@devlab.group/agent-commerce 2.2.1 → 2.4.0

package/dist/cli/{chunk-QZ6TOMX6.js → chunk-AZDWFVDW.js}

@@ -1,16 +1,17 @@
-import { assertPayToIsNotDevAddress, resolveX402Deployment, assertDevKeyIsLocalOnly, describeRpc, x402OfferName } from './chunk-KTV52MCU.js';
+import { isWellKnownDevKey, assertPayToIsNotDevAddress, resolveX402Deployment, assertDevKeyIsLocalOnly, describeRpc, x402OfferName } from './chunk-WYOGIANL.js';
 import { findX402Network, normalizeAddress, X402_DEFAULT_PAYMENT_FLOW, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY, SETTLE_AFTER_BACKEND_METADATA_KEY, sameAddress, LOCAL_CHAIN_ID, isTransactionReference, isEvmAddress, describeDeploymentMode } from './chunk-OZ4LAWBK.js';
 import { computeReplayKey, computePermit2ReplayKey } from './chunk-OSTCU6ZK.js';
-import { PACKAGE_VERSION } from './chunk-QY3K6PEQ.js';
+import { PACKAGE_VERSION } from './chunk-UXB65XCS.js';
 import { CommerceError, systemClock, NOOP_LOGGER, redactedErrorText } from './chunk-QQ3WY5L3.js';
 import { isRecord } from './chunk-3M6U7ILB.js';
 import { x402ExactPermit2ProxyAddress, toFacilitatorEvmSigner, PERMIT2_ADDRESS } from '@x402/evm';
-import { isAddress, getAddress, formatUnits, createWalletClient, http, publicActions, createPublicClient, HttpRequestError, TimeoutError, WaitForTransactionReceiptTimeoutError, BaseError, ContractFunctionRevertedError, erc20Abi } from 'viem';
+import { isAddress, keccak256, stringToBytes, getAddress, formatUnits, createWalletClient, http, publicActions, createPublicClient, HttpRequestError, TimeoutError, WaitForTransactionReceiptTimeoutError, BaseError, ContractFunctionRevertedError, erc20Abi } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { HTTPFacilitatorClient } from '@x402/core/http';
 import { SettleError, VerifyError } from '@x402/core/types';
 import { x402Facilitator } from '@x402/core/facilitator';
 import { registerExactEvmScheme } from '@x402/evm/exact/facilitator';
+import { randomBytes } from 'crypto';
 import { PaymentPayloadV2Schema } from '@x402/core/schemas';
 
 // src/payments/x402/provider/constants.ts
@@ -799,6 +800,172 @@ function offerCurrency(offer, quoted) {
   const canonical = offer.profile.canonicalAsset;
   return canonical !== void 0 && sameAddress(offer.profile, offer.asset, canonical.address) ? canonical.symbol : quoted;
 }
+
+// src/core/canonical-json.ts
+var LONE_SURROGATE = new RegExp("\\p{Cs}", "u");
+function canonicalJson(value) {
+  if (typeof value === "string")
+    return LONE_SURROGATE.test(value) ? void 0 : JSON.stringify(value);
+  if (typeof value === "number") return Number.isFinite(value) ? JSON.stringify(value) : void 0;
+  if (value === null || typeof value === "boolean") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    const items = value.map(canonicalJson);
+    return items.includes(void 0) ? void 0 : `[${items.join(",")}]`;
+  }
+  if (typeof value !== "object") return void 0;
+  const members = [];
+  for (const key of Object.keys(value).sort()) {
+    const member = canonicalJson(value[key]);
+    if (member === void 0 || LONE_SURROGATE.test(key)) return void 0;
+    members.push(`${JSON.stringify(key)}:${member}`);
+  }
+  return `{${members.join(",")}}`;
+}
+
+// src/payments/x402/provider/quote.ts
+var QUOTE_EXTENSION = "erc-8409";
+var QUOTE_REQUEST_SCHEME = "agent-commerce/request/v1";
+var QUOTE_DOMAIN = { name: "Signed Service Payment Quotes", version: "1" };
+var QUOTE_TYPES = {
+  ServicePaymentQuote: [
+    { name: "issuer", type: "address" },
+    { name: "payer", type: "address" },
+    { name: "recipient", type: "address" },
+    { name: "asset", type: "address" },
+    { name: "amount", type: "uint256" },
+    { name: "requestScheme", type: "string" },
+    { name: "requestHash", type: "bytes32" },
+    { name: "quoteId", type: "bytes32" },
+    { name: "validAfter", type: "uint64" },
+    { name: "validUntil", type: "uint64" }
+  ]
+};
+var BEARER = "0x0000000000000000000000000000000000000000";
+var QUOTE_INFO_SCHEMA = {
+  type: "object",
+  required: ["quotes"],
+  properties: {
+    quotes: {
+      type: "array",
+      items: {
+        type: "object",
+        required: ["chainId", "quote", "signature"],
+        properties: {
+          chainId: { type: "string" },
+          // Every field is a string in the ERC's JSON encoding
+          quote: {
+            type: "object",
+            required: QUOTE_TYPES.ServicePaymentQuote.map((field) => field.name),
+            properties: Object.fromEntries(
+              QUOTE_TYPES.ServicePaymentQuote.map((field) => [field.name, { type: "string" }])
+            )
+          },
+          signature: { type: "string" }
+        }
+      }
+    }
+  }
+};
+var QUOTE_CACHE_LIMIT = 1024;
+function createQuoteIssuer(options) {
+  const { signerPrivateKey, offers, deploymentMode, clock, maxTimeoutSeconds } = options;
+  let account;
+  try {
+    account = privateKeyToAccount(signerPrivateKey);
+  } catch (cause) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      'x402 provider: quote.signerPrivateKey is not a valid private key (expected "0x" followed by 64 hex characters)',
+      { cause }
+    );
+  }
+  if (deploymentMode !== "local" && isWellKnownDevKey(signerPrivateKey)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      "x402 provider: quote.signerPrivateKey is a well-known Anvil development key, so anyone could sign quotes as this gateway. Use a dedicated key outside the local chain."
+    );
+  }
+  const evmOffers = offers.filter((offer) => offer.family === "evm");
+  if (evmOffers.length === 0) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      "x402 provider: quote needs an EVM offer; ERC-8409 quotes cover EVM networks only"
+    );
+  }
+  const issuer = account.address;
+  if (evmOffers.some((offer) => offer.payTo.toLowerCase() === issuer.toLowerCase())) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      "x402 provider: quote.signerPrivateKey controls a payTo address. Use a dedicated key, not the merchant wallet."
+    );
+  }
+  const cache = /* @__PURE__ */ new Map();
+  async function quoteFor(offer, amount, requestHash) {
+    const now = Math.floor(clock.now().getTime() / 1e3);
+    const { chainId } = offer.profile;
+    const key = [
+      chainId,
+      offer.payTo.toLowerCase(),
+      offer.asset.toLowerCase(),
+      amount,
+      requestHash
+    ].join("|");
+    const cached = cache.get(key);
+    if (cached !== void 0 && Number(cached.quote.validUntil) - now >= maxTimeoutSeconds) {
+      return cached;
+    }
+    const validUntil = now + 2 * maxTimeoutSeconds;
+    const quote = {
+      issuer,
+      payer: BEARER,
+      recipient: offer.payTo,
+      asset: offer.asset,
+      amount,
+      requestScheme: QUOTE_REQUEST_SCHEME,
+      requestHash,
+      // Use a new ID for each signed body, as the ERC requires
+      quoteId: `0x${randomBytes(32).toString("hex")}`,
+      validAfter: String(now),
+      validUntil: String(validUntil)
+    };
+    const signature = await account.signTypedData({
+      domain: { ...QUOTE_DOMAIN, chainId },
+      types: QUOTE_TYPES,
+      primaryType: "ServicePaymentQuote",
+      message: {
+        ...quote,
+        amount: BigInt(amount),
+        validAfter: BigInt(now),
+        validUntil: BigInt(validUntil)
+      }
+    });
+    const signed = { chainId: String(chainId), quote, signature };
+    cache.delete(key);
+    if (cache.size >= QUOTE_CACHE_LIMIT) {
+      const oldest = cache.keys().next().value;
+      if (oldest !== void 0) cache.delete(oldest);
+    }
+    cache.set(key, signed);
+    return signed;
+  }
+  return {
+    issuer,
+    async extensionsFor(resourceId, input, quoted) {
+      if (quoted.length === 0) return void 0;
+      const requestHash = quoteRequestHash(resourceId, input);
+      if (requestHash === void 0) return void 0;
+      const quotes = [];
+      for (const { offer, amount } of quoted) {
+        quotes.push(await quoteFor(offer, amount, requestHash));
+      }
+      return { [QUOTE_EXTENSION]: { info: { quotes }, schema: QUOTE_INFO_SCHEMA } };
+    }
+  };
+}
+function quoteRequestHash(resourceId, input) {
+  const canonical = canonicalJson({ input, resource: resourceId });
+  return canonical === void 0 ? void 0 : keccak256(stringToBytes(canonical));
+}
 function decodePaymentSubmission(payloadBase64) {
   const json = decodeJson(payloadBase64);
   if (json === void 0) return void 0;
@@ -885,6 +1052,14 @@ function createRequirementBuilders(ctx, svmFeePayer) {
       }))
     );
     const single = offers.length === 1 ? offers[0] : void 0;
+    const extensions = await ctx.quotes?.extensionsFor(
+      context.resource.id,
+      context.input,
+      offers.flatMap((offer, index) => {
+        const accepted = accepts[index];
+        return offer.family === "evm" && accepted ? [{ offer, amount: accepted.amount }] : [];
+      })
+    );
     const resourceId = encodeURIComponent(context.resource.id);
     const envelope = {
       x402Version: X402_VERSION,
@@ -895,7 +1070,8 @@ function createRequirementBuilders(ctx, svmFeePayer) {
         // delivery carries the backend's own type when it is text and fits the body
         mimeType: options.resourceMimeTypes?.[context.resource.id] ?? DEFAULT_MIME_TYPE
       },
-      accepts
+      accepts,
+      ...extensions !== void 0 ? { extensions } : {}
     };
     const expiresAt = new Date(clock.now().getTime() + maxTimeoutSeconds * 1e3).toISOString();
     return {
@@ -1321,6 +1497,13 @@ function createX402PaymentProvider(options) {
   const ids = options.ids ?? DEFAULT_IDS;
   const logger = options.logger ?? NOOP_LOGGER;
   const maxTimeoutSeconds = options.maxTimeoutSeconds ?? DEFAULT_MAX_TIMEOUT_SECONDS;
+  const quotes = options.quote ? createQuoteIssuer({
+    signerPrivateKey: options.quote.signerPrivateKey,
+    offers,
+    deploymentMode,
+    clock,
+    maxTimeoutSeconds
+  }) : void 0;
   const evmOffers = offers.filter((offer) => offer.family === "evm");
   const hasSvm = offers.some((offer) => offer.family === "svm");
   const hasNear = offers.some((offer) => offer.family === "near");
@@ -1344,7 +1527,8 @@ function createX402PaymentProvider(options) {
       `mode=${deploymentMode}`,
       "authorization-flow",
       "upfront-flow",
-      ...severalOffers ? ["multiple-offers"] : []
+      ...severalOffers ? ["multiple-offers"] : [],
+      ...quotes ? ["erc-8409-quotes"] : []
     ],
     status: "stable",
     unsupported: [
@@ -1376,6 +1560,7 @@ function createX402PaymentProvider(options) {
     ids,
     logger,
     maxTimeoutSeconds,
+    quotes,
     svm,
     near
   };
@@ -1394,7 +1579,14 @@ function createX402PaymentProvider(options) {
     ...severalOffers ? { selectRequirement } : {},
     verify,
     settle,
-    health
+    health,
+    ...quotes ? {
+      quote: {
+        issuer: quotes.issuer,
+        requestScheme: QUOTE_REQUEST_SCHEME,
+        extension: QUOTE_EXTENSION
+      }
+    } : {}
   };
 }
 function loadOptionalModule(load, missing) {
@@ -1409,5 +1601,5 @@ function loadOptionalModule(load, missing) {
 }
 
 export { DEFAULT_IDS, chainIdFromCaip2, createX402PaymentProvider, parseCanonicalAmount };
-//# sourceMappingURL=chunk-QZ6TOMX6.js.map
-//# sourceMappingURL=chunk-QZ6TOMX6.js.map
+//# sourceMappingURL=chunk-AZDWFVDW.js.map
+//# sourceMappingURL=chunk-AZDWFVDW.js.map