open-agentpay 0.1.0 → 0.2.5

package/dist/client/signer.d.ts

@@ -0,0 +1,136 @@
+/**
+ * EIP-712 & EIP-3009 LocalSigner implementation for AgentPay.
+ *
+ * Uses viem for all cryptographic operations.
+ * Enforces firewall reservation binding and secret redaction.
+ */
+import { PaymentAuthorization, type PaymentChallenge } from '../core/models.js';
+import type { ReservationToken } from '../policy/models.js';
+import type { ISigner, SignAuthorizationOptions } from './interfaces.js';
+/** Standard EIP-3009 message type definition for TransferWithAuthorization */
+export declare const EIP3009_MESSAGE_TYPES: {
+    readonly TransferWithAuthorization: readonly [{
+        readonly name: "from";
+        readonly type: "address";
+    }, {
+        readonly name: "to";
+        readonly type: "address";
+    }, {
+        readonly name: "value";
+        readonly type: "uint256";
+    }, {
+        readonly name: "validAfter";
+        readonly type: "uint256";
+    }, {
+        readonly name: "validBefore";
+        readonly type: "uint256";
+    }, {
+        readonly name: "nonce";
+        readonly type: "bytes32";
+    }];
+};
+/** Standard token names for major stablecoins */
+export declare const DEFAULT_TOKEN_NAMES: Readonly<Record<string, string>>;
+/**
+ * Generate a cryptographically secure 32-byte hex nonce with 0x prefix.
+ */
+export declare function generateNonce(): `0x${string}`;
+/**
+ * Extract the integer chain ID from a CAIP-2 network string.
+ *
+ * @param network CAIP-2 network identifier (e.g. 'eip155:84532').
+ * @returns Integer chain ID.
+ * @throws UnsupportedNetworkError If the network is not an eip155 EVM chain.
+ */
+export declare function parseCaip2ChainId(network: string): number;
+/**
+ * Local private key signer for AgentPay clients.
+ *
+ * - Adheres to EIP-712 and EIP-3009 specifications.
+ * - Uses viem strictly; implements zero custom cryptography.
+ * - Enforces mandatory policy reservation verification before signing.
+ * - Redacts private key in toString, inspect, and toJSON for financial safety.
+ */
+export declare class LocalSigner implements ISigner {
+    #private;
+    readonly address: `0x${string}`;
+    constructor(privateKey: string | Uint8Array, options?: {
+        tokenNameMap?: Record<string, string>;
+    });
+    toString(): string;
+    toJSON(): Record<string, unknown>;
+    /**
+     * Generate a new random LocalSigner using cryptographically secure randomness.
+     */
+    static generate(): LocalSigner;
+    /**
+     * Resolve the EIP-712 domain token name for a payment challenge.
+     */
+    resolveTokenName(challenge: PaymentChallenge, explicitName?: string): string;
+    /**
+     * Build EIP-712 domain, types, and message dictionaries conforming to EIP-3009.
+     */
+    buildEip712Data(challenge: PaymentChallenge, nonce: string, options?: {
+        tokenName?: string;
+        tokenVersion?: string;
+    }): {
+        domain: {
+            name: string;
+            version: string;
+            chainId: number;
+            verifyingContract: `0x${string}`;
+        };
+        types: {
+            readonly TransferWithAuthorization: readonly [{
+                readonly name: "from";
+                readonly type: "address";
+            }, {
+                readonly name: "to";
+                readonly type: "address";
+            }, {
+                readonly name: "value";
+                readonly type: "uint256";
+            }, {
+                readonly name: "validAfter";
+                readonly type: "uint256";
+            }, {
+                readonly name: "validBefore";
+                readonly type: "uint256";
+            }, {
+                readonly name: "nonce";
+                readonly type: "bytes32";
+            }];
+        };
+        message: {
+            from: `0x${string}`;
+            to: `0x${string}`;
+            value: bigint;
+            validAfter: bigint;
+            validBefore: bigint;
+            nonce: `0x${string}`;
+        };
+    };
+    /**
+     * Sign an EIP-712/3009 transfer authorization after verifying the policy reservation.
+     *
+     * Safety Guardrails:
+     *   1. Verifies reservation.intentId === challenge.challengeId
+     *   2. Verifies reservation.amount === challenge.amountBaseUnits
+     *   3. Verifies reservation.expiresAt >= challenge.validBefore
+     *
+     * @returns PaymentAuthorization with cryptographic signature.
+     */
+    signPaymentAuthorization(challenge: PaymentChallenge, reservation: ReservationToken, options?: SignAuthorizationOptions): Promise<PaymentAuthorization>;
+    /**
+     * Verify that a PaymentAuthorization cryptographically matches the PaymentChallenge
+     * and was signed by the expected payer.
+     *
+     * @returns True if signature is valid and signer matches expected payer; False otherwise.
+     */
+    static verifyAuthorization(authorization: PaymentAuthorization, challenge: PaymentChallenge, options?: {
+        expectedPayer?: string;
+        tokenName?: string;
+        tokenVersion?: string;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=signer.d.ts.map

package/dist/client/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EACL,oBAAoB,EACpB,KAAK,gBAAgB,EAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO5D,OAAO,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAKzE,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;CASxB,CAAC;AAEX,iDAAiD;AACjD,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAG/D,CAAC;AAEH;;GAEG;AACH,wBAAgB,aAAa,IAAI,KAAK,MAAM,EAAE,CAI7C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASzD;AAED;;;;;;;GAOG;AACH,qBAAa,WAAY,YAAW,OAAO;;IAGzC,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;gBAG9B,UAAU,EAAE,MAAM,GAAG,UAAU,EAC/B,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAmCrD,QAAQ,IAAI,MAAM;IAQlB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,MAAM,CAAC,QAAQ,IAAI,WAAW;IAM9B;;OAEG;IACH,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAkB5E;;OAEG;IACH,eAAe,CACb,SAAS,EAAE,gBAAgB,EAC3B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;+BAoBf,KAAK,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;gBAQ5B,KAAK,MAAM,EAAE;;;;;;;IAUxC;;;;;;;;;OASG;IACG,wBAAwB,CAC5B,SAAS,EAAE,gBAAgB,EAC3B,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,oBAAoB,CAAC;IA4EhC;;;;;OAKG;WACU,mBAAmB,CAC9B,aAAa,EAAE,oBAAoB,EACnC,SAAS,EAAE,gBAAgB,EAC3B,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,OAAO,CAAC;CA+DpB"}

package/dist/client/signer.js

@@ -0,0 +1,300 @@
+/**
+ * EIP-712 & EIP-3009 LocalSigner implementation for AgentPay.
+ *
+ * Uses viem for all cryptographic operations.
+ * Enforces firewall reservation binding and secret redaction.
+ */
+import { parseSignature, recoverTypedDataAddress } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+import { PaymentAuthorization, SignatureData, } from '../core/models.js';
+import { InvalidPrivateKeyError, ReservationMismatchError, SignerError, UnsupportedNetworkError, } from './errors.js';
+/** CAIP-2 parsing regex for eip155 namespace: eip155:<chain_id> */
+const CAIP2_EIP155_RE = /^eip155:([0-9]+)$/;
+/** Standard EIP-3009 message type definition for TransferWithAuthorization */
+export const EIP3009_MESSAGE_TYPES = {
+    TransferWithAuthorization: [
+        { name: 'from', type: 'address' },
+        { name: 'to', type: 'address' },
+        { name: 'value', type: 'uint256' },
+        { name: 'validAfter', type: 'uint256' },
+        { name: 'validBefore', type: 'uint256' },
+        { name: 'nonce', type: 'bytes32' },
+    ],
+};
+/** Standard token names for major stablecoins */
+export const DEFAULT_TOKEN_NAMES = Object.freeze({
+    usdc: 'USD Coin',
+    eurc: 'Euro Coin',
+});
+/**
+ * Generate a cryptographically secure 32-byte hex nonce with 0x prefix.
+ */
+export function generateNonce() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return `0x${Buffer.from(bytes).toString('hex')}`;
+}
+/**
+ * Extract the integer chain ID from a CAIP-2 network string.
+ *
+ * @param network CAIP-2 network identifier (e.g. 'eip155:84532').
+ * @returns Integer chain ID.
+ * @throws UnsupportedNetworkError If the network is not an eip155 EVM chain.
+ */
+export function parseCaip2ChainId(network) {
+    const match = CAIP2_EIP155_RE.exec(network.trim());
+    if (!match || !match[1]) {
+        throw new UnsupportedNetworkError(`Unsupported network identifier: ${JSON.stringify(network)}. ` +
+            "LocalSigner only supports EVM chains conforming to 'eip155:<chainId>'.");
+    }
+    return Number.parseInt(match[1], 10);
+}
+/**
+ * Local private key signer for AgentPay clients.
+ *
+ * - Adheres to EIP-712 and EIP-3009 specifications.
+ * - Uses viem strictly; implements zero custom cryptography.
+ * - Enforces mandatory policy reservation verification before signing.
+ * - Redacts private key in toString, inspect, and toJSON for financial safety.
+ */
+export class LocalSigner {
+    #account;
+    #tokenNameMap;
+    address;
+    constructor(privateKey, options) {
+        try {
+            let cleanKey;
+            if (typeof privateKey === 'string') {
+                const trimmed = privateKey.trim();
+                cleanKey = (trimmed.startsWith('0x') ? trimmed : `0x${trimmed}`);
+                if (!/^0x[0-9a-fA-F]{64}$/.test(cleanKey)) {
+                    throw new Error('Private key must be a 32-byte hex string');
+                }
+            }
+            else if (privateKey instanceof Uint8Array) {
+                if (privateKey.byteLength !== 32) {
+                    throw new Error(`Private key bytes must be 32 bytes, got ${privateKey.byteLength}`);
+                }
+                cleanKey = `0x${Buffer.from(privateKey).toString('hex')}`;
+            }
+            else {
+                throw new TypeError(`privateKey must be string or Uint8Array, got ${typeof privateKey}`);
+            }
+            this.#account = privateKeyToAccount(cleanKey);
+        }
+        catch (exc) {
+            throw new InvalidPrivateKeyError(`Failed to load EVM private key: ${exc instanceof Error ? exc.message : String(exc)}`);
+        }
+        this.address = this.#account.address.toLowerCase();
+        this.#tokenNameMap = new Map();
+        if (options?.tokenNameMap) {
+            for (const [k, v] of Object.entries(options.tokenNameMap)) {
+                this.#tokenNameMap.set(k.toLowerCase(), v);
+            }
+        }
+    }
+    toString() {
+        return `LocalSigner(address=${this.address})`;
+    }
+    [Symbol.for('nodejs.util.inspect.custom')]() {
+        return `<LocalSigner address=${this.address}>`;
+    }
+    toJSON() {
+        return { address: this.address };
+    }
+    /**
+     * Generate a new random LocalSigner using cryptographically secure randomness.
+     */
+    static generate() {
+        const bytes = new Uint8Array(32);
+        crypto.getRandomValues(bytes);
+        return new LocalSigner(bytes);
+    }
+    /**
+     * Resolve the EIP-712 domain token name for a payment challenge.
+     */
+    resolveTokenName(challenge, explicitName) {
+        if (explicitName) {
+            return explicitName;
+        }
+        const assetLower = challenge.asset?.toLowerCase();
+        if (assetLower && this.#tokenNameMap.has(assetLower)) {
+            return this.#tokenNameMap.get(assetLower);
+        }
+        const symbolLower = challenge.assetSymbol?.toLowerCase();
+        if (symbolLower && this.#tokenNameMap.has(symbolLower)) {
+            return this.#tokenNameMap.get(symbolLower);
+        }
+        if (symbolLower && DEFAULT_TOKEN_NAMES[symbolLower]) {
+            return DEFAULT_TOKEN_NAMES[symbolLower];
+        }
+        return challenge.assetSymbol || 'USD Coin';
+    }
+    /**
+     * Build EIP-712 domain, types, and message dictionaries conforming to EIP-3009.
+     */
+    buildEip712Data(challenge, nonce, options) {
+        if (!challenge.network) {
+            throw new UnsupportedNetworkError('PaymentChallenge network is required for EIP-3009 signing');
+        }
+        if (!challenge.asset) {
+            throw new SignerError('PaymentChallenge asset is required for EIP-3009 signing');
+        }
+        if (!challenge.payee) {
+            throw new SignerError('PaymentChallenge payee is required for EIP-3009 signing');
+        }
+        const chainId = parseCaip2ChainId(challenge.network);
+        const domainName = this.resolveTokenName(challenge, options?.tokenName);
+        const tokenVersion = options?.tokenVersion ?? '2';
+        const domain = {
+            name: domainName,
+            version: tokenVersion,
+            chainId,
+            verifyingContract: challenge.asset,
+        };
+        const types = EIP3009_MESSAGE_TYPES;
+        const normNonce = (nonce.startsWith('0x') ? nonce.toLowerCase() : `0x${nonce.toLowerCase()}`);
+        const message = {
+            from: this.address,
+            to: challenge.payee,
+            value: challenge.amountBaseUnits,
+            validAfter: BigInt(challenge.validAfter),
+            validBefore: BigInt(challenge.validBefore),
+            nonce: normNonce,
+        };
+        return { domain, types, message };
+    }
+    /**
+     * Sign an EIP-712/3009 transfer authorization after verifying the policy reservation.
+     *
+     * Safety Guardrails:
+     *   1. Verifies reservation.intentId === challenge.challengeId
+     *   2. Verifies reservation.amount === challenge.amountBaseUnits
+     *   3. Verifies reservation.expiresAt >= challenge.validBefore
+     *
+     * @returns PaymentAuthorization with cryptographic signature.
+     */
+    async signPaymentAuthorization(challenge, reservation, options) {
+        // Guardrail 1: Policy intent binding
+        if (reservation.intentId !== challenge.challengeId) {
+            throw new ReservationMismatchError(`Reservation intent_id (${JSON.stringify(reservation.intentId)}) does not match ` +
+                `challenge_id (${JSON.stringify(challenge.challengeId)}). Refusing to sign.`);
+        }
+        // Guardrail 2: Amount exact match
+        if (reservation.amount !== challenge.amountBaseUnits) {
+            throw new ReservationMismatchError(`Reservation amount (${reservation.amount.toString()}) does not match ` +
+                `challenge amount (${challenge.amountBaseUnits.toString()}). Refusing to sign.`);
+        }
+        // Guardrail 3: Expiration safety window
+        if (reservation.expiresAt < challenge.validBefore) {
+            throw new ReservationMismatchError(`Reservation expires_at (${reservation.expiresAt}) does not cover ` +
+                `challenge valid_before (${challenge.validBefore}). Refusing to sign.`);
+        }
+        const signNonce = options?.nonce ? (options.nonce.startsWith('0x') ? options.nonce : `0x${options.nonce}`) : generateNonce();
+        const { domain, types, message } = this.buildEip712Data(challenge, signNonce, {
+            tokenName: options?.tokenName,
+            tokenVersion: options?.tokenVersion,
+        });
+        let rawSig;
+        try {
+            rawSig = await this.#account.signTypedData({
+                domain,
+                types,
+                primaryType: 'TransferWithAuthorization',
+                message,
+            });
+        }
+        catch (exc) {
+            throw new SignerError(`Cryptographic signing failed: ${exc instanceof Error ? exc.message : String(exc)}`);
+        }
+        const parsed = parseSignature(rawSig);
+        const rHex = parsed.r;
+        const sHex = parsed.s;
+        const vVal = Number(parsed.v);
+        const rClean = rHex.slice(2).padStart(64, '0');
+        const sClean = sHex.slice(2).padStart(64, '0');
+        const vHex = vVal.toString(16).padStart(2, '0');
+        const serializedHex = `${rClean}${sClean}${vHex}`;
+        const sigData = new SignatureData({
+            v: vVal,
+            r: rHex,
+            s: sHex,
+            serialized: serializedHex,
+            compact: `0x${serializedHex}`,
+        });
+        return new PaymentAuthorization({
+            version: '2.0',
+            challengeId: challenge.challengeId,
+            payer: this.address,
+            scheme: challenge.scheme,
+            nonce: signNonce,
+            validAfter: challenge.validAfter,
+            validBefore: challenge.validBefore,
+            signature: sigData,
+        });
+    }
+    /**
+     * Verify that a PaymentAuthorization cryptographically matches the PaymentChallenge
+     * and was signed by the expected payer.
+     *
+     * @returns True if signature is valid and signer matches expected payer; False otherwise.
+     */
+    static async verifyAuthorization(authorization, challenge, options) {
+        try {
+            if (!challenge.network || !challenge.asset || !challenge.payee) {
+                return false;
+            }
+            const targetPayer = (options?.expectedPayer ?? authorization.payer).toLowerCase();
+            const chainId = parseCaip2ChainId(challenge.network);
+            const symbolLower = challenge.assetSymbol?.toLowerCase();
+            const domainName = options?.tokenName ??
+                (symbolLower && DEFAULT_TOKEN_NAMES[symbolLower]) ??
+                challenge.assetSymbol ??
+                'USD Coin';
+            const tokenVersion = options?.tokenVersion ?? '2';
+            const domain = {
+                name: domainName,
+                version: tokenVersion,
+                chainId,
+                verifyingContract: challenge.asset,
+            };
+            const types = EIP3009_MESSAGE_TYPES;
+            const normNonce = (authorization.nonce.startsWith('0x')
+                ? authorization.nonce.toLowerCase()
+                : `0x${authorization.nonce.toLowerCase()}`);
+            const message = {
+                from: authorization.payer,
+                to: challenge.payee,
+                value: challenge.amountBaseUnits,
+                validAfter: BigInt(authorization.validAfter),
+                validBefore: BigInt(authorization.validBefore),
+                nonce: normNonce,
+            };
+            let sigHex;
+            if (authorization.signature instanceof SignatureData) {
+                sigHex = authorization.signature.compact;
+            }
+            else if (typeof authorization.signature === 'string') {
+                const clean = authorization.signature.startsWith('0x')
+                    ? authorization.signature
+                    : `0x${authorization.signature}`;
+                sigHex = clean.toLowerCase();
+            }
+            else {
+                return false;
+            }
+            const recovered = await recoverTypedDataAddress({
+                domain,
+                types,
+                primaryType: 'TransferWithAuthorization',
+                message,
+                signature: sigHex,
+            });
+            return recovered.toLowerCase() === targetPayer;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=signer.js.map

package/dist/client/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/client/signer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,MAAM,CAAC;AAC/D,OAAO,EAA0B,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EACL,oBAAoB,EAEpB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,mEAAmE;AACnE,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,yBAAyB,EAAE;QACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;KACnC;CACO,CAAC;AAEX,iDAAiD;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACjF,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,WAAW;CAClB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAmB,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI;YAC5D,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACb,QAAQ,CAAoB;IAC5B,aAAa,CAAsB;IACnC,OAAO,CAAgB;IAEhC,YACE,UAA+B,EAC/B,OAAmD;QAEnD,IAAI,CAAC;YACH,IAAI,QAAuB,CAAC;YAC5B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;gBAClC,QAAQ,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAkB,CAAC;gBAClF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;iBAAM,IAAI,UAAU,YAAY,UAAU,EAAE,CAAC;gBAC5C,IAAI,UAAU,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,QAAQ,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAmB,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,SAAS,CAAC,gDAAgD,OAAO,UAAU,EAAE,CAAC,CAAC;YAC3F,CAAC;YAED,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,sBAAsB,CAC9B,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAmB,CAAC;QACpE,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;QAC/B,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ;QACN,OAAO,uBAAuB,IAAI,CAAC,OAAO,GAAG,CAAC;IAChD,CAAC;IAED,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACxC,OAAO,wBAAwB,IAAI,CAAC,OAAO,GAAG,CAAC;IACjD,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ;QACb,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAA2B,EAAE,YAAqB;QACjE,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QAC7C,CAAC;QACD,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;QACzD,IAAI,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QAC9C,CAAC;QACD,IAAI,WAAW,IAAI,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,OAAO,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,SAAS,CAAC,WAAW,IAAI,UAAU,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CACb,SAA2B,EAC3B,KAAa,EACb,OAAuD;QAEvD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAAC,2DAA2D,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,yDAAyD,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,yDAAyD,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC;QAElD,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,YAAY;YACrB,OAAO;YACP,iBAAiB,EAAE,SAAS,CAAC,KAAsB;SACpD,CAAC;QAEF,MAAM,KAAK,GAAG,qBAAqB,CAAC;QACpC,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAkB,CAAC;QAE/G,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,EAAE,EAAE,SAAS,CAAC,KAAsB;YACpC,KAAK,EAAE,SAAS,CAAC,eAAe;YAChC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;YACxC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;YAC1C,KAAK,EAAE,SAAS;SACjB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,wBAAwB,CAC5B,SAA2B,EAC3B,WAA6B,EAC7B,OAAkC;QAElC,qCAAqC;QACrC,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,wBAAwB,CAChC,0BAA0B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB;gBAC/E,iBAAiB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,CAC/E,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,eAAe,EAAE,CAAC;YACrD,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB;gBACrE,qBAAqB,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,sBAAsB,CAClF,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,IAAI,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,IAAI,wBAAwB,CAChC,2BAA2B,WAAW,CAAC,SAAS,mBAAmB;gBACjE,2BAA2B,SAAS,CAAC,WAAW,sBAAsB,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAE7H,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE;YAC5E,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,YAAY,EAAE,OAAO,EAAE,YAAY;SACpC,CAAC,CAAC;QAEH,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACzC,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,2BAA2B;gBACxC,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;QAElD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,KAAK,aAAa,EAAE;SAC9B,CAAC,CAAC;QAEH,OAAO,IAAI,oBAAoB,CAAC;YAC9B,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,KAAK,EAAE,SAA0B;YACjC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,aAAmC,EACnC,SAA2B,EAC3B,OAA+E;QAE/E,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAClF,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;YACzD,MAAM,UAAU,GACd,OAAO,EAAE,SAAS;gBAClB,CAAC,WAAW,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACjD,SAAS,CAAC,WAAW;gBACrB,UAAU,CAAC;YACb,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC;YAElD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,YAAY;gBACrB,OAAO;gBACP,iBAAiB,EAAE,SAAS,CAAC,KAAsB;aACpD,CAAC;YAEF,MAAM,KAAK,GAAG,qBAAqB,CAAC;YACpC,MAAM,SAAS,GAAG,CAChB,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAClC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE;gBACnC,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC;YAEnB,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,aAAa,CAAC,KAAK;gBACzB,EAAE,EAAE,SAAS,CAAC,KAAsB;gBACpC,KAAK,EAAE,SAAS,CAAC,eAAe;gBAChC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;gBAC5C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;gBAC9C,KAAK,EAAE,SAAS;aACjB,CAAC;YAEF,IAAI,MAAqB,CAAC;YAC1B,IAAI,aAAa,CAAC,SAAS,YAAY,aAAa,EAAE,CAAC;gBACrD,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC;YAC3C,CAAC;iBAAM,IAAI,OAAO,aAAa,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;oBACpD,CAAC,CAAC,aAAa,CAAC,SAAS;oBACzB,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,GAAG,KAAK,CAAC,WAAW,EAAmB,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;gBAC9C,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,2BAA2B;gBACxC,OAAO;gBACP,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/client/transport.d.ts

@@ -0,0 +1,44 @@
+/**
+ * HTTP Fetch Interceptor and Transport for AgentPay.
+ *
+ * Implements transparent 402 Payment Required interception, policy evaluation,
+ * EIP-712 / EIP-3009 signing, agentpay-wallet authorization, and post-dispatch safety.
+ */
+import type { Clock, IPolicyEngine } from '../policy/interfaces.js';
+import type { ISigner } from './interfaces.js';
+export type CredentialMode = 'block' | 'meter' | 'allow';
+export declare const ALLOW_UNMETERED_HEADER = "x-agentpay-allow-unmetered";
+export declare const DEFAULT_CREDENTIAL_HEADERS: readonly string[];
+export declare const DEFAULT_CREDENTIAL_VALUE_PREFIXES: readonly string[];
+export interface AgentPayRequestInit extends RequestInit {
+    params?: Record<string, string | number | boolean | undefined | null> | URLSearchParams;
+}
+export interface AgentPayClientOptions {
+    signer: ISigner;
+    policy: IPolicyEngine;
+    baseFetch?: typeof globalThis.fetch;
+    baseUrl?: string;
+    defaultHeaders?: Record<string, string>;
+    autoRetryOn402?: boolean;
+    raiseOnPolicyRejection?: boolean;
+    clock?: Clock;
+    unmeteredCredentialPolicy?: CredentialMode;
+    credentialHeaders?: readonly string[];
+    credentialValuePrefixes?: readonly string[];
+    estimateCost?: (req: Request) => bigint | number;
+    actualCost?: (res: Response) => bigint | number | null;
+    credentialTtlSeconds?: number;
+    walletChallengeMode?: boolean;
+}
+export declare function computeRequestBinding(method: string, urlStr: string, bodyBytes: Uint8Array | null): string;
+export declare class AgentPayTransport {
+    readonly options: Readonly<AgentPayClientOptions>;
+    private readonly baseFetch;
+    private readonly clock;
+    private readonly credentialHeaders;
+    private readonly credentialValuePrefixes;
+    constructor(options: AgentPayClientOptions);
+    fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+}
+export declare function createAgentPayFetch(options: AgentPayClientOptions): typeof globalThis.fetch;
+//# sourceMappingURL=transport.d.ts.map

package/dist/client/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/client/transport.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,KAAK,EAAE,KAAK,EAAwB,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAAoB,CAAC;AAC7E,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAa,CAAC;AAE7E,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC;CACzF;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,yBAAyB,CAAC,EAAE,cAAc,CAAC;IAC3C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC;IACjD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAsCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,IAAI,GAAG,MAAM,CAQ1G;AAED,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IACtD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAoB;gBAEhD,OAAO,EAAE,qBAAqB;IA+B7B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CA+TzF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,UAAU,CAAC,KAAK,CAI3F"}