@artos-commerce/ucp-client 0.2.0 → 0.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/account/handlers.js +1 -1
  2. package/dist/account/handlers.js.map +1 -1
  3. package/package.json +5 -4
  4. package/test/test-vectors/ap2-verify.json +205 -0
  5. package/test/test-vectors/canonical-json.json +36 -0
package/dist/account/handlers.js CHANGED
@@ -31,7 +31,7 @@ export function createAccountHandlers(deps) {
31
31
  },
32
32
  /** A single order by id. */
33
33
  getOrder(id) {
34
- return client.callAccountTool('get_my_order', { id });
34
+ return client.callAccountTool('get_my_order', { order_id: id });
35
35
  },
36
36
  /** The buyer's returns. */
37
37
  listReturns() {
package/dist/account/handlers.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/account/handlers.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,OAAO;QACL,uEAAuE;QACvE,SAAS;YACP,OAAO,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnC,CAAC;QAED,6CAA6C;QAC7C,eAAe;YACb,OAAO,MAAM,CAAC,eAAe,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,oDAAoD;QACpD,aAAa;YACX,OAAO,MAAM,CAAC,eAAe,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,4CAA4C;QAC5C,UAAU,CACR,OAAgC,EAAE;YAElC,OAAO,MAAM,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAED,4BAA4B;QAC5B,QAAQ,CAAC,EAAU;YACjB,OAAO,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,2BAA2B;QAC3B,WAAW;YACT,OAAO,MAAM,CAAC,eAAe,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,4CAA4C;QAC5C,iBAAiB;YACf,OAAO,MAAM,CAAC,eAAe,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,qCAAqC;QACrC,WAAW;YACT,OAAO,MAAM,CAAC,eAAe,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,8BAA8B;QAC9B,SAAS;YACP,OAAO,MAAM,CAAC,eAAe,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,6BAA6B;QAC7B,SAAS,CAAC,IAA6B;YACrC,OAAO,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,kEAAkE;QAClE,IAAI,CACF,IAAY,EACZ,OAAgC,EAAE;YAElC,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/account/handlers.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,OAAO;QACL,uEAAuE;QACvE,SAAS;YACP,OAAO,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnC,CAAC;QAED,6CAA6C;QAC7C,eAAe;YACb,OAAO,MAAM,CAAC,eAAe,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,oDAAoD;QACpD,aAAa;YACX,OAAO,MAAM,CAAC,eAAe,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,4CAA4C;QAC5C,UAAU,CACR,OAAgC,EAAE;YAElC,OAAO,MAAM,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAED,4BAA4B;QAC5B,QAAQ,CAAC,EAAU;YACjB,OAAO,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,2BAA2B;QAC3B,WAAW;YACT,OAAO,MAAM,CAAC,eAAe,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,4CAA4C;QAC5C,iBAAiB;YACf,OAAO,MAAM,CAAC,eAAe,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,qCAAqC;QACrC,WAAW;YACT,OAAO,MAAM,CAAC,eAAe,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,8BAA8B;QAC9B,SAAS;YACP,OAAO,MAAM,CAAC,eAAe,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,6BAA6B;QAC7B,SAAS,CAAC,IAA6B;YACrC,OAAO,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,kEAAkE;QAClE,IAAI,CACF,IAAY,EACZ,OAAgC,EAAE;YAElC,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@artos-commerce/ucp-client",
3
- "version": "0.2.0",
3
+ "version": "0.2.2",
4
4
  "description": "Build-track Direct UCP client for Artos: typed UCP transport, AP2 mandate signing, checkout orchestration, buyer-account tools, and buyer OAuth so you can build your own commerce-grade UCP client without hand-rolling the envelope, signing, and credential rules.",
5
5
  "type": "module",
6
6
  "license": "MIT",
@@ -9,7 +9,8 @@
9
9
  },
10
10
  "files": [
11
11
  "dist",
12
- "README.md"
12
+ "README.md",
13
+ "test/test-vectors"
13
14
  ],
14
15
  "types": "./dist/index.d.ts",
15
16
  "exports": {
@@ -44,7 +45,7 @@
44
45
  "@eslint/js": "^9.39.4",
45
46
  "@mysten/sui": "^2.17.0",
46
47
  "@types/node": "^20.19.42",
47
- "@vitest/coverage-v8": "^2.1.9",
48
+ "@vitest/coverage-v8": "^4.1.9",
48
49
  "eslint": "^9.39.4",
49
50
  "eslint-config-prettier": "^10.1.8",
50
51
  "eslint-plugin-prettier": "^5.5.6",
@@ -52,7 +53,7 @@
52
53
  "prettier": "^3.8.3",
53
54
  "typescript": "^5.6.0",
54
55
  "typescript-eslint": "^8.62.0",
55
- "vitest": "^2.1.0"
56
+ "vitest": "^4.1.9"
56
57
  },
57
58
  "publishConfig": {
58
59
  "access": "public"
package/test/test-vectors/ap2-verify.json ADDED
@@ -0,0 +1,205 @@
1
+ {
2
+ "description": "Frozen AP2 verification vectors. The signatures are fixed; ECDSA P-256 verification is deterministic, so these verify identically across artos-api / artos-agent / artos-my / artos-storefront. Regenerate with test/test-vectors/gen note in ap2-verify-vectors.spec.ts.",
3
+ "publicJwk": {
4
+ "kty": "EC",
5
+ "x": "kbIpg9VfqAxcOKM3sLbF6PXPqj0Xtp1RVjbhYIr2ap8",
6
+ "y": "vJycZdQAYYQdLcJ8fAbDrquzsxCu423H1qP0PHvWY6M",
7
+ "crv": "P-256",
8
+ "kid": "store_key_2026"
9
+ },
10
+ "merchantAuthorization": [
11
+ {
12
+ "name": "valid merchant_authorization",
13
+ "body": {
14
+ "id": "checkout_01HVZEXAMPLE",
15
+ "currency": "USD",
16
+ "line_items": [
17
+ {
18
+ "item": {
19
+ "id": "variant_abc"
20
+ },
21
+ "quantity": 2
22
+ }
23
+ ],
24
+ "totals": [
25
+ {
26
+ "type": "subtotal",
27
+ "amount": 3000,
28
+ "currency": "USD"
29
+ },
30
+ {
31
+ "type": "total",
32
+ "amount": 3300,
33
+ "currency": "USD"
34
+ }
35
+ ],
36
+ "ucp": {
37
+ "status": "success"
38
+ },
39
+ "ap2": {
40
+ "merchant_authorization": "eyJhbGciOiJFUzI1NiIsImtpZCI6InN0b3JlX2tleV8yMDI2In0..aNaWi8Hgx5gRFp3I0btbpHZ04xfCuPAA8eg6QcHnEXJO_Nsru9OUvv31VazjgVBdLQVXEfjYWPext6-pTOJ0Mg"
41
+ }
42
+ },
43
+ "expect": true
44
+ },
45
+ {
46
+ "name": "tampered total after signing",
47
+ "body": {
48
+ "id": "checkout_01HVZEXAMPLE",
49
+ "currency": "USD",
50
+ "line_items": [
51
+ {
52
+ "item": {
53
+ "id": "variant_abc"
54
+ },
55
+ "quantity": 2
56
+ }
57
+ ],
58
+ "totals": [
59
+ {
60
+ "type": "subtotal",
61
+ "amount": 3000,
62
+ "currency": "USD"
63
+ },
64
+ {
65
+ "type": "total",
66
+ "amount": 1,
67
+ "currency": "USD"
68
+ }
69
+ ],
70
+ "ucp": {
71
+ "status": "success"
72
+ },
73
+ "ap2": {
74
+ "merchant_authorization": "eyJhbGciOiJFUzI1NiIsImtpZCI6InN0b3JlX2tleV8yMDI2In0..aNaWi8Hgx5gRFp3I0btbpHZ04xfCuPAA8eg6QcHnEXJO_Nsru9OUvv31VazjgVBdLQVXEfjYWPext6-pTOJ0Mg"
75
+ }
76
+ },
77
+ "expect": false
78
+ },
79
+ {
80
+ "name": "signed by an untrusted key (kid spoofed)",
81
+ "body": {
82
+ "id": "checkout_01HVZEXAMPLE",
83
+ "currency": "USD",
84
+ "line_items": [
85
+ {
86
+ "item": {
87
+ "id": "variant_abc"
88
+ },
89
+ "quantity": 2
90
+ }
91
+ ],
92
+ "totals": [
93
+ {
94
+ "type": "subtotal",
95
+ "amount": 3000,
96
+ "currency": "USD"
97
+ },
98
+ {
99
+ "type": "total",
100
+ "amount": 3300,
101
+ "currency": "USD"
102
+ }
103
+ ],
104
+ "ucp": {
105
+ "status": "success"
106
+ },
107
+ "ap2": {
108
+ "merchant_authorization": "eyJhbGciOiJFUzI1NiIsImtpZCI6InN0b3JlX2tleV8yMDI2In0..h_HDbhCOgzFWSlI0by8nJf1Z1Rj0i2Y3v80U2HC3Drv1kkTUNb0zYQs5S60PBAO3zhPmTnY6MkRdKBwMbW9lEg"
109
+ }
110
+ },
111
+ "expect": false
112
+ },
113
+ {
114
+ "name": "missing merchant_authorization",
115
+ "body": {
116
+ "id": "checkout_01HVZEXAMPLE",
117
+ "currency": "USD",
118
+ "line_items": [
119
+ {
120
+ "item": {
121
+ "id": "variant_abc"
122
+ },
123
+ "quantity": 2
124
+ }
125
+ ],
126
+ "totals": [
127
+ {
128
+ "type": "subtotal",
129
+ "amount": 3000,
130
+ "currency": "USD"
131
+ },
132
+ {
133
+ "type": "total",
134
+ "amount": 3300,
135
+ "currency": "USD"
136
+ }
137
+ ],
138
+ "ucp": {
139
+ "status": "success"
140
+ }
141
+ },
142
+ "expect": false
143
+ },
144
+ {
145
+ "name": "wrong alg header (RS256)",
146
+ "body": {
147
+ "id": "checkout_01HVZEXAMPLE",
148
+ "currency": "USD",
149
+ "line_items": [
150
+ {
151
+ "item": {
152
+ "id": "variant_abc"
153
+ },
154
+ "quantity": 2
155
+ }
156
+ ],
157
+ "totals": [
158
+ {
159
+ "type": "subtotal",
160
+ "amount": 3000,
161
+ "currency": "USD"
162
+ },
163
+ {
164
+ "type": "total",
165
+ "amount": 3300,
166
+ "currency": "USD"
167
+ }
168
+ ],
169
+ "ucp": {
170
+ "status": "success"
171
+ },
172
+ "ap2": {
173
+ "merchant_authorization": "eyJhbGciOiJSUzI1NiIsImtpZCI6InN0b3JlX2tleV8yMDI2In0..ON-HK5G5W06RQWUsETeW0MIoUg-ZfYO4WbHNKkrAgLZ3sUQKDK_MJcawOZ1qJYGS82eBr2-MqJwEfbHMvHS3cw"
174
+ }
175
+ },
176
+ "expect": false
177
+ }
178
+ ],
179
+ "detached": [
180
+ {
181
+ "name": "valid detached jws",
182
+ "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6InN0b3JlX2tleV8yMDI2In0..F0kfKED1LAVYnAbnLh-9JxPv2CflKSk2HSQgGEhbU0ST-8YTPcri5YevdfUCYMazsYMRWZYpW6V6l10a3tlX7A",
183
+ "payload": "{\"amount\":3300,\"currency\":\"USD\",\"mandate\":\"payment_mandate\"}",
184
+ "expect": true
185
+ },
186
+ {
187
+ "name": "non-detached (payload segment present)",
188
+ "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6InN0b3JlX2tleV8yMDI2In0.eyJhbW91bnQiOjMzMDAsImN1cnJlbmN5IjoiVVNEIiwibWFuZGF0ZSI6InBheW1lbnRfbWFuZGF0ZSJ9._2uKCLlWkmpNwKmJWz1kN0VvAdwXuzCMrcofiKCAHyUrBST6zXHRXnqrozRnP9NHkYhOMlQpwePFI-a-HRyMvw",
189
+ "payload": "{\"amount\":3300,\"currency\":\"USD\",\"mandate\":\"payment_mandate\"}",
190
+ "expect": false
191
+ },
192
+ {
193
+ "name": "signature over a different payload",
194
+ "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6InN0b3JlX2tleV8yMDI2In0..UCB5SnO2Sd6fJHRtcHBZfEL7V5Y0Xv7Y3auZJp0kbJyDptWcJxKW9v4bCeRmHR799IS1CqwWKrNXe-Slvh7Fhw",
195
+ "payload": "{\"amount\":3300,\"currency\":\"USD\",\"mandate\":\"payment_mandate\"}",
196
+ "expect": false
197
+ },
198
+ {
199
+ "name": "unknown kid (not in published keys)",
200
+ "token": "eyJhbGciOiJFUzI1NiIsImtpZCI6Im5vdC1wdWJsaXNoZWQifQ..Bbi158cOML4EoN9L6y0qCtLnugQDyEvyH00FDgHs4lHWDHZfVcoQrKUFr-xHTDEOKBX0Kl0xSdoitWUMBvyYPQ",
201
+ "payload": "{\"amount\":3300,\"currency\":\"USD\",\"mandate\":\"payment_mandate\"}",
202
+ "expect": false
203
+ }
204
+ ]
205
+ }
package/test/test-vectors/canonical-json.json ADDED
@@ -0,0 +1,36 @@
1
+ {
2
+ "description": "Frozen canonical-JSON parity vectors. Each `input` must serialize to the exact `output` bytes. Drift here silently breaks signature verification across artos-api, artos-agent, artos-my, and artos-storefront. If the API's canonical form changes, every copy + this file change in lockstep.",
3
+ "vectors": [
4
+ {
5
+ "name": "bridge checkout body (merchant_authorization parity)",
6
+ "source": "artos-agent/test/canonical-json.spec.ts",
7
+ "input": {
8
+ "ucp": { "status": "success" },
9
+ "id": "chk_1",
10
+ "currency": "USD",
11
+ "totals": [{ "type": "total", "amount": 1500, "currency": "USD" }]
12
+ },
13
+ "output": "{\"currency\":\"USD\",\"id\":\"chk_1\",\"totals\":[{\"amount\":1500,\"currency\":\"USD\",\"type\":\"total\"}],\"ucp\":{\"status\":\"success\"}}"
14
+ },
15
+ {
16
+ "name": "artos-my intent-mandate claims (buyer signing parity)",
17
+ "source": "artos-my/src/lib/sui/canonical-json.test.ts",
18
+ "input": {
19
+ "scope": "agent_spend",
20
+ "agent": "client_abc",
21
+ "currency": "USD",
22
+ "amount": 4200,
23
+ "merchant": "energy-sport",
24
+ "nonce": "n_1",
25
+ "expiry": 1893456000
26
+ },
27
+ "output": "{\"agent\":\"client_abc\",\"amount\":4200,\"currency\":\"USD\",\"expiry\":1893456000,\"merchant\":\"energy-sport\",\"nonce\":\"n_1\",\"scope\":\"agent_spend\"}"
28
+ },
29
+ {
30
+ "name": "primitives and null/undefined edges",
31
+ "source": "synthetic",
32
+ "input": { "a": null, "b": [null, 1], "c": "x", "d": true },
33
+ "output": "{\"a\":null,\"b\":[null,1],\"c\":\"x\",\"d\":true}"
34
+ }
35
+ ]
36
+ }