@devlab.group/agent-commerce 2.3.0 → 2.4.0

package/dist/mcp.d.ts

@@ -1,7 +1,7 @@
-import { H as HttpProtocolAdapter } from './protocol-adapter-CfxU8Z2T.js';
+import { HttpProtocolAdapter } from './index.js';
 import 'node:http';
-import './runtime-7vLNYvmU.js';
-import './authorization-CMkIuAkO.js';
+import './runtime-Cl_BLVZV.js';
+import './authorization-DjAecwuW.js';
 
 interface McpAdapterOptions {
     /** Path prefix the gateway mounts this adapter at. Default '/mcp' */
@@ -13,4 +13,5 @@ interface McpAdapterOptions {
 }
 declare function createMcpAdapter(options?: McpAdapterOptions): HttpProtocolAdapter;
 
-export { type McpAdapterOptions, createMcpAdapter, createMcpAdapter as mcp };
+export { createMcpAdapter, createMcpAdapter as mcp };
+export type { McpAdapterOptions };

package/dist/mcp.js

@@ -1,6 +1,6 @@
 import { MCP_TOOL_NAME_PATTERN, readCappedBody, MCP_MODERN_PROTOCOL_REVISION, x402ErrorCode, settlementFailure, settlementResponseFromDetails, x402McpPaymentSubmission, X402_MCP_PAYMENT_META_KEY, X402_MCP_PAYMENT_RESPONSE_META_KEY, settlementResponse, X402_MCP_ERROR_META_KEY } from './chunk-ES3V6ECS.js';
 import { mcpPaymentRequired, MPP_MCP_CREDENTIAL_META_KEY, receiptObject, MPP_MCP_RECEIPT_META_KEY, MPP_MCP_PAYMENT_REQUIRED_META_KEY } from './chunk-5ZYXBCDX.js';
-import { PACKAGE_VERSION, toLogInfo, toCommerceError, CommerceError, extractReservedInputFields, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, toPaymentRequiredEnvelope } from './chunk-Q5TII32R.js';
+import { PACKAGE_VERSION, toLogInfo, toCommerceError, CommerceError, extractReservedInputFields, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, toPaymentRequiredEnvelope } from './chunk-AITMDXKW.js';
 import { isRecord } from './chunk-2CJNA7MS.js';
 import { createMcpHandler, Server, ProtocolError, ProtocolErrorCode, LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/server';
 

package/dist/mpp.d.ts

@@ -1,6 +1,6 @@
-export { a as MPPX_VERSION, b as MPP_PROFILE, c as MPP_SPEC_COMMIT, d as MPP_SPEC_DRAFTS, e as MPP_SPEC_REPOSITORY, f as MPP_SUPPORTED_SPEC } from './constants-nackLItD.js';
-import { A as AdapterDescriptor, L as Logger, C as Clock, e as IdGenerator, d as PaymentProvider } from './runtime-7vLNYvmU.js';
-import { a as X402FacilitatorConfig, X as X402PaymentFlow } from './guardrails-CX_jYXvZ.js';
+export { a as MPPX_VERSION, b as MPP_PROFILE, c as MPP_SPEC_COMMIT, d as MPP_SPEC_DRAFTS, e as MPP_SPEC_REPOSITORY, f as MPP_SUPPORTED_SPEC } from './constants-BG22tE8S.js';
+import { AdapterDescriptor, Logger, Clock, IdGenerator, PaymentProvider } from './index.js';
+import { X402FacilitatorConfig, X402PaymentFlow } from './x402.js';
 
 /**
  * Describes the MPP profile and its unsupported variants.
@@ -58,4 +58,5 @@ interface MppProviderOptions {
 
 declare function createMppPaymentProvider(options: MppProviderOptions): PaymentProvider;
 
-export { MPP_DESCRIPTOR, type MppProviderOptions, createMppPaymentProvider, createMppPaymentProvider as mpp };
+export { MPP_DESCRIPTOR, createMppPaymentProvider, createMppPaymentProvider as mpp };
+export type { MppProviderOptions };

package/dist/mpp.js

@@ -1,9 +1,9 @@
 import { MPP_PROFILE, MPP_NETWORKS, MPP_SUPPORTED_SPEC, MPP_DEFAULT_NETWORK, MPP_MIN_CHALLENGE_SECRET_LENGTH, isMppNetwork, MPP_DEFAULT_PAYMENT_FLOW, MPP_SPEC_DRAFTS } from './chunk-6Z2H53CG.js';
 export { MPPX_VERSION, MPP_PROFILE, MPP_SPEC_COMMIT, MPP_SPEC_DRAFTS, MPP_SPEC_REPOSITORY, MPP_SUPPORTED_SPEC } from './chunk-6Z2H53CG.js';
 import { CONTENT_DIGEST_METADATA_KEY } from './chunk-5ZYXBCDX.js';
-import { createX402PaymentProvider, DEFAULT_IDS, parseCanonicalAmount } from './chunk-TNS7U5Q4.js';
-import { SETTLE_AFTER_BACKEND_METADATA_KEY } from './chunk-XVU46YAH.js';
-import { PACKAGE_VERSION, systemClock, CommerceError } from './chunk-Q5TII32R.js';
+import { createX402PaymentProvider, DEFAULT_IDS, parseCanonicalAmount } from './chunk-WUIAUAA7.js';
+import { SETTLE_AFTER_BACKEND_METADATA_KEY } from './chunk-4OEXK3YG.js';
+import { PACKAGE_VERSION, systemClock, CommerceError } from './chunk-AITMDXKW.js';
 import { computeReplayKey } from './chunk-KA2AX5FH.js';
 import './chunk-2CJNA7MS.js';
 import { Challenge, Method, Receipt, Credential, PaymentRequest, Errors } from 'mppx';

package/dist/{networks-DTWRlj-K.d.ts → networks-DDHYJLcg.d.ts}

@@ -35,4 +35,5 @@ declare const SUPPORTED_NETWORK_IDS: readonly string[];
 /** What a deployment is: the local dev chain, or a public testnet or mainnet */
 type DeploymentMode = 'local' | 'testnet' | 'mainnet';
 
-export { type CustomNetworks as C, type DeploymentMode as D, type NetworkProfile as N, SUPPORTED_NETWORK_IDS as S };
+export { SUPPORTED_NETWORK_IDS as S };
+export type { CustomNetworks as C, DeploymentMode as D, NetworkProfile as N };

package/dist/{protocol-adapter-CfxU8Z2T.d.ts → protocol-adapter-C9odYl6l.d.ts}

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { I as IsoTimestamp, o as PaymentResult, s as ProtocolName, b as PaymentSubmission, n as PaymentRequirement, A as AdapterDescriptor, R as ResourceRegistry, L as Logger, C as Clock, e as IdGenerator, c as AdapterHealth } from './runtime-7vLNYvmU.js';
-import { d as AuthorizationRecord, b as AuthorizationSubmission, a as AuthorizationRequirement } from './authorization-CMkIuAkO.js';
+import { I as IsoTimestamp, o as PaymentResult, s as ProtocolName, b as PaymentSubmission, n as PaymentRequirement, A as AdapterDescriptor, R as ResourceRegistry, L as Logger, C as Clock, e as IdGenerator, c as AdapterHealth } from './runtime-Cl_BLVZV.js';
+import { d as AuthorizationRecord, b as AuthorizationSubmission, a as AuthorizationRequirement } from './authorization-DjAecwuW.js';
 
 /**
  * Canonical commerce events. FROZEN CONTRACT. Every event in one flow shares
@@ -237,4 +237,5 @@ interface AdapterHttpRoute {
 }
 declare function isHttpProtocolAdapter(adapter: ProtocolAdapter): adapter is HttpProtocolAdapter;
 
-export { type AdapterHttpRoute as A, type CommerceEvent as C, type DeliveredOutcome as D, type ExecutionPipeline as E, type HttpProtocolAdapter as H, type PaymentRequiredOutcome as P, type PaymentAttempt as a, type CommerceReceipt as b, type ProtocolAdapter as c, type ProtocolAdapterContext as d, COMMERCE_EVENT_TYPES as e, type CanonicalRequest as f, type CommerceEventType as g, type EventSink as h, type ExecutionOutcome as i, isHttpProtocolAdapter as j };
+export { COMMERCE_EVENT_TYPES as e, isHttpProtocolAdapter as j };
+export type { AdapterHttpRoute as A, CommerceEvent as C, DeliveredOutcome as D, ExecutionPipeline as E, HttpProtocolAdapter as H, PaymentRequiredOutcome as P, PaymentAttempt as a, CommerceReceipt as b, ProtocolAdapter as c, ProtocolAdapterContext as d, CanonicalRequest as f, CommerceEventType as g, EventSink as h, ExecutionOutcome as i };

package/dist/{runtime-7vLNYvmU.d.ts → runtime-Cl_BLVZV.d.ts}

@@ -244,6 +244,12 @@ interface PaymentContext {
     readonly amount: DecimalAmount;
     readonly currency: string;
     readonly requestedAt: IsoTimestamp;
+    /**
+     * Validated resource input used to build the backend request. The pipeline
+     * sets this field on every createRequirement call. A rail may bind its
+     * challenge to the input but must not send it to a third party.
+     */
+    readonly input?: unknown;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 /** Input to {@link PaymentProvider.verify} */
@@ -322,4 +328,5 @@ interface IdGenerator {
 }
 declare const systemClock: Clock;
 
-export { type AdapterDescriptor as A, type BackendHandler as B, type Clock as C, type DecimalAmount as D, type IsoTimestamp as I, type JsonSchema as J, type Logger as L, NOOP_LOGGER as N, type PaymentMethodName as P, type ResourceRegistry as R, type CommerceResource as a, type PaymentSubmission as b, type AdapterHealth as c, type PaymentProvider as d, type IdGenerator as e, type AdapterHealthComponent as f, type AuthorizationMethodName as g, type BackendMethod as h, DEFAULT_BACKEND_TIMEOUT_MS as i, PAYMENT_METHOD_NAMES as j, PROTOCOL_NAMES as k, type PaymentChallenge as l, type PaymentContext as m, type PaymentRequirement as n, type PaymentResult as o, type PaymentSettlementContext as p, type PaymentVerificationContext as q, type Pricing as r, type ProtocolName as s, systemClock as t };
+export { NOOP_LOGGER as N, DEFAULT_BACKEND_TIMEOUT_MS as i, PAYMENT_METHOD_NAMES as j, PROTOCOL_NAMES as k, systemClock as t };
+export type { AdapterDescriptor as A, BackendHandler as B, Clock as C, DecimalAmount as D, IsoTimestamp as I, JsonSchema as J, Logger as L, PaymentMethodName as P, ResourceRegistry as R, CommerceResource as a, PaymentSubmission as b, AdapterHealth as c, PaymentProvider as d, IdGenerator as e, AdapterHealthComponent as f, AuthorizationMethodName as g, BackendMethod as h, PaymentChallenge as l, PaymentContext as m, PaymentRequirement as n, PaymentResult as o, PaymentSettlementContext as p, PaymentVerificationContext as q, Pricing as r, ProtocolName as s };

package/dist/{types-CVw6Sf46.d.ts → types-j7MnUXYN.d.ts}

@@ -101,4 +101,5 @@ type EnabledAp2Config = Extract<Ap2AuthorizationConfig, {
     enabled: true;
 }>;
 
-export { AP2_CHECKOUT_MANDATE_VCT as A, type EnabledAp2Config as E, AP2_CHECKOUT_PROFILE as a, AP2_DEFAULT_CLOCK_SKEW_SECONDS as b, AP2_MAX_CLOCK_SKEW_SECONDS as c, AP2_SIGNING_ALGORITHM as d, AP2_SPEC_VERSION as e, type Ap2AuthorizationConfig as f, type Ap2Mode as g, type Ap2TrustedIssuer as h, type Ap2TrustedKey as i };
+export { AP2_CHECKOUT_MANDATE_VCT as A, AP2_CHECKOUT_PROFILE as a, AP2_DEFAULT_CLOCK_SKEW_SECONDS as b, AP2_MAX_CLOCK_SKEW_SECONDS as c, AP2_SIGNING_ALGORITHM as d, AP2_SPEC_VERSION as e };
+export type { EnabledAp2Config as E, Ap2AuthorizationConfig as f, Ap2Mode as g, Ap2TrustedIssuer as h, Ap2TrustedKey as i };

package/dist/x402.d.ts

@@ -1,8 +1,8 @@
 import { X as X402PaymentFlow, a as X402FacilitatorConfig } from './guardrails-CX_jYXvZ.js';
 export { F as FacilitatorAuth } from './guardrails-CX_jYXvZ.js';
-import { C as CustomNetworks } from './networks-DTWRlj-K.js';
-export { D as DeploymentMode, N as NetworkProfile, S as SUPPORTED_NETWORK_IDS } from './networks-DTWRlj-K.js';
-import { L as Logger, C as Clock, e as IdGenerator, d as PaymentProvider } from './runtime-7vLNYvmU.js';
+import { C as CustomNetworks } from './networks-DDHYJLcg.js';
+export { D as DeploymentMode, N as NetworkProfile, S as SUPPORTED_NETWORK_IDS } from './networks-DDHYJLcg.js';
+import { Logger, Clock, IdGenerator, PaymentProvider } from './index.js';
 
 /**
  * Client-side payment helper: builds and EIP-712-signs an x402 v2 `exact`/EVM
@@ -72,10 +72,31 @@ interface X402ProviderOptions extends X402OfferOptions {
      * its `kind` determines mainnet guardrails
      */
     readonly customNetworks?: CustomNetworks;
+    /**
+     * Experimental. Signs an ERC-8409 quote for each EVM offer when the request
+     * data can be canonicalized. Use a dedicated key that holds no funds.
+     * Never use a merchant's or buyer's wallet key.
+     */
+    readonly quote?: {
+        readonly signerPrivateKey: string;
+    };
     readonly logger?: Logger;
     readonly clock?: Clock;
     readonly ids?: IdGenerator;
 }
+/** x402 payment provider with optional public quote metadata */
+interface X402PaymentProvider extends PaymentProvider {
+    /**
+     * Experimental. Present when ERC-8409 quote signing is enabled.
+     * Publishes the issuer address for signature checks, the request scheme and
+     * the key under `PaymentRequired.extensions`.
+     */
+    readonly quote?: {
+        readonly issuer: `0x${string}`;
+        readonly requestScheme: string;
+        readonly extension: string;
+    };
+}
 /** Settlement network, token and merchant payee for one offer */
 interface X402OfferOptions {
     /**
@@ -113,19 +134,7 @@ interface X402MultiOfferProviderOptions extends Omit<X402ProviderOptions, keyof
     readonly offers: readonly X402OfferOptions[];
 }
 
-/**
- * x402 payment provider: protocol v2, `exact` scheme. On EVM the buyer signs an
- * EIP-3009 `transferWithAuthorization` or a Permit2 transfer through the x402
- * exact proxy; on Solana, a token transfer whose fee the facilitator pays; on
- * NEAR, a delegated NEP-141 `ft_transfer` that the facilitator's relayer
- * submits.
- *
- * `verify()` never moves funds. `settle()` does, and throws unless it is handed
- * a successful verification. Both run through a facilitator (see
- * `../facilitator.ts`): the SDK's own `x402Facilitator` in this process, or a
- * remote HTTP facilitator.
- */
-
-declare function createX402PaymentProvider(options: X402ProviderOptions | X402MultiOfferProviderOptions): PaymentProvider;
+declare function createX402PaymentProvider(options: X402ProviderOptions | X402MultiOfferProviderOptions): X402PaymentProvider;
 
-export { type CreatePaymentProofOptions, type X402AssetTransferMethod, X402FacilitatorConfig, type X402MultiOfferProviderOptions, type X402OfferOptions, X402PaymentFlow, type X402ProviderOptions, createPaymentProof, createX402PaymentProvider, createX402PaymentProvider as x402 };
+export { X402FacilitatorConfig, X402PaymentFlow, createPaymentProof, createX402PaymentProvider, createX402PaymentProvider as x402 };
+export type { CreatePaymentProofOptions, X402AssetTransferMethod, X402MultiOfferProviderOptions, X402OfferOptions, X402PaymentProvider, X402ProviderOptions };

package/dist/x402.js

@@ -1,7 +1,7 @@
-import { chainIdFromCaip2 } from './chunk-TNS7U5Q4.js';
-export { createX402PaymentProvider, createX402PaymentProvider as x402 } from './chunk-TNS7U5Q4.js';
-export { SUPPORTED_NETWORK_IDS } from './chunk-XVU46YAH.js';
-import { CommerceError } from './chunk-Q5TII32R.js';
+import { chainIdFromCaip2 } from './chunk-WUIAUAA7.js';
+export { createX402PaymentProvider, createX402PaymentProvider as x402 } from './chunk-WUIAUAA7.js';
+export { SUPPORTED_NETWORK_IDS } from './chunk-4OEXK3YG.js';
+import { CommerceError } from './chunk-AITMDXKW.js';
 import './chunk-KA2AX5FH.js';
 import './chunk-2CJNA7MS.js';
 import { PaymentRequirementsV2Schema } from '@x402/core/schemas';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devlab.group/agent-commerce",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Open-source, self-hosted, non-custodial commerce and payment orchestration gateway for AI agents.",
   "license": "Apache-2.0",
   "type": "module",
@@ -110,7 +110,7 @@
     "ajv-formats": "3.0.1",
     "better-sqlite3": "13.0.3",
     "commander": "15.0.0",
-    "fastify": "5.12.5",
+    "fastify": "5.12.7",
     "picocolors": "1.1.1",
     "pino": "10.3.1",
     "yaml": "2.9.0",
@@ -187,7 +187,7 @@
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.4",
     "@vitejs/plugin-react": "6.0.5",
-    "@vitest/coverage-v8": "4.1.11",
+    "@vitest/coverage-v8": "4.1.12",
     "@x402/core": "2.25.0",
     "@x402/evm": "2.25.0",
     "@x402/mcp": "2.25.0",
@@ -199,12 +199,12 @@
     "pino-pretty": "13.1.2",
     "react": "19.0.8",
     "react-dom": "19.0.8",
-    "tsup": "8.5.1",
+    "tsup": "9.0.0",
     "tsx": "4.23.12",
     "typescript": "5.9.3",
     "viem": "2.57.1",
-    "vite": "8.2.1",
-    "vitest": "4.1.11"
+    "vite": "8.2.4",
+    "vitest": "4.1.12"
   },
   "overrides": {
     "@coinbase/x402": {