@commercelayer/agent-cli 1.0.0-dev.2 → 1.0.0-dev.22

package/dist/storefront.js

@@ -0,0 +1,280 @@
+// The starter storefront on this machine (contract section 48): the catalogue file of a custom
+// seed, and the look files of scaffold storefront, both checked here before anything is sent.
+//
+// A catalogue is YAML: name, products (name, description, prices in EUR and USD, code) and an
+// optional look. A refusal names the field as the API would (catalogue.products[2].prices.USD) and
+// the line of the file. A look file (--logo ./logo.svg) goes as { type, content_base64, sha256 }:
+// svg, png, jpg or webp, by its name and its first bytes, at most 512 KB, and 2 MB in one call. An
+// https URL goes as it is, and null takes the image off.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import YAML, { LineCounter, isMap, isSeq } from 'yaml';
+import { fail } from './errors.js';
+export const SEED_TYPES = ['coffee', 'tshirts', 'games', 'custom'];
+export const FONTS = ['classic', 'modern', 'rounded', 'mono'];
+export const CORNERS = ['round', 'square'];
+export const TAGLINE_MAX = 120;
+export const BADGE_MAX = 20;
+/** The shop's name in its title and header (scaffold storefront --name), trimmed. */
+export const NAME_MAX = 40;
+export const FILE_MAX = 512 * 1024;
+export const CALL_MAX = 2 * 1024 * 1024;
+const PRODUCTS_MAX = 24;
+const CURRENCIES = ['EUR', 'USD'];
+const LOOK_KEYS = ['color', 'background', 'font', 'corners', 'tagline', 'badge'];
+/** The answer's next with the shop's entry first, and the API's own entry for the same command left out. */
+export function withShop(r, store) {
+    const shop = shopNext(store);
+    if (!shop)
+        return r;
+    return { ...r, data: { ...r.data, shop_url: shop.url }, next: [shop.next, ...r.next.filter((n) => n.command !== shop.next.command)] };
+}
+/** The shop link of an answer's store, and the next entry that hands it to the human. */
+export function shopNext(store) {
+    const host = store && typeof store === 'object' ? store.host : undefined;
+    if (typeof host !== 'string' || !host)
+        return null;
+    const given = store.url;
+    const url = typeof given === 'string' && given ? given : `https://${host}/`;
+    return { url, next: { command: 'c11r scaffold storefront', why: `The shop is at ${url}: give the human the link. Every change to its look goes through this command.` } };
+}
+/** A look value checked as the API checks it; a message, or null when it is right. */
+export function lookProblem(key, v) {
+    if (v === null)
+        return null;
+    switch (key) {
+        case 'color':
+            return typeof v === 'string' && /^#[0-9a-fA-F]{6}$/.test(v) ? null : 'is a colour as #rrggbb';
+        case 'background':
+            return typeof v === 'string' && /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/.test(v) ? null : 'is a colour as #rgb or #rrggbb';
+        case 'font':
+            return typeof v === 'string' && FONTS.includes(v) ? null : `is one of ${FONTS.join(', ')}`;
+        case 'corners':
+            return typeof v === 'string' && CORNERS.includes(v) ? null : `is one of ${CORNERS.join(', ')}`;
+        case 'name':
+            return typeof v === 'string' && v.trim().length >= 1 && [...v.trim()].length <= NAME_MAX ? null : `has 1 to ${NAME_MAX} characters${typeof v === 'string' ? `, not ${[...v.trim()].length}` : ''}`;
+        case 'tagline':
+        case 'badge': {
+            const max = key === 'tagline' ? TAGLINE_MAX : BADGE_MAX;
+            return typeof v === 'string' && v.trim().length >= 1 && [...v].length <= max ? null : `has 1 to ${max} characters${typeof v === 'string' ? `, not ${[...v].length}` : ''}`;
+        }
+    }
+    return null;
+}
+/** The catalogue file read and checked: the object the API takes as body.catalogue. */
+export function readCatalogue(file) {
+    let text;
+    try {
+        text = fs.readFileSync(file, 'utf8');
+    }
+    catch (e) {
+        fail('invalid_value', `--catalogue ${file}: ${e.code === 'ENOENT' ? 'no such file' : e.message}.`, { path: 'catalogue' });
+    }
+    const lines = new LineCounter();
+    const doc = YAML.parseDocument(text, { lineCounter: lines, prettyErrors: false });
+    if (doc.errors.length) {
+        const e = doc.errors[0];
+        const at = lines.linePos(e.pos[0]);
+        fail('invalid_value', `${file} is not YAML${at ? ` (line ${at.line})` : ''}: ${e.message.split('\n')[0]}`, { path: 'catalogue', details: { file, ...(at ? { line: at.line } : {}) } });
+    }
+    const v = doc.toJS();
+    const bad = (at, why) => {
+        const field = ['catalogue', ...at].reduce((acc, k) => (typeof k === 'number' ? `${acc}[${k}]` : acc ? `${acc}.${k}` : String(k)), '');
+        const line = lineOf(doc, lines, at);
+        fail('invalid_value', `${file}${line ? ` line ${line}` : ''}: ${field.replace(/^catalogue\.?/, '') || 'the file'} ${why}. Nothing was sent.`, {
+            path: field,
+            details: { file, ...(line ? { line } : {}) },
+            next_step: { action: 'fix_request', command: null },
+        });
+    };
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        bad([], 'is a mapping with name and products');
+    const c = v;
+    for (const k of Object.keys(c))
+        if (!['name', 'products', 'look'].includes(k))
+            bad([k], 'is not a catalogue field: it takes name, products and look');
+    text1(c.name, ['name'], 40, true, bad);
+    if (!Array.isArray(c.products) || !c.products.length)
+        bad(['products'], `is a list of 1 to ${PRODUCTS_MAX} products`);
+    const products = c.products;
+    if (products.length > PRODUCTS_MAX)
+        bad(['products'], `has ${products.length} products: at most ${PRODUCTS_MAX}`);
+    const names = new Map();
+    const codes = new Map();
+    products.forEach((p, i) => {
+        const at = ['products', i];
+        if (!p || typeof p !== 'object' || Array.isArray(p))
+            bad(at, 'is a product with name and prices');
+        const o = p;
+        for (const k of Object.keys(o))
+            if (!['name', 'description', 'prices', 'code'].includes(k))
+                bad([...at, k], 'is not a product field: it takes name, description, prices and code');
+        text1(o.name, [...at, 'name'], 80, true, bad);
+        const name = o.name.trim().toLowerCase();
+        if (names.has(name))
+            bad([...at, 'name'], `repeats the name of products[${names.get(name)}]: names are unique`);
+        names.set(name, i);
+        if (o.description !== undefined && o.description !== null)
+            text1(o.description, [...at, 'description'], 500, false, bad);
+        if (!o.prices || typeof o.prices !== 'object' || Array.isArray(o.prices))
+            bad([...at, 'prices'], 'has a price in EUR and one in USD, as { EUR: 18, USD: 20 }');
+        const prices = o.prices;
+        for (const k of Object.keys(prices))
+            if (!CURRENCIES.includes(k))
+                bad([...at, 'prices', k], 'is not a currency of the seed: it takes EUR and USD');
+        for (const cur of CURRENCIES) {
+            const given = prices[cur];
+            if (given === undefined)
+                bad([...at, 'prices'], `has no ${cur} price: it needs EUR and USD`);
+            // A quoted amount ("9.50") is taken as the API takes it: digits, a dot, digits.
+            const n = typeof given === 'string' && /^\d+(\.\d+)?$/.test(given.trim()) ? Number(given) : given;
+            if (typeof n !== 'number' || !Number.isFinite(n) || n <= 0 || n > 100000)
+                bad([...at, 'prices', cur], 'is an amount above 0 and at most 100000');
+            if (Math.round(n * 100) !== Number((n * 100).toFixed(6)))
+                bad([...at, 'prices', cur], 'has two decimals at most');
+        }
+        if (o.code !== undefined) {
+            if (typeof o.code !== 'string' || !/^[A-Z0-9-]{2,24}$/.test(o.code))
+                bad([...at, 'code'], 'is 2 to 24 capitals, digits and dashes');
+            if (codes.has(o.code))
+                bad([...at, 'code'], `repeats the code of products[${codes.get(o.code)}]: codes are unique`);
+            codes.set(o.code, i);
+        }
+    });
+    if (c.look !== undefined && c.look !== null) {
+        if (typeof c.look !== 'object' || Array.isArray(c.look))
+            bad(['look'], `is a mapping of ${LOOK_KEYS.join(', ')}`);
+        for (const [k, x] of Object.entries(c.look)) {
+            if (!LOOK_KEYS.includes(k))
+                bad(['look', k], `is not a look field here: it takes ${LOOK_KEYS.join(', ')} (images come with c11r scaffold storefront)`);
+            const why = lookProblem(k, x);
+            if (why)
+                bad(['look', k], why);
+        }
+    }
+    return c;
+}
+function text1(v, at, max, required, bad) {
+    if (v === undefined || v === null) {
+        if (required)
+            bad(at, 'is missing');
+        return;
+    }
+    if (typeof v !== 'string')
+        bad(at, 'is text');
+    const n = [...v].length;
+    if ((required && !v.trim()) || n > max)
+        bad(at, `has ${required ? 1 : 0} to ${max} characters, not ${n}`);
+}
+/** The line of the field at the path: its key's line, or its item's; else the nearest parent's. */
+function lineOf(doc, lines, at) {
+    for (let n = at.length; n > 0; n--) {
+        const parent = n === 1 ? doc.contents : doc.getIn(at.slice(0, n - 1), true);
+        const last = at[n - 1];
+        if (isMap(parent)) {
+            const pair = parent.items.find((p) => p.key?.value === last);
+            const range = pair?.key?.range;
+            if (range)
+                return lines.linePos(range[0]).line;
+        }
+        else if (isSeq(parent) && typeof last === 'number') {
+            const range = parent.items[last]?.range;
+            if (range)
+                return lines.linePos(range[0]).line;
+        }
+    }
+    return null;
+}
+const EXT = { '.svg': 'svg', '.png': 'png', '.jpg': 'jpg', '.jpeg': 'jpg', '.webp': 'webp' };
+/** What the first bytes say the file is, or null. */
+function sniff(b) {
+    if (b.length >= 8 && b.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return 'png';
+    if (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return 'jpg';
+    if (b.length >= 12 && b.subarray(0, 4).toString('latin1') === 'RIFF' && b.subarray(8, 12).toString('latin1') === 'WEBP')
+        return 'webp';
+    const head = b.subarray(0, 1024).toString('utf8').replace(/^/, '').trimStart();
+    if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*(<!DOCTYPE svg[^>]*>\s*)?<svg[\s>]/i.test(head))
+        return 'svg';
+    return null;
+}
+/**
+ * An image value as the API takes it: null as null, an https URL as it is, else a local file read
+ * into { type, content_base64, sha256 }. field names it in errors (logo, product_images.BB-ETH-250).
+ */
+export function lookImage(field, flag, v) {
+    if (v === null)
+        return { value: null, bytes: 0 };
+    if (typeof v !== 'string' || !v.trim())
+        fail('invalid_value', `${flag} takes a file, an https URL, or null to take the image off.`, { path: field });
+    const s = v.trim();
+    if (/^https:\/\//i.test(s))
+        return { value: s, bytes: 0 };
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s))
+        fail('invalid_value', `${flag} ${s}: a link is https only. Or give a local file.`, { path: field });
+    const ext = EXT[path.extname(s).toLowerCase()];
+    if (!ext)
+        fail('invalid_value', `${flag} ${s} is not an svg, png, jpg or webp file, by its name.`, { path: field, details: { types: ['svg', 'png', 'jpg', 'webp'] } });
+    let stat;
+    try {
+        stat = fs.statSync(s);
+    }
+    catch (e) {
+        fail('invalid_value', `${flag} ${s}: ${e.code === 'ENOENT' ? 'no such file' : e.message}.`, { path: field });
+    }
+    if (!stat.isFile())
+        fail('invalid_value', `${flag} ${s} is not a file.`, { path: field });
+    if (stat.size > FILE_MAX)
+        fail('invalid_value', `${flag} ${s} has ${kb(stat.size)}: an image is at most 512 KB.`, { path: field, details: { bytes: stat.size, max: FILE_MAX } });
+    if (stat.size === 0)
+        fail('invalid_value', `${flag} ${s} is empty.`, { path: field });
+    const b = fs.readFileSync(s);
+    const is = sniff(b);
+    if (is !== ext)
+        fail('invalid_value', `${flag} ${s} is named ${ext}, but its first bytes ${is ? `are ${is}'s` : 'are none of svg, png, jpg or webp'}.`, { path: field });
+    if (ext === 'svg') {
+        let text = '';
+        try {
+            text = new TextDecoder('utf-8', { fatal: true }).decode(b);
+        }
+        catch {
+            fail('invalid_value', `${flag} ${s} is not UTF-8 text, as an svg file is. Save it again as UTF-8. Nothing was sent.`, { path: field, next_step: { action: 'fix_request', command: null } });
+        }
+        const why = svgRefusal(text);
+        if (why)
+            fail('invalid_value', `${flag} ${s} would be refused by the store: ${why.reason}. ${why.fix} Nothing was sent.`, { path: field, details: { refused: why.reason }, next_step: { action: 'fix_request', command: null } });
+    }
+    return { value: { type: ext, content_base64: b.toString('base64'), sha256: crypto.createHash('sha256').update(b).digest('hex') }, bytes: b.length };
+}
+/**
+ * Why the store would refuse an SVG, and the way out; null when it takes it. The store's rules
+ * (its assets.ts svgRefusal), checked here so the agent learns before the upload.
+ */
+export function svgRefusal(text) {
+    const body = text.replace(/^\uFEFF/, '').replace(/<\?xml[\s\S]*?\?>/, '').replace(/<!--[\s\S]*?-->/g, '').trim();
+    if (/<!DOCTYPE|<!ENTITY/i.test(text))
+        return { reason: 'it declares a DOCTYPE or an entity', fix: 'Remove the DOCTYPE line (and any ENTITY) from the file.' };
+    if (!/^<svg[\s>]/i.test(body))
+        return { reason: 'it is not an <svg> document', fix: 'The file starts with <svg>, after an optional <?xml ...?> line and comments.' };
+    const embedded = body.match(/<\s*(script|foreignObject|iframe|embed|object|audio|video|handler|listener)\b/i);
+    if (embedded)
+        return { reason: `it has a <${embedded[1]}> element`, fix: `Remove the <${embedded[1]}> element: a shop image has no script or embedded content.` };
+    const event = body.match(/\s(on[a-z]+)\s*=/i);
+    if (event)
+        return { reason: `it has the event attribute ${event[1]}`, fix: 'Remove every on... attribute.' };
+    if (/javascript:|vbscript:/i.test(body))
+        return { reason: 'it has a script URL', fix: 'Remove every javascript: or vbscript: link.' };
+    for (const m of body.matchAll(/\b(?:xlink:)?href\s*=\s*(["'])(.*?)\1/gi))
+        if (!allowedRef(m[2]))
+            return { reason: `it links to ${m[2].slice(0, 60)}`, fix: 'Keep only links inside the file (#id) or images embedded as data:image/...;base64.' };
+    for (const m of body.matchAll(/url\(\s*(["']?)(.*?)\1\s*\)/gi))
+        if (!allowedRef(m[2]))
+            return { reason: `it loads ${m[2].slice(0, 60)}`, fix: 'Keep only url(#id) or images embedded as data:image/...;base64.' };
+    if (/@import/i.test(body))
+        return { reason: 'it imports a stylesheet', fix: 'Remove the @import: put the styles in the file.' };
+    return null;
+}
+const allowedRef = (v) => /^#/.test(v.trim()) || /^data:image\/(png|jpe?g|webp|gif);base64,/i.test(v.trim());
+export const kb = (n) => `${Math.ceil(n / 1024)} KB`;

package/dist/ucp.js

@@ -0,0 +1,207 @@
+// A UCP platform client: what any shopping agent does to buy from a store that speaks UCP.
+// The CLI talks to the store directly, as the agent CLI platform: its profile is the static
+// https://commercelayer.ai/ucp/agent-cli/profile.json, it holds no keys, and stores verify no
+// request signature. Every call carries UCP-Agent and Request-Id, a Content-Digest with a body,
+// and an Idempotency-Key on writes. The store signs its answers (RFC 9421, ES256 over @status,
+// content-digest and content-type): the CLI checks them against keys[] of its /.well-known/ucp.
+import crypto from 'node:crypto';
+import { CliError, fail } from './errors.js';
+import { USER_AGENT } from './version.js';
+export const UCP_VERSION = '2026-08-25';
+export const AGENT_PROFILE_URL = 'https://commercelayer.ai/ucp/agent-cli/profile.json';
+/** The sandbox payment handler: no money moves. The only one this CLI pays with. */
+export const SANDBOX_HANDLER = 'ai.commercelayer.sandbox';
+const SANDBOX_HANDLER_ID = 'cl_sandbox';
+const SANDBOX_CREDENTIAL_TYPE = 'sandbox_token';
+const SANDBOX_TOKEN_SUCCESS = 'sbx_tok_success';
+const TIMEOUT_MS = 30_000;
+/** A store from a host or a URL on it: https only (http for localhost, in tests). */
+export function originOf(given) {
+    let url = null;
+    try {
+        url = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(given) ? given : `https://${given}`);
+    }
+    catch {
+        url = null;
+    }
+    if (!url || !url.hostname)
+        fail('invalid_value', `${given} is not a store: give its host, as in shop.example.com, or an https URL on it.`, { path: 'id' });
+    const local = ['localhost', '127.0.0.1'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local))
+        fail('invalid_value', `${given} is not https: UCP stores are served over https.`, { path: 'id' });
+    return url.origin;
+}
+/** GET /.well-known/ucp: what the store offers this CLI. */
+export async function discover(origin) {
+    const res = await http('GET', `${origin}/.well-known/ucp`, { accept: 'application/json' });
+    const host = new URL(origin).host;
+    if (res.status === 404)
+        fail('not_found', `${host} serves no UCP profile (/.well-known/ucp answered 404): it does not sell to agents.`, { path: 'id', next_step: { action: 'human_step', url: origin } });
+    if (res.status !== 200)
+        fail('store_unavailable', `${host}/.well-known/ucp answered ${res.status}.`, { details: { status: res.status }, next_step: { action: 'retry_later' } });
+    const profile = parse(res.body);
+    if (!profile || typeof profile.ucp !== 'object')
+        fail('invalid_response', `${host}/.well-known/ucp is not a UCP profile.`, { next_step: { action: 'none' } });
+    const ucp = profile.ucp;
+    if (ucp.version !== UCP_VERSION)
+        fail('not_supported', `${host} speaks UCP ${ucp.version ?? '(no version)'}; this CLI speaks ${UCP_VERSION}.`, { details: { store_version: ucp.version ?? null, cli_version: UCP_VERSION }, next_step: { action: 'none' } });
+    const rest = (name) => (ucp.services?.[name] ?? []).find((s) => s.transport === 'rest')?.endpoint ?? null;
+    const endpoint = rest('dev.ucp.shopping');
+    if (!endpoint)
+        fail('not_supported', `${host}'s profile has no REST dev.ucp.shopping service.`, { next_step: { action: 'none' } });
+    const capabilities = new Set();
+    for (const [name, entries] of Object.entries((ucp.capabilities ?? {})))
+        if (Array.isArray(entries) && entries.some((e) => e.version === UCP_VERSION))
+            capabilities.add(name);
+    return { origin, host, profile, endpoint, commonEndpoint: rest('dev.ucp.common'), capabilities, keys: Array.isArray(profile.keys) ? profile.keys : [] };
+}
+/** The payment handlers the store offers, by name, and whether this CLI can pay there. */
+export function handlersOf(store) {
+    const handlers = Object.keys(store.profile.ucp?.payment_handlers ?? {});
+    return { handlers, can_pay: handlers.includes(SANDBOX_HANDLER) && store.capabilities.has('dev.ucp.shopping.checkout') };
+}
+/** Before anything of the human's is sent: a store this CLI cannot pay at is refused. */
+export function mustPay(store, extra = {}) {
+    if (!store.capabilities.has('dev.ucp.shopping.checkout')) {
+        fail('not_supported', `${store.host} offers no UCP checkout: an agent can browse it, not buy there.`, { next_step: { action: 'human_step', url: store.origin } });
+    }
+    const { handlers } = handlersOf(store);
+    if (!handlers.includes(SANDBOX_HANDLER)) {
+        fail('payment_handler_unsupported', `${store.host} takes ${handlers.length ? handlers.join(', ') : 'no payment handler'}; this CLI pays only with the ${SANDBOX_HANDLER} test handler, where no money moves. The human buys there in person.`, { details: { handlers }, next_step: { action: 'human_step', url: extra.continue_url ?? store.origin } }, 'rejected');
+    }
+}
+export const sandboxPayment = () => ({ payment: { instruments: [{ id: 'pi_1', handler_id: SANDBOX_HANDLER_ID, type: 'card', selected: true, credential: { type: SANDBOX_CREDENTIAL_TYPE, token: SANDBOX_TOKEN_SUCCESS } }] } });
+/** A UCP call. The answer's digest and signature are checked; an error is a CliError. */
+export async function call(store, method, url, body, what = 'the store') {
+    const raw = body === undefined ? undefined : JSON.stringify(body);
+    const headers = { accept: 'application/json', 'ucp-agent': `profile="${AGENT_PROFILE_URL}"`, 'request-id': crypto.randomUUID() };
+    if (raw !== undefined) {
+        headers['content-type'] = 'application/json';
+        headers['content-digest'] = contentDigest(raw);
+    }
+    if (method !== 'GET' && !/\/catalog\/|\/ask$/.test(url))
+        headers['idempotency-key'] = crypto.randomUUID();
+    const res = await http(method, url, headers, raw);
+    const signature = checkAnswer(store, res);
+    const parsed = parse(res.body);
+    if (res.status >= 400 || parsed?.ucp?.status === 'error')
+        refused(store, res.status, parsed, what);
+    if (!parsed || typeof parsed !== 'object')
+        fail('invalid_response', `${store.host} answered ${what} with no JSON.`, { details: { status: res.status }, next_step: { action: 'retry_later' } });
+    return { status: res.status, body: parsed, signature };
+}
+/** The store's own words, as an error the agent can show the human. */
+function refused(store, status, body, what) {
+    const messages = Array.isArray(body?.messages) ? body.messages : [];
+    const first = messages.find((m) => m.type === 'error') ?? messages[0];
+    const code = body?.code ?? first?.code;
+    const said = body?.content ?? first?.content ?? `it answered ${status}`;
+    const details = { status, store_code: code ?? null, messages: messages.length ? messages : undefined };
+    if (status === 404 || code === 'not_found')
+        fail('not_found', `${store.host} does not know ${what}: ${said}`, { details, next_step: { action: 'none' } });
+    if (status === 401 && /signature/i.test(`${code} ${said}`)) {
+        fail('not_supported', `${store.host} wants a signed request, and this CLI signs none: ${said}`, { details, next_step: { action: 'human_step', url: store.origin } });
+    }
+    if (status === 401 || code === 'identity_required')
+        fail('forbidden', `${store.host} refused ${what}: ${said} This CLI reads only orders it placed.`, { details, next_step: { action: 'none' } });
+    if (status === 429 || status >= 500)
+        fail('store_unavailable', `${store.host} could not answer ${what}: ${said}`, { details, next_step: { action: 'retry_later' } });
+    fail('store_refused', `${store.host} refused ${what}: ${said}`, { details, next_step: { action: 'human_step' } }, 'rejected');
+}
+async function http(method, url, headers, body) {
+    let res;
+    try {
+        res = await fetch(url, { method, headers: { 'user-agent': USER_AGENT, ...headers }, body, redirect: 'follow', signal: AbortSignal.timeout(TIMEOUT_MS) });
+    }
+    catch (e) {
+        const host = (() => {
+            try {
+                return new URL(url).host;
+            }
+            catch {
+                return url;
+            }
+        })();
+        throw new CliError({ code: 'store_unavailable', message: `${host} could not be reached: ${e.message}.`, required_state: null, required_plan: null, missing: null, path: null, next_step: { action: 'retry_later', command: null, url: null } }, 'unavailable');
+    }
+    const out = {};
+    res.headers.forEach((v, k) => (out[k.toLowerCase()] = v));
+    return { status: res.status, headers: out, body: await res.text() };
+}
+function parse(text) {
+    if (!text)
+        return null;
+    try {
+        const v = JSON.parse(text);
+        return v && typeof v === 'object' ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ---------- digests and signatures (RFC 9530, RFC 9421)
+export function contentDigest(body) {
+    return `sha-256=:${crypto.createHash('sha256').update(body).digest('base64')}:`;
+}
+function serializeParams(p) {
+    let s = `(${p.components.map((c) => `"${c}"`).join(' ')})`;
+    if (p.created !== undefined)
+        s += `;created=${p.created}`;
+    return `${s};keyid="${p.keyid}"`;
+}
+export function signatureBase(values, p) {
+    return [...p.components.map((c) => `"${c}": ${values[c] ?? ''}`), `"@signature-params": ${serializeParams(p)}`].join('\n');
+}
+function parseSignature(input, signature) {
+    if (!input || !signature)
+        return null;
+    const m = input.match(/^\s*([a-z0-9_-]+)=\(([^)]*)\)((?:;[a-z]+=[^;]*)*)\s*$/i);
+    if (!m)
+        return null;
+    const [, label, list, rest] = m;
+    const params = { components: [...list.matchAll(/"([^"]+)"/g)].map((x) => x[1]), keyid: '' };
+    for (const [, k, v] of rest.matchAll(/;([a-z]+)=("[^"]*"|[^;]*)/g)) {
+        if (k === 'keyid')
+            params.keyid = v.replace(/^"|"$/g, '');
+        if (k === 'created')
+            params.created = Number(v);
+    }
+    const sig = signature.match(new RegExp(`${label}=:([A-Za-z0-9+/=]+):`));
+    return sig ? { params, signature: sig[1] } : null;
+}
+function verify(base, signature, jwk) {
+    try {
+        const { kid: _k, use: _u, alg: _a, key_ops: _o, ...key } = jwk;
+        return crypto.verify('sha256', Buffer.from(base), { key: crypto.createPublicKey({ key: key, format: 'jwk' }), dsaEncoding: 'ieee-p1363' }, Buffer.from(signature, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+/** A digest that does not match, or a signature that does not verify: the answer is not trusted. */
+function checkAnswer(store, res) {
+    const digest = res.headers['content-digest'];
+    if (digest && digest !== contentDigest(res.body))
+        fail('invalid_response', `${store.host}'s answer does not match its Content-Digest: it was changed on the way, and is not used.`, { next_step: { action: 'retry_later' } });
+    const sig = parseSignature(res.headers['signature-input'], res.headers.signature);
+    if (!sig)
+        return 'unsigned';
+    const key = store.keys.find((k) => k.kid === sig.params.keyid);
+    const values = { '@status': String(res.status), 'content-digest': digest ?? '', 'content-type': res.headers['content-type'] ?? '' };
+    if (!key || !verify(signatureBase(values, sig.params), sig.signature, key)) {
+        fail('invalid_response', `${store.host}'s answer is signed with ${key ? 'a signature that does not verify' : `a key its profile does not publish (${sig.params.keyid})`}: it is not used.`, { next_step: { action: 'none' } });
+    }
+    return 'verified';
+}
+export function money(amount, currency) {
+    let digits = 2;
+    try {
+        digits = new Intl.NumberFormat('en', { style: 'currency', currency }).resolvedOptions().maximumFractionDigits ?? 2;
+    }
+    catch {
+        digits = 2;
+    }
+    const major = amount / 10 ** digits;
+    return { amount, currency, display: `${amount < 0 ? '-' : ''}${currency} ${Math.abs(major).toFixed(digits)}` };
+}
+export const minorOf = (major, currency) => Math.round(major * 10 ** (money(0, currency).display.split('.')[1]?.length ?? 0));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercelayer/agent-cli",
-  "version": "1.0.0-dev.2",
+  "version": "1.0.0-dev.22",
   "description": "c11r: the Commerce Layer CLI for coding agents. One grammar, c11r <noun> <verb>, from a sandbox to a running organization.",
   "homepage": "https://commercelayer.ai",
   "keywords": [