@elisym/sdk 0.10.0 → 0.10.1

package/dist/index.cjs

@@ -1019,95 +1019,9 @@ async function createPaymentRequestWithOnchainConfig(rpc, programId, recipient,
     options
   );
 }
-var NEGATIVE_CACHE_TTL_MS = 6e4;
-var verifyCache = /* @__PURE__ */ new Map();
-function clearQuickVerifyCache() {
-  verifyCache.clear();
-}
-async function verifyJobPaymentQuick(rpc, txSignature, expectedRecipient) {
-  if (!txSignature) {
-    return { verified: false, txSignature: "", reason: "invalid_input" };
-  }
-  if (!expectedRecipient || !kit.isAddress(expectedRecipient)) {
-    return { verified: false, txSignature, reason: "invalid_input" };
-  }
-  const cacheKey2 = `${txSignature}:${expectedRecipient}`;
-  const cached = verifyCache.get(cacheKey2);
-  if (cached) {
-    if (cached.result.verified) {
-      return cached.result;
-    }
-    if (Date.now() - cached.cachedAt < NEGATIVE_CACHE_TTL_MS) {
-      return cached.result;
-    }
-  }
-  const result = await doVerifyOnce(rpc, txSignature, expectedRecipient);
-  verifyCache.set(cacheKey2, { result, cachedAt: Date.now() });
-  return result;
-}
-async function doVerifyOnce(rpc, txSignature, expectedRecipient) {
-  const sigStr = txSignature;
-  if (!rpc || typeof rpc.getTransaction !== "function") {
-    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
-  }
-  let tx;
-  try {
-    tx = await rpc.getTransaction(txSignature, {
-      commitment: "confirmed",
-      encoding: "json",
-      maxSupportedTransactionVersion: 0
-    }).send();
-  } catch {
-    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
-  }
-  if (!tx) {
-    return { verified: false, txSignature: sigStr, reason: "not_found" };
-  }
-  if (!tx.meta || tx.meta.err) {
-    return { verified: false, txSignature: sigStr, reason: "tx_failed" };
-  }
-  const accountKeys = tx.transaction.message.accountKeys;
-  const recipientStr = expectedRecipient;
-  const recipientIdx = accountKeys.indexOf(recipientStr);
-  if (recipientIdx !== -1) {
-    const preBalances = tx.meta.preBalances;
-    const postBalances = tx.meta.postBalances;
-    if (preBalances && postBalances) {
-      const pre = preBalances[recipientIdx];
-      const post = postBalances[recipientIdx];
-      if (pre !== void 0 && post !== void 0) {
-        const delta = BigInt(post) - BigInt(pre);
-        if (delta > 0n) {
-          return { verified: true, txSignature: sigStr };
-        }
-      }
-    }
-  }
-  const postTokenBalances = tx.meta.postTokenBalances;
-  const preTokenBalances = tx.meta.preTokenBalances;
-  if (postTokenBalances) {
-    for (const post of postTokenBalances) {
-      if (post.owner !== recipientStr) {
-        continue;
-      }
-      const pre = preTokenBalances?.find(
-        (entry) => entry.owner === recipientStr && entry.mint === post.mint
-      );
-      const preAmount = pre ? BigInt(pre.uiTokenAmount.amount) : 0n;
-      const postAmount = BigInt(post.uiTokenAmount.amount);
-      if (postAmount > preAmount) {
-        return { verified: true, txSignature: sigStr };
-      }
-    }
-  }
-  return { verified: false, txSignature: sigStr, reason: "recipient_mismatch" };
-}
-
-// src/services/discovery.ts
 var RANKING_ACTIVITY_WINDOW_SECS = 30 * 24 * 60 * 60;
 var RANKING_BUCKET_SIZE_SECS = 60;
 var COLD_START_BUCKET = -Infinity;
-var MAX_PAID_CANDIDATES_PER_AGENT = 5;
 function toDTag(name) {
   const tag = name.toLowerCase().replace(/[^a-z0-9\s-]/g, (ch) => "_" + ch.charCodeAt(0).toString(16).padStart(2, "0")).replace(/\s+/g, "-").replace(/^-+|-+$/g, "");
   if (!tag) {
@@ -1231,37 +1145,9 @@ function buildAgentsFromEvents(events, network) {
   }
   return agentMap;
 }
-function pickSolanaAddress(agent) {
-  for (const card of agent.cards) {
-    const addr = card.payment?.address;
-    if (card.payment?.chain === "solana" && typeof addr === "string" && addr.length > 0) {
-      return addr;
-    }
-  }
-  return null;
-}
-async function verifyNewestPaidCandidate(rpc, recipient, candidatesNewestFirst) {
-  const settled = await Promise.allSettled(
-    candidatesNewestFirst.map(
-      (candidate) => verifyJobPaymentQuick(rpc, candidate.txSignature, recipient)
-    )
-  );
-  for (let i = 0; i < settled.length; i++) {
-    const entry = settled[i];
-    if (entry?.status === "fulfilled" && entry.value.verified) {
-      return candidatesNewestFirst[i] ?? null;
-    }
-  }
-  return null;
-}
 var DiscoveryService = class {
-  constructor(pool, defaultRpc) {
+  constructor(pool) {
     this.pool = pool;
-    this.defaultRpc = defaultRpc;
-  }
-  /** Configure the Solana RPC used for on-chain payment verification in `fetchAgents`. */
-  setRpc(rpc) {
-    this.defaultRpc = rpc;
   }
   /** Count elisym agents (kind:31990 with "elisym" tag). */
   async fetchAllAgentCount() {
@@ -1350,20 +1236,26 @@ var DiscoveryService = class {
     return agents;
   }
   /**
-   * Fetch elisym agents filtered by network, ranked by verified paid-job recency.
+   * Fetch elisym agents filtered by network, ranked by paid-job recency and
+   * positive-feedback rate.
    *
    * Ranking algorithm:
-   * 1. Bucket each agent into 1-minute slots by `lastPaidJobAt` (last on-chain
-   *    verified payment). Cold-start agents (no verified paid job) go into a
+   * 1. Bucket each agent into 1-minute slots by `lastPaidJobAt` (newest
+   *    `payment-completed` feedback timestamp). Cold-start agents go into a
    *    sentinel bucket below all populated buckets.
    * 2. Within a bucket, sort by positive review rate descending.
    * 3. Tiebreak by raw `lastPaidJobAt`, then `lastSeen` (NIP-89 freshness).
    *
-   * On-chain verification uses {@link verifyJobPaymentQuick} - one-shot, cached.
-   * If `rpc` is not configured, all agents fall through to cold-start and order
-   * is determined by `lastSeen` only.
+   * NOTE: We trust the `payment-completed` feedback timestamp directly; we do
+   * not verify the embedded `tx` signature on-chain. Public Solana devnet RPC
+   * rate-limits trivially exceed what discovery needs (N agents * up-to-5
+   * candidates), and the resulting 429s blocked discovery entirely. This
+   * means a malicious customer can publish a fake `payment-completed` to lift
+   * an agent's ranking. Acceptable trade-off for devnet / MVP; tighten via
+   * recipient-tied checks when the network moves to mainnet with a paid RPC
+   * provider.
    */
-  async fetchAgents(network = "devnet", limit, rpcOverride) {
+  async fetchAgents(network = "devnet", limit) {
     const filter = {
       kinds: [KIND_APP_HANDLER],
       "#t": ["elisym"]
@@ -1412,7 +1304,6 @@ var DiscoveryService = class {
         agent.lastSeen = ev.created_at;
       }
     }
-    const paidCandidates = /* @__PURE__ */ new Map();
     for (const ev of feedbackEvents) {
       if (!nostrTools.verifyEvent(ev)) {
         continue;
@@ -1439,33 +1330,12 @@ var DiscoveryService = class {
       const txTag = ev.tags.find((t) => t[0] === "tx");
       const txSignature = txTag?.[1];
       if (status === "payment-completed" && typeof txSignature === "string" && txSignature) {
-        const list = paidCandidates.get(targetPubkey);
-        const candidate = { txSignature, createdAt: ev.created_at };
-        if (list) {
-          list.push(candidate);
-        } else {
-          paidCandidates.set(targetPubkey, [candidate]);
+        if (!agent.lastPaidJobAt || ev.created_at > agent.lastPaidJobAt) {
+          agent.lastPaidJobAt = ev.created_at;
+          agent.lastPaidJobTx = txSignature;
         }
       }
     }
-    const rpc = rpcOverride ?? this.defaultRpc;
-    if (rpc && paidCandidates.size > 0) {
-      const perAgent = Array.from(paidCandidates.entries()).map(([agentPubkey, list]) => {
-        const agent = agentMap.get(agentPubkey);
-        const recipient = agent ? pickSolanaAddress(agent) : null;
-        if (!agent || !recipient) {
-          return Promise.resolve();
-        }
-        const ordered = [...list].sort((a, b) => b.createdAt - a.createdAt).slice(0, MAX_PAID_CANDIDATES_PER_AGENT);
-        return verifyNewestPaidCandidate(rpc, recipient, ordered).then((winner) => {
-          if (winner) {
-            agent.lastPaidJobAt = winner.createdAt;
-            agent.lastPaidJobTx = winner.txSignature;
-          }
-        });
-      });
-      await Promise.all(perAgent);
-    }
     agents.sort(compareAgentsByRank);
     return agents;
   }
@@ -2165,6 +2035,7 @@ var MarketplaceService = class {
       let status = "processing";
       let amount;
       let txHash;
+      let asset;
       if (result) {
         status = "success";
         const amtTag = result.tags.find((t) => t[0] === "amount");
@@ -2173,9 +2044,18 @@ var MarketplaceService = class {
       const allFeedbacksForReq = feedbacksByRequestId.get(req.id) ?? [];
       for (const fb of allFeedbacksForReq) {
         const txTag = fb.tags.find((t) => t[0] === "tx");
-        if (txTag?.[1]) {
+        if (txTag?.[1] && !txHash) {
           txHash = txTag[1];
-          break;
+        }
+        if (!asset) {
+          const amtTag = fb.tags.find((t) => t[0] === "amount");
+          const requestJson = amtTag?.[2];
+          if (requestJson) {
+            const parsed = parsePaymentRequest(requestJson);
+            if (parsed.ok && parsed.data.asset) {
+              asset = parsed.data.asset;
+            }
+          }
         }
       }
       if (feedback) {
@@ -2204,6 +2084,7 @@ var MarketplaceService = class {
         resultEventId: result?.id,
         amount,
         txHash,
+        asset,
         createdAt: req.created_at
       });
     }
@@ -2814,7 +2695,7 @@ var ElisymClient = class {
   payment;
   constructor(config = {}) {
     this.pool = new NostrPool(config.relays ?? RELAYS);
-    this.discovery = new DiscoveryService(this.pool, config.rpc);
+    this.discovery = new DiscoveryService(this.pool);
     this.marketplace = new MarketplaceService(this.pool);
     this.ping = new PingService(this.pool);
     this.media = new MediaService(config.uploadUrl);
@@ -2942,6 +2823,89 @@ function lamportsToSol(lamports) {
   const frac = lamports % LAMPORTS_PER_SOL2;
   return `${whole}.${frac.toString().padStart(9, "0")}`;
 }
+var NEGATIVE_CACHE_TTL_MS = 6e4;
+var verifyCache = /* @__PURE__ */ new Map();
+function clearQuickVerifyCache() {
+  verifyCache.clear();
+}
+async function verifyJobPaymentQuick(rpc, txSignature, expectedRecipient) {
+  if (!txSignature) {
+    return { verified: false, txSignature: "", reason: "invalid_input" };
+  }
+  if (!expectedRecipient || !kit.isAddress(expectedRecipient)) {
+    return { verified: false, txSignature, reason: "invalid_input" };
+  }
+  const cacheKey2 = `${txSignature}:${expectedRecipient}`;
+  const cached = verifyCache.get(cacheKey2);
+  if (cached) {
+    if (cached.result.verified) {
+      return cached.result;
+    }
+    if (Date.now() - cached.cachedAt < NEGATIVE_CACHE_TTL_MS) {
+      return cached.result;
+    }
+  }
+  const result = await doVerifyOnce(rpc, txSignature, expectedRecipient);
+  verifyCache.set(cacheKey2, { result, cachedAt: Date.now() });
+  return result;
+}
+async function doVerifyOnce(rpc, txSignature, expectedRecipient) {
+  const sigStr = txSignature;
+  if (!rpc || typeof rpc.getTransaction !== "function") {
+    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
+  }
+  let tx;
+  try {
+    tx = await rpc.getTransaction(txSignature, {
+      commitment: "confirmed",
+      encoding: "json",
+      maxSupportedTransactionVersion: 0
+    }).send();
+  } catch {
+    return { verified: false, txSignature: sigStr, reason: "rpc_error" };
+  }
+  if (!tx) {
+    return { verified: false, txSignature: sigStr, reason: "not_found" };
+  }
+  if (!tx.meta || tx.meta.err) {
+    return { verified: false, txSignature: sigStr, reason: "tx_failed" };
+  }
+  const accountKeys = tx.transaction.message.accountKeys;
+  const recipientStr = expectedRecipient;
+  const recipientIdx = accountKeys.indexOf(recipientStr);
+  if (recipientIdx !== -1) {
+    const preBalances = tx.meta.preBalances;
+    const postBalances = tx.meta.postBalances;
+    if (preBalances && postBalances) {
+      const pre = preBalances[recipientIdx];
+      const post = postBalances[recipientIdx];
+      if (pre !== void 0 && post !== void 0) {
+        const delta = BigInt(post) - BigInt(pre);
+        if (delta > 0n) {
+          return { verified: true, txSignature: sigStr };
+        }
+      }
+    }
+  }
+  const postTokenBalances = tx.meta.postTokenBalances;
+  const preTokenBalances = tx.meta.preTokenBalances;
+  if (postTokenBalances) {
+    for (const post of postTokenBalances) {
+      if (post.owner !== recipientStr) {
+        continue;
+      }
+      const pre = preTokenBalances?.find(
+        (entry) => entry.owner === recipientStr && entry.mint === post.mint
+      );
+      const preAmount = pre ? BigInt(pre.uiTokenAmount.amount) : 0n;
+      const postAmount = BigInt(post.uiTokenAmount.amount);
+      if (postAmount > preAmount) {
+        return { verified: true, txSignature: sigStr };
+      }
+    }
+  }
+  return { verified: false, txSignature: sigStr, reason: "recipient_mismatch" };
+}
 var SessionSpendLimitEntrySchema = zod.z.object({
   chain: zod.z.enum(["solana"]),
   token: zod.z.string().min(1).max(16).regex(/^[a-z0-9]+$/, "token must be lowercase alphanumeric"),