capacity-attest 0.1.0

package/README.md

@@ -0,0 +1,85 @@
+# capacity-attest
+
+MCP-server voor leverings-attestaties bij x402-capaciteitshandel tussen AI-agents.
+
+> Status: MVP, **nog niet gepubliceerd** (`"private": true` in `package.json`). Structuur is publicatie-klaar (zie `server.json`), maar er is bewust nog geen `npm publish` of `git push` naar een remote gedaan.
+
+## Waarom dit bestaat
+
+Wanneer een AI-agent via het [x402-protocol](https://www.x402.org/) betaalt voor capaciteit — GPU-uren, opslag, API/inference-credits, bandbreedte — bij een andere agent of dienst, is er na de betaling geen bewijs dat het beloofde ook echt geleverd is. De kopende agent weet het zelf (hij zag de output, of zag hem niet), maar die kennis gaat verloren zodra de sessie eindigt. De volgende agent die met dezelfde verkoper zaken wil doen, begint weer blind.
+
+`capacity-attest` lost dat specifieke gat op: na afwikkeling laat de **betalende** agent een cryptografisch ondertekende, feitelijke claim achter (`delivered: yes/no/partial` + een hash van het bewijsmateriaal). Andere agents kunnen die geschiedenis opvragen **voordat** ze zelf met die verkoper in zee gaan.
+
+Geen oordeel. Geen reputatiescore. Geen "vonnis" — puur een ondertekende bon-plus-claim, net zoals een afleverbon bij een fysieke levering.
+
+## Wat dit NIET is
+
+Dit is bewust en hardcoded **niet**:
+
+- **Geen reputatiescore of rating.** `get_delivery_history` retourneert de ruwe, chronologische lijst van claims — geen gemiddelde, geen percentage, geen "trust score". Het samenvatten tot één getal is impliciet een oordeel, en dat is expliciet afgewezen tijdens de besluitvorming voor dit project.
+- **Geen financieel product.** Geen rente, geen tijd-disconto op betalingen, geen yield op het ledger-saldo (er ís geen saldo — dit is geen escrow), geen lening, geen onderpand, geen invoice-financing/factoring. `assetType` is een gesloten enum van capaciteitssoorten (`gpu-hours`, `storage`, `api-credits`, `bandwidth`) en bevat bewust niets dat op een financieel instrument lijkt.
+- **Geen eigen token of munt.** Betalingen lopen via x402/USDC zoals gebruikelijk; dit project registreert alleen de *bon* van een afwikkeling die al ergens anders heeft plaatsgevonden.
+- **Geen krediet-verlening.** Een claim wordt pas gemaakt **na** een voltooide betaling — dit project financiert niets, het documenteert een reeds afgeronde ijara (verhuur/dienst)-transactie.
+
+Dit is een sharia-getoetste (halal) ontwerpkeuze, niet een toevallige scope-beperking. Zie de guardrails-sectie in het project-brief als je overweegt hier iets aan toe te voegen: bij twijfel of een veld/functie hiertegenaan schuurt, laat het weg.
+
+## Hoe het werkt
+
+### 1. `record_delivery`
+
+De betalende agent (de koper) roept dit aan **na** een x402-afwikkeling, zodra bekend is of het beloofde is aangekomen. De claim bevat:
+
+| Veld | Betekenis |
+| --- | --- |
+| `sellerAddress` | 0x-adres van de partij die betaald werd |
+| `buyerAddress` | 0x-adres van de betalende agent — moet overeenkomen met het adres dat uit `signature` wordt teruggerekend |
+| `assetType` | `gpu-hours` \| `storage` \| `api-credits` \| `bandwidth` |
+| `promisedSpec` | Wat er beloofd was — vrije tekst of een gestructureerd object |
+| `delivered` | `yes` \| `no` \| `partial` |
+| `evidenceHash` | sha256-hex van bewijsmateriaal (logs, response-payload, ...) — het bewijs zelf wordt niet opgeslagen |
+| `settlementRef` | x402-payment-ref of on-chain tx-hash van de onderliggende betaling |
+| `timestamp` | ISO-8601 tijdstip |
+| `claimId` | content-addressed sha256-hash van alle velden hierboven — zie `computeClaimId()` in `src/schema.ts` |
+| `signature` | EIP-191 personal-sign handtekening van de koper over `claimId` |
+
+De server valideert eerst het schema, dan of `claimId` echt de hash van de inhoud is, en dan of `signature` echt terugrekent naar `buyerAddress`. Alleen dan wordt de claim toegevoegd aan de append-only ledger (`data/claims.jsonl`). Een ongeldige handtekening of een claim die al eerder is opgeslagen (zelfde `claimId`) wordt geweigerd.
+
+### 2. `get_delivery_history`
+
+Gegeven een `sellerAddress`, retourneert dit alle bekende claims tegen die verkoper, chronologisch (oudst eerst). Puur feitelijk — geen samengevat getal. Een kopende agent roept dit aan **vóórdat** hij betaalt, om de ruwe leveringsgeschiedenis van een potentiële verkoper te zien en zelf te beoordelen.
+
+## Ondertekening
+
+De claim wordt ondertekend door de **koper** (de partij die betaalde en dus weet wat er wel/niet aankwam), niet door de verkoper. Dit is bewust eenvoudige EIP-191 `personal_sign` over `claimId` (via `ethers.Signer#signMessage`), geen EIP-712 typed data — dat houdt het crypto-oppervlak van deze MVP klein en makkelijk te controleren. Een latere upgrade naar EIP-712 (zoals in `mcp-paywall/src/x402.mjs`) is additief mogelijk zonder bestaande claims ongeldig te maken.
+
+## Lokaal draaien
+
+```bash
+npm install
+npm run build      # tsc -> dist/
+npm run typecheck  # tsc --noEmit
+npm test           # vitest run
+npm run demo       # end-to-end lokale demo met TEST-sleutels, geen live infra
+npm start           # start de MCP-server over stdio (bijv. voor Claude Desktop/Code als lokale MCP-server)
+```
+
+De ledger-locatie is instelbaar via `CAPACITY_ATTEST_DATA_DIR` (default: `./data` in dit package). Tests en de demo gebruiken altijd een eigen, wegwerpbare tijdelijke map — nooit de echte `data/` map.
+
+## Architectuur
+
+```
+src/
+  schema.ts        DeliveryClaim zod-schema + content-addressing (computeClaimId, canonicalize)
+  signing.ts        sign/verify van een claim (ethers, EIP-191 personal-sign)
+  ledger.ts          append-only JSONL-opslag (data/claims.jsonl), nooit muteerbaar
+  tools.ts           de daadwerkelijke logica achter beide MCP-tools, transport-onafhankelijk
+  config.ts          waar de ledger-map leeft, lazy zodat tests 'm kunnen overriden
+  index.ts            MCP-server wiring (registreert record_delivery + get_delivery_history)
+examples/demo.ts   end-to-end lokaal voorbeeld met TEST-sleutels
+```
+
+`tools.ts` bevat de eigenlijke business-logica; `index.ts` vertaalt dat alleen naar MCP tool-calls. Zo kunnen tests en de demo dezelfde logica direct aanroepen zonder een stdio-transport op te tuigen.
+
+## Relatie tot x402
+
+Dit project verifieert of settelt zelf géén x402-betalingen — dat gebeurt al bij de betaalstap zelf (zie bijvoorbeeld `mcp-paywall/src/x402.mjs` in dit ecosysteem voor een volledige EIP-3009-verify/settle-implementatie). `settlementRef` verwijst simpelweg naar die reeds-voltooide afwikkeling. Dat betekent ook dat de MVP-koppeling met een echte x402-facilitator eenvoudig kan blijven: `settlementRef` is vrije tekst, met als aanname dat de koper 'm eerlijk invult. Een latere versie kan dat veld optioneel verifiëren tegen een echte facilitator (TODO, niet in deze MVP).

package/dist/config.d.ts

@@ -0,0 +1,6 @@
+export declare const ROOT: string;
+/** Directory the claims ledger (claims.jsonl) is read from / written to. */
+export declare function dataDir(): string;
+/** Ensure the data directory exists and return its path. */
+export declare function ensureDataDir(): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,IAAI,QAAwB,CAAC;AAE1C,4EAA4E;AAC5E,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,IAAI,MAAM,CAItC"}

package/dist/config.js

@@ -0,0 +1,23 @@
+// config.ts — where the append-only claims ledger lives on disk.
+//
+// The directory is resolved lazily (a function, not a module-load-time
+// constant) specifically so tests and examples/demo.ts can point at an
+// isolated, disposable directory by setting CAPACITY_ATTEST_DATA_DIR right
+// before calling a ledger function — no import-order gymnastics required.
+import { existsSync, mkdirSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+export const ROOT = join(__dirname, "..");
+/** Directory the claims ledger (claims.jsonl) is read from / written to. */
+export function dataDir() {
+    return process.env["CAPACITY_ATTEST_DATA_DIR"] || join(ROOT, "data");
+}
+/** Ensure the data directory exists and return its path. */
+export function ensureDataDir() {
+    const dir = dataDir();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    return dir;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAE1E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,UAAU,OAAO;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { ASSET_TYPES, DELIVERED_VALUES } from "./schema.js";
+export { ASSET_TYPES, DELIVERED_VALUES };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA2C,MAAM,aAAa,CAAC;AAwDrG,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/index.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+// index.ts — MCP server wiring. All actual logic lives in tools.ts; this
+// file only translates MCP tool calls into calls on that logic and formats
+// the result as MCP content blocks (same pattern as
+// al-yad-mcp-server/packages/mcp-server/src/index.ts).
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ASSET_TYPES, DELIVERED_VALUES, ClaimContentSchema, DeliveryClaimSchema } from "./schema.js";
+import { recordDelivery, getDeliveryHistory } from "./tools.js";
+const server = new McpServer({
+    name: "capacity-attest",
+    version: "0.1.0",
+});
+function textResult(value) {
+    const text = typeof value === "string" ? value : JSON.stringify(value, null, 2);
+    return { content: [{ type: "text", text }] };
+}
+function errorResult(message) {
+    return { content: [{ type: "text", text: `Error: ${message}` }], isError: true };
+}
+server.registerTool("record_delivery", {
+    title: "Record a delivery claim",
+    description: "Record a signed delivery claim after an x402 capacity settlement (gpu-hours, storage, api-credits, or bandwidth). " +
+        "The buyer agent calls this AFTER paying, once it knows whether what was promised actually arrived. " +
+        "The claim's schema and signature (must recover to buyerAddress) are validated before it is written to the " +
+        "append-only ledger. This is a factual receipt, not a reputation score — see get_delivery_history for how " +
+        "other agents read it back.",
+    inputSchema: DeliveryClaimSchema.shape,
+}, async (args) => {
+    const result = recordDelivery(args);
+    if (!result.ok)
+        return errorResult(result.reason);
+    return textResult({ ok: true, claimId: result.claimId });
+});
+server.registerTool("get_delivery_history", {
+    title: "Get a seller's delivery history",
+    description: "Return every known, signature-verified delivery claim recorded against a given sellerAddress, oldest first. " +
+        "Purely factual — no aggregate score, rating, or reputation judgment is computed. A buying agent can call this " +
+        "BEFORE paying a seller to see that seller's raw delivery history for gpu-hours, storage, api-credits, and " +
+        "bandwidth claims.",
+    inputSchema: {
+        sellerAddress: ClaimContentSchema.shape.sellerAddress,
+    },
+}, async ({ sellerAddress }) => {
+    return textResult(getDeliveryHistory(sellerAddress));
+});
+// Re-exported so callers embedding this package can reference the same enums
+// / schema the tools validate against without duplicating them.
+export { ASSET_TYPES, DELIVERED_VALUES };
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((e) => {
+    console.error("capacity-attest MCP server failed to start:", e);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,2EAA2E;AAC3E,oDAAoD;AACpD,uDAAuD;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;IACE,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,oHAAoH;QACpH,qGAAqG;QACrG,4GAA4G;QAC5G,2GAA2G;QAC3G,4BAA4B;IAC9B,WAAW,EAAE,mBAAmB,CAAC,KAAK;CACvC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;IACE,KAAK,EAAE,iCAAiC;IACxC,WAAW,EACT,8GAA8G;QAC9G,gHAAgH;QAChH,4GAA4G;QAC5G,mBAAmB;IACrB,WAAW,EAAE;QACX,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa;KACtD;CACF,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;IAC1B,OAAO,UAAU,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;AACvD,CAAC,CACF,CAAC;AAEF,6EAA6E;AAC7E,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAEzC,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/ledger.d.ts

@@ -0,0 +1,11 @@
+import { type DeliveryClaim } from "./schema.js";
+/**
+ * Append one already-verified claim to the ledger. Throws if a claim with
+ * the same claimId was already recorded.
+ */
+export declare function appendClaim(claim: DeliveryClaim): DeliveryClaim;
+/** All claims recorded against one seller, oldest first. */
+export declare function claimsForSeller(sellerAddress: string): DeliveryClaim[];
+/** Every claim in the ledger, oldest first. Mainly useful for tests/inspection. */
+export declare function allClaims(): DeliveryClaim[];
+//# sourceMappingURL=ledger.d.ts.map

package/dist/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAYA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAuBtE;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAQ/D;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,EAAE,CAItE;AAED,mFAAmF;AACnF,wBAAgB,SAAS,IAAI,aAAa,EAAE,CAE3C"}

package/dist/ledger.js

@@ -0,0 +1,57 @@
+// ledger.ts — append-only JSONL storage for delivery claims.
+//
+// Same pattern as mcp-paywall/src/ledger.mjs: one append-only file, nothing
+// ever rewritten or deleted. There is intentionally no update/delete
+// function anywhere in this module — a claim, once written, is permanent
+// history. A second claim with the same content-addressed claimId (i.e. an
+// attempt to re-record the exact same claim) is rejected rather than
+// silently duplicated.
+import { existsSync, readFileSync, appendFileSync } from "node:fs";
+import { join } from "node:path";
+import { dataDir, ensureDataDir } from "./config.js";
+import { DeliveryClaimSchema } from "./schema.js";
+function claimsFile() {
+    return join(dataDir(), "claims.jsonl");
+}
+function readClaims() {
+    const file = claimsFile();
+    if (!existsSync(file))
+        return [];
+    return readFileSync(file, "utf8")
+        .split("\n")
+        .filter(Boolean)
+        .flatMap((line) => {
+        try {
+            return [DeliveryClaimSchema.parse(JSON.parse(line))];
+        }
+        catch {
+            // A corrupt/partial line (e.g. a truncated write) must not take down
+            // reads of the rest of the ledger.
+            return [];
+        }
+    });
+}
+/**
+ * Append one already-verified claim to the ledger. Throws if a claim with
+ * the same claimId was already recorded.
+ */
+export function appendClaim(claim) {
+    const existing = readClaims();
+    if (existing.some((c) => c.claimId.toLowerCase() === claim.claimId.toLowerCase())) {
+        throw new Error(`claim_already_recorded: ${claim.claimId}`);
+    }
+    ensureDataDir();
+    appendFileSync(claimsFile(), JSON.stringify(claim) + "\n");
+    return claim;
+}
+/** All claims recorded against one seller, oldest first. */
+export function claimsForSeller(sellerAddress) {
+    return readClaims()
+        .filter((c) => c.sellerAddress.toLowerCase() === sellerAddress.toLowerCase())
+        .sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+}
+/** Every claim in the ledger, oldest first. Mainly useful for tests/inspection. */
+export function allClaims() {
+    return readClaims().sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+}
+//# sourceMappingURL=ledger.js.map

package/dist/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,uBAAuB;AAEvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAEtE,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;SAC9B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,mCAAmC;YACnC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAoB;IAC9C,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,aAAa,EAAE,CAAC;IAChB,cAAc,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,aAAqB;IACnD,OAAO,UAAU,EAAE;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;SAC5E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,68 @@
+import * as z from "zod/v4";
+export declare const ASSET_TYPES: readonly ["gpu-hours", "storage", "api-credits", "bandwidth"];
+export type AssetType = (typeof ASSET_TYPES)[number];
+export declare const DELIVERED_VALUES: readonly ["yes", "no", "partial"];
+export type Delivered = (typeof DELIVERED_VALUES)[number];
+/**
+ * The part of a claim that is hashed to produce claimId and that gets
+ * signed. Everything in here is chosen by the buyer at claim-creation time;
+ * claimId and signature (in DeliveryClaimSchema below) are derived from it.
+ */
+export declare const ClaimContentSchema: z.ZodObject<{
+    sellerAddress: z.ZodString;
+    buyerAddress: z.ZodString;
+    assetType: z.ZodEnum<{
+        "gpu-hours": "gpu-hours";
+        storage: "storage";
+        "api-credits": "api-credits";
+        bandwidth: "bandwidth";
+    }>;
+    promisedSpec: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
+    delivered: z.ZodEnum<{
+        yes: "yes";
+        no: "no";
+        partial: "partial";
+    }>;
+    evidenceHash: z.ZodString;
+    settlementRef: z.ZodString;
+    timestamp: z.ZodString;
+}, z.core.$strip>;
+export type ClaimContent = z.infer<typeof ClaimContentSchema>;
+/** The full, stored, signed claim — ClaimContent plus its content-address and signature. */
+export declare const DeliveryClaimSchema: z.ZodObject<{
+    sellerAddress: z.ZodString;
+    buyerAddress: z.ZodString;
+    assetType: z.ZodEnum<{
+        "gpu-hours": "gpu-hours";
+        storage: "storage";
+        "api-credits": "api-credits";
+        bandwidth: "bandwidth";
+    }>;
+    promisedSpec: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>;
+    delivered: z.ZodEnum<{
+        yes: "yes";
+        no: "no";
+        partial: "partial";
+    }>;
+    evidenceHash: z.ZodString;
+    settlementRef: z.ZodString;
+    timestamp: z.ZodString;
+    claimId: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strip>;
+export type DeliveryClaim = z.infer<typeof DeliveryClaimSchema>;
+/**
+ * Deterministic JSON stringify: object keys sorted recursively so hashing
+ * and signing are stable regardless of the original key insertion order.
+ * Arrays keep their order (order is meaningful there); only object keys are
+ * sorted.
+ */
+export declare function canonicalize(value: unknown): string;
+/**
+ * Content-addressed id for a claim: sha256 of the canonical JSON of its
+ * content fields (everything except claimId and signature themselves).
+ * Validates+normalizes `content` first so a claimId can never be computed
+ * over a shape that wouldn't itself pass ClaimContentSchema.
+ */
+export declare function computeClaimId(content: ClaimContent): string;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,WAAW,+DAAgE,CAAC;AACzF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,eAAO,MAAM,gBAAgB,mCAAoC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAS1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;iBA0B7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AAeD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAI5D"}

package/dist/schema.js

@@ -0,0 +1,99 @@
+// schema.ts — the DeliveryClaim shape.
+//
+// A DeliveryClaim is a factual, signed receipt: "buyer X paid seller Y for
+// asset Z under x402 settlement R, and here is whether what was promised
+// actually arrived." It is deliberately NOT a score, rating, or judgment —
+// see README.md "Wat dit NIET is".
+//
+// GUARDRAIL (halal): assetType is a closed enum of physical/compute capacity
+// kinds. Do not add anything that looks like a financial instrument (credit,
+// loan, yield, interest-bearing balance, invoice-financing) to this file —
+// see the "HALAL GUARDRAILS" section of the project brief. If a field or enum
+// value even smells like that, leave it out.
+import * as z from "zod/v4";
+import { createHash } from "node:crypto";
+export const ASSET_TYPES = ["gpu-hours", "storage", "api-credits", "bandwidth"];
+export const DELIVERED_VALUES = ["yes", "no", "partial"];
+const ETH_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+const SHA256_HEX_RE = /^[0-9a-fA-F]{64}$/;
+const CLAIM_ID_RE = /^0x[0-9a-fA-F]{64}$/;
+// 65-byte ECDSA signature (r ++ s ++ v), hex-encoded with 0x prefix — the
+// shape ethers.Signer#signMessage() / ethers.verifyMessage() produce.
+const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
+/**
+ * The part of a claim that is hashed to produce claimId and that gets
+ * signed. Everything in here is chosen by the buyer at claim-creation time;
+ * claimId and signature (in DeliveryClaimSchema below) are derived from it.
+ */
+export const ClaimContentSchema = z.object({
+    sellerAddress: z
+        .string()
+        .regex(ETH_ADDRESS_RE, "sellerAddress must be a 0x-prefixed 20-byte address")
+        .describe("0x address of the agent/service that was paid and was supposed to deliver"),
+    buyerAddress: z
+        .string()
+        .regex(ETH_ADDRESS_RE, "buyerAddress must be a 0x-prefixed 20-byte address")
+        .describe("0x address of the paying agent — must match the address recovered from `signature`"),
+    assetType: z.enum(ASSET_TYPES).describe("What kind of capacity this claim is about"),
+    promisedSpec: z
+        .union([z.string().min(1), z.record(z.string(), z.unknown())])
+        .describe("What the seller promised to deliver — free text or a structured object"),
+    delivered: z.enum(DELIVERED_VALUES).describe("Whether what was promised actually arrived"),
+    evidenceHash: z
+        .string()
+        .regex(SHA256_HEX_RE, "evidenceHash must be a sha256 hex digest (64 hex chars, no 0x prefix)")
+        .describe("sha256 hex digest of evidence for this claim (logs, response payload, etc.) — the evidence itself is not stored here"),
+    settlementRef: z
+        .string()
+        .min(1, "settlementRef is required (x402 payment reference or on-chain tx hash)")
+        .describe("x402 payment reference or on-chain tx hash for the settlement this claim is about"),
+    timestamp: z
+        .string()
+        .refine((v) => !Number.isNaN(Date.parse(v)), "timestamp must be a valid ISO-8601 date string")
+        .describe("ISO-8601 timestamp of when this claim was made"),
+});
+/** The full, stored, signed claim — ClaimContent plus its content-address and signature. */
+export const DeliveryClaimSchema = ClaimContentSchema.extend({
+    claimId: z
+        .string()
+        .regex(CLAIM_ID_RE, "claimId must be a 0x-prefixed sha256 hex digest")
+        .describe("Content-addressed id: sha256 of the canonical JSON of this claim's content fields — see computeClaimId()"),
+    signature: z
+        .string()
+        .regex(SIGNATURE_RE, "signature must be a 0x-prefixed 65-byte ECDSA signature")
+        .describe("Buyer's EIP-191 personal-sign signature over claimId"),
+});
+/**
+ * Deterministic JSON stringify: object keys sorted recursively so hashing
+ * and signing are stable regardless of the original key insertion order.
+ * Arrays keep their order (order is meaningful there); only object keys are
+ * sorted.
+ */
+export function canonicalize(value) {
+    return JSON.stringify(sortKeysDeep(value));
+}
+function sortKeysDeep(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeysDeep);
+    if (value !== null && typeof value === "object") {
+        const input = value;
+        const out = {};
+        for (const key of Object.keys(input).sort()) {
+            out[key] = sortKeysDeep(input[key]);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Content-addressed id for a claim: sha256 of the canonical JSON of its
+ * content fields (everything except claimId and signature themselves).
+ * Validates+normalizes `content` first so a claimId can never be computed
+ * over a shape that wouldn't itself pass ClaimContentSchema.
+ */
+export function computeClaimId(content) {
+    const parsed = ClaimContentSchema.parse(content);
+    const hash = createHash("sha256").update(canonicalize(parsed)).digest("hex");
+    return `0x${hash}`;
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,6CAA6C;AAE7C,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,CAAU,CAAC;AAGzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAU,CAAC;AAGlE,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,KAAK,CAAC,cAAc,EAAE,qDAAqD,CAAC;SAC5E,QAAQ,CAAC,2EAA2E,CAAC;IACxF,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,cAAc,EAAE,oDAAoD,CAAC;SAC3E,QAAQ,CAAC,oFAAoF,CAAC;IACjG,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACpF,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SAC7D,QAAQ,CAAC,wEAAwE,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC1F,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,aAAa,EAAE,uEAAuE,CAAC;SAC7F,QAAQ,CAAC,sHAAsH,CAAC;IACnI,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,wEAAwE,CAAC;SAChF,QAAQ,CAAC,mFAAmF,CAAC;IAChG,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,gDAAgD,CAAC;SAC7F,QAAQ,CAAC,gDAAgD,CAAC;CAC9D,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAC3D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACrE,QAAQ,CAAC,0GAA0G,CAAC;IACvH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,YAAY,EAAE,yDAAyD,CAAC;SAC9E,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC"}

package/dist/signing.d.ts

@@ -0,0 +1,36 @@
+import { ethers } from "ethers";
+import { type ClaimContent } from "./schema.js";
+export interface SignedClaimParts {
+    claimId: string;
+    signature: string;
+}
+/**
+ * Sign a delivery claim as the buyer. Returns the content-addressed claimId
+ * alongside the signature so callers can assemble a full DeliveryClaim.
+ */
+export declare function signClaim(signer: ethers.Signer, content: ClaimContent): Promise<SignedClaimParts>;
+/**
+ * Recover the address that produced `signature` over `claimId`. Pure,
+ * offline, deterministic — no network call.
+ */
+export declare function recoverClaimSigner(claimId: string, signature: string): string;
+export type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify that an assembled claim is internally consistent:
+ *   1. claimId really is the sha256 content-address of the claim's own
+ *      content fields (catches a submitted claimId that doesn't match a
+ *      tampered/edited content field), and
+ *   2. the signature really does recover to buyerAddress — the party
+ *      attesting to what it received, per the project's design (the PAYING
+ *      agent leaves the claim about the SELLER it paid).
+ */
+export declare function verifyClaim(claim: ClaimContent & {
+    claimId: string;
+    signature: string;
+}): VerifyResult;
+//# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAIvG;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3D,YAAY,CAkBd"}

package/dist/signing.js

@@ -0,0 +1,54 @@
+// signing.ts — sign a claim as the buyer, and verify that signature later.
+//
+// Deliberately simple EIP-191 personal-sign over the claim's content-address
+// (claimId), not EIP-712 typed data. This keeps the MVP's crypto surface
+// small and easy to audit end-to-end; a typed-data path can be added later
+// as an additive upgrade (accept both, prefer the new one) without breaking
+// already-recorded claims. See mcp-paywall/src/x402.mjs for the EIP-712
+// pattern this project can graduate to if/when claims need domain-separated
+// signing (e.g. once claims are also submitted on-chain).
+import { ethers } from "ethers";
+import { computeClaimId } from "./schema.js";
+/**
+ * Sign a delivery claim as the buyer. Returns the content-addressed claimId
+ * alongside the signature so callers can assemble a full DeliveryClaim.
+ */
+export async function signClaim(signer, content) {
+    const claimId = computeClaimId(content);
+    const signature = await signer.signMessage(claimId);
+    return { claimId, signature };
+}
+/**
+ * Recover the address that produced `signature` over `claimId`. Pure,
+ * offline, deterministic — no network call.
+ */
+export function recoverClaimSigner(claimId, signature) {
+    return ethers.verifyMessage(claimId, signature);
+}
+/**
+ * Verify that an assembled claim is internally consistent:
+ *   1. claimId really is the sha256 content-address of the claim's own
+ *      content fields (catches a submitted claimId that doesn't match a
+ *      tampered/edited content field), and
+ *   2. the signature really does recover to buyerAddress — the party
+ *      attesting to what it received, per the project's design (the PAYING
+ *      agent leaves the claim about the SELLER it paid).
+ */
+export function verifyClaim(claim) {
+    const expectedClaimId = computeClaimId(claim);
+    if (expectedClaimId.toLowerCase() !== claim.claimId.toLowerCase()) {
+        return { ok: false, reason: "claimId_mismatch" };
+    }
+    let recovered;
+    try {
+        recovered = recoverClaimSigner(claim.claimId, claim.signature);
+    }
+    catch (e) {
+        return { ok: false, reason: `signature_recovery_failed: ${e.message}` };
+    }
+    if (recovered.toLowerCase() !== claim.buyerAddress.toLowerCase()) {
+        return { ok: false, reason: "signature_does_not_match_buyer" };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,4EAA4E;AAC5E,0DAA0D;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAqB,cAAc,EAAE,MAAM,aAAa,CAAC;AAOhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAqB,EAAE,OAAqB;IAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB;IACnE,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAID;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,KAA4D;IAE5D,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,eAAe,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACrF,CAAC;IAED,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/test-helpers.d.ts

@@ -0,0 +1,19 @@
+import { ethers } from "ethers";
+import type { ClaimContent, DeliveryClaim } from "./schema.js";
+/** A fresh random TEST wallet — never funded, never used outside this test suite. */
+export declare function testWallet(): ethers.HDNodeWallet;
+/** sha256 hex digest of some evidence bytes, in the shape evidenceHash expects. */
+export declare function evidenceHash(evidence: string): string;
+export interface BuildClaimOverrides {
+    sellerAddress?: string;
+    buyerAddress?: string;
+    assetType?: ClaimContent["assetType"];
+    promisedSpec?: ClaimContent["promisedSpec"];
+    delivered?: ClaimContent["delivered"];
+    evidenceHash?: string;
+    settlementRef?: string;
+    timestamp?: string;
+}
+/** Build a valid, signed DeliveryClaim for buyer `wallet`, with sensible defaults. */
+export declare function buildSignedClaim(wallet: ethers.HDNodeWallet, overrides?: BuildClaimOverrides): Promise<DeliveryClaim>;
+//# sourceMappingURL=test-helpers.d.ts.map

package/dist/test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.d.ts","sourceRoot":"","sources":["../src/test-helpers.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG/D,qFAAqF;AACrF,wBAAgB,UAAU,IAAI,MAAM,CAAC,YAAY,CAEhD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IAC5C,SAAS,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,CAAC,YAAY,EAC3B,SAAS,GAAE,mBAAwB,GAClC,OAAO,CAAC,aAAa,CAAC,CAaxB"}

package/dist/test-helpers.js

@@ -0,0 +1,30 @@
+// test-helpers.ts — shared fixtures for the test suite. Not part of the
+// published surface (README/dist only ship what package.json's "files"
+// lists), but kept in src/ so it type-checks alongside the code it exercises.
+import { ethers } from "ethers";
+import { createHash } from "node:crypto";
+import { signClaim } from "./signing.js";
+/** A fresh random TEST wallet — never funded, never used outside this test suite. */
+export function testWallet() {
+    return ethers.Wallet.createRandom();
+}
+/** sha256 hex digest of some evidence bytes, in the shape evidenceHash expects. */
+export function evidenceHash(evidence) {
+    return createHash("sha256").update(evidence).digest("hex");
+}
+/** Build a valid, signed DeliveryClaim for buyer `wallet`, with sensible defaults. */
+export async function buildSignedClaim(wallet, overrides = {}) {
+    const content = {
+        sellerAddress: overrides.sellerAddress ?? "0x00000000000000000000000000000000000000aa",
+        buyerAddress: overrides.buyerAddress ?? wallet.address,
+        assetType: overrides.assetType ?? "gpu-hours",
+        promisedSpec: overrides.promisedSpec ?? "1x A100, 4 hours, us-east region",
+        delivered: overrides.delivered ?? "yes",
+        evidenceHash: overrides.evidenceHash ?? evidenceHash("demo evidence payload"),
+        settlementRef: overrides.settlementRef ?? "0x" + "11".repeat(32),
+        timestamp: overrides.timestamp ?? new Date().toISOString(),
+    };
+    const { claimId, signature } = await signClaim(wallet, content);
+    return { ...content, claimId, signature };
+}
+//# sourceMappingURL=test-helpers.js.map

package/dist/test-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../src/test-helpers.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,uEAAuE;AACvE,8EAA8E;AAE9E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,qFAAqF;AACrF,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAaD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA2B,EAC3B,YAAiC,EAAE;IAEnC,MAAM,OAAO,GAAiB;QAC5B,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,4CAA4C;QACtF,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO;QACtD,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,WAAW;QAC7C,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,kCAAkC;QAC1E,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,KAAK;QACvC,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,YAAY,CAAC,uBAAuB,CAAC;QAC7E,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC3D,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,27 @@
+import { type DeliveryClaim } from "./schema.js";
+export type RecordDeliveryResult = {
+    ok: true;
+    claimId: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Validate the claim's schema, verify its signature (must recover to
+ * buyerAddress), and persist it to the append-only ledger. This is the
+ * logic behind the `record_delivery` MCP tool.
+ */
+export declare function recordDelivery(input: unknown): RecordDeliveryResult;
+export interface DeliveryHistoryResult {
+    sellerAddress: string;
+    count: number;
+    claims: DeliveryClaim[];
+}
+/**
+ * Every known, signature-verified claim recorded against sellerAddress,
+ * oldest first. Purely factual — no aggregate score, rating, or reputation
+ * judgment is computed here; see README.md "Wat dit NIET is". This is the
+ * logic behind the `get_delivery_history` MCP tool.
+ */
+export declare function getDeliveryHistory(sellerAddress: string): DeliveryHistoryResult;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAMA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAItE,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAmBnE;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,qBAAqB,CAG/E"}

package/dist/tools.js

@@ -0,0 +1,42 @@
+// tools.ts — the two tools' actual logic, kept separate from the MCP
+// transport wiring in index.ts (same separation-of-concerns pattern as
+// al-yad-mcp-server's companion-client.ts vs. index.ts). This lets tests
+// and examples/demo.ts call the real logic directly without spinning up a
+// stdio JSON-RPC transport.
+import { DeliveryClaimSchema } from "./schema.js";
+import { verifyClaim } from "./signing.js";
+import { appendClaim, claimsForSeller } from "./ledger.js";
+/**
+ * Validate the claim's schema, verify its signature (must recover to
+ * buyerAddress), and persist it to the append-only ledger. This is the
+ * logic behind the `record_delivery` MCP tool.
+ */
+export function recordDelivery(input) {
+    const parsed = DeliveryClaimSchema.safeParse(input);
+    if (!parsed.success) {
+        return { ok: false, reason: `invalid_claim: ${parsed.error.issues.map((i) => i.message).join("; ")}` };
+    }
+    const claim = parsed.data;
+    const verdict = verifyClaim(claim);
+    if (!verdict.ok) {
+        return { ok: false, reason: `signature_invalid: ${verdict.reason}` };
+    }
+    try {
+        appendClaim(claim);
+    }
+    catch (e) {
+        return { ok: false, reason: e.message };
+    }
+    return { ok: true, claimId: claim.claimId };
+}
+/**
+ * Every known, signature-verified claim recorded against sellerAddress,
+ * oldest first. Purely factual — no aggregate score, rating, or reputation
+ * judgment is computed here; see README.md "Wat dit NIET is". This is the
+ * logic behind the `get_delivery_history` MCP tool.
+ */
+export function getDeliveryHistory(sellerAddress) {
+    const claims = claimsForSeller(sellerAddress);
+    return { sellerAddress, count: claims.length, claims };
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,4BAA4B;AAE5B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI3D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9C,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC"}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "capacity-attest",
+  "version": "0.1.0",
+  "description": "MCP server for capacity-delivery attestations: after an x402 payment for compute capacity (GPU-hours, storage, API credits, bandwidth), the paying agent leaves a signed, factual claim of what was actually delivered — so other agents can check a seller's delivery history before paying. No reputation score, no judgment, no financial instrument.",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "x402",
+    "agent-to-agent",
+    "agent-commerce",
+    "capacity-trade",
+    "attestation",
+    "provenance",
+    "ai-agent"
+  ],
+  "author": "holistis",
+  "license": "MIT",
+  "homepage": "https://tokenizen.nl",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/holistis/tokenizen.git",
+    "directory": "packages/capacity-attest"
+  },
+  "mcpName": "io.github.holistis/capacity-attest",
+  "type": "module",
+  "main": "./dist/index.js",
+  "bin": {
+    "capacity-attest": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node -e \"require('fs').chmodSync('dist/index.js', 0o755)\"",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "start": "node dist/index.js",
+    "demo": "tsx examples/demo.ts"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "ethers": "^6.13.0",
+    "zod": "^4.5.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8"
+  }
+}