@devlab.group/agent-commerce 1.6.0 → 2.0.0

package/dist/{constants-Bkq04FRZ.d.ts → constants-BSBRlKRR.d.ts}

@@ -18,12 +18,12 @@ declare const MPP_SPEC_REPOSITORY = "https://github.com/tempoxyz/mpp-specs";
 declare const MPP_SPEC_COMMIT = "806fdb8b8c92cda5c84b8660558921b6bbeef7e0";
 /** The core HTTP authentication draft, the `charge` intent, and its EVM method */
 declare const MPP_SPEC_DRAFTS: {
-    readonly core: "draft-httpauth-payment-00";
+    readonly core: "draft-httpauth-payment-01";
     readonly intent: "draft-payment-intent-charge-00";
     readonly method: "draft-evm-charge-00";
 };
 /** Exact `mppx` release the rail is pinned to */
-declare const MPPX_VERSION = "0.10.1";
+declare const MPPX_VERSION = "0.13.1";
 /**
  * The pinned profile.
  *

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { f as Ap2AuthorizationConfig } from './types-O6lg3Q5V.js';
+import { f as Ap2AuthorizationConfig } from './types-CVw6Sf46.js';
 import { I as IsoTimestamp, D as DecimalAmount, P as PaymentMethodName, a as CommerceResource, b as PaymentSubmission, B as BackendHandler, A as AdapterDescriptor, c as AdapterHealth, R as ResourceRegistry, d as PaymentProvider, L as Logger, C as Clock, e as IdGenerator } from './runtime-CiYbgGpi.js';
 export { f as AuthorizationMethodName, g as BackendMethod, h as DEFAULT_BACKEND_TIMEOUT_MS, J as JsonSchema, N as NOOP_LOGGER, i as PAYMENT_METHOD_NAMES, j as PROTOCOL_NAMES, k as PaymentChallenge, l as PaymentContext, m as PaymentRequirement, n as PaymentResult, o as PaymentSettlementContext, p as PaymentVerificationContext, q as Pricing, r as ProtocolName, s as systemClock } from './runtime-CiYbgGpi.js';
-import { M as MppNetwork } from './constants-Bkq04FRZ.js';
-import { X as X402FacilitatorConfig } from './guardrails-71XwtXlT.js';
+import { M as MppNetwork } from './constants-BSBRlKRR.js';
+import { X as X402PaymentFlow, a as X402FacilitatorConfig } from './payment-flow-DCS882tR.js';
 import { a as AuthorizationRequirement, b as AuthorizationSubmission, A as AuthorizationProvider } from './authorization-BpbWGGrf.js';
 export { c as AuthorizationFinalizeContext, d as AuthorizationRecord, e as AuthorizationVerification, f as AuthorizationVerificationContext } from './authorization-BpbWGGrf.js';
-import { D as DeliveredOutcome, P as PaymentRequiredOutcome, C as CommerceEvent, a as PaymentAttempt, b as CommerceReceipt, E as ExecutionPipeline, c as ProtocolAdapter, H as HttpProtocolAdapter, A as AdapterHttpRoute, d as ProtocolAdapterContext } from './protocol-adapter-DTkrXTev.js';
-export { e as COMMERCE_EVENT_TYPES, f as CanonicalRequest, g as CommerceEventType, h as EventSink, i as ExecutionOutcome, j as isHttpProtocolAdapter } from './protocol-adapter-DTkrXTev.js';
+import { D as DeliveredOutcome, P as PaymentRequiredOutcome, C as CommerceEvent, a as PaymentAttempt, b as CommerceReceipt, E as ExecutionPipeline, c as ProtocolAdapter, H as HttpProtocolAdapter, A as AdapterHttpRoute, d as ProtocolAdapterContext } from './protocol-adapter-DonxfAwa.js';
+export { e as COMMERCE_EVENT_TYPES, f as CanonicalRequest, g as CommerceEventType, h as EventSink, i as ExecutionOutcome, j as isHttpProtocolAdapter } from './protocol-adapter-DonxfAwa.js';
 import { FastifyInstance } from 'fastify';
 import { IncomingMessage, ServerResponse } from 'node:http';
 
@@ -265,6 +265,12 @@ interface BackendRequest {
      * when absent, the executor adds none.
      */
     readonly idempotencyKey?: string;
+    /**
+     * Adapter-supplied headers for the backend. Configured and executor-set
+     * headers take precedence. The HTTP executor filters sensitive and transport
+     * headers and rejects invalid names or values with `INPUT_INVALID`.
+     */
+    readonly backendHeaders?: Readonly<Record<string, string>>;
 }
 interface BackendResponse {
     readonly status: number;
@@ -315,9 +321,10 @@ interface ReceiptStore {
     /** Append a canonical event. Must not throw into the caller's flow */
     appendEvent(event: CommerceEvent): Promise<void>;
     /**
-     * Atomically claim a payment authorization before settlement: the gateway's
-     * replay defense, run for every paid request. Throws
-     * `CommerceError('PAYMENT_REPLAYED')` if `replayKey` was already reserved.
+     * Atomically reserve a payment authorization before settlement. If its
+     * `replayKey` is already reserved, throws `CommerceError('PAYMENT_REPLAYED')`
+     * with the existing attempt's `PaymentAttempt.status` in
+     * `details.attemptStatus` when available.
      */
     reservePaymentAttempt(reservation: PaymentAttemptReservation): Promise<PaymentAttempt>;
     updatePaymentAttempt(update: PaymentAttemptUpdate): Promise<void>;
@@ -417,6 +424,7 @@ type AcpProtocolConfig = {
     readonly idempotency: {
         readonly path: string;
         readonly retentionHours: number;
+        readonly merchantIdempotent: boolean;
     };
     readonly checkout: {
         readonly operations: Readonly<Record<AcpCheckoutOperation, string>>;
@@ -469,6 +477,10 @@ interface GatewayConfig {
             readonly assetDecimals: number;
             readonly payTo: string;
             readonly maxTimeoutSeconds: number;
+            /** Defaults to `authorization`, the x402 default */
+            readonly paymentFlow?: X402PaymentFlow;
+            /** Resources whose `paymentFlow` overrides the rail's, by resource id */
+            readonly resourcePaymentFlows?: Readonly<Record<string, X402PaymentFlow>>;
             readonly facilitator: X402FacilitatorConfig;
             readonly allowMainnet?: boolean;
             readonly allowUnauthenticatedFacilitator?: boolean;
@@ -484,6 +496,10 @@ interface GatewayConfig {
             readonly realm: string;
             readonly challengeSecret: string;
             readonly challengeTtlSeconds?: number;
+            /** Defaults to `authorization`: settle after a successful backend call */
+            readonly paymentFlow?: X402PaymentFlow;
+            /** Resources whose `paymentFlow` overrides the rail's, by resource id */
+            readonly resourcePaymentFlows?: Readonly<Record<string, X402PaymentFlow>>;
             readonly facilitator: X402FacilitatorConfig;
             readonly allowMainnet?: boolean;
             readonly allowUnauthenticatedFacilitator?: boolean;
@@ -528,18 +544,6 @@ interface GatewayInstance {
 }
 declare function createGateway(options: GatewayOptions): Promise<GatewayInstance>;
 
-/**
- * A2A (Agent2Agent) protocol adapter, experimental.
- *
- * Serves two paths: the configured mount (`/a2a`), where the JSON-RPC endpoint
- * lives, and the specification-fixed `/.well-known/agent-card.json`, declared
- * through `additionalHttpRoutes` so the gateway needs no A2A-specific routing.
- *
- * Only the synchronous `SendMessage` path is in scope; every other A2A method
- * is listed in `descriptor.unsupported` rather than half-served. This file
- * never calls a merchant backend and never inspects a payment object.
- */
-
 interface A2aAdapterOptions {
     readonly mountPath?: string;
     /** Agent name published on the card */
@@ -560,6 +564,9 @@ declare class A2aProtocolAdapter implements HttpProtocolAdapter {
     private started;
     private skillsById;
     private card;
+    private cardBody;
+    private cardEtag;
+    private pendingPayments;
     constructor(options?: A2aAdapterOptions);
     start(context: ProtocolAdapterContext): Promise<void>;
     /** `GET /.well-known/agent-card.json` */
@@ -568,6 +575,14 @@ declare class A2aProtocolAdapter implements HttpProtocolAdapter {
     handleHttp(req: IncomingMessage, res: ServerResponse): Promise<void>;
     private dispatch;
     private execute;
+    /**
+     * A message on a task waiting for an x402 extension payment, recognized by
+     * its `taskId` whether or not the header activated the extension again. Any
+     * other task id falls through to `parseInvocation`, which answers
+     * TaskNotFoundError.
+     */
+    private resumePayment;
+    private payPending;
     private taskIdentity;
     private taskResult;
     health(): Promise<AdapterHealth>;
@@ -580,12 +595,12 @@ declare function createA2aAdapter(options?: A2aAdapterOptions): A2aProtocolAdapt
  * A2A pins, kept in one place so nothing infers one version from another.
  *
  * The specification revision and the negotiation version look alike but
- * differ: `1.0.0` names the document this adapter was written against, `1.0`
+ * differ: `1.0.1` names the document this adapter was written against, `1.0`
  * is what a client negotiates on the wire. Neither is this package's version
  * (`PACKAGE_VERSION`).
  */
 /** A2A specification revision this adapter targets */
-declare const A2A_SPEC_VERSION = "1.0.0";
+declare const A2A_SPEC_VERSION = "1.0.1";
 /** Protocol negotiation version carried on the wire */
 declare const A2A_PROTOCOL_VERSION = "1.0";
 /**
@@ -626,6 +641,11 @@ interface AcpAdapterOptions {
     readonly idempotency: {
         readonly path: string;
         readonly retentionHours: number;
+        /**
+         * Declare that the merchant deduplicates by the derived `Idempotency-Key`.
+         * Allows a fresh retry after a 5xx. Defaults to false.
+         */
+        readonly merchantIdempotent?: boolean;
     };
     readonly discovery?: AcpDiscoveryMetadata;
 }