@curless/sinocare-demo 0.62.2 → 0.63.0

package/dist/index.js

@@ -250,6 +250,11 @@ import {
   signSolanaX402Payment
 } from "@curless/agentbank-protocols/solana";
 import { payMppTempoChallenge } from "@curless/agentbank-protocols/tempo";
+import {
+  checkout as uaagCheckout,
+  checkoutState as uaagCheckoutState,
+  createIntent as uaagCreateIntent
+} from "@curless/agentbank-protocols/uaag";
 import {
   cdpAccountSigner,
   encodeXPaymentHeader,
@@ -281,6 +286,7 @@ var CHECKOUT_CARD_HTML = Buffer.from(
 
 // src/index.ts
 var API_BASE = (process.env.AGENTBANK_API_URL ?? "https://mcp.curless.ai").replace(/\/$/, "");
+var WALLET_BASE = (process.env.BUYER_WALLET_PUBLIC_URL ?? API_BASE).replace(/\/$/, "");
 var SINOCARE = `${API_BASE}/sinocare`;
 var acp = (merchantId) => {
   if (!TOKEN) throw new Error("AGENTBANK_AGENT_TOKEN is not set");
@@ -751,6 +757,36 @@ var RAIL_TOOLS = [
       }
     }
   },
+  {
+    name: "start_sinocare_uaag_handoff",
+    description: "Buy a Sinocare product over UnionPay Agent Pay (UAAG). Sinocare prices it and opens a checkout session; UnionPay then authenticates the CARDHOLDER on its own page (3DS / Passkey) and issues a one-time payment token. \u26A0\uFE0F This is a HANDOFF, not a purchase: it returns UnionPay\u2019s checkout URL for the person to open, and the flow ends when UnionPay issues the credential. UnionPay\u2019s model has the MERCHANT charge that credential \u2014 it is shaped like an ordinary UnionPay card (token as the card number, DTVC as the CVV2), so the merchant needs UnionPay acceptance. Sinocare\u2019s demo checkout has none, so nothing is charged and no order is placed. Returns ordered:false always.",
+    inputSchema: {
+      type: "object",
+      required: ["sku"],
+      properties: {
+        sku: { type: "string" },
+        quantity: { type: "integer", description: "how many, default 1" },
+        cardId: {
+          type: "string",
+          description: "OPTIONAL, and normally omit it. The storefront reads the buyer's bound UnionPay cards from their own wallet session and uses the one they have; pass this only to pick between several. A uaagcard_\u2026 you did not get from that list is a guess, and UnionPay answers a wrong one with a 404 that does not say what was wrong."
+        }
+      }
+    }
+  },
+  {
+    name: "get_sinocare_uaag_status",
+    description: "Has UnionPay issued the payment credential yet? Pass the paymentIntentId from start_sinocare_uaag_handoff. The cardholder authenticates in their own browser and this server is never told when they finish, so this is the only way to know. \u26A0\uFE0F `issued: true` means a one-time token + DTVC now exist \u2014 it does NOT mean the order is paid. The MERCHANT charges that credential through their own UnionPay acceptance, which Sinocare does not have, so this demo stops there on purpose. Never report it as paid.",
+    inputSchema: {
+      type: "object",
+      required: ["paymentIntentId"],
+      properties: {
+        paymentIntentId: {
+          type: "string",
+          description: "from start_sinocare_uaag_handoff"
+        }
+      }
+    }
+  },
   {
     name: "buy_sinocare_product_acp",
     description: "Buy a Sinocare product over ACP (Agentic Commerce Protocol) \u2014 Sinocare prices the product and opens a merchant-quoted checkout session; this agent completes it with a delegated card credential, settling on the card rail (test mode). One of THREE ways to pay: ACP (card) / UCP (card) / x402 (USDC). The card rail is an implementation detail, not a separate payment choice. Returns the ordered order.",
@@ -1177,6 +1213,158 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
         message: `Ordered ${session.name} \xD7 ${quantity2} \u2014 ${session.amountDisplay} charged (${order.status}).`
       });
     }
+    if (req.params.name === "start_sinocare_uaag_handoff") {
+      if (!TOKEN) {
+        return text({ error: "sinocare-demo: AGENTBANK_AGENT_TOKEN is not set" });
+      }
+      if (!wallet.current()) {
+        const login = await pendingLogin();
+        return text({
+          needsLogin: true,
+          loginUrl: login.verificationUriComplete,
+          userCode: login.userCode,
+          message: "\u8981\u7528\u94F6\u8054\u5361\u4ED8\u6B3E,\u5F97\u5148\u767B\u5F55\u4F60\u81EA\u5DF1\u7684 Curless \u94B1\u5305 \u2014\u2014 \u5361\u7ED1\u5728\u90A3\u91CC,\u53EA\u6709\u5B83\u77E5\u9053\u4F60\u7ED1\u4E86\u54EA\u51E0\u5F20\u3002",
+          next: "show the person this link and stop. Do not pay another way."
+        });
+      }
+      const { cards } = await wallet.unionPayCards();
+      if (cards.length === 0) {
+        return text({
+          ordered: false,
+          blocked: "no_unionpay_card",
+          message: "\u4F60\u7684 Curless \u94B1\u5305\u91CC\u8FD8\u6CA1\u6709\u7ED1\u5B9A\u7684\u94F6\u8054\u5361\u3002\u7ED1\u5361\u5728\u94B1\u5305\u8FDE\u63A5\u5668\u91CC\u505A(wallet_bind_unionpay_card),\u4E0D\u5728\u8FD9\u4E2A\u5E97\u91CC \u2014\u2014 \u94F6\u8054\u8981\u5728\u4ED6\u4EEC\u81EA\u5DF1\u7684\u9875\u9762\u4E0A\u6536\u5361\u3002",
+          next: "tell them to bind a UnionPay card in their wallet connector first. Do NOT retry this tool, and do NOT offer to take the card number here."
+        });
+      }
+      const named = typeof args.cardId === "string" ? args.cardId : "";
+      const card = named ? cards.find((c) => c.id === named) : cards[0];
+      if (!card) {
+        return text({
+          ordered: false,
+          blocked: "unknown_card",
+          message: `\u4F60\u7684\u94B1\u5305\u91CC\u6CA1\u6709\u8FD9\u5F20\u5361:${named}`,
+          cards: cards.map((c) => ({ id: c.id, last4: c.panLastFour }))
+        });
+      }
+      const sku2 = String(args.sku ?? "");
+      const quantity2 = Math.max(Number(args.quantity) || 1, 1);
+      const session = await backend("/checkout-acp", {
+        method: "POST",
+        body: JSON.stringify({ sku: sku2, quantity: quantity2, ...BUYER ? { buyer: BUYER } : {} })
+      });
+      const me = await wallet.me();
+      const [firstName, ...rest] = (me.name ?? "Curless Buyer").trim().split(/\s+/);
+      const uaagOpts = { baseUrl: API_BASE, token: TOKEN };
+      const unit = (session.amount / quantity2 / 100).toFixed(2);
+      try {
+        await uaagCreateIntent(uaagOpts, {
+          paymentIntentId: session.sessionId,
+          cardId: card.id,
+          merchantName: "Sinocare",
+          merchantUrl: "https://www.sinocare.com",
+          items: [
+            {
+              itemName: session.name,
+              itemDescription: session.name,
+              itemUrl: `https://www.sinocare.com/products/${session.sku}`,
+              itemUnitPrice: { amount: unit, currencyCode: session.currency },
+              itemQuantity: String(quantity2)
+            }
+          ],
+          delivery: {
+            firstName: firstName || "Curless",
+            lastName: rest.join(" ") || "Buyer",
+            emailAddress: me.email,
+            // ⚠️ Required whenever anything ships, which is every item unless
+            // the whole order is DIGITAL — the field table calls it conditional
+            // and the condition is almost always true. Demo address: this shop
+            // never collected one, and inventing a plausible-looking real
+            // address would be worse than an obvious placeholder.
+            deliveryAddress: {
+              name: me.name ?? "Curless Buyer",
+              line1: "1 Demo Street",
+              city: "HongKong",
+              state: "HK",
+              countryCode: "HK",
+              zip: "999077"
+            }
+          }
+        });
+      } catch (err) {
+        const e = err;
+        return text({
+          ordered: false,
+          blocked: "uaag_intent_refused",
+          message: `\u94F6\u8054\u6CA1\u6709\u63A5\u53D7\u8FD9\u7B14\u610F\u56FE:${e.message}`,
+          declined: e.declined ?? false,
+          sessionId: session.sessionId,
+          next: "repeat what UnionPay said and stop. Do NOT retry, and do NOT pay another way without asking."
+        });
+      }
+      let checkout;
+      try {
+        checkout = await uaagCheckout(uaagOpts, {
+          paymentIntentId: session.sessionId,
+          cardId: card.id
+        });
+      } catch (err) {
+        const e = err;
+        return text({
+          ordered: false,
+          blocked: "uaag_checkout_refused",
+          message: `\u94F6\u8054\u6536\u94F6\u53F0\u6CA1\u80FD\u5F00:${e.message}`,
+          declined: e.declined ?? false,
+          sessionId: session.sessionId,
+          next: "repeat what UnionPay said and stop."
+        });
+      }
+      return text({
+        // Never true on this path. UnionPay issues a credential; the merchant
+        // charges it, and Sinocare cannot.
+        ordered: false,
+        awaitingPayment: true,
+        message: "\u94F6\u8054\u6536\u94F6\u53F0\u5DF2\u5F00\u597D\u3002\u5728\u6D4F\u89C8\u5668\u91CC\u5B8C\u6210 3DS / Passkey \u8BA4\u8BC1\u540E,\u94F6\u8054\u4F1A\u5411\u6211\u4EEC\u56DE\u8C03\u4E00\u6B21\u6027\u652F\u4ED8\u51ED\u8BC1\u3002",
+        checkoutUrl: checkout.upi.checkoutUrl ?? null,
+        srcCorrelationId: checkout.srcCorrelationId,
+        paymentIntentId: session.sessionId,
+        sessionId: session.sessionId,
+        merchantId: session.merchantId,
+        card: { id: card.id, last4: card.panLastFour },
+        product: session.name,
+        total: session.amountDisplay,
+        // ⚠️ The honest ending, as data rather than prose — so the card and the
+        // model both get it instead of one of them inferring a sale.
+        settlement: {
+          settled: false,
+          by: "merchant",
+          reason: "UnionPay \u628A\u4E00\u6B21\u6027\u652F\u4ED8\u51ED\u8BC1\u4EA4\u7ED9 Agent,\u7531\u5546\u6237\u7684\u6536\u5355\u673A\u6784\u6263\u6B3E\u3002\u4E09\u8BFA\u6CA1\u6709\u94F6\u8054\u6536\u5355,\u6240\u4EE5\u8FD9\u7B14\u4E0D\u4F1A\u88AB\u6263\u6B3E,\u4E5F\u4E0D\u4F1A\u751F\u6210\u8BA2\u5355\u3002"
+        },
+        next: "show the person the checkoutUrl. When they say they are done, call get_sinocare_uaag_status with this paymentIntentId \u2014 this server is never told when they finish. Do NOT claim the order was placed, and do NOT fall back to another rail without asking."
+      });
+    }
+    if (req.params.name === "get_sinocare_uaag_status") {
+      if (!TOKEN) {
+        return text({ error: "sinocare-demo: AGENTBANK_AGENT_TOKEN is not set" });
+      }
+      const paymentIntentId = String(args.paymentIntentId ?? "");
+      if (!paymentIntentId) {
+        return text({ error: "paymentIntentId is required (from start_sinocare_uaag_handoff)" });
+      }
+      const state = await uaagCheckoutState({ baseUrl: API_BASE, token: TOKEN }, paymentIntentId);
+      return text({
+        // ⚠️ `issued` is not `paid`, and the two are one word apart in every
+        // language this will be read in. A credential exists; nobody charged it.
+        issued: state.issued,
+        ordered: false,
+        paid: false,
+        paymentIntentId,
+        credential: state.credential ?? null,
+        issuedAt: state.issuedAt ?? null,
+        paymentIntentStatus: state.paymentIntentStatus,
+        message: state.issued ? "\u94F6\u8054\u5DF2\u7ECF\u7B7E\u53D1\u4E86\u4E00\u6B21\u6027\u652F\u4ED8\u51ED\u8BC1(\u4EE4\u724C + DTVC)\u3002\u5230\u6B64\u4E3A\u6B62 \u2014\u2014 \u4E09\u8BFA\u6CA1\u6709\u94F6\u8054\u6536\u5355,\u8FD9\u7B14\u4E0D\u4F1A\u88AB\u6263\u6B3E\u3002" : "\u8FD8\u6CA1\u6709\u3002\u6301\u5361\u4EBA\u8FD8\u6CA1\u5728\u94F6\u8054\u9875\u9762\u4E0A\u5B8C\u6210\u8BA4\u8BC1,\u6216\u8005\u521A\u5B8C\u6210\u3001\u56DE\u8C03\u8FD8\u6CA1\u5230\u3002",
+        next: state.issued ? "say plainly that UnionPay issued the credential and the demo stops there \u2014 nothing was charged and no order exists. Do NOT call it paid." : "tell them it is not done yet and let them finish on UnionPay\u2019s page. Do not retry in a tight loop."
+      });
+    }
     if (req.params.name === "start_sinocare_wallet_handoff") {
       if (!TOKEN) {
         return text({ error: "sinocare-demo: AGENTBANK_AGENT_TOKEN is not set" });
@@ -1247,7 +1435,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
         ordered: false,
         awaitingPayment: true,
         message: "\u5728\u6D4F\u89C8\u5668\u91CC\u6253\u5F00\u8FD9\u4E2A\u94FE\u63A5,\u770B\u6E05\u91D1\u989D\u518D\u6279\u51C6\u3002\u8FD9\u91CC\u8FD8\u6CA1\u6709\u6263\u4EFB\u4F55\u6B3E\u3002",
-        payUrl: `${API_BASE}/buyer/pay?session=${encodeURIComponent(session.sessionId)}`,
+        payUrl: `${WALLET_BASE}/buyer/pay?session=${encodeURIComponent(session.sessionId)}`,
         sessionId: session.sessionId,
         product: session.name,
         total: session.amountDisplay,