402mob-merchant-sdk 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.4.2 — prepared, unpublished
+
+- Add optional `artifact` commitment and `share` fields to resolved resources. Validate supplied commitments and preserve compatibility with older servers that omit them.
+
+## 0.4.1
+
+- Documentation-only release. The packaged README no longer states that the CLI's published SDK dependency remains 0.3.1; it states that published CLI 0.2.0 pins SDK 0.4.0. No code changes: `dist` is byte-identical to 0.4.0.
+
 ## 0.4.0
 
 - Worker profiles: `setWorkerProfile`, `getMyWorkerProfile`, public `getWorkerProfile` and `searchWorkers`, with exported input/response types. No prepared artifact is required. Worker discovery uses its own explicit visibility setting.

package/README.md

@@ -1,5 +1,7 @@
 # 402Mob Merchant SDK
 
+Source 0.4.2 is prepared locally with optional Payment Links commitment/share types and validation. Published 0.4.1 remains unchanged; these additions require the new source build until publication.
+
 **Version 0.4.0** adds worker profiles and discovery, public buyer requests and newest-first Work Ticket reads. Upgrade from 0.3.1 to use these additions. Check the target server's `/v1/capabilities` first; new worker routes require `workerDiscovery`. See [CHANGELOG.md](./CHANGELOG.md).
 
 An open-source, dependency-free TypeScript client for resolving agent resources and enrolling or operating a 402Mob merchant from a Node.js server or agent runtime.
@@ -248,7 +250,7 @@ npm test
 npm pack --pack-destination /tmp
 ```
 
-To test a local build in another project, install the generated file with `npm install /tmp/402mob-merchant-sdk-0.4.0.tgz`. The CLI's published SDK dependency remains 0.3.1 until a separate CLI release.
+To test a local build in another project, install the generated file with `npm install /tmp/402mob-merchant-sdk-0.4.1.tgz`. Published CLI 0.2.1 pins SDK 0.4.1 and exposes worker discovery, buyer requests and inbox ordering.
 
 The SDK tests use mocked HTTP responses and type-check every bundled example. They do not contact `evidence.contact` or submit wallet transactions. Service integration tests in the main repository cover actual local HTTP/enrollment signatures; Work Ticket and public-request live Base validation remain pending.
 

package/dist/index.d.ts

@@ -124,8 +124,16 @@ export interface AgentResourceProvider {
     payoutAddress?: EvmAddress;
     createdAt?: string;
 }
+/** Public commitment; the private verifier is returned only with paid delivery. */
+export interface ArtifactCommitment {
+    algorithm: "sha256-private-proof-v1";
+    commitment: string;
+    sizeUpperBound: number;
+}
 /** A provider-published, fixed-price resource descriptor. */
 export interface AgentResource {
+    artifact?: ArtifactCommitment;
+    share?: string;
     id: string;
     seriesId: string;
     version: string;

package/dist/index.js

@@ -443,7 +443,12 @@ function isAgentResource(value) {
         return false;
     const amountAtomic = value.amountAtomic;
     const amountUSDC = value.amountUSDC;
-    return nonempty(value.id) && nonempty(value.seriesId) && nonempty(value.version) &&
+    return (value.share === undefined || nonempty(value.share)) &&
+        (value.artifact === undefined || (isRecord(value.artifact) && value.artifact.algorithm === "sha256-private-proof-v1" &&
+            typeof value.artifact.commitment === "string" && /^[a-f0-9]{64}$/.test(value.artifact.commitment) &&
+            Number.isSafeInteger(value.artifact.sizeUpperBound) && Number(value.artifact.sizeUpperBound) >= 1024 &&
+            Number(value.artifact.sizeUpperBound) <= 49152 && Number(value.artifact.sizeUpperBound) % 1024 === 0)) &&
+        nonempty(value.id) && nonempty(value.seriesId) && nonempty(value.version) &&
         nonempty(value.title) && typeof value.description === "string" &&
         typeof amountAtomic === "string" && /^[1-9][0-9]*$/.test(amountAtomic) &&
         typeof amountUSDC === "string" && /^(0|[1-9][0-9]*)(\.[0-9]{1,6})?$/.test(amountUSDC) &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "402mob-merchant-sdk",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "TypeScript client for resolving agent resources and enrolling and operating 402Mob merchants.",
   "license": "MIT",
   "repository": {
@@ -33,6 +33,6 @@
     "prepare": "npm run build"
   },
   "devDependencies": {
-    "typescript": "5.9.3"
+    "typescript": "7.0.2"
   }
 }