@devlab.group/agent-commerce 1.4.0 → 1.5.0

package/dist/constants-6mypC60h.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The one MPP profile this rail targets.
+ *
+ * MPP combines a core HTTP authentication layer, an intent, a method and
+ * optional extensions. These constants identify the selected combination and
+ * the exact specification revision.
+ *
+ * Importing this metadata does not load `mppx`.
+ */
+/** Upstream specification repository the pinned drafts were read from */
+declare const MPP_SPEC_REPOSITORY = "https://github.com/tempoxyz/mpp-specs";
+/**
+ * Upstream commit the pinned drafts were read at.
+ *
+ * A draft's content can change without its `-00` name changing, so the name
+ * alone does not identify a document; the commit does.
+ */
+declare const MPP_SPEC_COMMIT = "806fdb8b8c92cda5c84b8660558921b6bbeef7e0";
+/** The core HTTP authentication draft, the `charge` intent, and its EVM method */
+declare const MPP_SPEC_DRAFTS: {
+    readonly core: "draft-httpauth-payment-00";
+    readonly intent: "draft-payment-intent-charge-00";
+    readonly method: "draft-evm-charge-00";
+};
+/** Exact `mppx` release the rail is pinned to */
+declare const MPPX_VERSION = "0.10.1";
+/**
+ * The pinned profile.
+ *
+ * `intent`, `method` and `credentialType` copy MPP wire identifiers from
+ * `mppx` so this module has no peer import; tests detect drift. `assetSymbol`
+ * is the pricing currency an MPP resource must use. EVM charge requests carry a
+ * numeric `chainId` and token address instead.
+ */
+declare const MPP_PROFILE: {
+    readonly intent: "charge";
+    readonly method: "evm";
+    readonly credentialType: "authorization";
+    readonly assetSymbol: "USDC";
+    readonly assetDecimals: 6;
+};
+/** Supported CAIP-2 networks; gateway config applies the x402 mainnet guardrails */
+declare const MPP_NETWORKS: readonly ["eip155:84532", "eip155:8453"];
+type MppNetwork = (typeof MPP_NETWORKS)[number];
+/**
+ * Compact descriptor value naming the core draft, intent and method
+ */
+declare const MPP_SUPPORTED_SPEC: string;
+
+export { type MppNetwork as M, MPPX_VERSION as a, MPP_PROFILE as b, MPP_SPEC_COMMIT as c, MPP_SPEC_DRAFTS as d, MPP_SPEC_REPOSITORY as e, MPP_SUPPORTED_SPEC as f };

package/dist/index.d.ts

@@ -1,11 +1,12 @@
 import { f as Ap2AuthorizationConfig } from './types-CJtwLu1c.js';
-import { I as IsoTimestamp, D as DecimalAmount, P as PaymentMethodName, a as CommerceResource, b as PaymentSubmission, B as BackendHandler, A as AdapterDescriptor, c as AdapterHealth, R as ResourceRegistry, d as PaymentProvider, L as Logger, C as Clock, e as IdGenerator } from './runtime-CKq3d_3K.js';
-export { f as AuthorizationMethodName, g as BackendMethod, h as DEFAULT_BACKEND_TIMEOUT_MS, J as JsonSchema, N as NOOP_LOGGER, i as PROTOCOL_NAMES, j as PaymentChallenge, k as PaymentContext, l as PaymentRequirement, m as PaymentResult, n as PaymentSettlementContext, o as PaymentVerificationContext, p as Pricing, q as ProtocolName, s as systemClock } from './runtime-CKq3d_3K.js';
+import { I as IsoTimestamp, D as DecimalAmount, P as PaymentMethodName, a as CommerceResource, b as PaymentSubmission, B as BackendHandler, A as AdapterDescriptor, c as AdapterHealth, R as ResourceRegistry, d as PaymentProvider, L as Logger, C as Clock, e as IdGenerator } from './runtime-DC5XQ9Cc.js';
+export { f as AuthorizationMethodName, g as BackendMethod, h as DEFAULT_BACKEND_TIMEOUT_MS, J as JsonSchema, N as NOOP_LOGGER, i as PAYMENT_METHOD_NAMES, j as PROTOCOL_NAMES, k as PaymentChallenge, l as PaymentContext, m as PaymentRequirement, n as PaymentResult, o as PaymentSettlementContext, p as PaymentVerificationContext, q as Pricing, r as ProtocolName, s as systemClock } from './runtime-DC5XQ9Cc.js';
+import { M as MppNetwork } from './constants-6mypC60h.js';
 import { X as X402FacilitatorConfig } from './guardrails-Dmwi63KB.js';
-import { a as AuthorizationRequirement, b as AuthorizationSubmission, A as AuthorizationProvider } from './authorization-CPDcpJVa.js';
-export { c as AuthorizationFinalizeContext, d as AuthorizationRecord, e as AuthorizationVerification, f as AuthorizationVerificationContext } from './authorization-CPDcpJVa.js';
-import { D as DeliveredOutcome, P as PaymentRequiredOutcome, C as CommerceEvent, a as PaymentAttempt, b as CommerceReceipt, E as ExecutionPipeline, c as ProtocolAdapter, H as HttpProtocolAdapter, A as AdapterHttpRoute, d as ProtocolAdapterContext } from './protocol-adapter-CaMZj6Wm.js';
-export { e as COMMERCE_EVENT_TYPES, f as CanonicalRequest, g as CommerceEventType, h as EventSink, i as ExecutionOutcome, j as isHttpProtocolAdapter } from './protocol-adapter-CaMZj6Wm.js';
+import { a as AuthorizationRequirement, b as AuthorizationSubmission, A as AuthorizationProvider } from './authorization-DA7mjy_O.js';
+export { c as AuthorizationFinalizeContext, d as AuthorizationRecord, e as AuthorizationVerification, f as AuthorizationVerificationContext } from './authorization-DA7mjy_O.js';
+import { D as DeliveredOutcome, P as PaymentRequiredOutcome, C as CommerceEvent, a as PaymentAttempt, b as CommerceReceipt, E as ExecutionPipeline, c as ProtocolAdapter, H as HttpProtocolAdapter, A as AdapterHttpRoute, d as ProtocolAdapterContext } from './protocol-adapter-APRjs1E2.js';
+export { e as COMMERCE_EVENT_TYPES, f as CanonicalRequest, g as CommerceEventType, h as EventSink, i as ExecutionOutcome, j as isHttpProtocolAdapter } from './protocol-adapter-APRjs1E2.js';
 import { FastifyInstance } from 'fastify';
 import { IncomingMessage, ServerResponse } from 'node:http';
 
@@ -278,11 +279,10 @@ declare function parseAuthorizationHeader(raw: string | readonly string[] | unde
  * (MCP tool arguments, A2A message data). HTTP carries both in headers and
  * uses the two parse helpers directly.
  *
- * The payment method comes from the resource's own declaration. This is not
- * the place that decides which rail a resource uses, so a proof for a
- * resource with no configured rail is dropped rather than forwarded under an
- * invented method. The pipeline then treats the request as unpaid and decides
- * on its own terms.
+ * A payment proof is labelled with the resource's first method. `createGateway`
+ * puts provider-backed methods first so the label matches pipeline selection;
+ * custom registries must preserve that ordering. Without a method, the proof is
+ * dropped and the pipeline receives an unpaid request.
  */
 declare function extractReservedInputFields(rawInput: Record<string, unknown>, resource: CommerceResource | undefined, requestId?: string): {
     input: Record<string, unknown>;
@@ -303,6 +303,16 @@ interface BackendRequest {
     readonly resourceId: string;
     /** Validated resource input. */
     readonly input: unknown;
+    /**
+     * Names the *operation*, so the merchant can recognise a repeat of it.
+     *
+     * Not `requestId`, which is fresh per call and would make every retry look
+     * like new work. An adapter sets this only when it can derive a value that
+     * survives a client retry, a reconnect and a gateway restart; the HTTP
+     * executor forwards it as the `Idempotency-Key` request header. Absent
+     * means the protocol has no such notion, and the merchant sees no header.
+     */
+    readonly idempotencyKey?: string;
 }
 interface BackendResponse {
     readonly status: number;
@@ -536,6 +546,21 @@ interface GatewayConfig {
             readonly allowMainnet?: boolean;
             readonly allowUnauthenticatedFacilitator?: boolean;
         };
+        readonly mpp?: {
+            readonly enabled: boolean;
+            readonly network: MppNetwork;
+            readonly rpcUrl: string;
+            readonly asset: string;
+            readonly assetName: string;
+            readonly assetVersion: string;
+            readonly recipient: string;
+            readonly realm: string;
+            readonly challengeSecret: string;
+            readonly challengeTtlSeconds?: number;
+            readonly facilitator: X402FacilitatorConfig;
+            readonly allowMainnet?: boolean;
+            readonly allowUnauthenticatedFacilitator?: boolean;
+        };
     };
     /**
      * Absent when no `authorization:` block is configured, which is how every
@@ -630,8 +655,14 @@ declare class AcpProtocolAdapter implements HttpProtocolAdapter {
     private readonly token;
     private readonly operations;
     private readonly idempotencyOptions;
-    /** Derived once: the token is fixed, and only its digest may be persisted. */
-    private readonly identityHash;
+    /**
+     * What an idempotency claim is scoped to, from `context.publicBaseUrl`.
+     *
+     * Not readonly because, unlike the token, it is known only once the adapter
+     * starts. Worth that: scoping by the credential meant a rotation freed
+     * every outstanding claim.
+     */
+    private deployment;
     private readonly discoveryMetadata;
     private idempotency;
     private resources;