@toon-protocol/core 1.4.0 → 1.4.2

package/dist/index.js

@@ -27,12 +27,12 @@ var JOB_REVIEW_KIND = 31117;
 var WEB_OF_TRUST_KIND = 30382;
 var PREFIX_CLAIM_KIND = 10034;
 var PREFIX_GRANT_KIND = 10037;
+var ILP_ROOT_PREFIX = "g.toon";
 var BLOB_STORAGE_REQUEST_KIND = 5094;
 var BLOB_STORAGE_RESULT_KIND = 6094;
 var PET_INTERACTION_REQUEST_KIND = 5900;
 var PET_INTERACTION_RESULT_KIND = 6900;
 var PET_INTERACTION_EVENT_KIND = 14919;
-var ILP_ROOT_PREFIX = "g.toon";
 
 // src/address/ilp-address-validation.ts
 var ILP_SEGMENT_PATTERN = /^[a-z0-9-]+$/;
@@ -277,15 +277,121 @@ function validatePrefix(prefix) {
   return { valid: true };
 }
 
-// src/events/parsers.ts
+// src/chain/chain-id.ts
 function validateChainId(chainId) {
   if (!chainId) return false;
   const segments = chainId.split(":");
   if (segments.length < 2 || segments.length > 3) return false;
   return segments.every((s) => s.length > 0);
 }
+
+// src/events/swap-pair-validation.ts
+var RATE_REGEX = /^(0|[1-9]\d*)(\.\d+)?$/;
+var AMOUNT_REGEX = /^\d+$/;
+var MAX_NUMERIC_STRING_LENGTH = 80;
 function isObject(value) {
-  return typeof value === "object" && value !== null;
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function validateAsset(asset, side) {
+  if (!isObject(asset)) {
+    return {
+      valid: false,
+      reason: `${side} must be an object`,
+      field: side
+    };
+  }
+  if (!isNonEmptyString(asset.assetCode)) {
+    return {
+      valid: false,
+      reason: `${side}.assetCode must be a non-empty string`,
+      field: `${side}.assetCode`
+    };
+  }
+  if (!isNonNegativeInteger(asset.assetScale)) {
+    return {
+      valid: false,
+      reason: `${side}.assetScale must be a non-negative integer`,
+      field: `${side}.assetScale`
+    };
+  }
+  if (typeof asset.chain !== "string" || !validateChainId(asset.chain)) {
+    return {
+      valid: false,
+      reason: `${side}.chain must be a valid chain identifier (e.g., "evm:base:8453")`,
+      field: `${side}.chain`
+    };
+  }
+  return { valid: true };
+}
+function isValidSwapPair(pair) {
+  if (!isObject(pair)) {
+    return { valid: false, reason: "pair must be an object", field: "" };
+  }
+  const fromResult = validateAsset(pair.from, "from");
+  if (!fromResult.valid) return fromResult;
+  const toResult = validateAsset(pair.to, "to");
+  if (!toResult.valid) return toResult;
+  if (typeof pair.rate !== "string" || pair.rate.length > MAX_NUMERIC_STRING_LENGTH || !RATE_REGEX.test(pair.rate)) {
+    return {
+      valid: false,
+      reason: `rate must be a non-negative decimal string (no leading zeros, no exponent, max ${MAX_NUMERIC_STRING_LENGTH} chars)`,
+      field: "rate"
+    };
+  }
+  if (pair.minAmount !== void 0) {
+    if (typeof pair.minAmount !== "string" || pair.minAmount.length > MAX_NUMERIC_STRING_LENGTH || !AMOUNT_REGEX.test(pair.minAmount)) {
+      return {
+        valid: false,
+        reason: `minAmount must be a non-negative integer string (max ${MAX_NUMERIC_STRING_LENGTH} digits)`,
+        field: "minAmount"
+      };
+    }
+  }
+  if (pair.maxAmount !== void 0) {
+    if (typeof pair.maxAmount !== "string" || pair.maxAmount.length > MAX_NUMERIC_STRING_LENGTH || !AMOUNT_REGEX.test(pair.maxAmount)) {
+      return {
+        valid: false,
+        reason: `maxAmount must be a non-negative integer string (max ${MAX_NUMERIC_STRING_LENGTH} digits)`,
+        field: "maxAmount"
+      };
+    }
+  }
+  if (pair.minAmount !== void 0 && pair.maxAmount !== void 0) {
+    if (BigInt(pair.minAmount) > BigInt(pair.maxAmount)) {
+      return {
+        valid: false,
+        reason: "minAmount must not exceed maxAmount",
+        field: "minAmount/maxAmount"
+      };
+    }
+  }
+  return { valid: true };
+}
+function formatMessage(index, result) {
+  return `swapPairs[${index}]: ${result.reason} (field: ${result.field})`;
+}
+function assertSwapPairForBuild(pair, index) {
+  const result = isValidSwapPair(pair);
+  if (!result.valid) {
+    throw new ToonError(formatMessage(index, result), "INVALID_SWAP_PAIR");
+  }
+}
+function assertSwapPairForParse(pair, index) {
+  const result = isValidSwapPair(pair);
+  if (!result.valid) {
+    throw new InvalidEventError(formatMessage(index, result));
+  }
+}
+
+// src/events/parsers.ts
+function isObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseIlpPeerInfo(event) {
   if (event.kind !== ILP_PEER_INFO_KIND) {
@@ -302,7 +408,7 @@ function parseIlpPeerInfo(event) {
       err instanceof Error ? err : void 0
     );
   }
-  if (!isObject(parsed)) {
+  if (!isObject2(parsed)) {
     throw new InvalidEventError("Event content must be a JSON object");
   }
   const {
@@ -319,10 +425,8 @@ function parseIlpPeerInfo(event) {
       "Missing or invalid required field: ilpAddress"
     );
   }
-  if (typeof btpEndpoint !== "string" || btpEndpoint.length === 0) {
-    throw new InvalidEventError(
-      "Missing or invalid required field: btpEndpoint"
-    );
+  if (btpEndpoint !== void 0 && typeof btpEndpoint !== "string") {
+    throw new InvalidEventError("Invalid field: btpEndpoint must be a string");
   }
   if (typeof assetCode !== "string" || assetCode.length === 0) {
     throw new InvalidEventError("Missing or invalid required field: assetCode");
@@ -361,7 +465,7 @@ function parseIlpPeerInfo(event) {
     }
   }
   if (settlementAddresses !== void 0) {
-    if (!isObject(settlementAddresses)) {
+    if (!isObject2(settlementAddresses)) {
       throw new InvalidEventError("settlementAddresses must be an object");
     }
     for (const [key, value] of Object.entries(settlementAddresses)) {
@@ -388,12 +492,12 @@ function parseIlpPeerInfo(event) {
     }
   }
   if (preferredTokens !== void 0) {
-    if (!isObject(preferredTokens)) {
+    if (!isObject2(preferredTokens)) {
       throw new InvalidEventError("preferredTokens must be an object");
     }
   }
   if (tokenNetworks !== void 0) {
-    if (!isObject(tokenNetworks)) {
+    if (!isObject2(tokenNetworks)) {
       throw new InvalidEventError("tokenNetworks must be an object");
     }
   }
@@ -411,7 +515,7 @@ function parseIlpPeerInfo(event) {
   const { prefixPricing: rawPrefixPricing } = parsed;
   let prefixPricing;
   if (rawPrefixPricing !== void 0) {
-    if (!isObject(rawPrefixPricing)) {
+    if (!isObject2(rawPrefixPricing)) {
       throw new InvalidEventError("prefixPricing must be an object");
     }
     const { basePrice } = rawPrefixPricing;
@@ -422,6 +526,17 @@ function parseIlpPeerInfo(event) {
     }
     prefixPricing = { basePrice };
   }
+  const { swapPairs: rawSwapPairs } = parsed;
+  let swapPairs;
+  if (rawSwapPairs !== void 0) {
+    if (!Array.isArray(rawSwapPairs)) {
+      throw new InvalidEventError("swapPairs must be an array");
+    }
+    rawSwapPairs.forEach((pair, index) => {
+      assertSwapPairForParse(pair, index);
+    });
+    swapPairs = rawSwapPairs;
+  }
   let ilpAddresses;
   if (rawIlpAddresses !== void 0) {
     if (!Array.isArray(rawIlpAddresses)) {
@@ -445,7 +560,7 @@ function parseIlpPeerInfo(event) {
   }
   return {
     ilpAddress,
-    btpEndpoint,
+    btpEndpoint: typeof btpEndpoint === "string" ? btpEndpoint : "",
     ...blsHttpEndpoint !== void 0 && typeof blsHttpEndpoint === "string" && { blsHttpEndpoint },
     assetCode,
     assetScale,
@@ -460,13 +575,30 @@ function parseIlpPeerInfo(event) {
     },
     ilpAddresses,
     feePerByte,
-    ...prefixPricing !== void 0 && { prefixPricing }
+    ...prefixPricing !== void 0 && { prefixPricing },
+    ...swapPairs !== void 0 && { swapPairs }
   };
 }
 
 // src/events/builders.ts
 import { finalizeEvent } from "nostr-tools/pure";
-function buildIlpPeerInfoEvent(info, secretKey) {
+
+// src/events/nip40.ts
+var EXPIRATION_TAG = "expiration";
+function getEventExpiration(event) {
+  const tag = event.tags.find((t) => t[0] === EXPIRATION_TAG);
+  if (!tag || tag[1] === void 0) return void 0;
+  const ts = Number(tag[1]);
+  if (!Number.isFinite(ts) || ts < 0) return void 0;
+  return ts;
+}
+function isEventExpired(event, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const exp = getEventExpiration(event);
+  return exp !== void 0 && exp <= nowSeconds;
+}
+
+// src/events/builders.ts
+function buildIlpPeerInfoEvent(info, secretKey, options = {}) {
   if (info.feePerByte !== void 0) {
     if (typeof info.feePerByte !== "string" || !/^\d+$/.test(info.feePerByte)) {
       throw new ToonError(
@@ -498,12 +630,31 @@ function buildIlpPeerInfoEvent(info, secretKey) {
       ilpAddress: primaryAddress
     };
   }
+  if (info.swapPairs !== void 0) {
+    if (!Array.isArray(info.swapPairs)) {
+      throw new ToonError(
+        "swapPairs must be an array when provided",
+        "INVALID_SWAP_PAIR"
+      );
+    }
+    info.swapPairs.forEach((pair, index) => {
+      assertSwapPairForBuild(pair, index);
+    });
+  }
+  const createdAt = Math.floor(Date.now() / 1e3);
+  const tags = [];
+  if (options.ttlSeconds !== void 0 && options.ttlSeconds > 0) {
+    tags.push([
+      EXPIRATION_TAG,
+      String(createdAt + Math.floor(options.ttlSeconds))
+    ]);
+  }
   return finalizeEvent(
     {
       kind: ILP_PEER_INFO_KIND,
       content: JSON.stringify(effectiveInfo),
-      tags: [],
-      created_at: Math.floor(Date.now() / 1e3)
+      tags,
+      created_at: createdAt
     },
     secretKey
   );
@@ -1220,7 +1371,8 @@ function buildWorkflowDefinitionEvent(params, secretKey) {
   };
   const contentJson = JSON.stringify(contentBody);
   const tags = [];
-  const dTag = params.workflowId ?? `wf-${Date.now()}-${params.steps.length}`;
+  const randomSuffix = Math.random().toString(36).slice(2, 8);
+  const dTag = params.workflowId ?? `wf-${Date.now()}-${params.steps.length}-${randomSuffix}`;
   tags.push(["d", dTag]);
   tags.push(["bid", params.totalBid, "usdc"]);
   return finalizeEvent6(
@@ -2486,6 +2638,12 @@ var SeedRelayDiscovery = class {
           );
           continue;
         }
+        if (isEventExpired(event)) {
+          console.warn(
+            `[SeedRelayDiscovery] Skipping expired kind:10032 announcement: ${event.id}`
+          );
+          continue;
+        }
         const info = parseIlpPeerInfo(event);
         info.pubkey = event.pubkey;
         discoveredPeers.push(info);
@@ -2749,6 +2907,152 @@ function resolveTokenForChain(chain, requesterPreferredTokens, responderPreferre
   return void 0;
 }
 
+// src/settlement/hashes.ts
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import {
+  bytesToHex,
+  hexToBytes as nobleHexToBytes
+} from "@noble/hashes/utils.js";
+function hexToBytes(hex) {
+  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (clean.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(clean)) {
+    throw new Error(`Invalid hex string: ${hex}`);
+  }
+  return nobleHexToBytes(clean);
+}
+function bigintToBytes32BE(x) {
+  if (x < 0n) {
+    throw new Error("bigint must be non-negative for balance-proof encoding");
+  }
+  const out = new Uint8Array(32);
+  let v = x;
+  for (let i = 31; i >= 0; i--) {
+    out[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  if (v !== 0n) {
+    throw new Error("bigint exceeds 256 bits");
+  }
+  return out;
+}
+function concatBytes(...parts) {
+  let len = 0;
+  for (const p of parts) len += p.length;
+  const out = new Uint8Array(len);
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+function balanceProofHashEvm(channelIdBytes, cumulativeAmount, nonce, recipientBytes) {
+  return keccak_256(
+    concatBytes(
+      channelIdBytes,
+      bigintToBytes32BE(cumulativeAmount),
+      bigintToBytes32BE(nonce),
+      recipientBytes
+    )
+  );
+}
+function balanceProofHashSolana(channelId, cumulativeAmount, nonce, recipient) {
+  return sha256(
+    concatBytes(
+      new TextEncoder().encode(channelId),
+      bigintToBytes32BE(cumulativeAmount),
+      bigintToBytes32BE(nonce),
+      new TextEncoder().encode(recipient)
+    )
+  );
+}
+function minaHashToField(s) {
+  const digestHex = bytesToHex(sha256(new TextEncoder().encode(s)));
+  return BigInt("0x" + digestHex.slice(0, 60));
+}
+function balanceProofFieldsMina(channelId, cumulativeAmount, nonce, recipient) {
+  return [
+    minaHashToField(channelId),
+    cumulativeAmount,
+    nonce,
+    minaHashToField(recipient)
+  ];
+}
+
+// src/settlement/base58.ts
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function base58Encode(bytes) {
+  let zeros = 0;
+  for (let i = 0; i < bytes.length && bytes[i] === 0; i++) zeros++;
+  let value = 0n;
+  for (const byte of bytes) {
+    value = value * 256n + BigInt(byte);
+  }
+  let result = "";
+  while (value > 0n) {
+    result = BASE58_ALPHABET[Number(value % 58n)] + result;
+    value = value / 58n;
+  }
+  for (let i = 0; i < zeros; i++) {
+    result = "1" + result;
+  }
+  return result || "1";
+}
+function base58Decode(str) {
+  let zeros = 0;
+  for (let i = 0; i < str.length && str[i] === "1"; i++) zeros++;
+  let value = 0n;
+  for (const ch of str) {
+    const idx = BASE58_ALPHABET.indexOf(ch);
+    if (idx === -1) throw new Error(`Invalid base58 character: ${ch}`);
+    value = value * 58n + BigInt(idx);
+  }
+  const hex = value === 0n ? "" : value.toString(16);
+  const hexPadded = hex.length % 2 ? "0" + hex : hex;
+  const rawBytes = [];
+  for (let i = 0; i < hexPadded.length; i += 2) {
+    rawBytes.push(parseInt(hexPadded.slice(i, i + 2), 16));
+  }
+  const result = new Uint8Array(zeros + rawBytes.length);
+  result.set(rawBytes, zeros);
+  return result;
+}
+
+// src/settlement/mina-key.ts
+import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
+var MINA_PRIVATE_KEY_VERSION = 90;
+function hexToMinaBase58PrivateKey(privateKey) {
+  if (!/^(0x)?[0-9a-fA-F]{64}$/.test(privateKey)) {
+    return privateKey;
+  }
+  const beScalar = hexToBytes(privateKey);
+  const leScalar = Uint8Array.from(beScalar).reverse();
+  const payload = concatBytes(
+    Uint8Array.from([MINA_PRIVATE_KEY_VERSION, 1]),
+    leScalar
+  );
+  const checksum = sha2562(sha2562(payload)).slice(0, 4);
+  return base58Encode(concatBytes(payload, checksum));
+}
+async function deriveMinaPublicKeyBase58(privateKey) {
+  let signerModule = null;
+  try {
+    const specifier = "mina-signer";
+    signerModule = await import(
+      /* @vite-ignore */
+      specifier
+    );
+  } catch {
+    return null;
+  }
+  if (!signerModule) return null;
+  const mod = signerModule;
+  const ClientCtor = mod.default ?? mod;
+  const client = new ClientCtor({ network: "mainnet" });
+  return client.derivePublicKey(hexToMinaBase58PrivateKey(privateKey));
+}
+
 // src/bootstrap/BootstrapService.ts
 import { SimplePool as SimplePool3 } from "nostr-tools/pool";
 import { getPublicKey as getPublicKey3 } from "nostr-tools/pure";
@@ -4097,6 +4401,32 @@ var AttestationBootstrap = class {
   }
 };
 
+// src/utils/reject-code.ts
+var ILP_TO_SEMANTIC = Object.freeze({
+  T00: "internal_error",
+  T04: "insufficient_funds",
+  F00: "invalid_request",
+  // F01 ("Invalid Packet" in ILP terms — emitted by the swap handler for
+  // "Invalid gift wrap" / "Invalid amount") has NO dedicated entry in the
+  // connector's REJECT_CODE_MAP (accepted semantics are: insufficient_funds,
+  // expired, unreachable, invalid_request, invalid_amount,
+  // insufficient_destination_amount, unexpected_payment, application_error,
+  // internal_error, timeout). The closest faithful reason is `invalid_request`,
+  // which the connector re-encodes to wire code F00. We map F01 EXPLICITLY
+  // (rather than relying on the fallback below) so the F01 -> F00 normalization
+  // is intentional and test-pinned, not a silent collapse that misleads callers
+  // into thinking they hit a different failure class. See issue #86.
+  F01: "invalid_request",
+  F02: "unreachable",
+  F03: "invalid_amount",
+  F04: "insufficient_destination_amount",
+  F06: "unexpected_payment",
+  R00: "expired"
+});
+function ilpCodeToSemantic(ilpCode) {
+  return ILP_TO_SEMANTIC[ilpCode] ?? "invalid_request";
+}
+
 // src/compose.ts
 function createToonNode(config) {
   const directIlpClient = createDirectIlpClient(config.connector, {
@@ -4156,7 +4486,7 @@ function createToonNode(config) {
             }
             const adapted = result;
             adapted.rejectReason = {
-              code: result.code,
+              code: ilpCodeToSemantic(result.code),
               message: result.message
             };
             return adapted;
@@ -4227,6 +4557,29 @@ var CHAIN_PRESETS = {
     usdcAddress: "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
     tokenNetworkAddress: "",
     registryAddress: ""
+  },
+  // Base Sepolia (public testnet) — TOON's deployed public-testnet settlement
+  // environment (source of truth: e2e/testnets.json). USDC is the deployed test
+  // token the TokenNetwork was opened against (NOT Circle's native testnet USDC,
+  // which the channel would not recognise). Registry + TokenNetwork are live, so
+  // this preset is settlement-complete: `--network testnet|devnet` settles here.
+  "base-sepolia": {
+    name: "base-sepolia",
+    chainId: 84532,
+    rpcUrl: "https://sepolia.base.org",
+    usdcAddress: "0xac80670b86db1eeb5c18c82e18a6bda98fcb4504",
+    tokenNetworkAddress: "0x47616F4b9cF4dA25F74FD727Cd85E9CA0C70Ec5C",
+    registryAddress: "0xb9516c6c53c016c43f3671b1e5eb6096c83ec2c7"
+  },
+  // Base mainnet (public). USDC is Circle's native USDC on Base.
+  // TOON TokenNetwork/registry not deployed yet → settlement relay-only.
+  "base-mainnet": {
+    name: "base-mainnet",
+    chainId: 8453,
+    rpcUrl: "https://mainnet.base.org",
+    usdcAddress: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    tokenNetworkAddress: "",
+    registryAddress: ""
   }
 };
 function resolveChainConfig(chain) {
@@ -4234,8 +4587,9 @@ function resolveChainConfig(chain) {
   const name = envChain || chain || "anvil";
   const preset = CHAIN_PRESETS[name];
   if (!preset) {
+    const validNames = Object.keys(CHAIN_PRESETS).join(", ");
     throw new ToonError(
-      `Unknown chain "${name}". Valid chains: anvil, arbitrum-sepolia, arbitrum-one`,
+      `Unknown chain "${name}". Valid chains: ${validNames}`,
       "INVALID_CHAIN"
     );
   }
@@ -4328,6 +4682,7 @@ function buildEvmProviderEntry(config, keyId) {
     chainId: `evm:${config.chainId}`,
     rpcUrl: config.rpcUrl,
     registryAddress: config.registryAddress,
+    tokenAddress: config.usdcAddress,
     keyId
   };
 }
@@ -4354,6 +4709,251 @@ function buildMinaProviderEntry(config, keyId) {
   };
 }
 
+// src/chain/network-profile.ts
+var DEV_EVM_PRESET = "anvil";
+var DEV_SOLANA = {
+  usdcMint: "6GbdrVghwNKTz9raga7y3Y4qqX5Zgg3AC4d48Kt7C59Q",
+  programId: ""
+  // TOON payment-channel program not deployed on the dev Solana node
+};
+var RELAY_ONLY_CHAIN = "none";
+var EVM_TIER = {
+  mainnet: { primary: "base-mainnet", also: ["arbitrum-one"] },
+  testnet: { primary: "base-sepolia", also: ["arbitrum-sepolia"] },
+  // EVM has no public devnet → the public Sepolia testnets serve the devnet tier.
+  devnet: { primary: "base-sepolia", also: ["arbitrum-sepolia"] }
+};
+var SOLANA_DEPLOYED_DEVNET = {
+  rpcUrl: "https://api.devnet.solana.com",
+  cluster: "devnet",
+  usdcMint: "9FtYCXjNiGDn17jSGvZuB5P4dZAKgVxUsDiQpLc8rbWy",
+  programId: "EdJxYPDxGvaJuu57DSUptf4soLv8enpdyQJJhHDLiydG"
+};
+var SOLANA_TIER = {
+  mainnet: {
+    rpcUrl: "https://api.mainnet-beta.solana.com",
+    cluster: "mainnet-beta",
+    usdcMint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
+    programId: ""
+    // TOON payment-channel program not deployed on mainnet
+  },
+  testnet: SOLANA_DEPLOYED_DEVNET,
+  devnet: SOLANA_DEPLOYED_DEVNET
+};
+var MINA_DEPLOYED_DEVNET = {
+  graphqlUrl: "https://api.minascan.io/node/devnet/v1/graphql",
+  network: "devnet",
+  // Reconciled with e2e/testnets.json (#205): the previous address
+  // (B62qjFgX…) is a bare, unfunded zkApp on-chain (balance 0, channel
+  // nonceField 0) — usable for claim issuance only. This is the funded,
+  // on-chain-settling PaymentChannel zkApp (balance ~4 MINA, nonceField 21
+  // — the on-chain settle proven in #217), same VK hash 21482326…
+  zkAppAddress: "B62qrH1As4odHiNyKpTZMHaM6tRs6gi5DJ53efZKQBtbaR5CUctbDs6"
+};
+var MINA_TIER = {
+  mainnet: {
+    graphqlUrl: "https://api.minascan.io/node/mainnet/v1/graphql",
+    network: "mainnet",
+    zkAppAddress: ""
+    // TOON payment-channel zkApp not deployed on mainnet
+  },
+  testnet: MINA_DEPLOYED_DEVNET,
+  devnet: MINA_DEPLOYED_DEVNET
+};
+function evmSettlementComplete(p) {
+  return p.registryAddress !== "" && p.tokenNetworkAddress !== "";
+}
+function resolveNetworkProfile(network, opts = {}) {
+  if (network === "custom") {
+    return resolveCustom(
+      opts.customProviders ?? [],
+      opts.endpoints ?? {},
+      opts.keyId
+    );
+  }
+  const tier = network;
+  const chainProviders = [];
+  const status = {
+    evm: "unconfigured",
+    solana: "unconfigured",
+    mina: "unconfigured"
+  };
+  const primary = CHAIN_PRESETS[EVM_TIER[tier].primary];
+  const nodeEnv = {
+    EVM_CHAIN: primary.name,
+    EVM_RPC_URL: primary.rpcUrl,
+    EVM_CHAIN_ID: String(primary.chainId),
+    EVM_USDC_ADDRESS: primary.usdcAddress
+  };
+  if (opts.keyId) {
+    for (const name of [EVM_TIER[tier].primary, ...EVM_TIER[tier].also]) {
+      const preset = CHAIN_PRESETS[name];
+      if (evmSettlementComplete(preset)) {
+        chainProviders.push(buildEvmProviderEntry(preset, opts.keyId));
+        status.evm = "configured";
+      }
+    }
+  }
+  const sol = SOLANA_TIER[tier];
+  nodeEnv.SOLANA_RPC_URL = sol.rpcUrl;
+  if (sol.usdcMint) nodeEnv.SOLANA_USDC_MINT = sol.usdcMint;
+  if (opts.keyId && sol.programId) {
+    chainProviders.push(
+      buildSolanaProviderEntry(
+        {
+          name: `solana-${sol.cluster}`,
+          chainType: "solana",
+          rpcUrl: sol.rpcUrl,
+          programId: sol.programId,
+          cluster: sol.cluster,
+          ...sol.usdcMint && { tokenMint: sol.usdcMint }
+        },
+        opts.keyId
+      )
+    );
+    status.solana = "configured";
+  }
+  const mina = MINA_TIER[tier];
+  if (opts.keyId && mina.zkAppAddress) {
+    chainProviders.push(
+      buildMinaProviderEntry(
+        {
+          name: `mina-${mina.network}`,
+          chainType: "mina",
+          graphqlUrl: mina.graphqlUrl,
+          zkAppAddress: mina.zkAppAddress,
+          network: mina.network
+        },
+        opts.keyId
+      )
+    );
+    status.mina = "configured";
+  }
+  return { network, chainProviders, nodeEnv, status };
+}
+function evmClientId(preset) {
+  const family = preset.name.split("-")[0] ?? preset.name;
+  return `evm:${family}:${preset.chainId}`;
+}
+function resolveClientNetwork(network) {
+  const supportedChains = [];
+  const chainRpcUrls = {};
+  const preferredTokens = {};
+  const tokenNetworks = {};
+  const status = {
+    evm: "unconfigured",
+    solana: "unconfigured",
+    mina: "unconfigured"
+  };
+  const evm = CHAIN_PRESETS[EVM_TIER[network].primary];
+  const evmId = evmClientId(evm);
+  supportedChains.push(evmId);
+  chainRpcUrls[evmId] = evm.rpcUrl;
+  if (evm.usdcAddress) preferredTokens[evmId] = evm.usdcAddress;
+  if (evmSettlementComplete(evm)) {
+    tokenNetworks[evmId] = evm.tokenNetworkAddress;
+    status.evm = "configured";
+  }
+  const sol = SOLANA_TIER[network];
+  const solId = `solana:${sol.cluster}`;
+  supportedChains.push(solId);
+  chainRpcUrls[solId] = sol.rpcUrl;
+  if (sol.usdcMint) preferredTokens[solId] = sol.usdcMint;
+  let solanaChannel;
+  if (sol.programId) {
+    solanaChannel = {
+      rpcUrl: sol.rpcUrl,
+      programId: sol.programId,
+      ...sol.usdcMint && { tokenMint: sol.usdcMint }
+    };
+    status.solana = "configured";
+  }
+  const mina = MINA_TIER[network];
+  const minaId = `mina:${mina.network}`;
+  supportedChains.push(minaId);
+  chainRpcUrls[minaId] = mina.graphqlUrl;
+  let minaChannel;
+  if (mina.zkAppAddress) {
+    minaChannel = {
+      graphqlUrl: mina.graphqlUrl,
+      zkAppAddress: mina.zkAppAddress,
+      networkId: mina.network === "mainnet" ? "mainnet" : "devnet"
+    };
+    status.mina = "configured";
+  }
+  return {
+    supportedChains,
+    chainRpcUrls,
+    preferredTokens,
+    tokenNetworks,
+    ...solanaChannel && { solanaChannel },
+    ...minaChannel && { minaChannel },
+    status
+  };
+}
+function resolveCustom(providers, endpoints, keyId) {
+  if (providers.length === 0 && (endpoints.evmUrl || endpoints.solUrl)) {
+    return resolveCustomEndpoints(endpoints, keyId);
+  }
+  const status = {
+    evm: "unconfigured",
+    solana: "unconfigured",
+    mina: "unconfigured"
+  };
+  const nodeEnv = {};
+  const evm = providers.find((p) => p.chainType === "evm");
+  if (evm && evm.chainType === "evm") {
+    nodeEnv.EVM_RPC_URL = evm.rpcUrl;
+    nodeEnv.EVM_CHAIN_ID = evm.chainId.replace(/^evm:/, "");
+    nodeEnv.EVM_USDC_ADDRESS = evm.tokenAddress;
+    nodeEnv.EVM_CHAIN = RELAY_ONLY_CHAIN;
+    if (evm.registryAddress) status.evm = "configured";
+  } else {
+    nodeEnv.EVM_CHAIN = RELAY_ONLY_CHAIN;
+  }
+  const sol = providers.find((p) => p.chainType === "solana");
+  if (sol && sol.chainType === "solana") {
+    nodeEnv.SOLANA_RPC_URL = sol.rpcUrl;
+    if (sol.tokenMint) nodeEnv.SOLANA_USDC_MINT = sol.tokenMint;
+    if (sol.programId) status.solana = "configured";
+  }
+  const mina = providers.find((p) => p.chainType === "mina");
+  if (mina && mina.chainType === "mina" && mina.zkAppAddress) {
+    status.mina = "configured";
+  }
+  return { network: "custom", chainProviders: providers, nodeEnv, status };
+}
+function resolveCustomEndpoints(endpoints, keyId) {
+  const evm = CHAIN_PRESETS[DEV_EVM_PRESET];
+  const status = {
+    evm: "unconfigured",
+    solana: "unconfigured",
+    mina: "unconfigured"
+  };
+  const chainProviders = [];
+  const nodeEnv = {
+    EVM_CHAIN: DEV_EVM_PRESET,
+    EVM_CHAIN_ID: String(evm.chainId),
+    EVM_USDC_ADDRESS: evm.usdcAddress
+  };
+  if (endpoints.evmUrl) {
+    nodeEnv.EVM_RPC_URL = endpoints.evmUrl;
+    status.evm = "configured";
+    if (keyId) {
+      chainProviders.push(
+        buildEvmProviderEntry({ ...evm, rpcUrl: endpoints.evmUrl }, keyId)
+      );
+    }
+  } else {
+    nodeEnv.EVM_CHAIN = RELAY_ONLY_CHAIN;
+  }
+  if (endpoints.solUrl) {
+    nodeEnv.SOLANA_RPC_URL = endpoints.solUrl;
+    nodeEnv.SOLANA_USDC_MINT = DEV_SOLANA.usdcMint;
+  }
+  return { network: "custom", chainProviders, nodeEnv, status };
+}
+
 // src/x402/build-ilp-prepare.ts
 function buildIlpPrepare(params) {
   return {
@@ -4500,8 +5100,8 @@ var NixBuilder = class {
         );
       }
       const imageData = await readFile(imagePath);
-      const sha256 = createHash("sha256").update(imageData).digest("hex");
-      const imageHash = `sha256:${sha256}`;
+      const sha2563 = createHash("sha256").update(imageData).digest("hex");
+      const imageHash = `sha256:${sha2563}`;
       const pcr0 = createHash("sha384").update(imageData).digest("hex");
       const KERNEL_REGION_SIZE = 1024 * 1024;
       const kernelRegion = imageData.subarray(
@@ -4714,9 +5314,11 @@ export {
   BootstrapError,
   BootstrapService,
   CHAIN_PRESETS,
+  EXPIRATION_TAG,
   GenesisPeerLoader,
   ILP_PEER_INFO_KIND,
   ILP_ROOT_PREFIX,
+  ILP_TO_SEMANTIC,
   IMAGE_GENERATION_KIND,
   InvalidEventError,
   JOB_FEEDBACK_KIND,
@@ -4736,6 +5338,7 @@ export {
   PREFIX_GRANT_KIND,
   PcrReproducibilityError,
   PeerDiscoveryError,
+  RELAY_ONLY_CHAIN,
   ReputationScoreCalculator,
   SEED_RELAY_LIST_KIND,
   SERVICE_DISCOVERY_KIND,
@@ -4757,6 +5360,12 @@ export {
   WORKFLOW_CHAIN_KIND,
   analyzeDockerfileForNonDeterminism,
   assignAddressFromHandshake,
+  balanceProofFieldsMina,
+  balanceProofHashEvm,
+  balanceProofHashSolana,
+  base58Decode,
+  base58Encode,
+  bigintToBytes32BE,
   buildAttestationEvent,
   buildBlobStorageRequest,
   buildEip712Domain,
@@ -4780,6 +5389,7 @@ export {
   buildWotDeclarationEvent,
   calculateRouteAmount,
   checkAddressCollision,
+  concatBytes,
   createAgentRuntimeClient,
   createDirectChannelClient,
   createDirectConnectorAdmin,
@@ -4796,13 +5406,20 @@ export {
   decodeEventFromToon,
   deriveChildAddress,
   deriveFromKmsSeed,
+  deriveMinaPublicKeyBase58,
   encodeEventToToon,
   encodeEventToToonString,
   extractPrefixFromHandshake,
+  getEventExpiration,
   hasMinReputation,
   hasRequireAttestation,
+  hexToBytes,
+  hexToMinaBase58PrivateKey,
+  ilpCodeToSemantic,
+  isEventExpired,
   isGenesisNode,
   isValidIlpAddressStructure,
+  minaHashToField,
   negotiateSettlementChain,
   parseAttestation,
   parseBlobStorageRequest,
@@ -4822,7 +5439,9 @@ export {
   publishSeedRelayEntry,
   readDockerfileNix,
   resolveChainConfig,
+  resolveClientNetwork,
   resolveMinaChainConfig,
+  resolveNetworkProfile,
   resolveRouteFees,
   resolveSolanaChainConfig,
   resolveTokenForChain,