@devlab.group/agent-commerce 0.2.0-beta.0 → 1.0.0

package/dist/mcp.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpProtocolAdapter } from './protocol-adapter-CtB0sOnV.js';
+import { H as HttpProtocolAdapter } from './protocol-adapter-CZPOb9uG.js';
 import 'node:http';
-import './runtime-Bie-9FAM.js';
+import './runtime-B-9IjMbO.js';
 
 /**
  * MCP protocol adapter.

package/dist/mcp.js

@@ -1,4 +1,4 @@
-import { PACKAGE_VERSION, toCommerceError, CommerceError, PAYMENT_INPUT_FIELD, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, toPaymentRequiredEnvelope } from './chunk-ASK67X56.js';
+import { PACKAGE_VERSION, toCommerceError, CommerceError, PAYMENT_INPUT_FIELD, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, toPaymentRequiredEnvelope } from './chunk-BQNE3A5H.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';

package/dist/{protocol-adapter-CtB0sOnV.d.ts → protocol-adapter-CZPOb9uG.d.ts}

@@ -1,5 +1,5 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { I as IsoTimestamp, j as PaymentResult, o as ProtocolName, l as PaymentSubmission, i as PaymentRequirement, A as AdapterDescriptor, R as ResourceRegistry, L as Logger, c as Clock, d as IdGenerator, a as AdapterHealth } from './runtime-Bie-9FAM.js';
+import { I as IsoTimestamp, j as PaymentResult, o as ProtocolName, l as PaymentSubmission, i as PaymentRequirement, A as AdapterDescriptor, R as ResourceRegistry, L as Logger, c as Clock, d as IdGenerator, a as AdapterHealth } from './runtime-B-9IjMbO.js';
 
 /**
  * Canonical commerce events.

package/dist/{runtime-Bie-9FAM.d.ts → runtime-B-9IjMbO.d.ts}

@@ -12,9 +12,9 @@
  * boundaries. Never treat this as trusted input without validation.
  */
 type JsonSchema = Record<string, unknown>;
-/** Protocol surfaces a resource can be exposed through in v0.1. */
+/** Protocol surfaces a resource can be exposed through in this release. */
 type ProtocolName = 'http' | 'mcp';
-/** Payment methods a resource can accept in v0.1. */
+/** Payment methods a resource can accept in this release. */
 type PaymentMethodName = 'x402';
 /** ISO-8601 timestamp string, always UTC with millisecond precision. */
 type IsoTimestamp = string;

package/dist/x402.d.ts

@@ -1,6 +1,6 @@
-import { X as X402FacilitatorConfig } from './guardrails-Di_yI_DW.js';
-export { F as FacilitatorAuth } from './guardrails-Di_yI_DW.js';
-import { L as Logger, c as Clock, d as IdGenerator, b as PaymentProvider } from './runtime-Bie-9FAM.js';
+import { X as X402FacilitatorConfig } from './guardrails-Dmwi63KB.js';
+export { F as FacilitatorAuth } from './guardrails-Dmwi63KB.js';
+import { L as Logger, c as Clock, d as IdGenerator, b as PaymentProvider } from './runtime-B-9IjMbO.js';
 
 interface NetworkProfile {
     /** CAIP-2 identifier, e.g. `eip155:84532`. */
@@ -10,13 +10,22 @@ interface NetworkProfile {
     readonly displayName: string;
     readonly kind: 'testnet' | 'mainnet';
     /**
-     * The USDC deployment this network is expected to settle in. Enforced only
-     * on mainnet (see `guardrails.ts`) — a testnet is where a mock token is a
-     * legitimate thing to point at.
+     * The USDC deployment this network is expected to settle in, with the EIP-712
+     * domain the token actually reports. Enforced only on mainnet (see
+     * `guardrails.ts`) — a testnet is where a mock token is a legitimate thing to
+     * point at.
+     *
+     * `name` is not decorative and is not the symbol: it is signed into every
+     * buyer's EIP-712 domain, and the two USDC deployments disagree. Base Sepolia
+     * reports `"USDC"`; Base mainnet reports `"USD Coin"`. Configure the wrong
+     * one and every payment is refused `invalid_exact_evm_token_name_mismatch`
+     * after the buyer has signed. Read back from the contracts, not assumed.
      */
     readonly canonicalAsset?: {
         readonly symbol: string;
         readonly address: string;
+        readonly name: string;
+        readonly version: string;
     };
 }
 declare const SUPPORTED_NETWORK_IDS: readonly string[];
@@ -120,6 +129,11 @@ interface X402ProviderOptions {
      * default — see `guardrails.ts`.
      */
     readonly allowMainnet?: boolean;
+    /**
+     * Required to be `true` to settle on a mainnet through a facilitator that
+     * takes no credential. Never a default.
+     */
+    readonly allowUnauthenticatedFacilitator?: boolean;
     readonly logger?: Logger;
     readonly clock?: Clock;
     readonly ids?: IdGenerator;

package/dist/x402.js

@@ -1,11 +1,11 @@
-import { assertPayToIsNotDevAddress, resolveX402Deployment, assertDevKeyIsLocalOnly, describeDeploymentMode } from './chunk-MQMKQGAB.js';
-export { SUPPORTED_NETWORK_IDS } from './chunk-MQMKQGAB.js';
-import { CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION } from './chunk-ASK67X56.js';
+import { assertPayToIsNotDevAddress, resolveX402Deployment, assertDevKeyIsLocalOnly, describeDeploymentMode } from './chunk-MEPETSP6.js';
+export { SUPPORTED_NETWORK_IDS } from './chunk-MEPETSP6.js';
+import { CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION } from './chunk-BQNE3A5H.js';
 import { PaymentRequirementsV2Schema, PaymentPayloadV2Schema } from '@x402/core/schemas';
 import { getAddress, toHex, isAddress, createWalletClient, http, publicActions, createPublicClient, HttpRequestError, TimeoutError, WaitForTransactionReceiptTimeoutError, encodeAbiParameters, keccak256, ContractFunctionRevertedError, ContractFunctionExecutionError } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { x402Facilitator } from '@x402/core/facilitator';
-import { HTTPFacilitatorClient, FacilitatorResponseError } from '@x402/core/http';
+import { HTTPFacilitatorClient } from '@x402/core/http';
 import { isEIP3009Payload, toFacilitatorEvmSigner } from '@x402/evm';
 import { registerExactEvmScheme } from '@x402/evm/exact/facilitator';
 
@@ -16,9 +16,9 @@ function chainIdFromCaip2(network) {
   const chainId = Number(match[1]);
   return Number.isSafeInteger(chainId) && chainId > 0 ? chainId : void 0;
 }
-function buildLocalChain(rpcUrl) {
+function buildLocalChain(rpcUrl, chainId = LOCAL_CHAIN_ID) {
   return {
-    id: LOCAL_CHAIN_ID,
+    id: chainId,
     name: "agent-commerce-local",
     nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
     rpcUrls: {
@@ -26,9 +26,9 @@ function buildLocalChain(rpcUrl) {
     }
   };
 }
-function createLocalPublicClient(rpcUrl, timeoutMs) {
+function createLocalPublicClient(rpcUrl, timeoutMs, chainId) {
   return createPublicClient({
-    chain: buildLocalChain(rpcUrl),
+    chain: buildLocalChain(rpcUrl, chainId),
     transport: http(rpcUrl, { timeout: timeoutMs } )
   });
 }
@@ -196,12 +196,41 @@ function createLocalFacilitatorBinding(client, network, isTransportError) {
     }
   };
 }
-function createRemoteFacilitatorBinding(options, isTransportError) {
+function cdpAuthHeaders(apiKeyId, apiKeySecret) {
+  const loading = import('@coinbase/x402').then(
+    (mod) => mod.createCdpAuthHeaders(apiKeyId, apiKeySecret),
+    (cause) => {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        'x402 provider: facilitator.auth.type is "cdp", which needs the optional peer "@coinbase/x402". Install it (npm install @coinbase/x402), or use a facilitator that accepts a static token with auth.type "bearer".',
+        { cause }
+      );
+    }
+  );
+  loading.catch(() => {
+  });
+  return async () => {
+    const create = await loading;
+    if (!create) {
+      throw new CommerceError(
+        "PAYMENT_PROVIDER_UNAVAILABLE",
+        "x402 provider: @coinbase/x402 returned no auth-header factory"
+      );
+    }
+    return await create();
+  };
+}
+function createRemoteFacilitatorBinding(options) {
   const auth = options.auth;
-  const createAuthHeaders = auth.type === "bearer" ? async () => {
-    const headers = { Authorization: `Bearer ${auth.token}` };
-    return { verify: headers, settle: headers, supported: headers };
-  } : void 0;
+  let createAuthHeaders;
+  if (auth.type === "bearer") {
+    createAuthHeaders = async () => {
+      const headers = { Authorization: `Bearer ${auth.token}` };
+      return { verify: headers, settle: headers, supported: headers };
+    };
+  } else if (auth.type === "cdp") {
+    createAuthHeaders = cdpAuthHeaders(auth.apiKeyId, auth.apiKeySecret);
+  }
   const client = new HTTPFacilitatorClient({
     url: options.url,
     timeoutMs: options.timeoutMs ?? SETTLEMENT_CONFIRMATION_TIMEOUT_MS,
@@ -216,7 +245,7 @@ function createRemoteFacilitatorBinding(options, isTransportError) {
         try {
           return await call();
         } catch (err) {
-          if (err instanceof FacilitatorResponseError || isTransportError(err)) failed = true;
+          failed = true;
           throw err;
         }
       };
@@ -261,6 +290,14 @@ var DEFAULT_MAX_TIMEOUT_SECONDS = 60;
 var DEFAULT_MIME_TYPE = "application/json";
 var HEALTH_TIMEOUT_MS = 4e3;
 var SETTLEMENT_PENDING_REASON = "settlement_pending";
+var MAX_REASON_LENGTH = 64;
+var REASON_SHAPE = /^[a-z0-9_.-]+$/i;
+function sanitiseReason(reason, fallback) {
+  if (reason === void 0) return fallback;
+  const trimmed = reason.trim();
+  if (trimmed.length === 0 || trimmed.length > MAX_REASON_LENGTH) return fallback;
+  return REASON_SHAPE.test(trimmed) ? trimmed : fallback;
+}
 var DEFAULT_IDS = {
   next: (prefix) => `${prefix ? `${prefix}_` : ""}${crypto.randomUUID()}`
 };
@@ -288,8 +325,11 @@ function createX402PaymentProvider(options) {
     network: options.network,
     payTo: options.payTo,
     asset: options.asset,
+    assetName: options.assetName,
+    assetVersion: options.assetVersion,
     facilitator: options.facilitator,
-    ...options.allowMainnet !== void 0 ? { allowMainnet: options.allowMainnet } : {}
+    ...options.allowMainnet !== void 0 ? { allowMainnet: options.allowMainnet } : {},
+    ...options.allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator: options.allowUnauthenticatedFacilitator } : {}
   });
   const network = options.network;
   let binding;
@@ -310,12 +350,16 @@ function createX402PaymentProvider(options) {
     }
     binding = createLocalFacilitatorBinding(client, network, isProviderUnavailableError);
   } else {
-    binding = createRemoteFacilitatorBinding(
-      { url: options.facilitator.url, auth: options.facilitator.auth },
-      isProviderUnavailableError
-    );
+    binding = createRemoteFacilitatorBinding({
+      url: options.facilitator.url,
+      auth: options.facilitator.auth
+    });
   }
-  const healthPublicClient = createLocalPublicClient(options.rpcUrl, HEALTH_TIMEOUT_MS);
+  const healthPublicClient = createLocalPublicClient(
+    options.rpcUrl,
+    HEALTH_TIMEOUT_MS,
+    profile.chainId
+  );
   const clock = options.clock ?? systemClock;
   const ids = options.ids ?? DEFAULT_IDS;
   const logger = options.logger ?? NOOP_LOGGER;
@@ -445,7 +489,7 @@ function createX402PaymentProvider(options) {
     } catch {
       return rejected("malformed_payment_payload");
     }
-    if (authorizedValue < required) {
+    if (authorizedValue !== required) {
       return rejected("wrong_amount");
     }
     const scope = binding.open();
@@ -473,7 +517,13 @@ function createX402PaymentProvider(options) {
           { details: { reportedReason: sdkResult.invalidReason ?? "invalid_payment" } }
         );
       }
-      return rejected(sdkResult.invalidReason ?? "invalid_payment");
+      if (sdkResult.invalidReason !== void 0) {
+        logger.debug(
+          { reportedReason: sdkResult.invalidReason },
+          "x402 verify(): facilitator rejection reason"
+        );
+      }
+      return rejected(sanitiseReason(sdkResult.invalidReason, "invalid_payment"));
     }
     const payloadChainId = chainIdFromCaip2(payload.accepted.network);
     if (payloadChainId === void 0) {
@@ -558,8 +608,14 @@ function createX402PaymentProvider(options) {
           }
         );
       }
+      if (sdkResult.errorReason !== void 0) {
+        logger.debug(
+          { reportedReason: sdkResult.errorReason },
+          "x402 settle(): facilitator failure reason"
+        );
+      }
       return {
-        ...rejectedSettlement(sdkResult.errorReason ?? "settlement_failed"),
+        ...rejectedSettlement(sanitiseReason(sdkResult.errorReason, "settlement_failed")),
         network: sdkResult.network,
         ...sdkResult.payer !== void 0 ? { payer: sdkResult.payer } : {}
       };