@tollxyz/guard 0.4.0 → 0.5.0

package/dist/budget.d.ts

@@ -0,0 +1,96 @@
+import type { SpendPolicy } from "./policy.js";
+/** The budget's EIP-712 domain: no verifyingContract (nothing on chain checks it). */
+export declare const BUDGET_DOMAIN: {
+    readonly name: "Toll Facilitator Budget";
+    readonly version: "1";
+    readonly chainId: 4663;
+};
+export declare const BUDGET_TYPES: {
+    readonly Budget: readonly [{
+        readonly name: "payer";
+        readonly type: "address";
+    }, {
+        readonly name: "perPayment";
+        readonly type: "uint256";
+    }, {
+        readonly name: "perDay";
+        readonly type: "uint256";
+    }, {
+        readonly name: "perPayTo";
+        readonly type: "uint256";
+    }, {
+        readonly name: "payToCaps";
+        readonly type: "PayToCap[]";
+    }, {
+        readonly name: "allowedPayTos";
+        readonly type: "address[]";
+    }, {
+        readonly name: "validUntil";
+        readonly type: "uint64";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }];
+    readonly PayToCap: readonly [{
+        readonly name: "payTo";
+        readonly type: "address";
+    }, {
+        readonly name: "perDay";
+        readonly type: "uint256";
+    }];
+};
+/** at most this many payToCaps and allowedPayTos */
+export declare const BUDGET_MAX_PAYTOS = 50;
+export interface GuardBudgetOptions {
+    /** the agent's paying wallet (it signs the budget) */
+    payer: string;
+    /** newer wins at the facilitator: use a growing number, e.g. BigInt(Date.now()) */
+    nonce: bigint | number | string;
+    /** unix seconds the budget ends; 0 or unset = no end */
+    validUntil?: bigint | number | string;
+    /** the payTo of each perEndpoint prefix (same keys); a perEndpoint key that is itself an address is its own payTo */
+    endpointPayTo?: Record<string, string>;
+    /** one day cap for every payTo, base units; 0 or unset = not set */
+    perPayTo?: bigint;
+    /** perPayment when the policy has no assets[USDG].perCall (the facilitator needs one: 0 lets nothing through) */
+    perPayment?: bigint;
+    /** perDay when the policy has no assets[USDG].perDay */
+    perDay?: bigint;
+}
+export interface GuardBudgetMessage {
+    payer: string;
+    perPayment: bigint;
+    perDay: bigint;
+    perPayTo: bigint;
+    payToCaps: Array<{
+        payTo: string;
+        perDay: bigint;
+    }>;
+    allowedPayTos: string[];
+    validUntil: bigint;
+    nonce: bigint;
+}
+export interface GuardBudget {
+    /** the budget (the typed message), for @tollxyz/sdk's setBudget({ budget, signature }) */
+    budget: GuardBudgetMessage;
+    /** EIP-712 typed data for the payer to sign (viem: account.signTypedData(typedData)) */
+    typedData: {
+        domain: {
+            name: string;
+            version: string;
+            chainId: number;
+        };
+        types: typeof BUDGET_TYPES;
+        primaryType: "Budget";
+        message: GuardBudgetMessage;
+    };
+    /** guard rules the facilitator budget cannot hold (guard still enforces them in-process) */
+    notMirrored: string[];
+}
+/**
+ * The facilitator budget that mirrors a guard SpendPolicy. Throws when the policy has no USDG per-call or per-day cap
+ * and none is passed (the facilitator treats a missing cap as 0, which refuses every payment), or when a list is over 50.
+ */
+export declare function guardBudget(policy: SpendPolicy | {
+    spend?: SpendPolicy;
+}, opts: GuardBudgetOptions): GuardBudget;

package/dist/budget.js

@@ -0,0 +1,110 @@
+/**
+ * Mirror guard's spend caps into a per-payer budget at Toll's x402 facilitator (x402.t0ll.xyz/budget, COMING: the
+ * facilitator answers 404 budgets_off until budgets are switched on). guard enforces caps in the agent's process; the
+ * facilitator budget enforces them again where the payment settles, so a second process, a leaked key used elsewhere or
+ * a bug in the agent cannot spend past them through that facilitator.
+ *
+ * The words match: guard's assets[USDG].perCall is the budget's perPayment, assets[USDG].perDay its perDay, perEndpoint
+ * day caps become payToCaps (the facilitator sees a payTo, not a URL, so each endpoint needs its payTo) and allow.payTo
+ * becomes allowedPayTos. Nothing here changes how guard itself behaves. Amounts are USDG base units (6 decimals).
+ */
+import { isAddress } from "./check.js";
+import { USDG } from "./spend.js";
+/** The budget's EIP-712 domain: no verifyingContract (nothing on chain checks it). */
+export const BUDGET_DOMAIN = { name: "Toll Facilitator Budget", version: "1", chainId: 4663 };
+export const BUDGET_TYPES = {
+    Budget: [
+        { name: "payer", type: "address" },
+        { name: "perPayment", type: "uint256" },
+        { name: "perDay", type: "uint256" },
+        { name: "perPayTo", type: "uint256" },
+        { name: "payToCaps", type: "PayToCap[]" },
+        { name: "allowedPayTos", type: "address[]" },
+        { name: "validUntil", type: "uint64" },
+        { name: "nonce", type: "uint256" },
+    ],
+    PayToCap: [
+        { name: "payTo", type: "address" },
+        { name: "perDay", type: "uint256" },
+    ],
+};
+/** at most this many payToCaps and allowedPayTos */
+export const BUDGET_MAX_PAYTOS = 50;
+const MAX_U64 = (1n << 64n) - 1n;
+function uint(v, name, max = (1n << 256n) - 1n) {
+    let n = null;
+    if (typeof v === "bigint")
+        n = v;
+    else if (typeof v === "number" && Number.isSafeInteger(v))
+        n = BigInt(v);
+    else if (typeof v === "string" && /^\d{1,78}$/.test(v.trim()))
+        n = BigInt(v.trim());
+    if (n === null || n < 0n || n > max)
+        throw new Error(`guardBudget: ${name} must be a whole number from 0`);
+    return n;
+}
+/**
+ * The facilitator budget that mirrors a guard SpendPolicy. Throws when the policy has no USDG per-call or per-day cap
+ * and none is passed (the facilitator treats a missing cap as 0, which refuses every payment), or when a list is over 50.
+ */
+export function guardBudget(policy, opts) {
+    const sp = (policy && "spend" in policy ? policy.spend : policy) ?? {};
+    if (!isAddress(opts.payer))
+        throw new Error("guardBudget: payer must be a 0x address");
+    const notMirrored = [];
+    const assets = sp.assets ?? {};
+    const usdgKey = Object.keys(assets).find((k) => k.toLowerCase() === USDG);
+    const caps = usdgKey ? assets[usdgKey] : undefined;
+    for (const k of Object.keys(assets))
+        if (k !== usdgKey)
+            notMirrored.push(`assets["${k}"]: the facilitator budget is USDG only`);
+    const perPayment = opts.perPayment ?? caps?.perCall;
+    const perDay = opts.perDay ?? caps?.perDay;
+    if (perPayment === undefined)
+        throw new Error("guardBudget: no USDG per-call cap (set spend.assets[USDG].perCall or pass perPayment)");
+    if (perDay === undefined)
+        throw new Error("guardBudget: no USDG per-day cap (set spend.assets[USDG].perDay or pass perDay)");
+    const byPayTo = new Map();
+    for (const [prefix, c] of Object.entries(sp.perEndpoint ?? {})) {
+        const payTo = opts.endpointPayTo?.[prefix] ?? (isAddress(prefix) ? prefix : undefined);
+        if (c.perCall !== undefined)
+            notMirrored.push(`perEndpoint["${prefix}"].perCall: the facilitator has no per-payTo per-payment cap (perPayment applies)`);
+        if (c.perDay === undefined)
+            continue;
+        if (!payTo) {
+            notMirrored.push(`perEndpoint["${prefix}"].perDay: no payTo known for it (pass endpointPayTo)`);
+            continue;
+        }
+        if (!isAddress(payTo))
+            throw new Error(`guardBudget: endpointPayTo["${prefix}"] must be a 0x address`);
+        const had = byPayTo.get(payTo.toLowerCase());
+        // two endpoints paying one wallet: the stricter day cap holds for both
+        if (!had || c.perDay < had.perDay)
+            byPayTo.set(payTo.toLowerCase(), { payTo, perDay: uint(c.perDay, `perEndpoint["${prefix}"].perDay`) });
+    }
+    const payToCaps = [...byPayTo.values()];
+    const allowed = [];
+    for (const a of sp.allow?.payTo ?? []) {
+        if (!isAddress(a))
+            throw new Error(`guardBudget: allow.payTo entry "${a}" is not an address`);
+        if (!allowed.some((x) => x.toLowerCase() === a.toLowerCase()))
+            allowed.push(a);
+    }
+    if (payToCaps.length > BUDGET_MAX_PAYTOS || allowed.length > BUDGET_MAX_PAYTOS)
+        throw new Error(`guardBudget: at most ${BUDGET_MAX_PAYTOS} payToCaps and allowed payTos`);
+    if (sp.allow?.to?.length || sp.allow?.spender?.length)
+        notMirrored.push("allow.to / allow.spender: the facilitator only sees x402 payments (payTo)");
+    if (sp.approveAbove || sp.approve)
+        notMirrored.push("approveAbove / approve: human approval stays in guard");
+    const budget = {
+        payer: opts.payer,
+        perPayment: uint(perPayment, "perPayment"),
+        perDay: uint(perDay, "perDay"),
+        perPayTo: uint(opts.perPayTo ?? 0n, "perPayTo"),
+        payToCaps,
+        allowedPayTos: allowed,
+        validUntil: uint(opts.validUntil ?? 0, "validUntil", MAX_U64),
+        nonce: uint(opts.nonce, "nonce"),
+    };
+    return { budget, typedData: { domain: { ...BUDGET_DOMAIN }, types: BUDGET_TYPES, primaryType: "Budget", message: budget }, notMirrored };
+}

package/dist/check.d.ts

@@ -2,6 +2,7 @@
  * The one call to Toll: POST https://t0ll.xyz/api/tx/check. Every check runs on Toll's server, so a new check reaches
  * every agent without a package update. This file only sends the request and reads the answer.
  */
+import { type TicketAsk } from "./ticket.js";
 export declare const DEFAULT_BASE_URL = "https://t0ll.xyz";
 /** Robinhood Chain: the only chain the pre-sign check reads for now */
 export declare const TX_CHAIN_ID = 4663;
@@ -117,6 +118,11 @@ export interface CheckOptions {
     maxRetryWaitMs?: number;
     /** for tests */
     sleep?: (ms: number) => Promise<void>;
+    /**
+     * 0.4.1: ask Toll for a single-use ALLOW ticket for this exact call (`true`, or {consumer?, scope?}). It comes back
+     * in x-toll.ticket (and on the GuardReport): signed, or with why none was issued. A BLOCK is never signed.
+     */
+    ticket?: boolean | TicketAsk;
 }
 export declare class TollBlockedError extends Error {
     readonly assessment: RiskAssessment;

package/dist/check.js

@@ -2,6 +2,7 @@
  * The one call to Toll: POST https://t0ll.xyz/api/tx/check. Every check runs on Toll's server, so a new check reaches
  * every agent without a package update. This file only sends the request and reads the answer.
  */
+import { ticketAskOf } from "./ticket.js";
 export const DEFAULT_BASE_URL = "https://t0ll.xyz";
 /** Robinhood Chain: the only chain the pre-sign check reads for now */
 export const TX_CHAIN_ID = 4663;
@@ -183,7 +184,8 @@ export async function checkTx(input, opts = {}) {
     const base = trimBase(opts.baseUrl ?? DEFAULT_BASE_URL);
     const url = `${base}/api/tx/check`;
     const paid = `${base}${PAID_TX_PATH}`;
-    const body = toJson(bodyOf(input));
+    const ask = ticketAskOf(opts.ticket);
+    const body = toJson(ask ? { ...bodyOf(input), ticket: ask } : bodyOf(input));
     const first = await once(url, body, opts, f, paid);
     if (first.retryS === null || opts.retry === false)
         return first.a;

package/dist/index.d.ts

@@ -12,3 +12,7 @@ export { spendOf, NATIVE, USDG, WETH, DEFAULT_SPEND_ASSETS, UNLIMITED } from "./
 export type { Spend, SpendItem } from "./spend.js";
 export { MemorySpendStore, dayStart } from "./store.js";
 export type { SpendStore } from "./store.js";
+export { appendTicketSuffix, encodeTicketAndSig, ticketAskOf, ticketOfAnswer, TICKET_SUFFIX_MAGIC, TOLL_ALLOW_SIGNER, ALLOW_DOCS } from "./ticket.js";
+export type { TicketAsk, AllowTicket, TicketResult } from "./ticket.js";
+export { guardBudget, BUDGET_DOMAIN, BUDGET_TYPES, BUDGET_MAX_PAYTOS } from "./budget.js";
+export type { GuardBudget, GuardBudgetOptions, GuardBudgetMessage } from "./budget.js";

package/dist/index.js

@@ -5,3 +5,5 @@ export { guardX402Fetch, readPaymentRequired, readPaymentForms, paymentFormsDiff
 export { read8470, latestFinding8470, decodeGetObservation, decodeLatestFinding, encodeGetObservation, encodeLatestByToken, encodeLatestFinding, FINDING_KINDS, NOT_READ, OBS_REGISTRY, OBS_DETECTOR, OBS_CHAIN_ID, RH_RPC, } from "./erc8470.js";
 export { spendOf, NATIVE, USDG, WETH, DEFAULT_SPEND_ASSETS, UNLIMITED } from "./spend.js";
 export { MemorySpendStore, dayStart } from "./store.js";
+export { appendTicketSuffix, encodeTicketAndSig, ticketAskOf, ticketOfAnswer, TICKET_SUFFIX_MAGIC, TOLL_ALLOW_SIGNER, ALLOW_DOCS } from "./ticket.js";
+export { guardBudget, BUDGET_DOMAIN, BUDGET_TYPES, BUDGET_MAX_PAYTOS } from "./budget.js";

package/dist/policy.d.ts

@@ -1,4 +1,5 @@
 import { TollBlockedError, TollUnavailableError, type CheckInput, type CheckOptions, type RiskAssessment } from "./check.js";
+import { type TicketResult } from "./ticket.js";
 import { type Spend } from "./spend.js";
 import { type SpendStore } from "./store.js";
 export type WarnPolicy = "allow" | "block" | "block-high" | ((assessment: RiskAssessment) => boolean | Promise<boolean>);
@@ -29,6 +30,11 @@ export interface GuardReport {
         approvalRef?: string;
         needsApproval?: boolean;
     };
+    /**
+     * 0.4.1, with the `ticket` option: Toll's single-use ALLOW ticket for this exact call ({ticket, signature, signer}),
+     * or {why} none was issued. Put it on the call with appendTicketSuffix (routers) or pass abi.encode(ticket, signature).
+     */
+    ticket?: TicketResult;
 }
 export type PolicyCode = "not-allowlisted" | "cap-per-call" | "cap-per-day" | "cap-endpoint" | "approval-denied" | "duplicate-payment" | "unknown-spend";
 export interface Caps {

package/dist/policy.js

@@ -1,4 +1,5 @@
 import { TX_CHAIN_ID, TollBlockedError, TollUnavailableError, checkTx, chainIdOf, paidUrlOf, bodyOf, toJson, } from "./check.js";
+import { ticketOfAnswer } from "./ticket.js";
 import { DEFAULT_SPEND_ASSETS, spendOf } from "./spend.js";
 import { MemorySpendStore, dayStart } from "./store.js";
 /** blocked by your own spend rules; a TollBlockedError, so existing catch blocks still see a block */
@@ -155,7 +156,8 @@ async function enforceVerdict(kind, build, o) {
     }
     const paidUrl = paidUrlOf(a);
     const done = async (decision, basis) => {
-        const r = { kind, input, assessment: a, decision, basis, paidUrl };
+        const tk = ticketOfAnswer(a);
+        const r = { kind, input, assessment: a, decision, basis, paidUrl, ...(tk ? { ticket: tk } : {}) };
         await report(o, r);
         return r;
     };

package/dist/ticket.d.ts

@@ -0,0 +1,56 @@
+/**
+ * 0.4.1: Toll's single-use ALLOW ticket. Ask for one with the `ticket` option; Toll signs a compact EIP-712 verdict
+ * bound to one exact call, one account, an optional consumer contract and a 60 second window. A contract built on
+ * toll-allow (https://github.com/t0ll-xyz/toll-allow) accepts the call only with a valid, unused ticket.
+ * A BLOCK is never signed. No ticket without `from`, or for a transaction with an EIP-7702 authorization list.
+ *
+ * appendTicketSuffix MUST match toll-allow's TollAllow.encodeSuffix / splitSuffix byte for byte:
+ *   body ‖ abi.encode((uint8,uint8,address,address,bytes32,uint64,uint64,bytes32,bytes32), bytes) ‖ uint32 len ‖ 0x900bc3e1
+ * where len is the byte length of the abi.encode part and 0x900bc3e1 = bytes4(keccak256("TollAllow.v1")).
+ */
+import type { Hex } from "./check.js";
+/** what to ask Toll for: `true` = scope "call", any consumer */
+export interface TicketAsk {
+    /** the contract that will check the ticket (its `consumer` field); unset = any contract */
+    consumer?: string;
+    /** "call" (default): bound to (target, value, keccak256(data)); "v4swap": bound to the swap a HookrRouter call makes */
+    scope?: "call" | "v4swap";
+}
+/** the ticket as Toll returns it (x-toll.ticket.ticket); uint64 times are unix seconds */
+export interface AllowTicket {
+    scope: number;
+    verdict: number;
+    account: string;
+    consumer: string;
+    subject: string;
+    validAfter: number | bigint | string;
+    validUntil: number | bigint | string;
+    nonce: string;
+    reportHash: string;
+}
+/** x-toll.ticket: a signed ticket, or why none was issued */
+export type TicketResult = {
+    ticket: AllowTicket;
+    signature: Hex;
+    signer: string;
+} | {
+    why: string;
+};
+/** bytes4(keccak256("TollAllow.v1")) */
+export declare const TICKET_SUFFIX_MAGIC = "0x900bc3e1";
+/** Toll's production ALLOW signer on Robinhood Chain (4663): pin it, or a TollSignerSet you control that includes it */
+export declare const TOLL_ALLOW_SIGNER = "0x4A2C93066d94F1E69f3EAd5438c4efDdf80a46ba";
+export declare const ALLOW_DOCS = "https://t0ll.xyz/agents/allow";
+/** the ask as the route reads it (`ticket: {consumer?, scope?}`), or null for none */
+export declare function ticketAskOf(t: boolean | TicketAsk | undefined | null): TicketAsk | null;
+/** the ticket in an answer, when the answer carries one (signed or with its why) */
+export declare function ticketOfAnswer(a: {
+    "x-toll"?: Record<string, unknown>;
+} | null | undefined): TicketResult | undefined;
+/** abi.encode(Ticket, bytes) as hex without 0x: the static tuple inline (9 words), then the offset and the bytes */
+export declare function encodeTicketAndSig(t: AllowTicket, signature: string): string;
+/**
+ * The calldata a ticket-checking router reads: `data ‖ abi.encode(ticket, signature) ‖ uint32 len ‖ 0x900bc3e1`.
+ * The ticket's subject is over `data` (the body) only. Identical to TollAllow.encodeSuffix in toll-allow.
+ */
+export declare function appendTicketSuffix(data: Hex, ticket: AllowTicket, signature: Hex): Hex;

package/dist/ticket.js

@@ -0,0 +1,90 @@
+/** bytes4(keccak256("TollAllow.v1")) */
+export const TICKET_SUFFIX_MAGIC = "0x900bc3e1";
+/** Toll's production ALLOW signer on Robinhood Chain (4663): pin it, or a TollSignerSet you control that includes it */
+export const TOLL_ALLOW_SIGNER = "0x4A2C93066d94F1E69f3EAd5438c4efDdf80a46ba";
+export const ALLOW_DOCS = "https://t0ll.xyz/agents/allow";
+/** the ask as the route reads it (`ticket: {consumer?, scope?}`), or null for none */
+export function ticketAskOf(t) {
+    if (t === undefined || t === null || t === false)
+        return null;
+    if (t === true)
+        return {};
+    const o = {};
+    if (t.consumer !== undefined)
+        o.consumer = t.consumer;
+    if (t.scope !== undefined)
+        o.scope = t.scope;
+    return o;
+}
+/** the ticket in an answer, when the answer carries one (signed or with its why) */
+export function ticketOfAnswer(a) {
+    const t = a?.["x-toll"]?.ticket;
+    if (!t || typeof t !== "object")
+        return undefined;
+    if (typeof t.why === "string")
+        return { why: t.why };
+    if (t.ticket && typeof t.ticket === "object" && typeof t.signature === "string" && typeof t.signer === "string") {
+        return { ticket: t.ticket, signature: t.signature, signer: t.signer };
+    }
+    return undefined;
+}
+/* ------------------------------------------------------------------ ABI encoding (no dependencies) */
+const hexBody = (h, what) => {
+    if (typeof h !== "string" || !/^0x([0-9a-fA-F]{2})*$/.test(h))
+        throw new TypeError(`${what} must be 0x hex with whole bytes`);
+    return h.slice(2).toLowerCase();
+};
+const word = (n, bits, what) => {
+    if (n < 0n || n >= 1n << BigInt(bits))
+        throw new RangeError(`${what} does not fit in uint${bits}`);
+    return n.toString(16).padStart(64, "0");
+};
+const uint = (v, bits, what) => {
+    let n;
+    try {
+        n = BigInt(v);
+    }
+    catch {
+        throw new TypeError(`${what} must be a whole number`);
+    }
+    return word(n, bits, what);
+};
+const addr = (a, what) => {
+    if (typeof a !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(a))
+        throw new TypeError(`${what} must be an address`);
+    return a.slice(2).toLowerCase().padStart(64, "0");
+};
+const b32 = (h, what) => {
+    if (typeof h !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(h))
+        throw new TypeError(`${what} must be 32 bytes`);
+    return h.slice(2).toLowerCase();
+};
+/** abi.encode(Ticket, bytes) as hex without 0x: the static tuple inline (9 words), then the offset and the bytes */
+export function encodeTicketAndSig(t, signature) {
+    const sig = hexBody(signature, "signature");
+    const head = uint(t.scope, 8, "ticket.scope") +
+        uint(t.verdict, 8, "ticket.verdict") +
+        addr(t.account, "ticket.account") +
+        addr(t.consumer, "ticket.consumer") +
+        b32(t.subject, "ticket.subject") +
+        uint(t.validAfter, 64, "ticket.validAfter") +
+        uint(t.validUntil, 64, "ticket.validUntil") +
+        b32(t.nonce, "ticket.nonce") +
+        b32(t.reportHash, "ticket.reportHash");
+    const offset = word(10n * 32n, 256, "offset"); // 9 tuple words + this offset word
+    const len = word(BigInt(sig.length / 2), 256, "signature length");
+    const padded = sig + "0".repeat((64 - (sig.length % 64)) % 64);
+    return head + offset + len + padded;
+}
+/**
+ * The calldata a ticket-checking router reads: `data ‖ abi.encode(ticket, signature) ‖ uint32 len ‖ 0x900bc3e1`.
+ * The ticket's subject is over `data` (the body) only. Identical to TollAllow.encodeSuffix in toll-allow.
+ */
+export function appendTicketSuffix(data, ticket, signature) {
+    const body = hexBody(data, "data");
+    const enc = encodeTicketAndSig(ticket, signature);
+    const n = enc.length / 2;
+    if (n >= 2 ** 32)
+        throw new RangeError("ticket encoding too long");
+    return `0x${body}${enc}${n.toString(16).padStart(8, "0")}${TICKET_SUFFIX_MAGIC.slice(2)}`;
+}

package/package.json

@@ -1,69 +1,70 @@
-{
-  "name": "@tollxyz/guard",
-  "version": "0.4.0",
-  "description": "Toll's live pre-sign check in front of an AI agent's wallet: viem, viem smart-account, ethers and x402 fetch wrappers that ask Toll (ALLOW / WARN / BLOCK, ERC-8265) before anything is signed on Robinhood Chain: transactions, messages, typed data, batches, user operations, EIP-7702 authorizations. Spend caps, allowlists and human approval around the verdict. Zero runtime dependencies.",
-  "license": "MIT",
-  "author": "Toll",
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=20.19"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/t0ll-xyz/toll-plugins.git",
-    "directory": "packages/guard"
-  },
-  "homepage": "https://t0ll.xyz/agents/plugins",
-  "keywords": [
-    "agent-wallet",
-    "transaction-guard",
-    "pre-sign",
-    "x402",
-    "erc-8004",
-    "erc-8470",
-    "erc-8265",
-    "robinhood-chain",
-    "viem",
-    "ethers",
-    "ai-agent",
-    "toll"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "test": "tsc -p tsconfig.json --noEmit && tsx --test tests/*.test.ts",
-    "smoke": "node scripts/smoke.mjs",
-    "prepublishOnly": "npm run build"
-  },
-  "peerDependencies": {
-    "ethers": "^6.0.0",
-    "viem": "^2.0.0"
-  },
-  "peerDependenciesMeta": {
-    "ethers": {
-      "optional": true
-    },
-    "viem": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
-  }
-}
+{
+  "name": "@tollxyz/guard",
+  "version": "0.5.0",
+  "description": "Toll's live pre-sign check in front of an AI agent's wallet: viem, viem smart-account, ethers and x402 fetch wrappers that ask Toll (ALLOW / WARN / BLOCK, ERC-8265) before anything is signed on Robinhood Chain: transactions, messages, typed data, batches, user operations, EIP-7702 authorizations. Spend caps, allowlists and human approval around the verdict; single-use ALLOW tickets for contracts that require one. Zero runtime dependencies.",
+  "license": "MIT",
+  "author": "Toll",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/t0ll-xyz/toll-plugins.git",
+    "directory": "packages/guard"
+  },
+  "homepage": "https://t0ll.xyz/agents/plugins",
+  "keywords": [
+    "agent-wallet",
+    "transaction-guard",
+    "pre-sign",
+    "x402",
+    "erc-8004",
+    "erc-8470",
+    "erc-8265",
+    "allow-ticket",
+    "robinhood-chain",
+    "viem",
+    "ethers",
+    "ai-agent",
+    "toll"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsc -p tsconfig.json --noEmit && tsx --test tests/*.test.ts",
+    "smoke": "node scripts/smoke.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "ethers": "^6.0.0",
+    "viem": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "ethers": {
+      "optional": true
+    },
+    "viem": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  }
+}