@scriptmasterlabs/mcp-x402 2.1.0 → 2.1.2

package/dist/server/apm/matcher.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * APM matcher — deterministic, pure functions that turn an agent's stated need
+ * into a ranked list of SML capabilities with per-constraint fit. No randomness,
+ * no network: live-status is injected by the caller.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenize = tokenize;
+exports.scoreCapability = scoreCapability;
+exports.evaluateFit = evaluateFit;
+exports.matchManifest = matchManifest;
+function tokenize(text) {
+    return text.toLowerCase().match(/[a-z0-9]+/g) ?? [];
+}
+/** Keyword overlap score between a need and a capability. Tag hits weigh double. */
+function scoreCapability(cap, needTokens) {
+    const haystack = new Set([
+        ...cap.tags,
+        ...tokenize(cap.tool),
+        ...tokenize(cap.summary),
+        ...tokenize(cap.product),
+    ]);
+    const tagSet = new Set(cap.tags);
+    let score = 0;
+    for (const token of needTokens) {
+        if (haystack.has(token))
+            score += 1;
+        if (tagSet.has(token))
+            score += 1; // tags are the strongest signal
+    }
+    return score;
+}
+function evaluateFit(cap, c) {
+    const price = c.max_price_usd === undefined || Number(cap.basePrice) <= c.max_price_usd;
+    const chain = !cap.paid ||
+        c.chains_accepted === undefined ||
+        c.chains_accepted.length === 0 ||
+        cap.paymentChains.some((ch) => c.chains_accepted.includes(ch));
+    const freshness = c.max_freshness_sec === undefined || cap.freshnessSec <= c.max_freshness_sec;
+    const attribution = c.needs_attribution !== true || cap.attribution === true;
+    return { price, chain, freshness, attribution };
+}
+/**
+ * Rank capabilities against a need. Returns only positive-score matches,
+ * sorted by score desc, then price asc. `live` is the set of online product keys.
+ */
+function matchManifest(need, constraints, capabilities, live) {
+    const tokens = tokenize(need);
+    return capabilities
+        .map((cap) => {
+        const score = scoreCapability(cap, tokens);
+        const fits = evaluateFit(cap, constraints);
+        return {
+            tool: cap.tool,
+            product: cap.product,
+            summary: cap.summary,
+            paid: cap.paid,
+            price_usd: cap.basePrice,
+            payment_chains: cap.paymentChains,
+            freshness_sec: cap.freshnessSec,
+            attribution: cap.attribution,
+            live: live.has(cap.product),
+            score,
+            fits,
+            meets_all_constraints: fits.price && fits.chain && fits.freshness && fits.attribution,
+        };
+    })
+        .filter((m) => m.score > 0)
+        .sort((a, b) => b.score - a.score || Number(a.price_usd) - Number(b.price_usd));
+}
+//# sourceMappingURL=matcher.js.map

package/dist/server/apm/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../../../src/server/apm/matcher.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAKH,4BAEC;AAGD,0CAcC;AAED,kCAgBC;AAMD,sCA8BC;AAzED,SAAgB,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,oFAAoF;AACpF,SAAgB,eAAe,CAAC,GAAe,EAAE,UAAoB;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS;QAC/B,GAAG,GAAG,CAAC,IAAI;QACX,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACrB,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QACxB,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC,CAAC,gCAAgC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,WAAW,CAAC,GAAe,EAAE,CAAc;IACzD,MAAM,KAAK,GACT,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAE5E,MAAM,KAAK,GACT,CAAC,GAAG,CAAC,IAAI;QACT,CAAC,CAAC,eAAe,KAAK,SAAS;QAC/B,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAC9B,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,eAAgB,CAAC,QAAQ,CAAC,EAAgC,CAAC,CAAC,CAAC;IAEhG,MAAM,SAAS,GACb,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,iBAAiB,CAAC;IAE/E,MAAM,WAAW,GAAG,CAAC,CAAC,iBAAiB,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC;IAE7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAC3B,IAAY,EACZ,WAAwB,EACxB,YAA0B,EAC1B,IAAiB;IAEjB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,YAAY;SAChB,GAAG,CAAC,CAAC,GAAG,EAAe,EAAE;QACxB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,aAAa;YACjC,aAAa,EAAE,GAAG,CAAC,YAAY;YAC/B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YAC3B,KAAK;YACL,IAAI;YACJ,qBAAqB,EACnB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW;SACjE,CAAC;IACJ,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;SAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/server/apm/quote.d.ts

@@ -0,0 +1,53 @@
+/**
+ * APM price-locked quote — a real, verifiable HMAC-signed quote.
+ *
+ * The quote binds {tool, price, chains, brokerage, expiry} so an agent can rely on
+ * the price for `ttl_sec`. Signed with HMAC-SHA256 over a canonical payload using
+ * APM_QUOTE_SECRET. If the secret is unset, the quote is still issued but marked
+ * `signed: false` (honest signalling — never a fake signature).
+ */
+export interface QuoteTerms {
+    tool: string;
+    price_usd: string;
+    payment_chains: string[];
+    brokerage_commission_pct: number;
+    ttl_sec: number;
+    agent_id?: string;
+}
+export interface SignedQuote {
+    quote_id: string;
+    tool: string;
+    price_usd: string;
+    currency: 'USDC';
+    payment_chains: string[];
+    brokerage_commission_pct: number;
+    agent_id: string | null;
+    issued_at: string;
+    expires_at: string;
+    algo: 'HMAC-SHA256';
+    signature: string;
+    signed: boolean;
+    canonical: string;
+}
+export declare function createQuote(terms: QuoteTerms): SignedQuote;
+/** Verify a quote's signature against APM_QUOTE_SECRET. Returns false if unsigned/unset. */
+export declare function verifyQuote(canonical: string, signature: string): boolean;
+export interface ParsedQuote {
+    tool: string;
+    price_usd: string;
+    currency: string;
+    payment_chains: string[];
+    brokerage_commission_pct: number;
+    agent_id: string | null;
+    issued_at: string;
+    expires_at: string;
+}
+export interface QuoteCheck {
+    valid: boolean;
+    expired: boolean;
+    reason?: string;
+    quote?: ParsedQuote;
+}
+/** Verify a quote's signature AND parse it, reporting expiry. Used by apm_execute. */
+export declare function verifyAndParseQuote(canonical: string, signature: string): QuoteCheck;
+//# sourceMappingURL=quote.d.ts.map

package/dist/server/apm/quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.d.ts","sourceRoot":"","sources":["../../../src/server/apm/quote.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wBAAwB,EAAE,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wBAAwB,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAuC1D;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQzE;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wBAAwB,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAYpF"}

package/dist/server/apm/quote.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * APM price-locked quote — a real, verifiable HMAC-signed quote.
+ *
+ * The quote binds {tool, price, chains, brokerage, expiry} so an agent can rely on
+ * the price for `ttl_sec`. Signed with HMAC-SHA256 over a canonical payload using
+ * APM_QUOTE_SECRET. If the secret is unset, the quote is still issued but marked
+ * `signed: false` (honest signalling — never a fake signature).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createQuote = createQuote;
+exports.verifyQuote = verifyQuote;
+exports.verifyAndParseQuote = verifyAndParseQuote;
+const node_crypto_1 = require("node:crypto");
+function canonicalize(payload) {
+    // Deterministic: sorted top-level keys (array form selects + orders keys).
+    return JSON.stringify(payload, Object.keys(payload).sort());
+}
+function createQuote(terms) {
+    const issuedMs = Date.now();
+    const expiresMs = issuedMs + terms.ttl_sec * 1000;
+    const payload = {
+        tool: terms.tool,
+        price_usd: terms.price_usd,
+        currency: 'USDC',
+        payment_chains: [...terms.payment_chains].sort(),
+        brokerage_commission_pct: terms.brokerage_commission_pct,
+        agent_id: terms.agent_id ?? null,
+        issued_at: new Date(issuedMs).toISOString(),
+        expires_at: new Date(expiresMs).toISOString(),
+    };
+    const canonical = canonicalize(payload);
+    const quoteId = (0, node_crypto_1.createHash)('sha256').update(canonical).digest('hex').slice(0, 24);
+    const secret = process.env['APM_QUOTE_SECRET'] ?? '';
+    const signed = secret.length > 0;
+    const signature = signed
+        ? (0, node_crypto_1.createHmac)('sha256', secret).update(canonical).digest('hex')
+        : '';
+    return {
+        quote_id: quoteId,
+        tool: payload.tool,
+        price_usd: payload.price_usd,
+        currency: payload.currency,
+        payment_chains: payload.payment_chains,
+        brokerage_commission_pct: payload.brokerage_commission_pct,
+        agent_id: payload.agent_id,
+        issued_at: payload.issued_at,
+        expires_at: payload.expires_at,
+        algo: 'HMAC-SHA256',
+        signature,
+        signed,
+        canonical,
+    };
+}
+/** Verify a quote's signature against APM_QUOTE_SECRET. Returns false if unsigned/unset. */
+function verifyQuote(canonical, signature) {
+    const secret = process.env['APM_QUOTE_SECRET'] ?? '';
+    if (!secret || !signature)
+        return false;
+    const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(canonical).digest('hex');
+    const a = Buffer.from(expected, 'hex');
+    const b = Buffer.from(signature, 'hex');
+    if (a.length !== b.length)
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(a, b);
+}
+/** Verify a quote's signature AND parse it, reporting expiry. Used by apm_execute. */
+function verifyAndParseQuote(canonical, signature) {
+    if (!verifyQuote(canonical, signature)) {
+        return { valid: false, expired: false, reason: 'signature_invalid_or_unsigned' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(canonical);
+    }
+    catch {
+        return { valid: false, expired: false, reason: 'canonical_unparseable' };
+    }
+    const expired = Date.now() > new Date(parsed.expires_at).getTime();
+    return { valid: true, expired, quote: parsed };
+}
+//# sourceMappingURL=quote.js.map

package/dist/server/apm/quote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote.js","sourceRoot":"","sources":["../../../src/server/apm/quote.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAkCH,kCAuCC;AAGD,kCAQC;AAqBD,kDAYC;AAnHD,6CAAsE;AA2BtE,SAAS,YAAY,CAAC,OAAgC;IACpD,2EAA2E;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAgB,WAAW,CAAC,KAAiB;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;IAElD,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,MAAe;QACzB,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE;QAChD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAC3C,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;KAC9C,CAAC;IAEF,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAElF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;QAC1D,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,IAAI,EAAE,aAAa;QACnB,SAAS;QACT,MAAM;QACN,SAAS;KACV,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAgB,WAAW,CAAC,SAAiB,EAAE,SAAiB;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAoBD,sFAAsF;AACtF,SAAgB,mBAAmB,CAAC,SAAiB,EAAE,SAAiB;IACtE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/server/apm/schema.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Agent Preference Manifest (APM) — the "ask, don't tell" schema.
+ *
+ * An agent declares what it NEEDS; SML answers with matching live tools.
+ * These types double as the published APM standard.
+ */
+import { z } from 'zod';
+export declare const ChainEnum: z.ZodEnum<["base", "xrpl", "solana"]>;
+export declare const ConstraintsSchema: z.ZodObject<{
+    /** Max USD the agent will pay per downstream tool call. */
+    max_price_usd: z.ZodOptional<z.ZodNumber>;
+    /** Payment chains the agent accepts. Empty/omitted = any. */
+    chains_accepted: z.ZodOptional<z.ZodArray<z.ZodEnum<["base", "xrpl", "solana"]>, "many">>;
+    /** Max acceptable data staleness, in seconds. */
+    max_freshness_sec: z.ZodOptional<z.ZodNumber>;
+    /** Require tools that cite authoritative sources. */
+    needs_attribution: z.ZodOptional<z.ZodBoolean>;
+    /** Agent's expected credit-score floor (informational; payment layer enforces >=300). */
+    min_credit_score: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    max_price_usd?: number | undefined;
+    chains_accepted?: ("base" | "xrpl" | "solana")[] | undefined;
+    max_freshness_sec?: number | undefined;
+    needs_attribution?: boolean | undefined;
+    min_credit_score?: number | undefined;
+}, {
+    max_price_usd?: number | undefined;
+    chains_accepted?: ("base" | "xrpl" | "solana")[] | undefined;
+    max_freshness_sec?: number | undefined;
+    needs_attribution?: boolean | undefined;
+    min_credit_score?: number | undefined;
+}>;
+export declare const ManifestSchema: z.ZodObject<{
+    need: z.ZodString;
+    mode: z.ZodDefault<z.ZodEnum<["preview", "contract"]>>;
+    wallet_address: z.ZodOptional<z.ZodString>;
+    agent_id: z.ZodOptional<z.ZodString>;
+    constraints: z.ZodOptional<z.ZodObject<{
+        /** Max USD the agent will pay per downstream tool call. */
+        max_price_usd: z.ZodOptional<z.ZodNumber>;
+        /** Payment chains the agent accepts. Empty/omitted = any. */
+        chains_accepted: z.ZodOptional<z.ZodArray<z.ZodEnum<["base", "xrpl", "solana"]>, "many">>;
+        /** Max acceptable data staleness, in seconds. */
+        max_freshness_sec: z.ZodOptional<z.ZodNumber>;
+        /** Require tools that cite authoritative sources. */
+        needs_attribution: z.ZodOptional<z.ZodBoolean>;
+        /** Agent's expected credit-score floor (informational; payment layer enforces >=300). */
+        min_credit_score: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        max_price_usd?: number | undefined;
+        chains_accepted?: ("base" | "xrpl" | "solana")[] | undefined;
+        max_freshness_sec?: number | undefined;
+        needs_attribution?: boolean | undefined;
+        min_credit_score?: number | undefined;
+    }, {
+        max_price_usd?: number | undefined;
+        chains_accepted?: ("base" | "xrpl" | "solana")[] | undefined;
+        max_freshness_sec?: number | undefined;
+        needs_attribution?: boolean | undefined;
+        min_credit_score?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    mode: "preview" | "contract";
+    need: string;
+    wallet_address?: string | undefined;
+    agent_id?: string | undefined;
+    constraints?: {
+        max_price_usd?: number | undefined;
+        chains_accepted?: ("base" | "xrpl" | "solana")[] | undefined;
+        max_freshness_sec?: number | undefined;
+        needs_attribution?: boolean | undefined;
+        min_credit_score?: number | undefined;
+    } | undefined;
+}, {
+    need: string;
+    mode?: "preview" | "contract" | undefined;
+    wallet_address?: string | undefined;
+    agent_id?: string | undefined;
+    constraints?: {
+        max_price_usd?: number | undefined;
+        chains_accepted?: ("base" | "xrpl" | "solana")[] | undefined;
+        max_freshness_sec?: number | undefined;
+        needs_attribution?: boolean | undefined;
+        min_credit_score?: number | undefined;
+    } | undefined;
+}>;
+export type Manifest = z.infer<typeof ManifestSchema>;
+export type Constraints = z.infer<typeof ConstraintsSchema>;
+export interface ConstraintFit {
+    price: boolean;
+    chain: boolean;
+    freshness: boolean;
+    attribution: boolean;
+}
+export interface ScoredMatch {
+    tool: string;
+    product: string;
+    summary: string;
+    paid: boolean;
+    price_usd: string;
+    payment_chains: string[];
+    freshness_sec: number;
+    attribution: boolean;
+    live: boolean;
+    score: number;
+    fits: ConstraintFit;
+    meets_all_constraints: boolean;
+}
+//# sourceMappingURL=schema.d.ts.map

package/dist/server/apm/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/server/apm/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,SAAS,uCAAqC,CAAC;AAE5D,eAAO,MAAM,iBAAiB;IAC5B,2DAA2D;;IAE3D,6DAA6D;;IAE7D,iDAAiD;;IAEjD,qDAAqD;;IAErD,yFAAyF;;;;;;;;;;;;;;EAEzF,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;QAZzB,2DAA2D;;QAE3D,6DAA6D;;QAE7D,iDAAiD;;QAEjD,qDAAqD;;QAErD,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUzF,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,qBAAqB,EAAE,OAAO,CAAC;CAChC"}

package/dist/server/apm/schema.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * Agent Preference Manifest (APM) — the "ask, don't tell" schema.
+ *
+ * An agent declares what it NEEDS; SML answers with matching live tools.
+ * These types double as the published APM standard.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManifestSchema = exports.ConstraintsSchema = exports.ChainEnum = void 0;
+const zod_1 = require("zod");
+exports.ChainEnum = zod_1.z.enum(['base', 'xrpl', 'solana']);
+exports.ConstraintsSchema = zod_1.z.object({
+    /** Max USD the agent will pay per downstream tool call. */
+    max_price_usd: zod_1.z.number().nonnegative().optional(),
+    /** Payment chains the agent accepts. Empty/omitted = any. */
+    chains_accepted: zod_1.z.array(exports.ChainEnum).optional(),
+    /** Max acceptable data staleness, in seconds. */
+    max_freshness_sec: zod_1.z.number().int().nonnegative().optional(),
+    /** Require tools that cite authoritative sources. */
+    needs_attribution: zod_1.z.boolean().optional(),
+    /** Agent's expected credit-score floor (informational; payment layer enforces >=300). */
+    min_credit_score: zod_1.z.number().int().optional(),
+});
+exports.ManifestSchema = zod_1.z.object({
+    need: zod_1.z.string().min(2).max(500),
+    mode: zod_1.z.enum(['preview', 'contract']).default('preview'),
+    wallet_address: zod_1.z.string().optional(),
+    agent_id: zod_1.z.string().optional(),
+    constraints: exports.ConstraintsSchema.optional(),
+});
+//# sourceMappingURL=schema.js.map

package/dist/server/apm/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/server/apm/schema.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,6BAAwB;AAEX,QAAA,SAAS,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/C,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,2DAA2D;IAC3D,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAClD,6DAA6D;IAC7D,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC,QAAQ,EAAE;IAC9C,iDAAiD;IACjD,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,qDAAqD;IACrD,iBAAiB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,yFAAyF;IACzF,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEU,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACxD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,yBAAiB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC"}

package/dist/server/payments/agent-payment.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Agent-payment enforcement gate — the REAL x402 model.
+ *
+ * Today the gateway "pays itself" (gateway wallet -> SML receiver) and serves paid
+ * tools regardless, so they're effectively free. This gate flips that to the correct
+ * flow: tool call -> 402 challenge (invoice) -> agent pays from ITS wallet -> agent
+ * re-calls with tx_hash -> we VERIFY via 402Proof -> serve.
+ *
+ * Safety: OFF by default (ENFORCE_AGENT_PAYMENT). When off, nothing here runs and
+ * existing behavior is unchanged. When on, each paid tool needs its 402Proof endpoint
+ * UUID (PROOF402_ENDPOINT_<TOOL>); without it the gate fails CLOSED (never serves free).
+ *
+ * NOTE: isVerified() interprets the 402Proof /v1/verify response defensively. Confirm
+ * the exact success contract against the live 402Proof service before going live.
+ */
+export declare function isAgentPaymentEnforced(): boolean;
+/** Resolve a tool's 402Proof endpoint UUID. Real values come from env. */
+export declare function resolveEndpointId(toolName: string): string | undefined;
+/** Defensive success check for the 402Proof /v1/verify response. */
+export declare function isVerified(resp: unknown): boolean;
+export interface PaymentProof {
+    txHash: string;
+}
+export type GateResult = {
+    status: 'paid';
+    txHash: string;
+    detail: unknown;
+} | {
+    status: 'payment_required';
+    endpointId: string;
+    payTo: string;
+    amount: string;
+    invoice?: unknown;
+    instructions: string;
+} | {
+    status: 'payment_invalid';
+    endpointId: string;
+    detail: unknown;
+} | {
+    status: 'unconfigured';
+    toolName: string;
+};
+/**
+ * Enforce agent payment for a tool call. Returns a discriminated result; the caller
+ * (executeX402Payment) translates it into a served response, a 402 challenge, or a
+ * rejection. Never serves on anything but {status:'paid'}.
+ */
+export declare function enforceAgentPayment(params: {
+    toolName: string;
+    price: string;
+    paymentProof?: PaymentProof;
+}): Promise<GateResult>;
+/** Thrown by executeX402Payment when the agent must pay before the tool runs. */
+export declare class PaymentRequiredError extends Error {
+    readonly gate: Extract<GateResult, {
+        status: 'payment_required';
+    }>;
+    constructor(gate: Extract<GateResult, {
+        status: 'payment_required';
+    }>);
+}
+/** Thrown when the agent's payment proof fails 402Proof verification. */
+export declare class PaymentUnverifiedError extends Error {
+    readonly gate: Extract<GateResult, {
+        status: 'payment_invalid';
+    }>;
+    constructor(gate: Extract<GateResult, {
+        status: 'payment_invalid';
+    }>);
+}
+//# sourceMappingURL=agent-payment.d.ts.map

package/dist/server/payments/agent-payment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-payment.d.ts","sourceRoot":"","sources":["../../../src/server/payments/agent-payment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE;AAOD,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAOjD;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1H;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,GAAG,OAAO,CAAC,UAAU,CAAC,CAmCtB;AAED,iFAAiF;AACjF,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,CAAC;gBAAzD,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,CAAC;CAItF;AAED,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;aACnB,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,iBAAiB,CAAA;KAAE,CAAC;gBAAxD,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,iBAAiB,CAAA;KAAE,CAAC;CAIrF"}

package/dist/server/payments/agent-payment.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Agent-payment enforcement gate — the REAL x402 model.
+ *
+ * Today the gateway "pays itself" (gateway wallet -> SML receiver) and serves paid
+ * tools regardless, so they're effectively free. This gate flips that to the correct
+ * flow: tool call -> 402 challenge (invoice) -> agent pays from ITS wallet -> agent
+ * re-calls with tx_hash -> we VERIFY via 402Proof -> serve.
+ *
+ * Safety: OFF by default (ENFORCE_AGENT_PAYMENT). When off, nothing here runs and
+ * existing behavior is unchanged. When on, each paid tool needs its 402Proof endpoint
+ * UUID (PROOF402_ENDPOINT_<TOOL>); without it the gate fails CLOSED (never serves free).
+ *
+ * NOTE: isVerified() interprets the 402Proof /v1/verify response defensively. Confirm
+ * the exact success contract against the live 402Proof service before going live.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PaymentUnverifiedError = exports.PaymentRequiredError = void 0;
+exports.isAgentPaymentEnforced = isAgentPaymentEnforced;
+exports.resolveEndpointId = resolveEndpointId;
+exports.isVerified = isVerified;
+exports.enforceAgentPayment = enforceAgentPayment;
+const proof402_js_1 = require("../../lib/sml-api/proof402.js");
+const x402_js_1 = require("./x402.js");
+function isAgentPaymentEnforced() {
+    return (process.env['ENFORCE_AGENT_PAYMENT'] ?? '').toLowerCase() === 'true';
+}
+/** Resolve a tool's 402Proof endpoint UUID. Real values come from env. */
+function resolveEndpointId(toolName) {
+    const fromEnv = process.env[`PROOF402_ENDPOINT_${toolName.toUpperCase()}`];
+    if (fromEnv && fromEnv.length > 0)
+        return fromEnv;
+    return ENDPOINT_MAP[toolName];
+}
+/** Built-in endpoint UUIDs. EMPTY by default — fill via env or here once registered. */
+const ENDPOINT_MAP = {
+// squeezeos_council: '<real-402proof-endpoint-uuid>',
+};
+/** Defensive success check for the 402Proof /v1/verify response. */
+function isVerified(resp) {
+    if (resp === null || typeof resp !== 'object')
+        return false;
+    const r = resp;
+    if (r['error'])
+        return false;
+    if (r['verified'] === true || r['valid'] === true || r['ok'] === true)
+        return true;
+    const status = typeof r['status'] === 'string' ? r['status'].toLowerCase() : '';
+    return status === 'confirmed' || status === 'verified' || status === 'paid';
+}
+/**
+ * Enforce agent payment for a tool call. Returns a discriminated result; the caller
+ * (executeX402Payment) translates it into a served response, a 402 challenge, or a
+ * rejection. Never serves on anything but {status:'paid'}.
+ */
+async function enforceAgentPayment(params) {
+    const endpointId = resolveEndpointId(params.toolName);
+    if (!endpointId) {
+        return { status: 'unconfigured', toolName: params.toolName };
+    }
+    // No proof yet -> issue a 402 challenge (invoice is best-effort).
+    if (!params.paymentProof?.txHash) {
+        let invoice;
+        try {
+            invoice = await proof402_js_1.Proof402API.invoice(endpointId);
+        }
+        catch {
+            invoice = undefined;
+        }
+        return {
+            status: 'payment_required',
+            endpointId,
+            payTo: (0, x402_js_1.getPaymentReceiver)(),
+            amount: params.price,
+            invoice,
+            instructions: `Payment required. Pay ${params.price} USDC/RLUSD to ${(0, x402_js_1.getPaymentReceiver)()} (or per the invoice), then re-call this tool with payment_proof.tx_hash set to your payment transaction hash.`,
+        };
+    }
+    // Proof provided -> verify the agent's on-chain payment via 402Proof.
+    let resp;
+    try {
+        resp = await proof402_js_1.Proof402API.verify(params.paymentProof.txHash, endpointId);
+    }
+    catch (err) {
+        return { status: 'payment_invalid', endpointId, detail: { error: String(err) } };
+    }
+    if (isVerified(resp)) {
+        return { status: 'paid', txHash: params.paymentProof.txHash, detail: resp };
+    }
+    return { status: 'payment_invalid', endpointId, detail: resp };
+}
+/** Thrown by executeX402Payment when the agent must pay before the tool runs. */
+class PaymentRequiredError extends Error {
+    gate;
+    constructor(gate) {
+        super('payment_required');
+        this.gate = gate;
+        this.name = 'PaymentRequiredError';
+    }
+}
+exports.PaymentRequiredError = PaymentRequiredError;
+/** Thrown when the agent's payment proof fails 402Proof verification. */
+class PaymentUnverifiedError extends Error {
+    gate;
+    constructor(gate) {
+        super('payment_unverified');
+        this.gate = gate;
+        this.name = 'PaymentUnverifiedError';
+    }
+}
+exports.PaymentUnverifiedError = PaymentUnverifiedError;
+//# sourceMappingURL=agent-payment.js.map

package/dist/server/payments/agent-payment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-payment.js","sourceRoot":"","sources":["../../../src/server/payments/agent-payment.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAKH,wDAEC;AAGD,8CAIC;AAQD,gCAOC;AAiBD,kDAuCC;AAnFD,+DAA4D;AAC5D,uCAA+C;AAE/C,SAAgB,sBAAsB;IACpC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAC1E,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,wFAAwF;AACxF,MAAM,YAAY,GAA2B;AAC3C,sDAAsD;CACvD,CAAC;AAEF,oEAAoE;AACpE,SAAgB,UAAU,CAAC,IAAa;IACtC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM,CAAC;AAC9E,CAAC;AAYD;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,MAIzC;IACC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QACjC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,yBAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,UAAU;YACV,KAAK,EAAE,IAAA,4BAAkB,GAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,OAAO;YACP,YAAY,EAAE,yBAAyB,MAAM,CAAC,KAAK,kBAAkB,IAAA,4BAAkB,GAAE,gHAAgH;SAC1M,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,yBAAW,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,iFAAiF;AACjF,MAAa,oBAAqB,SAAQ,KAAK;IACjB;IAA5B,YAA4B,IAAyD;QACnF,KAAK,CAAC,kBAAkB,CAAC,CAAC;QADA,SAAI,GAAJ,IAAI,CAAqD;QAEnF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAED,yEAAyE;AACzE,MAAa,sBAAuB,SAAQ,KAAK;IACnB;IAA5B,YAA4B,IAAwD;QAClF,KAAK,CAAC,oBAAoB,CAAC,CAAC;QADF,SAAI,GAAJ,IAAI,CAAoD;QAElF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC"}

package/dist/server/payments/x402.d.ts

@@ -4,16 +4,29 @@ export declare const PaymentConfigSchema: z.ZodObject<{
     currency: z.ZodEnum<["USDC", "RLUSD"]>;
     toolName: z.ZodString;
     walletAddress: z.ZodOptional<z.ZodString>;
+    paymentProof: z.ZodOptional<z.ZodObject<{
+        txHash: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        txHash: string;
+    }, {
+        txHash: string;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     currency: "USDC" | "RLUSD";
     price: string;
     toolName: string;
     walletAddress?: string | undefined;
+    paymentProof?: {
+        txHash: string;
+    } | undefined;
 }, {
     currency: "USDC" | "RLUSD";
     price: string;
     toolName: string;
     walletAddress?: string | undefined;
+    paymentProof?: {
+        txHash: string;
+    } | undefined;
 }>;
 export type PaymentConfig = z.infer<typeof PaymentConfigSchema>;
 export interface PaymentResult {
@@ -25,5 +38,18 @@ export interface PaymentResult {
     timestamp: number;
     walletAddress: string;
 }
+/** Resolve the address that collects USDC for paid tool calls. */
+export declare function getPaymentReceiver(): string;
 export declare function executeX402Payment(config: PaymentConfig): Promise<PaymentResult>;
+/**
+ * Brokered payment for APM-executed tools (apm_execute). The amount is the
+ * price-locked quote value + brokerage; its integrity is guaranteed by the
+ * SML-signed quote verified upstream — NOT by the price registry. Mirrors the
+ * settlement steps of executeX402Payment (cap, credit, AP2, route, receipt).
+ * Never call without a verified, unexpired quote.
+ */
+export declare function executeBrokeredPayment(params: {
+    amount: string;
+    toolName: string;
+}): Promise<PaymentResult>;
 //# sourceMappingURL=x402.d.ts.map

package/dist/server/payments/x402.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x402.d.ts","sourceRoot":"","sources":["../../../src/server/payments/x402.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AA6BD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,CAuHxB"}
+{"version":3,"file":"x402.d.ts","sourceRoot":"","sources":["../../../src/server/payments/x402.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAgBD,kEAAkE;AAClE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAqBD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,CAoJxB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CA8DzB"}