@devlab.group/agent-commerce 2.1.0 → 2.2.1

package/dist/cli/chunk-AA3FIEAR.js

@@ -0,0 +1,27 @@
+// src/payments/mpp/constants.ts
+var MPP_SPEC_COMMIT = "806fdb8b8c92cda5c84b8660558921b6bbeef7e0";
+var MPP_SPEC_DRAFTS = {
+  core: "draft-httpauth-payment-01",
+  intent: "draft-payment-intent-charge-00",
+  method: "draft-evm-charge-00"
+};
+var MPP_MIN_CHALLENGE_SECRET_LENGTH = 32;
+var MPPX_VERSION = "0.13.1";
+var MPP_PROFILE = {
+  intent: "charge",
+  method: "evm",
+  credentialType: "authorization",
+  assetSymbol: "USDC",
+  assetDecimals: 6
+};
+var MPP_NETWORKS = ["eip155:31337", "eip155:84532", "eip155:8453"];
+var MPP_DEFAULT_NETWORK = "eip155:84532";
+var MPP_DEFAULT_PAYMENT_FLOW = "upfront";
+function isMppNetwork(value) {
+  return MPP_NETWORKS.includes(value);
+}
+var MPP_SUPPORTED_SPEC = `mpp/${MPP_SPEC_DRAFTS.core} intent=${MPP_PROFILE.intent} method=${MPP_PROFILE.method}`;
+
+export { MPPX_VERSION, MPP_DEFAULT_NETWORK, MPP_DEFAULT_PAYMENT_FLOW, MPP_MIN_CHALLENGE_SECRET_LENGTH, MPP_NETWORKS, MPP_PROFILE, MPP_SPEC_COMMIT, MPP_SPEC_DRAFTS, MPP_SUPPORTED_SPEC, isMppNetwork };
+//# sourceMappingURL=chunk-AA3FIEAR.js.map
+//# sourceMappingURL=chunk-AA3FIEAR.js.map

package/dist/cli/chunk-AA3FIEAR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/payments/mpp/constants.ts"],"names":[],"mappings":";AAoBO,IAAM,eAAA,GAAkB;AAGxB,IAAM,eAAA,GAAkB;AAAA,EAC7B,IAAA,EAAM,2BAAA;AAAA,EACN,MAAA,EAAQ,gCAAA;AAAA,EACR,MAAA,EAAQ;AACV;AAMO,IAAM,+BAAA,GAAkC;AAGxC,IAAM,YAAA,GAAe;AAUrB,IAAM,WAAA,GAAc;AAAA,EACzB,MAAA,EAAQ,QAAA;AAAA,EACR,MAAA,EAAQ,KAAA;AAAA,EACR,cAAA,EAAgB,eAAA;AAAA,EAChB,WAAA,EAAa,MAAA;AAAA,EACb,aAAA,EAAe;AACjB;AAGO,IAAM,YAAA,GAAe,CAAC,cAAA,EAAgB,cAAA,EAAgB,aAAa;AAKnE,IAAM,mBAAA,GAAkC;AAOxC,IAAM,wBAAA,GAA4C;AAElD,SAAS,aAAa,KAAA,EAAoC;AAC/D,EAAA,OAAQ,YAAA,CAAmC,SAAS,KAAK,CAAA;AAC3D;AAGO,IAAM,kBAAA,GAAqB,OAAO,eAAA,CAAgB,IAAI,WAAW,WAAA,CAAY,MAAM,CAAA,QAAA,EAAW,WAAA,CAAY,MAAM,CAAA","file":"chunk-AA3FIEAR.js","sourcesContent":["/**\n * The one MPP profile this rail targets.\n *\n * MPP combines a core HTTP authentication layer, an intent, a method and\n * optional extensions. These constants identify the selected combination and\n * the exact specification revision.\n *\n * Importing this metadata does not load `mppx`.\n */\nimport type { X402PaymentFlow } from '../x402/payment-flow';\n\n/** Upstream specification repository the pinned drafts were read from */\nexport const MPP_SPEC_REPOSITORY = 'https://github.com/tempoxyz/mpp-specs';\n\n/**\n * Upstream commit the pinned drafts were read at.\n *\n * A draft's content can change without its `-00` name changing, so the name\n * alone does not identify a document; the commit does.\n */\nexport const MPP_SPEC_COMMIT = '806fdb8b8c92cda5c84b8660558921b6bbeef7e0';\n\n/** The core HTTP authentication draft, the `charge` intent, and its EVM method */\nexport const MPP_SPEC_DRAFTS = {\n  core: 'draft-httpauth-payment-01',\n  intent: 'draft-payment-intent-charge-00',\n  method: 'draft-evm-charge-00',\n} as const;\n\n/**\n * Minimum accepted `challengeSecret.length`. This is a configuration floor,\n * not an entropy check.\n */\nexport const MPP_MIN_CHALLENGE_SECRET_LENGTH = 32;\n\n/** Exact `mppx` release the rail is pinned to */\nexport const MPPX_VERSION = '0.13.1';\n\n/**\n * The pinned profile.\n *\n * `intent`, `method` and `credentialType` copy MPP wire identifiers from\n * `mppx` so this module has no peer import; tests detect drift. `assetSymbol`\n * is the pricing currency an MPP resource must use. EVM charge requests carry a\n * numeric `chainId` and token address instead.\n */\nexport const MPP_PROFILE = {\n  intent: 'charge',\n  method: 'evm',\n  credentialType: 'authorization',\n  assetSymbol: 'USDC',\n  assetDecimals: 6,\n} as const;\n\n/** Supported CAIP-2 networks; gateway config applies the x402 mainnet guardrails */\nexport const MPP_NETWORKS = ['eip155:31337', 'eip155:84532', 'eip155:8453'] as const;\n\nexport type MppNetwork = (typeof MPP_NETWORKS)[number];\n\n/** Default network: Base Sepolia. The local Anvil chain is `eip155:31337` */\nexport const MPP_DEFAULT_NETWORK: MppNetwork = 'eip155:84532';\n\n/**\n * Default payment flow: `upfront` settles before the backend runs. The\n * `charge` intent counts a backend call made before verification completes as\n * partial access, and EVM charge verification includes the transfer itself.\n */\nexport const MPP_DEFAULT_PAYMENT_FLOW: X402PaymentFlow = 'upfront';\n\nexport function isMppNetwork(value: string): value is MppNetwork {\n  return (MPP_NETWORKS as readonly string[]).includes(value);\n}\n\n/** Compact descriptor value naming the core draft, intent and method */\nexport const MPP_SUPPORTED_SPEC = `mpp/${MPP_SPEC_DRAFTS.core} intent=${MPP_PROFILE.intent} method=${MPP_PROFILE.method}`;\n"]}

package/dist/cli/chunk-FHCFR2GS.js

@@ -0,0 +1,17 @@
+// src/authorization/ap2/constants.ts
+var AP2_SPEC_VERSION = "0.2.0";
+var AP2_MODES = ["direct"];
+var AP2_SIGNING_ALGORITHM = "ES256";
+var AP2_KEY_TYPE = "EC";
+var AP2_JWK_CURVE = "P-256";
+var AP2_JWK_COORDINATE_BYTES = 32;
+var AP2_JWK_MEMBERS = ["kty", "crv", "x", "y", "kid", "alg", "use"];
+var AP2_CHECKOUT_MANDATE_VCT = "mandate.checkout.1";
+var AP2_CHECKOUT_PROFILE = "agent-commerce/ap2/checkout/v1";
+var AP2_DIGEST_ALGORITHM = "sha-256";
+var AP2_DEFAULT_CLOCK_SKEW_SECONDS = 60;
+var AP2_MAX_CLOCK_SKEW_SECONDS = 300;
+
+export { AP2_CHECKOUT_MANDATE_VCT, AP2_CHECKOUT_PROFILE, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_DIGEST_ALGORITHM, AP2_JWK_COORDINATE_BYTES, AP2_JWK_CURVE, AP2_JWK_MEMBERS, AP2_KEY_TYPE, AP2_MAX_CLOCK_SKEW_SECONDS, AP2_MODES, AP2_SIGNING_ALGORITHM, AP2_SPEC_VERSION };
+//# sourceMappingURL=chunk-FHCFR2GS.js.map
+//# sourceMappingURL=chunk-FHCFR2GS.js.map

package/dist/cli/chunk-FHCFR2GS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/authorization/ap2/constants.ts"],"names":[],"mappings":";AAQO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,SAAA,GAAY,CAAC,QAAQ;AAO3B,IAAM,qBAAA,GAAwB;AAG9B,IAAM,YAAA,GAAe;AACrB,IAAM,aAAA,GAAgB;AAGtB,IAAM,wBAAA,GAA2B;AAOjC,IAAM,eAAA,GAAkB,CAAC,KAAA,EAAO,KAAA,EAAO,KAAK,GAAA,EAAK,KAAA,EAAO,OAAO,KAAK;AAOpE,IAAM,wBAAA,GAA2B;AAQjC,IAAM,oBAAA,GAAuB;AAO7B,IAAM,oBAAA,GAAuB;AAG7B,IAAM,8BAAA,GAAiC;AAMvC,IAAM,0BAAA,GAA6B","file":"chunk-FHCFR2GS.js","sourcesContent":["/**\n * Pinned AP2 identifiers and key policy.\n *\n * AP2 v0.2.0 (2026-04-28, commit b4587ac) is the tagged release this gateway\n * verifies against; unversioned `main` is never implemented against. Config,\n * the verifier and `doctor` all read these, so a bump lands in one place.\n */\n\nexport const AP2_SPEC_VERSION = '0.2.0';\n\n/**\n * Direct only. Autonomous mode needs open mandates, cnf-bound agent keys and\n * constraint evaluation over `checkout.line_items`, none of which is\n * implemented, so it is refused rather than partly served.\n */\nexport const AP2_MODES = ['direct'] as const;\nexport type Ap2Mode = (typeof AP2_MODES)[number];\n\n/**\n * A single algorithm, so `alg=none` and the HMAC family are excluded by\n * construction rather than by a denylist\n */\nexport const AP2_SIGNING_ALGORITHM = 'ES256';\n\n/** The key type and curve ES256 implies. Any other pair is refused at load */\nexport const AP2_KEY_TYPE = 'EC';\nexport const AP2_JWK_CURVE = 'P-256';\n\n/** Byte length of a P-256 coordinate, before base64url encoding */\nexport const AP2_JWK_COORDINATE_BYTES = 32;\n\n/**\n * JWK members a verification key may carry. An allowlist, so private material\n * (`d`) and URL members (`x5u`, `jku`) are refused without the list naming\n * them. Keys are configured inline and never fetched; see docs/security.md.\n */\nexport const AP2_JWK_MEMBERS = ['kty', 'crv', 'x', 'y', 'kid', 'alg', 'use'] as const;\n\n/**\n * Compared against this literal, never as a prefix. `mandate.checkout.open.1`\n * carries spending constraints nothing here evaluates, so accepting it would\n * tell a buyer their limits were checked when nothing read them.\n */\nexport const AP2_CHECKOUT_MANDATE_VCT = 'mandate.checkout.1';\n\n/**\n * Merchant checkout JWTs declare this gateway-specific profile; AP2 leaves\n * the checkout payload out of scope. The identifier is a namespace that\n * clients do not dereference. Merchants sign it into each checkout JWT, so\n * changing the expected value would reject previously signed JWTs.\n */\nexport const AP2_CHECKOUT_PROFILE = 'agent-commerce/ap2/checkout/v1';\n\n/**\n * The only accepted SD-JWT `_sd_alg` (an absent one means sha-256). Any other\n * value is refused rather than hashed as sha-256, which would check a\n * presentation under an algorithm it never claimed.\n */\nexport const AP2_DIGEST_ALGORITHM = 'sha-256';\n\n/** Seconds of clock skew tolerated on mandate and checkout time claims */\nexport const AP2_DEFAULT_CLOCK_SKEW_SECONDS = 60;\n\n/**\n * Skew as wide as a mandate's validity window would stop `exp` rejecting\n * anything. An operator who needs more than five minutes has a clock to fix.\n */\nexport const AP2_MAX_CLOCK_SKEW_SECONDS = 300;\n"]}