@rempart/sdk 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## 0.1.0 — 2026-07-06
+
+- Version initiale: score, scoreDeep, account, pricing, verifySignature offline, retries 429/5xx, mode x402 par payer() injecté.

package/README.md

@@ -0,0 +1,52 @@
+# @rempart/sdk
+
+Signed anti-scam verdicts for Solana tokens. One call → score 0-100, verdict, confidence, machine-readable reasons, ed25519 signature you can verify offline.
+
+```sh
+npm i @rempart/sdk
+```
+
+## Sniper bot in 30 lines
+
+```ts
+import { Rempart } from '@rempart/sdk';
+
+const rempart = new Rempart({
+  apiKey: process.env.REMPART_KEY, // prepaid key — or use the x402 payer below
+  baseUrl: 'https://api.rempart.example',
+});
+
+export async function shouldBuy(mint: string): Promise<boolean> {
+  let verdict;
+  try {
+    verdict = await rempart.score(mint); // $0.05, p95 < 2s
+  } catch {
+    return false; // API down = unknown = do NOT treat as safe
+  }
+  // never trust the wire blindly: verify the signature offline
+  if (!(await rempart.verifySignature(verdict))) return false;
+  if (verdict.verdict !== 'safe') return false;
+  if (verdict.confidence < 0.7) return false;
+  // machine-readable reasons let you apply your own policy:
+  const hardStops = ['DEPLOYER_PRIOR_RUG', 'T22_PERMANENT_DELEGATE'];
+  if (verdict.reasons.some((r) => hardStops.includes(r.code))) return false;
+  return true;
+}
+
+// agent-native alternative: pay per call in USDC via x402, no account at all
+const agent = new Rempart({
+  payer: async (accepts) => signUsdcPayment(accepts), // your wallet logic (e.g. @solana/web3.js)
+});
+```
+
+Responses are `data-not-advice`: an input to your decision logic, not financial advice.
+
+## API
+
+- `score(mint)` — standard verdict ($0.05)
+- `scoreDeep(mint)` — + full deployer funding graph ($0.15)
+- `verifySignature(response, publicKeyHex?)` — offline ed25519 check (pubkey auto-fetched from `/.well-known/rempart-pubkey.json` and cached)
+- `account()` — prepaid balance & 30-day usage
+- `pricing()` — machine-readable pricing
+
+Retries: automatic with backoff on 429/5xx. Never on 402.

package/dist/contract.d.ts

@@ -0,0 +1,227 @@
+import { z } from 'zod';
+export declare const ReasonSchema: z.ZodObject<{
+    code: z.ZodString;
+    weight: z.ZodNumber;
+    detail: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    weight: number;
+    detail: string;
+}, {
+    code: string;
+    weight: number;
+    detail: string;
+}>;
+export type Reason = z.infer<typeof ReasonSchema>;
+export declare const VerdictSchema: z.ZodEnum<["danger", "caution", "safe"]>;
+export type Verdict = z.infer<typeof VerdictSchema>;
+export declare const ScoreResponseSchema: z.ZodObject<{
+    mint: z.ZodString;
+    score: z.ZodNumber;
+    verdict: z.ZodEnum<["danger", "caution", "safe"]>;
+    confidence: z.ZodNumber;
+    reasons: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        weight: z.ZodNumber;
+        detail: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        weight: number;
+        detail: string;
+    }, {
+        code: string;
+        weight: number;
+        detail: string;
+    }>, "many">;
+    model_version: z.ZodString;
+    features_at: z.ZodString;
+    key_id: z.ZodOptional<z.ZodString>;
+    signature: z.ZodOptional<z.ZodString>;
+    disclaimer: z.ZodLiteral<"data-not-advice">;
+}, "strip", z.ZodTypeAny, {
+    mint: string;
+    score: number;
+    verdict: "danger" | "caution" | "safe";
+    confidence: number;
+    reasons: {
+        code: string;
+        weight: number;
+        detail: string;
+    }[];
+    model_version: string;
+    features_at: string;
+    disclaimer: "data-not-advice";
+    key_id?: string | undefined;
+    signature?: string | undefined;
+}, {
+    mint: string;
+    score: number;
+    verdict: "danger" | "caution" | "safe";
+    confidence: number;
+    reasons: {
+        code: string;
+        weight: number;
+        detail: string;
+    }[];
+    model_version: string;
+    features_at: string;
+    disclaimer: "data-not-advice";
+    key_id?: string | undefined;
+    signature?: string | undefined;
+}>;
+export type ScoreResponse = z.infer<typeof ScoreResponseSchema>;
+/** Forme des features telle qu'exposée dans les rapports deep (sous-ensemble public). */
+export declare const FeaturesSchema: z.ZodObject<{
+    mint: z.ZodString;
+    programOrigin: z.ZodOptional<z.ZodEnum<["pumpfun", "raydium", "spl"]>>;
+    mintAuthorityRevoked: z.ZodOptional<z.ZodBoolean>;
+    freezeAuthorityRevoked: z.ZodOptional<z.ZodBoolean>;
+    lp: z.ZodOptional<z.ZodObject<{
+        exists: z.ZodBoolean;
+        lockedOrBurned: z.ZodOptional<z.ZodBoolean>;
+        solValue: z.ZodOptional<z.ZodNumber>;
+        pctSupply: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        exists: boolean;
+        lockedOrBurned?: boolean | undefined;
+        solValue?: number | undefined;
+        pctSupply?: number | undefined;
+    }, {
+        exists: boolean;
+        lockedOrBurned?: boolean | undefined;
+        solValue?: number | undefined;
+        pctSupply?: number | undefined;
+    }>>;
+    holders: z.ZodOptional<z.ZodObject<{
+        top10Pct: z.ZodNumber;
+        count: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        top10Pct: number;
+        count?: number | undefined;
+    }, {
+        top10Pct: number;
+        count?: number | undefined;
+    }>>;
+    deployer: z.ZodOptional<z.ZodObject<{
+        wallet: z.ZodOptional<z.ZodString>;
+        ageDays: z.ZodOptional<z.ZodNumber>;
+        tokensDeployed30d: z.ZodOptional<z.ZodNumber>;
+        priorRugs: z.ZodOptional<z.ZodNumber>;
+        fundedByRugger: z.ZodOptional<z.ZodBoolean>;
+        cleanHistory: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        wallet?: string | undefined;
+        ageDays?: number | undefined;
+        tokensDeployed30d?: number | undefined;
+        priorRugs?: number | undefined;
+        fundedByRugger?: boolean | undefined;
+        cleanHistory?: boolean | undefined;
+    }, {
+        wallet?: string | undefined;
+        ageDays?: number | undefined;
+        tokensDeployed30d?: number | undefined;
+        priorRugs?: number | undefined;
+        fundedByRugger?: boolean | undefined;
+        cleanHistory?: boolean | undefined;
+    }>>;
+    token2022: z.ZodOptional<z.ZodObject<{
+        transferFeePct: z.ZodOptional<z.ZodNumber>;
+        permanentDelegate: z.ZodOptional<z.ZodBoolean>;
+        unknownTransferHook: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        transferFeePct?: number | undefined;
+        permanentDelegate?: boolean | undefined;
+        unknownTransferHook?: boolean | undefined;
+    }, {
+        transferFeePct?: number | undefined;
+        permanentDelegate?: boolean | undefined;
+        unknownTransferHook?: boolean | undefined;
+    }>>;
+    externalVerdicts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source: z.ZodString;
+        risky: z.ZodBoolean;
+        detail: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        source: string;
+        risky: boolean;
+        detail?: string | undefined;
+    }, {
+        source: string;
+        risky: boolean;
+        detail?: string | undefined;
+    }>, "many">>;
+    featuresAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    mint: string;
+    featuresAt: string;
+    programOrigin?: "pumpfun" | "raydium" | "spl" | undefined;
+    mintAuthorityRevoked?: boolean | undefined;
+    freezeAuthorityRevoked?: boolean | undefined;
+    lp?: {
+        exists: boolean;
+        lockedOrBurned?: boolean | undefined;
+        solValue?: number | undefined;
+        pctSupply?: number | undefined;
+    } | undefined;
+    holders?: {
+        top10Pct: number;
+        count?: number | undefined;
+    } | undefined;
+    deployer?: {
+        wallet?: string | undefined;
+        ageDays?: number | undefined;
+        tokensDeployed30d?: number | undefined;
+        priorRugs?: number | undefined;
+        fundedByRugger?: boolean | undefined;
+        cleanHistory?: boolean | undefined;
+    } | undefined;
+    token2022?: {
+        transferFeePct?: number | undefined;
+        permanentDelegate?: boolean | undefined;
+        unknownTransferHook?: boolean | undefined;
+    } | undefined;
+    externalVerdicts?: {
+        source: string;
+        risky: boolean;
+        detail?: string | undefined;
+    }[] | undefined;
+}, {
+    mint: string;
+    featuresAt: string;
+    programOrigin?: "pumpfun" | "raydium" | "spl" | undefined;
+    mintAuthorityRevoked?: boolean | undefined;
+    freezeAuthorityRevoked?: boolean | undefined;
+    lp?: {
+        exists: boolean;
+        lockedOrBurned?: boolean | undefined;
+        solValue?: number | undefined;
+        pctSupply?: number | undefined;
+    } | undefined;
+    holders?: {
+        top10Pct: number;
+        count?: number | undefined;
+    } | undefined;
+    deployer?: {
+        wallet?: string | undefined;
+        ageDays?: number | undefined;
+        tokensDeployed30d?: number | undefined;
+        priorRugs?: number | undefined;
+        fundedByRugger?: boolean | undefined;
+        cleanHistory?: boolean | undefined;
+    } | undefined;
+    token2022?: {
+        transferFeePct?: number | undefined;
+        permanentDelegate?: boolean | undefined;
+        unknownTransferHook?: boolean | undefined;
+    } | undefined;
+    externalVerdicts?: {
+        source: string;
+        risky: boolean;
+        detail?: string | undefined;
+    }[] | undefined;
+}>;
+export type Features = z.infer<typeof FeaturesSchema>;
+/** JSON canonique: clés triées récursivement, sans espaces — la signature porte sur cette forme. */
+export declare function canonicalStringify(value: unknown): string;
+/** Vérification hors ligne d'un verdict signé, contre la pubkey publiée à /.well-known/rempart-pubkey.json. */
+export declare function verifyScoreResponse(response: ScoreResponse, publicKeyHex: string): boolean;

package/dist/contract.js

@@ -0,0 +1,110 @@
+/**
+ * Contrat public de l'API Rempart — copie contrôlée de la surface PUBLIQUE de
+ * @rempart/core (schemas de réponse, JSON canonique, vérification ed25519).
+ *
+ * Pourquoi une copie et pas une dépendance: @rempart/core contient le modèle de
+ * scoring (règles + poids), qui est le moat du produit et ne doit JAMAIS être
+ * publié sur npm (ROADMAP §9 risque D). Le SDK n'embarque que le contrat.
+ * La non-dérive est garantie par un test de parité dans test/contract-sync.test.ts
+ * (core reste devDependency workspace, jamais dans le tarball publié).
+ */
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha512';
+import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils';
+import { z } from 'zod';
+ed.etc.sha512Sync = (...m) => sha512(ed.etc.concatBytes(...m));
+export const ReasonSchema = z.object({
+    code: z.string(),
+    weight: z.number(),
+    detail: z.string(),
+});
+export const VerdictSchema = z.enum(['danger', 'caution', 'safe']);
+export const ScoreResponseSchema = z.object({
+    mint: z.string(),
+    score: z.number().int().min(0).max(100),
+    verdict: VerdictSchema,
+    confidence: z.number().min(0).max(1),
+    reasons: z.array(ReasonSchema),
+    model_version: z.string(),
+    features_at: z.string(),
+    key_id: z.string().optional(),
+    signature: z.string().optional(),
+    disclaimer: z.literal('data-not-advice'),
+});
+/** Forme des features telle qu'exposée dans les rapports deep (sous-ensemble public). */
+export const FeaturesSchema = z.object({
+    mint: z.string().min(32).max(44),
+    programOrigin: z.enum(['pumpfun', 'raydium', 'spl']).optional(),
+    mintAuthorityRevoked: z.boolean().optional(),
+    freezeAuthorityRevoked: z.boolean().optional(),
+    lp: z
+        .object({
+        exists: z.boolean(),
+        lockedOrBurned: z.boolean().optional(),
+        solValue: z.number().nonnegative().optional(),
+        pctSupply: z.number().min(0).max(100).optional(),
+    })
+        .optional(),
+    holders: z
+        .object({
+        top10Pct: z.number().min(0).max(100),
+        count: z.number().int().nonnegative().optional(),
+    })
+        .optional(),
+    deployer: z
+        .object({
+        wallet: z.string().optional(),
+        ageDays: z.number().nonnegative().optional(),
+        tokensDeployed30d: z.number().int().nonnegative().optional(),
+        priorRugs: z.number().int().nonnegative().optional(),
+        fundedByRugger: z.boolean().optional(),
+        cleanHistory: z.boolean().optional(),
+    })
+        .optional(),
+    token2022: z
+        .object({
+        transferFeePct: z.number().min(0).max(100).optional(),
+        permanentDelegate: z.boolean().optional(),
+        unknownTransferHook: z.boolean().optional(),
+    })
+        .optional(),
+    externalVerdicts: z
+        .array(z.object({
+        source: z.string(),
+        risky: z.boolean(),
+        detail: z.string().optional(),
+    }))
+        .optional(),
+    featuresAt: z.string().datetime(),
+});
+/** JSON canonique: clés triées récursivement, sans espaces — la signature porte sur cette forme. */
+export function canonicalStringify(value) {
+    return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortValue);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const v = value[key];
+            if (v !== undefined)
+                out[key] = sortValue(v);
+        }
+        return out;
+    }
+    return value;
+}
+/** Vérification hors ligne d'un verdict signé, contre la pubkey publiée à /.well-known/rempart-pubkey.json. */
+export function verifyScoreResponse(response, publicKeyHex) {
+    const { signature, key_id: _keyId, ...unsigned } = response;
+    if (!signature)
+        return false;
+    try {
+        return ed.verify(hexToBytes(signature), utf8ToBytes(canonicalStringify(unsigned)), hexToBytes(publicKeyHex));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=contract.js.map

package/dist/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAGnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,OAAO,EAAE,aAAa;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;CACzC,CAAC,CAAC;AAGH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9C,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;QACnB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACjD,CAAC;SACD,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACjD,CAAC;SACD,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACpD,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACtC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACrD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC;SACD,QAAQ,EAAE;IACb,gBAAgB,EAAE,CAAC;SAChB,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CACH;SACA,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,mBAAmB,CAAC,QAAuB,EAAE,YAAoB;IAC/E,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC5D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+import { type ScoreResponse } from './contract.js';
+export { canonicalStringify, FeaturesSchema, ReasonSchema, ScoreResponseSchema, VerdictSchema, verifyScoreResponse, } from './contract.js';
+export type { Features, Reason, ScoreResponse, Verdict } from './contract.js';
+/**
+ * Callback x402: reçoit les exigences de paiement du 402 (accepts[0]) et retourne
+ * la preuve encodée base64 pour l'en-tête X-PAYMENT. L'injection évite toute
+ * dépendance lourde: @solana/web3.js reste chez l'appelant (peer optionnelle).
+ */
+export type X402Payer = (accepts: Record<string, unknown>) => Promise<string>;
+export interface RempartOptions {
+    apiKey?: string;
+    payer?: X402Payer;
+    baseUrl?: string;
+    maxRetries?: number;
+    fetchImpl?: typeof fetch;
+}
+export declare class RempartError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(message: string, status: number, body: unknown);
+}
+export declare class Rempart {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly payer;
+    private readonly maxRetries;
+    private readonly fetchImpl;
+    private pubkeyCache;
+    constructor(opts?: RempartOptions);
+    /** Verdict standard (0.05 $). */
+    score(mint: string): Promise<ScoreResponse>;
+    /** Verdict + funding graph complet (0.15 $). */
+    scoreDeep(mint: string): Promise<ScoreResponse & {
+        funding_graph?: unknown;
+    }>;
+    /** Solde et conso (rail clé prépayée uniquement). */
+    account(): Promise<Record<string, unknown>>;
+    pricing(): Promise<Record<string, unknown>>;
+    /** Vérification ed25519 hors ligne contre la pubkey publiée (mise en cache). */
+    verifySignature(response: ScoreResponse, publicKeyHex?: string): Promise<boolean>;
+    private publishedKey;
+    private paidGet;
+    /** Retries: 429 et 5xx avec backoff exponentiel. Jamais sur 402 ni 4xx. */
+    private request;
+}

package/dist/index.js

@@ -0,0 +1,99 @@
+import { ScoreResponseSchema, verifyScoreResponse, } from './contract.js';
+export { canonicalStringify, FeaturesSchema, ReasonSchema, ScoreResponseSchema, VerdictSchema, verifyScoreResponse, } from './contract.js';
+export class RempartError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+    }
+}
+export class Rempart {
+    baseUrl;
+    apiKey;
+    payer;
+    maxRetries;
+    fetchImpl;
+    pubkeyCache = null;
+    constructor(opts = {}) {
+        this.baseUrl = (opts.baseUrl ?? 'https://api.rempart.example').replace(/\/$/, '');
+        this.apiKey = opts.apiKey;
+        this.payer = opts.payer;
+        this.maxRetries = opts.maxRetries ?? 3;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    /** Verdict standard (0.05 $). */
+    score(mint) {
+        return this.paidGet(`/v1/score/${mint}`).then((b) => ScoreResponseSchema.passthrough().parse(b));
+    }
+    /** Verdict + funding graph complet (0.15 $). */
+    scoreDeep(mint) {
+        return this.paidGet(`/v1/score/${mint}/deep`).then((b) => ScoreResponseSchema.passthrough().parse(b));
+    }
+    /** Solde et conso (rail clé prépayée uniquement). */
+    async account() {
+        if (!this.apiKey)
+            throw new Error('account() nécessite une apiKey (les payeurs x402 n’ont pas de solde chez nous)');
+        const res = await this.request(`${this.baseUrl}/v1/account`, { headers: { Authorization: `Bearer ${this.apiKey}` } });
+        return (await res.json());
+    }
+    async pricing() {
+        const res = await this.request(`${this.baseUrl}/pricing`, {});
+        return (await res.json());
+    }
+    /** Vérification ed25519 hors ligne contre la pubkey publiée (mise en cache). */
+    async verifySignature(response, publicKeyHex) {
+        const pub = publicKeyHex ?? (await this.publishedKey());
+        return verifyScoreResponse(response, pub);
+    }
+    async publishedKey() {
+        if (this.pubkeyCache)
+            return this.pubkeyCache;
+        const res = await this.request(`${this.baseUrl}/.well-known/rempart-pubkey.json`, {});
+        const body = (await res.json());
+        this.pubkeyCache = body.public_key_hex;
+        return this.pubkeyCache;
+    }
+    async paidGet(path) {
+        const url = `${this.baseUrl}${path}`;
+        const headers = {};
+        if (this.apiKey)
+            headers.Authorization = `Bearer ${this.apiKey}`;
+        let res = await this.request(url, { headers }, { allow402: true });
+        if (res.status === 402 && this.payer) {
+            // mode x402: payer puis rejouer avec la preuve. Jamais de retry automatique sur 402 (spec plan-06).
+            const body = (await res.json());
+            const accepts = body.accepts?.[0];
+            if (!accepts)
+                throw new RempartError('402 sans accepts[]', 402, body);
+            const proof = await this.payer(accepts);
+            res = await this.request(url, { headers: { ...headers, 'X-PAYMENT': proof } }, { allow402: true });
+        }
+        if (res.status === 402) {
+            throw new RempartError('payment required: fournir apiKey (créditée) ou payer x402', 402, await res.json());
+        }
+        if (!res.ok)
+            throw new RempartError(`HTTP ${res.status}`, res.status, await res.json().catch(() => null));
+        return res.json();
+    }
+    /** Retries: 429 et 5xx avec backoff exponentiel. Jamais sur 402 ni 4xx. */
+    async request(url, init, opts = {}) {
+        let last = null;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+            const res = await this.fetchImpl(url, init);
+            if (res.status === 429 || res.status >= 500) {
+                last = res;
+                const retryAfter = Number(res.headers.get('Retry-After') ?? 0);
+                const delay = retryAfter > 0 ? retryAfter * 1000 : 250 * 2 ** attempt;
+                await new Promise((r) => setTimeout(r, Math.min(delay, 5000)));
+                continue;
+            }
+            if (!opts.allow402 && res.status === 402)
+                return res;
+            return res;
+        }
+        return last;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAkBvB,MAAM,OAAO,YAAa,SAAQ,KAAK;IAGnB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;IAG/B,CAAC;CACF;AAED,MAAM,OAAO,OAAO;IACD,OAAO,CAAS;IAChB,MAAM,CAAqB;IAC3B,KAAK,CAAwB;IAC7B,UAAU,CAAS;IACnB,SAAS,CAAe;IACjC,WAAW,GAAkB,IAAI,CAAC;IAE1C,YAAY,OAAuB,EAAE;QACnC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,IAAY;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAkB,CAAC,CAAC;IACpH,CAAC;IAED,gDAAgD;IAChD,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAgD,CACjG,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACtH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,eAAe,CAAC,QAAuB,EAAE,YAAqB;QAClE,MAAM,GAAG,GAAG,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,kCAAkC,EAAE,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY;QAChC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QACjE,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,oGAAoG;YACpG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;YAChF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxC,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CAAC,2DAA2D,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1G,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAiB,EAAE,OAA+B,EAAE;QACrF,IAAI,IAAI,GAAoB,IAAI,CAAC;QACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC5C,IAAI,GAAG,GAAG,CAAC;gBACX,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC;gBACtE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YACrD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,IAAgB,CAAC;IAC1B,CAAC;CACF"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@rempart/sdk",
+  "version": "0.1.0",
+  "description": "Signed anti-scam verdicts for Solana tokens. One call, one USDC micropayment (x402) or prepaid key.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://rempart.app",
+  "keywords": [
+    "solana",
+    "anti-scam",
+    "rug-check",
+    "x402",
+    "trading-bot",
+    "token-security"
+  ],
+  "dependencies": {
+    "@noble/ed25519": "^2.2.3",
+    "@noble/hashes": "^1.7.1",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4",
+    "@rempart/core": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  }
+}