inamprotocol 0.3.1 → 0.3.6

package/README.md

@@ -1,84 +1,84 @@
-# inamprotocol (TypeScript/JavaScript SDK)
-
-Reference TypeScript client for the [INAM Protocol](https://inamprotocol.org) — agent identity (`did:key`), execution receipts, jobs, and reputation. Parity with the Python SDK, [`sdk-python`](https://pypi.org/project/inamprotocol/). See [SPEC.md](https://github.com/inamprotocol/inam-protocol/blob/main/SPEC.md) for the full protocol specification.
-
-This package is a standalone build of the same crypto/client code the [Node reference registry server](https://github.com/inamprotocol/inam-protocol) and its Cloudflare Workers deployment run in production — not a reimplementation with its own drift risk.
-
-## Install
-
-```
-npm install inamprotocol
-```
-
-## Usage
-
-```ts
-import { InamClient, generateKeypair } from "inamprotocol";
-
-const keypair = generateKeypair();
-const client = new InamClient("https://api.inamprotocol.org", keypair);
-
-const profile = await client.registerAgent(["document-extraction"], { name: "My Agent" });
-console.log(profile.id); // did:key:z...
-
-const reputation = await client.getReputation(profile.id);
-```
-
-### Jobs (post → offer → accept → execute → receipt)
-
-```ts
-const job = await poster.postJob({ capability: "document-extraction", specHash: "sha256:..." });
-await worker.submitOffer(job.jobId, "I can do this in an hour");
-await poster.acceptOffer(job.jobId, worker.did);
-
-const receipt = await worker.submitWork(poster.did, {
-  jobId: job.jobId,
-  task: { capability: "document-extraction", specHash: "sha256:...", createdAt: new Date().toISOString() },
-  result: { outputHash: "sha256:...", completedAt: new Date().toISOString() },
-  verification: { method: "payer_confirmation", outcome: "success" },
-});
-await poster.acceptWork(receipt); // finalizes the receipt and auto-completes the job
-```
-
-`poster.cancelJob(job.jobId)` cancels a not-yet-completed job (poster only); `client.getJob(id)` / `client.searchJobs({ capability, status })` / `client.listOffers(jobId)` round out discovery.
-
-### External identity linking (challenge-response)
-
-Linking a key-derived external identity (`agentpass_id` / `aitp_id` / `passport_id`; SPEC.md §2.1) requires proving control of that external key via a single-use, ~60s challenge — a bare claim is no longer enough. `a2a_endpoint` isn't key-derived, so it skips straight to `linkIdentity(protocol, value)`.
-
-```ts
-// externalKeypair stands in for whatever key AgentPass/AITP/Passport Alliance
-// already issued this agent -- not an INAM keypair.
-const challenge = await client.requestLinkChallenge("agentpass_id", toBase64(externalKeypair.publicKey), "ed25519");
-const proof = toBase64(sign(fromHex(challenge.challenge), externalKeypair.privateKey));
-await client.completeLink("agentpass_id", "ap_my_external_id", challenge.challengeId, proof);
-```
-
-### Verification (independent attestation)
-
-A third party — anyone but the receipt's own worker (`agentB`) — can attest that a finalized receipt's output actually holds up (SPEC.md §12), feeding a reputation boost:
-
-```ts
-const verification = await verifierClient.submitVerification({
-  receiptId: receipt.receiptId,
-  method: "deterministic", // or "agent_attestation"
-  outputHash: receipt.result.outputHash,
-  result: "verified", // or "rejected"
-});
-
-await verifierClient.getVerification(verification.verificationId);
-await verifierClient.listReceiptVerifications(receipt.receiptId);
-```
-
-## What's exported
-
-`InamClient`, `generateKeypair`/`keypairFromPrivateKey`/`publicKeyToDid`/`didToPublicKey`/`sign`/`verify`/`verifyRawEd25519`/`sha256Hex`, `generateP256Keypair`/`p256Sign`/`p256Verify` (used for external-identity link-challenge proofs, SPEC.md §2.1), `canonicalize` (the canonical-JSON serializer every INAM signature is computed over), `computeReceiptId`/`buildSignableContent`, `computeVerificationId`/`buildSignableVerificationContent`, and the full set of wire-format types (`AgentRecord`, `ExecutionReceipt`, `JobRecord`, `JobOffer`, `ReputationResult`, `LinkChallenge`, `VerificationRecord`, ...).
-
-## Building from source
-
-This package's `src/` is the actual source the registry server and Worker import directly (see `../src/services/receiptService.ts` and `../worker/src/receiptService.ts`) — there is exactly one implementation of the crypto/canonicalization/receipt-content logic across all TypeScript runtimes in this repo. The Python SDK is an independently maintained, interop-tested port (see `../sdk-python/tests/test_interop.py`).
-
-```
-npm install
-npm run build   # emits dist/ (declaration + sourcemaps)
-```
+# inamprotocol (TypeScript/JavaScript SDK)
+
+Reference TypeScript client for the [INAM Protocol](https://inamprotocol.org) — agent identity (`did:key`), execution receipts, jobs, and reputation. Parity with the Python SDK, [`sdk-python`](https://pypi.org/project/inamprotocol/). See [SPEC.md](https://github.com/inamprotocol/inam-protocol/blob/main/SPEC.md) for the full protocol specification.
+
+This package is a standalone build of the same crypto/client code the [Node reference registry server](https://github.com/inamprotocol/inam-protocol) and its Cloudflare Workers deployment run in production — not a reimplementation with its own drift risk.
+
+## Install
+
+```
+npm install inamprotocol
+```
+
+## Usage
+
+```ts
+import { InamClient, generateKeypair } from "inamprotocol";
+
+const keypair = generateKeypair();
+const client = new InamClient("https://api.inamprotocol.org", keypair);
+
+const profile = await client.registerAgent(["document-extraction"], { name: "My Agent" });
+console.log(profile.id); // did:key:z...
+
+const reputation = await client.getReputation(profile.id);
+```
+
+### Jobs (post → offer → accept → execute → receipt)
+
+```ts
+const job = await poster.postJob({ capability: "document-extraction", specHash: "sha256:..." });
+await worker.submitOffer(job.jobId, "I can do this in an hour");
+await poster.acceptOffer(job.jobId, worker.did);
+
+const receipt = await worker.submitWork(poster.did, {
+  jobId: job.jobId,
+  task: { capability: "document-extraction", specHash: "sha256:...", createdAt: new Date().toISOString() },
+  result: { outputHash: "sha256:...", completedAt: new Date().toISOString() },
+  verification: { method: "payer_confirmation", outcome: "success" },
+});
+await poster.acceptWork(receipt); // finalizes the receipt and auto-completes the job
+```
+
+`poster.cancelJob(job.jobId)` cancels a not-yet-completed job (poster only); `client.getJob(id)` / `client.searchJobs({ capability, status })` / `client.listOffers(jobId)` round out discovery.
+
+### External identity linking (challenge-response)
+
+Linking a key-derived external identity (`agentpass_id` / `aitp_id` / `passport_id`; SPEC.md §2.1) requires proving control of that external key via a single-use, ~60s challenge — a bare claim is no longer enough. `a2a_endpoint` isn't key-derived, so it skips straight to `linkIdentity(protocol, value)`.
+
+```ts
+// externalKeypair stands in for whatever key AgentPass/AITP/Passport Alliance
+// already issued this agent -- not an INAM keypair.
+const challenge = await client.requestLinkChallenge("agentpass_id", toBase64(externalKeypair.publicKey), "ed25519");
+const proof = toBase64(sign(fromHex(challenge.challenge), externalKeypair.privateKey));
+await client.completeLink("agentpass_id", "ap_my_external_id", challenge.challengeId, proof);
+```
+
+### Verification (independent attestation)
+
+A third party — anyone but the receipt's own worker (`agentB`) — can attest that a finalized receipt's output actually holds up (SPEC.md §12), feeding a reputation boost:
+
+```ts
+const verification = await verifierClient.submitVerification({
+  receiptId: receipt.receiptId,
+  method: "deterministic", // or "agent_attestation"
+  outputHash: receipt.result.outputHash,
+  result: "verified", // or "rejected"
+});
+
+await verifierClient.getVerification(verification.verificationId);
+await verifierClient.listReceiptVerifications(receipt.receiptId);
+```
+
+## What's exported
+
+`InamClient`, `generateKeypair`/`keypairFromPrivateKey`/`publicKeyToDid`/`didToPublicKey`/`sign`/`verify`/`verifyRawEd25519`/`sha256Hex`, `generateP256Keypair`/`p256Sign`/`p256Verify` (used for external-identity link-challenge proofs, SPEC.md §2.1), `canonicalize` (the canonical-JSON serializer every INAM signature is computed over), `computeReceiptId`/`buildSignableContent`, `computeVerificationId`/`buildSignableVerificationContent`, and the full set of wire-format types (`AgentRecord`, `ExecutionReceipt`, `JobRecord`, `JobOffer`, `ReputationResult`, `LinkChallenge`, `VerificationRecord`, ...).
+
+## Building from source
+
+This package's `src/` is the actual source the registry server and Worker import directly (see `../src/services/receiptService.ts` and `../worker/src/receiptService.ts`) — there is exactly one implementation of the crypto/canonicalization/receipt-content logic across all TypeScript runtimes in this repo. The Python SDK is an independently maintained, interop-tested port (see `../sdk-python/tests/test_interop.py`).
+
+```
+npm install
+npm run build   # emits dist/ (declaration + sourcemaps)
+```

package/dist/client.d.ts

@@ -17,6 +17,17 @@ export declare class InamClient {
     private request;
     registerAgent(capabilities: string[], metadata?: Record<string, unknown>): Promise<AgentRecord>;
     getAgent(id: string): Promise<AgentRecord>;
+    /** Retires this client's own INAM ID (SPEC.md §2.2). One-way — a revoked
+     * ID performs no further signed operations and drops out of search. This
+     * is the key-compromise / key-rotation-off tool: an INAM ID *is* its
+     * Ed25519 key, so a leaked key can't be re-pointed, only burned. Call
+     * this while you still control the key. */
+    revoke(reason: string): Promise<AgentRecord>;
+    /** Grants or revokes `targetAgentId`'s verifier status (SPEC.md §12.3).
+     * Only succeeds when this client's own keypair is the registry's
+     * configured operator identity — anyone else gets NOT_OPERATOR. There is
+     * no self-service path to becoming a verifier. */
+    setVerifierStatus(targetAgentId: string, authorized: boolean): Promise<AgentRecord>;
     /** Links `a2a_endpoint` — the one protocol that isn't a key-derived
      * identity, so there's nothing to prove control of beyond this request's
      * own INAM signature. For `agentpass_id` / `aitp_id` / `passport_id`, use
@@ -47,6 +58,10 @@ export declare class InamClient {
     /** Called by the requester (agent_a) to accept the worker's submitted result. */
     acceptWork(receipt: ExecutionReceipt): Promise<ExecutionReceipt>;
     disputeReceipt(receiptId: string, reason: string): Promise<ExecutionReceipt>;
+    /** Withdraw a dispute this client opened (SPEC.md §4.3) — moves the receipt
+     * `disputed` -> `finalized` so it counts toward reputation again. Only the
+     * party that opened the dispute may call this, and only once. */
+    resolveDispute(receiptId: string, note?: string): Promise<ExecutionReceipt>;
     postJob(input: {
         capability: string;
         specHash: string;

package/dist/client.js

@@ -50,6 +50,25 @@ export class InamClient {
     getAgent(id) {
         return this.request("GET", `/v1/agents/${encodeURIComponent(id)}`);
     }
+    /** Retires this client's own INAM ID (SPEC.md §2.2). One-way — a revoked
+     * ID performs no further signed operations and drops out of search. This
+     * is the key-compromise / key-rotation-off tool: an INAM ID *is* its
+     * Ed25519 key, so a leaked key can't be re-pointed, only burned. Call
+     * this while you still control the key. */
+    revoke(reason) {
+        return this.request("POST", `/v1/agents/${encodeURIComponent(this.keypair.did)}/revoke`, { reason }, {
+            idempotencyKey: `revoke:${this.keypair.did}`,
+        });
+    }
+    /** Grants or revokes `targetAgentId`'s verifier status (SPEC.md §12.3).
+     * Only succeeds when this client's own keypair is the registry's
+     * configured operator identity — anyone else gets NOT_OPERATOR. There is
+     * no self-service path to becoming a verifier. */
+    setVerifierStatus(targetAgentId, authorized) {
+        return this.request("POST", `/v1/agents/${encodeURIComponent(targetAgentId)}/verifier-status`, { authorized }, {
+            idempotencyKey: `verifier-status:${targetAgentId}:${authorized}:${Date.now()}`,
+        });
+    }
     /** Links `a2a_endpoint` — the one protocol that isn't a key-derived
      * identity, so there's nothing to prove control of beyond this request's
      * own INAM signature. For `agentpass_id` / `aitp_id` / `passport_id`, use
@@ -118,6 +137,14 @@ export class InamClient {
             idempotencyKey: `dispute:${receiptId}`,
         });
     }
+    /** Withdraw a dispute this client opened (SPEC.md §4.3) — moves the receipt
+     * `disputed` -> `finalized` so it counts toward reputation again. Only the
+     * party that opened the dispute may call this, and only once. */
+    resolveDispute(receiptId, note) {
+        return this.request("POST", `/v1/receipts/${encodeURIComponent(receiptId)}/dispute/resolve`, note ? { note } : {}, {
+            idempotencyKey: `dispute-resolve:${receiptId}`,
+        });
+    }
     // ---- Jobs (SPEC.md §3) — optional pre-work discovery/offer/accept ----
     postJob(input) {
         return this.request("POST", "/v1/jobs", input, { idempotencyKey: `job:${input.capability}:${input.specHash}:${Date.now()}` });

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAYhH;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,OAAe,EACf,OAAgB;QADhB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAkC;QACvG,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC9B,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;SAC5B,CAAC;QACF,IAAI,IAAI,EAAE,cAAc;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,YAAsB,EAAE,QAAkC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;0DAGsD;IACtD,YAAY,CAAC,QAAgB,EAAE,KAAa;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAClG,cAAc,EAAE,QAAQ,QAAQ,IAAI,KAAK,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;uEAEmE;IACnE,oBAAoB,CAAC,QAAgB,EAAE,iBAAyB,EAAE,OAAwB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE;YACjI,cAAc,EAAE,kBAAkB,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED;;+DAE2D;IAC3D,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB,EAAE,cAAsB;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;YAC/H,cAAc,EAAE,QAAQ,QAAQ,IAAI,WAAW,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAyE;QACpF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,KAA0B;QAC3D,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,OAAyB;QACxC,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE;YAC9G,cAAc,EAAE,eAAe,OAAO,CAAC,SAAS,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE;YAC/F,cAAc,EAAE,WAAW,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEzE,OAAO,CAAC,KAAoH;QAC1H,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,KAA+C;QACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,KAAa,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,UAAU,KAAK,IAAI,OAAO,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;YACrF,cAAc,EAAE,UAAU,KAAK,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IAExF;;;;6EAIyE;IACzE,KAAK,CAAC,kBAAkB,CAAC,KAAwE;QAC/F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,gCAAgC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtI,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,mBAAmB,EACnB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,EAC3L,EAAE,cAAc,EAAE,gBAAgB,OAAO,CAAC,cAAc,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAYhH;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,OAAe,EACf,OAAgB;QADhB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAkC;QACvG,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC9B,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;SAC5B,CAAC;QACF,IAAI,IAAI,EAAE,cAAc;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,YAAsB,EAAE,QAAkC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;+CAI2C;IAC3C,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE;YACnG,cAAc,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;;sDAGkD;IAClD,iBAAiB,CAAC,aAAqB,EAAE,UAAmB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,EAAE;YAC7G,cAAc,EAAE,mBAAmB,aAAa,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED;;;0DAGsD;IACtD,YAAY,CAAC,QAAgB,EAAE,KAAa;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAClG,cAAc,EAAE,QAAQ,QAAQ,IAAI,KAAK,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;uEAEmE;IACnE,oBAAoB,CAAC,QAAgB,EAAE,iBAAyB,EAAE,OAAwB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE;YACjI,cAAc,EAAE,kBAAkB,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED;;+DAE2D;IAC3D,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB,EAAE,cAAsB;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;YAC/H,cAAc,EAAE,QAAQ,QAAQ,IAAI,WAAW,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAyE;QACpF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,KAA0B;QAC3D,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,OAAyB;QACxC,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE;YAC9G,cAAc,EAAE,eAAe,OAAO,CAAC,SAAS,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE;YAC/F,cAAc,EAAE,WAAW,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED;;qEAEiE;IACjE,cAAc,CAAC,SAAiB,EAAE,IAAa;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACjH,cAAc,EAAE,mBAAmB,SAAS,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEzE,OAAO,CAAC,KAAoH;QAC1H,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,KAA+C;QACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,KAAa,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,UAAU,KAAK,IAAI,OAAO,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;YACrF,cAAc,EAAE,UAAU,KAAK,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IAExF;;;;6EAIyE;IACzE,KAAK,CAAC,kBAAkB,CAAC,KAAwE;QAC/F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,gCAAgC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtI,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,mBAAmB,EACnB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,EAC3L,EAAE,cAAc,EAAE,gBAAgB,OAAO,CAAC,cAAc,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;CACF"}

package/dist/core/schemas.d.ts

@@ -0,0 +1,268 @@
+import { z } from "zod";
+/**
+ * Request-body validation schemas — the one other piece of logic every
+ * runtime in this repo must agree on precisely, same principle as
+ * canonical.ts and receiptContent.ts. Before this file existed, the Node
+ * reference server (src/routes/*.ts) validated every mutating request with
+ * these exact Zod schemas, while the Cloudflare Worker (worker/src/index.ts)
+ * only checked that each required field was *present*, never that its value
+ * was actually valid — e.g. a signed POST /v1/verifications with
+ * `{ "result": "banana", "score": 999 }` would be rejected by the Node
+ * server but accepted by the Worker, silently writing an invalid `result`
+ * value into D1 forever. Both runtimes now import from here instead of
+ * defining their own copies, so "same request -> same validation -> same
+ * error code" is a property of sharing one schema, not of two
+ * independently-maintained ones happening to agree today.
+ */
+export declare const setVerifierStatusSchema: z.ZodObject<{
+    authorized: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    authorized: boolean;
+}, {
+    authorized: boolean;
+}>;
+export declare const revokeAgentSchema: z.ZodObject<{
+    reason: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    reason: string;
+}, {
+    reason: string;
+}>;
+export declare const registerAgentSchema: z.ZodObject<{
+    capabilities: z.ZodArray<z.ZodString, "many">;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    capabilities: string[];
+    metadata?: Record<string, unknown> | undefined;
+}, {
+    capabilities: string[];
+    metadata?: Record<string, unknown> | undefined;
+}>;
+export declare const linkChallengeSchema: z.ZodObject<{
+    protocol: z.ZodEnum<["agentpass_id", "aitp_id", "passport_id"]>;
+    externalPublicKey: z.ZodString;
+    keyType: z.ZodEnum<["ed25519", "p256"]>;
+}, "strip", z.ZodTypeAny, {
+    protocol: "agentpass_id" | "aitp_id" | "passport_id";
+    externalPublicKey: string;
+    keyType: "ed25519" | "p256";
+}, {
+    protocol: "agentpass_id" | "aitp_id" | "passport_id";
+    externalPublicKey: string;
+    keyType: "ed25519" | "p256";
+}>;
+export declare const linkSchema: z.ZodObject<{
+    protocol: z.ZodEnum<["agentpass_id", "aitp_id", "passport_id", "a2a_endpoint"]>;
+    value: z.ZodString;
+    challengeId: z.ZodOptional<z.ZodString>;
+    proofSignature: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    protocol: "agentpass_id" | "aitp_id" | "passport_id" | "a2a_endpoint";
+    challengeId?: string | undefined;
+    proofSignature?: string | undefined;
+}, {
+    value: string;
+    protocol: "agentpass_id" | "aitp_id" | "passport_id" | "a2a_endpoint";
+    challengeId?: string | undefined;
+    proofSignature?: string | undefined;
+}>;
+export declare const postJobSchema: z.ZodObject<{
+    capability: z.ZodString;
+    specHash: z.ZodString;
+    budget: z.ZodOptional<z.ZodObject<{
+        amount: z.ZodOptional<z.ZodString>;
+        currency: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        amount?: string | undefined;
+        currency?: string | undefined;
+    }, {
+        amount?: string | undefined;
+        currency?: string | undefined;
+    }>>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    capability: string;
+    specHash: string;
+    budget?: {
+        amount?: string | undefined;
+        currency?: string | undefined;
+    } | undefined;
+    expiresAt?: string | undefined;
+}, {
+    capability: string;
+    specHash: string;
+    budget?: {
+        amount?: string | undefined;
+        currency?: string | undefined;
+    } | undefined;
+    expiresAt?: string | undefined;
+}>;
+export declare const offerSchema: z.ZodObject<{
+    message: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    message?: string | undefined;
+}, {
+    message?: string | undefined;
+}>;
+export declare const acceptOfferSchema: z.ZodObject<{
+    agentId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    agentId: string;
+}, {
+    agentId: string;
+}>;
+export declare const draftReceiptSchema: z.ZodObject<{
+    jobId: z.ZodString;
+    agentAId: z.ZodString;
+    task: z.ZodObject<{
+        capability: z.ZodString;
+        specHash: z.ZodString;
+        createdAt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        capability: string;
+        specHash: string;
+        createdAt: string;
+    }, {
+        capability: string;
+        specHash: string;
+        createdAt: string;
+    }>;
+    result: z.ZodObject<{
+        outputHash: z.ZodString;
+        outputUri: z.ZodOptional<z.ZodString>;
+        completedAt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        outputHash: string;
+        completedAt: string;
+        outputUri?: string | undefined;
+    }, {
+        outputHash: string;
+        completedAt: string;
+        outputUri?: string | undefined;
+    }>;
+    settlement: z.ZodOptional<z.ZodObject<{
+        amount: z.ZodOptional<z.ZodString>;
+        currency: z.ZodOptional<z.ZodString>;
+        paymentRef: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        amount?: string | undefined;
+        currency?: string | undefined;
+        paymentRef?: string | undefined;
+    }, {
+        amount?: string | undefined;
+        currency?: string | undefined;
+        paymentRef?: string | undefined;
+    }>>;
+    verification: z.ZodObject<{
+        method: z.ZodEnum<["payer_confirmation", "independent_validator", "test_suite_pass"]>;
+        verifier: z.ZodOptional<z.ZodString>;
+        outcome: z.ZodEnum<["success", "partial", "failed"]>;
+    }, "strip", z.ZodTypeAny, {
+        method: "payer_confirmation" | "independent_validator" | "test_suite_pass";
+        outcome: "success" | "partial" | "failed";
+        verifier?: string | undefined;
+    }, {
+        method: "payer_confirmation" | "independent_validator" | "test_suite_pass";
+        outcome: "success" | "partial" | "failed";
+        verifier?: string | undefined;
+    }>;
+    signature: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    jobId: string;
+    task: {
+        capability: string;
+        specHash: string;
+        createdAt: string;
+    };
+    result: {
+        outputHash: string;
+        completedAt: string;
+        outputUri?: string | undefined;
+    };
+    verification: {
+        method: "payer_confirmation" | "independent_validator" | "test_suite_pass";
+        outcome: "success" | "partial" | "failed";
+        verifier?: string | undefined;
+    };
+    agentAId: string;
+    signature: string;
+    settlement?: {
+        amount?: string | undefined;
+        currency?: string | undefined;
+        paymentRef?: string | undefined;
+    } | undefined;
+}, {
+    jobId: string;
+    task: {
+        capability: string;
+        specHash: string;
+        createdAt: string;
+    };
+    result: {
+        outputHash: string;
+        completedAt: string;
+        outputUri?: string | undefined;
+    };
+    verification: {
+        method: "payer_confirmation" | "independent_validator" | "test_suite_pass";
+        outcome: "success" | "partial" | "failed";
+        verifier?: string | undefined;
+    };
+    agentAId: string;
+    signature: string;
+    settlement?: {
+        amount?: string | undefined;
+        currency?: string | undefined;
+        paymentRef?: string | undefined;
+    } | undefined;
+}>;
+export declare const countersignSchema: z.ZodObject<{
+    signature: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    signature: string;
+}, {
+    signature: string;
+}>;
+export declare const disputeSchema: z.ZodObject<{
+    reason: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    reason: string;
+}, {
+    reason: string;
+}>;
+export declare const resolveDisputeSchema: z.ZodObject<{
+    note: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    note?: string | undefined;
+}, {
+    note?: string | undefined;
+}>;
+export declare const submitVerificationSchema: z.ZodObject<{
+    receiptId: z.ZodString;
+    verifier: z.ZodString;
+    method: z.ZodEnum<["deterministic", "agent_attestation"]>;
+    outputHash: z.ZodString;
+    result: z.ZodEnum<["verified", "rejected"]>;
+    score: z.ZodOptional<z.ZodNumber>;
+    evidenceUri: z.ZodOptional<z.ZodString>;
+    signature: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    receiptId: string;
+    result: "verified" | "rejected";
+    method: "deterministic" | "agent_attestation";
+    verifier: string;
+    outputHash: string;
+    signature: string;
+    score?: number | undefined;
+    evidenceUri?: string | undefined;
+}, {
+    receiptId: string;
+    result: "verified" | "rejected";
+    method: "deterministic" | "agent_attestation";
+    verifier: string;
+    outputHash: string;
+    signature: string;
+    score?: number | undefined;
+    evidenceUri?: string | undefined;
+}>;

package/dist/core/schemas.js

@@ -0,0 +1,103 @@
+import { z } from "zod";
+/**
+ * Request-body validation schemas — the one other piece of logic every
+ * runtime in this repo must agree on precisely, same principle as
+ * canonical.ts and receiptContent.ts. Before this file existed, the Node
+ * reference server (src/routes/*.ts) validated every mutating request with
+ * these exact Zod schemas, while the Cloudflare Worker (worker/src/index.ts)
+ * only checked that each required field was *present*, never that its value
+ * was actually valid — e.g. a signed POST /v1/verifications with
+ * `{ "result": "banana", "score": 999 }` would be rejected by the Node
+ * server but accepted by the Worker, silently writing an invalid `result`
+ * value into D1 forever. Both runtimes now import from here instead of
+ * defining their own copies, so "same request -> same validation -> same
+ * error code" is a property of sharing one schema, not of two
+ * independently-maintained ones happening to agree today.
+ */
+export const setVerifierStatusSchema = z.object({
+    authorized: z.boolean(),
+});
+export const revokeAgentSchema = z.object({
+    reason: z.string().min(1).max(500),
+});
+export const registerAgentSchema = z.object({
+    capabilities: z.array(z.string().min(1)).min(1),
+    metadata: z.record(z.unknown()).optional(),
+});
+export const linkChallengeSchema = z.object({
+    protocol: z.enum(["agentpass_id", "aitp_id", "passport_id"]),
+    externalPublicKey: z.string().min(1),
+    keyType: z.enum(["ed25519", "p256"]),
+});
+export const linkSchema = z.object({
+    protocol: z.enum(["agentpass_id", "aitp_id", "passport_id", "a2a_endpoint"]),
+    value: z.string().min(1),
+    challengeId: z.string().min(1).optional(),
+    proofSignature: z.string().min(1).optional(),
+});
+// An audit (SPEC.md v0.11) found `settlement.amount`/`currency` and a job's
+// `budget` were `z.string()` with no shape check: `{ amount: "banana" }` or a
+// negative amount passed validation, then `Number("banana")` -> NaN poisoned
+// the reputation volume sums. `amount` is a non-negative decimal string;
+// `currency` is a short code-shaped token (ISO-4217 like "USD" or a
+// stablecoin ticker like "USDC"), not free-form prose.
+const moneyAmount = z.string().regex(/^\d+(\.\d+)?$/, "must be a non-negative decimal string");
+const currencyCode = z.string().regex(/^[A-Za-z0-9]{1,16}$/, "must be a short currency code");
+const moneyFields = { amount: moneyAmount.optional(), currency: currencyCode.optional() };
+export const postJobSchema = z.object({
+    capability: z.string().min(1),
+    specHash: z.string().min(1),
+    budget: z.object({ ...moneyFields }).optional(),
+    expiresAt: z.string().optional(),
+});
+export const offerSchema = z.object({ message: z.string().optional() });
+export const acceptOfferSchema = z.object({ agentId: z.string().min(1) });
+// `{ offset: true }` accepts both JS's `Date.prototype.toISOString()` output
+// ("...526Z") and Python's `datetime.isoformat()` output for a UTC-aware
+// datetime ("...459111+00:00") -- confirmed by hand, since these differ in
+// both suffix style and fractional-second precision and an audit's
+// future-dating finding (SPEC.md v0.7 / CHANGELOG) made date validation here
+// necessary. Bounds/ordering (not-in-the-future, completedAt >= createdAt)
+// are enforced in receiptService.ts, not here -- this only validates shape,
+// consistent with the schema/business-rule split elsewhere in this file.
+const isoDateTime = z.string().datetime({ offset: true });
+export const draftReceiptSchema = z.object({
+    jobId: z.string().min(1),
+    agentAId: z.string().min(1),
+    task: z.object({
+        capability: z.string().min(1),
+        specHash: z.string().min(1),
+        createdAt: isoDateTime,
+    }),
+    result: z.object({
+        outputHash: z.string().min(1),
+        outputUri: z.string().optional(),
+        completedAt: isoDateTime,
+    }),
+    settlement: z
+        .object({
+        paymentRef: z.string().optional(),
+        ...moneyFields,
+    })
+        .optional(),
+    verification: z.object({
+        method: z.enum(["payer_confirmation", "independent_validator", "test_suite_pass"]),
+        verifier: z.string().optional(),
+        outcome: z.enum(["success", "partial", "failed"]),
+    }),
+    signature: z.string().min(1),
+});
+export const countersignSchema = z.object({ signature: z.string().min(1) });
+export const disputeSchema = z.object({ reason: z.string().min(1) });
+export const resolveDisputeSchema = z.object({ note: z.string().max(500).optional() });
+export const submitVerificationSchema = z.object({
+    receiptId: z.string().min(1),
+    verifier: z.string().min(1),
+    method: z.enum(["deterministic", "agent_attestation"]),
+    outputHash: z.string().min(1),
+    result: z.enum(["verified", "rejected"]),
+    score: z.number().min(0).max(1).optional(),
+    evidenceUri: z.string().optional(),
+    signature: z.string().min(1),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/core/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/core/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC5D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,oEAAoE;AACpE,uDAAuD;AACvD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;AAC/F,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;AAC9F,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;AAE1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,WAAW;KACvB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,WAAW;KACzB,CAAC;IACF,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,WAAW;KACf,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;QAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;KAClD,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC"}

package/dist/core/settlementVolume.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Settlement-amount aggregation for the reputation model (SPEC.md §5.3).
+ *
+ * An audit found `components.volumeUsd` summed every finalized receipt's
+ * `settlement.amount` regardless of `settlement.currency` — a 1000 TRY receipt
+ * added 1000 to a field labelled USD, right next to a 10 USDC one. INAM does
+ * no FX and takes no position on stablecoin pegs (§10 — payments/settlement
+ * enforcement is out of scope), so the honest fix is to bucket volume by the
+ * currency it was actually denominated in and never cross-sum.
+ *
+ * Shared by both runtimes (src/, worker/) so the two agree by construction,
+ * same principle as canonical.ts / receiptContent.ts / schemas.ts.
+ */
+/**
+ * Normalize a free-form `settlement.currency` to a bucket key. Missing or
+ * blank is treated as `"USD"` — `volumeUsd` has always implicitly assumed an
+ * untagged amount was USD, and receipts predating any currency discipline
+ * still need to land somewhere sensible.
+ */
+export declare function normalizeCurrency(currency?: string): string;
+/**
+ * Parse a `settlement.amount` string to a non-negative finite number, or 0.
+ * A registry MUST NOT let a malformed or negative amount poison the running
+ * volume sums (same principle as the non-finite-weight guard in §5.2) — the
+ * reference schema rejects such values at ingestion, but data from a
+ * non-conformant registry still flows through here.
+ */
+export declare function parseSettlementAmount(amount?: string): number;
+/** Add one receipt's settlement into a currency→total map, in place. */
+export declare function accrueVolume(byCurrency: Record<string, number>, settlement?: {
+    amount?: string;
+    currency?: string;
+}): void;
+/** Round every bucket to 2 decimal places — these are money totals, not raw
+ *  floats, and `0.1 + 0.2` should not surface in an API response. */
+export declare function roundVolumes(byCurrency: Record<string, number>): Record<string, number>;

package/dist/core/settlementVolume.js

@@ -0,0 +1,51 @@
+/**
+ * Settlement-amount aggregation for the reputation model (SPEC.md §5.3).
+ *
+ * An audit found `components.volumeUsd` summed every finalized receipt's
+ * `settlement.amount` regardless of `settlement.currency` — a 1000 TRY receipt
+ * added 1000 to a field labelled USD, right next to a 10 USDC one. INAM does
+ * no FX and takes no position on stablecoin pegs (§10 — payments/settlement
+ * enforcement is out of scope), so the honest fix is to bucket volume by the
+ * currency it was actually denominated in and never cross-sum.
+ *
+ * Shared by both runtimes (src/, worker/) so the two agree by construction,
+ * same principle as canonical.ts / receiptContent.ts / schemas.ts.
+ */
+/**
+ * Normalize a free-form `settlement.currency` to a bucket key. Missing or
+ * blank is treated as `"USD"` — `volumeUsd` has always implicitly assumed an
+ * untagged amount was USD, and receipts predating any currency discipline
+ * still need to land somewhere sensible.
+ */
+export function normalizeCurrency(currency) {
+    const c = (currency ?? "").trim().toUpperCase();
+    return c === "" ? "USD" : c;
+}
+/**
+ * Parse a `settlement.amount` string to a non-negative finite number, or 0.
+ * A registry MUST NOT let a malformed or negative amount poison the running
+ * volume sums (same principle as the non-finite-weight guard in §5.2) — the
+ * reference schema rejects such values at ingestion, but data from a
+ * non-conformant registry still flows through here.
+ */
+export function parseSettlementAmount(amount) {
+    const n = Number(amount ?? 0);
+    return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+/** Add one receipt's settlement into a currency→total map, in place. */
+export function accrueVolume(byCurrency, settlement) {
+    const amount = parseSettlementAmount(settlement?.amount);
+    if (amount === 0)
+        return;
+    const key = normalizeCurrency(settlement?.currency);
+    byCurrency[key] = (byCurrency[key] ?? 0) + amount;
+}
+/** Round every bucket to 2 decimal places — these are money totals, not raw
+ *  floats, and `0.1 + 0.2` should not surface in an API response. */
+export function roundVolumes(byCurrency) {
+    const out = {};
+    for (const [k, v] of Object.entries(byCurrency))
+        out[k] = Math.round(v * 100) / 100;
+    return out;
+}
+//# sourceMappingURL=settlementVolume.js.map

package/dist/core/settlementVolume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlementVolume.js","sourceRoot":"","sources":["../../src/core/settlementVolume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAC1B,UAAkC,EAClC,UAAmD;IAEnD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO;IACzB,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;AACpD,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,YAAY,CAAC,UAAkC;IAC7D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -4,4 +4,5 @@ export { generateP256Keypair, p256Sign, p256Verify, type P256Keypair } from "./c
 export { canonicalize } from "./crypto/canonical.js";
 export { computeReceiptId, buildSignableContent, type ReceiptContentInput } from "./core/receiptContent.js";
 export { computeVerificationId, buildSignableVerificationContent, type VerificationContentInput } from "./core/verificationContent.js";
-export type { LinkedIdentities, ExternalKeyType, LinkChallenge, AgentRecord, VerificationMethod, ReceiptOutcome, ReceiptStatus, DisputeStatus, ExecutionReceipt, SignableReceiptContent, ReputationComponents, ReputationResult, JobStatus, JobOffer, JobRecord, IndependentVerificationMethod, VerificationResult, VerificationRecord, } from "./types.js";
+export { registerAgentSchema, linkChallengeSchema, linkSchema, postJobSchema, offerSchema, acceptOfferSchema, draftReceiptSchema, countersignSchema, disputeSchema, submitVerificationSchema, setVerifierStatusSchema, } from "./core/schemas.js";
+export type { LinkedIdentities, ExternalKeyType, LinkChallenge, AgentRecord, VerificationMethod, ReceiptOutcome, ReceiptStatus, DisputeStatus, ExecutionReceipt, SignableReceiptContent, ReputationComponents, ReputationRoleBreakdown, ReputationResult, JobStatus, JobOffer, JobRecord, IndependentVerificationMethod, VerificationResult, VerificationRecord, } from "./types.js";

package/dist/index.js

@@ -4,4 +4,10 @@ export { generateP256Keypair, p256Sign, p256Verify } from "./crypto/p256.js";
 export { canonicalize } from "./crypto/canonical.js";
 export { computeReceiptId, buildSignableContent } from "./core/receiptContent.js";
 export { computeVerificationId, buildSignableVerificationContent } from "./core/verificationContent.js";
+// Request-body validation schemas — shared by the Node reference server and
+// the Cloudflare Worker so both accept/reject the exact same requests (see
+// core/schemas.ts's own header comment for why this exists). Exported
+// publicly too: a caller building requests by hand (rather than through
+// InamClient) can validate a payload client-side before sending it.
+export { registerAgentSchema, linkChallengeSchema, linkSchema, postJobSchema, offerSchema, acceptOfferSchema, draftReceiptSchema, countersignSchema, disputeSchema, submitVerificationSchema, setVerifierStatusSchema, } from "./core/schemas.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,OAAO,GAER,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE5G,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,OAAO,GAER,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE5G,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAEvI,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC"}

package/dist/types.d.ts

@@ -15,6 +15,28 @@ export interface LinkedIdentities {
  * matches ATTP (the protocol AgentPass is built on); Ed25519 is offered as
  * the same primitive INAM's own did:key already uses. */
 export type ExternalKeyType = "ed25519" | "p256";
+/** How one `linked` entry was verified when it was recorded (SPEC.md §2.1).
+ * - `key_possession`: the caller proved control of `externalPublicKey` via a
+ *   signed challenge at `verifiedAt`. This does NOT confirm that key is the
+ *   one the external system currently recognizes as authoritative for the
+ *   identity — live cross-registry resolution is out of scope (SPEC.md §10).
+ * - `unverified_claim`: an INAM-signed assertion only, no external proof
+ *   (`a2a_endpoint`, a service URL rather than a key-derived identity). */
+export interface LinkProof {
+    method: "key_possession" | "unverified_claim";
+    verifiedAt: string;
+    keyType?: ExternalKeyType;
+    externalPublicKey?: string;
+}
+/** Per-protocol assurance metadata for `linked`, same keys as
+ * `LinkedIdentities` (SPEC.md §2.1). A missing key means that identity isn't
+ * linked. */
+export interface LinkedIdentityProofs {
+    agentpass_id?: LinkProof;
+    aitp_id?: LinkProof;
+    passport_id?: LinkProof;
+    a2a_endpoint?: LinkProof;
+}
 /** Response shape from POST /agents/:id/link/challenge. */
 export interface LinkChallenge {
     challengeId: string;
@@ -26,8 +48,22 @@ export interface AgentRecord {
     capabilities: string[];
     metadata: Record<string, unknown>;
     linked: LinkedIdentities;
+    /** Per-protocol assurance metadata for `linked` (SPEC.md §2.1) — lets a
+     * consumer tell a challenge-verified link from an unverified claim. */
+    linkedProof: LinkedIdentityProofs;
     stakeUsd: number;
     createdAt: string;
+    /** Whether the registry operator has authorized this agent as a verifier
+     * (SPEC.md §12.3) — false by default at registration. An agent cannot make
+     * itself a verifier by self-registering; only the registry's configured
+     * operator identity can grant this via POST /agents/:id/verifier-status. */
+    isAuthorizedVerifier: boolean;
+    /** ISO timestamp the agent retired this INAM ID via POST /agents/:id/revoke
+     * (SPEC.md §2.2) — a one-way, self-signed tombstone for a compromised or
+     * rotated-off key. Absent for an active agent. A revoked ID can perform no
+     * further signed operations and is excluded from search. */
+    revokedAt?: string;
+    revocationReason?: string;
 }
 export type VerificationMethod = "payer_confirmation" | "independent_validator" | "test_suite_pass";
 export type ReceiptOutcome = "success" | "partial" | "failed";
@@ -69,6 +105,9 @@ export interface ExecutionReceipt {
         status: DisputeStatus;
         reason?: string;
         windowClosesAt: string;
+        openedBy?: string;
+        resolvedAt?: string;
+        resolution?: string;
     };
     signatures: {
         agentB?: string;
@@ -83,18 +122,47 @@ export type SignableReceiptContent = Omit<ExecutionReceipt, "signatures" | "stat
         windowClosesAt: string;
     };
 };
+/** Weighted receipt count/success-rate/volume for one side of an agent's
+ * history — see ReputationComponents.asProvider/asRequester. Same weighting
+ * (pairWeight * counterpartyTrust * decay * attestationBoost) as the
+ * aggregate trustScore, just filtered to receipts where this agent held
+ * that role. Not a separate 0-100 score (that's real scoring-model design
+ * work, not done here) — the raw signal an aggregate trustScore currently
+ * merges away. */
+export interface ReputationRoleBreakdown {
+    receipts: number;
+    successRate: number;
+    /** Volume denominated in USD (or untagged) only — see
+     * ReputationComponents.volumeUsd/volumeByCurrency. */
+    volumeUsd: number;
+    /** Settlement volume bucketed by `settlement.currency`, never cross-summed. */
+    volumeByCurrency: Record<string, number>;
+}
 export interface ReputationComponents {
     eigenWeight: number;
     verifiedReceipts: number;
     rawReceipts: number;
     successRate: number;
+    /** Total settlement volume across finalized receipts denominated in USD
+     * (currency `"USD"` or untagged) only. An audit found this field summed
+     * every currency's raw `settlement.amount` into one USD-labelled number;
+     * INAM does no FX, so non-USD volume now lives only in `volumeByCurrency`. */
     volumeUsd: number;
+    /** Settlement volume bucketed by normalized `settlement.currency`
+     * (uppercased; untagged -> `"USD"`), never converted or cross-summed. */
+    volumeByCurrency: Record<string, number>;
     stakeUsd: number;
     decayHalfLifeDays: number;
     /** Count of finalized receipts backed by at least one `verified` Verification
      * (SPEC.md §12.5) — distinct from `verifiedReceipts` above, which really
      * means "two-party finalized," not independently attested. */
     attestedReceipts: number;
+    /** This agent's history specifically as agentB (the one who did the work)
+     * on its finalized receipts (SPEC.md §5.3). */
+    asProvider: ReputationRoleBreakdown;
+    /** This agent's history specifically as agentA (the one who requested and
+     * countersigned the work) on its finalized receipts (SPEC.md §5.3). */
+    asRequester: ReputationRoleBreakdown;
 }
 export interface ReputationResult {
     trustScore: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inamprotocol",
-  "version": "0.3.1",
+  "version": "0.3.6",
   "description": "Reference TypeScript/JavaScript SDK for the INAM Protocol — agent identity, execution receipts, jobs, and reputation",
   "type": "module",
   "main": "./dist/index.js",
@@ -43,7 +43,8 @@
     "@noble/curves": "^2.3.0",
     "@noble/ed25519": "^2.1.0",
     "@noble/hashes": "^1.5.0",
-    "bs58": "^6.0.0"
+    "bs58": "^6.0.0",
+    "zod": "^3.23.8"
   },
   "devDependencies": {
     "@types/node": "^22.5.0",