@arp-protocol/cli 0.0.0-stage → 0.0.1

package/dist/chunks/node-0ydee9hy.js

@@ -0,0 +1,593 @@
+#!/usr/bin/env node
+import {
+  resolveNodeKey
+} from "./cli-zpft011j.js";
+import {
+  appendJsonLine,
+  bigintSafe,
+  jsonResponse,
+  readJsonLines,
+  serveFetch,
+  stateFile
+} from "./cli-tyey74p3.js";
+import {
+  HIRE_RECEIPT_VERSION,
+  createPublicClient,
+  hireDigest,
+  http,
+  normaliseEndpoint,
+  parseEther,
+  signHireReceipt
+} from "./cli-74hv4etk.js";
+import"./cli-c8568g4c.js";
+import {
+  ERC8004_REGISTRY
+} from "./cli-v446mw5v.js";
+import {
+  formatEther,
+  isAddress
+} from "./cli-0hqxver6.js";
+import"./cli-d3dy7cxe.js";
+import"./cli-3kbbwfbp.js";
+import"./cli-g5zvr10v.js";
+
+// ../node/src/env.ts
+function portFrom(raw, fallback) {
+  if (raw === undefined || raw.trim() === "")
+    return fallback;
+  const port = Number(raw);
+  if (!/^[0-9]+$/.test(raw.trim()) || port < 1 || port > 65535) {
+    throw new Error(`AGENT_NODE_PORT must be a port between 1 and 65535, got ${raw}`);
+  }
+  return port;
+}
+function minBudgetFrom(raw, fallback) {
+  const value = raw === undefined || raw.trim() === "" ? fallback : raw.trim();
+  if (!/^(0|[1-9][0-9]*)(\.[0-9]{1,18})?$/.test(value)) {
+    throw new Error(`AGENT_NODE_MIN_BUDGET must be a decimal amount such as 0.001, got ${value}`);
+  }
+  return parseEther(value);
+}
+
+// ../node/src/task.ts
+var MAX_OFFER_FIELD = 500;
+function readOffer(value) {
+  if (typeof value !== "object" || value === null)
+    return null;
+  const { description, input, output } = value;
+  const fields = [description, input, output];
+  if (!fields.every((field) => typeof field === "string" && field.length > 0 && field.length <= MAX_OFFER_FIELD)) {
+    return null;
+  }
+  return { description, input, output };
+}
+var echo = async (payload, context) => ({
+  echoed: payload,
+  note: "No handler configured, so this node proves the protocol and nothing about the agent. Set " + "ARP_NODE_HANDLER to a module exporting `handle(payload, context)`.",
+  paidWei: context.paid.toString()
+});
+
+class PaymentLedger {
+  path;
+  spent = new Set;
+  pending = new Set;
+  constructor(path) {
+    this.path = path;
+    if (path === null)
+      return;
+    for (const row of readJsonLines(path)) {
+      const hash = row?.paymentTxHash;
+      if (typeof hash === "string")
+        this.spent.add(hash.toLowerCase());
+    }
+  }
+  isSpent(hash) {
+    const key = hash.toLowerCase();
+    return this.spent.has(key) || this.pending.has(key);
+  }
+  claim(hash) {
+    if (this.isSpent(hash))
+      return false;
+    this.pending.add(hash.toLowerCase());
+    return true;
+  }
+  release(hash) {
+    this.pending.delete(hash.toLowerCase());
+  }
+  commit(hash, record) {
+    const key = hash.toLowerCase();
+    if (this.path !== null)
+      appendJsonLine(this.path, { paymentTxHash: key, ...record });
+    this.pending.delete(key);
+    this.spent.add(key);
+  }
+}
+var DEFAULT_LIMITS = {
+  maxBodyBytes: 64 * 1024,
+  handlerTimeoutMs: 60000,
+  requestsPerMinute: 30,
+  receiptTtlSeconds: 86400
+};
+var TX_HASH = /^0x[0-9a-fA-F]{64}$/;
+var RATE_WINDOW_MS = 60000;
+var RATE_SWEEP_AT = 1e4;
+var json = jsonResponse;
+
+class Timeout extends Error {
+}
+function withTimeout(work, ms) {
+  let timer;
+  const expiry = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Timeout), ms);
+  });
+  return Promise.race([work, expiry]).finally(() => clearTimeout(timer));
+}
+function createNode(options) {
+  const { account, publicClient, chainId, identity, minBudget, handle, offer = null, ledger } = options;
+  const limits = { ...DEFAULT_LIMITS, ...options.limits };
+  const now = options.now ?? Date.now;
+  const windows = new Map;
+  function overLimit(client) {
+    const at = now();
+    if (windows.size > RATE_SWEEP_AT) {
+      for (const [key, window2] of windows) {
+        if (at - window2.start >= RATE_WINDOW_MS)
+          windows.delete(key);
+      }
+    }
+    const window = windows.get(client);
+    if (window === undefined || at - window.start >= RATE_WINDOW_MS) {
+      windows.set(client, { start: at, count: 1 });
+      return false;
+    }
+    window.count += 1;
+    return window.count > limits.requestsPerMinute;
+  }
+  async function verifyPayment(hash, requester) {
+    const tx = await publicClient.getTransaction({ hash }).catch(() => null);
+    if (tx === null)
+      return { error: `payment tx ${hash} not found` };
+    const receipt = await publicClient.getTransactionReceipt({ hash }).catch(() => null);
+    if (receipt === null)
+      return { error: `payment tx ${hash} is not mined yet` };
+    if (receipt.status !== "success")
+      return { error: `payment tx ${hash} reverted` };
+    if (!tx.to || tx.to.toLowerCase() !== account.address.toLowerCase()) {
+      return { error: `payment recipient ${tx.to ?? "none"} is not this agent ${account.address}` };
+    }
+    if (tx.value < minBudget) {
+      return {
+        error: `payment ${formatEther(tx.value)} is below this agent's minimum ${formatEther(minBudget)}`
+      };
+    }
+    if (tx.from.toLowerCase() !== requester.toLowerCase()) {
+      return { error: `payment came from ${tx.from}, not from the declared requester` };
+    }
+    return { requester, paid: tx.value, paymentTxHash: hash, agent: account.address };
+  }
+  async function readBody(request) {
+    const declared = Number(request.headers.get("content-length") ?? "0");
+    if (declared > limits.maxBodyBytes) {
+      return json({ error: `body over ${limits.maxBodyBytes} bytes` }, 413);
+    }
+    const text = await request.text();
+    if (new TextEncoder().encode(text).byteLength > limits.maxBodyBytes) {
+      return json({ error: `body over ${limits.maxBodyBytes} bytes` }, 413);
+    }
+    try {
+      const parsed = JSON.parse(text);
+      if (typeof parsed !== "object" || parsed === null) {
+        return json({ error: "body is not a JSON object" }, 400);
+      }
+      return parsed;
+    } catch {
+      return json({ error: "body is not JSON" }, 400);
+    }
+  }
+  return {
+    async fetch(request, client = "unknown") {
+      const url = new URL(request.url);
+      if (request.method === "GET" && url.pathname === "/healthz") {
+        return json({ ok: true, agent: account.address, minBudgetWei: minBudget.toString() });
+      }
+      if (request.method === "GET" && url.pathname === "/") {
+        return json({
+          agent: account.address,
+          endpoints: [{ path: "/task", method: "POST", description: "hire this agent" }],
+          minBudgetWei: minBudget.toString(),
+          offer
+        });
+      }
+      if (request.method !== "POST" || url.pathname !== "/task") {
+        return json({ error: "POST /task, or GET /healthz" }, 404);
+      }
+      if (overLimit(client)) {
+        return json({ error: `more than ${limits.requestsPerMinute} requests a minute` }, 429);
+      }
+      const body = await readBody(request);
+      if (body instanceof Response)
+        return body;
+      const { paymentTxHash: hash, requesterAddress: requester } = body;
+      if (typeof hash !== "string" || !TX_HASH.test(hash)) {
+        return json({ error: "paymentTxHash must be a 32-byte 0x-prefixed hex hash" }, 400);
+      }
+      if (typeof requester !== "string" || !isAddress(requester)) {
+        return json({ error: "requesterAddress must be an address" }, 400);
+      }
+      const { verifier, termId } = body;
+      if (typeof verifier !== "string" || !isAddress(verifier)) {
+        return json({ error: "verifier must be the address the receipt is for (an enforcer or a service)" }, 400);
+      }
+      if (typeof termId !== "string" || !TX_HASH.test(termId)) {
+        return json({ error: "termId must be the 32-byte term the requester will deposit on" }, 400);
+      }
+      const payment = hash;
+      const spentError = () => json({ error: `payment tx ${payment} was already used for a job` }, 409);
+      if (ledger.isSpent(payment))
+        return spentError();
+      const verified = await verifyPayment(payment, requester);
+      if ("error" in verified)
+        return json(verified, 402);
+      if (!ledger.claim(payment))
+        return spentError();
+      let result;
+      let requestHash;
+      let resultHash;
+      const abort = new AbortController;
+      const work = Promise.resolve().then(() => handle(body.payload, { ...verified, signal: abort.signal }));
+      try {
+        const answer = await withTimeout(work, limits.handlerTimeoutMs);
+        result = JSON.parse(JSON.stringify(answer ?? null, bigintSafe));
+        requestHash = hireDigest(body.payload ?? null);
+        resultHash = hireDigest(result);
+      } catch (error) {
+        if (error instanceof Timeout) {
+          abort.abort();
+          work.then(() => ledger.release(payment), () => ledger.release(payment));
+          return json({ error: `handler did not answer within ${limits.handlerTimeoutMs} ms` }, 504);
+        }
+        ledger.release(payment);
+        return json({ error: `handler failed: ${String(error).slice(0, 300)}` }, 500);
+      }
+      const issuedAt = Math.floor(now() / 1000);
+      const receipt = {
+        version: HIRE_RECEIPT_VERSION,
+        agentRegistry: identity?.agentRegistry ?? "",
+        agentId: (identity?.agentId ?? 0n).toString(),
+        requester: verified.requester,
+        payment,
+        paid: verified.paid.toString(),
+        requestHash,
+        resultHash,
+        issuedAt,
+        termId,
+        expiresAt: issuedAt + limits.receiptTtlSeconds
+      };
+      try {
+        ledger.commit(payment, {
+          requester: verified.requester,
+          requestHash,
+          at: new Date(now()).toISOString()
+        });
+      } catch (error) {
+        ledger.release(payment);
+        return json({ error: `could not record the payment: ${String(error).slice(0, 300)}` }, 500);
+      }
+      const signed = await signHireReceipt(receipt, { chainId, verifyingContract: verifier }, {
+        address: account.address,
+        signTypedData: (data) => account.signTypedData(data)
+      });
+      return json({ result, receipt: signed });
+    }
+  };
+}
+
+// ../node/src/tunnel.ts
+import { spawn as spawnChild } from "node:child_process";
+import { accessSync, constants, statSync } from "node:fs";
+import { delimiter, join } from "node:path";
+import { createInterface } from "node:readline";
+var DEFAULT_TUNNEL_TIMEOUT_MS = 30000;
+function isExecutable(path) {
+  try {
+    if (!statSync(path).isFile())
+      return false;
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function findOnPath(name, path, executable) {
+  for (const dir of (path ?? "").split(delimiter)) {
+    if (dir.length === 0)
+      continue;
+    const candidate = join(dir, name);
+    if (executable(candidate))
+      return candidate;
+  }
+  return null;
+}
+function chooseTunnel(env, executable = isExecutable) {
+  const mode = (env["ARP_NODE_TUNNEL"] ?? "auto").trim().toLowerCase();
+  const configured = () => {
+    const raw = env["ARP_NODE_PUBLIC_URL"];
+    if (raw === undefined || raw.trim() === "") {
+      return new Error("ARP_NODE_TUNNEL=configured needs ARP_NODE_PUBLIC_URL");
+    }
+    const publicUrl = normaliseEndpoint(raw);
+    if (publicUrl === null) {
+      return new Error(`ARP_NODE_PUBLIC_URL must be an https URL without credentials, got ${raw}`);
+    }
+    return { kind: "configured", publicUrl };
+  };
+  const binary = (kind) => {
+    const found = findOnPath(kind, env["PATH"], executable);
+    return found === null ? new Error(`${kind} is not on PATH`) : { kind, binary: found };
+  };
+  switch (mode) {
+    case "none":
+      return { kind: "none" };
+    case "configured":
+      return configured();
+    case "cloudflared":
+    case "ngrok":
+      return binary(mode);
+    case "auto": {
+      if (env["ARP_NODE_PUBLIC_URL"] !== undefined && env["ARP_NODE_PUBLIC_URL"].trim() !== "") {
+        return configured();
+      }
+      const cloudflared = binary("cloudflared");
+      if (!(cloudflared instanceof Error))
+        return cloudflared;
+      const ngrok = binary("ngrok");
+      if (!(ngrok instanceof Error))
+        return ngrok;
+      return new Error("no tunnel: install cloudflared or ngrok, or set ARP_NODE_PUBLIC_URL to a tunnel you run. " + "ARP_NODE_TUNNEL=none serves localhost only.");
+    }
+    default:
+      return new Error(`ARP_NODE_TUNNEL must be auto, cloudflared, ngrok, configured or none, got ${mode}`);
+  }
+}
+function tunnelArgs(kind, localUrl) {
+  return kind === "cloudflared" ? ["tunnel", "--no-autoupdate", "--url", localUrl] : ["http", localUrl, "--log", "stdout", "--log-format", "json"];
+}
+var QUICK_TUNNEL = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+function publicUrlFrom(kind, line) {
+  if (kind === "cloudflared")
+    return QUICK_TUNNEL.exec(line)?.[0] ?? null;
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return null;
+  const url = parsed["url"];
+  return typeof url === "string" ? normaliseEndpoint(url) : null;
+}
+var LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+function clientAddress(request, socketIp, tunnel) {
+  if (!LOOPBACK.has(socketIp))
+    return socketIp;
+  if (tunnel === "cloudflared") {
+    const cloudflare = request.headers.get("cf-connecting-ip")?.trim();
+    if (cloudflare !== undefined && cloudflare !== "")
+      return cloudflare;
+  }
+  if (tunnel === "ngrok") {
+    const forwarded = request.headers.get("x-forwarded-for")?.split(",").at(-1)?.trim();
+    if (forwarded !== undefined && forwarded !== "")
+      return forwarded;
+  }
+  return socketIp;
+}
+var spawnProcess = (command, args) => {
+  const child = spawnChild(command, [...args], { stdio: ["ignore", "pipe", "pipe"] });
+  const lineListeners = [];
+  for (const stream of [child.stdout, child.stderr]) {
+    createInterface({ input: stream }).on("line", (line) => {
+      for (const listener of lineListeners)
+        listener(line);
+    });
+  }
+  return {
+    onLine: (listener) => lineListeners.push(listener),
+    onExit: (listener) => child.on("exit", (code) => listener(code)),
+    kill: () => child.kill("SIGTERM")
+  };
+};
+function startTunnel(spec, localUrl, options = {}) {
+  if (spec.kind === "none") {
+    return Promise.resolve({ spec, publicUrl: null, stable: false, stop: () => {} });
+  }
+  if (spec.kind === "configured") {
+    return Promise.resolve({ spec, publicUrl: spec.publicUrl, stable: true, stop: () => {} });
+  }
+  const { kind } = spec;
+  const child = (options.spawn ?? spawnProcess)(spec.binary, tunnelArgs(kind, localUrl));
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TUNNEL_TIMEOUT_MS;
+  return new Promise((resolve, reject) => {
+    let state = "pending";
+    const fail = (message) => {
+      if (state !== "pending")
+        return;
+      state = "failed";
+      clearTimeout(timer);
+      child.kill();
+      reject(new Error(message));
+    };
+    const timer = setTimeout(() => fail(`${kind} printed no public URL within ${timeoutMs} ms`), timeoutMs);
+    child.onLine((line) => {
+      if (state !== "pending")
+        return;
+      const publicUrl = publicUrlFrom(kind, line);
+      if (publicUrl === null)
+        return;
+      state = "up";
+      clearTimeout(timer);
+      const stop = () => {
+        state = "stopped";
+        child.kill();
+      };
+      resolve({ spec, publicUrl, stable: false, stop });
+    });
+    child.onExit((code) => {
+      if (state === "up")
+        options.onDown?.(code);
+      else
+        fail(`${kind} exited (${code ?? "signal"}) before printing a public URL`);
+    });
+  });
+}
+
+// ../node/src/node.ts
+var PORT;
+var MIN_BUDGET;
+try {
+  PORT = portFrom(process.env.AGENT_NODE_PORT, 3100);
+  MIN_BUDGET = minBudgetFrom(process.env.AGENT_NODE_MIN_BUDGET, "0.001");
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
+var LEDGER;
+try {
+  LEDGER = stateFile(process.env.AGENT_NODE_LEDGER, "node-payments.jsonl");
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
+function positive(name, fallback) {
+  const raw = process.env[name];
+  if (raw === undefined)
+    return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0) {
+    console.error(`${name} must be a positive integer, got ${raw}`);
+    process.exit(1);
+  }
+  return value;
+}
+var LIMITS = {
+  maxBodyBytes: positive("AGENT_NODE_MAX_BODY_BYTES", DEFAULT_LIMITS.maxBodyBytes),
+  handlerTimeoutMs: positive("AGENT_NODE_HANDLER_TIMEOUT_MS", DEFAULT_LIMITS.handlerTimeoutMs),
+  requestsPerMinute: positive("AGENT_NODE_RATE_LIMIT", DEFAULT_LIMITS.requestsPerMinute),
+  receiptTtlSeconds: positive("AGENT_NODE_RECEIPT_TTL", DEFAULT_LIMITS.receiptTtlSeconds)
+};
+var rpcUrl = process.env.INTUITION_RPC_URL ?? process.env.INTUITION_TESTNET_RPC_URL;
+if (!rpcUrl) {
+  console.error("no RPC: set INTUITION_RPC_URL or INTUITION_TESTNET_RPC_URL");
+  process.exit(1);
+}
+var nodeKey;
+try {
+  nodeKey = resolveNodeKey(process.env);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
+var account = nodeKey.account;
+function identityFromEnv() {
+  const registry = process.env.AGENT_REGISTRY;
+  const id = process.env.AGENT_ID;
+  if (registry === undefined && id === undefined)
+    return null;
+  if (registry === undefined || id === undefined) {
+    console.error("set AGENT_REGISTRY and AGENT_ID together, or neither");
+    process.exit(1);
+  }
+  if (!ERC8004_REGISTRY.test(registry) || !/^(0|[1-9][0-9]*)$/.test(id)) {
+    console.error("AGENT_REGISTRY must be eip155:<chainId>:<address> and AGENT_ID a decimal token id");
+    process.exit(1);
+  }
+  return { agentRegistry: registry, agentId: BigInt(id) };
+}
+var identity = identityFromEnv();
+var handlerPath = process.env.ARP_NODE_HANDLER;
+var handle = echo;
+var offer = null;
+if (handlerPath !== undefined) {
+  const module = await import(handlerPath);
+  if (typeof module.handle !== "function") {
+    console.error(`${handlerPath} does not export a \`handle\` function`);
+    process.exit(1);
+  }
+  handle = module.handle;
+  offer = readOffer(module.offer);
+  if (module.offer !== undefined && offer === null) {
+    console.error(`${handlerPath} exports an \`offer\` that is not three short strings, so none is served`);
+  }
+}
+var publicClient = createPublicClient({ transport: http(rpcUrl) });
+var chainId = await publicClient.getChainId();
+var node = createNode({
+  account,
+  publicClient,
+  chainId,
+  identity,
+  minBudget: MIN_BUDGET,
+  handle,
+  offer,
+  ledger: new PaymentLedger(LEDGER),
+  limits: LIMITS
+});
+async function main() {
+  const tunnel = chooseTunnel(process.env);
+  if (tunnel instanceof Error) {
+    process.stderr.write(`${tunnel.message}
+`);
+    process.exit(1);
+  }
+  await serveFetch({ port: PORT, hostname: "127.0.0.1", maxBodyBytes: LIMITS.maxBodyBytes }, (request, ip) => node.fetch(request, clientAddress(request, ip, tunnel.kind)));
+  const local = `http://127.0.0.1:${PORT}`;
+  let running;
+  try {
+    running = await startTunnel(tunnel, local, {
+      onDown: (code) => process.stderr.write(`tunnel exited (${code ?? "signal"}); the node is unreachable
+`)
+    });
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+    process.exit(1);
+  }
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+      running.stop();
+      process.exit(0);
+    });
+  }
+  process.on("exit", () => running.stop());
+  process.stderr.write(`agent node on ${local}
+`);
+  process.stderr.write(`  public     ${running.publicUrl ?? "none (ARP_NODE_TUNNEL=none): localhost only"}${running.publicUrl !== null && !running.stable ? " — a new address on every start: run arp init --node again after a restart" : ""}
+`);
+  process.stderr.write(`  tunnel     ${tunnel.kind}
+`);
+  process.stderr.write(`  agent      ${account.address}
+`);
+  process.stderr.write(`  key        ${nodeKey.source === "env" ? "AGENT_PRIVATE_KEY" : `${nodeKey.path}${nodeKey.created ? " (created)" : ""}`}
+`);
+  process.stderr.write(`  min budget ${formatEther(MIN_BUDGET)}
+`);
+  process.stderr.write(`  handler    ${handlerPath ?? "echo (no handler configured)"}
+`);
+  process.stderr.write(`  chain      ${chainId}
+`);
+  process.stderr.write(`  identity   ${identity === null ? "none (AGENT_REGISTRY / AGENT_ID unset)" : `${identity.agentRegistry} #${identity.agentId}`}
+`);
+  process.stderr.write(`  ledger     ${LEDGER}
+`);
+  process.stderr.write(`  limits     ${LIMITS.maxBodyBytes} B body, ${LIMITS.handlerTimeoutMs} ms handler, ${LIMITS.requestsPerMinute}/min per client
+`);
+  process.stderr.write(`
+It signs receipts and never transactions.
+`);
+}
+if (false)
+  ;
+export {
+  main
+};