remesso-sdk 0.0.0-stage → 0.2.0

package/dist/vendor/fee.js

@@ -0,0 +1,40 @@
+// Copied from web/lib/fee.ts by scripts/build-sdk.ts. Edit the original and re-run;
+// `build-sdk.ts --check` fails while the two differ.
+/// The commission V5 takes, and what a recipient is owed, in base units.
+///
+/// V5 rounds its commission UP (`Math.mulDiv(amount, bps, 10_000,
+/// Math.Rounding.Ceil)`), so what arrives from a gross amount is
+/// `gross - ceil(gross * bps / 10_000)`. A requested amount, from a request or
+/// a pay link, is what the recipient receives (docs/agent-to-agent.md, 3a,
+/// decided 2026-10-24), so the form signs `grossFor(requested)`: an invoice
+/// names what is owed, and the payer covers the fee on top.
+///
+/// A policy payment through RemessoAgentAllowance takes no fee, so none of
+/// this applies there: what an agent pays is what arrives.
+/// What V5 keeps from `gross`, rounded up as the contract rounds it.
+export function feeOf(gross, bps) {
+    return (gross * BigInt(bps) + 9999n) / 10000n;
+}
+/// What the recipient receives from `gross`.
+export function netOf(gross, bps) {
+    return gross - feeOf(gross, bps);
+}
+/// The smallest gross whose net is at least `net`.
+///
+/// `netOf` never decreases as the gross grows (each extra unit raises the fee
+/// by at most one), so starting from the estimate `net / (1 - bps/10_000)` and
+/// stepping a unit or two either way finds the exact answer.
+export function grossFor(net, bps) {
+    if (net <= 0n)
+        return 0n;
+    if (!Number.isInteger(bps) || bps < 0 || bps >= 10_000)
+        throw new Error(`fee of ${bps}bps is out of range`);
+    if (bps === 0)
+        return net;
+    let gross = (net * 10000n) / (10000n - BigInt(bps));
+    while (gross > 0n && netOf(gross - 1n, bps) >= net)
+        gross--;
+    while (netOf(gross, bps) < net)
+        gross++;
+    return gross;
+}

package/dist/vendor/payee-profile.d.ts

@@ -0,0 +1,27 @@
+export type PayeeProfile = {
+    version: "1";
+    endpoint: string | null;
+    assets: {
+        network: string;
+        asset: string;
+    }[];
+    reference: {
+        required: boolean;
+    } | null;
+};
+export type UriSource = {
+    kind: "inline";
+    json: string;
+} | {
+    kind: "fetch";
+    url: string;
+} | {
+    kind: "unsupported";
+    reason: string;
+};
+export declare const IPFS_GATEWAY = "https://ipfs.io/ipfs/";
+export declare function uriSource(uri: string): UriSource;
+export declare function payeeProfile(doc: unknown): {
+    profile: PayeeProfile | null;
+    note?: string;
+};

package/dist/vendor/payee-profile.js

@@ -0,0 +1,73 @@
+// Copied from web/lib/payee-profile.ts by scripts/build-sdk.ts. Edit the original and re-run;
+// `build-sdk.ts --check` fails while the two differ.
+/// An agent's payee profile: the `remesso` entry in the `services` list of its
+/// ERC-8004 registration file (docs/agent-to-agent.md, 3d; docs/AGENTS.md).
+///
+/// It says which tokens the agent accepts and whether a payment must carry a
+/// reference. It never says where to pay: the registration file can be
+/// rewritten by the token's owner at any time, so the address comes only from
+/// the registry's `getAgentWallet`, which only the wallet's own signature can
+/// set. Nothing here returns an address to pay.
+///
+/// Pure, so both servers read files the same way. The local MCP wallet carries
+/// a copy (`mcp/src/payee-profile.mjs`).
+export const IPFS_GATEWAY = "https://ipfs.io/ipfs/";
+export function uriSource(uri) {
+    const u = uri.trim();
+    if (u.startsWith("data:")) {
+        const comma = u.indexOf(",");
+        if (comma < 0)
+            return { kind: "unsupported", reason: "a data: URI without data" };
+        const meta = u.slice(5, comma);
+        const body = u.slice(comma + 1);
+        try {
+            const json = /;base64$/i.test(meta)
+                ? new TextDecoder().decode(Uint8Array.from(atob(body), (c) => c.charCodeAt(0)))
+                : decodeURIComponent(body);
+            return { kind: "inline", json };
+        }
+        catch {
+            return { kind: "unsupported", reason: "a data: URI that doesn't decode" };
+        }
+    }
+    if (u.startsWith("https://"))
+        return { kind: "fetch", url: u };
+    if (u.startsWith("ipfs://")) {
+        const path = u.slice(7).replace(/^ipfs\//, "");
+        if (!/^[a-zA-Z0-9]+(\/[^\s?#]*)?$/.test(path))
+            return { kind: "unsupported", reason: "an ipfs: URI that isn't a CID" };
+        return { kind: "fetch", url: `${IPFS_GATEWAY}${path}` };
+    }
+    return { kind: "unsupported", reason: `${u.split(":")[0] || "an empty"} URIs aren't read` };
+}
+const CAIP2 = /^eip155:\d{1,12}$/;
+const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+/// The `remesso` entry of a registration file, under the reader's rules:
+/// unknown fields are ignored, and a version this reader doesn't implement
+/// counts as no profile at all.
+export function payeeProfile(doc) {
+    if (!doc || typeof doc !== "object")
+        return { profile: null, note: "the registration file isn't a JSON object" };
+    const d = doc;
+    // `services` replaced `endpoints` in the spec on 2026-01-25; older files use the old name.
+    const list = Array.isArray(d.services) ? d.services : Array.isArray(d.endpoints) ? d.endpoints : [];
+    const entry = list.find((s) => s && typeof s === "object" && s.name === "remesso");
+    if (!entry)
+        return { profile: null, note: "no remesso entry in its services" };
+    if (String(entry.version ?? "") !== "1") {
+        return { profile: null, note: `a remesso entry of version ${String(entry.version ?? "none")}, which this reader doesn't implement` };
+    }
+    const assets = (Array.isArray(entry.assets) ? entry.assets : [])
+        .filter((a) => !!a && typeof a === "object" && CAIP2.test(String(a.network)) &&
+        ADDRESS.test(String(a.asset)))
+        .map((a) => ({ network: a.network, asset: a.asset }));
+    const ref = entry.reference;
+    return {
+        profile: {
+            version: "1",
+            endpoint: typeof entry.endpoint === "string" && entry.endpoint.startsWith("https://") ? entry.endpoint : null,
+            assets,
+            reference: ref && typeof ref.required === "boolean" ? { required: ref.required } : null,
+        },
+    };
+}

package/dist/vendor/request-decline.d.ts

@@ -0,0 +1,55 @@
+export declare const DECLINE_DOMAIN: {
+    readonly name: "Remesso";
+    readonly version: "1";
+    readonly chainId: 42220;
+};
+export declare const DECLINE_TYPES: {
+    readonly PaymentRequestAction: readonly [{
+        readonly name: "request";
+        readonly type: "string";
+    }, {
+        readonly name: "action";
+        readonly type: "string";
+    }, {
+        readonly name: "expiry";
+        readonly type: "uint64";
+    }];
+};
+export declare const MAX_DECLINE_TTL_SECS: number;
+export type Decline = {
+    id: string;
+    expiry: number;
+    signature: `0x${string}`;
+};
+export declare function declineTypedData(id: string, expiry: number): {
+    domain: {
+        readonly name: "Remesso";
+        readonly version: "1";
+        readonly chainId: 42220;
+    };
+    types: {
+        readonly PaymentRequestAction: readonly [{
+            readonly name: "request";
+            readonly type: "string";
+        }, {
+            readonly name: "action";
+            readonly type: "string";
+        }, {
+            readonly name: "expiry";
+            readonly type: "uint64";
+        }];
+    };
+    primaryType: "PaymentRequestAction";
+    message: {
+        request: string;
+        action: string;
+        expiry: bigint;
+    };
+};
+export declare function checkDecline(body: Record<string, unknown>, nowSecs: number): {
+    ok: true;
+    decline: Decline;
+} | {
+    ok: false;
+    error: string;
+};

package/dist/vendor/request-decline.js

@@ -0,0 +1,60 @@
+// Copied from supabase/functions/_shared/request-decline.ts by scripts/build-sdk.ts. Edit the original and re-run;
+// `build-sdk.ts --check` fails while the two differ.
+/// A payer declining a payment request, by signature.
+///
+/// The app can't decline for anyone. An anonymous session's claimed wallet
+/// proves nothing and MiniPay can't sign, so a dismissal in the app only hides
+/// a request for that session. An agent holds a key, so it can sign a decline,
+/// and a signed decline is the only kind a requester is ever told about
+/// (docs/agent-to-agent.md, 1d and step 3).
+///
+/// Pure: the typed data, and the checks that need neither the database nor
+/// the chain. `request-payment` verifies the signature with
+/// `publicClient.verifyTypedData`, which also handles ERC-1271 smart accounts;
+/// the tests verify offline. The SDK imports this same definition, so a payer
+/// signs exactly what we verify.
+/// No verifying contract: nothing on-chain checks this signature. The request
+/// id, the action and the expiry are what bind it.
+export const DECLINE_DOMAIN = { name: "Remesso", version: "1", chainId: 42220 };
+export const DECLINE_TYPES = {
+    PaymentRequestAction: [
+        { name: "request", type: "string" },
+        { name: "action", type: "string" },
+        { name: "expiry", type: "uint64" },
+    ],
+};
+/// How far ahead a signed decline may expire. Long enough for an agent to sign
+/// it and send it, short enough that a signature found later is worthless.
+export const MAX_DECLINE_TTL_SECS = 24 * 60 * 60;
+/// The message a payer signs to decline request `id`. The id is signed as the
+/// caller sends it; request-payment returns it lowercase.
+export function declineTypedData(id, expiry) {
+    return {
+        domain: DECLINE_DOMAIN,
+        types: DECLINE_TYPES,
+        primaryType: "PaymentRequestAction",
+        message: { request: id, action: "decline", expiry: BigInt(expiry) },
+    };
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/// 65 bytes for a plain key; a smart account's ERC-1271 signature can be
+/// longer, so only an absurd size is refused.
+const SIGNATURE = /^0x(?:[0-9a-fA-F]{2}){65,4096}$/;
+/// Everything about a decline that can be checked without the database or the
+/// chain. `nowSecs` is a parameter so tests can hold the clock still.
+export function checkDecline(body, nowSecs) {
+    const id = String(body.id ?? "");
+    if (!UUID.test(id))
+        return { ok: false, error: "id must be a payment request id" };
+    const expiry = Number(body.expiry);
+    if (!Number.isSafeInteger(expiry))
+        return { ok: false, error: "expiry must be unix seconds" };
+    if (expiry <= nowSecs)
+        return { ok: false, error: "this signed decline has expired" };
+    if (expiry > nowSecs + MAX_DECLINE_TTL_SECS)
+        return { ok: false, error: "expiry must be within a day" };
+    const signature = String(body.signature ?? "");
+    if (!SIGNATURE.test(signature))
+        return { ok: false, error: "signature must be a hex signature" };
+    return { ok: true, decline: { id, expiry, signature: signature } };
+}

package/dist/vendor/safe-fetch.d.ts

@@ -0,0 +1,2 @@
+export declare function isPublicIp(ip: string): boolean;
+export declare function safeFetchText(raw: string): Promise<string>;

package/dist/vendor/safe-fetch.js

@@ -0,0 +1,154 @@
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { isIP } from "node:net";
+function v4Octets(ip) {
+    const parts = ip.split(".");
+    if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p)))
+        return null;
+    const o = parts.map(Number);
+    return o.every((n) => n <= 255) ? o : null;
+}
+function v4Public([a, b, c]) {
+    if (a === 0 || a === 10 || a === 127)
+        return false; // this network, private, loopback
+    if (a === 100 && b >= 64 && b <= 127)
+        return false; // CGNAT
+    if (a === 169 && b === 254)
+        return false; // link-local, cloud metadata
+    if (a === 172 && b >= 16 && b <= 31)
+        return false; // private
+    if (a === 192 && b === 0 && (c === 0 || c === 2))
+        return false; // protocol assignments, documentation
+    if (a === 192 && b === 88 && c === 99)
+        return false; // 6to4 relay
+    if (a === 192 && b === 168)
+        return false; // private
+    if (a === 198 && (b === 18 || b === 19))
+        return false; // benchmarking
+    if (a === 198 && b === 51 && c === 100)
+        return false; // documentation
+    if (a === 203 && b === 0 && c === 113)
+        return false; // documentation
+    return a < 224; // multicast, reserved and broadcast above
+}
+/// Eight 16-bit groups, or null. Handles `::`, a zone id and a dotted-quad tail.
+function v6Groups(raw) {
+    let s = raw.split("%")[0].toLowerCase();
+    const last = s.lastIndexOf(":");
+    const tail = s.slice(last + 1);
+    if (tail.includes(".")) {
+        const o = v4Octets(tail);
+        if (!o)
+            return null;
+        s = `${s.slice(0, last + 1)}${((o[0] << 8) | o[1]).toString(16)}:${((o[2] << 8) | o[3]).toString(16)}`;
+    }
+    const halves = s.split("::");
+    if (halves.length > 2)
+        return null;
+    const head = halves[0] ? halves[0].split(":") : [];
+    const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+    const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+    if (fill < 0 || (halves.length === 2 && fill < 1))
+        return null;
+    const groups = [...head, ...Array(fill).fill("0"), ...rest];
+    if (groups.length !== 8 || !groups.every((g) => /^[0-9a-f]{1,4}$/.test(g)))
+        return null;
+    return groups.map((g) => parseInt(g, 16));
+}
+function v6Public(g) {
+    const zero = (n) => g.slice(0, n).every((x) => x === 0);
+    const inner = () => [g[6] >> 8, g[6] & 255, g[7] >> 8, g[7] & 255];
+    if (zero(8))
+        return false; // ::
+    if (zero(7) && g[7] === 1)
+        return false; // ::1
+    if (zero(5) && g[5] === 0xffff)
+        return v4Public(inner()); // ::ffff:a.b.c.d
+    if (zero(6))
+        return v4Public(inner()); // ::a.b.c.d, deprecated
+    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((x) => x === 0))
+        return v4Public(inner()); // NAT64
+    if (g[0] === 0x100 && g.slice(1, 4).every((x) => x === 0))
+        return false; // 100::/64, discard-only
+    if (g[0] === 0x2001 && (g[1] === 0x0db8 || g[1] === 0))
+        return false; // documentation, Teredo
+    if (g[0] === 0x2002)
+        return false; // 6to4 carries an IPv4 we'd have to trust
+    if ((g[0] & 0xfe00) === 0xfc00)
+        return false; // unique local
+    if ((g[0] & 0xffc0) === 0xfe80 || (g[0] & 0xffc0) === 0xfec0)
+        return false; // link-local, site-local
+    return (g[0] & 0xff00) !== 0xff00; // multicast
+}
+/// Whether an address is safe to connect to: public, in either family.
+export function isPublicIp(ip) {
+    if (ip.includes(":")) {
+        const g = v6Groups(ip.replace(/^\[|\]$/g, ""));
+        return g !== null && v6Public(g);
+    }
+    const o = v4Octets(ip);
+    return o !== null && v4Public(o);
+}
+const MAX_BYTES = 256 * 1024;
+const TIMEOUT_MS = 5_000;
+/// The body of `raw`, as text, under the rules above. Throws, naming the rule,
+/// on anything else.
+export async function safeFetchText(raw) {
+    const url = new URL(raw);
+    if (url.protocol !== "https:")
+        throw new Error("only https URLs are fetched");
+    if (url.username || url.password)
+        throw new Error("a URL with credentials in it is refused");
+    if (url.port && url.port !== "443")
+        throw new Error("only the default HTTPS port is fetched");
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const found = isIP(host)
+        ? [{ address: host, family: isIP(host) }]
+        : await lookup(host, { all: true, verbatim: true });
+    if (!found.length)
+        throw new Error(`${host} doesn't resolve`);
+    const bad = found.find((a) => !isPublicIp(a.address));
+    if (bad)
+        throw new Error(`${host} resolves to ${bad.address}, which isn't a public address`);
+    const pinned = found[0];
+    // The connection goes to the address just checked. Newer Node asks for every
+    // address at once (`all`), older for one.
+    const pin = (_name, opts, cb) => {
+        if (opts.all)
+            cb(null, [pinned]);
+        else
+            cb(null, pinned.address, pinned.family);
+    };
+    return await new Promise((resolve, reject) => {
+        const req = request(url, {
+            method: "GET",
+            headers: { accept: "application/json, text/plain;q=0.5", "user-agent": "remesso-find-agent" },
+            lookup: pin,
+        }, (res) => {
+            const status = res.statusCode ?? 0;
+            if (status < 200 || status >= 300) {
+                res.resume();
+                reject(new Error(`${host} answered ${status}${status >= 300 && status < 400 ? ", a redirect, which isn't followed" : ""}`));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            res.on("data", (c) => {
+                size += c.length;
+                if (size > MAX_BYTES)
+                    req.destroy(new Error(`${host} sent more than ${MAX_BYTES / 1024} KB`));
+                else
+                    chunks.push(c);
+            });
+            res.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+            res.on("error", reject);
+        });
+        const timer = setTimeout(() => req.destroy(new Error(`${host} didn't answer within ${TIMEOUT_MS / 1000}s`)), TIMEOUT_MS);
+        req.on("error", (e) => {
+            clearTimeout(timer);
+            reject(e);
+        });
+        req.on("close", () => clearTimeout(timer));
+        req.end();
+    });
+}

package/dist/vendor/standard-webhooks.d.ts

@@ -0,0 +1,8 @@
+export declare const TOLERANCE_SECONDS: number;
+export declare function generateSecret(): string;
+export declare function sign(secret: string, id: string, timestampSeconds: number, body: string): Promise<string>;
+export declare function signedHeaders(secrets: string[], id: string, body: string, timestampSeconds?: number): Promise<Record<string, string>>;
+export declare function verify(raw: string, headers: Headers | Record<string, string>, secret: string, { nowSeconds, toleranceSeconds }?: {
+    nowSeconds?: number | undefined;
+    toleranceSeconds?: number | undefined;
+}): Promise<boolean>;

package/dist/vendor/standard-webhooks.js

@@ -0,0 +1,83 @@
+// Copied from supabase/functions/_shared/standard-webhooks.ts by scripts/build-sdk.ts. Edit the original and re-run;
+// `build-sdk.ts --check` fails while the two differ.
+/// Standard Webhooks (standardwebhooks.com), the scheme Svix speaks. Self signs
+/// its deliveries to us with it, and Remesso signs its own deliveries with it.
+///
+///   signed    = `${webhook-id}.${webhook-timestamp}.${body}`
+///   key       = base64-decode(secret without its `whsec_` prefix)
+///   signature = base64(HMAC-SHA256(key, signed)), sent as `v1,<sig>`,
+///               space-separated when a secret is mid-rotation
+///
+/// The timestamp window is what stops a captured delivery being replayed
+/// later. Web Crypto and nothing else, so the SDK imports this file as it is,
+/// in Node, Deno, Bun or a browser. `standard-webhooks.test.ts` holds it to the
+/// `svix` and `standardwebhooks` libraries.
+export const TOLERANCE_SECONDS = 5 * 60;
+/// A fresh signing secret: 32 random bytes as `whsec_`-prefixed base64.
+export function generateSecret() {
+    return `whsec_${bytesToBase64(crypto.getRandomValues(new Uint8Array(32)))}`;
+}
+/// `v1,<signature>` of `body` under one secret. Throws on a malformed secret:
+/// that is the sender's mistake, not something to swallow.
+export async function sign(secret, id, timestampSeconds, body) {
+    const key = await hmacKey(secret);
+    const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${id}.${timestampSeconds}.${body}`));
+    return `v1,${bytesToBase64(new Uint8Array(mac))}`;
+}
+/// The three headers for one attempt at a delivery. With more than one secret
+/// (a rotation in progress) there is one signature per secret, so a receiver
+/// holding either one verifies. The id stays the same on every attempt; the
+/// timestamp, and so the signature, are new each time.
+export async function signedHeaders(secrets, id, body, timestampSeconds = Math.floor(Date.now() / 1000)) {
+    const signatures = await Promise.all(secrets.map((s) => sign(s, id, timestampSeconds, body)));
+    return {
+        "webhook-id": id,
+        "webhook-timestamp": String(timestampSeconds),
+        "webhook-signature": signatures.join(" "),
+    };
+}
+/// Whether `raw` was signed with `secret` within the tolerance. Reads the
+/// `webhook-*` headers, or the `svix-*` names Svix sends the same values
+/// under. False, never a throw, for anything malformed.
+export async function verify(raw, headers, secret, { nowSeconds = Math.floor(Date.now() / 1000), toleranceSeconds = TOLERANCE_SECONDS } = {}) {
+    const get = (name) => headers instanceof Headers ? headers.get(name) : headers[name] ?? headers[name.toLowerCase()] ?? null;
+    const id = get("webhook-id") ?? get("svix-id");
+    const ts = get("webhook-timestamp") ?? get("svix-timestamp");
+    const sigs = get("webhook-signature") ?? get("svix-signature");
+    if (!id || !ts || !sigs || !secret)
+        return false;
+    const sent = Number(ts);
+    if (!Number.isInteger(sent) || Math.abs(nowSeconds - sent) > toleranceSeconds)
+        return false;
+    let expected;
+    try {
+        expected = (await sign(secret, id, sent, raw)).slice(3);
+    }
+    catch {
+        return false;
+    }
+    return sigs.split(" ").some((part) => {
+        const [version, sig] = part.split(",", 2);
+        return version === "v1" && sig !== undefined && timingSafeEqual(expected, sig);
+    });
+}
+async function hmacKey(secret) {
+    const bytes = Uint8Array.from(atob(secret.replace(/^whsec_/, "")), (c) => c.charCodeAt(0));
+    if (!bytes.length)
+        throw new Error("webhook secret is empty");
+    return await crypto.subtle.importKey("raw", bytes, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+function bytesToBase64(bytes) {
+    let s = "";
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s);
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}

package/dist/vendor/webhook-actions.d.ts

@@ -0,0 +1,84 @@
+export declare const WEBHOOK_DOMAIN: {
+    readonly name: "Remesso";
+    readonly version: "1";
+    readonly chainId: 42220;
+};
+export declare const WEBHOOK_TYPES: {
+    readonly WebhookAction: readonly [{
+        readonly name: "recipient";
+        readonly type: "address";
+    }, {
+        readonly name: "url";
+        readonly type: "string";
+    }, {
+        readonly name: "chainId";
+        readonly type: "uint256";
+    }, {
+        readonly name: "action";
+        readonly type: "string";
+    }, {
+        readonly name: "nonce";
+        readonly type: "string";
+    }, {
+        readonly name: "expiry";
+        readonly type: "uint64";
+    }];
+};
+export declare const WEBHOOK_ACTIONS: readonly ["subscribe", "rotate", "revoke", "replay"];
+export type WebhookActionName = (typeof WEBHOOK_ACTIONS)[number];
+export declare const MAX_ACTION_TTL_SECS: number;
+export declare const MAX_URL_LENGTH = 512;
+export type WebhookAction = {
+    recipient: `0x${string}`;
+    url: string;
+    chainId: number;
+    action: WebhookActionName;
+    nonce: string;
+    expiry: number;
+    signature: `0x${string}`;
+};
+export declare function webhookTypedData(a: Omit<WebhookAction, "signature">): {
+    domain: {
+        readonly name: "Remesso";
+        readonly version: "1";
+        readonly chainId: 42220;
+    };
+    types: {
+        readonly WebhookAction: readonly [{
+            readonly name: "recipient";
+            readonly type: "address";
+        }, {
+            readonly name: "url";
+            readonly type: "string";
+        }, {
+            readonly name: "chainId";
+            readonly type: "uint256";
+        }, {
+            readonly name: "action";
+            readonly type: "string";
+        }, {
+            readonly name: "nonce";
+            readonly type: "string";
+        }, {
+            readonly name: "expiry";
+            readonly type: "uint64";
+        }];
+    };
+    primaryType: "WebhookAction";
+    message: {
+        recipient: `0x${string}`;
+        url: string;
+        chainId: bigint;
+        action: "revoke" | "subscribe" | "rotate" | "replay";
+        nonce: string;
+        expiry: bigint;
+    };
+};
+export declare function endpointProblem(url: string): string | null;
+export declare function checkAction(body: Record<string, unknown>, nowSecs: number): {
+    ok: true;
+    action: WebhookAction;
+} | {
+    ok: false;
+    error: string;
+};