capacity-attest 0.1.0 → 0.1.2

package/README.md

@@ -2,26 +2,26 @@
 
 MCP-server voor leverings-attestaties bij x402-capaciteitshandel tussen AI-agents.
 
-> Status: MVP, **nog niet gepubliceerd** (`"private": true` in `package.json`). Structuur is publicatie-klaar (zie `server.json`), maar er is bewust nog geen `npm publish` of `git push` naar een remote gedaan.
+> Status: MVP, gepubliceerd op npm (`npm install capacity-attest`) en in het officiële MCP-register (`io.github.holistis/capacity-attest`).
 
 ## Waarom dit bestaat
 
-Wanneer een AI-agent via het [x402-protocol](https://www.x402.org/) betaalt voor capaciteit — GPU-uren, opslag, API/inference-credits, bandbreedte — bij een andere agent of dienst, is er na de betaling geen bewijs dat het beloofde ook echt geleverd is. De kopende agent weet het zelf (hij zag de output, of zag hem niet), maar die kennis gaat verloren zodra de sessie eindigt. De volgende agent die met dezelfde verkoper zaken wil doen, begint weer blind.
+Wanneer een AI-agent via het [x402-protocol](https://www.x402.org/) betaalt voor capaciteit (GPU-uren, opslag, API/inference-credits, bandbreedte) bij een andere agent of dienst, is er na de betaling geen bewijs dat het beloofde ook echt geleverd is. De kopende agent weet het zelf (hij zag de output, of zag hem niet), maar die kennis gaat verloren zodra de sessie eindigt. De volgende agent die met dezelfde verkoper zaken wil doen, begint weer blind.
 
 `capacity-attest` lost dat specifieke gat op: na afwikkeling laat de **betalende** agent een cryptografisch ondertekende, feitelijke claim achter (`delivered: yes/no/partial` + een hash van het bewijsmateriaal). Andere agents kunnen die geschiedenis opvragen **voordat** ze zelf met die verkoper in zee gaan.
 
-Geen oordeel. Geen reputatiescore. Geen "vonnis" — puur een ondertekende bon-plus-claim, net zoals een afleverbon bij een fysieke levering.
+Geen oordeel. Geen reputatiescore. Geen "vonnis", puur een ondertekende bon-plus-claim, net zoals een afleverbon bij een fysieke levering.
 
 ## Wat dit NIET is
 
 Dit is bewust en hardcoded **niet**:
 
-- **Geen reputatiescore of rating.** `get_delivery_history` retourneert de ruwe, chronologische lijst van claims — geen gemiddelde, geen percentage, geen "trust score". Het samenvatten tot één getal is impliciet een oordeel, en dat is expliciet afgewezen tijdens de besluitvorming voor dit project.
-- **Geen financieel product.** Geen rente, geen tijd-disconto op betalingen, geen yield op het ledger-saldo (er ís geen saldo — dit is geen escrow), geen lening, geen onderpand, geen invoice-financing/factoring. `assetType` is een gesloten enum van capaciteitssoorten (`gpu-hours`, `storage`, `api-credits`, `bandwidth`) en bevat bewust niets dat op een financieel instrument lijkt.
+- **Geen reputatiescore of rating.** `get_delivery_history` retourneert de ruwe, chronologische lijst van claims, geen gemiddelde, geen percentage, geen "trust score". Het samenvatten tot één getal is impliciet een oordeel, en dat is expliciet afgewezen tijdens de besluitvorming voor dit project.
+- **Geen financieel product.** Geen rente, geen tijd-disconto op betalingen, geen yield op het ledger-saldo (er ís geen saldo, dit is geen escrow), geen lening, geen onderpand, geen invoice-financing/factoring. `assetType` is een gesloten enum van capaciteitssoorten (`gpu-hours`, `storage`, `api-credits`, `bandwidth`) en bevat bewust niets dat op een financieel instrument lijkt.
 - **Geen eigen token of munt.** Betalingen lopen via x402/USDC zoals gebruikelijk; dit project registreert alleen de *bon* van een afwikkeling die al ergens anders heeft plaatsgevonden.
-- **Geen krediet-verlening.** Een claim wordt pas gemaakt **na** een voltooide betaling — dit project financiert niets, het documenteert een reeds afgeronde ijara (verhuur/dienst)-transactie.
+- **Geen krediet-verlening.** Een claim wordt pas gemaakt **na** een voltooide betaling. Dit project financiert niets, het documenteert een reeds afgeronde ijara (verhuur/dienst)-transactie.
 
-Dit is een sharia-getoetste (halal) ontwerpkeuze, niet een toevallige scope-beperking. Zie de guardrails-sectie in het project-brief als je overweegt hier iets aan toe te voegen: bij twijfel of een veld/functie hiertegenaan schuurt, laat het weg.
+Dit is een bewuste, formeel getoetste ontwerpkeuze, niet een toevallige scope-beperking. Zie de guardrails-sectie in het project-brief als je overweegt hier iets aan toe te voegen: bij twijfel of een veld/functie hiertegenaan schuurt, laat het weg.
 
 ## Hoe het werkt
 
@@ -32,25 +32,25 @@ De betalende agent (de koper) roept dit aan **na** een x402-afwikkeling, zodra b
 | Veld | Betekenis |
 | --- | --- |
 | `sellerAddress` | 0x-adres van de partij die betaald werd |
-| `buyerAddress` | 0x-adres van de betalende agent — moet overeenkomen met het adres dat uit `signature` wordt teruggerekend |
+| `buyerAddress` | 0x-adres van de betalende agent, moet overeenkomen met het adres dat uit `signature` wordt teruggerekend |
 | `assetType` | `gpu-hours` \| `storage` \| `api-credits` \| `bandwidth` |
-| `promisedSpec` | Wat er beloofd was — vrije tekst of een gestructureerd object |
+| `promisedSpec` | Wat er beloofd was: vrije tekst of een gestructureerd object |
 | `delivered` | `yes` \| `no` \| `partial` |
-| `evidenceHash` | sha256-hex van bewijsmateriaal (logs, response-payload, ...) — het bewijs zelf wordt niet opgeslagen |
+| `evidenceHash` | sha256-hex van bewijsmateriaal (logs, response-payload, ...), het bewijs zelf wordt niet opgeslagen |
 | `settlementRef` | x402-payment-ref of on-chain tx-hash van de onderliggende betaling |
 | `timestamp` | ISO-8601 tijdstip |
-| `claimId` | content-addressed sha256-hash van alle velden hierboven — zie `computeClaimId()` in `src/schema.ts` |
+| `claimId` | content-addressed sha256-hash van alle velden hierboven, zie `computeClaimId()` in `src/schema.ts` |
 | `signature` | EIP-191 personal-sign handtekening van de koper over `claimId` |
 
 De server valideert eerst het schema, dan of `claimId` echt de hash van de inhoud is, en dan of `signature` echt terugrekent naar `buyerAddress`. Alleen dan wordt de claim toegevoegd aan de append-only ledger (`data/claims.jsonl`). Een ongeldige handtekening of een claim die al eerder is opgeslagen (zelfde `claimId`) wordt geweigerd.
 
 ### 2. `get_delivery_history`
 
-Gegeven een `sellerAddress`, retourneert dit alle bekende claims tegen die verkoper, chronologisch (oudst eerst). Puur feitelijk — geen samengevat getal. Een kopende agent roept dit aan **vóórdat** hij betaalt, om de ruwe leveringsgeschiedenis van een potentiële verkoper te zien en zelf te beoordelen.
+Gegeven een `sellerAddress`, retourneert dit alle bekende claims tegen die verkoper, chronologisch (oudst eerst). Puur feitelijk, geen samengevat getal. Een kopende agent roept dit aan **vóórdat** hij betaalt, om de ruwe leveringsgeschiedenis van een potentiële verkoper te zien en zelf te beoordelen.
 
 ## Ondertekening
 
-De claim wordt ondertekend door de **koper** (de partij die betaalde en dus weet wat er wel/niet aankwam), niet door de verkoper. Dit is bewust eenvoudige EIP-191 `personal_sign` over `claimId` (via `ethers.Signer#signMessage`), geen EIP-712 typed data — dat houdt het crypto-oppervlak van deze MVP klein en makkelijk te controleren. Een latere upgrade naar EIP-712 (zoals in `mcp-paywall/src/x402.mjs`) is additief mogelijk zonder bestaande claims ongeldig te maken.
+De claim wordt ondertekend door de **koper** (de partij die betaalde en dus weet wat er wel/niet aankwam), niet door de verkoper. Dit is bewust eenvoudige EIP-191 `personal_sign` over `claimId` (via `ethers.Signer#signMessage`), geen EIP-712 typed data. Dat houdt het crypto-oppervlak van deze MVP klein en makkelijk te controleren. Een latere upgrade naar EIP-712 (zoals in `mcp-paywall/src/x402.mjs`) is additief mogelijk zonder bestaande claims ongeldig te maken.
 
 ## Lokaal draaien
 
@@ -63,7 +63,7 @@ npm run demo       # end-to-end lokale demo met TEST-sleutels, geen live infra
 npm start           # start de MCP-server over stdio (bijv. voor Claude Desktop/Code als lokale MCP-server)
 ```
 
-De ledger-locatie is instelbaar via `CAPACITY_ATTEST_DATA_DIR` (default: `./data` in dit package). Tests en de demo gebruiken altijd een eigen, wegwerpbare tijdelijke map — nooit de echte `data/` map.
+De ledger-locatie is instelbaar via `CAPACITY_ATTEST_DATA_DIR` (default: `./data` in dit package). Tests en de demo gebruiken altijd een eigen, wegwerpbare tijdelijke map, nooit de echte `data/` map.
 
 ## Architectuur
 
@@ -82,4 +82,4 @@ examples/demo.ts   end-to-end lokaal voorbeeld met TEST-sleutels
 
 ## Relatie tot x402
 
-Dit project verifieert of settelt zelf géén x402-betalingen — dat gebeurt al bij de betaalstap zelf (zie bijvoorbeeld `mcp-paywall/src/x402.mjs` in dit ecosysteem voor een volledige EIP-3009-verify/settle-implementatie). `settlementRef` verwijst simpelweg naar die reeds-voltooide afwikkeling. Dat betekent ook dat de MVP-koppeling met een echte x402-facilitator eenvoudig kan blijven: `settlementRef` is vrije tekst, met als aanname dat de koper 'm eerlijk invult. Een latere versie kan dat veld optioneel verifiëren tegen een echte facilitator (TODO, niet in deze MVP).
+Dit project verifieert of settelt zelf géén x402-betalingen, dat gebeurt al bij de betaalstap zelf (zie bijvoorbeeld `mcp-paywall/src/x402.mjs` in dit ecosysteem voor een volledige EIP-3009-verify/settle-implementatie). `settlementRef` verwijst simpelweg naar die reeds-voltooide afwikkeling. Dat betekent ook dat de MVP-koppeling met een echte x402-facilitator eenvoudig kan blijven: `settlementRef` is vrije tekst, met als aanname dat de koper 'm eerlijk invult. Een latere versie kan dat veld optioneel verifiëren tegen een echte facilitator (TODO, niet in deze MVP).

package/dist/index.js

@@ -27,7 +27,7 @@ server.registerTool("record_delivery", {
         "other agents read it back.",
     inputSchema: DeliveryClaimSchema.shape,
 }, async (args) => {
-    const result = recordDelivery(args);
+    const result = await recordDelivery(args);
     if (!result.ok)
         return errorResult(result.reason);
     return textResult({ ok: true, claimId: result.claimId });
@@ -42,7 +42,7 @@ server.registerTool("get_delivery_history", {
         sellerAddress: ClaimContentSchema.shape.sellerAddress,
     },
 }, async ({ sellerAddress }) => {
-    return textResult(getDeliveryHistory(sellerAddress));
+    return textResult(await getDeliveryHistory(sellerAddress));
 });
 // Re-exported so callers embedding this package can reference the same enums
 // / schema the tools validate against without duplicating them.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,2EAA2E;AAC3E,oDAAoD;AACpD,uDAAuD;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;IACE,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,oHAAoH;QACpH,qGAAqG;QACrG,4GAA4G;QAC5G,2GAA2G;QAC3G,4BAA4B;IAC9B,WAAW,EAAE,mBAAmB,CAAC,KAAK;CACvC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;IACE,KAAK,EAAE,iCAAiC;IACxC,WAAW,EACT,8GAA8G;QAC9G,gHAAgH;QAChH,4GAA4G;QAC5G,mBAAmB;IACrB,WAAW,EAAE;QACX,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa;KACtD;CACF,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;IAC1B,OAAO,UAAU,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;AACvD,CAAC,CACF,CAAC;AAEF,6EAA6E;AAC7E,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAEzC,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,2EAA2E;AAC3E,oDAAoD;AACpD,uDAAuD;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;IACE,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,oHAAoH;QACpH,qGAAqG;QACrG,4GAA4G;QAC5G,2GAA2G;QAC3G,4BAA4B;IAC9B,WAAW,EAAE,mBAAmB,CAAC,KAAK;CACvC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;IACE,KAAK,EAAE,iCAAiC;IACxC,WAAW,EACT,8GAA8G;QAC9G,gHAAgH;QAChH,4GAA4G;QAC5G,mBAAmB;IACrB,WAAW,EAAE;QACX,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa;KACtD;CACF,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;IAC1B,OAAO,UAAU,CAAC,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;AAC7D,CAAC,CACF,CAAC;AAEF,6EAA6E;AAC7E,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAEzC,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/ledger.d.ts

@@ -3,9 +3,9 @@ import { type DeliveryClaim } from "./schema.js";
  * Append one already-verified claim to the ledger. Throws if a claim with
  * the same claimId was already recorded.
  */
-export declare function appendClaim(claim: DeliveryClaim): DeliveryClaim;
+export declare function appendClaim(claim: DeliveryClaim): Promise<DeliveryClaim>;
 /** All claims recorded against one seller, oldest first. */
-export declare function claimsForSeller(sellerAddress: string): DeliveryClaim[];
+export declare function claimsForSeller(sellerAddress: string): Promise<DeliveryClaim[]>;
 /** Every claim in the ledger, oldest first. Mainly useful for tests/inspection. */
-export declare function allClaims(): DeliveryClaim[];
+export declare function allClaims(): Promise<DeliveryClaim[]>;
 //# sourceMappingURL=ledger.d.ts.map

package/dist/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAYA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAuBtE;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAQ/D;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,EAAE,CAItE;AAED,mFAAmF;AACnF,wBAAgB,SAAS,IAAI,aAAa,EAAE,CAE3C"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAYA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAoftE;;;GAGG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CA0D9E;AAED,4DAA4D;AAC5D,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAQrF;AAED,mFAAmF;AACnF,wBAAsB,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAG1D"}

package/dist/ledger.js

@@ -6,52 +6,564 @@
 // history. A second claim with the same content-addressed claimId (i.e. an
 // attempt to re-record the exact same claim) is rejected rather than
 // silently duplicated.
-import { existsSync, readFileSync, appendFileSync } from "node:fs";
+import { readFileSync, appendFileSync, openSync, closeSync, unlinkSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { dataDir, ensureDataDir } from "./config.js";
 import { DeliveryClaimSchema } from "./schema.js";
 function claimsFile() {
     return join(dataDir(), "claims.jsonl");
 }
-function readClaims() {
-    const file = claimsFile();
-    if (!existsSync(file))
-        return [];
-    return readFileSync(file, "utf8")
-        .split("\n")
-        .filter(Boolean)
-        .flatMap((line) => {
+// A concurrency benchmark (bench/ledger-concurrency.mjs) found that
+// appendClaim()'s original read-then-check-then-write sequence was a real,
+// reproducible TOCTOU race: with separate OS processes sharing one
+// CAPACITY_ATTEST_DATA_DIR (exactly the multi-agent deployment this ledger
+// exists for), 3 of 5 runs at N=8 concurrent submissions of the SAME claim
+// produced actual duplicate lines in claims.jsonl — the ledger's one
+// documented guarantee, broken 60% of the time under realistic load.
+//
+// Fix: a lockfile-based mutex around the whole read+check+append sequence,
+// using O_EXCL ("wx") as the atomic primitive — only one process can
+// successfully create the lock file at a time, so the race window closes.
+//
+// SECOND FIX (2026-08-31, same day): the mutex's first version retried a
+// contended lock with a synchronous `while (Date.now() < until) {}` spin
+// loop. That busy-wait blocks the entire Node.js event loop for however
+// long it spins (up to LOCK_TIMEOUT_MS = 5000ms) — in a live server this
+// package is designed to run inside (a buyer agent recording a delivery
+// claim right after a paid x402 call), that stalls every other in-flight
+// request on the process, not just the caller. The retry now awaits a real
+// `setTimeout`-based delay instead, which yields control back to the event
+// loop between attempts. This makes acquireLock() / appendClaim() (and,
+// for a consistent async surface across the module, readClaims() /
+// claimsForSeller() / allClaims()) Promise-returning. Every call site
+// (tools.ts, index.ts's tool handlers, examples/demo.ts, the test suite,
+// the bench/ scripts) was updated to await them — a half-converted fix
+// (async internals with a caller that forgot to await) would silently
+// reorder the read-check-write sequence and could reintroduce the exact
+// duplicate-claim race the lock exists to prevent. Verified after the fix:
+// bench/ledger-concurrency.mjs still shows 0% duplicates under real
+// multi-process contention (same as right after the first fix), and a new
+// bench/event-loop-non-blocking.mjs proves a concurrent setInterval no
+// longer stalls while the lock is contended.
+const LOCK_RETRY_DELAY_MS = 5;
+const LOCK_TIMEOUT_MS = 5_000;
+// If a process crashes while holding the lock, the lock file would
+// otherwise block every future write forever. Treat a lock older than this
+// as abandoned and reclaim it.
+const STALE_LOCK_MS = 30_000;
+function lockFile() {
+    return claimsFile() + ".lock";
+}
+/** Resolves after `ms` real milliseconds — yields control back to the event loop, unlike a spin loop. */
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// Errno codes that mean "could not create the lock file right now because
+// someone else is touching it" and are therefore worth retrying, rather
+// than "something is actually wrong" and worth throwing immediately.
+// EEXIST is the expected, documented case (another process holds the
+// lock). EPERM is included too: on Windows/NTFS, deleting a file (as
+// releaseLock() does) can leave it briefly in a "pending delete" state, and
+// a `wx`-mode open racing against that transition can surface as EPERM
+// rather than either a clean success or a clean EEXIST. Found empirically
+// (2026-08-31) while writing bench/event-loop-non-blocking.mjs: 25
+// concurrent in-process callers all racing to re-acquire a just-released
+// lock intermittently hit this, and — before this was added — it threw
+// past the retry loop entirely, turning ordinary contention into a hard
+// failure instead of a bounded wait. Reproduces identically on the
+// pre-async-fix synchronous code too, so this is not something the
+// busy-wait -> async change introduced; it is a pre-existing Windows-only
+// gap in what counted as "retryable" that this same fix pass closed.
+function isRetryableLockError(e) {
+    const code = e.code;
+    return code === "EEXIST" || code === "EPERM";
+}
+async function acquireLock(path) {
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    for (;;) {
+        try {
+            closeSync(openSync(path, "wx"));
+            return;
+        }
+        catch (e) {
+            if (!isRetryableLockError(e))
+                throw e;
+            try {
+                if (Date.now() - statSync(path).mtimeMs > STALE_LOCK_MS) {
+                    unlinkSync(path);
+                    continue;
+                }
+            }
+            catch {
+                // Lock file vanished between our failed open() and this stat/unlink
+                // — another process released it. Just retry the open immediately.
+                continue;
+            }
+            if (Date.now() > deadline) {
+                throw new Error(`ledger_lock_timeout: could not acquire lock at ${path}`);
+            }
+            // Non-blocking backoff: await a real timer instead of spinning, so the
+            // event loop stays free to process other work (timers, other
+            // requests) while this call is waiting for the lock.
+            await delay(LOCK_RETRY_DELAY_MS);
+        }
+    }
+}
+function releaseLock(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        // Already gone (e.g. reclaimed as stale by another process) — fine.
+    }
+}
+// THIRD FIX (2026-08-31, same day, found by an adversarial verifier): the
+// function this comment used to describe (readClaims()) re-read and
+// re-validated the ENTIRE ledger file, through zod, on every single call —
+// appendClaim() (for its duplicate-claimId check) AND claimsForSeller()/
+// allClaims(). Cost is linear in TOTAL ledger size, and since this ledger is
+// explicitly append-only, permanent history (nothing is ever deleted — see
+// this file's header comment), that cost only grows over the service's
+// lifetime, never shrinks. Measured empirically before this fix: 903ms of
+// unbroken event-loop freeze at 40,000 lines for a single call with zero
+// contention; under real lock contention against a 5,000-line ledger with 10
+// concurrent callers, a single continuous 526ms stretch where the event loop
+// processed nothing at all. In this package's real deployment shape (a
+// single long-lived Node process, no clustering — see x402-server.mjs), that
+// is every other in-flight request on the process freezing for over half a
+// second, every time anyone records a delivery, and it gets worse forever.
+//
+// Fix: an in-memory cache, per resolved ledger file path (NOT a single
+// global — CAPACITY_ATTEST_DATA_DIR differs between tests/instances, so
+// keying by path is what makes this correct for more than one ledger file
+// per process), holding the already-parsed-and-validated claims plus two
+// indexes built for the two things this module actually needs to answer
+// fast: a claimId Set (appendClaim()'s duplicate check) and a
+// sellerAddress -> claims[] Map (claimsForSeller()). Each cache entry also
+// carries the ledger file's byte size AT THE MOMENT it was built.
+//
+// On every call, a cheap `statSync` (no parsing) compares the file's CURRENT
+// byte size against the cached size. Byte size, not mtime: filesystem mtime
+// resolution can be coarse enough on some platforms that two real writes
+// within the same tick look unchanged to an mtime check — that would be a
+// silent-stale-read correctness bug, not just a missed optimization.
+// Unchanged size -> the cache is used as-is, no disk read, no re-parse, no
+// re-validation: this is the fast path this fix exists to add. Changed size
+// -> the file was written since our cache was built (by another process, or
+// by our own appendClaim() before it started updating the cache in-place —
+// see below), so the cache is stale and gets rebuilt from disk.
+//
+// LOCK-VS-STALENESS-CHECK ORDERING (the part that is easy to get backwards
+// and silently reintroduce the original duplicate-claim race): appendClaim()
+// does its staleness check/resync AFTER acquireLock(), never before. If it
+// checked staleness first and only acquired the lock afterward, there would
+// be a TOCTOU gap between "we decided the cache is fresh" and "we hold the
+// lock" during which another process could append — our now-actually-stale
+// cache would then pass the duplicate check against a claimId set that is
+// missing that concurrent write, and two processes could both believe they
+// won the race, exactly the bug the lock was built to close in the first
+// fix. Doing the freshness check (and, if needed, the resync) INSIDE the
+// locked section instead means: by the time appendClaim() looks at the
+// cache, no other process can be mid-write against this file (the lock
+// serializes that), so the cache, once confirmed fresh (or just rebuilt),
+// stays a true reflection of on-disk state for the rest of the critical
+// section — there is no gap left for a concurrent writer to hide in. The
+// cache is therefore a performance layer INSIDE the lock's critical section,
+// never a substitute for it; duplicate-claimId safety still comes 100% from
+// the lock, exactly as before this fix.
+//
+// claimsForSeller()/allClaims() do NOT take the lock (same as before this
+// fix — see the original comment this one replaces), because their
+// correctness need is different: they don't need atomicity with a
+// concurrent write, they just need to reflect a recent, self-consistent
+// on-disk state at the time they're called. The same statSync-based
+// staleness check gives them that: right after another process (or our own
+// appendClaim()) writes, the file's size changes, so the very next
+// claimsForSeller()/allClaims() call resyncs instead of trusting a now-stale
+// cache. This is exactly the "process A warm cache, process B writes
+// directly, process A must see it" scenario the new
+// cross-process-cache-invalidation test in ledger.test.ts exercises.
+//
+// The resync-from-disk path is still fundamentally O(n) — unavoidable if the
+// true on-disk state must be validated — but two things change: (1) it is
+// now the EXCEPTION (only when the file actually changed underneath us),
+// not the norm (every call, regardless); (2) it no longer holds the event
+// loop hostage for its full duration in one stretch — resyncFromDisk()
+// processes lines in RESYNC_BATCH_SIZE-sized batches and `await`s a real
+// setImmediate between batches, bounding any single blocking stretch to
+// roughly one batch's cost rather than the whole file's, the same
+// non-blocking-yield pattern the previous fix in this file applied to lock
+// contention.
+//
+// Concurrent-resync safety within one process: resyncFromDisk() builds its
+// claims array / claimId Set / sellerAddress Map into a brand-new object and
+// only publishes it (a single synchronous Map.set on cacheByPath) once
+// fully built — so a reader that hits the fast path mid-resync sees either
+// the old (stale but internally consistent) cache or the new one, never a
+// half-populated one. If two callers in the same process both observe
+// staleness at once (e.g. a concurrent appendClaim() and claimsForSeller()),
+// they share ONE in-flight resync via pendingResyncs rather than each
+// starting their own redundant O(n) pass.
+//
+// Verified after this fix: bench/ledger-scale.mjs (rewritten for this fix)
+// shows append/history calls after the first one at a given N running in
+// well under a millisecond instead of growing linearly with ledger size;
+// bench/ledger-concurrency.mjs still shows 0% duplicates and 0 lost writes
+// under real multi-process contention (unchanged from the previous fix);
+// bench/event-loop-non-blocking.mjs (the previous fix's proof) still passes
+// unmodified, confirming this fix did not reintroduce event-loop blocking on
+// the lock-wait path it already fixed.
+const RESYNC_BATCH_SIZE = 500;
+function emptyCache() {
+    return { size: 0, claims: [], claimIdSet: new Set(), bySeller: new Map() };
+}
+// Keyed by resolved ledger file path, not a single global — tests (and any
+// future multi-tenant use) point CAPACITY_ATTEST_DATA_DIR at different
+// directories within the same process, and a single shared cache variable
+// would silently serve one ledger's data for another's calls.
+const cacheByPath = new Map();
+// De-duplicates concurrent resyncs of the SAME path within one process: if
+// two callers both observe staleness before either resync finishes, the
+// second joins the first's in-flight Promise instead of redoing the O(n)
+// work itself.
+const pendingResyncs = new Map();
+/** Yields control back to the event loop — used between resync batches. */
+function yieldToEventLoop() {
+    return new Promise((resolve) => setImmediate(resolve));
+}
+function timestampMs(claim) {
+    return Date.parse(claim.timestamp);
+}
+// WHY THE CACHE KEEPS claims/bySeller PRE-SORTED, INSTEAD OF SORTING AT READ
+// TIME (which is what the pre-cache readClaims()-based code did, and what an
+// earlier draft of THIS fix also did): claimsForSeller()/allClaims() are
+// exactly the calls this whole fix is about making cheap on the warm path.
+// Re-running `.sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp))`
+// on every single warm call is itself O(n log n) with an expensive
+// comparator (Date.parse() is a real date-string parse, not a cheap number
+// compare) — at N=40,000 that measured at ~13-14ms PER WARM CALL in this
+// fix's own benchmark (bench/ledger-cache-scale.mjs), 450x the N=0 floor,
+// which is not "amortized O(1) or close to it" by any reasonable reading,
+// even though it correctly skipped the disk read. So: claims/bySeller are
+// sorted ONCE per resync (still inside the O(n) resync's cost, effectively
+// free to add), and appendClaim() keeps that invariant on the warm
+// incremental-update path too, via a binary-search insert (sortedInsertIndex
+// below) instead of a plain push — O(log n) to find the position, O(n) for
+// the underlying array shift (a plain memmove of object references, not
+// re-parsing/re-validating anything), which is what turns the warm-call
+// benchmark's claimsForSeller()/allClaims() numbers into a plain array copy:
+// no comparator, no Date.parse, cost proportional only to the RESULT size,
+// not the ledger's total size.
+function sortedInsertIndex(sorted, ts) {
+    let lo = 0;
+    let hi = sorted.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        // <= keeps insertion AFTER any existing entries with an equal
+        // timestamp, so a newly appended claim with a tied timestamp lands
+        // after previously-recorded ones — the same tie-break a stable
+        // file-order sort would have produced, since this is an append-only
+        // log and the new claim is, by definition, the most recently arrived.
+        if (timestampMs(sorted[mid]) <= ts)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo;
+}
+// SIXTH FIX (2026-08-31, same day, found by adversarial verification): the
+// parse loop above correctly yields every RESYNC_BATCH_SIZE lines, but the
+// code that used to follow it — a single `decorated.sort(...)` over the
+// WHOLE array, then a single unyielded `for` loop over the WHOLE sorted
+// array to build `bySeller` — both ran as one uninterrupted synchronous
+// stretch after the batched parse loop finished. Measured: at N=50,000 that
+// unyielded tail alone was ~75ms (26ms sort + 47ms bySeller-build); at a
+// plausible future N=200,000 it was ~438ms — approaching the magnitude of
+// the original pre-cache bug (903ms at N=40,000) this entire fix exists to
+// eliminate. A plain per-batch merge (merge each newly-parsed batch into the
+// accumulated sorted result, yield between batches) would NOT actually fix
+// this: the merge step itself is O(accumulated size), so the LAST merge in a
+// large ledger would still be one unyielded O(n) stretch — the exact same
+// shape of bug, just moved earlier. What actually bounds every unyielded
+// stretch to ~one batch's cost, all the way through an O(n log n) sort, is
+// counting WORK DONE (elements written to the merge output), not batch
+// boundaries, and yielding whenever that counter crosses RESYNC_BATCH_SIZE —
+// this is what yieldingMergeSort() below does: a standard iterative
+// bottom-up merge sort (stable, like the native Array.prototype.sort() it
+// replaces — see its own comment for why <= on ties matters), except every
+// single element written into the merge output increments a shared counter
+// that triggers a real yield once it reaches RESYNC_BATCH_SIZE, regardless
+// of which pass or which pair-merge that element happened to fall in. Total
+// work is still the same O(n log n) a native sort would do; what changes is
+// that it is never done in one unbroken stretch bigger than one batch.
+async function yieldingMergeSort(items) {
+    const n = items.length;
+    if (n < 2)
+        return;
+    let src = items;
+    let dst = new Array(n);
+    let writtenSinceYield = 0;
+    for (let width = 1; width < n; width *= 2) {
+        for (let lo = 0; lo < n; lo += width * 2) {
+            const mid = Math.min(lo + width, n);
+            const hi = Math.min(lo + width * 2, n);
+            let i = lo;
+            let j = mid;
+            let k = lo;
+            while (i < mid || j < hi) {
+                // <= (not <) is what makes this stable: on a tie, the left run
+                // (which, at every level of a bottom-up merge sort, always holds
+                // elements that were earlier in the pre-sort/file order than the
+                // right run) is drained first — identical tie-break to the native
+                // stable `.sort()` this replaces.
+                if (j >= hi || (i < mid && src[i].ts <= src[j].ts)) {
+                    dst[k++] = src[i++];
+                }
+                else {
+                    dst[k++] = src[j++];
+                }
+                if (++writtenSinceYield >= RESYNC_BATCH_SIZE) {
+                    writtenSinceYield = 0;
+                    await yieldToEventLoop();
+                }
+            }
+        }
+        [src, dst] = [dst, src];
+    }
+    if (src !== items) {
+        // The last swap left the fully-sorted array in `src`, which is the
+        // scratch buffer, not the caller's `items` array — copy it back in
+        // place, itself batched/yielded for the same reason as everything else
+        // in this function: a plain unyielded `for` here over all n elements
+        // would just reintroduce the exact bug this function exists to close.
+        for (let i = 0; i < n; i++) {
+            items[i] = src[i];
+            if ((i + 1) % RESYNC_BATCH_SIZE === 0 && i + 1 < n) {
+                await yieldToEventLoop();
+            }
+        }
+    }
+}
+/**
+ * Re-reads and re-validates the entire ledger file from disk, in batches
+ * with a real yield between them so this never holds the event loop for the
+ * whole file's cost in one uninterrupted stretch. Builds a brand-new cache
+ * object and only publishes it once complete (see the header comment above
+ * for why that matters for in-process concurrent readers).
+ */
+async function resyncFromDisk(file) {
+    let content;
+    try {
+        content = readFileSync(file, "utf8");
+    }
+    catch (e) {
+        // FIFTH FIX (2026-08-31, same day, found by adversarial verification):
+        // this bare `catch` used to treat EVERY readFileSync error identically
+        // to "file doesn't exist yet" — including a transient EACCES, EBUSY,
+        // EMFILE, or a Windows sharing-violation, none of which mean the ledger
+        // is empty. Silently downgrading a real error to "empty cache" can wipe
+        // a warm, correct in-memory cache down to zero known claimIds, after
+        // which a genuine duplicate claimId would be wrongly accepted — the
+        // exact guarantee this whole module exists to protect. Only ENOENT
+        // (mirrors isRetryableLockError()'s explicit-code-check style above)
+        // means "does not exist yet, empty is the correct read"; every other
+        // error now propagates as a real thrown error instead of being eaten.
+        if (e.code !== "ENOENT")
+            throw e;
+        // Doesn't exist (or vanished) — a fresh, empty, but still validly-sized
+        // (0 bytes) cache. Matches the pre-fix behavior of readClaims()
+        // returning [] when the file doesn't exist yet.
+        const empty = emptyCache();
+        cacheByPath.set(file, empty);
+        return empty;
+    }
+    const lines = content.split("\n").filter(Boolean);
+    // Decorated with each claim's parsed timestamp so the sort below compares
+    // plain numbers instead of re-parsing every timestamp string on every
+    // comparison (an O(n log n)-times cost vs. this O(n)-times one).
+    const decorated = [];
+    const claimIdSet = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
         try {
-            return [DeliveryClaimSchema.parse(JSON.parse(line))];
+            const claim = DeliveryClaimSchema.parse(JSON.parse(line));
+            decorated.push({ claim, ts: timestampMs(claim) });
+            claimIdSet.add(claim.claimId.toLowerCase());
         }
         catch {
             // A corrupt/partial line (e.g. a truncated write) must not take down
-            // reads of the rest of the ledger.
-            return [];
+            // reads of the rest of the ledger — same tolerance as before this fix.
+        }
+        if ((i + 1) % RESYNC_BATCH_SIZE === 0 && i + 1 < lines.length) {
+            await yieldToEventLoop();
+        }
+    }
+    // Stable sort, same tie-break behavior (ties keep original file/append
+    // order) as the pre-fix code's native `.sort()` — but via
+    // yieldingMergeSort() instead, which bounds every unyielded stretch to
+    // ~RESYNC_BATCH_SIZE elements instead of running as one uninterrupted
+    // O(n log n) block. See yieldingMergeSort()'s own comment (SIXTH FIX) for
+    // why a naive per-batch merge would not actually have achieved this.
+    await yieldingMergeSort(decorated);
+    const claims = decorated.map((d) => d.claim);
+    // sellerAddress is already lower-cased by ClaimContentSchema's own
+    // .transform() (see schema.ts), so no extra normalization needed here.
+    // Iterating the now-sorted `claims` means every bucket comes out sorted
+    // too, with no separate per-seller sort needed. Batched with a yield every
+    // RESYNC_BATCH_SIZE claims (same SIXTH FIX as the sort above) instead of
+    // one unyielded pass over the whole array — building this map is itself
+    // O(n) and was part of the same measured 47ms-at-N=50,000 unyielded tail.
+    const bySeller = new Map();
+    for (let i = 0; i < claims.length; i++) {
+        const claim = claims[i];
+        const bucket = bySeller.get(claim.sellerAddress);
+        if (bucket)
+            bucket.push(claim);
+        else
+            bySeller.set(claim.sellerAddress, [claim]);
+        if ((i + 1) % RESYNC_BATCH_SIZE === 0 && i + 1 < claims.length) {
+            await yieldToEventLoop();
         }
+    }
+    // size is derived from the exact content string we just validated
+    // (Buffer.byteLength), not a separate statSync call — that would open a
+    // gap where a write between the read and the stat could make the marker
+    // disagree with what we actually parsed. This way the two can never
+    // disagree by construction.
+    const entry = { size: Buffer.byteLength(content, "utf8"), claims, claimIdSet, bySeller };
+    cacheByPath.set(file, entry);
+    return entry;
+}
+/**
+ * Returns a cache guaranteed fresh as of the moment this is called: if the
+ * on-disk file's byte size still matches what the cache was built from,
+ * returns it as-is (no disk read at all beyond the one cheap statSync).
+ * Otherwise resyncs from disk first (see resyncFromDisk()).
+ */
+async function getFreshCache(file) {
+    let diskSize;
+    try {
+        diskSize = statSync(file).size;
+    }
+    catch (e) {
+        // Same explicit-ENOENT-only reasoning as resyncFromDisk()'s catch above
+        // (FIFTH FIX) — a non-ENOENT statSync error is a real problem, not an
+        // empty ledger, and must not be swallowed into diskSize=0.
+        if (e.code !== "ENOENT")
+            throw e;
+        diskSize = 0; // file does not exist yet
+    }
+    const cached = cacheByPath.get(file);
+    if (cached && cached.size === diskSize) {
+        return cached;
+    }
+    // KNOWN LIMITATION (documented 2026-08-31, not fixed): this join does not
+    // re-check the in-flight resync's eventual `.size` against the `diskSize`
+    // measured above. If that resync was already snapshotting disk (via
+    // resyncFromDisk()'s own readFileSync) before an external, lock-bypassing
+    // writer appended a claim, and this call's own statSync happened to run
+    // after that external write, the joined resync can resolve to a cache
+    // that is already stale relative to what this caller just observed on
+    // disk. In appendClaim()'s case that means the duplicate-claimId check
+    // could pass against a claimId the external writer just added, producing
+    // a real duplicate line in the ledger. Reproduced 3/3 in adversarial
+    // testing. Low real-world severity today: this package's actual
+    // deployment (a single long-lived process holding the lockfile for every
+    // write) never has a second, lock-bypassing writer racing a resync in
+    // this exact window; the gap only opens for a future deployment shape
+    // (e.g. multiple processes/hosts sharing one CAPACITY_ATTEST_DATA_DIR,
+    // with something other than this package's own appendClaim() writing to
+    // the file directly). Fix direction if this is ever revisited: re-check
+    // `inFlight`'s resolved `.size` against `diskSize` after joining, and
+    // loop to a fresh resyncFromDisk() call if they still disagree.
+    const inFlight = pendingResyncs.get(file);
+    if (inFlight)
+        return inFlight;
+    const resync = resyncFromDisk(file).finally(() => {
+        pendingResyncs.delete(file);
     });
+    pendingResyncs.set(file, resync);
+    return resync;
 }
 /**
  * Append one already-verified claim to the ledger. Throws if a claim with
  * the same claimId was already recorded.
  */
-export function appendClaim(claim) {
-    const existing = readClaims();
-    if (existing.some((c) => c.claimId.toLowerCase() === claim.claimId.toLowerCase())) {
-        throw new Error(`claim_already_recorded: ${claim.claimId}`);
-    }
+export async function appendClaim(claim) {
     ensureDataDir();
-    appendFileSync(claimsFile(), JSON.stringify(claim) + "\n");
-    return claim;
+    const file = claimsFile();
+    const lock = lockFile();
+    await acquireLock(lock);
+    try {
+        // Freshness check happens AFTER acquiring the lock — see this file's
+        // header comment for why that ordering, not the reverse, is what keeps
+        // the duplicate-claimId guarantee intact across processes.
+        const cache = await getFreshCache(file);
+        const claimIdLower = claim.claimId.toLowerCase();
+        if (cache.claimIdSet.has(claimIdLower)) {
+            throw new Error(`claim_already_recorded: ${claim.claimId}`);
+        }
+        // FOURTH FIX (2026-08-31, same day, found by adversarial verification of
+        // the THIRD FIX above): this used to re-`statSync(file).size` right
+        // after the write below, on the theory that "exact by construction" was
+        // safer than hand-computing a delta. That reasoning was backwards: a
+        // statSync reads the file's CURRENT combined size, so if any OTHER
+        // writer — even one that doesn't respect this module's own lockfile,
+        // e.g. a second independent process doing a raw fs.appendFileSync, which
+        // this whole lock exists to defend against for the on-disk data but was
+        // never guarding OUR in-memory size marker — wrote to the same file in
+        // the narrow window between our appendFileSync and that statSync, the
+        // cache's `size` would end up matching the file's new COMBINED size
+        // while cache.claims/claimIdSet only reflect OUR write. The next
+        // getFreshCache() would then see size-matches-disk and trust a cache
+        // that is silently missing the other writer's claim — permanently,
+        // until some unrelated write happens to invalidate it again. Reproduced
+        // 4/4 runs: a duplicate claimId got accepted (should have been
+        // rejected), and claimsForSeller()/allClaims() silently omitted the
+        // externally-written claim. Fixed by computing the new size as a DELTA —
+        // old cached size + exactly the bytes of the line we ourselves just
+        // wrote — which by construction cannot be perturbed by anyone else's
+        // write landing in that window, matching resyncFromDisk()'s own
+        // Buffer.byteLength(content, "utf8") convention for what "size" means.
+        const serializedLine = JSON.stringify(claim) + "\n";
+        appendFileSync(file, serializedLine);
+        // Update the cache in place to reflect our own write, synchronously and
+        // with no `await` anywhere in this block — that's what guarantees no
+        // other same-process caller can observe a half-updated cache (JS never
+        // preempts a synchronous stretch of code). This keeps OUR process's
+        // cache warm for the next call without forcing an immediate resync, and
+        // is why repeated appendClaim()/claimsForSeller() calls from the same
+        // long-lived process stay cheap even as the ledger grows. Insertion
+        // (not push) keeps claims/bySeller sorted by timestamp at all times —
+        // see sortedInsertIndex()'s comment for why that matters.
+        const ts = timestampMs(claim);
+        cache.claims.splice(sortedInsertIndex(cache.claims, ts), 0, claim);
+        cache.claimIdSet.add(claimIdLower);
+        const bucket = cache.bySeller.get(claim.sellerAddress);
+        if (bucket)
+            bucket.splice(sortedInsertIndex(bucket, ts), 0, claim);
+        else
+            cache.bySeller.set(claim.sellerAddress, [claim]);
+        cache.size = cache.size + Buffer.byteLength(serializedLine, "utf8");
+        return claim;
+    }
+    finally {
+        releaseLock(lock);
+    }
 }
 /** All claims recorded against one seller, oldest first. */
-export function claimsForSeller(sellerAddress) {
-    return readClaims()
-        .filter((c) => c.sellerAddress.toLowerCase() === sellerAddress.toLowerCase())
-        .sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+export async function claimsForSeller(sellerAddress) {
+    const cache = await getFreshCache(claimsFile());
+    const bucket = cache.bySeller.get(sellerAddress.toLowerCase()) ?? [];
+    // bucket is already sorted (see LedgerCache's invariant) — just copy it,
+    // so a caller mutating the returned array can't corrupt the shared cache.
+    // No sort, no Date.parse, at call time: this is the whole point of the
+    // fix — cost proportional to the RESULT size, not the ledger's total size.
+    return [...bucket];
 }
 /** Every claim in the ledger, oldest first. Mainly useful for tests/inspection. */
-export function allClaims() {
-    return readClaims().sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+export async function allClaims() {
+    const cache = await getFreshCache(claimsFile());
+    return [...cache.claims];
 }
 //# sourceMappingURL=ledger.js.map

package/dist/ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,uBAAuB;AAEvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAEtE,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;SAC9B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,mCAAmC;YACnC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAoB;IAC9C,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,aAAa,EAAE,CAAC;IAChB,cAAc,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,aAAqB;IACnD,OAAO,UAAU,EAAE;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;SAC5E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACxF,CAAC"}
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,uBAAuB;AAEvB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAEtE,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,qEAAqE;AACrE,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,mEAAmE;AACnE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,oEAAoE;AACpE,0EAA0E;AAC1E,uEAAuE;AACvE,6CAA6C;AAC7C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,mEAAmE;AACnE,2EAA2E;AAC3E,+BAA+B;AAC/B,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,SAAS,QAAQ;IACf,OAAO,UAAU,EAAE,GAAG,OAAO,CAAC;AAChC,CAAC;AAED,yGAAyG;AACzG,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,4EAA4E;AAC5E,uEAAuE;AACvE,0EAA0E;AAC1E,mEAAmE;AACnE,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,mEAAmE;AACnE,0EAA0E;AAC1E,qEAAqE;AACrE,SAAS,oBAAoB,CAAC,CAAU;IACtC,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;IAC/C,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,SAAS,CAAC;QACR,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBACxD,UAAU,CAAC,IAAI,CAAC,CAAC;oBACjB,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,kEAAkE;gBAClE,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,uEAAuE;YACvE,6DAA6D;YAC7D,qDAAqD;YACrD,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,oEAAoE;AACpE,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,8DAA8D;AAC9D,2EAA2E;AAC3E,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,wCAAwC;AACxC,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,oEAAoE;AACpE,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,qEAAqE;AACrE,oDAAoD;AACpD,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,2EAA2E;AAC3E,cAAc;AACd,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,6EAA6E;AAC7E,sEAAsE;AACtE,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,uCAAuC;AAEvC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAa9B,SAAS,UAAU;IACjB,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,0EAA0E;AAC1E,8DAA8D;AAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;AACnD,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,eAAe;AACf,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAC;AAE/D,2EAA2E;AAC3E,SAAS,gBAAgB;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,kFAAkF;AAClF,mEAAmE;AACnE,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,+BAA+B;AAC/B,SAAS,iBAAiB,CAAC,MAAuB,EAAE,EAAU;IAC5D,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IACvB,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,8DAA8D;QAC9D,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,IAAI,EAAE;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC7C,EAAE,GAAG,GAAG,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,uEAAuE;AACvE,KAAK,UAAU,iBAAiB,CAAC,KAAkD;IACjF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO;IAElB,IAAI,GAAG,GAAgD,KAAK,CAAC;IAC7D,IAAI,GAAG,GAAgD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;YACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,GAAG,CAAC;YACZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzB,+DAA+D;gBAC/D,iEAAiE;gBACjE,iEAAiE;gBACjE,kEAAkE;gBAClE,kCAAkC;gBAClC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAE,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAE,CAAC;gBACvB,CAAC;gBACD,IAAI,EAAE,iBAAiB,IAAI,iBAAiB,EAAE,CAAC;oBAC7C,iBAAiB,GAAG,CAAC,CAAC;oBACtB,MAAM,gBAAgB,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QACD,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,mEAAmE;QACnE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,gBAAgB,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC;QAC5D,wEAAwE;QACxE,gEAAgE;QAChE,gDAAgD;QAChD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,0EAA0E;IAC1E,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,SAAS,GAAgD,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,uEAAuE;QACzE,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9D,MAAM,gBAAgB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0DAA0D;IAC1D,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7C,mEAAmE;IACnE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC1B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,gBAAgB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,4BAA4B;IAC5B,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACtG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC;QAC5D,QAAQ,GAAG,CAAC,CAAC,CAAC,0BAA0B;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,gEAAgE;IAChE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAC/C,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,aAAa,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,qEAAqE;QACrE,mEAAmE;QACnE,wEAAwE;QACxE,+DAA+D;QAC/D,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,gEAAgE;QAChE,uEAAuE;QACvE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACpD,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACrC,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,0DAA0D;QAC1D,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,MAAM;YAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;;YAC9D,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC"}

package/dist/schema.d.ts

@@ -3,14 +3,9 @@ export declare const ASSET_TYPES: readonly ["gpu-hours", "storage", "api-credits
 export type AssetType = (typeof ASSET_TYPES)[number];
 export declare const DELIVERED_VALUES: readonly ["yes", "no", "partial"];
 export type Delivered = (typeof DELIVERED_VALUES)[number];
-/**
- * The part of a claim that is hashed to produce claimId and that gets
- * signed. Everything in here is chosen by the buyer at claim-creation time;
- * claimId and signature (in DeliveryClaimSchema below) are derived from it.
- */
 export declare const ClaimContentSchema: z.ZodObject<{
-    sellerAddress: z.ZodString;
-    buyerAddress: z.ZodString;
+    sellerAddress: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    buyerAddress: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     assetType: z.ZodEnum<{
         "gpu-hours": "gpu-hours";
         storage: "storage";
@@ -30,8 +25,8 @@ export declare const ClaimContentSchema: z.ZodObject<{
 export type ClaimContent = z.infer<typeof ClaimContentSchema>;
 /** The full, stored, signed claim — ClaimContent plus its content-address and signature. */
 export declare const DeliveryClaimSchema: z.ZodObject<{
-    sellerAddress: z.ZodString;
-    buyerAddress: z.ZodString;
+    sellerAddress: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    buyerAddress: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     assetType: z.ZodEnum<{
         "gpu-hours": "gpu-hours";
         storage: "storage";

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,WAAW,+DAAgE,CAAC;AACzF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,eAAO,MAAM,gBAAgB,mCAAoC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAS1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;iBA0B7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AAeD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAI5D"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,WAAW,+DAAgE,CAAC;AACzF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,eAAO,MAAM,gBAAgB,mCAAoC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAoD1D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;iBA6C7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AA+BD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAI5D"}

package/dist/schema.js

@@ -5,11 +5,11 @@
 // actually arrived." It is deliberately NOT a score, rating, or judgment —
 // see README.md "Wat dit NIET is".
 //
-// GUARDRAIL (halal): assetType is a closed enum of physical/compute capacity
-// kinds. Do not add anything that looks like a financial instrument (credit,
-// loan, yield, interest-bearing balance, invoice-financing) to this file —
-// see the "HALAL GUARDRAILS" section of the project brief. If a field or enum
-// value even smells like that, leave it out.
+// GUARDRAIL (design boundary): assetType is a closed enum of physical/compute
+// capacity kinds. Do not add anything that looks like a financial instrument
+// (credit, loan, yield, interest-bearing balance, invoice-financing) to this
+// file — see the "DESIGN GUARDRAILS" section of the project brief. If a field
+// or enum value even smells like that, leave it out.
 import * as z from "zod/v4";
 import { createHash } from "node:crypto";
 export const ASSET_TYPES = ["gpu-hours", "storage", "api-credits", "bandwidth"];
@@ -25,18 +25,76 @@ const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
  * signed. Everything in here is chosen by the buyer at claim-creation time;
  * claimId and signature (in DeliveryClaimSchema below) are derived from it.
  */
+// Guardrails against two verified bugs (2026-08-31 adversarial audit):
+// - MAX_PROMISED_SPEC_STRING_LENGTH / MAX_SETTLEMENT_REF_LENGTH: without a
+//   bound, a multi-megabyte string was accepted in ~6ms, letting any caller
+//   grow the append-only ledger and every future read's memory footprint
+//   without limit.
+// - MAX_PROMISED_SPEC_JSON_BYTES: the object branch of promisedSpec has no
+//   own length check, so it needs an explicit serialized-size cap instead.
+const MAX_PROMISED_SPEC_STRING_LENGTH = 4_000;
+const MAX_SETTLEMENT_REF_LENGTH = 512;
+const MAX_PROMISED_SPEC_JSON_BYTES = 8_000;
+// Shared with sortKeysDeep() below: how deep promisedSpec may nest.
+const MAX_DEPTH = 32;
+// Iterative (non-recursive) depth check for the object branch of
+// promisedSpec, used at schema-parse time. This deliberately does NOT use
+// recursion, and deliberately runs BEFORE any JSON.stringify of the raw
+// input: an earlier version of this guard called JSON.stringify(v) directly
+// inside the refine below to enforce MAX_PROMISED_SPEC_JSON_BYTES, and that
+// call is itself a recursive walk that blew the call stack on the exact
+// pathologically-deep input it was meant to reject (caught by this
+// package's own fuzz tests). Checking depth first, with an explicit stack
+// instead of language-level recursion, closes that gap for good.
+function exceedsMaxDepth(value, maxDepth) {
+    const stack = [{ v: value, d: 0 }];
+    while (stack.length > 0) {
+        const { v, d } = stack.pop();
+        if (d > maxDepth)
+            return true;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                stack.push({ v: item, d: d + 1 });
+        }
+        else if (v !== null && typeof v === "object") {
+            for (const key of Object.keys(v)) {
+                stack.push({ v: v[key], d: d + 1 });
+            }
+        }
+    }
+    return false;
+}
 export const ClaimContentSchema = z.object({
+    // .transform(toLowerCase): a fuzz-and-benchmark audit found that
+    // computeClaimId() hashed addresses exactly as submitted while every other
+    // address comparison in this codebase (signature recovery, seller
+    // filtering) was already case-insensitive. That let the same real claim be
+    // resubmitted under a different claimId by only re-casing a hex letter,
+    // defeating appendClaim()'s claimId-based duplicate rejection. Normalizing
+    // here, once, before anything is hashed or compared, closes that gap for
+    // every consumer of this schema.
     sellerAddress: z
         .string()
         .regex(ETH_ADDRESS_RE, "sellerAddress must be a 0x-prefixed 20-byte address")
+        .transform((v) => v.toLowerCase())
         .describe("0x address of the agent/service that was paid and was supposed to deliver"),
     buyerAddress: z
         .string()
         .regex(ETH_ADDRESS_RE, "buyerAddress must be a 0x-prefixed 20-byte address")
+        .transform((v) => v.toLowerCase())
         .describe("0x address of the paying agent — must match the address recovered from `signature`"),
     assetType: z.enum(ASSET_TYPES).describe("What kind of capacity this claim is about"),
     promisedSpec: z
-        .union([z.string().min(1), z.record(z.string(), z.unknown())])
+        .union([
+        z.string().min(1).max(MAX_PROMISED_SPEC_STRING_LENGTH),
+        z.record(z.string(), z.unknown()).refine((v) => {
+            if (exceedsMaxDepth(v, MAX_DEPTH))
+                return false;
+            // Only safe to JSON.stringify for the size check once depth is
+            // bounded — see exceedsMaxDepth's comment above.
+            return Buffer.byteLength(JSON.stringify(v), "utf8") <= MAX_PROMISED_SPEC_JSON_BYTES;
+        }, `promisedSpec object exceeds the allowed nesting depth (${MAX_DEPTH}) or size (${MAX_PROMISED_SPEC_JSON_BYTES} bytes)`),
+    ])
         .describe("What the seller promised to deliver — free text or a structured object"),
     delivered: z.enum(DELIVERED_VALUES).describe("Whether what was promised actually arrived"),
     evidenceHash: z
@@ -46,6 +104,7 @@ export const ClaimContentSchema = z.object({
     settlementRef: z
         .string()
         .min(1, "settlementRef is required (x402 payment reference or on-chain tx hash)")
+        .max(MAX_SETTLEMENT_REF_LENGTH)
         .describe("x402 payment reference or on-chain tx hash for the settlement this claim is about"),
     timestamp: z
         .string()
@@ -70,16 +129,32 @@ export const DeliveryClaimSchema = ClaimContentSchema.extend({
  * sorted.
  */
 export function canonicalize(value) {
-    return JSON.stringify(sortKeysDeep(value));
+    return JSON.stringify(sortKeysDeep(value, 0));
 }
-function sortKeysDeep(value) {
+// A fuzz audit found that a promisedSpec nested a few thousand levels deep
+// (no valid signature required — this runs before signature verification)
+// crashes the process with an uncaught RangeError instead of the normal
+// {ok:false, reason} response every other invalid claim gets. MAX_DEPTH
+// (declared above, shared with the schema-level guard on promisedSpec)
+// turns that crash into a clean, catchable Error well before the engine's
+// own call-stack limit, however it's shaped (objects or arrays) — kept here
+// too as defense-in-depth in case computeClaimId is ever called on content
+// that bypassed schema validation.
+function sortKeysDeep(value, depth) {
+    if (depth > MAX_DEPTH) {
+        throw new Error(`promisedSpec nesting exceeds max depth of ${MAX_DEPTH}`);
+    }
     if (Array.isArray(value))
-        return value.map(sortKeysDeep);
+        return value.map((v) => sortKeysDeep(v, depth + 1));
     if (value !== null && typeof value === "object") {
         const input = value;
-        const out = {};
+        // Object.create(null) has no inherited `__proto__` accessor, so a key
+        // literally named "__proto__" becomes a normal own property instead of
+        // silently reassigning out's prototype (and vanishing from the hashed
+        // output) the way `out["__proto__"] = ...` would on a plain {} object.
+        const out = Object.create(null);
         for (const key of Object.keys(input).sort()) {
-            out[key] = sortKeysDeep(input[key]);
+            out[key] = sortKeysDeep(input[key], depth + 1);
         }
         return out;
     }

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,6CAA6C;AAE7C,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,CAAU,CAAC;AAGzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAU,CAAC;AAGlE,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,KAAK,CAAC,cAAc,EAAE,qDAAqD,CAAC;SAC5E,QAAQ,CAAC,2EAA2E,CAAC;IACxF,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,cAAc,EAAE,oDAAoD,CAAC;SAC3E,QAAQ,CAAC,oFAAoF,CAAC;IACjG,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACpF,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SAC7D,QAAQ,CAAC,wEAAwE,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC1F,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,aAAa,EAAE,uEAAuE,CAAC;SAC7F,QAAQ,CAAC,sHAAsH,CAAC;IACnI,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,wEAAwE,CAAC;SAChF,QAAQ,CAAC,mFAAmF,CAAC;IAChG,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,gDAAgD,CAAC;SAC7F,QAAQ,CAAC,gDAAgD,CAAC;CAC9D,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAC3D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACrE,QAAQ,CAAC,0GAA0G,CAAC;IACvH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,YAAY,EAAE,yDAAyD,CAAC;SAC9E,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,qDAAqD;AAErD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,CAAU,CAAC;AAGzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAU,CAAC;AAGlE,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;GAIG;AACH,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,mBAAmB;AACnB,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAC9C,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,oEAAoE;AACpE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,iEAAiE;AACjE,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,mEAAmE;AACnE,0EAA0E;AAC1E,iEAAiE;AACjE,SAAS,eAAe,CAAC,KAAc,EAAE,QAAgB;IACvD,MAAM,KAAK,GAAqC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC9B,IAAI,CAAC,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAG,CAA6B,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,iEAAiE;IACjE,2EAA2E;IAC3E,kEAAkE;IAClE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,iCAAiC;IACjC,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,KAAK,CAAC,cAAc,EAAE,qDAAqD,CAAC;SAC5E,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACjC,QAAQ,CAAC,2EAA2E,CAAC;IACxF,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,cAAc,EAAE,oDAAoD,CAAC;SAC3E,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACjC,QAAQ,CAAC,oFAAoF,CAAC;IACjG,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACpF,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC;QACL,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7C,IAAI,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChD,+DAA+D;YAC/D,iDAAiD;YACjD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,4BAA4B,CAAC;QACtF,CAAC,EAAE,0DAA0D,SAAS,cAAc,4BAA4B,SAAS,CAAC;KAC3H,CAAC;SACD,QAAQ,CAAC,wEAAwE,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC1F,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,aAAa,EAAE,uEAAuE,CAAC;SAC7F,QAAQ,CAAC,sHAAsH,CAAC;IACnI,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,wEAAwE,CAAC;SAChF,GAAG,CAAC,yBAAyB,CAAC;SAC9B,QAAQ,CAAC,mFAAmF,CAAC;IAChG,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,gDAAgD,CAAC;SAC7F,QAAQ,CAAC,gDAAgD,CAAC;CAC9D,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAC3D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACrE,QAAQ,CAAC,0GAA0G,CAAC;IACvH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,YAAY,EAAE,yDAAyD,CAAC;SAC9E,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,mCAAmC;AACnC,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,GAAG,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC"}

package/dist/tools.d.ts

@@ -10,8 +10,14 @@ export type RecordDeliveryResult = {
  * Validate the claim's schema, verify its signature (must recover to
  * buyerAddress), and persist it to the append-only ledger. This is the
  * logic behind the `record_delivery` MCP tool.
+ *
+ * Async because appendClaim() is: its lock-contention retry awaits a real
+ * timer instead of busy-waiting, so this function must be awaited by every
+ * caller — an un-awaited call here would let the caller's next statement
+ * run before the claim is actually locked/checked/written, reordering the
+ * exact read-check-write sequence the lock exists to make atomic.
  */
-export declare function recordDelivery(input: unknown): RecordDeliveryResult;
+export declare function recordDelivery(input: unknown): Promise<RecordDeliveryResult>;
 export interface DeliveryHistoryResult {
     sellerAddress: string;
     count: number;
@@ -22,6 +28,8 @@ export interface DeliveryHistoryResult {
  * oldest first. Purely factual — no aggregate score, rating, or reputation
  * judgment is computed here; see README.md "Wat dit NIET is". This is the
  * logic behind the `get_delivery_history` MCP tool.
+ *
+ * Async to match claimsForSeller()'s now-async signature (see ledger.ts).
  */
-export declare function getDeliveryHistory(sellerAddress: string): DeliveryHistoryResult;
+export declare function getDeliveryHistory(sellerAddress: string): Promise<DeliveryHistoryResult>;
 //# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAMA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAItE,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAmBnE;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,qBAAqB,CAG/E"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAMA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAItE,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA4BlF;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAG9F"}

package/dist/tools.js

@@ -10,19 +10,35 @@ import { appendClaim, claimsForSeller } from "./ledger.js";
  * Validate the claim's schema, verify its signature (must recover to
  * buyerAddress), and persist it to the append-only ledger. This is the
  * logic behind the `record_delivery` MCP tool.
+ *
+ * Async because appendClaim() is: its lock-contention retry awaits a real
+ * timer instead of busy-waiting, so this function must be awaited by every
+ * caller — an un-awaited call here would let the caller's next statement
+ * run before the claim is actually locked/checked/written, reordering the
+ * exact read-check-write sequence the lock exists to make atomic.
  */
-export function recordDelivery(input) {
+export async function recordDelivery(input) {
     const parsed = DeliveryClaimSchema.safeParse(input);
     if (!parsed.success) {
         return { ok: false, reason: `invalid_claim: ${parsed.error.issues.map((i) => i.message).join("; ")}` };
     }
     const claim = parsed.data;
-    const verdict = verifyClaim(claim);
+    let verdict;
+    try {
+        verdict = verifyClaim(claim);
+    }
+    catch (e) {
+        // computeClaimId() (called inside verifyClaim, before any signature is
+        // even checked) can throw on pathological input, e.g. promisedSpec
+        // nested past schema.ts's MAX_DEPTH. That must degrade to the tool's
+        // normal error contract, not an uncaught exception.
+        return { ok: false, reason: `invalid_claim: ${e.message}` };
+    }
     if (!verdict.ok) {
         return { ok: false, reason: `signature_invalid: ${verdict.reason}` };
     }
     try {
-        appendClaim(claim);
+        await appendClaim(claim);
     }
     catch (e) {
         return { ok: false, reason: e.message };
@@ -34,9 +50,11 @@ export function recordDelivery(input) {
  * oldest first. Purely factual — no aggregate score, rating, or reputation
  * judgment is computed here; see README.md "Wat dit NIET is". This is the
  * logic behind the `get_delivery_history` MCP tool.
+ *
+ * Async to match claimsForSeller()'s now-async signature (see ledger.ts).
  */
-export function getDeliveryHistory(sellerAddress) {
-    const claims = claimsForSeller(sellerAddress);
+export async function getDeliveryHistory(sellerAddress) {
+    const claims = await claimsForSeller(sellerAddress);
     return { sellerAddress, count: claims.length, claims };
 }
 //# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,4BAA4B;AAE5B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI3D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9C,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,4BAA4B;AAE5B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI3D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,IAAI,OAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,oDAAoD;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAmB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9C,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB;IAC5D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACpD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "capacity-attest",
-  "version": "0.1.0",
-  "description": "MCP server for capacity-delivery attestations: after an x402 payment for compute capacity (GPU-hours, storage, API credits, bandwidth), the paying agent leaves a signed, factual claim of what was actually delivered — so other agents can check a seller's delivery history before paying. No reputation score, no judgment, no financial instrument.",
+  "version": "0.1.2",
+  "description": "MCP server for capacity-delivery attestations: after an x402 payment for compute capacity (GPU-hours, storage, API credits, bandwidth), the paying agent leaves a signed, factual claim of what was actually delivered, so other agents can check a seller's delivery history before paying. No reputation score, no judgment, no financial instrument.",
   "keywords": [
     "mcp",
     "model-context-protocol",
@@ -18,14 +18,14 @@
   "homepage": "https://tokenizen.nl",
   "repository": {
     "type": "git",
-    "url": "https://github.com/holistis/tokenizen.git",
+    "url": "git+https://github.com/holistis/tokenizen.git",
     "directory": "packages/capacity-attest"
   },
   "mcpName": "io.github.holistis/capacity-attest",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
-    "capacity-attest": "./dist/index.js"
+    "capacity-attest": "dist/index.js"
   },
   "files": [
     "dist",
@@ -50,6 +50,6 @@
     "@types/node": "^22.10.5",
     "tsx": "^4.19.2",
     "typescript": "^5.7.3",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.11"
   }
 }