@supercuts-walrus/backend 0.0.0-stage → 0.1.0

package/dist/remote-buyer.js

@@ -0,0 +1,231 @@
+import { createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, hkdfSync, randomBytes } from "node:crypto";
+import { isValidPersonalMessageSignature } from "@mysten/sui/verify";
+import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+import { validateCapabilityManifest, verifySignedCapability } from "./capability.js";
+import { fail } from "./errors.js";
+import { executeMandated } from "./mandate.js";
+import { decryptSessionMessage, encryptSessionMessage } from "./negotiation.js";
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+const num = (value, name) => typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1 ? value : fail("SELLER_PREVIEW_INVALID", `${name} must be between zero and one`);
+const halves = (content) => { const hash = sha256(content); return [BigInt(`0x${hash.slice(0, 32)}`).toString(), BigInt(`0x${hash.slice(32)}`).toString()]; };
+export class RemoteBuyer {
+    app;
+    mandate;
+    http;
+    #origin;
+    constructor(app, mandate, origin, http = fetch) {
+        this.app = app;
+        this.mandate = mandate;
+        this.http = http;
+        this.#origin = new URL(origin);
+        if (this.#origin.protocol !== "https:" && !(this.#origin.protocol === "http:" && ["127.0.0.1", "localhost", "::1"].includes(this.#origin.hostname)))
+            fail("SELLER_ORIGIN_INVALID", "seller origin must use HTTPS except on loopback");
+    }
+    async request(path, init = {}) {
+        let response;
+        for (let attempt = 0; attempt < 2; attempt++) {
+            try {
+                response = await this.http(new URL(path, this.#origin), { ...init, headers: { ...(init.body ? { "content-type": "application/json" } : {}), ...(init.headers ?? {}) }, signal: init.signal ?? AbortSignal.timeout(90_000), redirect: "error" });
+            }
+            catch (error) {
+                if (attempt === 0)
+                    continue;
+                return fail("REMOTE_SELLER_UNAVAILABLE", "seller transport failed after retry", error);
+            }
+            if (response.status !== 503 || attempt === 1)
+                break;
+            await response.arrayBuffer();
+            await new Promise((done) => setTimeout(done, 3000));
+        }
+        const received = response ?? fail("REMOTE_SELLER_UNAVAILABLE", "seller did not respond");
+        const value = await received.json();
+        if (!received.ok && received.status !== 202)
+            fail("REMOTE_SELLER_ERROR", `seller returned ${received.status}: ${String(value.error ?? "unknown error")}`);
+        return value;
+    }
+    async catalog() {
+        const listed = await this.request("/v1/catalog"), entries = listed.capabilities;
+        if (!Array.isArray(entries) || !entries.length || entries.length > 100)
+            fail("SELLER_CATALOG_INVALID", "remote catalog is empty or too large");
+        const discovered = (await this.app.execute("capability.discover", { "blob-ids": Buffer.from(JSON.stringify(entries.map((entry) => entry.blobId))).toString("base64url") })).data.capabilities;
+        if (discovered.length !== entries.length)
+            fail("SELLER_CATALOG_INVALID", "Walrus discovery returned a different capability count");
+        for (let i = 0; i < entries.length; i++) {
+            const entry = entries[i];
+            validateCapabilityManifest(entry.manifest);
+            if (entry.manifest.manifestHash !== discovered[i].manifestHash || entry.blobId !== discovered[i].blobId || !this.mandate.allowedCounterparties.includes(entry.manifest.sellerId))
+                fail("SELLER_CATALOG_INVALID", "catalog differs from Walrus or owner allowlist");
+            await verifySignedCapability({ manifest: entry.manifest, manifestBlobId: entry.blobId, transportPublicKey: entry.transportPublicKey, sellerSignature: entry.signature });
+        }
+        return { capabilities: entries };
+    }
+    async rankBriefs(input) {
+        if (!/^[1-9][0-9]*$/.test(input.budget))
+            fail("BUYER_BUDGET_INVALID", "budget must be positive MIST");
+        const budget = BigInt(input.budget), catalog = await this.catalog();
+        const analysis = catalog.capabilities.find((entry) => entry.manifest.capability === "sui.competitor-analysis" && entry.manifest.supportedRails.includes("shielded")) ?? fail("ANALYSIS_UNAVAILABLE", "no shielded competitor analysis is available");
+        const analysisPrice = BigInt(analysis.manifest.priceBand.minimum), variants = analysis.preview.artifactHashes;
+        const candidates = catalog.capabilities.filter((entry) => {
+            const briefHash = entry.preview.artifactHashes?.default;
+            return entry.manifest.capability === "sui.market-brief" && entry.manifest.supportedRails.includes("x402") && typeof briefHash === "string" && /^[0-9a-f]{64}$/.test(briefHash) && typeof variants?.[briefHash] === "string" && BigInt(entry.manifest.priceBand.minimum) + analysisPrice <= budget;
+        });
+        if (candidates.length < 2)
+            fail("BRIEF_COMPARISON_UNAVAILABLE", "at least two eligible market briefs are required");
+        const scored = candidates.map((entry) => {
+            const preview = entry.preview, relevance = num(preview.relevance, "relevance"), sourceQuality = num(preview.sourceQuality, "sourceQuality"), freshnessDays = Number(preview.freshnessDays);
+            if (!Number.isFinite(freshnessDays) || freshnessDays < 0 || freshnessDays > 365)
+                fail("SELLER_PREVIEW_INVALID", "freshnessDays is invalid");
+            const freshness = Math.max(0, 1 - freshnessDays / 30), price = BigInt(entry.manifest.priceBand.minimum), totalPrice = price + analysisPrice, priceScore = Number((budget - totalPrice) * 1000n / budget) / 1000;
+            const score = Math.round((0.35 * relevance + 0.30 * sourceQuality + 0.20 * freshness + 0.15 * priceScore) * 1000) / 1000;
+            return { capabilityId: entry.manifest.capabilityId, sellerId: entry.manifest.sellerId, priceMist: price.toString(), projectedTotalMist: totalPrice.toString(), score, components: { relevance, sourceQuality, freshness, price: priceScore }, preview: { title: preview.title, summary: preview.summary, citations: preview.citations, freshnessDays }, manifestHash: entry.manifest.manifestHash };
+        }).sort((a, b) => b.score - a.score || (BigInt(a.priceMist) < BigInt(b.priceMist) ? -1 : BigInt(a.priceMist) > BigInt(b.priceMist) ? 1 : a.capabilityId.localeCompare(b.capabilityId)));
+        return { topic: input.topic, budgetMist: input.budget, analysisCapabilityId: analysis.manifest.capabilityId, analysisPriceMist: analysisPrice.toString(), rubric: { relevance: 0.35, sourceQuality: 0.30, freshness: 0.20, price: 0.15 }, rankings: scored, winner: scored[0], note: "Preview quality fields are seller supplied; the buyer checks artifact citations after delivery." };
+    }
+    async negotiate(input) {
+        const catalog = await this.catalog(), entry = catalog.capabilities.find((item) => item.manifest.capabilityId === input.capabilityId) ?? fail("SELLER_CAPABILITY_UNKNOWN", "capability is not in the verified catalog");
+        if (!/^[1-9][0-9]*$/.test(input.opening) || !/^[1-9][0-9]*$/.test(input.maximum) || BigInt(input.opening) > BigInt(input.maximum) || BigInt(input.maximum) < BigInt(entry.manifest.priceBand.minimum) || BigInt(input.maximum) > BigInt(entry.manifest.priceBand.maximum))
+            fail("NEGOTIATION_BOUNDS_INVALID", "offer bounds are outside the seller price band");
+        if (input.briefHash !== undefined && !/^[0-9a-f]{64}$/.test(input.briefHash))
+            fail("BUYER_BRIEF_HASH_INVALID", "brief hash is invalid");
+        const privateDer = this.app.store.getSecret("identity:x25519-private") ?? fail("IDENTITY_MISSING", "buyer negotiation key is missing"), publicKey = this.app.store.getSecret("identity:x25519-public")?.toString("base64url") ?? fail("IDENTITY_MISSING", "buyer negotiation key is missing");
+        const shared = diffieHellman({ privateKey: createPrivateKey({ key: privateDer, format: "der", type: "pkcs8" }), publicKey: createPublicKey({ key: Buffer.from(entry.transportPublicKey, "base64url"), format: "der", type: "spki" }) });
+        const key = Buffer.from(hkdfSync("sha256", shared, Buffer.from(input.sessionId), Buffer.from("supercuts-negotiation-v1"), 32));
+        this.app.store.db.exec("CREATE TABLE IF NOT EXISTS remote_buyer_negotiations(session_id TEXT PRIMARY KEY, capability_id TEXT NOT NULL, run_id TEXT NOT NULL, offer_hash TEXT NOT NULL, request_ciphertext TEXT NOT NULL, buyer_signature TEXT NOT NULL, reply_json TEXT)");
+        const offer = { task: input.task.slice(0, 512), opening: input.opening, maximum: input.maximum, ...(input.briefHash ? { briefHash: input.briefHash } : {}) }, offerHash = sha256(JSON.stringify(offer));
+        const existing = this.app.store.db.prepare("SELECT capability_id AS capabilityId,run_id AS runId,offer_hash AS offerHash,request_ciphertext AS ciphertext,buyer_signature AS buyerSignature,reply_json AS replyJson FROM remote_buyer_negotiations WHERE session_id=?").get(input.sessionId);
+        if (existing && (existing.capabilityId !== input.capabilityId || existing.runId !== input.runId || existing.offerHash !== offerHash))
+            fail("NEGOTIATION_SESSION_CONFLICT", "session belongs to another offer or run");
+        const encrypted = existing?.ciphertext ?? encryptSessionMessage(key, input.sessionId, `${input.sessionId}:buyer:1`, Buffer.from(JSON.stringify(offer)));
+        const encodedSigner = this.app.store.getSecret("live:sui-private-key")?.toString() ?? fail("LIVE_CREDENTIAL_MISSING", "buyer signing key is missing"), decoded = decodeSuiPrivateKey(encodedSigner);
+        if (decoded.scheme !== "ED25519")
+            fail("SIGNER_UNSUPPORTED", "buyer requires an ED25519 signer");
+        const signer = Ed25519Keypair.fromSecretKey(decoded.secretKey), signedBytes = Buffer.from(`${input.sessionId}:${input.capabilityId}:${publicKey}:${sha256(Buffer.from(encrypted, "base64"))}`);
+        const buyerSignature = existing?.buyerSignature ?? (await signer.signPersonalMessage(signedBytes)).signature;
+        if (!existing)
+            this.app.store.db.prepare("INSERT INTO remote_buyer_negotiations(session_id,capability_id,run_id,offer_hash,request_ciphertext,buyer_signature) VALUES(?,?,?,?,?,?)").run(input.sessionId, input.capabilityId, input.runId, offerHash, encrypted, buyerSignature);
+        const result = existing?.replyJson ? JSON.parse(existing.replyJson) : await this.request("/v1/negotiate", { method: "POST", body: JSON.stringify({ capabilityId: input.capabilityId, sessionId: input.sessionId, runId: input.runId, buyerAddress: signer.toSuiAddress(), buyerPublicKey: publicKey, buyerSignature, ciphertext: encrypted }) });
+        const replyCiphertext = String(result.ciphertext ?? ""), transcriptHash = sha256(JSON.stringify({ request: sha256(Buffer.from(encrypted, "base64")), reply: sha256(Buffer.from(replyCiphertext, "base64")) }));
+        if (result.sessionId !== input.sessionId || result.capabilityId !== input.capabilityId || result.transcriptHash !== transcriptHash || !(await isValidPersonalMessageSignature(Buffer.from(`${input.sessionId}:${input.capabilityId}:${sha256(Buffer.from(replyCiphertext, "base64"))}:${transcriptHash}`), String(result.signature), { address: entry.manifest.sellerId })))
+            fail("NEGOTIATION_RESPONSE_INVALID", "seller response or signature is invalid");
+        const aggregator = this.app.profile.live?.walrusAggregatorUrl ?? fail("LIVE_WALRUS_CONFIG_MISSING", "buyer needs a Walrus aggregator");
+        for (const [blobId, ciphertext] of [[result.requestBlobId, encrypted], [result.replyBlobId, replyCiphertext]]) {
+            const read = await this.http(`${aggregator.replace(/\/$/, "")}/v1/blobs/${encodeURIComponent(String(blobId))}`, { signal: AbortSignal.timeout(60_000) });
+            if (!read.ok || !Buffer.from(await read.arrayBuffer()).equals(Buffer.from(ciphertext, "base64")))
+                fail("WALRUS_BLOB_MISMATCH", "encrypted offer or response differs from Walrus");
+        }
+        const response = JSON.parse(decryptSessionMessage(key, input.sessionId, `${input.sessionId}:seller:2`, replyCiphertext).toString());
+        if (response.capabilityId !== input.capabilityId || response.asset !== entry.manifest.asset || response.amount !== entry.manifest.priceBand.minimum || response.accepted !== true)
+            fail("NEGOTIATION_RESPONSE_INVALID", "seller response changed the approved price or capability");
+        if (!existing?.replyJson)
+            this.app.store.db.prepare("UPDATE remote_buyer_negotiations SET reply_json=? WHERE session_id=?").run(JSON.stringify(result), input.sessionId);
+        return { sessionId: input.sessionId, capabilityId: input.capabilityId, sellerId: entry.manifest.sellerId, opening: input.opening, amount: response.amount, asset: response.asset, accepted: true, transcriptHash, requestBlobId: result.requestBlobId, replyBlobId: result.replyBlobId };
+    }
+    async quote(input) {
+        const catalog = await this.catalog(), entry = catalog.capabilities.find((item) => item.manifest.capabilityId === input.capabilityId) ?? fail("SELLER_CAPABILITY_UNKNOWN", "capability is not in the verified catalog");
+        if (!entry.manifest.supportedRails.includes("x402"))
+            fail("SELLER_RAIL_UNSUPPORTED", "capability does not support public settlement");
+        const quote = await this.request("/v1/quote", { method: "POST", body: JSON.stringify(input) });
+        if (quote.capabilityId !== entry.manifest.capabilityId || quote.sellerId !== entry.manifest.sellerId || quote.asset !== entry.manifest.asset || quote.amount !== entry.manifest.priceBand.minimum || quote.requestId !== input.requestId || quote.operationId !== input.operationId)
+            fail("SELLER_QUOTE_INVALID", "seller quote differs from its manifest or request");
+        const endpoint = new URL(entry.manifest.endpoint), resource = new URL(String(quote.resourceUrl));
+        if (resource.origin !== endpoint.origin || resource.pathname !== `${endpoint.pathname.replace(/\/$/, "")}/${encodeURIComponent(input.requestId)}` || resource.search || resource.hash)
+            fail("SELLER_QUOTE_INVALID", "seller resource URL is outside its capability endpoint");
+        return quote;
+    }
+    async purchaseBrief(input) {
+        if (!/^[1-9][0-9]*$/.test(input.budget))
+            fail("BUYER_BUDGET_INVALID", "budget must be positive MIST");
+        const catalog = await this.catalog(), entry = catalog.capabilities.find((item) => item.manifest.capabilityId === input.capabilityId) ?? fail("SELLER_CAPABILITY_UNKNOWN", "capability is not in the verified catalog");
+        if (entry.manifest.capability !== "sui.market-brief")
+            fail("BUYER_CAPABILITY_INVALID", "selected capability is not a market brief");
+        const briefHash = entry.preview.artifactHashes?.default;
+        const analysis = catalog.capabilities.find((item) => item.manifest.capability === "sui.competitor-analysis" && typeof item.preview.artifactHashes?.[String(briefHash)] === "string") ?? fail("ANALYSIS_UNAVAILABLE", "analysis seller has no matching prepared variant");
+        if (BigInt(entry.manifest.priceBand.minimum) + BigInt(analysis.manifest.priceBand.minimum) > BigInt(input.budget))
+            fail("BUYER_BUDGET_EXCEEDED", "brief and analysis exceed the total task budget");
+        const minimum = BigInt(entry.manifest.priceBand.minimum), opening = minimum > 1n ? minimum - (minimum / 10n || 1n) : minimum;
+        const negotiated = await this.negotiate({ capabilityId: input.capabilityId, sessionId: input.requestId, runId: input.runId, task: input.task, opening: opening.toString(), maximum: (BigInt(input.budget) - BigInt(analysis.manifest.priceBand.minimum) < BigInt(entry.manifest.priceBand.maximum) ? BigInt(input.budget) - BigInt(analysis.manifest.priceBand.minimum) : BigInt(entry.manifest.priceBand.maximum)).toString() });
+        const quote = await this.quote(input);
+        if (BigInt(String(quote.amount)) > BigInt(input.budget))
+            fail("BUYER_BUDGET_EXCEEDED", "seller quote exceeds the budget");
+        const plan = await executeMandated(this.app, this.mandate, "settlement.plan", { "operation-id": input.operationId, manifest: entry.manifest, "requested-amount": String(quote.amount) });
+        if (plan.status !== "approved" || plan.rail !== "x402")
+            fail("BUYER_RAIL_DENIED", "public brief settlement plan was not approved for x402");
+        const paid = await executeMandated(this.app, this.mandate, "pay.x402", { "operation-id": input.operationId, "resource-url": String(quote.resourceUrl), amount: String(quote.amount), "plan-hash": String(plan.planHash) });
+        const artifact = Buffer.from(String(paid.response), "base64");
+        if (sha256(artifact) !== quote.artifactSha256 || sha256(artifact) !== paid.responseSha256)
+            fail("DELIVERY_HASH_MISMATCH", "delivered brief differs from the seller quote or payment receipt");
+        let report;
+        try {
+            report = JSON.parse(artifact.toString());
+        }
+        catch (error) {
+            return fail("BRIEF_INVALID", "paid brief is not JSON", error);
+        }
+        if (typeof report.title !== "string" || typeof report.body !== "string" || !Array.isArray(report.citations) || report.citations.length < 2 || report.citations.some((value) => typeof value !== "string" || !/^https:\/\//.test(value)))
+            fail("BRIEF_INVALID", "paid brief needs a title, body, and at least two HTTPS citations");
+        const recorded = (await this.app.execute("resource.fetch", { "request-id": input.requestId, "operation-id": input.operationId, response: artifact.toString("base64url") })).data;
+        this.app.store.db.exec("CREATE TABLE IF NOT EXISTS remote_purchases(run_id TEXT PRIMARY KEY,brief_hash TEXT NOT NULL,brief_amount TEXT NOT NULL,budget TEXT NOT NULL,capability_id TEXT NOT NULL,operation_id TEXT NOT NULL)");
+        const prior = this.app.store.db.prepare("SELECT brief_hash AS briefHash,brief_amount AS briefAmount,budget,capability_id AS capabilityId,operation_id AS operationId FROM remote_purchases WHERE run_id=?").get(input.runId);
+        const purchase = { briefHash: sha256(artifact), briefAmount: String(paid.amount), budget: input.budget, capabilityId: input.capabilityId, operationId: input.operationId };
+        if (prior && JSON.stringify(prior) !== JSON.stringify(purchase))
+            fail("BUYER_RUN_CONFLICT", "run ID identifies a different purchased brief or budget");
+        if (!prior)
+            this.app.store.db.prepare("INSERT INTO remote_purchases(run_id,brief_hash,brief_amount,budget,capability_id,operation_id) VALUES(?,?,?,?,?,?)").run(input.runId, purchase.briefHash, purchase.briefAmount, purchase.budget, purchase.capabilityId, purchase.operationId);
+        return { capabilityId: input.capabilityId, sellerId: entry.manifest.sellerId, negotiation: negotiated, artifact: report, artifactSha256: sha256(artifact), deliveryStatus: recorded.deliveryStatus, transactionDigest: paid.transactionDigest, checkpoint: paid.checkpoint, rail: "x402", amount: paid.amount, payee: paid.counterparty, planHash: plan.planHash };
+    }
+    async agreement(input) {
+        if (!/^[0-9a-f]{64}$/.test(input.briefHash))
+            fail("BUYER_BRIEF_HASH_INVALID", "brief hash is invalid");
+        const catalog = await this.catalog(), entry = catalog.capabilities.find((item) => item.manifest.capabilityId === input.capabilityId) ?? fail("SELLER_CAPABILITY_UNKNOWN", "capability is not in the verified catalog");
+        this.app.store.db.exec("CREATE TABLE IF NOT EXISTS remote_purchases(run_id TEXT PRIMARY KEY,brief_hash TEXT NOT NULL,brief_amount TEXT NOT NULL,budget TEXT NOT NULL,capability_id TEXT NOT NULL,operation_id TEXT NOT NULL)");
+        const purchased = this.app.store.db.prepare("SELECT brief_hash AS briefHash,brief_amount AS briefAmount,budget FROM remote_purchases WHERE run_id=?").get(input.runId);
+        if (!purchased || purchased.briefHash !== input.briefHash || BigInt(purchased.briefAmount) + BigInt(entry.manifest.priceBand.minimum) > BigInt(purchased.budget))
+            fail("BUYER_PURCHASE_REQUIRED", "analysis requires the matching paid brief within the total budget");
+        const hashes = entry.preview.artifactHashes, artifactSha256 = hashes?.[input.briefHash];
+        if (!artifactSha256 || !/^[0-9a-f]{64}$/.test(artifactSha256))
+            fail("SELLER_ARTIFACT_MISSING", "seller has no prepared analysis for the purchased brief");
+        const analysisMinimum = BigInt(entry.manifest.priceBand.minimum), analysisOpening = analysisMinimum > 1n ? analysisMinimum - (analysisMinimum / 10n || 1n) : analysisMinimum;
+        const negotiated = await this.negotiate({ capabilityId: input.capabilityId, sessionId: input.sessionId, runId: input.runId, task: "Confidential competitor analysis of the purchased Sui brief", opening: analysisOpening.toString(), maximum: entry.manifest.priceBand.minimum, briefHash: input.briefHash });
+        const plan = await executeMandated(this.app, this.mandate, "settlement.plan", { "operation-id": input.operationId, manifest: entry.manifest, "requested-amount": entry.manifest.priceBand.minimum });
+        if (plan.status !== "approved" || plan.rail !== "shielded" || !Array.isArray(plan.reasonCodes) || !plan.reasonCodes.includes("MEMORY_PRIVACY_APPLIED"))
+            fail("BUYER_PRIVACY_REQUIRED", "saved owner privacy rule did not select shielded settlement");
+        const publicKey = this.app.store.getSecret("identity:x25519-public")?.toString("base64url") ?? fail("IDENTITY_MISSING", "buyer delivery key is missing");
+        const identity = (await this.app.execute("doctor", {})).data;
+        const [transcriptRootLo, transcriptRootHi] = [BigInt(`0x${String(negotiated.transcriptHash).slice(0, 32)}`).toString(), BigInt(`0x${String(negotiated.transcriptHash).slice(32)}`).toString()];
+        const [serviceDigestLo, serviceDigestHi] = halves(JSON.stringify({ capabilityId: input.capabilityId, briefHash: input.briefHash, artifactSha256, deliveryPublicKey: publicKey }));
+        const scalar = () => BigInt(`0x${randomBytes(16).toString("hex")}`).toString();
+        const draft = { dealId: scalar(), revision: "1", transcriptRootLo, transcriptRootHi, serviceDigestLo, serviceDigestHi, settlementNonceLo: scalar(), settlementNonceHi: scalar(), paymentAmount: entry.manifest.priceBand.minimum, blinding: scalar(), expiry: String(Date.now() + 30 * 60_000), buyerPublicKey: identity.babyJubPublicKey, counterparty: entry.manifest.sellerId, capabilityId: entry.manifest.capabilityId, manifestHash: entry.manifest.manifestHash };
+        const signed = await this.request("/v1/agreement", { method: "POST", body: JSON.stringify({ capabilityId: input.capabilityId, sessionId: input.sessionId, runId: input.runId, briefHash: input.briefHash, deliveryPublicKey: publicKey, agreement: Buffer.from(JSON.stringify(draft)).toString("base64url") }) });
+        if (signed.artifactSha256 !== artifactSha256 || signed.capabilityId !== input.capabilityId || signed.sessionId !== input.sessionId)
+            fail("AGREEMENT_BINDING_MISMATCH", "seller response changed the prepared artifact or session");
+        const accepted = await executeMandated(this.app, this.mandate, "offer.accept", { "operation-id": `accept-${input.sessionId}`, session: input.sessionId, agreement: signed.agreement, "plan-hash": String(plan.planHash) });
+        return { plan, accepted, negotiation: negotiated, sessionId: input.sessionId, artifactSha256, memoryCitationCount: Array.isArray(plan.citations) ? plan.citations.length : 0 };
+    }
+    async settleAnalysis(input) {
+        const agreement = this.app.store.db.prepare("SELECT agreement FROM live_agreements WHERE session_id=?").get(input.sessionId) ?? fail("AGREEMENT_NOT_ACCEPTED", "analysis session has no accepted seller agreement");
+        const accepted = JSON.parse(agreement.agreement);
+        const binding = this.app.store.db.prepare("SELECT plan_hash FROM settlement_agreement_bindings WHERE session_id=?").get(input.sessionId) ?? fail("SETTLEMENT_PLAN_REQUIRED", "analysis agreement is not bound to an approved plan");
+        const receipt = await executeMandated(this.app, this.mandate, "pay.shielded", { "operation-id": input.operationId, session: input.sessionId, amount: accepted.paymentAmount, counterparty: accepted.counterparty, "plan-hash": binding.plan_hash });
+        return { sessionId: input.sessionId, rail: "shielded", transactionDigest: receipt.transactionDigest, checkpoint: receipt.checkpoint, finalized: receipt.finalized, tatumVerified: receipt.tatumVerified, dealCommitment: receipt.dealCommitment, planHash: binding.plan_hash, visibility: "pool transaction and gas sender visible; direct amount and counterparty absent" };
+    }
+    async delivery(input) {
+        const response = await this.request(`/v1/delivery/${encodeURIComponent(input.sessionId)}`);
+        if (response.status === "payment-pending")
+            return response;
+        if (response.status !== "delivered" || response.sessionId !== input.sessionId || !/^[0-9a-f]{64}$/.test(String(response.artifactSha256)))
+            fail("DELIVERY_INVALID", "seller delivery is invalid");
+        const privateDer = this.app.store.getSecret("identity:x25519-private") ?? fail("IDENTITY_MISSING", "buyer delivery key is missing");
+        const privateKey = createPrivateKey({ key: privateDer, format: "der", type: "pkcs8" }), ephemeral = createPublicKey({ key: Buffer.from(response.ephemeralPublicKey, "base64url"), format: "der", type: "spki" });
+        const shared = diffieHellman({ privateKey, publicKey: ephemeral }), key = Buffer.from(hkdfSync("sha256", shared, Buffer.from(input.sessionId), Buffer.from("supercuts-delivery-v1"), 32));
+        const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(response.nonce, "base64url"));
+        decipher.setAAD(Buffer.from(`${input.sessionId}:${String(response.capabilityId)}:${String(response.artifactSha256)}`));
+        decipher.setAuthTag(Buffer.from(response.tag, "base64url"));
+        const artifact = Buffer.concat([decipher.update(Buffer.from(response.ciphertext, "base64url")), decipher.final()]);
+        if (sha256(artifact) !== response.artifactSha256)
+            fail("DELIVERY_HASH_MISMATCH", "seller artifact differs from its accepted hash");
+        const recorded = (await this.app.execute("resource.fetch", { "request-id": input.sessionId, "operation-id": input.operationId, response: artifact.toString("base64url") })).data;
+        return { status: "delivered", sessionId: input.sessionId, artifactSha256: response.artifactSha256, body: artifact.toString("utf8"), record: { deliveryStatus: recorded.deliveryStatus, responseHash: recorded.responseHash } };
+    }
+    async events(runId) { return this.request(`/v1/events?runId=${encodeURIComponent(runId)}`); }
+}

package/dist/resource-server.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/resource-server.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { Phase3App, errorOutput, homePath, parseArgs } from "./phase3.js";
+import { X402ResourceService } from "./x402-resource-service.js";
+import { fail } from "./errors.js";
+const args = parseArgs(process.argv.slice(2)), required = (name) => typeof args[name] === "string" ? args[name] : fail("ARGUMENT_REQUIRED", `--${name} is required`);
+try {
+    const app = new Phase3App(homePath(args));
+    if (app.profile.role !== "seller")
+        fail("ROLE_FORBIDDEN", "resource service requires a seller role home");
+    const document = JSON.parse(readFileSync(resolve(required("config")), "utf8"));
+    if (!Array.isArray(document.artifacts) || !document.artifacts.length)
+        fail("RESOURCE_CONFIG_INVALID", "resource config needs at least one artifact");
+    const service = new X402ResourceService(app.store, document.service), registered = document.artifacts.map((item) => ({ requestId: item.requestId, operationId: item.operationId, ...service.register(item.requestId, item.operationId, readFileSync(resolve(item.file))) })), server = service.createServer(), origin = new URL(document.service.origin), port = Number(origin.port || (origin.protocol === "https:" ? 443 : 80));
+    server.listen(port, origin.hostname, () => process.stdout.write(`${JSON.stringify({ schemaVersion: "supercuts.resource.v1", ok: true, origin: document.service.origin, payTo: document.service.payTo, artifacts: registered })}\n`));
+    const close = () => server.close(() => { app.close(); process.exit(0); });
+    process.on("SIGINT", close);
+    process.on("SIGTERM", close);
+}
+catch (error) {
+    process.stdout.write(`${JSON.stringify(errorOutput(error))}\n`);
+    process.exitCode = 1;
+}

package/dist/resource.d.ts

@@ -0,0 +1,22 @@
+import { ExactRequirements, FinalPayment, PaymentBinding, PaymentConsumptionLedger } from "./x402.js";
+export interface PaymentSubmission {
+    binding: PaymentBinding;
+}
+export type PayerSignatureVerifier = (binding: PaymentBinding, requirements: ExactRequirements) => Promise<boolean>;
+export type PaymentSettlementReader = (digest: string) => Promise<FinalPayment | undefined>;
+export interface PaymentChallenge {
+    status: 402;
+    requestId: string;
+    nonce: string;
+    requirements: ExactRequirements;
+}
+export declare function verifySuiPaymentBinding(binding: PaymentBinding): Promise<boolean>;
+export declare class ExactResourceServer {
+    private readonly ledger;
+    private readonly requirements;
+    private readonly verifyPayer;
+    private readonly readSettlement;
+    constructor(ledger: PaymentConsumptionLedger, requirements: ExactRequirements, verifyPayer: PayerSignatureVerifier, readSettlement: PaymentSettlementReader);
+    challenge(requestId: string): PaymentChallenge;
+    deliver(requestId: string, submission: PaymentSubmission, produce: () => Promise<Uint8Array>): Promise<Buffer>;
+}

package/dist/resource.js

@@ -0,0 +1,55 @@
+import { randomBytes } from "node:crypto";
+import { isValidPersonalMessageSignature } from "@mysten/sui/verify";
+import { fail } from "./errors.js";
+import { requirementsHash, verifyBinding, verifyExactPayment } from "./x402.js";
+import { paymentBindingBytes } from "./x402.js";
+export async function verifySuiPaymentBinding(binding) {
+    const { payerSignature: _signature, ...unsigned } = binding;
+    return isValidPersonalMessageSignature(paymentBindingBytes(unsigned), binding.payerSignature, { address: binding.payer });
+}
+export class ExactResourceServer {
+    ledger;
+    requirements;
+    verifyPayer;
+    readSettlement;
+    constructor(ledger, requirements, verifyPayer, readSettlement) {
+        this.ledger = ledger;
+        this.requirements = requirements;
+        this.verifyPayer = verifyPayer;
+        this.readSettlement = readSettlement;
+    }
+    challenge(requestId) {
+        const nonce = this.ledger.challenge(requestId, requirementsHash(this.requirements), () => randomBytes(24).toString("hex"));
+        return { status: 402, requestId, nonce, requirements: structuredClone(this.requirements) };
+    }
+    async deliver(requestId, submission, produce) {
+        const stored = this.ledger.getChallenge(requestId, requirementsHash(this.requirements)) ?? fail("X402_CHALLENGE_MISSING", "request has no active payment challenge");
+        const challenge = { requestId, nonce: stored.nonce, requirements: this.requirements };
+        verifyBinding(submission.binding, requestId, challenge.nonce, challenge.requirements, submission.binding.transactionDigest);
+        if (!(await this.verifyPayer(submission.binding, challenge.requirements)))
+            fail("X402_PAYER_SIGNATURE_INVALID", "payer did not authorize this request binding");
+        if (!submission.binding.payer)
+            fail("X402_PAYER_SIGNATURE_INVALID", "payment binding has no payer identity");
+        const cached = this.ledger.getDelivery(requestId);
+        if (this.ledger.isDeliveryComplete(requestId))
+            return cached ?? fail("DELIVERY_STATE_INVALID", "completed delivery has no persisted response");
+        if (Date.now() > stored.createdAt + this.requirements.maxTimeoutSeconds * 1_000)
+            fail("X402_CHALLENGE_EXPIRED", "payment challenge has expired");
+        const payment = await this.readSettlement(submission.binding.transactionDigest) ?? fail("PAYMENT_NOT_FOUND", "payment transaction was not found");
+        if (payment.digest !== submission.binding.transactionDigest)
+            fail("PAYMENT_DIGEST_MISMATCH", "settlement reader returned another transaction");
+        verifyExactPayment(payment, challenge.requirements);
+        this.ledger.claim(payment, requestId);
+        if (!this.ledger.acquireDelivery(requestId))
+            fail("DELIVERY_IN_PROGRESS", "resource delivery is already being produced");
+        try {
+            const response = Buffer.from(await produce());
+            this.ledger.completeDelivery(requestId, response);
+            return response;
+        }
+        catch (error) {
+            this.ledger.releaseDelivery(requestId);
+            throw error;
+        }
+    }
+}

package/dist/seam.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/seam.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import { Phase3App, errorOutput, homePath, initialize } from "./phase3.js";
+import { DealJournal } from "./deal.js";
+import { createConfiguredDealEngine } from "./deal-adapter.js";
+import { loadMandate } from "./mandate.js";
+import { LiveDealPorts } from "./live-deal-ports.js";
+import { createRequire } from "node:module";
+const PROTOCOL = 1;
+const PACKAGE_VERSION = createRequire(import.meta.url)("../package.json").version;
+const envelope = (requestId, value) => ({ protocol: PROTOCOL, requestId, ...value });
+let responded = false;
+const write = (value, status = 0) => { if (responded)
+    return; responded = true; process.stdout.write(`${JSON.stringify(value)}\n`); process.exitCode = status; };
+const asArgs = (value) => {
+    const result = {};
+    for (const [key, item] of Object.entries(value ?? {})) {
+        if (typeof item === "boolean" || typeof item === "string")
+            result[key] = item;
+        else if (typeof item === "number" && Number.isSafeInteger(item))
+            result[key] = String(item);
+        else if (item !== undefined)
+            result[key] = Buffer.from(JSON.stringify(item)).toString("base64url");
+    }
+    return result;
+};
+let raw = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { raw += chunk; if (raw.length > 1024 * 1024)
+    write(envelope(null, { ok: false, error: { code: "SEAM_REQUEST_TOO_LARGE", message: "request exceeds 1 MiB; reduce the input", retryable: false } }), 1); });
+process.stdin.on("error", () => write(envelope(null, { ok: false, error: { code: "SEAM_REQUEST_INVALID", message: "request stream failed", retryable: false } }), 1));
+process.stdin.on("end", async () => {
+    if (responded)
+        return;
+    let request;
+    try {
+        request = JSON.parse(raw);
+    }
+    catch {
+        return write(envelope(null, { ok: false, error: { code: "SEAM_REQUEST_INVALID", message: "request is not valid JSON", retryable: false } }), 1);
+    }
+    if (!request || request.protocol !== PROTOCOL || typeof request.requestId !== "string" || !request.requestId || request.requestId.length > 256 || typeof request.method !== "string" || !request.method || request.method.length > 128)
+        return write(envelope(typeof request?.requestId === "string" ? request.requestId : null, { ok: false, error: { code: "SEAM_PROTOCOL_MISMATCH", message: `supercuts seam protocol ${PROTOCOL} and a bounded request identity and method are required`, retryable: false } }), 1);
+    try {
+        if (request.method === "version")
+            return write(envelope(request.requestId, { ok: true, result: { protocol: PROTOCOL, packageVersion: PACKAGE_VERSION } }));
+        if (typeof request.home !== "string" || !request.home)
+            return write(envelope(request.requestId, { ok: false, error: { code: "SEAM_HOME_REQUIRED", message: "an explicit role home is required", retryable: false } }), 1);
+        if (request.params !== undefined && (!request.params || typeof request.params !== "object" || Array.isArray(request.params)))
+            return write(envelope(request.requestId, { ok: false, error: { code: "SEAM_REQUEST_INVALID", message: "params must be an object", retryable: false } }), 1);
+        const params = asArgs(request.params), home = homePath({ home: request.home ?? "" });
+        if (request.method === "initialize") {
+            const result = initialize(home, { ...params, role: String(request.params?.role ?? "") });
+            return write(envelope(request.requestId, { ok: true, result: result.data }));
+        }
+        const app = new Phase3App(home);
+        try {
+            if (request.method.startsWith("deal.")) {
+                if (app.profile.role !== "buyer")
+                    throw Object.assign(new Error("deal methods require a buyer role home"), { code: "ROLE_FORBIDDEN" });
+                const journal = new DealJournal(app.store);
+                if (request.method === "deal.catalog") {
+                    const mandate = loadMandate(home);
+                    const entries = await new LiveDealPorts(app, mandate).catalog();
+                    return write(envelope(request.requestId, { ok: true, result: { capabilities: entries.map(({ origin, registration }) => ({ origin, manifest: registration.manifest, manifestBlobId: registration.manifestBlobId })) } }));
+                }
+                if (request.method === "deal.policy") {
+                    const mandate = loadMandate(home), hasTable = Boolean(app.store.db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='mandate_operations'").get());
+                    const reserved = hasTable ? app.store.db.prepare("SELECT amount FROM mandate_operations").all().reduce((sum, row) => sum + BigInt(row.amount), 0n) : 0n;
+                    return write(envelope(request.requestId, { ok: true, result: { perDealCeiling: mandate.perDealCeiling, totalBudget: mandate.totalRunBudget, remainingBudget: (BigInt(mandate.totalRunBudget) - reserved).toString(), expiresAt: mandate.expiresAt, defaultRail: "shielded", allowPublicX402: mandate.allowPublicX402 === true, allowedAssets: mandate.allowedAssets, allowedCapabilityIds: mandate.allowedCapabilityIds, allowedCapabilityClasses: mandate.allowedCapabilityClasses } }));
+                }
+                if (request.method === "deal.execute") {
+                    const engine = await createConfiguredDealEngine(app);
+                    return write(envelope(request.requestId, { ok: true, result: await engine.execute(request.params?.input) }));
+                }
+                if (request.method === "deal.resume") {
+                    const engine = await createConfiguredDealEngine(app);
+                    return write(envelope(request.requestId, { ok: true, result: await engine.resume(String(request.params?.operationId ?? "")) }));
+                }
+                if (request.method === "deal.reconcile") {
+                    if (!loadMandate(home).allowedCommands.includes("deal.resume"))
+                        throw Object.assign(new Error("deal reconciliation requires owner deal authority"), { code: "MANDATE_COMMAND_FORBIDDEN" });
+                    return write(envelope(request.requestId, { ok: true, result: await app.reconcileDealOutcome(String(request.params?.operationId ?? "")) }));
+                }
+                if (request.method === "deal.get")
+                    return write(envelope(request.requestId, { ok: true, result: journal.get(String(request.params?.operationId ?? "")) }));
+                if (request.method === "deal.evidence")
+                    return write(envelope(request.requestId, { ok: true, result: journal.evidence(String(request.params?.dealId ?? "")) }));
+                if (request.method === "deal.delivery") {
+                    const delivery = journal.delivery(String(request.params?.dealId ?? ""));
+                    return write(envelope(request.requestId, { ok: true, result: { ...delivery, artifact: Buffer.from(delivery.artifact).toString("base64") } }));
+                }
+            }
+            if (request.method === "authorization.preview") {
+                const command = String(request.params?.command ?? ""), commandArgs = asArgs(request.params?.arguments);
+                return write(envelope(request.requestId, { ok: true, result: app.preview(command, commandArgs) }));
+            }
+            if (request.method === "authorization.approve")
+                return write(envelope(request.requestId, { ok: true, result: app.approve(String(request.params?.challengeId ?? "")) }));
+            if (request.method === "command.execute") {
+                const command = String(request.params?.command ?? ""), commandArgs = asArgs(request.params?.arguments);
+                if (typeof request.params?.approvalToken === "string")
+                    commandArgs["approval-token"] = request.params.approvalToken;
+                const result = await app.execute(command, commandArgs);
+                return write(envelope(request.requestId, { ok: true, result: result.data }));
+            }
+            return write(envelope(request.requestId, { ok: false, error: { code: "SEAM_METHOD_UNKNOWN", message: `unknown seam method ${request.method}`, retryable: false } }), 1);
+        }
+        finally {
+            app.close();
+        }
+    }
+    catch (error) {
+        const shaped = errorOutput(error);
+        const code = String(shaped.error.code ?? "INTERNAL_ERROR");
+        return write(envelope(request.requestId, { ok: false, error: { ...shaped.error, retryable: ["DELIVERY_IN_PROGRESS", "MEMORY_JOB_PENDING", "TATUM_TIMEOUT"].includes(code) } }), 1);
+    }
+});

package/dist/seller-catalog-generate.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/seller-catalog-generate.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { createCapabilityManifest } from "./capability.js";
+import { fail } from "./errors.js";
+import { parseArgs } from "./phase3.js";
+const args = parseArgs(process.argv.slice(2));
+const required = (name) => typeof args[name] === "string" ? args[name] : fail("ARGUMENT_REQUIRED", `--${name} is required`);
+const report = (name) => {
+    const path = resolve(required(name));
+    if ((statSync(path).mode & 0o077) !== 0)
+        fail("ARTIFACT_PERMISSIONS", `${name} report must be owner-only`);
+    const body = readFileSync(path);
+    if (!body.length || body.length > 10 * 1024 * 1024)
+        fail("ARTIFACT_INVALID", `${name} report size is invalid`);
+    let data;
+    try {
+        data = JSON.parse(body.toString());
+    }
+    catch (error) {
+        return fail("ARTIFACT_INVALID", `${name} report must be JSON`, error);
+    }
+    return { path, body, data, hash: createHash("sha256").update(body).digest("hex") };
+};
+const price = (name) => { const value = required(name); if (!/^[1-9][0-9]*$/.test(value))
+    fail("PRICE_INVALID", `${name} must be positive MIST`); return value; };
+try {
+    const run = JSON.parse(readFileSync(resolve(required("run-json")), "utf8"));
+    const origin = new URL(required("seller-url"));
+    if (origin.protocol !== "https:" && !(origin.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(origin.hostname)))
+        fail("SELLER_ORIGIN_INVALID", "seller URL must use HTTPS except on loopback");
+    const briefA = report("brief-a"), briefB = report("brief-b"), analysisA = report("analysis-a"), analysisB = report("analysis-b");
+    for (const item of [briefA, briefB, analysisA, analysisB])
+        if (item.data.reviewStatus !== "approved")
+            fail("ARTIFACT_REVIEW_REQUIRED", `${item.path} must be owner-reviewed before live provisioning`);
+    for (const brief of [briefA, briefB]) {
+        if (typeof brief.data.title !== "string" || typeof brief.data.body !== "string" || !Array.isArray(brief.data.citations) || brief.data.citations.length < 2 || typeof brief.data.preview !== "object")
+            fail("BRIEF_INVALID", "brief reports need title, body, two citations, and preview metadata");
+        for (const key of ["relevance", "sourceQuality"])
+            if (typeof brief.data.preview[key] !== "number" || brief.data.preview[key] < 0 || brief.data.preview[key] > 1)
+                fail("BRIEF_INVALID", `preview ${key} must be in [0,1]`);
+        if (!Number.isFinite(brief.data.preview.freshnessDays) || brief.data.preview.freshnessDays < 0 || brief.data.preview.freshnessDays > 365)
+            fail("BRIEF_INVALID", "preview freshnessDays is invalid");
+    }
+    for (const analysis of [analysisA, analysisB])
+        if (typeof analysis.data.title !== "string" || typeof analysis.data.body !== "string")
+            fail("ANALYSIS_INVALID", "analysis reports need a title and body");
+    const expiresAt = Date.now() + 7 * 24 * 60 * 60 * 1000;
+    const capability = (id, sellerId, description, rails, amount) => createCapabilityManifest({ capabilityId: id, sellerId, capability: id === "competitor-analysis" ? "sui.competitor-analysis" : "sui.market-brief", description, inputSchema: { type: "object", properties: { topic: { type: "string" } } }, outputSchema: { type: "object", properties: { title: { type: "string" }, body: { type: "string" }, citations: { type: "array" } } }, supportedRails: rails, priceBand: { minimum: amount, maximum: amount }, asset: "0x2::sui::SUI", endpoint: new URL(`/resource/${id}`, origin).toString(), expiresAt });
+    const publicA = run.addresses.publicSeller ?? fail("SELLER_CONFIG_INVALID", "first brief seller is missing"), publicB = run.addresses.secondPublicSeller ?? fail("SELLER_CONFIG_INVALID", "second brief seller is missing"), analysisSeller = run.addresses.confidentialSeller ?? fail("SELLER_CONFIG_INVALID", "analysis seller is missing");
+    const manifestA = capability("market-brief-a", publicA, String(briefA.data.title), ["x402"], price("brief-a-price"));
+    const manifestB = capability("market-brief-b", publicB, String(briefB.data.title), ["x402"], price("brief-b-price"));
+    const manifestAnalysis = capability("competitor-analysis", analysisSeller, String(analysisA.data.title), ["x402", "shielded"], price("analysis-price"));
+    const config = { sellers: [
+            { sellerId: run.addresses.publicSeller, home: run.homes.publicSeller, capabilities: [{ manifest: manifestA, preview: { title: briefA.data.title, summary: briefA.data.preview.summary, citations: briefA.data.citations, relevance: briefA.data.preview.relevance, sourceQuality: briefA.data.preview.sourceQuality, freshnessDays: briefA.data.preview.freshnessDays }, artifact: briefA.path }] },
+            { sellerId: run.addresses.secondPublicSeller, home: run.homes.secondPublicSeller, capabilities: [{ manifest: manifestB, preview: { title: briefB.data.title, summary: briefB.data.preview.summary, citations: briefB.data.citations, relevance: briefB.data.preview.relevance, sourceQuality: briefB.data.preview.sourceQuality, freshnessDays: briefB.data.preview.freshnessDays }, artifact: briefB.path }] },
+            { sellerId: run.addresses.confidentialSeller, home: run.homes.confidentialSeller, capabilities: [{ manifest: manifestAnalysis, preview: { title: analysisA.data.title, summary: "Prepared competitor analysis matched to the purchased brief" }, variants: { [briefA.hash]: analysisA.path, [briefB.hash]: analysisB.path } }] },
+        ] };
+    const output = resolve(required("output")), workflow = resolve(required("workflow-output"));
+    writeFileSync(output, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    writeFileSync(workflow, `${JSON.stringify({ capabilities: [manifestA, manifestB, manifestAnalysis] }, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    process.stdout.write(`${JSON.stringify({ config: output, workflow, briefHashes: [briefA.hash, briefB.hash], capabilityIds: [manifestA.capabilityId, manifestB.capabilityId, manifestAnalysis.capabilityId] })}\n`);
+}
+catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : "catalog generation failed"}\n`);
+    process.exitCode = 1;
+}

package/dist/seller-database.d.ts

@@ -0,0 +1,41 @@
+import type { EncryptedSellerSnapshot } from "./seller-state.js";
+import type { SignedCapabilityRegistration } from "./capability.js";
+/** Server-only PostgREST access. The service-role key must never reach a buyer tool. */
+export declare class SellerDatabase {
+    private readonly origin;
+    private readonly serviceKey;
+    private readonly http;
+    constructor(origin: string, serviceKey: string, http?: typeof fetch);
+    private request;
+    getSnapshot(sellerId: string): Promise<{
+        payload: EncryptedSellerSnapshot;
+        revision: number;
+    } | undefined>;
+    putSnapshot(snapshot: EncryptedSellerSnapshot, expectedRevision?: number): Promise<number>;
+    listCatalog(): Promise<Array<Record<string, unknown>>>;
+    listDirectory(now?: number, offset?: number): Promise<SignedCapabilityRegistration[]>;
+    putDirectory(registration: SignedCapabilityRegistration): Promise<void>;
+    putCatalog(row: {
+        seller_id: string;
+        capability_id: string;
+        manifest: unknown;
+        blob_id: string;
+        signature: string;
+        transport_public_key: string;
+        preview: unknown;
+    }): Promise<void>;
+    addEvent(row: {
+        run_id: string;
+        seller_id: string;
+        stage: string;
+        status: string;
+        details: Record<string, unknown>;
+    }): Promise<void>;
+    listEvents(runId: string): Promise<Array<Record<string, unknown>>>;
+    listPaymentClaims(): Promise<Array<{
+        digest: string;
+        request_id: string;
+        seller_id: string;
+    }>>;
+    claimPayment(digest: string, requestId: string, sellerId: string): Promise<void>;
+}