@curless/agentbank-core

Shared, edge-safe runtime primitives for the agentbank SDKs. Built on the Web Crypto API (globalThis.crypto) with no node:crypto dependency, so every SDK that depends on it runs unchanged on Node 18+, Vercel Edge, Cloudflare Workers and Deno.

Most apps don't install this directly — it comes in as a dependency of @curless/agentbank-sdk, @curless/agentbank-merchant-sdk and @curless/agentbank-protocols.

Crypto

import { hmacSha256Hex, randomHex, timingSafeEqualHex } from '@curless/agentbank-core';

const nonce = randomHex(32);                          // 64-char hex, sync
const sig = await hmacSha256Hex(secret, `${ts}.${body}`); // HMAC-SHA256, async
const ok = timingSafeEqualHex(sig, expected);         // constant-time compare

hmacSha256Hex is byte-for-byte identical to node:crypto.createHmac('sha256', secret).update(message).digest('hex'), so signatures stay compatible with the agentbank server. It is async because crypto.subtle.sign has no synchronous form on edge runtimes.

MIT