@commercelayer/agent-cli 0.8.1 → 1.0.0-dev.1

package/dist/ucp/platform.js

@@ -1,90 +0,0 @@
-// What this CLI is on the UCP side: a platform (a buyer's agent). Its profile is
-// served from commercelayer.ai so stores can fetch it; the stub knows it inline.
-// Shared constants of the store side live here too, so the client, the stub and
-// the conformance check agree on them.
-export const UCP_VERSION = '2026-08-25';
-export const UCP = `https://ucp.dev/${UCP_VERSION}`;
-export const AGENT_PROFILE_URL = process.env.C11R_AGENT_PROFILE_URL ?? 'https://commercelayer.ai/ucp/agent-cli/profile.json';
-export const AGENT_WEBHOOK_URL = 'https://commercelayer.ai/ucp/agent-cli/webhook';
-/** The sandbox payment handler every sandbox store accepts. No money moves. */
-export const SANDBOX_HANDLER = 'ai.commercelayer.sandbox';
-export const SANDBOX_HANDLER_ID = 'cl_sandbox';
-export const SANDBOX_HANDLER_SPEC = 'https://commercelayer.ai/ucp/handlers/sandbox';
-export const SANDBOX_HANDLER_SCHEMA = 'https://commercelayer.ai/ucp/handlers/sandbox.json';
-export const SANDBOX_CREDENTIAL_TYPE = 'sandbox_token';
-/** Tokens the handler spec publishes: the first approves, the second declines. */
-export const SANDBOX_TOKEN_SUCCESS = 'sbx_tok_success';
-export const SANDBOX_TOKEN_DECLINED = 'sbx_tok_declined';
-export const SHOPPING_CAPABILITIES = ['dev.ucp.shopping.catalog.search', 'dev.ucp.shopping.catalog.lookup', 'dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout', 'dev.ucp.shopping.order'];
-export const EXTENSIONS = {
-    'dev.ucp.shopping.fulfillment': ['dev.ucp.shopping.checkout', 'dev.ucp.shopping.catalog.search', 'dev.ucp.shopping.catalog.lookup'],
-    'dev.ucp.shopping.discount': ['dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout'],
-    'dev.ucp.shopping.buyer_consent': ['dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout'],
-    'dev.ucp.shopping.policy.return': ['dev.ucp.shopping.catalog.search', 'dev.ucp.shopping.catalog.lookup', 'dev.ucp.shopping.cart', 'dev.ucp.shopping.checkout', 'dev.ucp.shopping.order'],
-};
-const specOf = {
-    'dev.ucp.shopping.catalog.search': 'specification/shopping/catalog/search',
-    'dev.ucp.shopping.catalog.lookup': 'specification/shopping/catalog/lookup',
-    'dev.ucp.shopping.cart': 'specification/shopping/cart',
-    'dev.ucp.shopping.checkout': 'specification/shopping/checkout',
-    'dev.ucp.shopping.order': 'specification/shopping/order',
-    'dev.ucp.common.ask': 'specification/common/ask',
-    'dev.ucp.shopping.fulfillment': 'specification/shopping/extensions/fulfillment',
-    'dev.ucp.shopping.discount': 'specification/shopping/extensions/discount',
-    'dev.ucp.shopping.buyer_consent': 'specification/shopping/extensions/buyer-consent',
-    'dev.ucp.shopping.policy.return': 'specification/shopping/extensions/return-policy',
-    'dev.ucp.common.identity_linking': 'specification/common/identity-linking/',
-    'dev.ucp.shopping.permalink': 'specification/permalink',
-};
-const schemaOf = {
-    'dev.ucp.shopping.catalog.search': 'schemas/shopping/catalog_search.json',
-    'dev.ucp.shopping.catalog.lookup': 'schemas/shopping/catalog_lookup.json',
-    'dev.ucp.shopping.cart': 'schemas/shopping/cart.json',
-    'dev.ucp.shopping.checkout': 'schemas/shopping/checkout.json',
-    'dev.ucp.shopping.order': 'schemas/shopping/order.json',
-    'dev.ucp.common.ask': 'schemas/common/ask.json',
-    'dev.ucp.shopping.fulfillment': 'schemas/shopping/fulfillment.json',
-    'dev.ucp.shopping.discount': 'schemas/shopping/discount.json',
-    'dev.ucp.shopping.buyer_consent': 'schemas/shopping/buyer_consent.json',
-    'dev.ucp.shopping.policy.return': 'schemas/shopping/policy_return.json',
-    'dev.ucp.common.identity_linking': 'schemas/common/identity_linking.json',
-    'dev.ucp.shopping.permalink': 'schemas/shopping/permalink.json',
-};
-export function capabilityEntry(name, extra = {}) {
-    const entry = { version: UCP_VERSION, spec: `${UCP}/${specOf[name]}`, schema: `${UCP}/${schemaOf[name]}` };
-    if (EXTENSIONS[name])
-        entry.extends = EXTENSIONS[name];
-    return { ...entry, ...extra };
-}
-/** The platform profile this CLI presents in UCP-Agent. Published by the site. */
-export function agentProfile() {
-    const capabilities = {};
-    for (const name of [...SHOPPING_CAPABILITIES, 'dev.ucp.common.ask', ...Object.keys(EXTENSIONS), 'dev.ucp.common.identity_linking']) {
-        capabilities[name] = [capabilityEntry(name, name === 'dev.ucp.shopping.order' ? { config: { webhook_url: AGENT_WEBHOOK_URL } } : {})];
-    }
-    // The fulfillment extension on the platform side: one group per method is enough.
-    capabilities['dev.ucp.shopping.fulfillment'] = [capabilityEntry('dev.ucp.shopping.fulfillment', { config: { supports_multi_group: false } })];
-    return {
-        ucp: {
-            version: UCP_VERSION,
-            services: {},
-            capabilities,
-            payment_handlers: {
-                [SANDBOX_HANDLER]: [{ id: SANDBOX_HANDLER_ID, version: UCP_VERSION, spec: SANDBOX_HANDLER_SPEC, schema: SANDBOX_HANDLER_SCHEMA, available_instruments: [{ type: 'card' }] }],
-            },
-        },
-        name: 'Commerce Layer agent CLI',
-        description: 'The Commerce Layer agent CLI: a shopping agent that buys from UCP stores on behalf of a human, places test orders in its own store and checks that a store speaks UCP.',
-    };
-}
-/** Minor units per currency unit (ISO 4217 exponent). */
-export function minorUnits(currency) {
-    if (['JPY', 'KRW', 'VND', 'CLP', 'ISK', 'HUF', 'TWD', 'UGX', 'PYG', 'RWF', 'XAF', 'XOF'].includes(currency))
-        return 1;
-    if (['BHD', 'KWD', 'JOD', 'OMR', 'TND', 'IQD', 'LYD'].includes(currency))
-        return 1000;
-    return 100;
-}
-export function toMinor(amount, currency) {
-    return Math.round(amount * minorUnits(currency));
-}

package/dist/ucp/shop.js

@@ -1,357 +0,0 @@
-// Buying from a store step by step, for an agent shopping on behalf of its human: search,
-// look at a product, open a checkout, give the buyer's details, pay, read the order. Each
-// step is one command, so the agent talks to the human in between. The results are trimmed
-// for a conversation: prices in major units as well as minor, what is still missing.
-// buy.ts is the one-shot test buyer; this is the real one, with the human's details.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fail } from '../output.js';
-import { discover, replay, shopping, UcpError } from './client.js';
-import { sandboxInstrument } from './buy.js';
-import { minorUnits, SANDBOX_HANDLER } from './platform.js';
-// ---------- which store an id belongs to
-/** Checkout and order ids, by the store origin they were made at: later steps need no --store. */
-const stateFile = () => process.env.C11R_UCP_STATE ?? path.join(process.env.XDG_STATE_HOME ?? path.join(os.homedir(), '.local', 'state'), 'c11r', 'ucp.json');
-const MAX_REMEMBERED = 200;
-function readState() {
-    try {
-        return JSON.parse(fs.readFileSync(stateFile(), 'utf8'));
-    }
-    catch {
-        return {};
-    }
-}
-export function remember(id, origin) {
-    const s = readState();
-    delete s[id];
-    s[id] = origin;
-    const keys = Object.keys(s);
-    for (const k of keys.slice(0, Math.max(0, keys.length - MAX_REMEMBERED)))
-        delete s[k];
-    fs.mkdirSync(path.dirname(stateFile()), { recursive: true });
-    fs.writeFileSync(stateFile(), JSON.stringify(s, null, 2) + '\n', { mode: 0o600 });
-}
-export const remembered = (id) => readState()[id];
-/** A store origin from --store: an origin, a URL on the store, or a bare hostname. */
-export function originOf(given) {
-    let url;
-    try {
-        url = new URL(/^[a-z]+:\/\//i.test(given) ? given : `https://${given}`);
-    }
-    catch {
-        fail('invalid_argument', `--store ${given} is not a URL or hostname.`, 'Give the store as a hostname (shop.example.com) or an origin (https://shop.example.com).');
-    }
-    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1'].includes(url.hostname)))
-        fail('invalid_argument', `--store ${given} is not https.`, 'UCP stores are served over https: give https://<host>.');
-    return url.origin;
-}
-export function money(amount, currency) {
-    const minor = minorUnits(currency);
-    const decimals = Math.round(Math.log10(minor));
-    const major = amount / minor;
-    return { amount, currency, major, display: `${amount < 0 ? '-' : ''}${currency} ${Math.abs(major).toFixed(decimals)}` };
-}
-const plain = (d) => d?.plain ?? d?.markdown ?? d?.html;
-/** How a variant ships, from fulfillment.methods[0]: where to, the first option's price and arrival, and whether it ships to the country asked. */
-function shippingView(m, currency) {
-    if (!m)
-        return undefined;
-    const o = m.options?.[0];
-    const amount = o?.totals?.find((t) => t.type === 'fulfillment' || t.type === 'total')?.amount;
-    const view = {
-        to: m.ships_to,
-        option: o?.title,
-        price: amount !== undefined && currency ? money(amount, currency) : undefined,
-        earliest: o?.earliest_fulfillment_time,
-        latest: o?.latest_fulfillment_time,
-        // Only when a country was asked (--country): false when the store does not ship there.
-        ships_to_country: m.destination ? m.destination.ships !== false : undefined,
-    };
-    return Object.values(view).some((x) => x !== undefined) ? Object.fromEntries(Object.entries(view).filter(([, x]) => x !== undefined)) : undefined;
-}
-function variantView(v) {
-    const shipping = v.fulfillment?.methods?.map((m) => plain(m.description)).filter(Boolean).join('; ');
-    return {
-        id: v.id,
-        sku: v.sku,
-        title: v.title,
-        price: v.price ? money(v.price.amount, v.price.currency) : undefined,
-        // The price before a sale, when the store shows one.
-        list_price: v.list_price && v.list_price.amount !== v.price?.amount ? money(v.list_price.amount, v.list_price.currency) : undefined,
-        available: v.availability?.available ?? undefined,
-        availability: v.availability?.status ?? undefined,
-        image_url: v.media?.find((m) => m.type === 'image')?.url,
-        ships: shipping || undefined,
-        shipping: shippingView(v.fulfillment?.methods?.[0], v.price?.currency),
-    };
-}
-export function productView(p, full = false) {
-    const variants = (p.variants ?? []).map(variantView);
-    const description = plain(p.description);
-    const image = p.media?.find((m) => m.type === 'image')?.url ?? variants[0]?.image_url;
-    return {
-        id: p.id,
-        title: p.title,
-        description: full || !description || description.length <= 200 ? description : `${description.slice(0, 197)}...`,
-        url: p.url,
-        image_url: image,
-        categories: p.categories?.length ? p.categories.map((c) => c.value) : undefined,
-        // A text search ranks products with every word first; partial marks one with only some of them.
-        partial: p.metadata?.search?.all_words === false || undefined,
-        matched_on: p.metadata?.search?.matched_on,
-        // A search lists a variant's image only when it is not the product's.
-        variants: full ? variants : variants.map((v) => ({ ...v, image_url: v.image_url === image ? undefined : v.image_url })),
-    };
-}
-const sign = (c) => c.signature ?? 'unsigned';
-function selectedDestination(ck) {
-    const m = ck.fulfillment?.methods?.[0];
-    return m?.destinations?.find((d) => d.id === m.selected_destination_id);
-}
-/** A checkout for the conversation: what is in it, what it costs, what is still missing. */
-export function checkoutView(ck, origin, call) {
-    const cur = ck.currency;
-    const method = ck.fulfillment?.methods?.[0];
-    const group = method?.groups?.[0];
-    const options = group?.options ?? [];
-    const option = options.find((o) => o.id === group?.selected_option_id);
-    const optionView = (o) => ({ id: o.id, title: o.title, description: plain(o.description), price: o.totals?.find((t) => t.type === 'total') ? money(o.totals.find((t) => t.type === 'total').amount, cur) : undefined });
-    const { id: _id, type: _type, ...address } = selectedDestination(ck) ?? {};
-    const total = (ck.totals ?? []).find((t) => t.type === 'total');
-    return {
-        id: ck.id,
-        status: ck.status,
-        store: origin,
-        currency: cur,
-        line_items: (ck.line_items ?? []).map((l) => ({
-            id: l.id,
-            item_id: l.item?.id,
-            title: l.item?.title,
-            image_url: l.item?.image_url,
-            quantity: l.quantity,
-            unit_price: l.item?.price === undefined ? undefined : money(l.item.price, cur),
-            total: money((l.totals ?? []).find((t) => t.type === 'total')?.amount ?? 0, cur),
-        })),
-        buyer: ck.buyer ? Object.fromEntries(Object.entries(ck.buyer).filter(([k]) => k !== 'consent')) : undefined,
-        ship_to: Object.keys(address).length ? address : undefined,
-        shipping: option ? optionView(option) : undefined,
-        shipping_options: options.length > 1 ? options.map(optionView) : undefined,
-        discounts: ck.discounts?.applied?.length ? ck.discounts.applied.map((d) => ({ code: d.code, title: d.title, automatic: d.automatic, amount: money(d.amount, cur) })) : undefined,
-        codes: ck.discounts?.codes?.length ? ck.discounts.codes : undefined,
-        totals: (ck.totals ?? []).map((t) => ({ type: t.type, label: t.display_text, ...money(t.amount, cur) })),
-        total: total ? money(total.amount, cur) : undefined,
-        messages: ck.messages,
-        order: ck.order,
-        continue_url: ck.continue_url,
-        expires_at: ck.expires_at,
-        links: ck.links,
-        signature: sign(call),
-    };
-}
-export function orderView(o, origin, call) {
-    const cur = o.currency;
-    return {
-        id: o.id,
-        label: o.label,
-        permalink_url: o.permalink_url,
-        store: origin,
-        checkout_id: o.checkout_id,
-        currency: cur,
-        line_items: (o.line_items ?? []).map((l) => ({
-            item_id: l.item?.id,
-            title: l.item?.title,
-            image_url: l.item?.image_url,
-            quantity: l.quantity?.total ?? l.quantity,
-            status: l.status,
-            total: money((l.totals ?? []).find((t) => t.type === 'total')?.amount ?? 0, cur),
-        })),
-        fulfillment: (o.fulfillment?.expectations ?? []).map((e) => ({ method: e.method_type, destination: e.destination, description: e.description })),
-        events: o.fulfillment?.events?.length ? o.fulfillment.events : undefined,
-        totals: (o.totals ?? []).map((t) => ({ type: t.type, label: t.display_text, ...money(t.amount, cur) })),
-        signature: sign(call),
-    };
-}
-// ---------- the steps
-/** Turn a store's refusal into a CLI error; a missing checkout or order is not_found. */
-async function step(origin, run) {
-    try {
-        return await run();
-    }
-    catch (e) {
-        if (!(e instanceof UcpError))
-            throw e;
-        const code = e.call.body?.messages?.[0]?.code;
-        if (code === 'not_found' || e.call.status === 404)
-            fail('not_found', e.message, `The store at ${origin} does not know it. Check the id, or pass --store <the store it was made at>.`);
-        if (code === 'identity_required' || e.call.status === 401)
-            fail('identity_required', e.message, 'Orders are readable by the platform that placed them: this CLI can only read orders it placed.');
-        fail('ucp_error', e.message, `The store at ${origin} refused it: tell the human what it said. The variant ids it sells are in c11r ucp search.`);
-    }
-}
-/** --item ID or ID:QTY, the variant id. */
-export function parseItem(raw) {
-    const m = String(raw).match(/^(.+?)(?::(\d+))?$/);
-    if (!m || !m[1].trim())
-        fail('invalid_argument', `--item ${raw} is not ID or ID:QUANTITY.`, 'Use a variant id from c11r ucp search (variants[].id), for example --item ETH-250:2; quantity 1 when left out, 0 removes it in checkout update.');
-    return { id: m[1].trim(), quantity: m[2] === undefined ? 1 : Number(m[2]) };
-}
-export async function open(origin) {
-    const store = await discover(origin);
-    if (!store.capabilities.has('dev.ucp.shopping.checkout'))
-        fail('checkout_unsupported', `The store at ${origin} does not offer UCP checkout to this CLI.`, 'It can only be browsed: give the human the store URL to buy there.');
-    return store;
-}
-export async function search(origin, query, f = {}) {
-    const store = await discover(origin);
-    const body = { pagination: { limit: 50 } };
-    if (query)
-        body.query = query;
-    if (f.country)
-        body.context = { address_country: f.country.toUpperCase() };
-    const filters = {};
-    if (f.categories?.length)
-        filters.categories = f.categories;
-    if (f.min !== undefined || f.max !== undefined) {
-        // filters.price is in minor units of context.currency: ask the store which currency it prices in here.
-        const probe = await step(origin, () => shopping.search(store, { ...body, ...(f.categories?.length ? { filters } : {}), pagination: { limit: 1 } }));
-        const currency = probe.body.products?.[0]?.variants?.[0]?.price?.currency;
-        if (currency) {
-            body.context = { ...body.context, currency };
-            filters.price = { ...(f.min !== undefined ? { min: Math.round(f.min * minorUnits(currency)) } : {}), ...(f.max !== undefined ? { max: Math.round(f.max * minorUnits(currency)) } : {}) };
-        }
-    }
-    if (Object.keys(filters).length)
-        body.filters = filters;
-    const call = await step(origin, () => shopping.search(store, body));
-    const r = call.body;
-    let products = r.products ?? [];
-    // A store that ignores filters.price still gets the bounds applied here.
-    if (filters.price)
-        products = products.filter((p) => (p.variants ?? []).some((v) => v.price && (filters.price.min === undefined || v.price.amount >= filters.price.min) && (filters.price.max === undefined || v.price.amount <= filters.price.max)));
-    // Which market, currency and countries the prices are for: the store says it per variant, the same for all.
-    const prices = products.flatMap((p) => p.variants ?? []).find((v) => v.metadata?.prices)?.metadata.prices;
-    return {
-        store: origin,
-        query,
-        prices: prices ? { market: prices.market, market_name: prices.market_name, currency: prices.currency, countries: prices.countries, tax_included: prices.tax_included } : undefined,
-        filters: Object.keys(filters).length ? { categories: filters.categories, min_price: f.min, max_price: f.max, currency: body.context?.currency } : undefined,
-        count: products.length,
-        total_count: r.pagination?.total_count,
-        has_more: r.pagination?.has_next_page || undefined,
-        products: products.map((p) => productView(p)),
-        messages: r.messages,
-        signature: sign(call),
-    };
-}
-export async function product(origin, id, country) {
-    const store = await discover(origin);
-    const body = { id };
-    if (country)
-        body.context = { address_country: country.toUpperCase() };
-    const call = await step(origin, () => shopping.product(store, body));
-    return { store: origin, product: productView(call.body.product, true), signature: sign(call) };
-}
-export async function createCheckout(origin, items, codes, country) {
-    const store = await open(origin);
-    const body = { line_items: items.map((l) => ({ item: { id: l.id }, quantity: l.quantity })) };
-    if (country)
-        body.context = { address_country: country.toUpperCase() };
-    if (codes.length)
-        body.discounts = { codes };
-    const call = await step(origin, () => shopping.createCheckout(store, body));
-    remember(call.body.id, origin);
-    return checkoutView(call.body, origin, call);
-}
-export async function getCheckout(origin, id) {
-    const store = await open(origin);
-    const call = await step(origin, () => shopping.getCheckout(store, id));
-    return checkoutView(call.body, origin, call);
-}
-const clean = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined && v !== ''));
-export async function updateCheckout(origin, id, ch) {
-    const store = await open(origin);
-    const current = (await step(origin, () => shopping.getCheckout(store, id))).body;
-    if (current.status === 'completed' || current.status === 'canceled')
-        fail('checkout_closed', `The checkout ${id} is ${current.status}.`, current.status === 'completed' ? `It is an order now: c11r ucp order ${current.order?.id ?? '<id>'}.` : 'Open a new one: c11r ucp checkout create --item <sku>.');
-    const body = replay(current);
-    if (ch.buyer)
-        body.buyer = clean({ ...(current.buyer ?? {}), ...ch.buyer });
-    for (const l of ch.items ?? []) {
-        const i = body.line_items.findIndex((x) => x.item.id === l.id);
-        if (l.quantity === 0) {
-            if (i >= 0)
-                body.line_items.splice(i, 1);
-        }
-        else if (i >= 0)
-            body.line_items[i].quantity = l.quantity;
-        else
-            body.line_items.push({ item: { id: l.id }, quantity: l.quantity });
-    }
-    if (!body.line_items.length)
-        fail('invalid_argument', 'The update leaves the checkout with no items.', `Keep at least one item, or cancel it: c11r ucp checkout cancel ${id}.`);
-    const codes = ch.codes ?? [...(current.discounts?.codes ?? []), ...(ch.add_codes ?? [])];
-    if (ch.codes || ch.add_codes?.length)
-        body.discounts = { codes: [...new Set(codes)] };
-    if (ch.address || ch.shipping) {
-        const method = body.fulfillment?.methods?.[0] ?? { type: 'shipping', line_item_ids: (current.line_items ?? []).map((l) => l.id) };
-        if (ch.address) {
-            const prev = selectedDestination(current) ?? {};
-            const buyer = (body.buyer ?? {});
-            const dest = clean({ ...prev, first_name: buyer.first_name, last_name: buyer.last_name, ...ch.address, id: prev.id ?? 'dest_1' });
-            if (dest.address_country)
-                dest.address_country = String(dest.address_country).toUpperCase();
-            delete dest.type;
-            method.destinations = [dest];
-            method.selected_destination_id = dest.id;
-        }
-        if (ch.shipping)
-            method.groups = (method.groups?.length ? method.groups : [{ id: 'grp_1' }]).map((g) => ({ ...g, selected_option_id: ch.shipping }));
-        body.fulfillment = { methods: [method, ...(body.fulfillment?.methods?.slice(1) ?? [])] };
-    }
-    let call = await step(origin, () => shopping.updateCheckout(store, id, body));
-    // A store that offers shipping options without picking one: take its first, and say which in the result.
-    const group = call.body.fulfillment?.methods?.[0]?.groups?.[0];
-    if (group && !group.selected_option_id && group.options?.length) {
-        const again = replay(call.body);
-        again.fulfillment.methods[0].groups[0].selected_option_id = group.options[0].id;
-        call = await step(origin, () => shopping.updateCheckout(store, id, again));
-    }
-    // A store can answer ready_for_complete before the shipping is in the totals (seen once, since
-    // fixed on the store host): read it again rather than show the human a total without shipping.
-    const ck = call.body;
-    if (ck.status === 'ready_for_complete' && ck.fulfillment?.methods?.[0]?.groups?.[0]?.selected_option_id && !(ck.totals ?? []).some((t) => t.type === 'fulfillment')) {
-        call = await step(origin, () => shopping.getCheckout(store, id));
-    }
-    return checkoutView(call.body, origin, call);
-}
-export async function cancelCheckout(origin, id) {
-    const store = await open(origin);
-    const call = await step(origin, () => shopping.cancelCheckout(store, id));
-    return checkoutView(call.body, origin, call);
-}
-export async function completeCheckout(origin, id, decline) {
-    const store = await open(origin);
-    if (!store.profile.ucp?.payment_handlers?.[SANDBOX_HANDLER]) {
-        const handlers = Object.keys(store.profile.ucp?.payment_handlers ?? {});
-        fail('payment_handler_unsupported', `The store at ${origin} takes ${handlers.length ? handlers.join(', ') : 'no payment handler this CLI knows'}; this CLI pays only with the ${SANDBOX_HANDLER} test handler today.`, `Give the human the checkout's continue_url to pay there: c11r ucp checkout show ${id}.`);
-    }
-    const call = await step(origin, () => shopping.completeCheckout(store, id, { payment: { instruments: [sandboxInstrument(decline)] }, signals: { 'dev.ucp.user_agent': 'c11r' } }));
-    const ck = call.body;
-    if (ck.order?.id)
-        remember(ck.order.id, origin);
-    return checkoutView(ck, origin, call);
-}
-export async function getOrder(origin, id) {
-    const store = await discover(origin);
-    const call = await step(origin, () => shopping.getOrder(store, id));
-    return orderView(call.body, origin, call);
-}
-export async function ask(origin, question) {
-    const store = await discover(origin);
-    if (!store.capabilities.has('dev.ucp.common.ask'))
-        fail('ask_unsupported', `The store at ${origin} does not answer questions over UCP.`, 'Search its catalog instead: c11r ucp search <query>.');
-    const call = await step(origin, () => shopping.ask(store, { query: question }));
-    const r = call.body;
-    return { store: origin, question, answer: plain(r.answer), links: r.links, messages: r.messages, signature: sign(call) };
-}

package/dist/ucp/signing.js

@@ -1,67 +0,0 @@
-// HTTP message signatures (RFC 9421) and content digests (RFC 9530) as UCP uses
-// them: ES256 over a signature base, raw r||s encoding, keys published as JWKs.
-import crypto from 'node:crypto';
-export function contentDigest(body) {
-    return `sha-256=:${crypto.createHash('sha256').update(body).digest('base64')}:`;
-}
-/** The inner-list serialization that goes in Signature-Input and in the base. */
-export function serializeParams(p) {
-    let s = `(${p.components.map((c) => `"${c}"`).join(' ')})`;
-    if (p.created !== undefined)
-        s += `;created=${p.created}`;
-    s += `;keyid="${p.keyid}"`;
-    return s;
-}
-/** The signature base: one line per covered component, then @signature-params. */
-export function signatureBase(values, p) {
-    const lines = p.components.map((c) => `"${c}": ${values[c] ?? ''}`);
-    lines.push(`"@signature-params": ${serializeParams(p)}`);
-    return lines.join('\n');
-}
-export function generateKey(kid) {
-    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
-    const privateJwk = privateKey.export({ format: 'jwk' });
-    const publicJwk = { ...publicKey.export({ format: 'jwk' }), kid, use: 'sig', alg: 'ES256' };
-    return { privateJwk, publicJwk };
-}
-export function sign(base, privateJwk) {
-    const key = crypto.createPrivateKey({ key: privateJwk, format: 'jwk' });
-    return crypto.sign('sha256', Buffer.from(base), { key, dsaEncoding: 'ieee-p1363' }).toString('base64');
-}
-export function verify(base, signatureBase64, publicJwk) {
-    try {
-        const key = crypto.createPublicKey({ key: publicJwk, format: 'jwk' });
-        return crypto.verify('sha256', Buffer.from(base), { key, dsaEncoding: 'ieee-p1363' }, Buffer.from(signatureBase64, 'base64'));
-    }
-    catch {
-        return false;
-    }
-}
-/** Build Signature-Input and Signature headers for a message. */
-export function signHeaders(label, values, p, privateJwk) {
-    return {
-        'signature-input': `${label}=${serializeParams(p)}`,
-        signature: `${label}=:${sign(signatureBase(values, p), privateJwk)}:`,
-    };
-}
-/** Parse one signature out of Signature-Input / Signature headers (the first label). */
-export function parseSignature(signatureInput, signature) {
-    if (!signatureInput || !signature)
-        return null;
-    const input = signatureInput.match(/^\s*([a-z0-9_-]+)=\(([^)]*)\)((?:;[a-z]+=[^;]*)*)\s*$/i);
-    if (!input)
-        return null;
-    const [, label, list, paramStr] = input;
-    const components = [...list.matchAll(/"([^"]+)"/g)].map((m) => m[1]);
-    const params = { components, keyid: '' };
-    for (const [, k, v] of paramStr.matchAll(/;([a-z]+)=("[^"]*"|[^;]*)/g)) {
-        if (k === 'keyid')
-            params.keyid = v.replace(/^"|"$/g, '');
-        if (k === 'created')
-            params.created = Number(v);
-    }
-    const sig = signature.match(new RegExp(`${label}=:([A-Za-z0-9+/=]+):`));
-    if (!sig)
-        return null;
-    return { label, params, signature: sig[1] };
-}