@vantic/sdk - npm Package Compare versions

Comparing version 0.1.0 to 0.1.1

dist/accept.d.ts

+/**
+ * Accept — the requirement side, over HTTP.
+ *
+ * `checkMandate` (gate.ts) is the raw decision: does a presented mandate authorize a payment
+ * to THIS counterparty? This module turns that into the thing a resource server actually does:
+ * demand a mandate on the wire, and answer with HTTP 402 (Payment Required) + a challenge when
+ * one is missing or insufficient. That is what makes a mandate something a counterparty
+ * *requires* rather than a self-check an agent can code around — the requirement lives here, on
+ * the receiving side.
+ *
+ * Two integration shapes, both zero-dependency and duck-typed (we import no web framework):
+ *   - `mandateGate(...)`  — Express/Connect/raw-Node middleware `(req, res, next)`.
+ *   - `withMandate(...)`  — Web-standard `(Request) => Response` for Hono, Next.js route
+ *                           handlers, Bun, Deno, and Cloudflare Workers.
+ *
+ * Wire format: the agent presents `X-Vantic-Mandate: base64(JSON{ mandate, receipts? })`.
+ * A 402 answer echoes an x402-flavored `accepts` array describing what would satisfy the route.
+ *
+ * Budget caveat carries over from gate.ts: an isolated counterparty soundly enforces the
+ * signature, validity window, revocation, counterparty/action scope, and per-transaction cap
+ * (none of which need history), but NOT the global rolling budget — the agent controls which
+ * receipts it presents. See spec §8.
+ */
+import { type ResourceRequirement, type GateResult } from "./gate.js";
+import type { VerifyOptions } from "./verify.js";
+import type { Mandate, Receipt } from "./types.js";
+/** Header an agent uses to present its mandate to a resource server. */
+export declare const MANDATE_HEADER = "x-vantic-mandate";
+export interface MandatePresentation {
+    mandate: Mandate;
+    /** The agent's spend history under this mandate (optional; see budget caveat). */
+    receipts?: Receipt[];
+}
+/** Encode a mandate (+ optional receipts) into the `X-Vantic-Mandate` header value. */
+export declare function encodeMandatePresentation(p: MandatePresentation): string;
+/** Build the header object an agent attaches to its request. */
+export declare function mandateHeaders(p: MandatePresentation): Record<string, string>;
+/** Decode an `X-Vantic-Mandate` header value. Returns null if absent or malformed. */
+export declare function decodeMandatePresentation(headerValue: string | undefined | null): MandatePresentation | null;
+export interface MandateChallenge {
+    error: "mandate_required" | "mandate_invalid";
+    /** Present when a mandate was supplied but rejected. */
+    reasons?: string[];
+    /** x402-flavored: what would satisfy this route. */
+    accepts: Array<{
+        scheme: "vantic";
+        counterparty: string;
+        action: string;
+        amount: number;
+        currency: string;
+    }>;
+}
+/** Build the 402 challenge body for a requirement (optionally with rejection reasons). */
+export declare function mandateChallenge(req: ResourceRequirement, reasons?: string[]): MandateChallenge;
+export interface GateDecision {
+    granted: boolean;
+    /** 200 if granted, else 402. */
+    status: 200 | 402;
+    /** The gate result, present iff a (decodable) mandate was supplied. */
+    result: GateResult | null;
+    /** The 402 challenge, present iff not granted. */
+    challenge: MandateChallenge | null;
+    /** The decoded presentation, present iff a decodable mandate was supplied. */
+    presentation: MandatePresentation | null;
+}
+/**
+ * Core, transport-agnostic decision: given the raw header value and this route's requirement,
+ * decode + verify and return whether to serve (200) or challenge (402).
+ */
+export declare function evaluateMandate(headerValue: string | undefined | null, requirement: ResourceRequirement, opts?: VerifyOptions): GateDecision;
+/** Requirement, or a function that derives it from the request (per-route/dynamic pricing). */
+export type Requirement<Req> = ResourceRequirement | ((req: Req) => ResourceRequirement);
+export interface MandateGateOptions extends VerifyOptions {
+    /** Header to read the mandate from. Default: `x-vantic-mandate`. */
+    header?: string;
+}
+/** What the gate attaches on success (Express: `req.vantic`; Web: the handler's 2nd arg). */
+export interface MandateContext {
+    /** The verified principal (sponsor) — present iff the signature checked out. */
+    principal?: string;
+    /** The agent the mandate authorizes. */
+    agent: string;
+    mandate: Mandate;
+    receipts: Receipt[];
+}
+/**
+ * Express / Connect / raw-Node middleware. On an authorized request it attaches
+ * `req.vantic` (a MandateContext) and calls `next()`; otherwise it answers 402 with the
+ * challenge and does NOT call `next()`, so the protected handler never runs.
+ */
+export declare function mandateGate<Req = any>(requirement: Requirement<Req>, opts?: MandateGateOptions): (req: any, res: any, next: (err?: unknown) => void) => void;
+/**
+ * Web-standard wrapper: `(Request) => Response`. On success it calls
+ * `handler(req, ctx)` with the verified MandateContext; otherwise returns a 402 Response.
+ * Works with Hono, Next.js route handlers, Bun, Deno, and Cloudflare Workers.
+ */
+export declare function withMandate(requirement: Requirement<Request>, handler: (req: Request, ctx: MandateContext) => Response | Promise<Response>, opts?: MandateGateOptions): (req: Request) => Promise<Response>;
+//# sourceMappingURL=accept.d.ts.map

dist/accept.d.ts.map

+{"version":3,"file":"accept.d.ts","sourceRoot":"","sources":["../src/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAgB,KAAK,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEnD,wEAAwE;AACxE,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAGxE;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7E;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,mBAAmB,GAAG,IAAI,CAY5G;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,CAAC;IAC9C,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,oDAAoD;IACpD,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9G;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAO/F;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,uEAAuE;IACvE,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,kDAAkD;IAClD,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,8EAA8E;IAC9E,YAAY,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACtC,WAAW,EAAE,mBAAmB,EAChC,IAAI,GAAE,aAAkB,GACvB,YAAY,CAUd;AAED,+FAA+F;AAC/F,MAAM,MAAM,WAAW,CAAC,GAAG,IAAI,mBAAmB,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;AAEzF,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAkCD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,GAAG,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,GAAE,kBAAuB,IAEhF,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,KAAG,IAAI,CAU1E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC5E,IAAI,GAAE,kBAAuB,GAC5B,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAarC"}

dist/accept.js

+/**
+ * Accept — the requirement side, over HTTP.
+ *
+ * `checkMandate` (gate.ts) is the raw decision: does a presented mandate authorize a payment
+ * to THIS counterparty? This module turns that into the thing a resource server actually does:
+ * demand a mandate on the wire, and answer with HTTP 402 (Payment Required) + a challenge when
+ * one is missing or insufficient. That is what makes a mandate something a counterparty
+ * *requires* rather than a self-check an agent can code around — the requirement lives here, on
+ * the receiving side.
+ *
+ * Two integration shapes, both zero-dependency and duck-typed (we import no web framework):
+ *   - `mandateGate(...)`  — Express/Connect/raw-Node middleware `(req, res, next)`.
+ *   - `withMandate(...)`  — Web-standard `(Request) => Response` for Hono, Next.js route
+ *                           handlers, Bun, Deno, and Cloudflare Workers.
+ *
+ * Wire format: the agent presents `X-Vantic-Mandate: base64(JSON{ mandate, receipts? })`.
+ * A 402 answer echoes an x402-flavored `accepts` array describing what would satisfy the route.
+ *
+ * Budget caveat carries over from gate.ts: an isolated counterparty soundly enforces the
+ * signature, validity window, revocation, counterparty/action scope, and per-transaction cap
+ * (none of which need history), but NOT the global rolling budget — the agent controls which
+ * receipts it presents. See spec §8.
+ */
+import { checkMandate } from "./gate.js";
+/** Header an agent uses to present its mandate to a resource server. */
+export const MANDATE_HEADER = "x-vantic-mandate";
+/** Encode a mandate (+ optional receipts) into the `X-Vantic-Mandate` header value. */
+export function encodeMandatePresentation(p) {
+    const json = JSON.stringify({ mandate: p.mandate, receipts: p.receipts ?? [] });
+    return Buffer.from(json, "utf8").toString("base64");
+}
+/** Build the header object an agent attaches to its request. */
+export function mandateHeaders(p) {
+    return { [MANDATE_HEADER]: encodeMandatePresentation(p) };
+}
+/** Decode an `X-Vantic-Mandate` header value. Returns null if absent or malformed. */
+export function decodeMandatePresentation(headerValue) {
+    if (!headerValue)
+        return null;
+    try {
+        const obj = JSON.parse(Buffer.from(headerValue, "base64").toString("utf8"));
+        if (!obj || typeof obj !== "object" || !obj.mandate)
+            return null;
+        return {
+            mandate: obj.mandate,
+            receipts: Array.isArray(obj.receipts) ? obj.receipts : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Build the 402 challenge body for a requirement (optionally with rejection reasons). */
+export function mandateChallenge(req, reasons) {
+    const rejected = reasons != null && reasons.length > 0;
+    return {
+        error: rejected ? "mandate_invalid" : "mandate_required",
+        ...(rejected ? { reasons } : {}),
+        accepts: [{ scheme: "vantic", counterparty: req.counterparty, action: req.action, amount: req.amount, currency: req.currency }],
+    };
+}
+/**
+ * Core, transport-agnostic decision: given the raw header value and this route's requirement,
+ * decode + verify and return whether to serve (200) or challenge (402).
+ */
+export function evaluateMandate(headerValue, requirement, opts = {}) {
+    const presentation = decodeMandatePresentation(headerValue);
+    if (!presentation) {
+        return { granted: false, status: 402, result: null, challenge: mandateChallenge(requirement), presentation: null };
+    }
+    const result = checkMandate(presentation.mandate, requirement, presentation.receipts ?? [], opts);
+    if (!result.granted) {
+        return { granted: false, status: 402, result, challenge: mandateChallenge(requirement, result.reasons), presentation };
+    }
+    return { granted: true, status: 200, result, challenge: null, presentation };
+}
+function contextFrom(d) {
+    return {
+        principal: d.result?.principal,
+        agent: d.result.agent,
+        mandate: d.presentation.mandate,
+        receipts: d.presentation.receipts ?? [],
+    };
+}
+function readHeader(req, header) {
+    const h = req?.headers;
+    if (!h)
+        return undefined;
+    const v = typeof h.get === "function" ? h.get(header) : h[header] ?? h[header.toLowerCase()];
+    return Array.isArray(v) ? v[0] : (v ?? undefined);
+}
+function send402(res, challenge) {
+    const body = JSON.stringify(challenge);
+    if (typeof res.status === "function" && typeof res.json === "function") {
+        if (typeof res.set === "function")
+            res.set("WWW-Authenticate", "Mandate");
+        else if (typeof res.setHeader === "function")
+            res.setHeader("WWW-Authenticate", "Mandate");
+        res.status(402).json(challenge);
+    }
+    else if (typeof res.writeHead === "function") {
+        res.writeHead(402, { "content-type": "application/json", "www-authenticate": "Mandate" });
+        res.end(body);
+    }
+    else {
+        res.statusCode = 402;
+        if (typeof res.setHeader === "function")
+            res.setHeader("content-type", "application/json");
+        res.end?.(body);
+    }
+}
+/**
+ * Express / Connect / raw-Node middleware. On an authorized request it attaches
+ * `req.vantic` (a MandateContext) and calls `next()`; otherwise it answers 402 with the
+ * challenge and does NOT call `next()`, so the protected handler never runs.
+ */
+export function mandateGate(requirement, opts = {}) {
+    const header = (opts.header ?? MANDATE_HEADER).toLowerCase();
+    return function (req, res, next) {
+        const required = typeof requirement === "function" ? requirement(req) : requirement;
+        const decision = evaluateMandate(readHeader(req, header), required, opts);
+        if (decision.granted) {
+            req.vantic = contextFrom(decision);
+            next();
+            return;
+        }
+        send402(res, decision.challenge);
+    };
+}
+/**
+ * Web-standard wrapper: `(Request) => Response`. On success it calls
+ * `handler(req, ctx)` with the verified MandateContext; otherwise returns a 402 Response.
+ * Works with Hono, Next.js route handlers, Bun, Deno, and Cloudflare Workers.
+ */
+export function withMandate(requirement, handler, opts = {}) {
+    const header = opts.header ?? MANDATE_HEADER;
+    return async (req) => {
+        const required = typeof requirement === "function" ? requirement(req) : requirement;
+        const decision = evaluateMandate(req.headers.get(header), required, opts);
+        if (!decision.granted) {
+            return new Response(JSON.stringify(decision.challenge), {
+                status: 402,
+                headers: { "content-type": "application/json", "www-authenticate": "Mandate" },
+            });
+        }
+        return handler(req, contextFrom(decision));
+    };
+}
+//# sourceMappingURL=accept.js.map

dist/accept.js.map

+{"version":3,"file":"accept.js","sourceRoot":"","sources":["../src/accept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAIpF,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAQjD,uFAAuF;AACvF,MAAM,UAAU,yBAAyB,CAAC,CAAsB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,CAAsB;IACnD,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,yBAAyB,CAAC,WAAsC;IAC9E,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAkB;YAC/B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,QAAsB,CAAC,CAAC,CAAC,EAAE;SACzE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,GAAwB,EAAE,OAAkB;IAC3E,MAAM,QAAQ,GAAG,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB;QACxD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;KAChI,CAAC;AACJ,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAsC,EACtC,WAAgC,EAChC,OAAsB,EAAE;IAExB,MAAM,YAAY,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACrH,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAClG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC/E,CAAC;AAoBD,SAAS,WAAW,CAAC,CAAe;IAClC,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS;QAC9B,KAAK,EAAE,CAAC,CAAC,MAAO,CAAC,KAAK;QACtB,OAAO,EAAE,CAAC,CAAC,YAAa,CAAC,OAAO;QAChC,QAAQ,EAAE,CAAC,CAAC,YAAa,CAAC,QAAQ,IAAI,EAAE;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ,EAAE,MAAc;IAC1C,MAAM,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,SAA2B;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU;YAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;aACrE,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;YAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;YAAE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAC3F,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAY,WAA6B,EAAE,OAA2B,EAAE;IACjG,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,OAAO,UAAU,GAAQ,EAAE,GAAQ,EAAE,IAA6B;QAChE,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,UAAU,CAAC,CAAC,CAAE,WAA+C,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACzH,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAU,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,WAAiC,EACjC,OAA4E,EAC5E,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,OAAO,KAAK,EAAE,GAAY,EAAqB,EAAE;QAC/C,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,UAAU,CAAC,CAAC,CAAE,WAAmD,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7H,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBACtD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC"}

package.json

 {
   "name": "@vantic/sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
+  "mcpName": "io.github.vanticlabs/vantic",
   "description": "Vantic — a spending firewall and permission layer for AI agents: signed mandates, allowlists, and tamper-proof receipts for every money-moving action.",
@@ -5,0 +6,0 @@ "type": "module",

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

143374

15.85%

Number of package files

63

6.78%

Lines of code

1672

17.17%

No dependency changes