@devlab.group/agent-commerce 2.3.0 → 2.4.1

package/README.md

@@ -279,16 +279,17 @@ See [docs/configuration.md](docs/configuration.md).
 
 ## Protocol support
 
-| Protocol | Status       | Pinned revision                                                                                              |
-| -------- | ------------ | ------------------------------------------------------------------------------------------------------------ |
-| **HTTP** | Supported    | native routes                                                                                                |
-| **MCP**  | Supported    | `2026-07-28` and `2025-11-25`, `@modelcontextprotocol/server@2.3.0`                                          |
-| **x402** | Supported    | x402 v2 (`@x402/core`, `@x402/evm`, `@x402/svm`, `@x402/near`), scheme `exact`, EVM and Solana; NEAR partial |
-| **MPP**  | Experimental | `mppx@0.13.1`, `charge` + `evm` + EIP-3009, USDC on Base Sepolia and Base                                    |
-| **A2A**  | Experimental | A2A v1.0.1, binding `JSONRPC`, method `SendMessage`, x402 extension                                          |
-| **ACP**  | Experimental | ACP `2026-04-17`, REST checkout + discovery                                                                  |
-| **AP2**  | Experimental | AP2 `v0.2.0`, Direct Checkout Mandate verification                                                           |
-| UCP      | Planned      | no implementation                                                                                            |
+| Protocol     | Status       | Pinned revision                                                                                              |
+| ------------ | ------------ | ------------------------------------------------------------------------------------------------------------ |
+| **HTTP**     | Supported    | native routes                                                                                                |
+| **MCP**      | Supported    | `2026-07-28` and `2025-11-25`, `@modelcontextprotocol/server@2.3.0`                                          |
+| **x402**     | Supported    | x402 v2 (`@x402/core`, `@x402/evm`, `@x402/svm`, `@x402/near`), scheme `exact`, EVM and Solana; NEAR partial |
+| **MPP**      | Experimental | `mppx@0.13.1`, `charge` + `evm` + EIP-3009, USDC on Base Sepolia and Base                                    |
+| **A2A**      | Experimental | A2A v1.0.1, binding `JSONRPC`, method `SendMessage`, x402 extension                                          |
+| **ACP**      | Experimental | ACP `2026-04-17`, REST checkout + discovery                                                                  |
+| **AP2**      | Experimental | AP2 `v0.2.0`, Direct Checkout Mandate verification                                                           |
+| **ERC-8409** | Experimental | draft `SergeevDmitry/ERCs@0ee33230`: signed quotes on x402 EVM offers                                        |
+| UCP          | Planned      | no implementation                                                                                            |
 
 [AP2](docs/protocols/ap2.md) is an authorization method, not a transport. It verifies a
 mandate before a paid resource settles; the gateway does not issue the mandate
@@ -296,7 +297,8 @@ or its Checkout Receipt.
 
 The experimental entries above ship off by default with documented subsets:
 [A2A](docs/protocols/a2a.md), [ACP](docs/protocols/acp.md),
-[AP2](docs/protocols/ap2.md#not-implemented) and [MPP](docs/protocols/mpp.md). Supported
+[AP2](docs/protocols/ap2.md#not-implemented), [MPP](docs/protocols/mpp.md) and
+[ERC-8409 quotes](docs/protocols/x402.md#erc-8409-signed-quotes). Supported
 [MCP](docs/protocols/mcp.md) and [x402](docs/protocols/x402.md) are also scoped.
 ACP exposes only its five checkout operations; merchant `payment_data` is never
 converted into a gateway payment proof.
@@ -308,7 +310,8 @@ prints the `unsupported` lists for A2A, ACP and AP2 when they are enabled.
 ### Versioning
 
 Minor releases may break experimental configurations, integrations or types.
-This applies to MPP, A2A, ACP, AP2 and `agent-commerce import openapi`.
+This applies to MPP, A2A, ACP, AP2, ERC-8409 quotes and
+`agent-commerce import openapi`.
 Runtime adapters and providers report `status: experimental` in
 `GET /.well-known/agent-commerce`. Pin an exact version and test upgrades
 before deploying them. Since 2.1, some supported x402 behavior and types
@@ -318,7 +321,8 @@ differ from 2.0; see [Upgrading from 2.0 to 2.x](docs/migration-2.1.md).
 
 - **Non-custodial.** Buyer payments go directly to the merchant address in
   `payTo` (`recipient` for MPP). The gateway does not require buyer or merchant
-  private keys. Local facilitator mode does hold a separate gas-paying signer.
+  private keys. Local facilitator mode uses a separate key to pay gas.
+  Experimental ERC-8409 quotes use a dedicated, unfunded signing key.
 - **Fail closed.** Missing, malformed, expired, replayed, wrong-amount,
   wrong-recipient, wrong-network and wrong-asset payments are rejected.
 - **Replay-safe twice over.** The EIP-3009 or Permit2 nonce stops a double

package/dist/ap2.d.ts

@@ -1,7 +1,7 @@
-import { E as EnabledAp2Config } from './types-CVw6Sf46.js';
-export { A as AP2_CHECKOUT_MANDATE_VCT, a as AP2_CHECKOUT_PROFILE, b as AP2_DEFAULT_CLOCK_SKEW_SECONDS, c as AP2_MAX_CLOCK_SKEW_SECONDS, d as AP2_SIGNING_ALGORITHM, e as AP2_SPEC_VERSION, f as Ap2AuthorizationConfig, g as Ap2Mode, h as Ap2TrustedIssuer, i as Ap2TrustedKey } from './types-CVw6Sf46.js';
-import { A as AuthorizationProvider } from './authorization-CMkIuAkO.js';
-import { C as Clock, L as Logger } from './runtime-7vLNYvmU.js';
+import { E as EnabledAp2Config } from './types-j7MnUXYN.js';
+export { A as AP2_CHECKOUT_MANDATE_VCT, a as AP2_CHECKOUT_PROFILE, b as AP2_DEFAULT_CLOCK_SKEW_SECONDS, c as AP2_MAX_CLOCK_SKEW_SECONDS, d as AP2_SIGNING_ALGORITHM, e as AP2_SPEC_VERSION, f as Ap2AuthorizationConfig, g as Ap2Mode, h as Ap2TrustedIssuer, i as Ap2TrustedKey } from './types-j7MnUXYN.js';
+import { AuthorizationProvider } from './index.js';
+import { Clock, Logger } from './index.js';
 
 /**
  * A private ES256 key: either a private JWK (the pair of the public one in the
@@ -158,4 +158,5 @@ interface Ap2AuthorizationProvider extends AuthorizationProvider {
 }
 declare function createAp2AuthorizationProvider(options: Ap2AuthorizationProviderOptions): Ap2AuthorizationProvider;
 
-export { AP2_CAPABILITIES, AP2_REJECTION_REASONS, AP2_UNSUPPORTED, type Ap2AuthorizationProvider, type Ap2AuthorizationProviderOptions, type Ap2RejectionReason, type Ap2SigningKey, type CreateCheckoutJwtOptions, EnabledAp2Config, createAp2AuthorizationProvider as ap2, createAp2AuthorizationProvider, createCheckoutJwt };
+export { AP2_CAPABILITIES, AP2_REJECTION_REASONS, AP2_UNSUPPORTED, EnabledAp2Config, createAp2AuthorizationProvider as ap2, createAp2AuthorizationProvider, createCheckoutJwt };
+export type { Ap2AuthorizationProvider, Ap2AuthorizationProviderOptions, Ap2RejectionReason, Ap2SigningKey, CreateCheckoutJwtOptions };

package/dist/ap2.js

@@ -1,6 +1,6 @@
-import { AP2_CHECKOUT_MANDATE_VCT, AP2_SIGNING_ALGORITHM, AP2_DIGEST_ALGORITHM, AP2_CHECKOUT_PROFILE, AP2_SPEC_VERSION, AP2_KEY_TYPE, AP2_JWK_CURVE, openSqliteDatabase } from './chunk-4ZSE5DCH.js';
-export { AP2_CHECKOUT_MANDATE_VCT, AP2_CHECKOUT_PROFILE, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_MAX_CLOCK_SKEW_SECONDS, AP2_SIGNING_ALGORITHM, AP2_SPEC_VERSION } from './chunk-4ZSE5DCH.js';
-import { systemClock, NOOP_LOGGER, CommerceError, PACKAGE_VERSION } from './chunk-Q5TII32R.js';
+import { AP2_CHECKOUT_MANDATE_VCT, AP2_SIGNING_ALGORITHM, AP2_DIGEST_ALGORITHM, AP2_CHECKOUT_PROFILE, AP2_SPEC_VERSION, AP2_KEY_TYPE, AP2_JWK_CURVE, openSqliteDatabase } from './chunk-WZW5ORZH.js';
+export { AP2_CHECKOUT_MANDATE_VCT, AP2_CHECKOUT_PROFILE, AP2_DEFAULT_CLOCK_SKEW_SECONDS, AP2_MAX_CLOCK_SKEW_SECONDS, AP2_SIGNING_ALGORITHM, AP2_SPEC_VERSION } from './chunk-WZW5ORZH.js';
+import { systemClock, NOOP_LOGGER, CommerceError, PACKAGE_VERSION } from './chunk-DTKU3Z2M.js';
 import { isRecord } from './chunk-2CJNA7MS.js';
 import { SignJWT, importPKCS8, importJWK, jwtVerify, decodeProtectedHeader, decodeJwt } from 'jose';
 import canonicalize from 'canonicalize';

package/dist/{authorization-CMkIuAkO.d.ts → authorization-DjAecwuW.d.ts}

@@ -1,4 +1,4 @@
-import { g as AuthorizationMethodName, A as AdapterDescriptor, n as PaymentRequirement, c as AdapterHealth } from './runtime-7vLNYvmU.js';
+import { g as AuthorizationMethodName, A as AdapterDescriptor, n as PaymentRequirement, c as AdapterHealth } from './runtime-Cl_BLVZV.js';
 
 /**
  * Canonical authorization model. FROZEN CONTRACT.

package/dist/{chunk-TNS7U5Q4.js → chunk-CXWC5LWM.js}

@@ -1,14 +1,15 @@
-import { findX402Network, normalizeAddress, assertPayToIsNotDevAddress, resolveX402Deployment, assertDevKeyIsLocalOnly, describeRpc, X402_DEFAULT_PAYMENT_FLOW, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY, SETTLE_AFTER_BACKEND_METADATA_KEY, sameAddress, LOCAL_CHAIN_ID, isTransactionReference, x402OfferName, isEvmAddress, describeDeploymentMode } from './chunk-XVU46YAH.js';
-import { CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION, redactedErrorText } from './chunk-Q5TII32R.js';
+import { isWellKnownDevKey, findX402Network, normalizeAddress, assertPayToIsNotDevAddress, resolveX402Deployment, assertDevKeyIsLocalOnly, describeRpc, X402_DEFAULT_PAYMENT_FLOW, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY, SETTLE_AFTER_BACKEND_METADATA_KEY, sameAddress, LOCAL_CHAIN_ID, isTransactionReference, x402OfferName, isEvmAddress, describeDeploymentMode } from './chunk-QPV3EGJO.js';
+import { CommerceError, systemClock, NOOP_LOGGER, PACKAGE_VERSION, redactedErrorText } from './chunk-DTKU3Z2M.js';
 import { computeReplayKey, computePermit2ReplayKey } from './chunk-KA2AX5FH.js';
 import { isRecord } from './chunk-2CJNA7MS.js';
 import { x402ExactPermit2ProxyAddress, toFacilitatorEvmSigner, PERMIT2_ADDRESS } from '@x402/evm';
-import { isAddress, getAddress, formatUnits, createWalletClient, http, publicActions, createPublicClient, HttpRequestError, TimeoutError, WaitForTransactionReceiptTimeoutError, BaseError, ContractFunctionRevertedError, erc20Abi } from 'viem';
+import { isAddress, keccak256, stringToBytes, getAddress, formatUnits, createWalletClient, http, publicActions, createPublicClient, HttpRequestError, TimeoutError, WaitForTransactionReceiptTimeoutError, BaseError, ContractFunctionRevertedError, erc20Abi } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { HTTPFacilitatorClient } from '@x402/core/http';
 import { SettleError, VerifyError } from '@x402/core/types';
 import { x402Facilitator } from '@x402/core/facilitator';
 import { registerExactEvmScheme } from '@x402/evm/exact/facilitator';
+import { randomBytes } from 'crypto';
 import { PaymentPayloadV2Schema } from '@x402/core/schemas';
 
 // src/payments/x402/provider/constants.ts
@@ -770,6 +771,172 @@ function offerCurrency(offer, quoted) {
   return canonical !== void 0 && sameAddress(offer.profile, offer.asset, canonical.address) ? canonical.symbol : quoted;
 }
 
+// src/core/canonical-json.ts
+var LONE_SURROGATE = new RegExp("\\p{Cs}", "u");
+function canonicalJson(value) {
+  if (typeof value === "string")
+    return LONE_SURROGATE.test(value) ? void 0 : JSON.stringify(value);
+  if (typeof value === "number") return Number.isFinite(value) ? JSON.stringify(value) : void 0;
+  if (value === null || typeof value === "boolean") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    const items = value.map(canonicalJson);
+    return items.includes(void 0) ? void 0 : `[${items.join(",")}]`;
+  }
+  if (typeof value !== "object") return void 0;
+  const members = [];
+  for (const key of Object.keys(value).sort()) {
+    const member = canonicalJson(value[key]);
+    if (member === void 0 || LONE_SURROGATE.test(key)) return void 0;
+    members.push(`${JSON.stringify(key)}:${member}`);
+  }
+  return `{${members.join(",")}}`;
+}
+
+// src/payments/x402/provider/quote.ts
+var QUOTE_EXTENSION = "erc-8409";
+var QUOTE_REQUEST_SCHEME = "agent-commerce/request/v1";
+var QUOTE_DOMAIN = { name: "Signed Service Payment Quotes", version: "1" };
+var QUOTE_TYPES = {
+  ServicePaymentQuote: [
+    { name: "issuer", type: "address" },
+    { name: "payer", type: "address" },
+    { name: "recipient", type: "address" },
+    { name: "asset", type: "address" },
+    { name: "amount", type: "uint256" },
+    { name: "requestScheme", type: "string" },
+    { name: "requestHash", type: "bytes32" },
+    { name: "quoteId", type: "bytes32" },
+    { name: "validAfter", type: "uint64" },
+    { name: "validUntil", type: "uint64" }
+  ]
+};
+var BEARER = "0x0000000000000000000000000000000000000000";
+var QUOTE_INFO_SCHEMA = {
+  type: "object",
+  required: ["quotes"],
+  properties: {
+    quotes: {
+      type: "array",
+      items: {
+        type: "object",
+        required: ["chainId", "quote", "signature"],
+        properties: {
+          chainId: { type: "string" },
+          // Every field is a string in the ERC's JSON encoding
+          quote: {
+            type: "object",
+            required: QUOTE_TYPES.ServicePaymentQuote.map((field) => field.name),
+            properties: Object.fromEntries(
+              QUOTE_TYPES.ServicePaymentQuote.map((field) => [field.name, { type: "string" }])
+            )
+          },
+          signature: { type: "string" }
+        }
+      }
+    }
+  }
+};
+var QUOTE_CACHE_LIMIT = 1024;
+function createQuoteIssuer(options) {
+  const { signerPrivateKey, offers, deploymentMode, clock, maxTimeoutSeconds } = options;
+  let account;
+  try {
+    account = privateKeyToAccount(signerPrivateKey);
+  } catch (cause) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      'x402 provider: quote.signerPrivateKey is not a valid private key (expected "0x" followed by 64 hex characters)',
+      { cause }
+    );
+  }
+  if (deploymentMode !== "local" && isWellKnownDevKey(signerPrivateKey)) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      "x402 provider: quote.signerPrivateKey is a well-known Anvil development key, so anyone could sign quotes as this gateway. Use a dedicated key outside the local chain."
+    );
+  }
+  const evmOffers = offers.filter((offer) => offer.family === "evm");
+  if (evmOffers.length === 0) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      "x402 provider: quote needs an EVM offer; ERC-8409 quotes cover EVM networks only"
+    );
+  }
+  const issuer = account.address;
+  if (evmOffers.some((offer) => offer.payTo.toLowerCase() === issuer.toLowerCase())) {
+    throw new CommerceError(
+      "CONFIG_INVALID",
+      "x402 provider: quote.signerPrivateKey controls a payTo address. Use a dedicated key, not the merchant wallet."
+    );
+  }
+  const cache = /* @__PURE__ */ new Map();
+  async function quoteFor(offer, amount, requestHash) {
+    const now = Math.floor(clock.now().getTime() / 1e3);
+    const { chainId } = offer.profile;
+    const key = [
+      chainId,
+      offer.payTo.toLowerCase(),
+      offer.asset.toLowerCase(),
+      amount,
+      requestHash
+    ].join("|");
+    const cached = cache.get(key);
+    if (cached !== void 0 && Number(cached.quote.validUntil) - now >= maxTimeoutSeconds) {
+      return cached;
+    }
+    const validUntil = now + 2 * maxTimeoutSeconds;
+    const quote = {
+      issuer,
+      payer: BEARER,
+      recipient: offer.payTo,
+      asset: offer.asset,
+      amount,
+      requestScheme: QUOTE_REQUEST_SCHEME,
+      requestHash,
+      // Use a new ID for each signed body, as the ERC requires
+      quoteId: `0x${randomBytes(32).toString("hex")}`,
+      validAfter: String(now),
+      validUntil: String(validUntil)
+    };
+    const signature = await account.signTypedData({
+      domain: { ...QUOTE_DOMAIN, chainId },
+      types: QUOTE_TYPES,
+      primaryType: "ServicePaymentQuote",
+      message: {
+        ...quote,
+        amount: BigInt(amount),
+        validAfter: BigInt(now),
+        validUntil: BigInt(validUntil)
+      }
+    });
+    const signed = { chainId: String(chainId), quote, signature };
+    cache.delete(key);
+    if (cache.size >= QUOTE_CACHE_LIMIT) {
+      const oldest = cache.keys().next().value;
+      if (oldest !== void 0) cache.delete(oldest);
+    }
+    cache.set(key, signed);
+    return signed;
+  }
+  return {
+    issuer,
+    async extensionsFor(resourceId, input, quoted) {
+      if (quoted.length === 0) return void 0;
+      const requestHash = quoteRequestHash(resourceId, input);
+      if (requestHash === void 0) return void 0;
+      const quotes = [];
+      for (const { offer, amount } of quoted) {
+        quotes.push(await quoteFor(offer, amount, requestHash));
+      }
+      return { [QUOTE_EXTENSION]: { info: { quotes }, schema: QUOTE_INFO_SCHEMA } };
+    }
+  };
+}
+function quoteRequestHash(resourceId, input) {
+  const canonical = canonicalJson({ input, resource: resourceId });
+  return canonical === void 0 ? void 0 : keccak256(stringToBytes(canonical));
+}
+
 // src/payments/x402/amount.ts
 var DECIMAL_STRING_PATTERN = /^\d+(?:\.\d+)?$/;
 function parseCanonicalAmount(amount, decimals) {
@@ -883,6 +1050,14 @@ function createRequirementBuilders(ctx, svmFeePayer) {
       }))
     );
     const single = offers.length === 1 ? offers[0] : void 0;
+    const extensions = await ctx.quotes?.extensionsFor(
+      context.resource.id,
+      context.input,
+      offers.flatMap((offer, index) => {
+        const accepted = accepts[index];
+        return offer.family === "evm" && accepted ? [{ offer, amount: accepted.amount }] : [];
+      })
+    );
     const resourceId = encodeURIComponent(context.resource.id);
     const envelope = {
       x402Version: X402_VERSION,
@@ -893,7 +1068,8 @@ function createRequirementBuilders(ctx, svmFeePayer) {
         // delivery carries the backend's own type when it is text and fits the body
         mimeType: options.resourceMimeTypes?.[context.resource.id] ?? DEFAULT_MIME_TYPE
       },
-      accepts
+      accepts,
+      ...extensions !== void 0 ? { extensions } : {}
     };
     const expiresAt = new Date(clock.now().getTime() + maxTimeoutSeconds * 1e3).toISOString();
     return {
@@ -1319,6 +1495,13 @@ function createX402PaymentProvider(options) {
   const ids = options.ids ?? DEFAULT_IDS;
   const logger = options.logger ?? NOOP_LOGGER;
   const maxTimeoutSeconds = options.maxTimeoutSeconds ?? DEFAULT_MAX_TIMEOUT_SECONDS;
+  const quotes = options.quote ? createQuoteIssuer({
+    signerPrivateKey: options.quote.signerPrivateKey,
+    offers,
+    deploymentMode,
+    clock,
+    maxTimeoutSeconds
+  }) : void 0;
   const evmOffers = offers.filter((offer) => offer.family === "evm");
   const hasSvm = offers.some((offer) => offer.family === "svm");
   const hasNear = offers.some((offer) => offer.family === "near");
@@ -1342,7 +1525,8 @@ function createX402PaymentProvider(options) {
       `mode=${deploymentMode}`,
       "authorization-flow",
       "upfront-flow",
-      ...severalOffers ? ["multiple-offers"] : []
+      ...severalOffers ? ["multiple-offers"] : [],
+      ...quotes ? ["erc-8409-quotes"] : []
     ],
     status: "stable",
     unsupported: [
@@ -1374,6 +1558,7 @@ function createX402PaymentProvider(options) {
     ids,
     logger,
     maxTimeoutSeconds,
+    quotes,
     svm,
     near
   };
@@ -1392,7 +1577,14 @@ function createX402PaymentProvider(options) {
     ...severalOffers ? { selectRequirement } : {},
     verify,
     settle,
-    health
+    health,
+    ...quotes ? {
+      quote: {
+        issuer: quotes.issuer,
+        requestScheme: QUOTE_REQUEST_SCHEME,
+        extension: QUOTE_EXTENSION
+      }
+    } : {}
   };
 }
 function loadOptionalModule(load, missing) {
@@ -1407,5 +1599,5 @@ function loadOptionalModule(load, missing) {
 }
 
 export { DEFAULT_IDS, chainIdFromCaip2, createX402PaymentProvider, parseCanonicalAmount };
-//# sourceMappingURL=chunk-TNS7U5Q4.js.map
-//# sourceMappingURL=chunk-TNS7U5Q4.js.map
+//# sourceMappingURL=chunk-CXWC5LWM.js.map
+//# sourceMappingURL=chunk-CXWC5LWM.js.map