@curless/agentbank-core

The foundation every AgentBank SDK is built on: one implementation of the crypto, encoding, HTTP, error type, and shared types, so the buyer, merchant, and protocol SDKs behave identically instead of each shipping its own copy.

Zero runtime dependencies, edge-safe. Built on the Web Crypto API (globalThis.crypto) and the platform fetch — no node: builtins — so anything that depends on it runs unchanged on Node 18+, Vercel Edge, Cloudflare Workers, and Deno.

You rarely install this directly. It comes in as a dependency of @curless/agentbank-merchant-sdk, @curless/agentbank-sdk, and @curless/agentbank-protocols. Install it on its own only if you're writing your own client against the gateway. It's published — and has to be — because every SDK depends on it at runtime; that's what makes AgentbankError one class across all of them.

Crypto

import { hmacSha256Hex, randomHex, timingSafeEqualHex } from '@curless/agentbank-core';

const nonce = randomHex(32);                          // 64-char hex, sync
const sig = await hmacSha256Hex(secret, `${ts}.${body}`); // HMAC-SHA256, async
const ok = timingSafeEqualHex(sig, expected);         // constant-time compare

hmacSha256Hex is byte-for-byte identical to node:crypto.createHmac('sha256', secret).update(message).digest('hex'), so signatures stay compatible with the agentbank server. It is async because crypto.subtle.sign has no synchronous form on edge runtimes.

Encoding

import { fromBase64, toBase64, toBase64Url } from '@curless/agentbank-core';

Portable base64 / unpadded base64url — Buffer on Node, atob/btoa + TextEncoder on edge runtimes. fromBase64 accepts both standard and url-safe input.

HTTP + errors

sendJson (used by every SDK) carries a 30s default deadline and accepts { signal, timeoutMs }. Every failure throws AgentbankError: HTTP errors with their real status, transport failures with status === 0 and code timeout / aborted / network_error. Prefer AgentbankError.is(err) over instanceof at package boundaries — it recognizes errors thrown by a different copy of this package in the same node_modules.

Types

The shared type surface the SDKs speak — PaymentIntent, PaymentIntentStatus, PaymentProtocol, PaymentLink, Customer, BalanceTransaction, Paginated<T>, and more. These mirror the gateway's schema exactly (a contract test fails the build if they drift), so a value the API can return is always representable in the types.

MIT