weft-sdk 0.25.0 → 0.32.5

data/lib/weft/facilitator/path_match.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+module Weft
+  module Facilitator
+    # Linear scans for route compilation, path normalization, and amounts.
+    # Route matching itself is a Core-equivalent regex compiled once per route.
+    module PathMatch
+      ROUTE_ESCAPE = '$()+.?^{|}\\'
+
+      module_function
+
+      def compile_route(path)
+        trailing = path.end_with?('/*')
+        body = trailing ? path[0..-3] : path
+        source = +''
+        index = 0
+        while index < body.length
+          char = body[index]
+          if char == '['
+            close = body.index(']', index + 1)
+            if close && close > index + 1
+              source << '[^/]+'
+              index = close + 1
+              next
+            end
+          end
+          if char == ':'
+            length = ident_len(body, index + 1)
+            if length.positive?
+              source << '[^/]+'
+              index += 1 + length
+              next
+            end
+          end
+          if char == '*'
+            source << '.*?'
+            index += 1
+            next
+          end
+          source << '\\' if ROUTE_ESCAPE.include?(char)
+          source << char
+          index += 1
+        end
+        source << '(?:/.*?)?' if trailing
+        Regexp.new("\\A#{source}\\z", Regexp::IGNORECASE | Regexp::MULTILINE, timeout: 0.05)
+      end
+
+      def ident_len(text, start)
+        return 0 if start >= text.length || !ident_start?(text[start])
+
+        index = start + 1
+        index += 1 while index < text.length && ident_cont?(text[index])
+        index - start
+      end
+
+      def ident_start?(char)
+        char == '_' || (char >= 'A' && char <= 'Z') || (char >= 'a' && char <= 'z')
+      end
+
+      def ident_cont?(char)
+        ident_start?(char) || (char >= '0' && char <= '9')
+      end
+
+      def split_verb(pattern)
+        return ['*', pattern] unless pattern.include?(' ')
+
+        parts = []
+        token = +''
+        pattern.each_char do |char|
+          if whitespace?(char)
+            next if token.empty?
+
+            parts << token
+            token = +''
+          else
+            token << char
+          end
+        end
+        parts << token unless token.empty?
+        [parts[0] || '', parts[1] || '']
+      end
+
+      def whitespace?(char)
+        char == ' ' || char == "\t" || char == "\n" || char == "\r" || char == "\f" || char == "\v"
+      end
+
+      def glob_match?(pattern, text)
+        pattern_index = 0
+        text_index = 0
+        star_pattern = nil
+        star_text = -1
+        while text_index < text.length
+          if pattern_index < pattern.length && pattern[pattern_index] == '*'
+            star_pattern = pattern_index
+            star_text = text_index
+            pattern_index += 1
+            next
+          end
+          if pattern_index < pattern.length && pattern[pattern_index] == text[text_index]
+            pattern_index += 1
+            text_index += 1
+            next
+          end
+          return false unless star_pattern
+
+          star_text += 1
+          return false if star_text > text.length
+
+          text_index = star_text
+          pattern_index = star_pattern + 1
+        end
+        pattern_index += 1 while pattern_index < pattern.length && pattern[pattern_index] == '*'
+        pattern_index == pattern.length
+      end
+
+      def collapse_slashes(value)
+        out = +''
+        previous_slash = false
+        value.each_char do |char|
+          if char == '/'
+            out << '/' unless previous_slash
+            previous_slash = true
+          else
+            out << char
+            previous_slash = false
+          end
+        end
+        out
+      end
+
+      def trim_trailing_slashes(value)
+        text = value.to_s.dup
+        text.chomp!('/') while text.end_with?('/')
+        text
+      end
+
+      def trim_trailing_slashes_keep_root(value)
+        return value if value.length <= 1
+
+        end_at = value.length
+        end_at -= 1 while end_at > 1 && value[end_at - 1] == '/'
+        end_at == value.length ? value : value[0, end_at]
+      end
+
+      def strip_leading_slashes(value)
+        text = value.to_s
+        index = 0
+        index += 1 while index < text.length && text[index] == '/'
+        index.zero? ? text : text[index..]
+      end
+
+      def decimal_amount?(text)
+        return false if text.nil? || text.empty?
+
+        index = 0
+        index += 1 if text[0] == '-'
+        return false if index >= text.length || !digit?(text[index])
+
+        index += 1 while index < text.length && digit?(text[index])
+        if index < text.length && text[index] == '.'
+          index += 1
+          index += 1 while index < text.length && digit?(text[index])
+        end
+        index == text.length
+      end
+
+      def digit?(char)
+        char >= '0' && char <= '9'
+      end
+
+      def strip_leading_zeros(text)
+        index = 0
+        index += 1 while index < text.length && text[index] == '0'
+        rest = text[index..]
+        rest.nil? || rest.empty? ? '0' : rest
+      end
+    end
+  end
+end

data/lib/weft/facilitator/product.rb

@@ -0,0 +1,380 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'uri'
+
+module Weft
+  module Facilitator
+    module Product
+      PRODUCT_TYPES = %w[api agent mcp].freeze
+      WEFT_TYPE_TAG_PREFIX = 'weft:type:'
+      WEFT_PRODUCT_EXTENSION_KEY = 'weft.product'
+      MAX_TAGS = 5
+      MAX_TAG_CHARS = 32
+      MAX_DIMENSIONS = 8
+      MAX_DIMENSION_CHARS = 64
+      DIMENSION_NAME = /\A[A-Za-z_][A-Za-z0-9_.-]*\z/
+      MAX_SERVICE_NAME_CHARS = 32
+      MAX_ICON_URL_CHARS = 2048
+      PRINTABLE_ASCII = /\A[\x20-\x7e]+\z/
+
+      WEFT_PRODUCT_INFO_SCHEMA = {
+        '$schema' => 'https://json-schema.org/draft/2020-12/schema',
+        'type' => 'object',
+        'properties' => {
+          'kind' => { 'type' => 'string', 'enum' => PRODUCT_TYPES.dup },
+          'product_id' => { 'type' => 'string', 'minLength' => 1 },
+          'manifest_hash' => { 'type' => 'string', 'minLength' => 1 }
+        },
+        'additionalProperties' => false
+      }.freeze
+
+      module_function
+
+      def product_type_tag(type)
+        "#{WEFT_TYPE_TAG_PREFIX}#{type}"
+      end
+
+      def create_warn
+        seen = {}
+        lambda do |message, dedupe_key = nil|
+          key = dedupe_key || message
+          return if seen[key]
+
+          seen[key] = true
+          warn "[weft] #{message}"
+        end
+      end
+
+      def apply_product_identity(routes, identity)
+        identity = stringify_hash(identity)
+        return routes unless routes.is_a?(Hash)
+        return routes unless has_product_identity?(identity) || has_route_identity?(routes)
+
+        sink = create_warn
+        if single_route?(routes)
+          apply_to_route(routes, identity, sink)
+        else
+          routes.each_with_object({}) do |(pattern, route), out|
+            out[pattern] = apply_to_route(route, identity, sink)
+          end
+        end
+      end
+
+      def sanitize_product_identity(identity)
+        identity = stringify_hash(identity)
+        silent = ->(*) {}
+        type = resolve_type(read(identity, 'type'), 'type', silent)
+        name = resolve_service_name(nil, read(identity, 'name'), silent)
+        icon = resolve_icon_url(nil, read(identity, 'iconUrl'), silent)
+        tags = resolve_tags(nil, read(identity, 'tags'), type, silent)
+        tags = tags&.reject { |tag| reserved_type_tag?(tag) }
+        out = {}
+        out['name'] = name unless name.nil?
+        out['type'] = type unless type.nil?
+        out['tags'] = tags if tags.is_a?(Array) && !tags.empty?
+        out['iconUrl'] = icon unless icon.nil?
+        out
+      end
+
+      def resolve_dimensions(value, sink)
+        declared = as_tag_list(value, 'dimensions', sink)
+        return nil if declared.nil?
+
+        malformed = []
+        named = declared.select do |name|
+          if name.length <= MAX_DIMENSION_CHARS && DIMENSION_NAME.match?(name)
+            true
+          else
+            malformed << name
+            false
+          end
+        end
+        unless malformed.empty?
+          sink.call(
+            "dropping #{malformed.length} dimension(s) that do not name a field " \
+            "(max #{MAX_DIMENSION_CHARS} characters, starting with a letter or " \
+            "underscore): #{malformed.join(', ')}"
+          )
+        end
+        deduped = named.uniq
+        if deduped.length > MAX_DIMENSIONS
+          sink.call(
+            "dropping #{deduped.length - MAX_DIMENSIONS} dimension(s): at most " \
+            "#{MAX_DIMENSIONS} travel. Dropped: #{deduped.drop(MAX_DIMENSIONS).join(', ')}"
+          )
+        end
+        bounded = deduped.take(MAX_DIMENSIONS)
+        bounded.empty? ? nil : bounded
+      end
+
+      def apply_to_route(route, identity, sink)
+        unless route.is_a?(Hash)
+          sink.call(
+            "ignoring route #{show(route)}: expected a route config object, got #{type_name(route)}"
+          )
+          return route
+        end
+
+        rest = route.dup
+        declared_type = take(rest, 'type')
+        declared_name = take(rest, 'serviceName')
+        declared_tags = take(rest, 'tags')
+        declared_icon = take(rest, 'iconUrl')
+        type = resolve_type(declared_type, 'route type', sink) || resolve_type(read(identity, 'type'), 'type', sink)
+        service_name = resolve_service_name(declared_name, read(identity, 'name'), sink)
+        icon_url = resolve_icon_url(declared_icon, read(identity, 'iconUrl'), sink)
+        tags = resolve_tags(declared_tags, read(identity, 'tags'), type, sink)
+        extensions = resolve_product_extensions(read(rest, 'extensions'), type, identity, sink)
+
+        result = stringify_hash(rest)
+        result['serviceName'] = service_name unless service_name.nil?
+        result['tags'] = tags unless tags.nil?
+        result['iconUrl'] = icon_url unless icon_url.nil?
+        result['extensions'] = extensions unless extensions.nil?
+        result
+      end
+
+      def resolve_product_extensions(route_extensions, type, declaration, sink)
+        product_id = resolve_opaque_string('productId', read(declaration, 'productId'), sink)
+        manifest_hash = resolve_opaque_string('manifestHash', read(declaration, 'manifestHash'), sink)
+        info = {}
+        info['kind'] = type unless type.nil?
+        info['product_id'] = product_id unless product_id.nil?
+        info['manifest_hash'] = manifest_hash unless manifest_hash.nil?
+        return nil if info.empty?
+
+        unless route_extensions.nil?
+          unless route_extensions.is_a?(Hash)
+            sink.call(
+              "route extensions #{show(route_extensions)} are #{type_name(route_extensions)}, " \
+              'not an object; leaving them untouched and skipping the ' \
+              "#{WEFT_PRODUCT_EXTENSION_KEY} declaration for this route"
+            )
+            return nil
+          end
+          return nil if has_key?(route_extensions, WEFT_PRODUCT_EXTENSION_KEY)
+        end
+
+        merged = stringify_hash(route_extensions || {})
+        merged[WEFT_PRODUCT_EXTENSION_KEY] = {
+          'info' => info,
+          'schema' => WEFT_PRODUCT_INFO_SCHEMA
+        }
+        merged
+      end
+
+      def resolve_tags(route_tags, identity_tags, type, sink)
+        declared = as_tag_list(route_tags, 'route tags', sink)
+        declared = as_tag_list(identity_tags, 'tags', sink) if declared.nil?
+        return nil if declared.nil? && type.nil?
+
+        seller_tags = (declared || []).select do |tag|
+          next true unless reserved_type_tag?(tag)
+
+          sink.call(
+            "dropping reserved tag #{show(tag)}: declare the product kind with " \
+            "`type` (#{PRODUCT_TYPES.join(', ')}) on the middleware config or " \
+            'on the route'
+          )
+          false
+        end
+        malformed = []
+        carried = []
+        carried << product_type_tag(type) unless type.nil?
+        carried.concat(seller_tags)
+        carried.select! do |tag|
+          if tag.length <= MAX_TAG_CHARS && PRINTABLE_ASCII.match?(tag)
+            true
+          else
+            malformed << tag
+            false
+          end
+        end
+        unless malformed.empty?
+          sink.call(
+            "dropping #{malformed.length} tag(s) the x402 protocol cannot carry " \
+            "(max #{MAX_TAG_CHARS} printable-ASCII characters each): #{malformed.join(', ')}"
+          )
+        end
+        deduped = carried.uniq
+        if deduped.length > MAX_TAGS
+          dropped = deduped.drop(MAX_TAGS)
+          sink.call(
+            "dropping #{dropped.length} tag(s): the x402 protocol carries #{MAX_TAGS}" \
+            "#{type.nil? ? '' : ' and the declared type uses one of them'}. " \
+            "Dropped: #{dropped.join(', ')}"
+          )
+        end
+        bounded = deduped.take(MAX_TAGS)
+        bounded.empty? ? nil : bounded
+      end
+
+      def resolve_service_name(route_name, identity_name, sink)
+        declared = as_string('route serviceName', route_name, sink) || as_string('name', identity_name, sink)
+        return nil if declared.nil?
+        unless PRINTABLE_ASCII.match?(declared)
+          sink.call(
+            "dropping product name #{show(declared)}: the x402 protocol carries " \
+            "1-#{MAX_SERVICE_NAME_CHARS} printable-ASCII characters (U+0020-U+007E)"
+          )
+          return nil
+        end
+        if declared.length > MAX_SERVICE_NAME_CHARS
+          truncated = declared[0, MAX_SERVICE_NAME_CHARS]
+          sink.call(
+            "product name #{show(declared)} is #{declared.length} characters; the " \
+            "x402 protocol carries #{MAX_SERVICE_NAME_CHARS}, so it travels as #{show(truncated)}"
+          )
+          return truncated
+        end
+
+        declared
+      end
+
+      def resolve_icon_url(route_icon, identity_icon, sink)
+        declared = as_string('route iconUrl', route_icon, sink) || as_string('iconUrl', identity_icon, sink)
+        return nil if declared.nil?
+        if declared.length > MAX_ICON_URL_CHARS
+          sink.call(
+            "dropping iconUrl: #{declared.length} characters exceeds the " \
+            "#{MAX_ICON_URL_CHARS} the x402 protocol carries"
+          )
+          return nil
+        end
+        scheme = declared[/\A([A-Za-z][A-Za-z0-9+.-]*):/, 1]&.downcase
+        if scheme.nil?
+          sink.call("dropping iconUrl #{show(declared)}: expected an absolute http or https URL")
+          return nil
+        end
+        if scheme != 'http' && scheme != 'https'
+          sink.call(
+            "dropping iconUrl #{show(declared)}: only http and https are carried " \
+            '(a dashboard renders this URL)'
+          )
+          return nil
+        end
+
+        declared
+      end
+
+      def resolve_type(value, field, sink)
+        return nil if value.nil?
+        return value if value.is_a?(String) && PRODUCT_TYPES.include?(value)
+
+        sink.call("ignoring #{field} #{show(value)}: expected one of #{PRODUCT_TYPES.join(', ')}")
+        nil
+      end
+
+      def resolve_opaque_string(field, value, sink)
+        declared = as_string(field, value, sink)
+        return nil if declared.nil?
+
+        trimmed = declared.strip
+        if trimmed.empty?
+          sink.call("ignoring empty #{field}")
+          return nil
+        end
+        trimmed
+      end
+
+      def as_string(field, value, sink)
+        return nil if value.nil?
+        return value if value.is_a?(String)
+
+        sink.call("ignoring #{field} #{show(value)}: expected a string, got #{type_name(value)}")
+        nil
+      end
+
+      def as_tag_list(value, field, sink)
+        return nil if value.nil?
+        unless value.is_a?(Array)
+          sink.call(
+            "ignoring #{field} #{show(value)}: expected an array of strings, got #{type_name(value)}"
+          )
+          return nil
+        end
+
+        value.select do |entry|
+          next true if entry.is_a?(String)
+
+          sink.call("dropping tag #{show(entry)}: expected a string, got #{type_name(entry)}")
+          false
+        end
+      end
+
+      def reserved_type_tag?(tag)
+        tag.strip.downcase.start_with?(WEFT_TYPE_TAG_PREFIX)
+      end
+
+      def has_product_identity?(identity)
+        %w[name type tags iconUrl productId manifestHash].any? { |key| !read(identity, key).nil? }
+      end
+
+      def has_route_identity?(routes)
+        if single_route?(routes)
+          !read(routes, 'type').nil?
+        else
+          routes.any? { |_, route| route.is_a?(Hash) && !read(route, 'type').nil? }
+        end
+      end
+
+      def single_route?(routes)
+        has_key?(routes, 'accepts')
+      end
+
+      def read(hash, key)
+        return nil unless hash.is_a?(Hash)
+        return hash[key] if hash.key?(key)
+        return hash[key.to_sym] if hash.key?(key.to_sym)
+
+        nil
+      end
+
+      def has_key?(hash, key)
+        return false unless hash.is_a?(Hash)
+
+        hash.key?(key) || hash.key?(key.to_sym)
+      end
+
+      def take(hash, key)
+        value = read(hash, key)
+        hash.delete(key)
+        hash.delete(key.to_sym)
+        value
+      end
+
+      def stringify_hash(value)
+        return {} if value.nil?
+        return value unless value.is_a?(Hash)
+
+        value.each_with_object({}) do |(key, item), out|
+          out[key.to_s] = item
+        end
+      end
+
+      def show(value)
+        JSON.generate(value)
+      rescue StandardError
+        type_name(value)
+      end
+
+      def type_name(value)
+        return 'null' if value.nil?
+        return 'an array' if value.is_a?(Array)
+
+        "a #{js_type(value)}"
+      end
+
+      def js_type(value)
+        case value
+        when String then 'string'
+        when Integer, Float then 'number'
+        when TrueClass, FalseClass then 'boolean'
+        when Hash then 'object'
+        else 'object'
+        end
+      end
+    end
+  end
+end

data/lib/weft/facilitator/replay.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'json'
+
+require_relative 'json_wire'
+
+module Weft
+  module Facilitator
+    module Replay
+      module_function
+
+      def payment_resume_candidate(context)
+        header = payment_header(context)
+        return nil if header.nil? || header.empty?
+
+        payload = JSON.parse(JsonWire.base64_decode(header))
+        return nil unless payload.is_a?(Hash)
+        return nil unless payload['x402Version'] == 2
+        return nil unless payload['accepted'].is_a?(Hash)
+        return nil unless payload['payload'].is_a?(Hash)
+        return nil unless payload['accepted']['scheme'].is_a?(String)
+        return nil unless payload['accepted']['network'].is_a?(String)
+
+        {
+          'paymentPayload' => payload,
+          'paymentRequirements' => payload['accepted']
+        }
+      rescue StandardError
+        nil
+      end
+
+      def payment_header(context)
+        return nil unless context.is_a?(Hash)
+
+        direct = Product.read(context, 'paymentHeader')
+        return direct unless direct.nil?
+
+        adapter = Product.read(context, 'adapter')
+        return nil unless adapter.respond_to?(:get_header)
+
+        adapter.get_header('payment-signature') || adapter.get_header('PAYMENT-SIGNATURE')
+      end
+    end
+  end
+end