inamprotocol 0.13.0 → 0.15.0

package/dist/a2a.d.ts

@@ -0,0 +1,52 @@
+import type { InamClient } from "./client.js";
+import type { AgentRecord, ReputationResult } from "./types.js";
+import { type X402Policy } from "./x402.js";
+/** INAM reputation on an A2A Agent Card (SPEC.md §11.3).
+ *
+ * A data-only A2A extension: the card names its INAM ID, and a client
+ * accepts it only if that ID has, with its own key, linked the same service
+ * endpoint (`linked.a2a_endpoint`, SPEC.md §2). Both sides name each other,
+ * so a card can't borrow a reputable agent's ID and an ID can't adopt
+ * someone else's endpoint. */
+export declare const INAM_A2A_EXTENSION_URI = "https://inamprotocol.org/ext/a2a/v1";
+export type A2APolicy = X402Policy;
+export interface A2ADecision {
+    allow: boolean;
+    reason: string;
+    did?: string;
+    reputation?: ReputationResult;
+}
+interface AgentExtension {
+    uri: string;
+    params?: {
+        did?: unknown;
+    };
+}
+/** The parts of an A2A Agent Card this check reads: v1.0 `supportedInterfaces`, v0.3 `url`/`additionalInterfaces`. */
+export interface A2AAgentCardLike {
+    url?: string;
+    supportedInterfaces?: {
+        url: string;
+    }[];
+    additionalInterfaces?: {
+        url: string;
+    }[];
+    capabilities?: {
+        extensions?: AgentExtension[];
+    };
+}
+/** The `capabilities.extensions` entry an agent adds to its card. Never `required`: it is data-only. */
+export declare function inamA2AExtension(did: string): {
+    uri: string;
+    description: string;
+    required: boolean;
+    params: {
+        did: string;
+    };
+};
+export declare function cardEndpoints(card: A2AAgentCardLike): string[];
+/** Pure check, for callers that already fetched the agent and its reputation. */
+export declare function decideA2A(card: A2AAgentCardLike, agent: AgentRecord, reputation: ReputationResult, policy?: A2APolicy): A2ADecision;
+/** Reads the INAM extension off a card and checks it against the registry `inam` points at. */
+export declare function verifyA2ACard(card: A2AAgentCardLike, inam: InamClient, policy?: A2APolicy): Promise<A2ADecision>;
+export {};

package/dist/a2a.js

@@ -0,0 +1,58 @@
+import { policyFailure } from "./x402.js";
+/** INAM reputation on an A2A Agent Card (SPEC.md §11.3).
+ *
+ * A data-only A2A extension: the card names its INAM ID, and a client
+ * accepts it only if that ID has, with its own key, linked the same service
+ * endpoint (`linked.a2a_endpoint`, SPEC.md §2). Both sides name each other,
+ * so a card can't borrow a reputable agent's ID and an ID can't adopt
+ * someone else's endpoint. */
+export const INAM_A2A_EXTENSION_URI = "https://inamprotocol.org/ext/a2a/v1";
+/** The `capabilities.extensions` entry an agent adds to its card. Never `required`: it is data-only. */
+export function inamA2AExtension(did) {
+    return {
+        uri: INAM_A2A_EXTENSION_URI,
+        description: "This agent's INAM ID. Verify it links this endpoint, then read its receipt-based reputation.",
+        required: false,
+        params: { did },
+    };
+}
+function normalize(u) {
+    try {
+        return new URL(u).href.replace(/\/+$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+export function cardEndpoints(card) {
+    return [card.url, ...(card.supportedInterfaces ?? []), ...(card.additionalInterfaces ?? [])]
+        .map((x) => (typeof x === "string" ? x : x?.url))
+        .filter((x) => typeof x === "string");
+}
+/** Pure check, for callers that already fetched the agent and its reputation. */
+export function decideA2A(card, agent, reputation, policy = {}) {
+    const base = { did: agent.id, reputation };
+    if (agent.revokedAt)
+        return { ...base, allow: false, reason: "INAM ID is revoked" };
+    const linked = agent.linked.a2a_endpoint && normalize(agent.linked.a2a_endpoint);
+    if (!linked || !cardEndpoints(card).some((u) => normalize(u) === linked)) {
+        return { ...base, allow: false, reason: "no endpoint on this card is the a2a_endpoint the INAM ID linked" };
+    }
+    const failed = policyFailure(reputation, policy);
+    return failed ? { ...base, allow: false, reason: failed } : { ...base, allow: true, reason: "ok" };
+}
+/** Reads the INAM extension off a card and checks it against the registry `inam` points at. */
+export async function verifyA2ACard(card, inam, policy = {}) {
+    const did = card.capabilities?.extensions?.find((e) => e.uri === INAM_A2A_EXTENSION_URI)?.params?.did;
+    if (typeof did !== "string")
+        return { allow: false, reason: "card names no INAM ID" };
+    let agent, reputation;
+    try {
+        [agent, reputation] = await Promise.all([inam.getAgent(did), inam.getReputation(did)]);
+    }
+    catch {
+        return { allow: false, did, reason: "INAM ID not found in the registry" };
+    }
+    return decideA2A(card, agent, reputation, policy);
+}
+//# sourceMappingURL=a2a.js.map

package/dist/a2a.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a.js","sourceRoot":"","sources":["../src/a2a.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAmB,MAAM,WAAW,CAAC;AAE3D;;;;;;8BAM8B;AAE9B,MAAM,CAAC,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAoB5E,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO;QACL,GAAG,EAAE,sBAAsB;QAC3B,WAAW,EAAE,8FAA8F;QAC3G,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,EAAE,GAAG,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAsB;IAClD,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAsB,EAAE,KAAkB,EAAE,UAA4B,EAAE,SAAoB,EAAE;IACxH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAsB,EAAE,IAAgB,EAAE,SAAoB,EAAE;IAClG,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC;IACtG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACtF,IAAI,KAAkB,EAAE,UAA4B,CAAC;IACrD,IAAI,CAAC;QACH,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/index.d.ts

@@ -11,3 +11,7 @@ export { type TransparencyEntryType, payloadHash } from "./core/transparencyLog.
 export { type AttestationVerdict, type EvidenceLevel, type EvidenceDimensions } from "./core/attestation.js";
 export { registerAgentSchema, linkChallengeSchema, linkSchema, postJobSchema, offerSchema, acceptOfferSchema, draftReceiptSchema, countersignSchema, disputeSchema, submitVerificationSchema, setVerifierStatusSchema, } from "./core/schemas.js";
 export type { LinkedIdentities, ExternalKeyType, LinkChallenge, AgentRecord, VerificationMethod, ReceiptOutcome, ReceiptStatus, DisputeStatus, ExecutionReceipt, SignableReceiptContent, ReputationComponents, ReputationRoleBreakdown, ReputationResult, JobStatus, JobOffer, JobRecord, IndependentVerificationMethod, VerificationResult, VerificationRecord, } from "./types.js";
+export { INAM_X402_EXTENSION, inamX402Extension, decideX402, withInamX402Gate, X402PaymentBlocked } from "./x402.js";
+export type { X402Policy, X402Decision } from "./x402.js";
+export { INAM_A2A_EXTENSION_URI, inamA2AExtension, decideA2A, verifyA2ACard, cardEndpoints } from "./a2a.js";
+export type { A2APolicy, A2ADecision, A2AAgentCardLike } from "./a2a.js";

package/dist/index.js

@@ -20,4 +20,6 @@ export { payloadHash } from "./core/transparencyLog.js";
 // publicly too: a caller building requests by hand (rather than through
 // InamClient) can validate a payload client-side before sending it.
 export { registerAgentSchema, linkChallengeSchema, linkSchema, postJobSchema, offerSchema, acceptOfferSchema, draftReceiptSchema, countersignSchema, disputeSchema, submitVerificationSchema, setVerifierStatusSchema, } from "./core/schemas.js";
+export { INAM_X402_EXTENSION, inamX402Extension, decideX402, withInamX402Gate, X402PaymentBlocked } from "./x402.js";
+export { INAM_A2A_EXTENSION_URI, inamA2AExtension, decideA2A, verifyA2ACard, cardEndpoints } from "./a2a.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,OAAO,GAER,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,mCAAmC,EACnC,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE5G,qEAAqE;AACrE,yEAAyE;AACzE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAExF,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAEvI,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,0CAA0C;AAC1C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAA8B,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGpF,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,OAAO,GAER,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,mCAAmC,EACnC,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE5G,qEAAqE;AACrE,yEAAyE;AACzE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAExF,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAEvI,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,0CAA0C;AAC1C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAA8B,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGpF,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAuB3B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAErH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}

package/dist/x402.d.ts

@@ -0,0 +1,59 @@
+import type { InamClient } from "./client.js";
+import type { AgentRecord, ReputationResult } from "./types.js";
+import type { EvidenceLevel } from "./core/attestation.js";
+/** "Verify before you pay" for x402 v2 (SPEC.md §11.2).
+ *
+ * A paid resource names its INAM ID in the 402's `extensions.inam`. Before any
+ * payment is signed, the gate checks that this ID proved control of the
+ * `payTo` address (`linked.erc8004_id`, SPEC.md §2.1), and that its
+ * reputation meets the caller's policy. Without that binding a server could
+ * borrow a reputable agent's DID while routing the money elsewhere. */
+export declare const INAM_X402_EXTENSION = "inam";
+export interface X402Policy {
+    /** Minimum `trustScore` (0-100, SPEC.md §5.3). Default 0. */
+    minTrustScore?: number;
+    /** Minimum evidence behind the history. Default "countersigned". */
+    minEvidence?: EvidenceLevel;
+}
+export interface X402Decision {
+    allow: boolean;
+    reason: string;
+    did?: string;
+    reputation?: ReputationResult;
+}
+/** The `extensions` entry a paid server adds to its PaymentRequired object. */
+export declare function inamX402Extension(did: string): {
+    inam: {
+        info: {
+            did: string;
+        };
+        schema: {
+            $schema: string;
+            type: string;
+            properties: {
+                did: {
+                    type: string;
+                    pattern: string;
+                };
+            };
+            required: string[];
+        };
+    };
+};
+/** Pure policy check, usable without the fetch wrapper. */
+export declare function decideX402(agent: AgentRecord, reputation: ReputationResult, payTo: string[], policy?: X402Policy): X402Decision;
+/** Why `reputation` misses `policy`, or null if it meets it. Shared with the A2A check (§11.3). */
+export declare function policyFailure(reputation: ReputationResult, policy?: X402Policy): string | null;
+export declare class X402PaymentBlocked extends Error {
+    readonly decision: X402Decision;
+    constructor(decision: X402Decision);
+}
+/** Wraps `fetch` so x402 402 responses are checked before a payment wrapper
+ * sees them. Compose it *inside* the payment wrapper:
+ *
+ *   const pay = wrapFetchWithPayment(withInamX402Gate(fetch, inam, policy), signer);
+ *
+ * Blocked payees throw `X402PaymentBlocked`, so nothing is signed. Allowed
+ * ones are passed on with `accepts` narrowed to the bound `payTo`, so the
+ * payment wrapper can't pick an unverified destination. */
+export declare function withInamX402Gate(inner: typeof fetch, inam: InamClient, policy?: X402Policy): typeof fetch;

package/dist/x402.js

@@ -0,0 +1,97 @@
+/** "Verify before you pay" for x402 v2 (SPEC.md §11.2).
+ *
+ * A paid resource names its INAM ID in the 402's `extensions.inam`. Before any
+ * payment is signed, the gate checks that this ID proved control of the
+ * `payTo` address (`linked.erc8004_id`, SPEC.md §2.1), and that its
+ * reputation meets the caller's policy. Without that binding a server could
+ * borrow a reputable agent's DID while routing the money elsewhere. */
+export const INAM_X402_EXTENSION = "inam";
+const EVIDENCE_RANK = { none: 0, countersigned: 1, independently_verified: 2 };
+/** The `extensions` entry a paid server adds to its PaymentRequired object. */
+export function inamX402Extension(did) {
+    return {
+        [INAM_X402_EXTENSION]: {
+            info: { did },
+            schema: {
+                $schema: "https://json-schema.org/draft/2020-12/schema",
+                type: "object",
+                properties: { did: { type: "string", pattern: "^did:key:" } },
+                required: ["did"],
+            },
+        },
+    };
+}
+/** Pure policy check, usable without the fetch wrapper. */
+export function decideX402(agent, reputation, payTo, policy = {}) {
+    const base = { did: agent.id, reputation };
+    if (agent.revokedAt)
+        return { ...base, allow: false, reason: "payee INAM ID is revoked" };
+    const bound = agent.linked.erc8004_id?.toLowerCase();
+    if (!bound || !payTo.some((a) => a.toLowerCase() === bound)) {
+        return { ...base, allow: false, reason: "payTo is not an address this INAM ID proved control of" };
+    }
+    const failed = policyFailure(reputation, policy);
+    return failed ? { ...base, allow: false, reason: failed } : { ...base, allow: true, reason: "ok" };
+}
+/** Why `reputation` misses `policy`, or null if it meets it. Shared with the A2A check (§11.3). */
+export function policyFailure(reputation, policy = {}) {
+    const minEvidence = policy.minEvidence ?? "countersigned";
+    if (EVIDENCE_RANK[reputation.evidenceLevel] < EVIDENCE_RANK[minEvidence])
+        return `evidence ${reputation.evidenceLevel} is below ${minEvidence}`;
+    if (reputation.trustScore < (policy.minTrustScore ?? 0))
+        return `trustScore ${reputation.trustScore} is below ${policy.minTrustScore}`;
+    return null;
+}
+export class X402PaymentBlocked extends Error {
+    decision;
+    constructor(decision) {
+        super(`x402 payment blocked by INAM: ${decision.reason}`);
+        this.decision = decision;
+        this.name = "X402PaymentBlocked";
+    }
+}
+const b64decode = (s) => new TextDecoder().decode(Uint8Array.from(atob(s), (c) => c.charCodeAt(0)));
+const b64encode = (s) => btoa(String.fromCharCode(...new TextEncoder().encode(s)));
+/** Wraps `fetch` so x402 402 responses are checked before a payment wrapper
+ * sees them. Compose it *inside* the payment wrapper:
+ *
+ *   const pay = wrapFetchWithPayment(withInamX402Gate(fetch, inam, policy), signer);
+ *
+ * Blocked payees throw `X402PaymentBlocked`, so nothing is signed. Allowed
+ * ones are passed on with `accepts` narrowed to the bound `payTo`, so the
+ * payment wrapper can't pick an unverified destination. */
+// ponytail: x402 v2 header only; v1 (body JSON, X-PAYMENT) servers get treated as having no INAM ID.
+export function withInamX402Gate(inner, inam, policy = {}) {
+    return async (input, init) => {
+        const res = await inner(input, init);
+        if (res.status !== 402)
+            return res;
+        const header = res.headers.get("payment-required");
+        let required;
+        try {
+            required = JSON.parse(b64decode(header ?? ""));
+        }
+        catch {
+            throw new X402PaymentBlocked({ allow: false, reason: "no readable PAYMENT-REQUIRED header" });
+        }
+        const did = required.extensions?.[INAM_X402_EXTENSION]?.info?.did;
+        if (typeof did !== "string")
+            throw new X402PaymentBlocked({ allow: false, reason: "payee names no INAM ID" });
+        let agent, reputation;
+        try {
+            [agent, reputation] = await Promise.all([inam.getAgent(did), inam.getReputation(did)]);
+        }
+        catch {
+            throw new X402PaymentBlocked({ allow: false, did, reason: "payee INAM ID not found in the registry" });
+        }
+        const accepts = required.accepts ?? [];
+        const decision = decideX402(agent, reputation, accepts.map((a) => a.payTo), policy);
+        if (!decision.allow)
+            throw new X402PaymentBlocked(decision);
+        const bound = agent.linked.erc8004_id.toLowerCase();
+        const headers = new Headers(res.headers);
+        headers.set("payment-required", b64encode(JSON.stringify({ ...required, accepts: accepts.filter((a) => a.payTo.toLowerCase() === bound) })));
+        return new Response(res.body, { status: 402, statusText: res.statusText, headers });
+    };
+}
+//# sourceMappingURL=x402.js.map

package/dist/x402.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402.js","sourceRoot":"","sources":["../src/x402.ts"],"names":[],"mappings":"AAIA;;;;;;uEAMuE;AAEvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAgB1C,MAAM,aAAa,GAAkC,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;AAE9G,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO;QACL,CAAC,mBAAmB,CAAC,EAAE;YACrB,IAAI,EAAE,EAAE,GAAG,EAAE;YACb,MAAM,EAAE;gBACN,OAAO,EAAE,8CAA8C;gBACvD,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;gBAC7D,QAAQ,EAAE,CAAC,KAAK,CAAC;aAClB;SACF;KACF,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,KAAkB,EAAE,UAA4B,EAAE,KAAe,EAAE,SAAqB,EAAE;IACnH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,UAA4B,EAAE,SAAqB,EAAE;IACjF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,eAAe,CAAC;IAC1D,IAAI,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,YAAY,UAAU,CAAC,aAAa,aAAa,WAAW,EAAE,CAAC;IAChJ,IAAI,UAAU,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAAE,OAAO,cAAc,UAAU,CAAC,UAAU,aAAa,MAAM,CAAC,aAAa,EAAE,CAAC;IACvI,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAArB,YAAqB,QAAsB;QACzC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QADvC,aAAQ,GAAR,QAAQ,CAAc;QAEzC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAOD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3F;;;;;;;2DAO2D;AAC3D,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,KAAmB,EAAE,IAAgB,EAAE,SAAqB,EAAE;IAC7F,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC;QAClE,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAE9G,IAAI,KAAkB,EAAE,UAA4B,CAAC;QACrD,IAAI,CAAC;YACH,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAW,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7I,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inamprotocol",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Reference TypeScript/JavaScript SDK for the INAM Protocol — agent identity, execution receipts, jobs, and reputation",
   "type": "module",
   "main": "./dist/index.js",