twzrd-x402-gate 0.8.8 → 0.8.10

package/QUICKSTART.md

@@ -0,0 +1,61 @@
+# twzrd-x402-gate — Quickstart (15 minutes, 0 USDC)
+
+Refuses payment to a wash-flagged merchant **before your wallet signs**. Free intel, no
+API key, no signup, no config — every `TWZRD_*` env var is an optional override. If intel
+is unreachable the gate never *invents* a wash flag (the wash check fails open); a failed
+preflight blocks the payment by default (`TWZRD_FAIL_OPEN=true` to allow).
+
+## 1. Install + gate your client (5 lines)
+
+```bash
+npm install twzrd-x402-gate@0.8.10 @x402/core @x402/fetch @x402/svm
+```
+
+```typescript
+import { x402Client } from "@x402/core/client";
+import { installTwzrdAutoGate } from "twzrd-x402-gate";
+
+const client = new x402Client();
+// refuseWashFlagged defaults true; gateOnCanSpend stays false unless you opt in
+installTwzrdAutoGate(client, { refuseWashFlagged: true });
+// then register schemes + wrapFetchWithPayment as usual
+```
+
+## 2. Prove it blocked something (spends nothing)
+
+```bash
+npm run autogate-block-proof
+# preflights a live wash_flagged seller; the gate aborts before any signer runs
+# writes block-proof-<run_id>.json — reason: TWZRD_TRUST_GATE_BLOCK: wash_flagged
+```
+
+That JSON is your receipt: a bad merchant intercepted with 0 USDC at risk.
+
+## 3. See your own seat
+
+Every preflight is stamped `X-Twzrd-Caller: twzrd-x402-gate/<version>` — your seat
+identity in TWZRD's metrics. To make runs attributable to *you* (recommended):
+
+```typescript
+installTwzrdAutoGate(client, {
+  refuseWashFlagged: true,
+  attribution: { integration: "<your-host-or-project>", runId: "<uuid-per-run>" },
+});
+```
+
+## 4. The only three knobs you need
+
+| Knob | Effect |
+|------|--------|
+| `TWZRD_AUTO_GATE=0` | Kill switch — gate fully off, payments proceed unguarded |
+| `refuseWashFlagged: false` | Stop refusing wash-flagged merchants (default `true`) |
+| `gateOnCanSpend: true` | Opt-in hard cap: also block when `can_spend=false` (default `false`) |
+
+Everything else (thresholds, wash caps, fail posture, settle guard): [README](./README.md).
+
+## What this will NOT do
+
+- **No Base/EVM reputation.** Non-Solana networks get an explicit `unknown` (payment
+  allowed, observed) unless you set `TWZRD_UNSUPPORTED_NETWORK_MODE=strict`.
+- **No delivery guarantee.** It screens the merchant before you pay, nothing after.
+- **Not a wallet.** It never holds keys or signs — it only decides if your signer runs.

package/README.md

@@ -10,7 +10,7 @@ refuse. Protects the **payer** from a risky **merchant** (`payTo`). Chain-neutra
 ### Default-on AutoGate (5 lines)
 
 ```bash
-npm install twzrd-x402-gate@0.8.6 @x402/core @x402/fetch @x402/svm
+npm install twzrd-x402-gate@0.8.10 @x402/core @x402/fetch @x402/svm
 ```
 
 ```typescript
@@ -49,7 +49,7 @@ transfer on-chain. Wash/sybil edges are primarily discounted in TWZRD scoring, n
 revenue refusal.
 
 ```bash
-npm install twzrd-x402-gate@0.8.6
+npm install twzrd-x402-gate@0.8.10
 ```
 
 ```typescript
@@ -93,7 +93,7 @@ Fixture-backed SVM extract tests live in `test/seller-hook.test.ts` +
 Install the published gate and run against wash fixtures:
 
 ```bash
-npm install twzrd-x402-gate@0.8.6
+npm install twzrd-x402-gate@0.8.10
 # from package root after install, or from a checkout:
 npm run wash-dogfood
 ```
@@ -238,10 +238,10 @@ Dogfood (one public live proof path):
 ## Install
 
 ```bash
-npm install twzrd-x402-gate@0.8.6
+npm install twzrd-x402-gate@0.8.10
 ```
 
-Current npm truth: `0.8.5` (buyer gate + optional seller settle guard + payer-extract hardening).
+Current npm truth: `0.8.10` (buyer gate + optional seller settle guard + payer-extract hardening).
 Check `npm view twzrd-x402-gate version` if in doubt (do not pin stale **0.5.4** / **0.7.1**).
 
 Optional settle guard (resource-server **payer** policy): see **Seller settle guard

package/bin/twzrd-gate-doctor.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+/**
+ * Publishable bin for twzrd-gate-doctor.
+ * Prefers compiled dist; falls back to tsx source in dev checkouts.
+ * Mirrors bin/twzrd-safe-fetch.js so packaging behaves identically.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = join(__dirname, "..");
+const dist = join(root, "dist", "doctor.js");
+const src = join(root, "src", "doctor.ts");
+
+if (existsSync(dist)) {
+  await import(pathToFileURL(dist).href);
+} else if (existsSync(src)) {
+  // Do NOT set cwd to the package root here (unlike twzrd-safe-fetch): the
+  // doctor inspects process.cwd() to find the OPERATOR's package.json. Running
+  // it from the package root made it read our own manifest and report a
+  // signing surface for every project, including ones with nothing to gate.
+  // tsx resolves `src` by absolute path, so the user's cwd is safe to keep.
+  const r = spawnSync("npx", ["--yes", "tsx", src, ...process.argv.slice(2)], {
+    stdio: "inherit",
+  });
+  process.exit(r.status ?? 1);
+} else {
+  console.error(
+    "twzrd-gate-doctor: missing dist/doctor.js — run npm run build in twzrd-x402-gate",
+  );
+  process.exit(1);
+}

package/bin/twzrd-gate-eval-refuse.js

@@ -16,8 +16,9 @@ import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { existsSync } from "node:fs";
 
-const TARGET_URL = "https://three.ws/api/x402/model-check";
-const EXPECT_PAYTO = "wwwwwDxFWRn7grgr3Esrsg5C6NvDoDHSA4gaCffccrU";
+// Owned TWZRD refuse dogfood (not a third-party brand). Live 402 + force hard-block.
+const TARGET_URL = "https://intel.twzrd.xyz/v1/intel/refuse-fixture";
+const EXPECT_PAYTO = "CnTmHDXVEafkc8sFSzNky9w5zwk63Bk2mHZZodorjhvR";
 const NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
 const USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
 const INTEL_PREFLIGHT = "https://intel.twzrd.xyz/v1/intel/preflight";
@@ -79,7 +80,7 @@ async function main() {
     if (!resolveImport(pkg)) {
       console.error(
         `twzrd-gate-eval-refuse: missing peer ${pkg}. Run:\n` +
-          `  npm install twzrd-x402-gate@0.8.6 @x402/core @x402/fetch @x402/svm @solana/kit @scure/base`,
+          `  npm install twzrd-x402-gate@0.8.10 @x402/core @x402/fetch @x402/svm @solana/kit @scure/base`,
       );
       process.exit(2);
     }

package/dist/doctor.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `npx twzrd-gate-doctor` — one command that turns "should I gate this?" into
+ * "here are the exact lines for THIS project, and here is the gate refusing."
+ *
+ * Why a doctor and not a codemod: patching someone else's source is invasive,
+ * hard to review, and the first thing an operator reverts. The adoption blocker
+ * is not typing three lines — it is not knowing WHICH three lines apply to the
+ * client you already use, and not believing the gate actually refuses anything.
+ * So this does exactly two things:
+ *
+ *   1. DETECT the x402 / agent surface already in package.json and print the
+ *      snippet for that specific host (not a generic README excerpt).
+ *   2. PROVE a refusal, offline, spending nothing: a wash-flagged verdict is fed
+ *      to the real hook and we assert the signer was never invoked.
+ *
+ * Exit codes: 0 = a seam was found and the refusal proof passed. 1 = proof
+ * failed (a real problem — report it). 2 = no x402 surface detected (nothing to
+ * gate here yet, not an error).
+ *
+ * No network by default: the refusal proof is deterministic and local, so it
+ * works in CI and on a plane. Pass --live to additionally preflight a real
+ * wash-flagged seller against intel.
+ */
+type Host = {
+    id: string;
+    label: string;
+    /** Any of these dependency names present ⇒ this host applies. */
+    deps: string[];
+    install: string;
+    snippet: string;
+    note?: string;
+};
+export declare function detectHosts(pkg: Record<string, unknown> | null): Host[];
+/**
+ * Deterministic, offline refusal proof.
+ *
+ * Feeds a wash-flagged card straight to the policy layer and asserts the signer
+ * never ran. This is the claim an operator needs to believe before adopting,
+ * and it must be checkable without spending or reaching the network.
+ */
+export declare function proveRefusal(): Promise<{
+    refused: boolean;
+    signerInvocations: number;
+    reason: string;
+}>;
+export declare function main(argv?: string[]): Promise<number>;
+export {};
+//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,KAAK,IAAI,GAAG;IACV,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AA4EF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CASvE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAuED;AAMD,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAwDlF"}

package/dist/doctor.js

@@ -0,0 +1,246 @@
+/**
+ * `npx twzrd-gate-doctor` — one command that turns "should I gate this?" into
+ * "here are the exact lines for THIS project, and here is the gate refusing."
+ *
+ * Why a doctor and not a codemod: patching someone else's source is invasive,
+ * hard to review, and the first thing an operator reverts. The adoption blocker
+ * is not typing three lines — it is not knowing WHICH three lines apply to the
+ * client you already use, and not believing the gate actually refuses anything.
+ * So this does exactly two things:
+ *
+ *   1. DETECT the x402 / agent surface already in package.json and print the
+ *      snippet for that specific host (not a generic README excerpt).
+ *   2. PROVE a refusal, offline, spending nothing: a wash-flagged verdict is fed
+ *      to the real hook and we assert the signer was never invoked.
+ *
+ * Exit codes: 0 = a seam was found and the refusal proof passed. 1 = proof
+ * failed (a real problem — report it). 2 = no x402 surface detected (nothing to
+ * gate here yet, not an error).
+ *
+ * No network by default: the refusal proof is deterministic and local, so it
+ * works in CI and on a plane. Pass --live to additionally preflight a real
+ * wash-flagged seller against intel.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { CLIENT_VERSION } from "./version.js";
+/**
+ * Ordered most-specific first: a project using solana-agent-kit AND @x402/core
+ * should be told about the SAK seat, because that is where its signing happens.
+ */
+const HOSTS = [
+    {
+        id: "solana-agent-kit",
+        label: "Solana Agent Kit (SolanaAgentKit)",
+        deps: ["solana-agent-kit"],
+        install: "npm install twzrd-x402-gate",
+        snippet: `import { SolanaAgentKit } from "solana-agent-kit";
+import { twzrdBeforeSign } from "twzrd-x402-gate";
+
+// Every plugin that signs goes through this policy, including plugins that
+// call agent.wallet.signAndSendTransaction directly.
+const agent = new SolanaAgentKit(wallet, rpcUrl, {
+  beforeSign: twzrdBeforeSign({ refuseWashFlagged: true }),
+});`,
+        note: "Requires the optional beforeSign hook on Config (sendaifun/solana-agent-kit#599). " +
+            "Until that lands, wrap the wallet yourself with wrapWallet() from that PR.",
+    },
+    {
+        id: "x402-client",
+        label: "official x402 client (@x402/core)",
+        deps: ["@x402/core", "@x402/fetch", "@x402/svm"],
+        install: "npm install twzrd-x402-gate @x402/core @x402/fetch @x402/svm",
+        snippet: `import { x402Client } from "@x402/core/client";
+import { installTwzrdAutoGate } from "twzrd-x402-gate";
+
+const client = new x402Client();
+// Runs after requirement selection, BEFORE payload creation / signing.
+installTwzrdAutoGate(client, { refuseWashFlagged: true });`,
+    },
+    {
+        id: "elizaos",
+        label: "elizaOS agent runtime",
+        deps: ["@elizaos/core", "elizaos"],
+        install: "npm install twzrd-x402-gate",
+        snippet: `import { installTwzrdAutoGate } from "twzrd-x402-gate";
+
+// Gate the payment client your plugin hands to the runtime, not the runtime
+// itself — the seam is wherever the signer lives.
+installTwzrdAutoGate(paymentClient, { refuseWashFlagged: true });`,
+    },
+    {
+        id: "goat",
+        label: "GOAT SDK",
+        deps: ["@goat-sdk/core"],
+        install: "npm install twzrd-x402-gate",
+        snippet: `import { installTwzrdAutoGate } from "twzrd-x402-gate";
+
+installTwzrdAutoGate(walletClient, { refuseWashFlagged: true });`,
+    },
+    {
+        id: "raw-fetch",
+        label: "raw fetch + x402 payer",
+        deps: ["x402-fetch", "x402"],
+        install: "npm install twzrd-x402-gate",
+        snippet: `import { installTwzrdAutoGate } from "twzrd-x402-gate";
+
+// Wraps fetch: a refused payment never reaches the payer.
+const gatedFetch = installTwzrdAutoGate(payFetch, { refuseWashFlagged: true });`,
+    },
+];
+function readPackageJson(cwd) {
+    try {
+        return JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function detectHosts(pkg) {
+    if (!pkg)
+        return [];
+    const all = {
+        ...(pkg.dependencies ?? {}),
+        ...(pkg.devDependencies ?? {}),
+        ...(pkg.peerDependencies ?? {}),
+    };
+    const names = new Set(Object.keys(all));
+    return HOSTS.filter((h) => h.deps.some((d) => names.has(d)));
+}
+/**
+ * Deterministic, offline refusal proof.
+ *
+ * Feeds a wash-flagged card straight to the policy layer and asserts the signer
+ * never ran. This is the claim an operator needs to believe before adopting,
+ * and it must be checkable without spending or reaching the network.
+ */
+export async function proveRefusal() {
+    const { installTwzrdAutoGate } = await import("./auto-gate.js");
+    // Model the official-client seam, which is the path with existing coverage
+    // (see test/autogate-intercept.test.ts). A wash-flagged card must come back
+    // as abort, and the signer stub must never be reached.
+    let signerInvocations = 0;
+    let hook;
+    const client = {
+        onBeforePaymentCreation(h) {
+            hook = h;
+            return client;
+        },
+    };
+    installTwzrdAutoGate(client, {
+        refuseWashFlagged: true,
+        gateOnCanSpend: false,
+        preflightMinScore: 0,
+        failOpen: true,
+        // Injected preflight response: wash_flagged ⇒ the policy must refuse. No network.
+        fetch: (async () => new Response(JSON.stringify({
+            readiness_card: {
+                decision: "block",
+                trust_score: 30,
+                can_spend: false,
+                wash_flagged: true,
+                wash_label: "ring",
+            },
+        }), { status: 200, headers: { "content-type": "application/json" } })),
+    });
+    if (!hook) {
+        return {
+            refused: false,
+            signerInvocations,
+            reason: "gate did not install a pre-payment hook",
+        };
+    }
+    let refused = false;
+    let reason = "";
+    try {
+        const out = await hook({
+            selectedRequirements: {
+                payTo: "34w53UkhfBBmVLBcphD1M4dRhbBTQaLLbnRfyTeXzc5m",
+                network: "solana",
+                asset: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
+                maxAmountRequired: "50000",
+                scheme: "exact",
+            },
+            // If the gate ever approved, a real client would call this next.
+            sign: async () => {
+                signerInvocations += 1;
+            },
+        });
+        if (out && typeof out === "object" && out.abort) {
+            refused = true;
+            reason = String(out.reason ?? "abort");
+        }
+    }
+    catch (err) {
+        // A throwing refusal is equally acceptable: nothing got signed.
+        refused = true;
+        reason = String(err?.message ?? err).slice(0, 160);
+    }
+    return { refused, signerInvocations, reason };
+}
+function line(s = "") {
+    process.stdout.write(`${s}\n`);
+}
+export async function main(argv = process.argv.slice(2)) {
+    const cwd = process.cwd();
+    const pkg = readPackageJson(cwd);
+    const detected = detectHosts(pkg);
+    line(`twzrd-gate-doctor  (twzrd-x402-gate ${CLIENT_VERSION})`);
+    line();
+    if (!pkg) {
+        line("No package.json here. Run this from your project root.");
+        return 2;
+    }
+    if (detected.length === 0) {
+        line("No x402 / agent signing surface detected in this project.");
+        line("Nothing to gate yet — this is not an error.");
+        line();
+        line("The gate is useful once something here signs a Solana USDC payment.");
+        line("Surfaces it recognises: @x402/core, solana-agent-kit, @elizaos/core,");
+        line("@goat-sdk/core, x402-fetch.");
+        return 2;
+    }
+    line(`Detected ${detected.length} signing surface(s):`);
+    for (const h of detected)
+        line(`  • ${h.label}`);
+    line();
+    for (const h of detected) {
+        line(`── ${h.label} ${"─".repeat(Math.max(0, 58 - h.label.length))}`);
+        line();
+        line(`  ${h.install}`);
+        line();
+        for (const l of h.snippet.split("\n"))
+            line(`  ${l}`);
+        if (h.note) {
+            line();
+            line(`  Note: ${h.note}`);
+        }
+        line();
+    }
+    line("── Refusal proof (offline, spends nothing) ──────────────────");
+    line();
+    const proof = await proveRefusal();
+    if (proof.refused && proof.signerInvocations === 0) {
+        line("  PASS — wash-flagged seller refused before signing.");
+        line(`         signer invocations: ${proof.signerInvocations}`);
+        line(`         reason: ${proof.reason}`);
+        line();
+        line("  That is the whole product: the payment did not happen, and it cost 0.");
+        return 0;
+    }
+    line("  FAIL — the gate did NOT refuse a wash-flagged seller.");
+    line(`         refused=${proof.refused} signer_invocations=${proof.signerInvocations}`);
+    line("  Please report this with your package versions — it is a real bug.");
+    return 1;
+}
+// Only auto-run as a CLI, never on import (keeps it testable). Anchored on a
+// path separator so a file merely ENDING in "doctor.ts" (e.g. probe-doctor.ts)
+// does not trigger the CLI — that bit me while testing this very function.
+if (process.argv[1] &&
+    /(^|[\\/])doctor(\.[cm]?[jt]s)?$/.test(process.argv[1])) {
+    main().then((code) => process.exit(code), (err) => {
+        process.stderr.write(`twzrd-gate-doctor: ${String(err)}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAY9C;;;GAGG;AACH,MAAM,KAAK,GAAW;IACpB;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,mCAAmC;QAC1C,IAAI,EAAE,CAAC,kBAAkB,CAAC;QAC1B,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE;;;;;;;IAOT;QACA,IAAI,EACF,oFAAoF;YACpF,4EAA4E;KAC/E;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,mCAAmC;QAC1C,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC;QAChD,OAAO,EAAE,8DAA8D;QACvE,OAAO,EAAE;;;;;2DAK8C;KACxD;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC;QAClC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE;;;;kEAIqD;KAC/D;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,CAAC,gBAAgB,CAAC;QACxB,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE;;iEAEoD;KAC9D;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;QAC5B,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE;;;gFAGmE;KAC7E;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAmC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG;QACV,GAAG,CAAE,GAAG,CAAC,YAAuC,IAAI,EAAE,CAAC;QACvD,GAAG,CAAE,GAAG,CAAC,eAA0C,IAAI,EAAE,CAAC;QAC1D,GAAG,CAAE,GAAG,CAAC,gBAA2C,IAAI,EAAE,CAAC;KAC5D,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAKhC,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEhE,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,IAAI,IAAsB,CAAC;IAC3B,MAAM,MAAM,GAAG;QACb,uBAAuB,CAAC,CAAO;YAC7B,IAAI,GAAG,CAAC,CAAC;YACT,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IAEF,oBAAoB,CAAC,MAAe,EAAE;QACpC,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,KAAK;QACrB,iBAAiB,EAAE,CAAC;QACpB,QAAQ,EAAE,IAAI;QACd,kFAAkF;QAClF,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CACjB,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC;YACb,cAAc,EAAE;gBACd,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,EAAE;gBACf,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,MAAM;aACnB;SACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAA4B;KACvB,CAAC,CAAC;IAEZ,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;YACjB,MAAM,EAAE,yCAAyC;SAClD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC;YACrB,oBAAoB,EAAE;gBACpB,KAAK,EAAE,8CAA8C;gBACrD,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,8CAA8C;gBACrD,iBAAiB,EAAE,OAAO;gBAC1B,MAAM,EAAE,OAAO;aAChB;YACD,iEAAiE;YACjE,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,iBAAiB,IAAI,CAAC,CAAC;YACzB,CAAC;SACF,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAK,GAA2B,CAAC,KAAK,EAAE,CAAC;YACzE,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,MAAM,CAAE,GAA2B,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE;IAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,uCAAuC,cAAc,GAAG,CAAC,CAAC;IAC/D,IAAI,EAAE,CAAC;IAEP,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAClE,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC;QACP,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAC5E,IAAI,CAAC,sEAAsE,CAAC,CAAC;QAC7E,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,YAAY,QAAQ,CAAC,MAAM,sBAAsB,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC;IAEP,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC;QACP,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC;QACP,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAED,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACtE,IAAI,EAAE,CAAC;IACP,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,sDAAsD,CAAC,CAAC;QAC7D,IAAI,CAAC,gCAAgC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC;QACP,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAChE,IAAI,CAAC,oBAAoB,KAAK,CAAC,OAAO,uBAAuB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACvD,CAAC;IACD,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "twzrd-x402-gate",
-  "version": "0.8.8",
-  "description": "Core: buyer-side x402 trust gate. Free TWZRD preflight (ReadinessCard) before signing USDC to any merchant, with optional $0.001 paid trust escalate on warn — blocking spend on bad intel, no human in the loop. Optional: createTwzrdSettleGuard for resource servers to apply merchant policy on the payer before settle+serve. installTwzrdAutoGate is the canonical default-on entry across fetch payWrap, x402 client (onBeforePaymentCreation), and MPP onChallenge. Fail-closed by default — set TWZRD_FAIL_OPEN=true for outage allow; kill switch TWZRD_GATE_ENABLED=false or TWZRD_AUTO_GATE=0. Always stamps X-Twzrd-Caller for seat metrics.",
+  "version": "0.8.10",
+  "description": "Core: buyer-side x402 trust gate. Free TWZRD preflight (ReadinessCard) before signing USDC to any merchant, with optional $0.001 paid trust escalate on warn \u2014 blocking spend on bad intel, no human in the loop. Optional: createTwzrdSettleGuard for resource servers to apply merchant policy on the payer before settle+serve. installTwzrdAutoGate is the canonical default-on entry across fetch payWrap, x402 client (onBeforePaymentCreation), and MPP onChallenge. Fail-closed by default \u2014 set TWZRD_FAIL_OPEN=true for outage allow; kill switch TWZRD_GATE_ENABLED=false or TWZRD_AUTO_GATE=0. Always stamps X-Twzrd-Caller for seat metrics.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "twzrd-safe-fetch": "bin/twzrd-safe-fetch.js",
-    "twzrd-gate-eval-refuse": "bin/twzrd-gate-eval-refuse.js"
+    "twzrd-safe-fetch": "./bin/twzrd-safe-fetch.js",
+    "twzrd-gate-eval-refuse": "./bin/twzrd-gate-eval-refuse.js",
+    "twzrd-gate-doctor": "./bin/twzrd-gate-doctor.js"
   },
   "exports": {
     ".": {
@@ -23,13 +24,14 @@
   "files": [
     "dist",
     "bin",
-    "README.md"
+    "README.md",
+    "QUICKSTART.md"
   ],
   "scripts": {
     "build": "tsc",
     "prepublishOnly": "tsc",
     "typecheck": "tsc --noEmit -p tsconfig.check.json",
-    "test": "tsx test/version-identity.test.ts && tsx test/policy.test.ts && tsx test/wrap-fetch.test.ts && tsx test/mcp-hook.test.ts && tsx test/attribution.test.ts && tsx test/auto-receipt.test.ts && tsx test/quick.test.ts && tsx test/sponsored.test.ts && tsx test/escalation.test.ts && tsx test/wash-refuse.test.ts && tsx test/auto-gate.test.ts && tsx test/autogate-intercept.test.ts && tsx test/network.test.ts && tsx test/safe-fetch.test.ts && tsx test/payto-prefer.test.ts && tsx test/challenge-swap.test.ts && tsx test/x402-client-hook.test.ts && tsx test/hook-single-eval.test.ts && tsx test/run-attribution.test.ts && tsx test/payment-control.test.ts && tsx test/intent-binding.test.ts && tsx test/mpp-hook.test.ts && tsx test/mpp-safety.test.ts && tsx test/payment-control-followup.test.ts && tsx test/payment-control-hardening.test.ts && tsx test/x402-official-compat.test.ts && tsx test/seller-hook.test.ts && tsx test/adoption-proof.test.ts && tsx test/delivery-capture.test.ts",
+    "test": "tsx test/version-identity.test.ts && tsx test/policy.test.ts && tsx test/wrap-fetch.test.ts && tsx test/mcp-hook.test.ts && tsx test/attribution.test.ts && tsx test/auto-receipt.test.ts && tsx test/quick.test.ts && tsx test/sponsored.test.ts && tsx test/escalation.test.ts && tsx test/wash-refuse.test.ts && tsx test/auto-gate.test.ts && tsx test/autogate-intercept.test.ts && tsx test/network.test.ts && tsx test/safe-fetch.test.ts && tsx test/payto-prefer.test.ts && tsx test/challenge-swap.test.ts && tsx test/x402-client-hook.test.ts && tsx test/hook-single-eval.test.ts && tsx test/run-attribution.test.ts && tsx test/payment-control.test.ts && tsx test/intent-binding.test.ts && tsx test/mpp-hook.test.ts && tsx test/mpp-safety.test.ts && tsx test/payment-control-followup.test.ts && tsx test/payment-control-hardening.test.ts && tsx test/x402-official-compat.test.ts && tsx test/seller-hook.test.ts && tsx test/adoption-proof.test.ts && tsx test/delivery-capture.test.ts && tsx test/doctor.test.ts",
     "pack-smoke": "node scripts/pack-smoke.mjs",
     "safe-fetch": "tsx src/safe-fetch.ts",
     "guard-demo": "tsx examples/agentic-market-gate.ts",
@@ -41,7 +43,8 @@
     "adoption-proof": "tsx src/adoption-proof.ts",
     "demo:buyer-no-spend": "tsx src/adoption-proof.ts -- --integration ops-demo-buyer-no-spend",
     "live-autogate-matrix": "tsx examples/live-autogate-matrix.ts",
-    "gate-eval-refuse": "node bin/twzrd-gate-eval-refuse.js"
+    "gate-eval-refuse": "node bin/twzrd-gate-eval-refuse.js",
+    "gate-doctor": "tsx src/doctor.ts"
   },
   "keywords": [
     "x402",