twzrd-x402-gate 0.5.3 → 0.6.0

package/README.md

@@ -18,7 +18,11 @@ const client = new x402Client();
 client.register("solana:*", new ExactSvmScheme(svmSigner));
 // Optional: client.register("eip155:*", new ExactEvmScheme(evmSigner));
 
-installTwzrdX402ClientHook(client, { gateOnCanSpend: true });
+installTwzrdX402ClientHook(client, {
+  gateOnCanSpend: false, // decision-only default (warn allowed)
+  refuseWashFlagged: true,
+});
+// Strict opt-in: gateOnCanSpend: true — also block when can_spend=false
 // → onBeforePaymentCreation: scores selectedRequirements, abort if policy denies
 
 const fetchWithPayment = wrapFetchWithPayment(fetch, client);
@@ -89,6 +93,92 @@ Dogfood:
 npm install twzrd-x402-gate
 ```
 
+## TWZRD Payment Control (protocol-neutral authorization core)
+
+The gate now ships a protocol-neutral policy runtime underneath the x402 surface.
+Defining invariant: **a signer path that calls `assertIntentApproved` will not sign
+an intent that differs from what TWZRD evaluated.** (Honest scope: TWZRD does not
+own third-party wallets - the binding is enforceable exactly where the check runs
+before the signer, not as a claim over arbitrary wallet internals.)
+
+```typescript
+import {
+  evaluateIntent,
+  assertIntentApproved,
+  createLocalDecisionSigner,
+  createDecisionRegistry,
+  x402RequirementsToIntent, // or ap2CheckoutToIntent
+} from "twzrd-x402-gate";
+
+const signer = createLocalDecisionSigner();
+const registry = createDecisionRegistry(); // consume-once
+
+const intent = x402RequirementsToIntent(selectedRequirements, { resourceUrl });
+const token = await evaluateIntent(intent, {
+  signer,
+  mandate,                    // user/company mandate (purpose, ceilings, resource scope)
+  policy,                     // local hard controls (caps, lists, recurring checks)
+  intelligence: twzrdIntel,   // optional remote counterparty intelligence
+});
+
+// Wallet-side, immediately before signing the EXACT intent:
+assertIntentApproved(intentBeingSigned, token, {
+  registry,                       // replay / consume-once
+  publicKeyPem: signer.publicKeyPem, // signature verification
+});
+// throws INTENT_HASH_MISMATCH | DECISION_EXPIRED | DECISION_NOT_ALLOW |
+//        DECISION_REPLAYED | BAD_SIGNATURE -> the signer is never invoked
+```
+
+- `PaymentIntent` v1 (frozen): protocol `x402 | ap2 | ucp | mpp | direct` +
+  network/asset/amount/payTo + resource + facilitator + mandate + recurrence
+  context, bound into one canonical `tiv1:` intent hash.
+- Decisions are signed, expiring `DecisionToken`s - "policy version X approved
+  this exact transaction at this timestamp", auditable offline.
+- A **block is a signed decision**, not an exception - refusals audit the same
+  way approvals do.
+- Local hard controls (mandate scope, ceilings, allow/blocklists, cumulative
+  caps, recurring price checks) never depend on API availability; remote
+  intelligence (wash/fleet, counterparty score) plugs in via a provider.
+- The category test lives in
+  [`test/payment-control.test.ts`](./test/payment-control.test.ts): a mandate
+  permits software under $100, a $12 checkout is approved, orchestration
+  mutates `payTo` after approval, the wallet refuses on hash mismatch,
+  `signerInvocationCount === 0`, and both the decision and the refusal verify
+  from audit records alone.
+
+### On the client hook (opt-in)
+
+`installTwzrdX402ClientHook` wires the runtime into the official
+`onBeforePaymentCreation` seat. Pass `paymentControl` to build the canonical
+intent, run the policy runtime (with the hook's own preflight fed in as remote
+intelligence), and surface a signed, intent-bound `PaymentDecision`:
+
+```typescript
+import { installTwzrdX402ClientHook, createLocalDecisionSigner } from "twzrd-x402-gate";
+
+const signer = createLocalDecisionSigner();
+installTwzrdX402ClientHook(client, {
+  paymentControl: {
+    signer,
+    mandate,                       // optional user/company mandate
+    policy: { maxAmountUsd: "50" }, // optional local hard controls
+  },
+  onDecision: ({ intent, decision }) => handOff(intent, decision), // → assertIntentApproved
+});
+```
+
+- **Tighten-only composition:** a `paymentControl` block aborts even when the
+  legacy preflight allowed; it never loosens a legacy denial.
+- **Opt-in:** with `paymentControl` unset the hook behaves exactly as before.
+- x402 wire amounts (USDC micro units) are converted to the decimal USD the
+  runtime expects before policy evaluation. (The `x402RequirementsToIntent`
+  adapter still passes the raw wire amount through into the decimal `amount`
+  field — a latent unit bug fixed at the hook boundary here; the adapter fix is
+  a follow-up.)
+- Hook binding test:
+  [`test/intent-binding.test.ts`](./test/intent-binding.test.ts).
+
 ### Experimental CLI: `twzrd-safe-fetch` (AgentCash advisory pre-check)
 
 > **Not a challenge-bound firewall.** Classification: `advisory_precheck`.
@@ -413,6 +503,33 @@ A 402 whose payment requirements yield **no identifiable seller wallet** (missin
 | `x402Fetch` | — | — | x402-capable fetch for `autoReceipt` |
 | `onReceipt` | — | — | Callback after receipt is captured |
 | `disabled` (`installTwzrdAutoGate` only) | `TWZRD_AUTO_GATE=0`/`false` | `false` | Bypass the guard entirely — `payWrap` gets the raw, unguarded fetch |
+| `attribution` | `TWZRD_ATTRIBUTION_INTEGRATION` + `TWZRD_ATTRIBUTION_RUN_ID` | — | Opt-in run attribution (see below) |
+
+## Run attribution (optional, for integration correlation)
+
+When you set `attribution`, the gate stamps **only the TWZRD preflight request** (never the
+paid `/v1/intel/trust` call or the resource fetch) with correlation headers:
+
+```
+X-TWZRD-Integration: <integration>
+X-TWZRD-Run-Id:      <runId>
+X-TWZRD-Client:      twzrd-x402-gate/<version>
+```
+
+```ts
+installTwzrdAutoGate((guarded) => wrapFetchWithPayment(guarded, wallet), {
+  attribution: {
+    integration: "payai-x402-solana-pr38",
+    runId: crypto.randomUUID(), // echo this in your transcript / issue comment
+  },
+});
+```
+
+This is **correlation evidence, not proof of adoption** — the `runId` is caller-supplied and
+spoofable. A run counts as an external execution only when the same `runId` (1) appears in the
+integrator's own transcript, (2) is observed server-side with a real policy decision, and (3)
+comes from non-internal lineage. No PII, secret, wallet, or payload is added; both fields must
+be set or nothing is stamped.
 
 ## Compatibility note
 

package/dist/config.d.ts

@@ -16,6 +16,11 @@ export type ResolvedTwzrdGateConfig = {
     unsupportedNetworkMode: "observe" | "strict";
     fetch: typeof fetch;
     onWarnUpsell?: (ctx: TwzrdUpsellContext) => void | Promise<void>;
+    /** Opt-in preflight run attribution (see TwzrdGateConfig.attribution). */
+    attribution?: {
+        integration: string;
+        runId: string;
+    };
 };
 export declare function resolveConfig(overrides?: TwzrdGateConfig): ResolvedTwzrdGateConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,sBAAsB,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7C,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE,CAAC;AAYF,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,eAAe,GAAG,uBAAuB,CA0ElF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,sBAAsB,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7C,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,0EAA0E;IAC1E,WAAW,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD,CAAC;AAYF,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,eAAe,GAAG,uBAAuB,CAuFlF"}

package/dist/config.js

@@ -52,6 +52,15 @@ export function resolveConfig(overrides) {
     if (typeof fetchFn !== "function") {
         throw new Error("[twzrd-x402-gate] fetch is not available; pass config.fetch");
     }
+    // Opt-in preflight attribution. Sent ONLY when both fields resolve (no partial
+    // stamping). Overrides win; env fallback (TWZRD_ATTRIBUTION_INTEGRATION +
+    // TWZRD_ATTRIBUTION_RUN_ID) exists for the zero-spend harness.
+    let attribution;
+    const attrIntegration = overrides?.attribution?.integration ?? process.env.TWZRD_ATTRIBUTION_INTEGRATION;
+    const attrRunId = overrides?.attribution?.runId ?? process.env.TWZRD_ATTRIBUTION_RUN_ID;
+    if (attrIntegration && attrRunId) {
+        attribution = { integration: attrIntegration, runId: attrRunId };
+    }
     return {
         intelBase,
         preflightMinScore,
@@ -63,6 +72,7 @@ export function resolveConfig(overrides) {
         unsupportedNetworkMode,
         fetch: fetchFn,
         onWarnUpsell: overrides?.onWarnUpsell,
+        attribution,
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAqBA,SAAS,mBAAmB,CAAC,GAAuB;IAClD,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;IACtC,OAAO,IAAI,GAAG,CACZ,MAAM;SACH,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA2B;IACvD,MAAM,SAAS,GAAG,CAChB,SAAS,EAAE,SAAS;QACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,yBAAyB,CAC1B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEtB,MAAM,MAAM,GACV,SAAS,EAAE,iBAAiB;QAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,CAAC,CAAC;IACxD,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjF,MAAM,cAAc,GAClB,SAAS,EAAE,cAAc,IAAI,IAAI;QAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAE7D,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,QAAQ,GACZ,SAAS,EAAE,QAAQ;QACnB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM;YACrC,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,CAAC;IAEzC,4EAA4E;IAC5E,gFAAgF;IAChF,gFAAgF;IAChF,wEAAwE;IACxE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,cAAc,GAClB,SAAS,EAAE,cAAc;QACzB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,MAAM;YAC7C,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAEjD,iFAAiF;IACjF,yEAAyE;IACzE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC5D,MAAM,iBAAiB,GACrB,SAAS,EAAE,iBAAiB;QAC5B,CAAC,CAAC,aAAa,KAAK,GAAG,IAAI,aAAa,KAAK,OAAO,CAAC,CAAC;IAExD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,SAAS,EAAE,WAAW,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7E,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IACtC,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,EAAE,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,WAAW,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,6EAA6E;IAC7E,kFAAkF;IAClF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxF,MAAM,sBAAsB,GAC1B,SAAS,EAAE,sBAAsB;QACjC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEhD,MAAM,OAAO,GAAG,SAAS,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,cAAc;QACd,QAAQ;QACR,cAAc;QACd,iBAAiB;QACjB,WAAW;QACX,sBAAsB;QACtB,KAAK,EAAE,OAAO;QACd,YAAY,EAAE,SAAS,EAAE,YAAY;KACtC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAuBA,SAAS,mBAAmB,CAAC,GAAuB;IAClD,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;IACtC,OAAO,IAAI,GAAG,CACZ,MAAM;SACH,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA2B;IACvD,MAAM,SAAS,GAAG,CAChB,SAAS,EAAE,SAAS;QACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,yBAAyB,CAC1B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEtB,MAAM,MAAM,GACV,SAAS,EAAE,iBAAiB;QAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,CAAC,CAAC;IACxD,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjF,MAAM,cAAc,GAClB,SAAS,EAAE,cAAc,IAAI,IAAI;QAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAE7D,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,QAAQ,GACZ,SAAS,EAAE,QAAQ;QACnB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM;YACrC,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,CAAC;IAEzC,4EAA4E;IAC5E,gFAAgF;IAChF,gFAAgF;IAChF,wEAAwE;IACxE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,cAAc,GAClB,SAAS,EAAE,cAAc;QACzB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,MAAM;YAC7C,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAEjD,iFAAiF;IACjF,yEAAyE;IACzE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC5D,MAAM,iBAAiB,GACrB,SAAS,EAAE,iBAAiB;QAC5B,CAAC,CAAC,aAAa,KAAK,GAAG,IAAI,aAAa,KAAK,OAAO,CAAC,CAAC;IAExD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,SAAS,EAAE,WAAW,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7E,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IACtC,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,EAAE,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,WAAW,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,6EAA6E;IAC7E,kFAAkF;IAClF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxF,MAAM,sBAAsB,GAC1B,SAAS,EAAE,sBAAsB;QACjC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEhD,MAAM,OAAO,GAAG,SAAS,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,WAA+D,CAAC;IACpE,MAAM,eAAe,GACnB,SAAS,EAAE,WAAW,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACnF,MAAM,SAAS,GACb,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACxE,IAAI,eAAe,IAAI,SAAS,EAAE,CAAC;QACjC,WAAW,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnE,CAAC;IAED,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,cAAc;QACd,QAAQ;QACR,cAAc;QACd,iBAAiB;QACjB,WAAW;QACX,sBAAsB;QACtB,KAAK,EAAE,OAAO;QACd,YAAY,EAAE,SAAS,EAAE,YAAY;QACrC,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/decision-token.d.ts

@@ -0,0 +1,80 @@
+/**
+ * TWZRD Payment Control — signed, expiring DecisionTokens + intent binding.
+ *
+ * A DecisionToken is not "we checked this merchant earlier". It is:
+ * "at this timestamp, policy version X approved this EXACT transaction".
+ * The wallet (or payment client) must verify, before signing:
+ *
+ *   hash(intent being signed) === token.intentHash
+ *
+ * plus expiry, decision === allow, signature, and consume-once. Any mismatch
+ * means refuse — the signer is never invoked.
+ */
+import { type PaymentIntent } from "./intent.js";
+export type PaymentDecisionVerdict = "allow" | "warn" | "block";
+export type DecisionConstraints = {
+    maxAmount?: string;
+    allowedAssets?: string[];
+    requireHumanApproval?: boolean;
+};
+export type PaymentDecision = {
+    decision: PaymentDecisionVerdict;
+    reasonCodes: string[];
+    intentHash: string;
+    policyVersion: string;
+    decisionId: string;
+    /** ISO-8601. Tokens are short-lived by design. */
+    expiresAt: string;
+    constraints?: DecisionConstraints;
+    /** Signer key identifier (for rotation / audit). */
+    keyId: string;
+    /** base64 Ed25519 signature over the domain-separated canonical payload. */
+    signature: string;
+};
+export type DecisionSigner = {
+    keyId: string;
+    sign(preimage: Uint8Array): Uint8Array | Promise<Uint8Array>;
+    /** PEM (SPKI) for local verification; remote signers publish theirs. */
+    publicKeyPem?: string;
+};
+/** Everything signed — the token minus the signature itself. */
+export declare function decisionPreimage(token: Omit<PaymentDecision, "signature">): Buffer;
+/**
+ * Local Ed25519 decision signer. Pass a PKCS#8 PEM to pin a key; otherwise an
+ * ephemeral keypair is generated (fine for tests and per-process runtimes).
+ */
+export declare function createLocalDecisionSigner(options?: {
+    privateKeyPem?: string;
+    keyId?: string;
+}): DecisionSigner & {
+    publicKeyPem: string;
+};
+export declare function signDecision(unsigned: Omit<PaymentDecision, "signature" | "keyId">, signer: DecisionSigner): Promise<PaymentDecision>;
+export declare function verifyDecisionSignature(token: PaymentDecision, publicKeyPem: string): boolean;
+export type BindingErrorCode = "INTENT_HASH_MISMATCH" | "DECISION_EXPIRED" | "DECISION_NOT_ALLOW" | "DECISION_REPLAYED" | "BAD_SIGNATURE";
+export declare class TwzrdIntentBindingError extends Error {
+    readonly code: BindingErrorCode;
+    readonly decisionId: string;
+    constructor(code: BindingErrorCode, decisionId: string, detail: string);
+}
+export type DecisionRegistry = {
+    /** True exactly once per decisionId; false on every replay. */
+    consume(decisionId: string): boolean;
+};
+/** In-process consume-once ledger. Entries expire with the tokens. */
+export declare function createDecisionRegistry(): DecisionRegistry;
+export type AssertIntentApprovedOptions = {
+    now?: number;
+    /** Enforce consume-once semantics (recommended for anything non-idempotent). */
+    registry?: DecisionRegistry;
+    /** Verify the token signature against this key before trusting it. */
+    publicKeyPem?: string;
+};
+/**
+ * The wallet-side check. Call with the EXACT intent about to be signed.
+ * Throws TwzrdIntentBindingError on any violation; returns void when the
+ * signature may proceed. A caught error means: do not invoke the signer.
+ */
+export declare function assertIntentApproved(intent: PaymentIntent, token: PaymentDecision, options?: AssertIntentApprovedOptions): void;
+export declare function newDecisionId(): string;
+//# sourceMappingURL=decision-token.d.ts.map

package/dist/decision-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-token.d.ts","sourceRoot":"","sources":["../src/decision-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAI5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEhE,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAElC,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7D,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,MAAM,CAKlF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,cAAc,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAe5C;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,OAAO,CAAC,EACtD,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAYT;AAMD,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,eAAe,CAAC;AAEpB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAChB,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMvE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+DAA+D;IAC/D,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC,CAAC;AAEF,sEAAsE;AACtE,wBAAgB,sBAAsB,IAAI,gBAAgB,CASzD;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE,2BAA2B,GACpC,IAAI,CA2CN;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/decision-token.js

@@ -0,0 +1,107 @@
+/**
+ * TWZRD Payment Control — signed, expiring DecisionTokens + intent binding.
+ *
+ * A DecisionToken is not "we checked this merchant earlier". It is:
+ * "at this timestamp, policy version X approved this EXACT transaction".
+ * The wallet (or payment client) must verify, before signing:
+ *
+ *   hash(intent being signed) === token.intentHash
+ *
+ * plus expiry, decision === allow, signature, and consume-once. Any mismatch
+ * means refuse — the signer is never invoked.
+ */
+import { createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign as edSign, verify as edVerify, } from "node:crypto";
+import { canonicalJson, intentHash } from "./intent.js";
+const DECISION_DOMAIN = "twzrd-decision-v1\n";
+/** Everything signed — the token minus the signature itself. */
+export function decisionPreimage(token) {
+    return Buffer.concat([
+        Buffer.from(DECISION_DOMAIN, "utf8"),
+        Buffer.from(canonicalJson(token), "utf8"),
+    ]);
+}
+/**
+ * Local Ed25519 decision signer. Pass a PKCS#8 PEM to pin a key; otherwise an
+ * ephemeral keypair is generated (fine for tests and per-process runtimes).
+ */
+export function createLocalDecisionSigner(options) {
+    let privateKey;
+    if (options?.privateKeyPem) {
+        privateKey = createPrivateKey(options.privateKeyPem);
+    }
+    else {
+        ({ privateKey } = generateKeyPairSync("ed25519"));
+    }
+    const publicKeyPem = createPublicKey(privateKey)
+        .export({ type: "spki", format: "pem" })
+        .toString();
+    return {
+        keyId: options?.keyId ?? "local-ed25519",
+        publicKeyPem,
+        sign: (preimage) => edSign(null, Buffer.from(preimage), privateKey),
+    };
+}
+export async function signDecision(unsigned, signer) {
+    const payload = { ...unsigned, keyId: signer.keyId };
+    const signature = Buffer.from(await signer.sign(decisionPreimage(payload))).toString("base64");
+    return { ...payload, signature };
+}
+export function verifyDecisionSignature(token, publicKeyPem) {
+    const { signature, ...payload } = token;
+    try {
+        return edVerify(null, decisionPreimage(payload), createPublicKey(publicKeyPem), Buffer.from(signature, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+export class TwzrdIntentBindingError extends Error {
+    code;
+    decisionId;
+    constructor(code, decisionId, detail) {
+        super(`[twzrd] ${code}: ${detail} (decisionId=${decisionId})`);
+        this.name = "TwzrdIntentBindingError";
+        this.code = code;
+        this.decisionId = decisionId;
+    }
+}
+/** In-process consume-once ledger. Entries expire with the tokens. */
+export function createDecisionRegistry() {
+    const consumed = new Set();
+    return {
+        consume(decisionId) {
+            if (consumed.has(decisionId))
+                return false;
+            consumed.add(decisionId);
+            return true;
+        },
+    };
+}
+/**
+ * The wallet-side check. Call with the EXACT intent about to be signed.
+ * Throws TwzrdIntentBindingError on any violation; returns void when the
+ * signature may proceed. A caught error means: do not invoke the signer.
+ */
+export function assertIntentApproved(intent, token, options) {
+    const now = options?.now ?? Date.now();
+    if (options?.publicKeyPem && !verifyDecisionSignature(token, options.publicKeyPem)) {
+        throw new TwzrdIntentBindingError("BAD_SIGNATURE", token.decisionId, "decision token signature did not verify");
+    }
+    if (token.decision !== "allow" && token.decision !== "warn") {
+        throw new TwzrdIntentBindingError("DECISION_NOT_ALLOW", token.decisionId, `decision is ${token.decision}`);
+    }
+    if (now >= Date.parse(token.expiresAt)) {
+        throw new TwzrdIntentBindingError("DECISION_EXPIRED", token.decisionId, `expired at ${token.expiresAt}`);
+    }
+    const actual = intentHash(intent);
+    if (actual !== token.intentHash) {
+        throw new TwzrdIntentBindingError("INTENT_HASH_MISMATCH", token.decisionId, `approved ${token.intentHash} but signing ${actual}`);
+    }
+    if (options?.registry && !options.registry.consume(token.decisionId)) {
+        throw new TwzrdIntentBindingError("DECISION_REPLAYED", token.decisionId, "decision token already consumed");
+    }
+}
+export function newDecisionId() {
+    return randomUUID();
+}
+//# sourceMappingURL=decision-token.js.map

package/dist/decision-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-token.js","sourceRoot":"","sources":["../src/decision-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,UAAU,EACV,IAAI,IAAI,MAAM,EACd,MAAM,IAAI,QAAQ,GAEnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAE5E,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAmC9C,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,KAAyC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAGzC;IACC,IAAI,UAAqB,CAAC;IAC1B,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,CAAC,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,UAAU,CAAC;SAC7C,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACvC,QAAQ,EAAE,CAAC;IACd,OAAO;QACL,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,eAAe;QACxC,YAAY;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAsD,EACtD,MAAsB;IAEtB,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAClF,QAAQ,CACT,CAAC;IACF,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,YAAoB;IAEpB,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,QAAQ,CACb,IAAI,EACJ,gBAAgB,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,YAAY,CAAC,EAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAaD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAmB;IACvB,UAAU,CAAS;IAC5B,YAAY,IAAsB,EAAE,UAAkB,EAAE,MAAc;QACpE,KAAK,CAAC,WAAW,IAAI,KAAK,MAAM,gBAAgB,UAAU,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAOD,sEAAsE;AACtE,MAAM,UAAU,sBAAsB;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,OAAO;QACL,OAAO,CAAC,UAAkB;YACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,KAAsB,EACtB,OAAqC;IAErC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvC,IAAI,OAAO,EAAE,YAAY,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,KAAK,CAAC,UAAU,EAChB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,KAAK,CAAC,UAAU,EAChB,eAAe,KAAK,CAAC,QAAQ,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,uBAAuB,CAC/B,kBAAkB,EAClB,KAAK,CAAC,UAAU,EAChB,cAAc,KAAK,CAAC,SAAS,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,KAAK,CAAC,UAAU,EAChB,YAAY,KAAK,CAAC,UAAU,gBAAgB,MAAM,EAAE,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,KAAK,CAAC,UAAU,EAChB,iCAAiC,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG;IAClD;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IAC/D;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE;QACf,iHAAiH;QACjH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,qFAAqF;QACrF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,kBAAkB,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6GAA6G;IAC7G,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,uBAAuB,EAC5C,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAqI7B"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG;IAClD;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IAC/D;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE;QACf,iHAAiH;QACjH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,qFAAqF;QACrF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,kBAAkB,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6GAA6G;IAC7G,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kFAAkF;IAClF,aAAa,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,uBAAuB,EAC5C,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAsI7B"}

package/dist/evaluate.js

@@ -28,6 +28,7 @@ export async function evaluate_x402_resource(resourceUrl, paymentRequirements, o
         washMaxUsdc: opts.washMaxUsdc,
         unsupportedNetworkMode: opts.unsupportedNetworkMode,
         fetch: opts.fetch,
+        attribution: opts.attribution,
     });
     const { payTo, amountMicro, resource } = payToFromRequirements(paymentRequirements);
     const priceUsdc = priceUsdcFromAmountMicro(amountMicro);

package/dist/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAkB,MAAM,YAAY,CAAC;AA0ExD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,mBAA4C,EAC5C,OAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,mEAAmE;QACnE,6EAA6E;QAC7E,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC;QACE,WAAW,EAAE,QAAQ,IAAI,WAAW;QACpC,KAAK;QACL,SAAS;QACT,WAAW,EAAE,wBAAwB;QACrC,wEAAwE;QACxE,sDAAsD;QACtD,KAAK,EAAE,mBAAmB,CAAC,OAAO;KACnC;IACD,+DAA+D;IAC/D,MAAM,CACP,CAAC;IAEF,0FAA0F;IAC1F,MAAM,QAAQ,GAAG,CACf,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,SAAS,CAAC,CACjC,CAAC;IAC/B,8EAA8E;IAC9E,MAAM,UAAU,GACd,KAAK,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI;QACzC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACnE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,IAAI,GAAuB;QAC/B,QAAQ;QACR,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,UAAU;QACV,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;KACpC,CAAC;IAEF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,mFAAmF;IACnF,wEAAwE;IACxE,IACE,IAAI,CAAC,cAAc;QACnB,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU;QACpC,KAAK;QACL,QAAQ,KAAK,MAAM;QACnB,IAAI,CAAC,QAAQ;QACb,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3D,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;YACzC,OAAO;gBACL,GAAG,IAAI;gBACP,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,KAAK,CAAC,KAAK;gBACvB,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,aAAa,EAAE,KAAK,CAAC,IAAI;gBACzB,MAAM,EAAE,WAAW;oBACjB,CAAC,CAAC,gDAAgD,KAAK,CAAC,KAAK,OAAO,KAAK,GAAG;oBAC5E,CAAC,CAAC,gDAAgD,KAAK,CAAC,KAAK,MAAM,KAAK,GAAG;aAC9E,CAAC;QACJ,CAAC;QACD,6EAA6E;QAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,IACE,IAAI,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU;QACpC,KAAK;QACL,QAAQ,KAAK,OAAO,EACpB,CAAC;QACD,IAAI,CAAC;YACH,qFAAqF;YACrF,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACvE,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC7C,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,GAAG,MAAM,CAAC,SAAS,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACjE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAC3B,CAAC;YACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAK9B,CAAC;gBACF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;gBACnC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAA+C,CAAC;gBAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,QAAQ,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5H,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;gBAClD,IAAI,IAAI,CAAC,SAAS;oBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAkB,MAAM,YAAY,CAAC;AA0ExD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,mBAA4C,EAC5C,OAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,mEAAmE;QACnE,6EAA6E;QAC7E,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC;QACE,WAAW,EAAE,QAAQ,IAAI,WAAW;QACpC,KAAK;QACL,SAAS;QACT,WAAW,EAAE,wBAAwB;QACrC,wEAAwE;QACxE,sDAAsD;QACtD,KAAK,EAAE,mBAAmB,CAAC,OAAO;KACnC;IACD,+DAA+D;IAC/D,MAAM,CACP,CAAC;IAEF,0FAA0F;IAC1F,MAAM,QAAQ,GAAG,CACf,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,SAAS,CAAC,CACjC,CAAC;IAC/B,8EAA8E;IAC9E,MAAM,UAAU,GACd,KAAK,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI;QACzC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACnE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,IAAI,GAAuB;QAC/B,QAAQ;QACR,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,UAAU;QACV,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;KACpC,CAAC;IAEF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,mFAAmF;IACnF,wEAAwE;IACxE,IACE,IAAI,CAAC,cAAc;QACnB,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU;QACpC,KAAK;QACL,QAAQ,KAAK,MAAM;QACnB,IAAI,CAAC,QAAQ;QACb,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3D,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;YACzC,OAAO;gBACL,GAAG,IAAI;gBACP,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,KAAK,CAAC,KAAK;gBACvB,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,aAAa,EAAE,KAAK,CAAC,IAAI;gBACzB,MAAM,EAAE,WAAW;oBACjB,CAAC,CAAC,gDAAgD,KAAK,CAAC,KAAK,OAAO,KAAK,GAAG;oBAC5E,CAAC,CAAC,gDAAgD,KAAK,CAAC,KAAK,MAAM,KAAK,GAAG;aAC9E,CAAC;QACJ,CAAC;QACD,6EAA6E;QAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,IACE,IAAI,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU;QACpC,KAAK;QACL,QAAQ,KAAK,OAAO,EACpB,CAAC;QACD,IAAI,CAAC;YACH,qFAAqF;YACrF,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACvE,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC7C,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,GAAG,MAAM,CAAC,SAAS,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACjE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAC3B,CAAC;YACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAK9B,CAAC;gBACF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;gBACnC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAA+C,CAAC;gBAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,QAAQ,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5H,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;gBAClD,IAAI,IAAI,CAAC,SAAS;oBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -11,8 +11,12 @@ export { evaluate_x402_resource, type EvaluateX402Options, type EvaluateX402Resu
 export { withTwzrdGuard, type TwzrdGuardOptions } from "./with-guard.js";
 export { installTwzrdAutoGate, type PayWrap, type InstallAutoGateOptions, } from "./auto-gate.js";
 export { safeFetch, runAgentcashFetch, main as safeFetchMain, type SafeFetchOptions, type SafeFetchResult, } from "./safe-fetch.js";
-export { installTwzrdX402ClientHook, twzrdBeforePaymentCreation, type X402ClientLike, type X402SelectedRequirements, type BeforePaymentCreationContext, type BeforePaymentCreationResult, type InstallX402ClientHookOptions, } from "./x402-client-hook.js";
+export { installTwzrdX402ClientHook, twzrdBeforePaymentCreation, type X402ClientLike, type X402SelectedRequirements, type BeforePaymentCreationContext, type BeforePaymentCreationResult, type InstallX402ClientHookOptions, type X402PaymentControlOptions, } from "./x402-client-hook.js";
 export { quickCheck, QUICK_PRICE_USDC, type QuickCheckResult, type QuickCheckOptions, type TwzrdTier, } from "./quick.js";
 export { createSponsoredX402Fetch, type SponsorSettle, type SponsoredX402Options, } from "./sponsored.js";
 export type { TwzrdDecision, TwzrdReadinessCard, TwzrdPreflightInput, TwzrdGateConfig, TwzrdApproveContext, TwzrdApprovalResult, TwzrdUpsellContext, X402PaymentRequirements, X402PaymentRequiredBody, X402McpPaymentRequest, X402McpPaymentRequestedContext, } from "./types.js";
+export { canonicalJson, intentHash, toMicroUsd, INTENT_HASH_PREFIX, type PaymentIntent, type PaymentProtocol, } from "./intent.js";
+export { assertIntentApproved, createDecisionRegistry, createLocalDecisionSigner, decisionPreimage, newDecisionId, signDecision, verifyDecisionSignature, TwzrdIntentBindingError, type AssertIntentApprovedOptions, type BindingErrorCode, type DecisionConstraints, type DecisionRegistry, type DecisionSigner, type PaymentDecision, type PaymentDecisionVerdict, } from "./decision-token.js";
+export { createMemorySpendLedger, evaluateIntent, POLICY_VERSION, type CounterpartyIntelligence, type EvaluateIntentOptions, type IntelligenceProvider, type Mandate, type SpendLedger, type SpendPolicy, } from "./policy-runtime.js";
+export { ap2CheckoutToIntent, x402RequirementsToIntent, type Ap2Cart, type Ap2UserMandate, type X402IntentContext, } from "./intent-adapters.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,KAAK,OAAO,EACZ,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,IAAI,IAAI,aAAa,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,SAAS,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,KAAK,OAAO,EACZ,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,IAAI,IAAI,aAAa,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,SAAS,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,aAAa,EACb,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -17,4 +17,9 @@ export { safeFetch, runAgentcashFetch, main as safeFetchMain, } from "./safe-fet
 export { installTwzrdX402ClientHook, twzrdBeforePaymentCreation, } from "./x402-client-hook.js";
 export { quickCheck, QUICK_PRICE_USDC, } from "./quick.js";
 export { createSponsoredX402Fetch, } from "./sponsored.js";
+/* ── TWZRD Payment Control (protocol-neutral authorization core) ── */
+export { canonicalJson, intentHash, toMicroUsd, INTENT_HASH_PREFIX, } from "./intent.js";
+export { assertIntentApproved, createDecisionRegistry, createLocalDecisionSigner, decisionPreimage, newDecisionId, signDecision, verifyDecisionSignature, TwzrdIntentBindingError, } from "./decision-token.js";
+export { createMemorySpendLedger, evaluateIntent, POLICY_VERSION, } from "./policy-runtime.js";
+export { ap2CheckoutToIntent, x402RequirementsToIntent, } from "./intent-adapters.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,OAAO,EAAE,eAAe,EAAE,WAAW,EAAkB,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,aAAa,EAAgC,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,YAAY,GAKb,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACL,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAA0B,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,oBAAoB,GAGrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,IAAI,IAAI,aAAa,GAGtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAM3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EACV,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,GAGzB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,OAAO,EAAE,eAAe,EAAE,WAAW,EAAkB,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,aAAa,EAAgC,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,YAAY,GAKb,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACL,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAA0B,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,oBAAoB,GAGrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,IAAI,IAAI,aAAa,GAGtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAO3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EACV,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,GAGzB,MAAM,gBAAgB,CAAC;AAexB,uEAAuE;AACvE,OAAO,EACL,aAAa,EACb,UAAU,EACV,UAAU,EACV,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,GAQxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,GAIzB,MAAM,sBAAsB,CAAC"}

package/dist/intent-adapters.d.ts

@@ -0,0 +1,62 @@
+/**
+ * TWZRD Payment Control — protocol adapters into PaymentIntent v1.
+ *
+ * Adapters normalize protocol-specific payment shapes into the one canonical
+ * intent the policy runtime evaluates. The x402 adapter keeps the existing
+ * gate's behavior available on the new core; the AP2/UCP adapter is the
+ * non-x402 reference — it exists to prove the runtime combines a USER MANDATE
+ * with counterparty risk, not merely that it parses another crypto request.
+ */
+import type { PaymentIntent } from "./intent.js";
+import type { Mandate } from "./policy-runtime.js";
+import type { X402SelectedRequirements } from "./x402-client-hook.js";
+export type X402IntentContext = {
+    /** Resource URL when the requirement omits `resource` (v2 top-level). */
+    resourceUrl?: string;
+    method?: string;
+    facilitator?: string;
+    agent?: PaymentIntent["agent"];
+    purpose?: string;
+};
+/** Normalize a selected x402 payment requirement (v1 or v2 field names). */
+export declare function x402RequirementsToIntent(req: X402SelectedRequirements, ctx?: X402IntentContext): PaymentIntent;
+/**
+ * Minimal AP2-style cart: what an agent is about to check out under a user
+ * mandate. Field names follow the AP2 mandate/cart split — the mandate says
+ * what MAY be spent; the cart is the concrete transaction.
+ */
+export type Ap2Cart = {
+    merchantId: string;
+    /** Settlement destination (merchant account / wallet). */
+    payTo: string;
+    currency: string;
+    total: string;
+    items?: Array<{
+        sku?: string;
+        description?: string;
+        price?: string;
+    }>;
+    checkoutUrl?: string;
+    category?: string;
+    recurring?: boolean;
+    priorCharge?: string;
+};
+export type Ap2UserMandate = {
+    mandateId: string;
+    /** Purchase categories the user authorized (e.g. ["software"]). */
+    categories?: string[];
+    maxPerTransaction?: string;
+    monthlyCeiling?: string;
+    merchantAllowPrefixes?: string[];
+    expiresAt?: string;
+};
+/** Cart -> canonical intent. The mandate rides along for the policy runtime. */
+export declare function ap2CheckoutToIntent(cart: Ap2Cart, mandate: Ap2UserMandate, options?: {
+    network?: string;
+    agentId?: string;
+    organization?: string;
+}): {
+    intent: PaymentIntent;
+    mandate: Mandate;
+};
+//# sourceMappingURL=intent-adapters.d.ts.map

package/dist/intent-adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent-adapters.d.ts","sourceRoot":"","sources":["../src/intent-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAMtE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,GAAG,CAAC,EAAE,iBAAiB,GACtB,aAAa,CAmBf;AAMD;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA+B7C"}

package/dist/intent-adapters.js

@@ -0,0 +1,66 @@
+/**
+ * TWZRD Payment Control — protocol adapters into PaymentIntent v1.
+ *
+ * Adapters normalize protocol-specific payment shapes into the one canonical
+ * intent the policy runtime evaluates. The x402 adapter keeps the existing
+ * gate's behavior available on the new core; the AP2/UCP adapter is the
+ * non-x402 reference — it exists to prove the runtime combines a USER MANDATE
+ * with counterparty risk, not merely that it parses another crypto request.
+ */
+/** Normalize a selected x402 payment requirement (v1 or v2 field names). */
+export function x402RequirementsToIntent(req, ctx) {
+    const payTo = req.payTo ?? req.pay_to;
+    const amount = req.amount ?? req.maxAmountRequired;
+    if (!payTo)
+        throw new Error("[twzrd] x402 requirement missing payTo");
+    if (!amount)
+        throw new Error("[twzrd] x402 requirement missing amount");
+    return {
+        protocol: "x402",
+        network: req.network ?? "unknown",
+        asset: req.asset ?? "unknown",
+        amount,
+        payTo,
+        resource: {
+            url: req.resource ?? ctx?.resourceUrl,
+            method: ctx?.method,
+        },
+        facilitator: ctx?.facilitator,
+        agent: ctx?.agent,
+        context: ctx?.purpose ? { purpose: ctx.purpose } : undefined,
+    };
+}
+/** Cart -> canonical intent. The mandate rides along for the policy runtime. */
+export function ap2CheckoutToIntent(cart, mandate, options) {
+    const intent = {
+        protocol: "ap2",
+        network: options?.network ?? "fiat:card",
+        asset: cart.currency,
+        amount: cart.total,
+        payTo: cart.payTo,
+        resource: {
+            url: cart.checkoutUrl,
+            operation: `checkout:${cart.merchantId}`,
+        },
+        agent: {
+            id: options?.agentId,
+            organization: options?.organization,
+            mandateId: mandate.mandateId,
+        },
+        context: {
+            purpose: cart.category,
+            recurring: cart.recurring,
+            priorSpend: cart.priorCharge,
+        },
+    };
+    const normalizedMandate = {
+        mandateId: mandate.mandateId,
+        purposes: mandate.categories,
+        maxPerTransactionUsd: mandate.maxPerTransaction,
+        monthlyCeilingUsd: mandate.monthlyCeiling,
+        resourceAllow: mandate.merchantAllowPrefixes,
+        expiresAt: mandate.expiresAt,
+    };
+    return { intent, mandate: normalizedMandate };
+}
+//# sourceMappingURL=intent-adapters.js.map

package/dist/intent-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent-adapters.js","sourceRoot":"","sources":["../src/intent-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB,CACtC,GAA6B,EAC7B,GAAuB;IAEvB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,iBAAiB,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACxE,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,SAAS;QACjC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,MAAM;QACN,KAAK;QACL,QAAQ,EAAE;YACR,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,EAAE,WAAW;YACrC,MAAM,EAAE,GAAG,EAAE,MAAM;SACpB;QACD,WAAW,EAAE,GAAG,EAAE,WAAW;QAC7B,KAAK,EAAE,GAAG,EAAE,KAAK;QACjB,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC;AAkCD,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CACjC,IAAa,EACb,OAAuB,EACvB,OAAuE;IAEvE,MAAM,MAAM,GAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW;QACxC,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE;YACR,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,SAAS,EAAE,YAAY,IAAI,CAAC,UAAU,EAAE;SACzC;QACD,KAAK,EAAE;YACL,EAAE,EAAE,OAAO,EAAE,OAAO;YACpB,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B;QACD,OAAO,EAAE;YACP,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,WAAW;SAC7B;KACF,CAAC;IACF,MAAM,iBAAiB,GAAY;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,oBAAoB,EAAE,OAAO,CAAC,iBAAiB;QAC/C,iBAAiB,EAAE,OAAO,CAAC,cAAc;QACzC,aAAa,EAAE,OAAO,CAAC,qBAAqB;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAChD,CAAC"}