@routedock/routedock 0.1.2 → 0.3.0

package/dist/MppSessionHandler-1EL8QBAn.d.cts

@@ -0,0 +1,215 @@
+import { g as RouteDockLogger, h as RouteDockManifest } from './logger-D8_Q2ytp.cjs';
+import { RequestHandler } from 'express';
+import { Store } from 'mppx';
+
+/**
+ * Idempotency store for payment settlement.
+ *
+ * `x402Handler` and `MppChargeHandler` settle on every request carrying a
+ * payment header. An agent that retries after a post-settlement network
+ * timeout resends the *same* signed payment, which would settle a second time
+ * and invoke `onSettled` twice — double-counting in billing.
+ *
+ * Before settling, a handler derives an idempotency key from the inbound
+ * payment header(s) *together with the resource being paid for* and checks
+ * this store. On a hit it replays the cached settlement response and skips
+ * both the on-chain settle and `onSettled`. A hit older than
+ * {@link SETTLEMENT_REPLAY_WINDOW_MS}, or one replayed more than
+ * {@link MAX_SETTLEMENT_REPLAYS} times, is rejected instead of replayed so a
+ * leaked header cannot buy unlimited requests.
+ *
+ * `claimReplay` and {@link SettlementRecord.createdAt} are optional so a
+ * custom store written against the original two-method (`get`/`set`) contract
+ * keeps compiling. See {@link checkSettlementReplay} for how a store that
+ * supplies neither bounds a replay.
+ *
+ * The default {@link InMemorySeenTxStore} is per-handler and per-process. For
+ * multi-instance deployments, supply a shared implementation backed by Redis,
+ * Supabase, etc.
+ */
+/** The resource a settlement idempotency key is scoped to. */
+interface SettlementScope {
+    /** HTTP method of the paid request (e.g. `GET`). */
+    method: string;
+    /** Path of the paid request, without query string (e.g. `/price`). */
+    path: string;
+    /** Charge amount as declared by the route's requirements. */
+    amount: string;
+    /** Payee address the route settles to. */
+    payTo: string;
+}
+/** Cached outcome of a settlement, replayed on a duplicate payment. */
+interface SettlementRecord {
+    /** On-chain transaction hash (or settlement reference), if known. */
+    txHash: string | null;
+    /** Response headers to re-apply on a replay (e.g. `X-Payment-Response`). */
+    headers?: Record<string, string>;
+    /**
+     * Epoch milliseconds at which the settlement was recorded. Optional for
+     * backwards compatibility with custom stores that predate the replay bound;
+     * a record without it can only be bounded by the replay count.
+     */
+    createdAt?: number;
+}
+interface SeenTxStore {
+    /** Returns the cached settlement for a key, or `undefined` if unseen. */
+    get(key: string): Promise<SettlementRecord | undefined> | SettlementRecord | undefined;
+    /** Records the settlement outcome for a key. */
+    set(key: string, record: SettlementRecord): Promise<void> | void;
+    /**
+     * Optionally, atomically record one replay of `key` and return the new
+     * replay count. Returns `Infinity` when the key is unknown (e.g. evicted
+     * between a `get` and this call), so the caller treats the payment as spent
+     * rather than replaying an unbounded number of times.
+     *
+     * Optional so a custom store written against the original two-method
+     * (`get`/`set`) contract keeps compiling. A store that omits it is still
+     * bounded by {@link SETTLEMENT_REPLAY_WINDOW_MS} when its records carry
+     * {@link SettlementRecord.createdAt}.
+     */
+    claimReplay?(key: string): Promise<number> | number;
+}
+interface InMemorySeenTxStoreOptions {
+    /** Maximum number of entries before FIFO eviction. Defaults to 10,000. */
+    maxEntries?: number;
+    /** Log a startup warning about non-durability. Defaults to true. */
+    warn?: boolean;
+    /** Log sink for the non-durability warning. Defaults to a console-backed logger. */
+    logger?: RouteDockLogger;
+}
+/**
+ * How long after a settlement a byte-identical retry may still replay the
+ * cached response. Matches the `maxTimeoutSeconds: 60` both x402 requirement
+ * objects declare, so past this point the payment is expired anyway.
+ */
+declare const SETTLEMENT_REPLAY_WINDOW_MS = 60000;
+/**
+ * How many times one settled payment may be replayed beyond the original
+ * settlement. The SDK's own clients never resend a byte-identical header —
+ * they re-sign on every retry — so a tight limit costs nothing while stopping
+ * a leaked header from buying unlimited requests.
+ */
+declare const MAX_SETTLEMENT_REPLAYS = 1;
+/** Outcome of checking whether an idempotency key may replay a settlement. */
+type SettlementReplayCheck = {
+    kind: 'miss';
+} | {
+    kind: 'replay';
+    record: SettlementRecord;
+} | {
+    kind: 'spent';
+};
+/**
+ * Decide what a payment bearing `key` should do.
+ *
+ * - `miss`  — no cached settlement; fall through to decode and settle.
+ * - `replay`— a fresh settlement within the replay window and under the replay
+ *             limit; re-apply the recorded headers and skip settling.
+ * - `spent` — the settlement is older than the replay window, or has already
+ *             been replayed the maximum number of times; respond 402 without
+ *             decoding, settling, or invoking callbacks.
+ *
+ * The age check runs first so an expired record never touches the replay
+ * counter.
+ *
+ * Custom stores may predate this function and implement only `get`/`set`:
+ *
+ * - a record that carries `createdAt` but a store without `claimReplay` is
+ *   bounded by {@link SETTLEMENT_REPLAY_WINDOW_MS} alone;
+ * - a record without `createdAt` offers no window to check, so a store's own
+ *   `claimReplay` is the only bound available; a store that supplies neither
+ *   replays as it did before this function existed.
+ */
+declare function checkSettlementReplay(store: SeenTxStore, key: string, now?: number): Promise<SettlementReplayCheck>;
+/**
+ * Default in-memory {@link SeenTxStore}. Bounded by `maxEntries` with FIFO
+ * eviction so a long-running process cannot grow without limit.
+ *
+ * **Not durable.** On serverless/edge runtimes each request may land on a
+ * fresh isolate with an empty cache, which causes duplicate settlements.
+ * Supply a persistent implementation (Supabase, Redis, …) in production.
+ */
+declare class InMemorySeenTxStore implements SeenTxStore {
+    private readonly map;
+    private readonly replayCounts;
+    private readonly order;
+    constructor(maxEntriesOrOptions?: number | InMemorySeenTxStoreOptions);
+    private readonly maxEntries;
+    get(key: string): SettlementRecord | undefined;
+    set(key: string, record: SettlementRecord): void;
+    claimReplay(key: string): number;
+}
+/**
+ * Derive a collision-resistant idempotency key from the inbound
+ * payment-bearing headers, scoped to the resource being paid for. Uses
+ * SHA-256 instead of 32-bit FNV-1a (which has a 2^32 keyspace — birthday
+ * collisions become likely well before the 10_000-entry default store is
+ * full).
+ *
+ * x402 clients send the signed payment in `payment-signature` / `x-payment`;
+ * mppx clients send it in `authorization` (the `Payment` scheme). A retry
+ * resends byte-identical headers, so hashing the first present one yields a
+ * stable key.
+ *
+ * The `scope` (method, path, amount, payTo) is hashed alongside the header so
+ * a payment settled for one route can never replay against another route,
+ * even when the same store is shared across routes. Returns `null` when no
+ * payment header is present (nothing to dedupe — e.g. the initial 402
+ * challenge request).
+ */
+declare function paymentIdempotencyKey(getHeader: (name: string) => string | undefined, scope: SettlementScope): Promise<string | null>;
+
+/** Store shape extended with optional atomic update operation. */
+type ChannelStore = Store.Store & {
+    update?: (key: string, fn: (prev: unknown) => unknown) => Promise<unknown>;
+};
+/** Expected payload shape for voucher cumulative amount entries. */
+interface VoucherStoreValue {
+    amount: string;
+    [key: string]: unknown;
+}
+/** Validates that a stored store value is an object containing a numeric string amount. */
+declare function isVoucherStoreValue(value: unknown): value is VoucherStoreValue;
+type Network = 'testnet' | 'mainnet';
+/** Why a live session was flagged as orphaned (never cleanly closed). */
+type OrphanReason = 'connection-closed' | 'idle-timeout';
+/** Latest signed state of an orphaned session, enough for the reconciler to settle. */
+interface OrphanedSessionInfo {
+    /** Cumulative amount of the highest voucher seen (human-readable, 7 dp). */
+    cumulativeAmount: string;
+    /** Hex-encoded signature of the highest voucher seen. */
+    lastSignature: string;
+    /** Number of vouchers received before teardown. */
+    voucherCount: number;
+    /** What triggered the orphan flag. */
+    reason: OrphanReason;
+}
+interface MppSessionHandlerOptions {
+    payeeSecretKey: string;
+    network: Network;
+    channelFactory: string;
+    rate: string;
+    assetContract?: string;
+    manifest: RouteDockManifest;
+    commitmentPublicKey: string;
+    onSettled?: (txHash: string, totalPaid: string, mode: string, payer: string | null) => Promise<void>;
+    onSessionOpen?: (channelId: string, payer: string | null) => Promise<void>;
+    onVoucher?: (channelId: string, voucherIndex: number, cumulativeAmount: string, signature: string) => Promise<void>;
+    onCallbackError?: (err: unknown, cb: string) => void;
+    /**
+     * Called when the client connection drops mid-session or the session goes
+     * idle, before a clean close. Persist the session as `closing` so the
+     * SessionReconciler can settle it with the latest signed voucher.
+     */
+    onOrphaned?: (channelId: string, info: OrphanedSessionInfo) => Promise<void>;
+    /**
+     * Flag the session orphaned after this many milliseconds with no voucher
+     * activity. Disabled when unset.
+     */
+    idleTimeoutMs?: number;
+    /** Log sink for internal error paths. Defaults to a console-backed logger. */
+    logger?: RouteDockLogger;
+}
+declare function createMppSessionHandler(opts: MppSessionHandlerOptions): RequestHandler;
+
+export { type ChannelStore as C, InMemorySeenTxStore as I, MAX_SETTLEMENT_REPLAYS as M, type OrphanedSessionInfo as O, type SeenTxStore as S, type VoucherStoreValue as V, type SettlementRecord as a, type InMemorySeenTxStoreOptions as b, type MppSessionHandlerOptions as c, type OrphanReason as d, SETTLEMENT_REPLAY_WINDOW_MS as e, type SettlementReplayCheck as f, type SettlementScope as g, checkSettlementReplay as h, createMppSessionHandler as i, isVoucherStoreValue as j, paymentIdempotencyKey as p };

package/dist/MppSessionHandler-Bq4S-JTE.d.ts

@@ -0,0 +1,215 @@
+import { g as RouteDockLogger, h as RouteDockManifest } from './logger-D8_Q2ytp.js';
+import { RequestHandler } from 'express';
+import { Store } from 'mppx';
+
+/**
+ * Idempotency store for payment settlement.
+ *
+ * `x402Handler` and `MppChargeHandler` settle on every request carrying a
+ * payment header. An agent that retries after a post-settlement network
+ * timeout resends the *same* signed payment, which would settle a second time
+ * and invoke `onSettled` twice — double-counting in billing.
+ *
+ * Before settling, a handler derives an idempotency key from the inbound
+ * payment header(s) *together with the resource being paid for* and checks
+ * this store. On a hit it replays the cached settlement response and skips
+ * both the on-chain settle and `onSettled`. A hit older than
+ * {@link SETTLEMENT_REPLAY_WINDOW_MS}, or one replayed more than
+ * {@link MAX_SETTLEMENT_REPLAYS} times, is rejected instead of replayed so a
+ * leaked header cannot buy unlimited requests.
+ *
+ * `claimReplay` and {@link SettlementRecord.createdAt} are optional so a
+ * custom store written against the original two-method (`get`/`set`) contract
+ * keeps compiling. See {@link checkSettlementReplay} for how a store that
+ * supplies neither bounds a replay.
+ *
+ * The default {@link InMemorySeenTxStore} is per-handler and per-process. For
+ * multi-instance deployments, supply a shared implementation backed by Redis,
+ * Supabase, etc.
+ */
+/** The resource a settlement idempotency key is scoped to. */
+interface SettlementScope {
+    /** HTTP method of the paid request (e.g. `GET`). */
+    method: string;
+    /** Path of the paid request, without query string (e.g. `/price`). */
+    path: string;
+    /** Charge amount as declared by the route's requirements. */
+    amount: string;
+    /** Payee address the route settles to. */
+    payTo: string;
+}
+/** Cached outcome of a settlement, replayed on a duplicate payment. */
+interface SettlementRecord {
+    /** On-chain transaction hash (or settlement reference), if known. */
+    txHash: string | null;
+    /** Response headers to re-apply on a replay (e.g. `X-Payment-Response`). */
+    headers?: Record<string, string>;
+    /**
+     * Epoch milliseconds at which the settlement was recorded. Optional for
+     * backwards compatibility with custom stores that predate the replay bound;
+     * a record without it can only be bounded by the replay count.
+     */
+    createdAt?: number;
+}
+interface SeenTxStore {
+    /** Returns the cached settlement for a key, or `undefined` if unseen. */
+    get(key: string): Promise<SettlementRecord | undefined> | SettlementRecord | undefined;
+    /** Records the settlement outcome for a key. */
+    set(key: string, record: SettlementRecord): Promise<void> | void;
+    /**
+     * Optionally, atomically record one replay of `key` and return the new
+     * replay count. Returns `Infinity` when the key is unknown (e.g. evicted
+     * between a `get` and this call), so the caller treats the payment as spent
+     * rather than replaying an unbounded number of times.
+     *
+     * Optional so a custom store written against the original two-method
+     * (`get`/`set`) contract keeps compiling. A store that omits it is still
+     * bounded by {@link SETTLEMENT_REPLAY_WINDOW_MS} when its records carry
+     * {@link SettlementRecord.createdAt}.
+     */
+    claimReplay?(key: string): Promise<number> | number;
+}
+interface InMemorySeenTxStoreOptions {
+    /** Maximum number of entries before FIFO eviction. Defaults to 10,000. */
+    maxEntries?: number;
+    /** Log a startup warning about non-durability. Defaults to true. */
+    warn?: boolean;
+    /** Log sink for the non-durability warning. Defaults to a console-backed logger. */
+    logger?: RouteDockLogger;
+}
+/**
+ * How long after a settlement a byte-identical retry may still replay the
+ * cached response. Matches the `maxTimeoutSeconds: 60` both x402 requirement
+ * objects declare, so past this point the payment is expired anyway.
+ */
+declare const SETTLEMENT_REPLAY_WINDOW_MS = 60000;
+/**
+ * How many times one settled payment may be replayed beyond the original
+ * settlement. The SDK's own clients never resend a byte-identical header —
+ * they re-sign on every retry — so a tight limit costs nothing while stopping
+ * a leaked header from buying unlimited requests.
+ */
+declare const MAX_SETTLEMENT_REPLAYS = 1;
+/** Outcome of checking whether an idempotency key may replay a settlement. */
+type SettlementReplayCheck = {
+    kind: 'miss';
+} | {
+    kind: 'replay';
+    record: SettlementRecord;
+} | {
+    kind: 'spent';
+};
+/**
+ * Decide what a payment bearing `key` should do.
+ *
+ * - `miss`  — no cached settlement; fall through to decode and settle.
+ * - `replay`— a fresh settlement within the replay window and under the replay
+ *             limit; re-apply the recorded headers and skip settling.
+ * - `spent` — the settlement is older than the replay window, or has already
+ *             been replayed the maximum number of times; respond 402 without
+ *             decoding, settling, or invoking callbacks.
+ *
+ * The age check runs first so an expired record never touches the replay
+ * counter.
+ *
+ * Custom stores may predate this function and implement only `get`/`set`:
+ *
+ * - a record that carries `createdAt` but a store without `claimReplay` is
+ *   bounded by {@link SETTLEMENT_REPLAY_WINDOW_MS} alone;
+ * - a record without `createdAt` offers no window to check, so a store's own
+ *   `claimReplay` is the only bound available; a store that supplies neither
+ *   replays as it did before this function existed.
+ */
+declare function checkSettlementReplay(store: SeenTxStore, key: string, now?: number): Promise<SettlementReplayCheck>;
+/**
+ * Default in-memory {@link SeenTxStore}. Bounded by `maxEntries` with FIFO
+ * eviction so a long-running process cannot grow without limit.
+ *
+ * **Not durable.** On serverless/edge runtimes each request may land on a
+ * fresh isolate with an empty cache, which causes duplicate settlements.
+ * Supply a persistent implementation (Supabase, Redis, …) in production.
+ */
+declare class InMemorySeenTxStore implements SeenTxStore {
+    private readonly map;
+    private readonly replayCounts;
+    private readonly order;
+    constructor(maxEntriesOrOptions?: number | InMemorySeenTxStoreOptions);
+    private readonly maxEntries;
+    get(key: string): SettlementRecord | undefined;
+    set(key: string, record: SettlementRecord): void;
+    claimReplay(key: string): number;
+}
+/**
+ * Derive a collision-resistant idempotency key from the inbound
+ * payment-bearing headers, scoped to the resource being paid for. Uses
+ * SHA-256 instead of 32-bit FNV-1a (which has a 2^32 keyspace — birthday
+ * collisions become likely well before the 10_000-entry default store is
+ * full).
+ *
+ * x402 clients send the signed payment in `payment-signature` / `x-payment`;
+ * mppx clients send it in `authorization` (the `Payment` scheme). A retry
+ * resends byte-identical headers, so hashing the first present one yields a
+ * stable key.
+ *
+ * The `scope` (method, path, amount, payTo) is hashed alongside the header so
+ * a payment settled for one route can never replay against another route,
+ * even when the same store is shared across routes. Returns `null` when no
+ * payment header is present (nothing to dedupe — e.g. the initial 402
+ * challenge request).
+ */
+declare function paymentIdempotencyKey(getHeader: (name: string) => string | undefined, scope: SettlementScope): Promise<string | null>;
+
+/** Store shape extended with optional atomic update operation. */
+type ChannelStore = Store.Store & {
+    update?: (key: string, fn: (prev: unknown) => unknown) => Promise<unknown>;
+};
+/** Expected payload shape for voucher cumulative amount entries. */
+interface VoucherStoreValue {
+    amount: string;
+    [key: string]: unknown;
+}
+/** Validates that a stored store value is an object containing a numeric string amount. */
+declare function isVoucherStoreValue(value: unknown): value is VoucherStoreValue;
+type Network = 'testnet' | 'mainnet';
+/** Why a live session was flagged as orphaned (never cleanly closed). */
+type OrphanReason = 'connection-closed' | 'idle-timeout';
+/** Latest signed state of an orphaned session, enough for the reconciler to settle. */
+interface OrphanedSessionInfo {
+    /** Cumulative amount of the highest voucher seen (human-readable, 7 dp). */
+    cumulativeAmount: string;
+    /** Hex-encoded signature of the highest voucher seen. */
+    lastSignature: string;
+    /** Number of vouchers received before teardown. */
+    voucherCount: number;
+    /** What triggered the orphan flag. */
+    reason: OrphanReason;
+}
+interface MppSessionHandlerOptions {
+    payeeSecretKey: string;
+    network: Network;
+    channelFactory: string;
+    rate: string;
+    assetContract?: string;
+    manifest: RouteDockManifest;
+    commitmentPublicKey: string;
+    onSettled?: (txHash: string, totalPaid: string, mode: string, payer: string | null) => Promise<void>;
+    onSessionOpen?: (channelId: string, payer: string | null) => Promise<void>;
+    onVoucher?: (channelId: string, voucherIndex: number, cumulativeAmount: string, signature: string) => Promise<void>;
+    onCallbackError?: (err: unknown, cb: string) => void;
+    /**
+     * Called when the client connection drops mid-session or the session goes
+     * idle, before a clean close. Persist the session as `closing` so the
+     * SessionReconciler can settle it with the latest signed voucher.
+     */
+    onOrphaned?: (channelId: string, info: OrphanedSessionInfo) => Promise<void>;
+    /**
+     * Flag the session orphaned after this many milliseconds with no voucher
+     * activity. Disabled when unset.
+     */
+    idleTimeoutMs?: number;
+    /** Log sink for internal error paths. Defaults to a console-backed logger. */
+    logger?: RouteDockLogger;
+}
+declare function createMppSessionHandler(opts: MppSessionHandlerOptions): RequestHandler;
+
+export { type ChannelStore as C, InMemorySeenTxStore as I, MAX_SETTLEMENT_REPLAYS as M, type OrphanedSessionInfo as O, type SeenTxStore as S, type VoucherStoreValue as V, type SettlementRecord as a, type InMemorySeenTxStoreOptions as b, type MppSessionHandlerOptions as c, type OrphanReason as d, SETTLEMENT_REPLAY_WINDOW_MS as e, type SettlementReplayCheck as f, type SettlementScope as g, checkSettlementReplay as h, createMppSessionHandler as i, isVoucherStoreValue as j, paymentIdempotencyKey as p };

package/dist/ProviderRegistry-CA_TdREG.d.ts

@@ -0,0 +1,142 @@
+import { usdcToStroops } from '@routedock/nulth-sdk';
+import { l as SpendStore, a as DailySpend, R as RetryPolicy } from './RouteDockClient-Bh86bVly.js';
+import { ClientStellarSigner } from '@x402/stellar';
+import { h as RouteDockManifest, c as PaymentResult } from './logger-D8_Q2ytp.js';
+import { Keypair } from '@stellar/stellar-sdk';
+import { SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * USDC conversion — canonical implementation lives in @routedock/nulth-sdk and is
+ * re-exported here so SDK consumers (client, provider) share one converter.
+ *
+ * @routedock/routedock already depends on @routedock/nulth-sdk, so re-exporting
+ * (rather than defining a parallel helper) keeps a single source of truth.
+ */
+
+/**
+ * @deprecated Use {@link usdcToStroops} — the same validated bigint converter.
+ * Kept as a thin alias so existing call sites keep working during migration.
+ */
+declare const usdcToUnits: typeof usdcToStroops;
+
+/**
+ * File-backed durable {@link SpendStore}.
+ *
+ * Persists the daily spend accumulator to a JSON file on disk, preserving
+ * cumulative spending totals across process restarts, crashes, and redeploys.
+ *
+ * ### Error semantics
+ * - File absent (ENOENT): returns null — legitimately no spend recorded yet.
+ * - File present but unreadable or malformed: throws — a safety control must
+ *   fail closed, not assume nothing was spent.
+ *
+ * ### Write atomicity
+ * Writes go to `<filePath>.tmp` first, then `fs.rename` onto the target.
+ * `rename` is atomic within a filesystem, so there is no window where the
+ * target file is truncated but not yet fully written.
+ */
+declare class FileSpendStore implements SpendStore {
+    readonly filePath: string;
+    constructor(filePath: string);
+    read(): Promise<DailySpend | null>;
+    write(state: DailySpend): Promise<void>;
+}
+
+type Network = 'testnet' | 'mainnet';
+declare class X402Client {
+    private readonly network;
+    private readonly retryPolicy?;
+    private readonly httpClient;
+    private readonly signer;
+    constructor(secretKeyOrSigner: string | ClientStellarSigner, network: Network, retryPolicy?: RetryPolicy | undefined);
+    /** Replace signer (e.g. swap to Nulth ZK account payer before pay) */
+    withSigner(signer: ClientStellarSigner): X402Client;
+    pay(url: string, manifest: RouteDockManifest): Promise<PaymentResult>;
+}
+
+declare class MppChargeClient {
+    private readonly keypair;
+    private readonly network;
+    private readonly retryPolicy?;
+    constructor(keypair: Keypair, network: 'testnet' | 'mainnet', retryPolicy?: RetryPolicy | undefined);
+    pay(url: string, manifest: RouteDockManifest): Promise<PaymentResult>;
+}
+
+interface OnChainProviderInfo {
+    account: string;
+    endpoint: string;
+    tags: string[];
+}
+declare class OnChainRegistry {
+    private readonly horizon;
+    private readonly knownAccounts;
+    private readonly timeoutMs;
+    constructor(options: {
+        horizonUrl: string;
+        knownAccounts: string[];
+        timeoutMs?: number;
+    });
+    /**
+     * stellar-sdk 14.6.1 has no way to cancel the underlying Horizon request, so
+     * we stop waiting on it instead: the promise returned here rejects once
+     * `timeoutMs` elapses, even though the request may still be in flight. The
+     * timer is always cleared, including on the error path.
+     */
+    private loadAccountWithTimeout;
+    listProviders(): Promise<OnChainProviderInfo[]>;
+}
+
+interface ProviderRecord {
+    name: string;
+    description: string | undefined;
+    base_url: string;
+    modes: string[];
+    tags: string[];
+    network: string;
+    payee: string;
+    source: 'supabase' | 'onchain';
+    /**
+     * True only when the provider was verified out-of-band — for on-chain
+     * records the payee is the account that published the endpoint, for
+     * supabase records only rows flagged `verified` are returned.
+     */
+    verified: boolean;
+}
+interface ProviderRegistryConfig {
+    supabase?: SupabaseClient;
+    onChain: {
+        horizonUrl: string;
+        knownAccounts: string[];
+        /**
+         * Optional explicit network override. When omitted it is derived from the
+         * Horizon URL: URLs containing `testnet` map to 'testnet', everything else
+         * defaults to 'mainnet'.
+         */
+        network?: 'testnet' | 'mainnet';
+        /**
+         * Per-account timeout for on-chain account loads, in milliseconds.
+         * Defaults to 10000 ms.
+         */
+        timeoutMs?: number;
+    };
+}
+declare class ProviderRegistry {
+    private readonly supabase;
+    private readonly onChain;
+    private readonly network;
+    constructor(config: ProviderRegistryConfig);
+    listProviders(): Promise<ProviderRecord[]>;
+    private trySupabase;
+    private tryOnChain;
+    /**
+     * Fetch a provider's manifest bound to the record's payee. The record's
+     * `payee` (from supabase `verified` rows or the on-chain registry account)
+     * is the out-of-band trust anchor: the fetched manifest's `payee` must
+     * equal it, otherwise `RouteDockSignatureError` is thrown. This closes the
+     * gap where the registry never cross-checked the on-chain payee against
+     * the manifest payee.
+     */
+    fetchProviderManifest(record: ProviderRecord): Promise<RouteDockManifest>;
+}
+
+export { FileSpendStore as F, MppChargeClient as M, type OnChainProviderInfo as O, type ProviderRecord as P, X402Client as X, OnChainRegistry as a, ProviderRegistry as b, type ProviderRegistryConfig as c, usdcToUnits as u };