tenzro-wallet 0.1.0

package/dist/ports/agent/payment-rails.d.ts

@@ -0,0 +1,140 @@
+/**
+ * PaymentRailsPort — agent-payment rail dispatcher.
+ *
+ * Tenzro's `PaymentClient` exposes five rails through one client class:
+ *
+ *   • MPP            — Tempo's Machine Payments Protocol
+ *   • x402           — Coinbase HTTP-402, x402 Foundation governance,
+ *                      absorbed as a payment method inside AP2
+ *   • AP2            — FIDO Alliance Agentic-Payments TWG (v0.2, Apr 2026)
+ *   • Visa TAP       — Visa Trusted Agent Protocol (RFC 9421 sigs)
+ *   • Mastercard     — Mastercard Agent Pay (SingleUse / SessionBound /
+ *                      Recurring tokens, KYA tier checks)
+ *
+ * The wallet doesn't pick the rail — the merchant or resource declares it
+ * (HTTP 402 header, AP2 mandate type, etc.). The wallet's job is to
+ * surface them through one port so a single agent-spending UI can drive
+ * them all under the same SessionKey scope.
+ *
+ * Per `reference_agentic_payments_2026.md`: x402 is now subsumed inside
+ * AP2 schema-wise, but stays a distinct *rail* on the wire (HTTP 402 vs.
+ * AP2 mandate). We keep the methods separate so callers can opt into the
+ * rail their counterparty actually speaks.
+ */
+export interface PaymentReceipt {
+    readonly receiptId: string;
+    /** Underlying tx hash on the settlement chain, when applicable. */
+    readonly txHash?: string;
+    /** Engine-reported status (Approved / Settled / Pending / Failed / …). */
+    readonly status: string;
+    /** Free-form metadata the engine attached. */
+    readonly meta?: Readonly<Record<string, unknown>>;
+}
+export interface PayMppRequest {
+    readonly url: string;
+    readonly payerDid?: string;
+}
+export interface PayX402Request {
+    readonly url: string;
+    readonly payerDid?: string;
+}
+export interface PayAp2Request {
+    /** Agent DID that authorises the payment under its delegation scope. */
+    readonly agentDid: string;
+    readonly url: string;
+    /** Decimal-string amount (preserves precision; matches AP2 wire shape). */
+    readonly amount: string;
+}
+export interface PayVisaTapRequest {
+    /** Visa-issued credential. Opaque; forwarded verbatim. */
+    readonly credential: Readonly<Record<string, unknown>>;
+}
+export interface PayMastercardRequest {
+    /**
+     * Mastercard-issued payment credential — typically one of the three
+     * token kinds: SingleUse, SessionBound, Recurring.
+     */
+    readonly credential: Readonly<Record<string, unknown>>;
+}
+export interface SignVisaTapRequest {
+    /**
+     * RFC 9421 HTTP message-signature inputs the SDK turns into the
+     * `Signature-Input` / `Signature` header pair. The wallet only declares
+     * what it carries on the wire — composition happens in the SDK.
+     */
+    readonly request: {
+        readonly method: string;
+        readonly url: string;
+        readonly headers: Readonly<Record<string, string>>;
+        readonly body?: string;
+    };
+    /** Agent DID whose key signs the message. */
+    readonly agentDid: string;
+}
+export interface VisaTapSignedRequest {
+    /** Original headers plus `Signature-Input` and `Signature`. */
+    readonly headers: Readonly<Record<string, string>>;
+    /** Echoed back so callers don't have to thread the URL separately. */
+    readonly url: string;
+    readonly method: string;
+}
+/** Mastercard token kinds per Mastercard Agent Pay spec. */
+export type MastercardTokenKind = 'SingleUse' | 'SessionBound' | 'Recurring';
+export interface IssueMastercardTokenRequest {
+    readonly agentDid: string;
+    readonly kind: MastercardTokenKind;
+    /**
+     * Per-token-kind binding params — opaque to the kernel (recurring schedule,
+     * session id, single-use cap, etc.). The SDK validates against KYA tier.
+     */
+    readonly params: Readonly<Record<string, unknown>>;
+}
+export interface MastercardToken {
+    readonly tokenId: string;
+    readonly kind: MastercardTokenKind;
+    /** Decimal-string cap; "0" means uncapped at this layer (KYA tier still applies). */
+    readonly cap: string;
+    readonly expiresAt: number;
+    readonly raw: Readonly<Record<string, unknown>>;
+}
+export interface PaymentChallenge {
+    /** Opaque challenge id the gateway echoes back. */
+    readonly challengeId: string;
+    /** Resource the challenge gates. */
+    readonly resource: string;
+    readonly amount: number;
+    readonly asset: string;
+    readonly protocol: string;
+    /** Engine fields the wallet should not interpret. */
+    readonly raw: Readonly<Record<string, unknown>>;
+}
+export interface CreateChallengeRequest {
+    readonly resource: string;
+    readonly amount: number;
+    /** Defaults to 'USDC' on the SDK side. */
+    readonly asset?: string;
+    /** Defaults to 'mpp' on the SDK side. */
+    readonly protocol?: 'mpp' | 'x402' | 'ap2';
+}
+export interface PaymentRailsPort {
+    createChallenge(req: CreateChallengeRequest): Promise<PaymentChallenge>;
+    payMpp(req: PayMppRequest): Promise<PaymentReceipt>;
+    payX402(req: PayX402Request): Promise<PaymentReceipt>;
+    payAp2(req: PayAp2Request): Promise<PaymentReceipt>;
+    payVisaTap(req: PayVisaTapRequest): Promise<PaymentReceipt>;
+    payMastercard(req: PayMastercardRequest): Promise<PaymentReceipt>;
+    getReceipt(receiptId: string): Promise<PaymentReceipt | null>;
+    /**
+     * Produce RFC 9421 message-signature headers for a Visa TAP request.
+     * Throws "SDK pending" until `tenzro-sdk`'s PaymentClient exposes
+     * `signVisaTap` (DESIGN.md §11.1).
+     */
+    signVisaTap(req: SignVisaTapRequest): Promise<VisaTapSignedRequest>;
+    /**
+     * Issue a Mastercard Agent Pay token for the given agent + kind. Throws
+     * "SDK pending" until `tenzro-sdk`'s PaymentClient exposes
+     * `issueMastercardToken` (DESIGN.md §11.1).
+     */
+    issueMastercardToken(req: IssueMastercardTokenRequest): Promise<MastercardToken>;
+}
+//# sourceMappingURL=payment-rails.d.ts.map

package/dist/ports/agent/payment-rails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-rails.d.ts","sourceRoot":"","sources":["../../../src/ports/agent/payment-rails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAUD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAAC;AAE7E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,qFAAqF;IACrF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpD,UAAU,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5D,aAAa,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAI9D;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEpE;;;;OAIG;IACH,oBAAoB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAClF"}

package/dist/ports/agent/payment-rails.js

@@ -0,0 +1,25 @@
+/**
+ * PaymentRailsPort — agent-payment rail dispatcher.
+ *
+ * Tenzro's `PaymentClient` exposes five rails through one client class:
+ *
+ *   • MPP            — Tempo's Machine Payments Protocol
+ *   • x402           — Coinbase HTTP-402, x402 Foundation governance,
+ *                      absorbed as a payment method inside AP2
+ *   • AP2            — FIDO Alliance Agentic-Payments TWG (v0.2, Apr 2026)
+ *   • Visa TAP       — Visa Trusted Agent Protocol (RFC 9421 sigs)
+ *   • Mastercard     — Mastercard Agent Pay (SingleUse / SessionBound /
+ *                      Recurring tokens, KYA tier checks)
+ *
+ * The wallet doesn't pick the rail — the merchant or resource declares it
+ * (HTTP 402 header, AP2 mandate type, etc.). The wallet's job is to
+ * surface them through one port so a single agent-spending UI can drive
+ * them all under the same SessionKey scope.
+ *
+ * Per `reference_agentic_payments_2026.md`: x402 is now subsumed inside
+ * AP2 schema-wise, but stays a distinct *rail* on the wire (HTTP 402 vs.
+ * AP2 mandate). We keep the methods separate so callers can opt into the
+ * rail their counterparty actually speaks.
+ */
+export {};
+//# sourceMappingURL=payment-rails.js.map

package/dist/ports/agent/payment-rails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-rails.js","sourceRoot":"","sources":["../../../src/ports/agent/payment-rails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/ports/agent/principal-chain.d.ts

@@ -0,0 +1,95 @@
+/**
+ * PrincipalChainPort — read-only access to the receipt principal-chain
+ * (Agent-Swarm Spec 5).
+ *
+ * Every settlement / payment / lifecycle receipt produced by the network
+ * grows a typed `principal_chain` field captured at receipt write time:
+ * a delegation path from the acting identity (`actor`) up to the
+ * controller, plus the controller's KYC tier and bond figures. The
+ * chain is frozen — later revocations don't invalidate it.
+ *
+ * Auditors, dashboards, and seed-agent governance walk these chains via
+ * the SDK's `PrincipalChainClient`; the wallet exposes the same surface
+ * so it can render "who paid for this" trails alongside transactions.
+ */
+export type PrincipalRole = 'controller' | 'delegated_agent' | 'autonomous_agent';
+export type IdentityType = 'human' | 'machine';
+export interface PrincipalLink {
+    /** DID string of the link. */
+    readonly did: string;
+    readonly identityType: IdentityType;
+    /** Hex-encoded SHA-256 of the DelegationScope under which this link acted. */
+    readonly delegationScopeId?: string;
+    readonly role: PrincipalRole;
+    /**
+     * `true` when the link's identity could not be resolved at receipt
+     * write time (revoked, not-found). Receipts are still written — the
+     * regulator sees a partially-resolvable chain with an explicit gap.
+     */
+    readonly tombstone: boolean;
+}
+export interface PrincipalChainRecord {
+    /** DID of the acting identity (signer of the underlying tx). */
+    readonly actor: string;
+    /**
+     * Top-down list of intermediate links. Empty when the controller acted
+     * directly (`delegationDepth === 0`).
+     */
+    readonly chain: readonly PrincipalLink[];
+    /** The controller link itself — the legally responsible principal. */
+    readonly controller: PrincipalLink;
+    /** 0 = Unverified, 1 = Basic, 2 = Enhanced, 3 = Full. */
+    readonly controllerKycTier: number;
+    /** Bond posted by the controller, in TNZO base units. */
+    readonly controllerBond?: bigint;
+    /** Bond posted directly against the actor's DID (Spec 9). */
+    readonly actorBond?: bigint;
+    /**
+     * Sum of all promotion-eligible Active bonds the controller has posted
+     * across every agent they own (Spec 9) — total skin-in-the-game.
+     */
+    readonly controllerBondAggregate?: bigint;
+    /** Number of delegation levels between actor and controller. */
+    readonly delegationDepth: number;
+    /** Block height at which the chain was resolved and frozen. */
+    readonly frozenAtBlock: bigint;
+}
+export interface PrincipalChainSummaryRecord {
+    readonly actor: string;
+    readonly controller: string;
+    readonly controllerKycTier: number;
+    readonly controllerBond?: bigint;
+    readonly actorBond?: bigint;
+    readonly controllerBondAggregate?: bigint;
+    readonly delegationDepth: number;
+    readonly hasTombstone: boolean;
+    readonly frozenAtBlock: bigint;
+}
+export interface ControllerActivitySummaryRecord {
+    readonly controllerDid: string;
+    readonly receiptCount: bigint;
+    /** Total settled value in the window, in TNZO base units. */
+    readonly totalValueTnzo: bigint;
+    /** Distinct DIDs that acted under the controller in the window. */
+    readonly agentsActedUnder: readonly string[];
+    readonly killSwitchEvents: number;
+    readonly kycTierAtOldest: number;
+    readonly kycTierAtNewest: number;
+    readonly bondMin: bigint;
+    readonly bondMax: bigint;
+    /** Inclusive lower bound, unix seconds; undefined if open-ended. */
+    readonly since?: number;
+    /** Inclusive upper bound, unix seconds; undefined if open-ended. */
+    readonly until?: number;
+}
+export interface PrincipalChainPort {
+    /** Full chain for a single receipt. Returns null if unknown. */
+    getReceiptPrincipalChain(receiptId: string): Promise<PrincipalChainRecord | null>;
+    /** Compact summaries for every receipt with the given actor DID. */
+    listReceiptsByActor(actorDid: string): Promise<PrincipalChainSummaryRecord[]>;
+    /** Compact summaries for every receipt terminating at controllerDid. */
+    listReceiptsByController(controllerDid: string): Promise<PrincipalChainSummaryRecord[]>;
+    /** Aggregate activity metrics for a controller. Returns null if unknown. */
+    summarizeController(controllerDid: string): Promise<ControllerActivitySummaryRecord | null>;
+}
+//# sourceMappingURL=principal-chain.d.ts.map

package/dist/ports/agent/principal-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-chain.d.ts","sourceRoot":"","sources":["../../../src/ports/agent/principal-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAElF,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,yDAAyD;IACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,yDAAyD;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,gEAAgE;IAChE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAElF,oEAAoE;IACpE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAE9E,wEAAwE;IACxE,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAExF,4EAA4E;IAC5E,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;CAC7F"}

package/dist/ports/agent/principal-chain.js

@@ -0,0 +1,16 @@
+/**
+ * PrincipalChainPort — read-only access to the receipt principal-chain
+ * (Agent-Swarm Spec 5).
+ *
+ * Every settlement / payment / lifecycle receipt produced by the network
+ * grows a typed `principal_chain` field captured at receipt write time:
+ * a delegation path from the acting identity (`actor`) up to the
+ * controller, plus the controller's KYC tier and bond figures. The
+ * chain is frozen — later revocations don't invalidate it.
+ *
+ * Auditors, dashboards, and seed-agent governance walk these chains via
+ * the SDK's `PrincipalChainClient`; the wallet exposes the same surface
+ * so it can render "who paid for this" trails alongside transactions.
+ */
+export {};
+//# sourceMappingURL=principal-chain.js.map

package/dist/ports/agent/principal-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-chain.js","sourceRoot":"","sources":["../../../src/ports/agent/principal-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/ports/agent/session-key.d.ts

@@ -0,0 +1,94 @@
+/**
+ * SessionKeyPort — scoped delegations under TDIP.
+ *
+ * This is the primitive every agent-payment rail rests on. AP2 mandates,
+ * Mastercard Agent Pay tokens, x402 micropayment caps, Visa TAP scopes —
+ * all of them are *expressions* of a session key with a bounded
+ * delegation scope. The wallet's job is to:
+ *
+ *   1. Create scoped session keys ("this agent may spend up to 10 USDC/day
+ *      on inference services for the next hour").
+ *   2. Inspect / list active scopes for the user UI.
+ *   3. Revoke a scope when the user wants to cut off an agent.
+ *
+ * Server-side, the auth engine enforces. The wallet does NOT decide
+ * whether a tx is in-policy — it asks. A compromised wallet client cannot
+ * widen a scope; the engine rejects.
+ *
+ * Wire mapping: `tenzro_onboardDelegatedAgent`, `tenzro_revokeDid`,
+ * `tenzro_revokeJwt` — i.e. delegation scopes are JWT-bound under the
+ * controller's act-chain. Creating a scope is "onboard a delegated
+ * agent under controllerDid with this scope"; revoking is revoking the
+ * JWT (single scope) or the DID (cascades all scopes).
+ *
+ * The opaque `scope` shape is whatever the engine accepts — currently a
+ * `Record<string, unknown>` matching `SpendingPolicy::is_allowed()`'s
+ * input. The port doesn't validate; it forwards. AP2/Mastercard/Visa
+ * adapters build scope objects that match their respective schemas and
+ * pass them through.
+ */
+export interface SessionScope {
+    /** Human-readable label shown in approver UI. */
+    readonly label: string;
+    /** Capability strings — "inference", "rpc-call", "storage", custom tags. */
+    readonly capabilities: readonly string[];
+    /** Engine-specific scope object. Forwarded as-is to the auth engine. */
+    readonly delegationScope: Readonly<Record<string, unknown>>;
+    /** Optional DPoP thumbprint to bind the resulting JWT to a specific key. */
+    readonly dpopJkt?: string;
+}
+export interface CreateSessionRequest {
+    /** Controller DID (the human or upstream agent granting authority). */
+    readonly controllerDid: string;
+    readonly scope: SessionScope;
+}
+export interface CreatedSession {
+    /** DID of the newly-onboarded delegated agent. */
+    readonly agentDid: string;
+    /** Bearer JWT for the new agent. The wallet hands this to the agent. */
+    readonly accessToken: string;
+    /** Refresh token for renewal. */
+    readonly refreshToken?: string;
+    /** Unix-ms when the access token expires. */
+    readonly expiresAt: number;
+}
+export interface ActiveSession {
+    readonly agentDid: string;
+    readonly controllerDid: string;
+    readonly capabilities: readonly string[];
+    readonly delegationScope: Readonly<Record<string, unknown>>;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+    readonly status: 'active' | 'revoked' | 'expired';
+}
+export interface RevokeSessionRequest {
+    /**
+     * Either a JWT `jti` (revokes a single session) or a DID (cascades
+     * — invalidates every JWT minted under that DID and every descendant
+     * DID in the act-chain).
+     */
+    readonly target: {
+        kind: 'jti';
+        jti: string;
+    } | {
+        kind: 'did';
+        did: string;
+    };
+    readonly reason?: string;
+}
+export interface RevokeSessionResult {
+    readonly target: string;
+    readonly status: string;
+}
+export interface SessionKeyPort {
+    /** Create a scoped session key under `controllerDid`. */
+    create(req: CreateSessionRequest): Promise<CreatedSession>;
+    /**
+     * List active sessions for the controller. Used by the wallet UI to
+     * render "agents acting on your behalf" + a revoke button.
+     */
+    list(controllerDid: string): Promise<readonly ActiveSession[]>;
+    /** Revoke a single session (jti) or every session under a DID. */
+    revoke(req: RevokeSessionRequest): Promise<RevokeSessionResult>;
+}
+//# sourceMappingURL=session-key.d.ts.map

package/dist/ports/agent/session-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-key.d.ts","sourceRoot":"","sources":["../../../src/ports/agent/session-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,wEAAwE;IACxE,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iCAAiC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,MAAM,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3D;;;OAGG;IACH,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAE/D,kEAAkE;IAClE,MAAM,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjE"}

package/dist/ports/agent/session-key.js

@@ -0,0 +1,31 @@
+/**
+ * SessionKeyPort — scoped delegations under TDIP.
+ *
+ * This is the primitive every agent-payment rail rests on. AP2 mandates,
+ * Mastercard Agent Pay tokens, x402 micropayment caps, Visa TAP scopes —
+ * all of them are *expressions* of a session key with a bounded
+ * delegation scope. The wallet's job is to:
+ *
+ *   1. Create scoped session keys ("this agent may spend up to 10 USDC/day
+ *      on inference services for the next hour").
+ *   2. Inspect / list active scopes for the user UI.
+ *   3. Revoke a scope when the user wants to cut off an agent.
+ *
+ * Server-side, the auth engine enforces. The wallet does NOT decide
+ * whether a tx is in-policy — it asks. A compromised wallet client cannot
+ * widen a scope; the engine rejects.
+ *
+ * Wire mapping: `tenzro_onboardDelegatedAgent`, `tenzro_revokeDid`,
+ * `tenzro_revokeJwt` — i.e. delegation scopes are JWT-bound under the
+ * controller's act-chain. Creating a scope is "onboard a delegated
+ * agent under controllerDid with this scope"; revoking is revoking the
+ * JWT (single scope) or the DID (cascades all scopes).
+ *
+ * The opaque `scope` shape is whatever the engine accepts — currently a
+ * `Record<string, unknown>` matching `SpendingPolicy::is_allowed()`'s
+ * input. The port doesn't validate; it forwards. AP2/Mastercard/Visa
+ * adapters build scope objects that match their respective schemas and
+ * pass them through.
+ */
+export {};
+//# sourceMappingURL=session-key.js.map

package/dist/ports/agent/session-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-key.js","sourceRoot":"","sources":["../../../src/ports/agent/session-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG"}

package/dist/ports/agent/tee-attestation.d.ts

@@ -0,0 +1,51 @@
+/**
+ * TeeAttestationPort — verify the node's TEE attestation.
+ *
+ * The wallet's hybrid-signing path leans on a TEE-resident co-signer at
+ * the Tenzro node. Before trusting that co-signer (in particular before
+ * sending a passkey-derived share to it), the wallet should verify the
+ * node's attestation report against the TEE vendor's certificate chain.
+ *
+ * The wallet does NOT itself decode TDX/SEV/Nitro reports — that's a
+ * mountain of vendor-specific code, with cert chains that need keeping
+ * up to date. Instead the node exposes verification as an RPC
+ * (`tenzro_verifyTeeAttestation`); the wallet calls in. Trust model:
+ * the same engine that issues the attestation also verifies it, which
+ * isn't useful in isolation. The protection comes from the wallet
+ * pinning the node's expected vendor + measurement off-band (e.g. via a
+ * release manifest) and then checking the attestation result *and* the
+ * report's measurement field against that pin.
+ *
+ * This port surfaces:
+ *   - `detect`         — what TEE the node says it has
+ *   - `getAttestation` — fetch a fresh attestation report
+ *   - `verify`         — verify an attestation (typically the one just fetched)
+ *
+ * The wallet UI uses these to render a "verified" badge and to gate
+ * sensitive flows on a green attestation.
+ */
+export interface TeeInfo {
+    readonly available: boolean;
+    /** "intel-tdx", "amd-sev-snp", "aws-nitro", "nvidia-gpu". */
+    readonly vendor: string;
+    readonly capabilities: readonly string[];
+}
+export interface AttestationReport {
+    /** Hex-encoded report bytes. The wallet treats these as opaque except
+     *  for pinning-time measurement comparisons. */
+    readonly report: string;
+    /** Hex-encoded vendor signature over `report`. */
+    readonly signature: string;
+    /** X.509 certificate chain (PEM strings). */
+    readonly certificateChain: readonly string[];
+}
+export interface AttestationVerifyResult {
+    readonly valid: boolean;
+    readonly message?: string;
+}
+export interface TeeAttestationPort {
+    detect(): Promise<TeeInfo>;
+    getAttestation(teeType: string): Promise<AttestationReport>;
+    verify(attestationHex: string, teeType: string): Promise<AttestationVerifyResult>;
+}
+//# sourceMappingURL=tee-attestation.d.ts.map

package/dist/ports/agent/tee-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-attestation.d.ts","sourceRoot":"","sources":["../../../src/ports/agent/tee-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC;oDACgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACnF"}

package/dist/ports/agent/tee-attestation.js

@@ -0,0 +1,28 @@
+/**
+ * TeeAttestationPort — verify the node's TEE attestation.
+ *
+ * The wallet's hybrid-signing path leans on a TEE-resident co-signer at
+ * the Tenzro node. Before trusting that co-signer (in particular before
+ * sending a passkey-derived share to it), the wallet should verify the
+ * node's attestation report against the TEE vendor's certificate chain.
+ *
+ * The wallet does NOT itself decode TDX/SEV/Nitro reports — that's a
+ * mountain of vendor-specific code, with cert chains that need keeping
+ * up to date. Instead the node exposes verification as an RPC
+ * (`tenzro_verifyTeeAttestation`); the wallet calls in. Trust model:
+ * the same engine that issues the attestation also verifies it, which
+ * isn't useful in isolation. The protection comes from the wallet
+ * pinning the node's expected vendor + measurement off-band (e.g. via a
+ * release manifest) and then checking the attestation result *and* the
+ * report's measurement field against that pin.
+ *
+ * This port surfaces:
+ *   - `detect`         — what TEE the node says it has
+ *   - `getAttestation` — fetch a fresh attestation report
+ *   - `verify`         — verify an attestation (typically the one just fetched)
+ *
+ * The wallet UI uses these to render a "verified" badge and to gate
+ * sensitive flows on a green attestation.
+ */
+export {};
+//# sourceMappingURL=tee-attestation.js.map

package/dist/ports/agent/tee-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-attestation.js","sourceRoot":"","sources":["../../../src/ports/agent/tee-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/ports/bridge/adapters/bridge-adapter-base.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Shared body for the wallet's per-vendor bridge adapters. Each adapter
+ * (LI.FI, CCIP, LayerZero, Wormhole, deBridge, Canton) is the wallet's
+ * UX-side abstraction — one row in the route picker per vendor. Under
+ * the hood they all forward to the same `tenzro-sdk` `BridgeClient`,
+ * filtering by `adapter` (the SDK's name for `vendor`).
+ *
+ * SDK shape this targets (verified against `tenzro-sdk@0.1.0`
+ * `src/bridge.ts`):
+ *
+ *   - `client.bridge().getRoutes(fromChain, toChain, token?)`
+ *      → `BridgeRoute[]` (one entry per available vendor; the wallet
+ *      filters to its own `adapterId` and synthesises the `BridgeQuote`).
+ *   - `client.bridge().bridgeTokens(fromChain, toChain, token, amount,
+ *      recipient, adapter?)`
+ *      → `BridgeTransfer { id, sourceChain, targetChain, assetId, amount,
+ *      sender, recipient, status, txHash, bridgeFee, completedAt? }`.
+ *      The wallet maps this to a `BridgeBuildResult` whose single
+ *      transaction wraps the SDK-returned tx hash for surface display.
+ *   - `client.bridge().getTransferStatus(transferId)`
+ *      → `TransferStatus { transfer_id, status, source_tx_hash?,
+ *      destination_tx_hash?, updated_at }`.
+ *      The wallet wraps this in an async-iterable that polls until a
+ *      terminal phase (`delivered` / `failed`).
+ *
+ * The wallet's `BridgeRoutePort` surface (quote → build → track) is
+ * UX-shaped; it doesn't perfectly match the SDK's flatter API. The
+ * adapter does the mapping:
+ *
+ *   - `quote()` calls `getRoutes()` and finds the entry matching
+ *     `adapterId`. The route's `opaque` payload carries the original
+ *     request fields the wallet needs to call `bridgeTokens` later.
+ *   - `build()` reads the `opaque` payload, calls `bridgeTokens`,
+ *     and returns the SDK transfer's `id` as `trackerId`.
+ *   - `track()` polls `getTransferStatus(trackerId)` on a 2 s tick
+ *     until the transfer is `delivered` or `failed`.
+ */
+import type { BridgeClient } from 'tenzro-sdk';
+import type { BridgeAdapterId, BridgeRoutePort } from '../bridge.js';
+/**
+ * Type alias for the SDK's `BridgeClient`. We take a structural
+ * super-type for testability (the test suite injects a fake), but the
+ * real adapter accepts the SDK class instance as-is.
+ */
+export type BridgeClientLike = Partial<Pick<BridgeClient, 'getRoutes' | 'bridgeTokens' | 'getTransferStatus' | 'listAdapters'>>;
+export declare function bridgeAdapterFromClient(vendor: BridgeAdapterId, client: BridgeClientLike | undefined): BridgeRoutePort;
+//# sourceMappingURL=bridge-adapter-base.d.ts.map

package/dist/ports/bridge/adapters/bridge-adapter-base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-adapter-base.d.ts","sourceRoot":"","sources":["../../../../src/ports/bridge/adapters/bridge-adapter-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EACV,eAAe,EAKf,eAAe,EAGhB,MAAM,cAAc,CAAC;AAEtB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CACpC,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,cAAc,GAAG,mBAAmB,GAAG,cAAc,CAAC,CACxF,CAAC;AAkBF,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,eAAe,CAmFjB"}