheckError, RectaHttpError, RectaDebtError } from "./errors.js";
+export * as pins from "./constants.js";

package/dist/index.js

@@ -0,0 +1,8 @@
+export { createRectaClient, signedRequestMessage } from "./client.js";
+export { checkFeePermit } from "./fee.js";
+export { checkExecutionArtifact, pinnedRouteOf } from "./artifact.js";
+export { PINNED_ROUTES } from "./pinned-routes.js";
+export { parseWalletPolicy } from "./policy.js";
+export { viemSigner, viemChainReader, cdpSigner, CDP_SEND_NETWORKS } from "./signer.js";
+export { RectaCheckError, RectaHttpError, RectaDebtError } from "./errors.js";
+export * as pins from "./constants.js";

package/dist/pinned-routes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * GENERATED by scripts/generate-client-pinned-routes.ts from Recta's server configuration; do not edit by hand.
+ * Every EVM-to-EVM commercial corridor: source and output tokens, and the only contracts a route may approve and call on
+ * the source network, with the destination identifier each call must name (Across chain id, CCTP V2 domain, LayerZero
+ * endpoint id). A served wallet policy never adds to this list: a contract missing here is refused.
+ */
+export interface PinnedRoute {
+    readonly source_chain_id: number;
+    readonly source_token: string;
+    readonly source_decimals: number;
+    readonly output_token: string;
+    readonly output_decimals: number;
+    readonly contracts: readonly {
+        readonly protocol: "across" | "cctp_v2" | "oft";
+        readonly address: string;
+        readonly destination_id: number;
+    }[];
+}
+export declare const PINNED_ROUTES: Readonly<Record<string, PinnedRoute>>;