@commercelayer/agent-cli 0.0.0-stage → 0.1.1

package/dist/ucp/platform.js

@@ -0,0 +1,90 @@
+// What this CLI is on the UCP side: a platform (a buyer's agent). Its profile is
+// served from commercelayer.ai so stores can fetch it; the stub knows it inline.
+// Shared constants of the store side live here too, so the client, the stub and
+// the conformance check agree on them.
+export const UCP_VERSION = '2026-08-25';
+export const UCP = `https://ucp.dev/${UCP_VERSION}`;
+export const AGENT_PROFILE_URL = process.env.C11R_AGENT_PROFILE_URL ?? 'https://commercelayer.ai/ucp/agent-cli/profile.json';
+export const AGENT_WEBHOOK_URL = 'https://commercelayer.ai/ucp/agent-cli/webhook';
+/** The sandbox payment handler every sandbox store accepts. No money moves. */
+export const SANDBOX_HANDLER = 'ai.commercelayer.sandbox';
+export const SANDBOX_HANDLER_ID = 'cl_sandbox';
+export const SANDBOX_HANDLER_SPEC = 'https://commercelayer.ai/ucp/handlers/sandbox';
+export const SANDBOX_HANDLER_SCHEMA = 'https://commercelayer.ai/ucp/handlers/sandbox.json';
+export const SANDBOX_CREDENTIAL_TYPE = 'sandbox_token';
+/** Tokens the handler spec publishes: the first approves, the second declines. */
+export const SANDBOX_TOKEN_SUCCESS = 'sbx_tok_success';
+export const SANDBOX_TOKEN_DECLINED = 'sbx_tok_declined';
+export const SHOPPING_CAPABILITIES = ['dev.ucp.shopping.catalog.search', 'dev.ucp.shopping.catalog.lookup', 'dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout', 'dev.ucp.shopping.order'];
+export const EXTENSIONS = {
+    'dev.ucp.shopping.fulfillment': ['dev.ucp.shopping.checkout', 'dev.ucp.shopping.catalog.search', 'dev.ucp.shopping.catalog.lookup'],
+    'dev.ucp.shopping.discount': ['dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout'],
+    'dev.ucp.shopping.buyer_consent': ['dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout'],
+    'dev.ucp.shopping.policy.return': ['dev.ucp.shopping.catalog.search', 'dev.ucp.shopping.catalog.lookup', 'dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout', 'dev.ucp.shopping.order'],
+};
+const specOf = {
+    'dev.ucp.shopping.catalog.search': 'specification/shopping/catalog/search',
+    'dev.ucp.shopping.catalog.lookup': 'specification/shopping/catalog/lookup',
+    'dev.ucp.shopping.cart': 'specification/shopping/cart',
+    'dev.ucp.shopping.checkout': 'specification/shopping/checkout',
+    'dev.ucp.shopping.order': 'specification/shopping/order',
+    'dev.ucp.common.ask': 'specification/common/ask',
+    'dev.ucp.shopping.fulfillment': 'specification/shopping/extensions/fulfillment',
+    'dev.ucp.shopping.discount': 'specification/shopping/extensions/discount',
+    'dev.ucp.shopping.buyer_consent': 'specification/shopping/extensions/buyer-consent',
+    'dev.ucp.shopping.policy.return': 'specification/shopping/extensions/return-policy',
+    'dev.ucp.common.identity_linking': 'specification/common/identity-linking/',
+    'dev.ucp.shopping.permalink': 'specification/permalink',
+};
+const schemaOf = {
+    'dev.ucp.shopping.catalog.search': 'schemas/shopping/catalog_search.json',
+    'dev.ucp.shopping.catalog.lookup': 'schemas/shopping/catalog_lookup.json',
+    'dev.ucp.shopping.cart': 'schemas/shopping/cart.json',
+    'dev.ucp.shopping.checkout': 'schemas/shopping/checkout.json',
+    'dev.ucp.shopping.order': 'schemas/shopping/order.json',
+    'dev.ucp.common.ask': 'schemas/common/ask.json',
+    'dev.ucp.shopping.fulfillment': 'schemas/shopping/fulfillment.json',
+    'dev.ucp.shopping.discount': 'schemas/shopping/discount.json',
+    'dev.ucp.shopping.buyer_consent': 'schemas/shopping/buyer_consent.json',
+    'dev.ucp.shopping.policy.return': 'schemas/shopping/policy_return.json',
+    'dev.ucp.common.identity_linking': 'schemas/common/identity_linking.json',
+    'dev.ucp.shopping.permalink': 'schemas/shopping/permalink.json',
+};
+export function capabilityEntry(name, extra = {}) {
+    const entry = { version: UCP_VERSION, spec: `${UCP}/${specOf[name]}`, schema: `${UCP}/${schemaOf[name]}` };
+    if (EXTENSIONS[name])
+        entry.extends = EXTENSIONS[name];
+    return { ...entry, ...extra };
+}
+/** The platform profile this CLI presents in UCP-Agent. Published by the site. */
+export function agentProfile() {
+    const capabilities = {};
+    for (const name of [...SHOPPING_CAPABILITIES, 'dev.ucp.common.ask', ...Object.keys(EXTENSIONS), 'dev.ucp.common.identity_linking']) {
+        capabilities[name] = [capabilityEntry(name, name === 'dev.ucp.shopping.order' ? { config: { webhook_url: AGENT_WEBHOOK_URL } } : {})];
+    }
+    // The fulfillment extension on the platform side: one group per method is enough.
+    capabilities['dev.ucp.shopping.fulfillment'] = [capabilityEntry('dev.ucp.shopping.fulfillment', { config: { supports_multi_group: false } })];
+    return {
+        ucp: {
+            version: UCP_VERSION,
+            services: {},
+            capabilities,
+            payment_handlers: {
+                [SANDBOX_HANDLER]: [{ id: SANDBOX_HANDLER_ID, version: UCP_VERSION, spec: SANDBOX_HANDLER_SPEC, schema: SANDBOX_HANDLER_SCHEMA, available_instruments: [{ type: 'card' }] }],
+            },
+        },
+        name: 'Commerce Layer agent CLI',
+        description: 'c11r, the Commerce Layer CLI for coding agents, acting as a shopping platform: it places test orders and checks a store speaks UCP.',
+    };
+}
+/** Minor units per currency unit (ISO 4217 exponent). */
+export function minorUnits(currency) {
+    if (['JPY', 'KRW', 'VND', 'CLP', 'ISK', 'HUF', 'TWD', 'UGX', 'PYG', 'RWF', 'XAF', 'XOF'].includes(currency))
+        return 1;
+    if (['BHD', 'KWD', 'JOD', 'OMR', 'TND', 'IQD', 'LYD'].includes(currency))
+        return 1000;
+    return 100;
+}
+export function toMinor(amount, currency) {
+    return Math.round(amount * minorUnits(currency));
+}

package/dist/ucp/signing.js

@@ -0,0 +1,67 @@
+// HTTP message signatures (RFC 9421) and content digests (RFC 9530) as UCP uses
+// them: ES256 over a signature base, raw r||s encoding, keys published as JWKs.
+import crypto from 'node:crypto';
+export function contentDigest(body) {
+    return `sha-256=:${crypto.createHash('sha256').update(body).digest('base64')}:`;
+}
+/** The inner-list serialization that goes in Signature-Input and in the base. */
+export function serializeParams(p) {
+    let s = `(${p.components.map((c) => `"${c}"`).join(' ')})`;
+    if (p.created !== undefined)
+        s += `;created=${p.created}`;
+    s += `;keyid="${p.keyid}"`;
+    return s;
+}
+/** The signature base: one line per covered component, then @signature-params. */
+export function signatureBase(values, p) {
+    const lines = p.components.map((c) => `"${c}": ${values[c] ?? ''}`);
+    lines.push(`"@signature-params": ${serializeParams(p)}`);
+    return lines.join('\n');
+}
+export function generateKey(kid) {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+    const privateJwk = privateKey.export({ format: 'jwk' });
+    const publicJwk = { ...publicKey.export({ format: 'jwk' }), kid, use: 'sig', alg: 'ES256' };
+    return { privateJwk, publicJwk };
+}
+export function sign(base, privateJwk) {
+    const key = crypto.createPrivateKey({ key: privateJwk, format: 'jwk' });
+    return crypto.sign('sha256', Buffer.from(base), { key, dsaEncoding: 'ieee-p1363' }).toString('base64');
+}
+export function verify(base, signatureBase64, publicJwk) {
+    try {
+        const key = crypto.createPublicKey({ key: publicJwk, format: 'jwk' });
+        return crypto.verify('sha256', Buffer.from(base), { key, dsaEncoding: 'ieee-p1363' }, Buffer.from(signatureBase64, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Build Signature-Input and Signature headers for a message. */
+export function signHeaders(label, values, p, privateJwk) {
+    return {
+        'signature-input': `${label}=${serializeParams(p)}`,
+        signature: `${label}=:${sign(signatureBase(values, p), privateJwk)}:`,
+    };
+}
+/** Parse one signature out of Signature-Input / Signature headers (the first label). */
+export function parseSignature(signatureInput, signature) {
+    if (!signatureInput || !signature)
+        return null;
+    const input = signatureInput.match(/^\s*([a-z0-9_-]+)=\(([^)]*)\)((?:;[a-z]+=[^;]*)*)\s*$/i);
+    if (!input)
+        return null;
+    const [, label, list, paramStr] = input;
+    const components = [...list.matchAll(/"([^"]+)"/g)].map((m) => m[1]);
+    const params = { components, keyid: '' };
+    for (const [, k, v] of paramStr.matchAll(/;([a-z]+)=("[^"]*"|[^;]*)/g)) {
+        if (k === 'keyid')
+            params.keyid = v.replace(/^"|"$/g, '');
+        if (k === 'created')
+            params.created = Number(v);
+    }
+    const sig = signature.match(new RegExp(`${label}=:([A-Za-z0-9+/=]+):`));
+    if (!sig)
+        return null;
+    return { label, params, signature: sig[1] };
+}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@commercelayer/agent-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "c11r: the Commerce Layer CLI for coding agents. Builds a sandbox store that people and shopping agents can buy from.",
+  "homepage": "https://commercelayer.ai",
+  "keywords": [
+    "commercelayer",
+    "commerce",
+    "cli",
+    "agent",
+    "ucp",
+    "sandbox"
+  ],
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "c11r": "dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && chmod +x dist/bin.js dist/api/server.js",
+    "dev": "tsx src/bin.ts",
+    "stub-api": "tsx src/api/server.ts",
+    "test": "npm run build && vitest run",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "yaml": "^2.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "vitest": "^3.0.0"
+  },
+  "allowScripts": {
+    "esbuild@0.28.2": true
+  }
+}