@reinconsole/x402-rails 0.1.0

package/dist/index.js

@@ -0,0 +1,808 @@
+// src/wire.ts
+import { z } from "zod";
+
+// src/errors.ts
+var RailsError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "RailsError";
+  }
+  code;
+};
+var FacilitatorHttpError = class extends Error {
+  constructor(status, body) {
+    super(`facilitator responded ${status}: ${body.slice(0, 500)}`);
+    this.status = status;
+    this.body = body;
+    this.name = "FacilitatorHttpError";
+  }
+  status;
+  body;
+};
+
+// src/wire.ts
+var Hex = z.string().regex(/^0x[0-9a-fA-F]*$/, "must be 0x-prefixed hex");
+var EvmAddress = z.string().regex(/^0x[0-9a-fA-F]{40}$/, "must be a 20-byte EVM address");
+var UintString = z.string().regex(/^\d+$/, "must be a decimal integer string");
+var ExactEvmAuthorization = z.object({
+  from: EvmAddress,
+  to: EvmAddress,
+  /** Atomic-unit amount, mirroring the requirement's maxAmountRequired. */
+  value: UintString,
+  validAfter: UintString,
+  validBefore: UintString,
+  /** bytes32 — Rein derives it from the intent id (see nonce.ts). */
+  nonce: z.string().regex(/^0x[0-9a-fA-F]{64}$/, "nonce must be bytes32 hex")
+});
+var ExactEvmPayload = z.object({
+  /** 65-byte EIP-712 signature over the authorization. */
+  signature: Hex,
+  authorization: ExactEvmAuthorization
+});
+var PaymentPayload = z.object({
+  x402Version: z.literal(1),
+  scheme: z.string(),
+  network: z.string(),
+  payload: ExactEvmPayload
+});
+var VerifyResponse = z.object({
+  isValid: z.boolean(),
+  invalidReason: z.string().optional(),
+  payer: z.string().optional()
+});
+var SettleResponse = z.object({
+  success: z.boolean(),
+  errorReason: z.string().optional(),
+  payer: z.string().optional(),
+  /** The on-chain tx hash (the guard surfaces this on the receipt). */
+  transaction: z.string(),
+  network: z.string()
+});
+function encodePaymentHeader(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64");
+}
+function decodePaymentHeader(raw) {
+  let json;
+  try {
+    json = JSON.parse(Buffer.from(raw, "base64").toString("utf8"));
+  } catch {
+    throw new RailsError("malformed_payment", "X-PAYMENT is not base64-encoded JSON");
+  }
+  const parsed = PaymentPayload.safeParse(json);
+  if (!parsed.success) {
+    throw new RailsError("malformed_payment", `invalid X-PAYMENT body: ${parsed.error.message}`);
+  }
+  return parsed.data;
+}
+function encodeSettlementHeader(response) {
+  return Buffer.from(JSON.stringify(response)).toString("base64");
+}
+
+// src/nonce.ts
+import { keccak256, stringToBytes } from "viem";
+function intentNonce(intentId) {
+  return keccak256(stringToBytes(intentId));
+}
+
+// src/networks.ts
+var NETWORK_TO_CHAIN_ID = {
+  base: 8453,
+  "eip155:8453": 8453,
+  "base-sepolia": 84532,
+  "eip155:84532": 84532
+};
+function chainIdForNetwork(network) {
+  return NETWORK_TO_CHAIN_ID[network.toLowerCase()];
+}
+
+// src/payer.ts
+import { privateKeyToAccount } from "viem/accounts";
+var transferWithAuthorizationTypes = {
+  TransferWithAuthorization: [
+    { name: "from", type: "address" },
+    { name: "to", type: "address" },
+    { name: "value", type: "uint256" },
+    { name: "validAfter", type: "uint256" },
+    { name: "validBefore", type: "uint256" },
+    { name: "nonce", type: "bytes32" }
+  ]
+};
+function createX402Payer(options) {
+  const account = privateKeyToAccount(options.privateKey);
+  const skew = options.validAfterSkewSeconds ?? 600;
+  const defaultTimeout = options.defaultTimeoutSeconds ?? 300;
+  const now = options.now ?? (() => Math.floor(Date.now() / 1e3));
+  return async (requirement, intent) => {
+    const chainId = chainIdForNetwork(requirement.network);
+    if (chainId === void 0) {
+      throw new RailsError(
+        "unsupported_network",
+        `cannot sign for x402 network "${requirement.network}"`
+      );
+    }
+    const ts = now();
+    const authorization = {
+      from: account.address,
+      to: requirement.payTo,
+      value: requirement.maxAmountRequired,
+      validAfter: String(ts - skew),
+      validBefore: String(ts + (requirement.maxTimeoutSeconds ?? defaultTimeout)),
+      nonce: intentNonce(intent.id)
+    };
+    const signature = await account.signTypedData({
+      domain: {
+        name: extraString(requirement, "name") ?? "USDC",
+        version: extraString(requirement, "version") ?? "2",
+        chainId,
+        verifyingContract: requirement.asset
+      },
+      types: transferWithAuthorizationTypes,
+      primaryType: "TransferWithAuthorization",
+      message: {
+        from: authorization.from,
+        to: authorization.to,
+        value: BigInt(authorization.value),
+        validAfter: BigInt(authorization.validAfter),
+        validBefore: BigInt(authorization.validBefore),
+        nonce: authorization.nonce
+      }
+    });
+    return encodePaymentHeader({
+      x402Version: 1,
+      scheme: requirement.scheme,
+      network: requirement.network,
+      payload: { signature, authorization }
+    });
+  };
+}
+function extraString(requirement, key) {
+  const value = requirement.extra?.[key];
+  return typeof value === "string" ? value : void 0;
+}
+
+// src/facilitator.ts
+var DEFAULT_FACILITATOR_URL = "https://x402.org/facilitator";
+var FacilitatorClient = class {
+  url;
+  fetch;
+  constructor(options = {}) {
+    this.url = (options.url ?? DEFAULT_FACILITATOR_URL).replace(/\/$/, "");
+    const f = options.fetch ?? globalThis.fetch;
+    this.fetch = (input, init) => f(input, init);
+  }
+  async verify(payload, requirements) {
+    return VerifyResponse.parse(await this.post("/verify", payload, requirements));
+  }
+  async settle(payload, requirements) {
+    return SettleResponse.parse(await this.post("/settle", payload, requirements));
+  }
+  /** The facilitator's advertised (x402Version, scheme, network) kinds. */
+  async supported() {
+    const res = await this.fetch(`${this.url}/supported`);
+    if (!res.ok) throw new FacilitatorHttpError(res.status, await res.text());
+    return res.json();
+  }
+  async post(path, paymentPayload, paymentRequirements) {
+    const claimed = paymentPayload.x402Version;
+    const x402Version = typeof claimed === "number" ? claimed : 1;
+    const res = await this.fetch(`${this.url}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ x402Version, paymentPayload, paymentRequirements })
+    });
+    if (!res.ok) throw new FacilitatorHttpError(res.status, await res.text());
+    return res.json();
+  }
+};
+
+// ../../packages/core/dist/index.js
+import { z as z2 } from "zod";
+var Chain = z2.enum(["base", "solana", "polygon", "bnb"]);
+var Asset = z2.enum(["USDC", "USDT", "EURC"]);
+var DecimalString = z2.string().regex(/^\d+(\.\d+)?$/, 'must be a non-negative decimal string, e.g. "5.00"');
+var ULID_BODY = "[0-9A-HJKMNP-TV-Z]{26}";
+function prefixedId(prefix) {
+  return z2.string().regex(new RegExp(`^${prefix}_${ULID_BODY}$`), `expected a "${prefix}_" prefixed id`);
+}
+var OrgId = prefixedId("org");
+var AgentId = prefixedId("agt");
+var PolicyId = prefixedId("pol");
+var IntentId = prefixedId("int");
+var DecisionId = prefixedId("dec");
+var ReceiptId = prefixedId("rcp");
+var SessionId = prefixedId("ses");
+var GateReceiptId = prefixedId("grc");
+var EnforcementMode = z2.enum(["observed", "sdk", "session-key"]);
+var AgentWallet = z2.object({
+  chain: Chain,
+  address: z2.string().min(1),
+  mode: EnforcementMode
+});
+var AgentStatus = z2.enum(["active", "frozen"]);
+var Agent = z2.object({
+  id: AgentId,
+  orgId: OrgId,
+  name: z2.string().min(1).max(200),
+  /** On-chain ERC-8004 identity, if the agent is registered. */
+  erc8004Id: z2.string().optional(),
+  wallets: z2.array(AgentWallet).default([]),
+  status: AgentStatus.default("active"),
+  createdAt: z2.coerce.date()
+});
+var ID_PATTERN = /^eip155:(\d+):(0x[0-9a-fA-F]{40})\/(\d+)$/;
+function parseErc8004Id(value) {
+  const match = ID_PATTERN.exec(value);
+  if (!match) return void 0;
+  const chainId = Number(match[1]);
+  if (!Number.isSafeInteger(chainId) || chainId < 1) return void 0;
+  return {
+    chainId,
+    registry: match[2].toLowerCase(),
+    tokenId: BigInt(match[3])
+  };
+}
+var Erc8004Id = z2.string().refine((value) => parseErc8004Id(value) !== void 0, {
+  message: 'expected "eip155:{chainId}:{registry}/{tokenId}"'
+});
+var Vendor = z2.object({
+  host: z2.string().min(1),
+  address: z2.string().min(1),
+  erc8004Id: z2.string().optional()
+});
+var TaskContext = z2.object({
+  taskId: z2.string().optional(),
+  parentRunId: z2.string().optional(),
+  purpose: z2.string().max(500).optional()
+});
+var PaymentIntent = z2.object({
+  id: IntentId,
+  agentId: AgentId,
+  vendor: Vendor,
+  resource: z2.string(),
+  amount: DecimalString,
+  asset: Asset,
+  chain: Chain,
+  taskContext: TaskContext.default({}),
+  nonce: z2.string().min(1),
+  createdAt: z2.coerce.date()
+});
+var DecisionOutcome = z2.enum(["allow", "deny", "escalate"]);
+var Decision = z2.object({
+  id: DecisionId,
+  intentId: IntentId,
+  /**
+   * sha256 of the intent's canonical content (see canonical.ts). Binds the
+   * decision to the exact transfer it judged — amount, recipient, asset,
+   * chain — so a signer can verify an {intent, decision} pair offline as a
+   * self-contained spend voucher, not just a reference by id.
+   */
+  intentHash: z2.string(),
+  outcome: DecisionOutcome,
+  /** Ids of the rules that fired, for explainability. */
+  matchedRules: z2.array(z2.string()).default([]),
+  /** Human-readable explanation surfaced in the dashboard. */
+  reason: z2.string().optional(),
+  policyId: z2.string(),
+  policyVersion: z2.string(),
+  /** Hash of the previous decision in the chain (tamper-evident log). */
+  prevHash: z2.string(),
+  /** Hash of this decision's canonical content. */
+  hash: z2.string(),
+  /** Service signing-key signature over `hash`. */
+  signature: z2.string(),
+  latencyMs: z2.number().nonnegative(),
+  decidedAt: z2.coerce.date()
+});
+var Session = z2.object({
+  id: SessionId,
+  agentId: AgentId,
+  /** sha256 hex of the bearer token. */
+  tokenHash: z2.string(),
+  /** Cumulative ceiling across the session's lifetime. Absent = uncapped. */
+  capAmount: DecimalString.optional(),
+  /** Ceiling per individual signature. Absent = uncapped. */
+  maxPerPayment: DecimalString.optional(),
+  expiresAt: z2.coerce.date(),
+  createdAt: z2.coerce.date(),
+  revokedAt: z2.coerce.date().optional()
+});
+var SettledPayment = z2.object({
+  intentId: IntentId,
+  txHash: z2.string(),
+  chain: Chain,
+  blockNumber: z2.coerce.bigint(),
+  facilitator: z2.string().optional(),
+  feePaid: DecimalString.optional(),
+  confirmedAt: z2.coerce.date()
+});
+var ReceiptSettlement = z2.object({
+  txHash: z2.string().optional(),
+  networkId: z2.string().optional(),
+  /** Raw header payload, kept for forensics until the indexer confirms. */
+  raw: z2.string().optional()
+});
+var Receipt = z2.object({
+  id: ReceiptId,
+  agentId: AgentId,
+  intentId: IntentId,
+  decisionId: DecisionId,
+  outcome: DecisionOutcome,
+  /** The URL the agent actually fetched (the paywalled resource). */
+  url: z2.string(),
+  method: z2.string().default("GET"),
+  vendorHost: z2.string(),
+  amount: DecimalString,
+  asset: Asset,
+  chain: Chain,
+  taskContext: TaskContext.default({}),
+  /** Human-readable explanation copied from the decision. */
+  reason: z2.string().optional(),
+  /** Present only once a payment was made and the vendor confirmed it. */
+  settlement: ReceiptSettlement.optional(),
+  createdAt: z2.coerce.date()
+});
+var GateReceipt = z2.object({
+  id: GateReceiptId,
+  at: z2.coerce.date(),
+  /** The route pattern that priced this request, e.g. "/api/reports/*". */
+  route: z2.string().min(1),
+  /** The concrete resource paid for (URL path actually requested). */
+  resource: z2.string().min(1),
+  method: z2.string().min(1),
+  /** The paying wallet address, as asserted by the settled payment. */
+  payer: z2.string().min(1),
+  payTo: z2.string().min(1),
+  /** Human-unit decimal amount, e.g. "0.05". */
+  amount: DecimalString,
+  /** The same amount in the asset's atomic units, e.g. "50000". */
+  amountAtomic: z2.string().regex(/^\d+$/, "atomic amount must be an integer string"),
+  /** Token symbol or contract address, exactly as quoted in the requirement. */
+  asset: z2.string().min(1),
+  network: z2.string().min(1),
+  /** Settlement transaction hash (mock ledger or on-chain). */
+  transaction: z2.string().min(1)
+});
+var Window = z2.string().regex(/^\d+[smhd]$/, 'window must be like "30s", "15m", "1h", or "7d"');
+var Multiplier = z2.string().regex(/^\d+(\.\d+)?x$/, 'multiplier must be like "3x"');
+var Condition = z2.object({
+  /** Per-transaction amount exceeds this value. */
+  amountGt: DecimalString.optional(),
+  /** Sum of spend in a rolling window exceeds `gt`. */
+  rollingSum: z2.object({ window: Window, gt: DecimalString }).optional(),
+  /** Transaction count in a rolling window exceeds `gt`. */
+  txCount: z2.object({ window: Window, gt: z2.number().int().nonnegative() }).optional(),
+  /** Vendor host matches one of these patterns (supports `*` globs). */
+  vendorHostIn: z2.array(z2.string()).optional(),
+  /** First time Rein has seen this vendor for the agent. */
+  vendorFirstSeen: z2.boolean().optional(),
+  /** Vendor reputation score is below this threshold (Phase 3 hook). */
+  vendorReputationLt: z2.number().min(0).max(100).optional(),
+  /** Amount is more than `gt`-times the observed median for this resource. */
+  amountVsResourceMedian: z2.object({ gt: Multiplier }).optional()
+}).refine((c) => Object.values(c).some((v) => v !== void 0), {
+  message: "a condition must specify at least one predicate"
+});
+var Rule = z2.object({
+  id: z2.string().min(1),
+  allow: Condition.optional(),
+  deny: Condition.optional(),
+  escalate: Condition.optional()
+}).refine((r) => [r.allow, r.deny, r.escalate].filter((v) => v !== void 0).length === 1, {
+  message: "a rule must specify exactly one of allow / deny / escalate"
+});
+var PolicyDefault = z2.enum(["allow", "deny"]);
+var AppliesTo = z2.object({
+  /** Agent id patterns (supports `*` globs, e.g. "agt_research_*"). */
+  agents: z2.array(z2.string()).optional(),
+  chains: z2.array(Chain).optional()
+});
+var Escalation = z2.object({
+  approvers: z2.array(z2.string()).default([]),
+  timeoutAction: PolicyDefault.default("deny"),
+  timeoutMin: z2.number().int().positive().default(15)
+});
+var Policy = z2.object({
+  policyId: z2.string().min(1),
+  version: z2.string().default("1"),
+  appliesTo: AppliesTo.default({}),
+  rules: z2.array(Rule).default([]),
+  default: PolicyDefault.default("deny"),
+  /** Below this amount, fail-open is permitted during a policy-service outage. */
+  denyFloor: DecimalString.default("0.05"),
+  escalation: Escalation.optional()
+});
+var ReputationSubject = z2.object({
+  kind: z2.enum(["agent", "vendor"]),
+  id: z2.string()
+});
+var ReputationComponents = z2.object({
+  volume: z2.number(),
+  longevity: z2.number(),
+  disputeRate: z2.number(),
+  counterpartyQuality: z2.number(),
+  settlementReliability: z2.number()
+});
+var ReputationScore = z2.object({
+  subject: ReputationSubject,
+  score: z2.number().min(0).max(100),
+  components: ReputationComponents,
+  confidence: z2.number().min(0).max(1),
+  asOf: z2.coerce.date(),
+  /** Hash-anchored attestation, optionally published on-chain (ERC-8004). */
+  evidenceUri: z2.string().optional()
+});
+var ReinEvent = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("intent.created"), at: z2.coerce.date(), intent: PaymentIntent }),
+  z2.object({ type: z2.literal("decision.made"), at: z2.coerce.date(), decision: Decision }),
+  z2.object({ type: z2.literal("payment.settled"), at: z2.coerce.date(), payment: SettledPayment }),
+  z2.object({
+    type: z2.literal("shadow.spend"),
+    at: z2.coerce.date(),
+    agentId: AgentId,
+    txHash: z2.string(),
+    chain: Chain,
+    amount: DecimalString
+  }),
+  z2.object({
+    type: z2.literal("signature.released"),
+    at: z2.coerce.date(),
+    sessionId: SessionId,
+    agentId: AgentId,
+    intentId: IntentId,
+    decisionId: DecisionId,
+    amount: DecimalString
+  }),
+  z2.object({
+    type: z2.literal("signature.refused"),
+    at: z2.coerce.date(),
+    /** Refusal code, e.g. "decision_replayed" (see @reinconsole/signer). */
+    code: z2.string(),
+    reason: z2.string(),
+    sessionId: SessionId.optional(),
+    agentId: AgentId.optional(),
+    intentId: IntentId.optional()
+  }),
+  z2.object({
+    type: z2.literal("gate.quoted"),
+    at: z2.coerce.date(),
+    resource: z2.string(),
+    method: z2.string(),
+    amount: DecimalString,
+    asset: z2.string(),
+    network: z2.string()
+  }),
+  z2.object({ type: z2.literal("gate.settled"), at: z2.coerce.date(), receipt: GateReceipt }),
+  z2.object({
+    type: z2.literal("gate.refused"),
+    at: z2.coerce.date(),
+    /** Refusal code, e.g. "payment_replayed" (see @reinconsole/gate). */
+    code: z2.string(),
+    reason: z2.string(),
+    resource: z2.string(),
+    /** Known only when the payment header decoded far enough to name a payer. */
+    payer: z2.string().optional()
+  })
+]);
+
+// ../../packages/sdk/dist/index.js
+import { z as z3 } from "zod";
+var Health = z3.object({ status: z3.string(), publicKey: z3.string() });
+var EvaluateResponse = z3.object({ intent: PaymentIntent, decision: Decision });
+var PaymentRequirement = z3.object({
+  scheme: z3.string(),
+  network: z3.string(),
+  /** Amount in the asset's atomic units (e.g. "10000" = 0.01 USDC at 6 decimals). */
+  maxAmountRequired: z3.string().regex(/^\d+$/, "atomic amount must be an integer string"),
+  resource: z3.string().optional(),
+  description: z3.string().optional(),
+  mimeType: z3.string().optional(),
+  payTo: z3.string().min(1),
+  maxTimeoutSeconds: z3.number().optional(),
+  /** Token contract address — or, mock-first, a plain symbol like "USDC". */
+  asset: z3.string().min(1),
+  extra: z3.record(z3.unknown()).optional()
+});
+var PaymentRequired = z3.object({
+  x402Version: z3.number(),
+  accepts: z3.array(PaymentRequirement).min(1),
+  error: z3.string().optional()
+});
+function atomicToDecimal(atomic, decimals) {
+  if (!/^\d+$/.test(atomic)) throw new TypeError(`invalid atomic amount: ${atomic}`);
+  if (decimals === 0) return atomic.replace(/^0+(?=\d)/, "");
+  const digits = atomic.padStart(decimals + 1, "0");
+  const intPart = digits.slice(0, digits.length - decimals).replace(/^0+(?=\d)/, "");
+  const fracPart = digits.slice(digits.length - decimals).replace(/0+$/, "");
+  return fracPart.length > 0 ? `${intPart}.${fracPart}` : intPart;
+}
+
+// src/wallet.ts
+import {
+  createPublicClient,
+  erc20Abi,
+  http
+} from "viem";
+import { generatePrivateKey, privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
+import { baseSepolia } from "viem/chains";
+var BASE_SEPOLIA_USDC = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
+var CIRCLE_FAUCET_URL = "https://faucet.circle.com";
+var basescanTxUrl = (txHash) => `https://sepolia.basescan.org/tx/${txHash}`;
+function generateWallet() {
+  const privateKey = generatePrivateKey();
+  return { privateKey, address: privateKeyToAccount2(privateKey).address };
+}
+function createBaseSepoliaClient(rpcUrl) {
+  return createPublicClient({ chain: baseSepolia, transport: http(rpcUrl) });
+}
+async function getUsdcBalance(client, address, usdc = BASE_SEPOLIA_USDC) {
+  return client.readContract({
+    address: usdc,
+    abi: erc20Abi,
+    functionName: "balanceOf",
+    args: [address]
+  });
+}
+
+// src/vendor.ts
+function createRealVendor(options) {
+  const calls = [];
+  const requirementFor = (url) => PaymentRequirement.parse({
+    scheme: "exact",
+    network: options.network ?? "base-sepolia",
+    maxAmountRequired: options.atomicPrice,
+    resource: url,
+    description: options.description ?? "",
+    mimeType: "application/json",
+    payTo: options.payTo,
+    maxTimeoutSeconds: options.maxTimeoutSeconds ?? 300,
+    asset: options.asset ?? BASE_SEPOLIA_USDC,
+    extra: options.extra ?? { name: "USDC", version: "2" }
+  });
+  const paymentRequired = (url, error) => new Response(JSON.stringify({ x402Version: 1, accepts: [requirementFor(url)], error }), {
+    status: 402,
+    headers: { "content-type": "application/json" }
+  });
+  const fetch = async (input, init) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    const headers = new Headers(
+      init?.headers ?? (input instanceof Request ? input.headers : void 0)
+    );
+    const payment = headers.get("X-PAYMENT");
+    calls.push({ url, payment });
+    if (payment === null) return paymentRequired(url, "X-PAYMENT header is required");
+    const requirement = requirementFor(url);
+    let payload;
+    try {
+      payload = decodePaymentHeader(payment);
+    } catch (err) {
+      if (err instanceof RailsError) return paymentRequired(url, err.message);
+      throw err;
+    }
+    const verified = await options.facilitator.verify(payload, requirement);
+    if (!verified.isValid) {
+      return paymentRequired(url, verified.invalidReason ?? "payment verification failed");
+    }
+    const settled = await options.facilitator.settle(payload, requirement);
+    if (!settled.success) {
+      return paymentRequired(url, settled.errorReason ?? "payment settlement failed");
+    }
+    return new Response(JSON.stringify(options.body ?? { ok: true }), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "X-PAYMENT-RESPONSE": encodeSettlementHeader(settled)
+      }
+    });
+  };
+  return { fetch, calls, requirementFor };
+}
+
+// src/indexer.ts
+import { EventEmitter } from "events";
+import { parseAbi } from "viem";
+var railEventsAbi = parseAbi([
+  "event Transfer(address indexed from, address indexed to, uint256 value)",
+  "event AuthorizationUsed(address indexed authorizer, bytes32 indexed nonce)"
+]);
+var OnchainIndexer = class {
+  options;
+  bus = new EventEmitter();
+  emitted = [];
+  /** Every intent the engine has seen, by id (from `intent.created`). */
+  intents = /* @__PURE__ */ new Map();
+  /** Intents with an ALLOW decision, by id. */
+  allowed = /* @__PURE__ */ new Map();
+  settledIntents = /* @__PURE__ */ new Set();
+  /** Expected on-chain nonce -> intent id, for every allowed intent. */
+  nonceToIntent = /* @__PURE__ */ new Map();
+  timer;
+  nextBlock;
+  scanning = false;
+  constructor(options) {
+    this.options = options;
+  }
+  /** Subscribe to a policy engine's event stream to learn which intents were allowed. */
+  connectEngine(engine) {
+    engine.onEvent((event) => {
+      if (event.type === "intent.created") {
+        this.intents.set(event.intent.id, event.intent);
+      } else if (event.type === "decision.made" && event.decision.outcome === "allow") {
+        const intent = this.intents.get(event.decision.intentId);
+        if (intent) {
+          this.allowed.set(intent.id, intent);
+          this.nonceToIntent.set(intentNonce(intent.id).toLowerCase(), intent.id);
+        }
+      }
+    });
+  }
+  /** Begin polling. Scans from `fromBlock` (default: the current head). */
+  async start() {
+    if (this.timer !== void 0) return;
+    this.nextBlock = this.options.fromBlock ?? await this.options.client.getBlockNumber() + 1n;
+    const interval = this.options.pollIntervalMs ?? 3e3;
+    this.timer = setInterval(() => void this.scan(), interval);
+    this.timer.unref?.();
+  }
+  stop() {
+    if (this.timer !== void 0) clearInterval(this.timer);
+    this.timer = void 0;
+  }
+  onEvent(handler) {
+    this.bus.on("event", handler);
+  }
+  /** Everything the indexer has emitted, oldest first. */
+  events() {
+    return this.emitted;
+  }
+  settledPayments() {
+    return this.emitted.flatMap((e) => e.type === "payment.settled" ? [e.payment] : []);
+  }
+  shadowSpends() {
+    return this.emitted.filter((e) => e.type === "shadow.spend");
+  }
+  /** Resolve when an event (past or future) matches; reject on timeout. */
+  waitFor(predicate, timeoutMs = 9e4) {
+    const existing = this.emitted.find(predicate);
+    if (existing) return Promise.resolve(existing);
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        this.bus.off("event", handler);
+        reject(new Error(`indexer: no matching event within ${timeoutMs}ms`));
+      }, timeoutMs);
+      const handler = (event) => {
+        if (!predicate(event)) return;
+        clearTimeout(timeout);
+        this.bus.off("event", handler);
+        resolve(event);
+      };
+      this.bus.on("event", handler);
+    });
+  }
+  /** One poll: fetch logs since the last scanned block and classify them. */
+  async scan() {
+    if (this.scanning || this.nextBlock === void 0) return;
+    this.scanning = true;
+    try {
+      const head = await this.options.client.getBlockNumber();
+      if (head < this.nextBlock) return;
+      const logs = await this.options.client.getLogs({
+        address: this.options.usdcAddress ?? BASE_SEPOLIA_USDC,
+        events: railEventsAbi,
+        fromBlock: this.nextBlock,
+        toBlock: head
+      });
+      for (const tx of groupByTx(logs)) this.observe(tx);
+      this.nextBlock = head + 1n;
+    } catch (err) {
+      this.options.onError?.(err);
+    } finally {
+      this.scanning = false;
+    }
+  }
+  emit(event) {
+    const parsed = ReinEvent.parse(event);
+    this.emitted.push(parsed);
+    this.bus.emit("event", parsed);
+  }
+  agentFor(from) {
+    const chain = this.options.chain ?? "base";
+    for (const agent of this.options.agents()) {
+      const owns = agent.wallets.some((w) => w.chain === chain && sameAddress(w.address, from));
+      if (owns) return agent.id;
+    }
+    return void 0;
+  }
+  observe(tx) {
+    for (const transfer of tx.transfers) {
+      const from = transfer.args.from;
+      if (from === void 0 || transfer.args.value === void 0) continue;
+      const agentId = this.agentFor(from);
+      if (agentId === void 0) continue;
+      const intent = this.reconcile(tx, from, agentId);
+      const at = /* @__PURE__ */ new Date();
+      if (intent) {
+        this.settledIntents.add(intent.id);
+        this.emit({
+          type: "payment.settled",
+          at,
+          payment: {
+            intentId: intent.id,
+            txHash: tx.txHash,
+            chain: this.options.chain ?? "base",
+            blockNumber: transfer.blockNumber ?? 0n,
+            facilitator: this.options.facilitator,
+            confirmedAt: at
+          }
+        });
+        continue;
+      }
+      this.emit({
+        type: "shadow.spend",
+        at,
+        agentId,
+        txHash: tx.txHash,
+        chain: this.options.chain ?? "base",
+        amount: atomicToDecimal(transfer.args.value.toString(), this.options.decimals ?? 6)
+      });
+    }
+  }
+  reconcile(tx, from, agentId) {
+    for (const auth of tx.authorizations) {
+      const { authorizer, nonce } = auth.args;
+      if (authorizer === void 0 || nonce === void 0) continue;
+      if (!sameAddress(authorizer, from)) continue;
+      const intentId = this.nonceToIntent.get(nonce.toLowerCase());
+      if (intentId === void 0) continue;
+      const intent = this.allowed.get(intentId);
+      if (intent && intent.agentId === agentId && !this.settledIntents.has(intent.id)) {
+        return intent;
+      }
+    }
+    return void 0;
+  }
+};
+function groupByTx(logs) {
+  const byTx = /* @__PURE__ */ new Map();
+  for (const log of logs) {
+    if (log.transactionHash === null) continue;
+    let tx = byTx.get(log.transactionHash);
+    if (!tx) {
+      tx = { txHash: log.transactionHash, transfers: [], authorizations: [] };
+      byTx.set(log.transactionHash, tx);
+    }
+    (log.eventName === "Transfer" ? tx.transfers : tx.authorizations).push(log);
+  }
+  return [...byTx.values()];
+}
+function sameAddress(a, b) {
+  return a === b || a.toLowerCase() === b.toLowerCase();
+}
+export {
+  BASE_SEPOLIA_USDC,
+  CIRCLE_FAUCET_URL,
+  DEFAULT_FACILITATOR_URL,
+  ExactEvmAuthorization,
+  ExactEvmPayload,
+  FacilitatorClient,
+  FacilitatorHttpError,
+  OnchainIndexer,
+  PaymentPayload,
+  RailsError,
+  SettleResponse,
+  VerifyResponse,
+  basescanTxUrl,
+  chainIdForNetwork,
+  createBaseSepoliaClient,
+  createRealVendor,
+  createX402Payer,
+  decodePaymentHeader,
+  encodePaymentHeader,
+  encodeSettlementHeader,
+  generateWallet,
+  getUsdcBalance,
+  intentNonce,
+  railEventsAbi,
+  transferWithAuthorizationTypes
+};
+//# sourceMappingURL=index.js.map