@supercuts-walrus/backend 0.0.0-stage → 0.1.0

package/dist/mcp.js

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+import { createInterface } from "node:readline";
+import { Phase3App, errorOutput, homePath } from "./phase3.js";
+import { executeMandated, loadMandate, toolSchema } from "./mandate.js";
+import { RemoteBuyer } from "./remote-buyer.js";
+import { DemoEventLog } from "./events.js";
+import { DealJournal } from "./deal.js";
+import { createConfiguredDealEngine } from "./deal-adapter.js";
+import { LiveDealPorts } from "./live-deal-ports.js";
+import { createRequire } from "node:module";
+const PACKAGE_VERSION = createRequire(import.meta.url)("../package.json").version;
+const MAX_REQUEST_BYTES = 1024 * 1024;
+const home = homePath({});
+const app = new Phase3App(home);
+const mandate = loadMandate(home);
+const remote = app.profile.role === "buyer" && !app.profile.mock && process.env.SUPERCUTS_SELLER_URL ? new RemoteBuyer(app, mandate, process.env.SUPERCUTS_SELLER_URL) : undefined;
+const eventLog = process.env.SUPERCUTS_EVENT_PATH && process.env.SUPERCUTS_RUN_ID ? new DemoEventLog(process.env.SUPERCUTS_EVENT_PATH, process.env.SUPERCUTS_RUN_ID) : undefined;
+if (eventLog)
+    eventLog.append({ actor: "operator", stage: "run", status: "started", publicDetails: { flow: remote ? "codex-remote" : "codex-deal-v2" }, evidenceHashes: [], explorerLinks: [] });
+let memoryTickRunning = false;
+const memoryTick = async () => {
+    if (memoryTickRunning)
+        return;
+    memoryTickRunning = true;
+    try {
+        await app.processMemoryOutbox();
+    }
+    catch (error) {
+        process.stderr.write(`${error && typeof error === "object" && "code" in error ? String(error.code) : "MEMORY_WORKER_ERROR"}\n`);
+    }
+    finally {
+        memoryTickRunning = false;
+    }
+};
+const memoryConfigured = app.profile.role === "buyer" && !app.profile.mock && Boolean(app.store.getSecret("live:memory-config"));
+if (memoryConfigured)
+    app.recoverStaleMemorySubmissions();
+const memoryTimer = memoryConfigured ? setInterval(() => { void memoryTick(); }, 30_000) : undefined;
+if (memoryTimer) {
+    memoryTimer.unref();
+    void memoryTick();
+}
+const tools = {
+    buyer: "status,doctor,deal.catalog,deal.policy,deal.execute,deal.get,deal.resume,deal.reconcile,deal.evidence,deal.delivery,capability.discover,settlement.plan,wallet.deposit,wallet.balance,wallet.recover,wallet.withdraw,wallet.exit.queue,wallet.exit.status,wallet.exit.finalize,offer.open,offer.propose,offer.accept,offer.show,pay.quote,pay.shielded,pay.x402,pay.status,resource.fetch,memory.remember,memory.recall,memory.status,memory.inventory,remote.catalog,remote.rank-briefs,remote.negotiate,remote.quote,remote.purchase-brief,remote.agreement,remote.settle-analysis,remote.delivery,remote.events,disclose",
+    seller: "status,doctor,capability.publish,wallet.balance,wallet.recover,wallet.withdraw,wallet.exit.queue,wallet.exit.status,wallet.exit.finalize,offer.counter,offer.show,pay.status,resource.serve,resource.fetch,memory.remember,memory.recall,memory.status",
+    auditor: "status,doctor,audit.verify",
+};
+const send = (value) => process.stdout.write(`${JSON.stringify(value)}\n`);
+function logTool(name, data) {
+    if (!eventLog)
+        return;
+    const append = (actor, stage, details, hashes = []) => eventLog.append({ actor, stage, status: "complete", publicDetails: details, evidenceHashes: hashes, explorerLinks: [] });
+    if (name === "remote.rank-briefs")
+        append("buyer", "seller-selection", { winner: data.winner?.capabilityId, rankings: data.rankings?.map((item) => ({ capabilityId: item.capabilityId, score: item.score, priceMist: item.priceMist })) });
+    if (name === "remote.negotiate")
+        append("buyer", "negotiation", { capabilityId: data.capabilityId, sessionId: data.sessionId, requestBlobId: data.requestBlobId, replyBlobId: data.replyBlobId, transcriptHash: data.transcriptHash }, typeof data.transcriptHash === "string" ? [data.transcriptHash] : []);
+    if (name === "remote.purchase-brief") {
+        const negotiation = data.negotiation;
+        if (negotiation)
+            append("buyer", "negotiation", { capabilityId: data.capabilityId, sessionId: negotiation.sessionId, requestBlobId: negotiation.requestBlobId, replyBlobId: negotiation.replyBlobId, transcriptHash: negotiation.transcriptHash }, typeof negotiation.transcriptHash === "string" ? [negotiation.transcriptHash] : []);
+        append("buyer", "public-settlement", { rail: "x402", capabilityId: data.capabilityId, transactionDigest: data.transactionDigest, amount: data.amount, payee: data.payee, planHash: data.planHash });
+        append("buyer", "artifact-delivery", { capabilityId: data.capabilityId, artifactSha256: data.artifactSha256, kind: "public-brief" }, typeof data.artifactSha256 === "string" ? [data.artifactSha256] : []);
+    }
+    if (name === "memory.remember")
+        append("buyer", "memory", { blobId: data.blobId, kind: data.kind, provenance: data.provenance });
+    if (name === "memory.recall")
+        append("supercuts", "memory-recall", { citations: data.citations, restarted: false });
+    if (name === "wallet.deposit" && typeof data.transactionDigest === "string")
+        append("buyer", "prefunding", { transactionDigest: data.transactionDigest, amount: data.amount });
+    if (name === "wallet.exit.queue")
+        append(app.profile.role === "seller" ? "confidential-seller" : "buyer", "delayed-exit", { state: data.status, amount: data.amount, operationId: data.operationId });
+    if (name === "remote.agreement") {
+        const plan = data.plan;
+        const negotiation = data.negotiation;
+        if (negotiation)
+            append("buyer", "negotiation", { capabilityId: plan.capabilityId, sessionId: negotiation.sessionId, requestBlobId: negotiation.requestBlobId, replyBlobId: negotiation.replyBlobId, transcriptHash: negotiation.transcriptHash }, typeof negotiation.transcriptHash === "string" ? [negotiation.transcriptHash] : []);
+        append("buyer", "settlement-plan", { phase: "after-memory", planHash: plan.planHash, capabilityId: plan.capabilityId, rail: plan.rail, openingAmount: plan.openingAmount, maximumAmount: plan.maximumAmount, riskLevel: plan.riskLevel, reasonCodes: plan.reasonCodes, blobIds: plan.citations?.map((item) => item.blobId) ?? [] }, typeof plan.manifestHash === "string" ? [plan.manifestHash] : []);
+    }
+    if (name === "remote.settle-analysis")
+        append("buyer", "private-settlement", { rail: "shielded", transactionDigest: data.transactionDigest, checkpoint: data.checkpoint, planHash: data.planHash, visibility: data.visibility }, typeof data.dealCommitment === "string" ? [data.dealCommitment] : []);
+    if (name === "remote.delivery" && data.status === "delivered")
+        append("buyer", "artifact-delivery", { kind: "competitor-analysis", artifactSha256: data.artifactSha256, sessionId: data.sessionId }, typeof data.artifactSha256 === "string" ? [data.artifactSha256] : []);
+    if ((name === "deal.execute" || name === "deal.resume" || name === "deal.get") && typeof data.dealId === "string") {
+        const journal = new DealJournal(app.store), evidence = journal.evidence(data.dealId);
+        const plan = journal.step(String(data.operationId), "planning");
+        if (plan)
+            append("supercuts", "settlement-plan", { phase: "after-memory", planHash: plan.planHash, capabilityId: plan.capabilityId, rail: plan.rail, openingAmount: plan.openingAmount, maximumAmount: plan.maximumAmount, riskLevel: plan.riskLevel, reasonCodes: plan.reasonCodes, blobIds: plan.citations.map((item) => item.blobId) });
+        append("supercuts", "deal-lifecycle", { dealId: data.dealId, state: data.state, rail: data.rail, agreement: data.evidence?.agreement, payment: data.evidence?.payment, delivery: data.evidence?.delivery, outcomeMemory: data.evidence?.outcomeMemory, agreementBlobId: evidence.agreementBlobId, deliveryBlobId: evidence.deliveryBlobId, outcomeMemoryBlobId: evidence.outcomeMemoryBlobId, paymentDigest: evidence.paymentDigest });
+    }
+}
+const rl = createInterface({ input: process.stdin });
+let queue = Promise.resolve();
+rl.on("line", (line) => {
+    queue = queue.then(async () => {
+        if (Buffer.byteLength(line) > MAX_REQUEST_BYTES)
+            return send({ jsonrpc: "2.0", error: { code: -32600, message: "Request exceeds 1 MiB" }, id: null });
+        let request;
+        try {
+            request = JSON.parse(line);
+        }
+        catch {
+            return send({ jsonrpc: "2.0", error: { code: -32700, message: "Parse error" }, id: null });
+        }
+        if (!request || typeof request !== "object" || request.method !== undefined && typeof request.method !== "string" || request.id !== undefined && typeof request.id !== "string" && typeof request.id !== "number" && request.id !== null || request.params !== undefined && (!request.params || typeof request.params !== "object" || Array.isArray(request.params)))
+            return send({ jsonrpc: "2.0", error: { code: -32600, message: "Invalid JSON-RPC request" }, id: null });
+        try {
+            if (request.method === "initialize")
+                return send({ jsonrpc: "2.0", id: request.id, result: { protocolVersion: "2025-06-18", capabilities: { tools: {} }, serverInfo: { name: `supercuts-${app.profile.role}`, version: PACKAGE_VERSION } } });
+            if (request.method === "notifications/initialized")
+                return;
+            const available = tools[app.profile.role].split(",").filter((name) => (remote || !name.startsWith("remote.")) && (app.profile.mock || memoryConfigured || !name.startsWith("memory.")) && (!name.startsWith("deal.") || mandate.version === "supercuts.mandate.v2") && (["status", "doctor"].includes(name) || mandate.allowedCommands.includes(name === "deal.reconcile" ? "deal.resume" : name)));
+            if (request.method === "tools/list")
+                return send({ jsonrpc: "2.0", id: request.id, result: { tools: available.map((name) => { const spec = toolSchema(name); return { name, description: spec.description, inputSchema: spec.inputSchema }; }) } });
+            if (request.method === "tools/call") {
+                const name = String(request.params?.name ?? ""), raw = (request.params?.arguments ?? {});
+                if (!available.includes(name))
+                    return send({ jsonrpc: "2.0", id: request.id, error: { code: -32601, message: "Tool is unavailable for this role or configuration" } });
+                if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                    return send({ jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "Tool arguments must be an object" } });
+                let data;
+                if (name.startsWith("deal.")) {
+                    const spec = toolSchema(name);
+                    const { validateToolArguments } = await import("./mandate.js");
+                    validateToolArguments(spec, raw);
+                    if (mandate.version !== "supercuts.mandate.v2" || !mandate.allowedCommands.includes(name === "deal.reconcile" ? "deal.resume" : name) || (name === "deal.execute" || name === "deal.resume") && Date.now() > mandate.expiresAt)
+                        throw new Error("deal tool is not authorized by an active v2 mandate");
+                    if (name === "deal.catalog")
+                        data = { capabilities: (await new LiveDealPorts(app, mandate).catalog()).map(({ origin, registration }) => ({ origin, manifest: registration.manifest, manifestBlobId: registration.manifestBlobId })) };
+                    else if (name === "deal.policy") {
+                        const hasTable = Boolean(app.store.db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='mandate_operations'").get());
+                        const reserved = hasTable ? app.store.db.prepare("SELECT amount FROM mandate_operations").all().reduce((sum, row) => sum + BigInt(row.amount), 0n) : 0n;
+                        data = { perDealCeiling: mandate.perDealCeiling, totalBudget: mandate.totalRunBudget, remainingBudget: (BigInt(mandate.totalRunBudget) - reserved).toString(), expiresAt: mandate.expiresAt, defaultRail: "shielded", allowPublicX402: mandate.allowPublicX402 === true, allowedAssets: mandate.allowedAssets, allowedCapabilityIds: mandate.allowedCapabilityIds, allowedCapabilityClasses: mandate.allowedCapabilityClasses };
+                    }
+                    else if (name === "deal.evidence")
+                        data = new DealJournal(app.store).evidence(String(raw.dealId));
+                    else if (name === "deal.reconcile")
+                        data = await app.reconcileDealOutcome(String(raw.operationId));
+                    else if (name === "deal.delivery") {
+                        const delivery = new DealJournal(app.store).delivery(String(raw.dealId));
+                        data = { dealId: delivery.dealId, contentType: delivery.contentType, artifactSha256: delivery.artifactSha256, artifactBase64: Buffer.from(delivery.artifact).toString("base64") };
+                    }
+                    else if (name === "deal.execute") {
+                        const input = raw.input;
+                        if (raw["operation-id"] !== input?.operationId)
+                            throw new Error("deal operation ID does not match its input");
+                        data = await (await createConfiguredDealEngine(app)).execute(input);
+                    }
+                    else if (name === "deal.resume")
+                        data = await (await createConfiguredDealEngine(app)).resume(String(raw.operationId));
+                    else
+                        data = new DealJournal(app.store).get(String(raw.operationId));
+                }
+                else if (name.startsWith("remote.")) {
+                    if (!remote || !mandate.allowedCommands.includes(name) || Date.now() > mandate.expiresAt)
+                        throw new Error("remote buyer tool is not authorized or configured");
+                    const spec = toolSchema(name);
+                    const { validateToolArguments } = await import("./mandate.js");
+                    validateToolArguments(spec, raw);
+                    if (process.env.SUPERCUTS_RUN_ID && name !== "remote.catalog" && name !== "remote.rank-briefs" && raw.runId !== undefined && raw.runId !== process.env.SUPERCUTS_RUN_ID)
+                        throw new Error("remote tool run ID differs from this buyer demo run");
+                    data = name === "remote.catalog" ? await remote.catalog() :
+                        name === "remote.rank-briefs" ? await remote.rankBriefs(raw) :
+                            name === "remote.negotiate" ? await remote.negotiate(raw) :
+                                name === "remote.quote" ? await remote.quote(raw) :
+                                    name === "remote.purchase-brief" ? await remote.purchaseBrief(raw) :
+                                        name === "remote.agreement" ? await remote.agreement(raw) :
+                                            name === "remote.settle-analysis" ? await remote.settleAnalysis(raw) :
+                                                name === "remote.delivery" ? await remote.delivery(raw) :
+                                                    name === "remote.events" ? await remote.events(String(raw.runId)) : {};
+                }
+                else
+                    data = await executeMandated(app, mandate, name, raw);
+                logTool(name, data);
+                const result = { schemaVersion: "supercuts.v1", ok: true, command: name, data };
+                return send({ jsonrpc: "2.0", id: request.id, result: { content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: result } });
+            }
+            return send({ jsonrpc: "2.0", id: request.id, error: { code: -32601, message: "Method not found" } });
+        }
+        catch (error) {
+            return send({ jsonrpc: "2.0", id: request.id, result: { isError: true, content: [{ type: "text", text: JSON.stringify(errorOutput(error)) }], structuredContent: errorOutput(error) } });
+        }
+    }).catch((error) => send({ jsonrpc: "2.0", error: { code: -32603, message: error instanceof Error ? error.message : "Internal error" }, id: null }));
+});
+const close = () => { if (memoryTimer)
+    clearInterval(memoryTimer); app.close(); process.exit(0); };
+process.on("SIGINT", close);
+process.on("SIGTERM", close);

package/dist/memory-worker.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/memory-worker.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import { Phase3App } from "./phase3.js";
+const home = process.argv[2];
+if (!home) {
+    process.stderr.write("usage: supercuts-memory-worker <role-home>\n");
+    process.exitCode = 2;
+}
+else {
+    let stopped = false;
+    process.on("SIGINT", () => { stopped = true; });
+    process.on("SIGTERM", () => { stopped = true; });
+    const app = new Phase3App(home);
+    try {
+        if (app.profile.mock)
+            throw new Error("memory worker requires a live role home");
+        // Only stale claims are ambiguous; another process may be actively writing.
+        app.recoverStaleMemorySubmissions();
+        while (!stopped) {
+            try {
+                await app.processMemoryOutbox();
+            }
+            catch (error) {
+                const code = error && typeof error === "object" && "code" in error ? String(error.code) : "MEMORY_WORKER_ERROR";
+                process.stderr.write(`${code}\n`);
+            }
+            if (!stopped)
+                await new Promise((resolve) => {
+                    const done = () => { clearTimeout(timer); process.off("SIGINT", done); process.off("SIGTERM", done); resolve(); };
+                    const timer = setTimeout(done, 30_000);
+                    process.once("SIGINT", done);
+                    process.once("SIGTERM", done);
+                });
+        }
+    }
+    finally {
+        app.close();
+    }
+}

package/dist/memory.d.ts

@@ -0,0 +1,15 @@
+export type MemoryFactKind = "budget_preference" | "counterparty_reliability" | "delivery_observation" | "successful_counteroffer" | "privacy_choice";
+export interface MemoryFact {
+    kind: MemoryFactKind;
+    subject: string;
+    observation: string;
+    operationId: string;
+    createdAt: number;
+}
+export declare function validateMemoryFact(fact: MemoryFact): void;
+export interface RailPolicy {
+    hiddenAmountRequired: boolean;
+    recalledRulesAvailable: boolean;
+    contradictory: boolean;
+}
+export declare function selectRail(policy: RailPolicy, requested: "shielded" | "x402"): "shielded" | "x402";

package/dist/memory.js

@@ -0,0 +1,17 @@
+import { fail } from "./errors.js";
+const forbidden = [/private key/i, /spend secret/i, /note opening/i, /full transcript/i, /seed phrase/i];
+export function validateMemoryFact(fact) {
+    if (!fact.subject || !fact.observation || !fact.operationId)
+        fail("MEMORY_FACT_INVALID", "memory facts require subject, observation, and operation ID");
+    if (!Number.isSafeInteger(fact.createdAt) || fact.createdAt < 0 || fact.subject.length > 256 || fact.observation.length > 4096 || fact.operationId.length > 256)
+        fail("MEMORY_FACT_INVALID", "memory fact timestamp or field length is invalid");
+    if (forbidden.some((pattern) => pattern.test(`${fact.subject}\n${fact.observation}`)))
+        fail("MEMORY_SECRET_REJECTED", "memory facts cannot include wallet or transcript secrets");
+}
+export function selectRail(policy, requested) {
+    if (!policy.recalledRulesAvailable || policy.contradictory)
+        fail("POLICY_RECALL_REQUIRED", "payment requires explicit policy because recall is missing or contradictory");
+    if (requested === "x402" && policy.hiddenAmountRequired)
+        fail("PUBLIC_RAIL_FORBIDDEN", "policy requires a hidden payment amount");
+    return requested;
+}

package/dist/memwal.d.ts

@@ -0,0 +1,35 @@
+import { MemoryFact } from "./memory.js";
+import { type SettlementMemoryV1 } from "./settlement.js";
+import { RoleStore } from "./store.js";
+export interface ManualMemoryConfig {
+    key: string;
+    accountId: string;
+    serverUrl: string;
+    suiPrivateKey: string;
+    embeddingApiKey: string;
+    embeddingApiBase: string;
+    embeddingModel: string;
+    packageId: string;
+    registryId: string;
+    namespace: string;
+    walrusAggregatorUrl: string;
+    walrusPublisherUrl: string;
+}
+/** Client-managed memory facade; plaintext never crosses the relayer boundary. */
+export declare class ManualMemory {
+    private readonly store;
+    private readonly client;
+    constructor(store: RoleStore, config: ManualMemoryConfig);
+    remember(fact: MemoryFact | SettlementMemoryV1): Promise<string>;
+    recall(query: string, limit?: number): Promise<Array<{
+        blobId: string;
+        text: string;
+        distance: number;
+    }>>;
+    listMetadata(config: ManualMemoryConfig): Promise<{
+        indexed: number;
+        deleted: number;
+        cursor: string | null;
+    }>;
+    destroy(): void;
+}

package/dist/memwal.js

@@ -0,0 +1,83 @@
+import { MemWalManual } from "@mysten-incubation/memwal/manual";
+import { MemWal } from "@mysten-incubation/memwal";
+import { validateMemoryFact } from "./memory.js";
+import { SETTLEMENT_MEMORY_VERSION, validateSettlementMemory } from "./settlement.js";
+/** Client-managed memory facade; plaintext never crosses the relayer boundary. */
+export class ManualMemory {
+    store;
+    client;
+    constructor(store, config) {
+        this.store = store;
+        let embedding;
+        try {
+            embedding = new URL(config.embeddingApiBase);
+        }
+        catch (error) {
+            throw new TypeError(`embeddingApiBase is invalid: ${error instanceof Error ? error.message : "invalid URL"}`);
+        }
+        if (!["localhost", "127.0.0.1", "::1"].includes(embedding.hostname))
+            throw new TypeError("memory embeddings must use a loopback trusted endpoint");
+        this.client = MemWalManual.create({ ...config, suiNetwork: "mainnet", preflightTimeoutMs: 15_000 });
+    }
+    async remember(fact) {
+        if (fact.version === SETTLEMENT_MEMORY_VERSION)
+            validateSettlementMemory(fact);
+        else
+            validateMemoryFact(fact);
+        const text = JSON.stringify(fact);
+        const result = await this.client.rememberManual(text);
+        this.store.putSecret(`memory:${result.blob_id}`, Buffer.from(text));
+        return result.blob_id;
+    }
+    async recall(query, limit = 5) {
+        const result = await this.client.recallManual(query, { limit });
+        return result.results.map((item) => ({ blobId: item.blob_id, text: item.text, distance: item.distance }));
+    }
+    async listMetadata(config) {
+        const client = MemWal.create({ key: config.key, accountId: config.accountId, serverUrl: config.serverUrl, namespace: config.namespace });
+        let cursor = this.store.db.prepare("SELECT cursor FROM memory_inventory_cursor WHERE namespace=?").get(config.namespace)?.cursor ?? undefined;
+        let indexed = 0, deleted = 0, restarted = false;
+        try {
+            for (;;) {
+                const page = await client.listMemories({ ...(cursor ? { cursor } : {}), namespace: config.namespace });
+                if (page.must_resync) {
+                    if (restarted)
+                        throw new Error("Walrus Memory inventory repeatedly requested a full resync");
+                    restarted = true;
+                    cursor = undefined;
+                    this.store.db.prepare("DELETE FROM memory_inventory WHERE namespace=?").run(config.namespace);
+                    this.store.db.prepare("DELETE FROM memory_inventory_cursor WHERE namespace=?").run(config.namespace);
+                    continue;
+                }
+                this.store.db.exec("BEGIN IMMEDIATE");
+                try {
+                    for (const item of page.memories) {
+                        this.store.db.prepare("INSERT INTO memory_inventory(blob_id,memory_id,namespace,status,expires_at,deleted,updated_at) VALUES(?,?,?,?,?,0,?) ON CONFLICT(blob_id) DO UPDATE SET memory_id=excluded.memory_id,namespace=excluded.namespace,status=excluded.status,expires_at=excluded.expires_at,deleted=0,updated_at=excluded.updated_at")
+                            .run(item.blob_id, item.memory_id, item.namespace_id, item.status, item.expires_at, item.updated_at);
+                        indexed++;
+                    }
+                    for (const item of page.deleted) {
+                        this.store.db.prepare("UPDATE memory_inventory SET deleted=1,updated_at=? WHERE memory_id=? AND namespace=?").run(item.deleted_at, item.memory_id, item.namespace_id);
+                        deleted++;
+                    }
+                    this.store.db.prepare("INSERT INTO memory_inventory_cursor(namespace,cursor,updated_at) VALUES(?,?,?) ON CONFLICT(namespace) DO UPDATE SET cursor=excluded.cursor,updated_at=excluded.updated_at")
+                        .run(config.namespace, page.next_cursor, Date.now());
+                    this.store.db.exec("COMMIT");
+                }
+                catch (error) {
+                    this.store.db.exec("ROLLBACK");
+                    throw error;
+                }
+                cursor = page.next_cursor ?? undefined;
+                if (!page.has_more)
+                    return { indexed, deleted, cursor: page.next_cursor };
+                if (!cursor)
+                    throw new Error("Walrus Memory inventory has more pages without a cursor");
+            }
+        }
+        finally {
+            client.destroy();
+        }
+    }
+    destroy() { this.client.destroy(); }
+}

package/dist/negotiation.d.ts

@@ -0,0 +1,23 @@
+import { RoleStore } from "./store.js";
+import { MessageEnvelope, SignatureVerifier } from "./transcript.js";
+export interface BlobTransport {
+    put(id: string, ciphertext: string): Promise<string>;
+    get(blobId: string): Promise<string>;
+    resolve(id: string): Promise<string | undefined>;
+}
+export interface TranscriptManifestEntry extends Omit<MessageEnvelope, "ciphertext"> {
+    blobId: string;
+}
+export declare function encryptSessionMessage(key: Uint8Array, sessionId: string, id: string, plaintext: Uint8Array): string;
+export declare function decryptSessionMessage(key: Uint8Array, sessionId: string, id: string, encoded: string): Buffer;
+/** Persists exact ciphertext before transport and makes uncertain uploads idempotent. */
+export declare class DurableTranscriptTransport {
+    private readonly store;
+    private readonly blobs;
+    constructor(store: RoleStore, blobs: BlobTransport);
+    upload(message: MessageEnvelope): Promise<TranscriptManifestEntry>;
+    restart(manifest: TranscriptManifestEntry[], verify: SignatureVerifier, sessionId: string, participants: ReadonlySet<string>): Promise<{
+        messages: MessageEnvelope[];
+        root: string;
+    }>;
+}

package/dist/negotiation.js

@@ -0,0 +1,58 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { fail } from "./errors.js";
+import { hydrateTranscript, sha256 } from "./transcript.js";
+function sessionKey(key) {
+    if (key.length !== 32)
+        fail("SESSION_KEY_INVALID", "session key must contain 32 bytes");
+    return Buffer.from(key);
+}
+export function encryptSessionMessage(key, sessionId, id, plaintext) {
+    const nonce = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", sessionKey(key), nonce);
+    cipher.setAAD(Buffer.from(`${sessionId}:${id}`));
+    const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return Buffer.concat([nonce, cipher.getAuthTag(), body]).toString("base64");
+}
+export function decryptSessionMessage(key, sessionId, id, encoded) {
+    try {
+        const value = Buffer.from(encoded, "base64");
+        if (value.length < 29)
+            fail("SESSION_CIPHERTEXT_INVALID", "session ciphertext is truncated");
+        const decipher = createDecipheriv("aes-256-gcm", sessionKey(key), value.subarray(0, 12));
+        decipher.setAAD(Buffer.from(`${sessionId}:${id}`));
+        decipher.setAuthTag(value.subarray(12, 28));
+        return Buffer.concat([decipher.update(value.subarray(28)), decipher.final()]);
+    }
+    catch (error) {
+        return fail("SESSION_DECRYPT_FAILED", "participant could not authenticate the session message", error);
+    }
+}
+/** Persists exact ciphertext before transport and makes uncertain uploads idempotent. */
+export class DurableTranscriptTransport {
+    store;
+    blobs;
+    constructor(store, blobs) {
+        this.store = store;
+        this.blobs = blobs;
+    }
+    async upload(message) {
+        const ciphertextHash = sha256(Buffer.from(message.ciphertext, "base64"));
+        if (ciphertextHash !== message.ciphertextHash)
+            fail("CIPHERTEXT_TAMPERED", "message ciphertext hash does not match");
+        this.store.prepareMessage({ id: message.id, sessionId: message.sessionId, sequence: message.sequence, ciphertextHash });
+        this.store.putSecretOnce(`message:${message.id}`, Buffer.from(message.ciphertext));
+        const prepared = this.store.getMessage(message.id);
+        let blobId = prepared.blobId ?? await this.blobs.resolve(message.id);
+        if (!blobId)
+            blobId = await this.blobs.put(message.id, this.store.getSecret(`message:${message.id}`).toString());
+        const remote = await this.blobs.get(blobId);
+        if (sha256(Buffer.from(remote, "base64")) !== ciphertextHash)
+            fail("WALRUS_BLOB_MISMATCH", "retrieved blob differs from durable ciphertext");
+        this.store.attachMessageBlob(message.id, ciphertextHash, blobId);
+        const { ciphertext: _ciphertext, ...metadata } = message;
+        return { ...metadata, blobId };
+    }
+    async restart(manifest, verify, sessionId, participants) {
+        return hydrateTranscript(manifest, (blobId) => this.blobs.get(blobId), verify, { sessionId, participants });
+    }
+}

package/dist/notes.d.ts

@@ -0,0 +1,11 @@
+export interface NoteOpening {
+    deployment: bigint;
+    amount: bigint;
+    ownerAx: bigint;
+    ownerAy: bigint;
+    spendSecret: bigint;
+    salt: bigint;
+}
+export declare function encodeNoteOpening(opening: NoteOpening): Buffer;
+/** Recomputes the exact Poseidon commitment enforced by protocol-v1 circuits. */
+export declare function noteCommitment(opening: NoteOpening): Promise<string>;

package/dist/notes.js

@@ -0,0 +1,26 @@
+import { buildPoseidon } from "circomlibjs";
+import { fail } from "./errors.js";
+const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+const U64_MAX = (1n << 64n) - 1n;
+let poseidonPromise;
+function field(name, value) {
+    if (typeof value !== "bigint" || value <= 0n || value >= FIELD_MODULUS)
+        fail("NOTE_OPENING_INVALID", `${name} must be a nonzero canonical BN254 field element`);
+}
+export function encodeNoteOpening(opening) {
+    return Buffer.from(JSON.stringify(Object.fromEntries(Object.entries(opening).map(([key, value]) => [key, value.toString()]))));
+}
+/** Recomputes the exact Poseidon commitment enforced by protocol-v1 circuits. */
+export async function noteCommitment(opening) {
+    field("deployment", opening.deployment);
+    field("ownerAx", opening.ownerAx);
+    field("ownerAy", opening.ownerAy);
+    field("spendSecret", opening.spendSecret);
+    field("salt", opening.salt);
+    if (typeof opening.amount !== "bigint" || opening.amount <= 0n || opening.amount > U64_MAX)
+        fail("NOTE_OPENING_INVALID", "amount must be a positive u64");
+    const poseidon = await (poseidonPromise ??= buildPoseidon());
+    const spendTag = poseidon.F.toObject(poseidon([2006n, opening.spendSecret]));
+    const commitment = poseidon.F.toObject(poseidon([2010n, opening.deployment, opening.amount, opening.ownerAx, opening.ownerAy, spendTag, opening.salt]));
+    return commitment.toString(16).padStart(64, "0");
+}

package/dist/onboarding-doctor.d.ts

@@ -0,0 +1 @@
+export declare function onboardingDoctor(home: string, sellerConfig?: string): Promise<Record<string, unknown>>;

package/dist/onboarding-doctor.js

@@ -0,0 +1,76 @@
+import { readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { verifySignedCapability } from "./capability.js";
+import { fail } from "./errors.js";
+import { loadMandate } from "./mandate.js";
+import { Phase3App } from "./phase3.js";
+import { writeClient } from "./sui.js";
+async function json(url) {
+    const response = await fetch(url, { redirect: "error", signal: AbortSignal.timeout(15_000) });
+    if (!response.ok)
+        fail("ONBOARDING_SERVICE_UNAVAILABLE", `${url.origin} returned HTTP ${response.status}`);
+    const result = await response.json();
+    if (!result || typeof result !== "object" || Array.isArray(result))
+        fail("ONBOARDING_SERVICE_INVALID", `${url.origin} returned invalid JSON`);
+    return result;
+}
+export async function onboardingDoctor(home, sellerConfig) {
+    const app = new Phase3App(home);
+    try {
+        if (app.profile.mock)
+            fail("LIVE_PROFILE_REQUIRED", "onboarding doctor requires a live Testnet role home");
+        const runtime = await app.execute("doctor", {});
+        if (runtime.data.readyForDemo === false)
+            fail("ONBOARDING_RUNTIME_NOT_READY", "live runtime doctor reports missing prerequisites");
+        if (app.profile.role === "buyer") {
+            const mandate = loadMandate(home);
+            if (mandate.version !== "supercuts.mandate.v2")
+                fail("DEAL_MANDATE_VERSION", "buyer needs a v2 standing mandate");
+            if (JSON.stringify([...mandate.allowedCounterparties].sort()) !== JSON.stringify([...app.profile.policy.allowedCounterparties].sort()))
+                fail("POLICY_COUNTERPARTY_MISMATCH", "buyer mandate and payment profile allow different sellers");
+            const path = join(home, "deal-sellers.json");
+            if ((statSync(path).mode & 0o077) !== 0)
+                fail("DEAL_SELLERS_PERMISSIONS", "buyer catalog config must be owner-only");
+            const source = JSON.parse(readFileSync(path, "utf8"));
+            const directoryUrl = Array.isArray(source) ? undefined : source.directoryUrl;
+            let directoryListings;
+            if (directoryUrl) {
+                const health = await json(new URL("/v2/directory/health", directoryUrl));
+                if (health.ok !== true)
+                    fail("SELLER_DIRECTORY_UNAVAILABLE", "directory health check failed");
+                directoryListings = Number(health.listings);
+            }
+            const endpoint = app.profile.live?.writeGrpcEndpoint ?? fail("LIVE_PROFILE_INVALID", "buyer write RPC is missing");
+            const signer = String(runtime.data.signer ?? "");
+            const { balance } = await writeClient(endpoint).getBalance({ owner: signer, coinType: "0x2::sui::SUI" });
+            return { role: "buyer", healthy: true, runtime: runtime.data, approvedSellers: mandate.allowedCounterparties.length, nativeSuiMist: String(balance.balance), funded: BigInt(balance.balance) > 0n, ...(directoryListings !== undefined ? { directoryListings } : {}) };
+        }
+        if (app.profile.role === "seller") {
+            if (!sellerConfig)
+                fail("ARGUMENT_REQUIRED", "seller doctor requires --config <owner-only-seller-config.json>");
+            const path = resolve(sellerConfig);
+            if ((statSync(path).mode & 0o077) !== 0)
+                fail("SELLER_CONFIG_PERMISSIONS", "seller config must be owner-only");
+            const config = JSON.parse(readFileSync(path, "utf8"));
+            if (!Array.isArray(config.capabilities) || !config.capabilities.length)
+                fail("SELLER_CONFIG_INVALID", "seller has no registered capabilities");
+            const served = await json(new URL("/v2/catalog", config.origin));
+            if (!Array.isArray(served.capabilities))
+                fail("SELLER_CATALOG_INVALID", "seller endpoint has no valid catalog");
+            for (const item of config.capabilities) {
+                const registrationPath = resolve(item.registrationFile);
+                if ((statSync(registrationPath).mode & 0o077) !== 0)
+                    fail("SELLER_CONFIG_PERMISSIONS", "registration file must be owner-only");
+                const registration = JSON.parse(readFileSync(registrationPath, "utf8"));
+                await verifySignedCapability(registration);
+                if (!served.capabilities.some((entry) => JSON.stringify(entry) === JSON.stringify(registration)))
+                    fail("SELLER_CATALOG_INVALID", "seller endpoint does not serve its configured registration");
+            }
+            return { role: "seller", healthy: true, runtime: runtime.data, capabilities: config.capabilities.length, origin: config.origin };
+        }
+        return fail("ROLE_FORBIDDEN", "onboarding doctor supports buyer and seller homes");
+    }
+    finally {
+        app.close();
+    }
+}