@elisym/sdk 0.25.4 → 0.26.0

package/dist/skills.cjs

@@ -454,6 +454,53 @@ var DynamicScriptSkill = class {
     }
   }
 };
+
+// src/skills/x402ProxySkill.ts
+var X402ProxySkill = class {
+  name;
+  description;
+  capabilities;
+  priceSubunits;
+  asset;
+  mode = "x402";
+  image;
+  imageFile;
+  llmOverride;
+  x402;
+  constructor(params) {
+    this.name = params.name;
+    this.description = params.description;
+    this.capabilities = params.capabilities;
+    this.priceSubunits = params.priceSubunits;
+    this.asset = params.asset;
+    this.x402 = params.x402;
+    this.image = params.image;
+    this.imageFile = params.imageFile;
+  }
+  /** GET upstream without a query param consumes no buyer input (card should be static). */
+  get noInput() {
+    return this.x402.method === "GET" && this.x402.queryParam === void 0;
+  }
+  requireInvoker(ctx) {
+    if (ctx.x402 === void 0) {
+      throw new Error(
+        `Skill "${this.name}": x402 skills require the elisym CLI runtime (no x402 driver in SkillContext)`
+      );
+    }
+    return ctx.x402;
+  }
+  async preflight(input, ctx) {
+    await this.requireInvoker(ctx).preflight(this.x402, input);
+  }
+  async execute(input, ctx) {
+    const result = await this.requireInvoker(ctx).execute(this.x402, input, ctx.signal);
+    return {
+      data: result.data,
+      outputMime: result.outputMime,
+      filePath: result.filePath
+    };
+  }
+};
 function resolveInsidePath(rootDir, value) {
   const root = path.resolve(rootDir);
   const candidate = path.resolve(root, value);
@@ -464,6 +511,10 @@ function resolveInsidePath(rootDir, value) {
   return candidate;
 }
 var LIMITS = {
+  // Ceiling above which a text/* attachment is NOT materialized back into a string
+  // (re-inlined into SkillInput.data) - the consumer gets a filePath / explicit
+  // fetch instead. Also bounds the in-memory git-diff buffer (memory-DoS guard).
+  MAX_REINLINE_TEXT_BYTES: 4194304,
   // Upper bound for execution budgets (`max_execution_secs` / `execution_timeout_secs`).
   // Distinct from MAX_TIMEOUT_SECS (the result-wait cap): execution budgets may be
   // hours, so this exists only to keep `secs * 1000` within Node's setTimeout limit
@@ -543,8 +594,10 @@ var VALID_MODES = [
   "llm",
   "static-file",
   "static-script",
-  "dynamic-script"
+  "dynamic-script",
+  "x402"
 ];
+var DEFAULT_X402_MAX_INPUT_BYTES = 1e5;
 function solToLamports(sol) {
   const asString = (typeof sol === "string" ? sol : String(sol)).trim();
   if (/^0+(?:\.0+)?$/.test(asString)) {
@@ -700,6 +753,11 @@ function validateLlmOverride(skillName, frontmatter, mode) {
   if (!hasProvider && !hasModel && !hasMaxTokens) {
     return void 0;
   }
+  if (mode === "x402") {
+    throw new Error(
+      `SKILL.md "${skillName}": "provider"/"model"/"max_tokens" are not valid in mode 'x402'`
+    );
+  }
   if (hasMaxTokens && mode !== "llm") {
     throw new Error(
       `SKILL.md "${skillName}": "max_tokens" is only valid in mode 'llm' (got '${mode}'). For script modes, control token limits inside the script.`
@@ -823,6 +881,114 @@ function validateMaxExecutionSecs(skillName, raw) {
   }
   return raw;
 }
+var X402_METHODS = ["GET", "POST"];
+function validateX402Config(skillName, frontmatter, mode, options) {
+  const fieldNames = [
+    "x402_url",
+    "x402_method",
+    "x402_query_param",
+    "x402_max_upstream",
+    "x402_max_input_bytes"
+  ];
+  const presentFields = fieldNames.filter(
+    (field) => frontmatter[field] !== void 0 && frontmatter[field] !== null
+  );
+  if (mode !== "x402") {
+    if (presentFields.length > 0) {
+      throw new Error(
+        `SKILL.md "${skillName}": "${presentFields[0]}" is only valid in mode 'x402'`
+      );
+    }
+    return void 0;
+  }
+  if (!options.allowX402Skills) {
+    throw new Error(
+      `SKILL.md "${skillName}": x402 skills require the elisym CLI runtime; this host cannot execute mode 'x402'`
+    );
+  }
+  if (typeof frontmatter.x402_url !== "string" || frontmatter.x402_url.length === 0) {
+    throw new Error(`SKILL.md "${skillName}": mode 'x402' requires "x402_url" (string)`);
+  }
+  let url;
+  try {
+    url = new URL(frontmatter.x402_url);
+  } catch {
+    throw new Error(`SKILL.md "${skillName}": "x402_url" is not a valid URL`);
+  }
+  const isLoopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+    throw new Error(
+      `SKILL.md "${skillName}": "x402_url" must be an https:// URL (plain http is allowed for localhost only)`
+    );
+  }
+  let method = "POST";
+  if (frontmatter.x402_method !== void 0 && frontmatter.x402_method !== null) {
+    if (typeof frontmatter.x402_method !== "string" || !X402_METHODS.includes(frontmatter.x402_method)) {
+      throw new Error(
+        `SKILL.md "${skillName}": "x402_method" must be one of ${X402_METHODS.join(", ")}`
+      );
+    }
+    method = frontmatter.x402_method;
+  }
+  let queryParam;
+  if (frontmatter.x402_query_param !== void 0 && frontmatter.x402_query_param !== null) {
+    if (method !== "GET") {
+      throw new Error(
+        `SKILL.md "${skillName}": "x402_query_param" is only valid with x402_method 'GET' (POST maps the input to the request body)`
+      );
+    }
+    if (typeof frontmatter.x402_query_param !== "string" || frontmatter.x402_query_param.length === 0) {
+      throw new Error(`SKILL.md "${skillName}": "x402_query_param" must be a non-empty string`);
+    }
+    if (url.searchParams.has(frontmatter.x402_query_param)) {
+      throw new Error(
+        `SKILL.md "${skillName}": "x402_query_param" ("${frontmatter.x402_query_param}") collides with a parameter already present in "x402_url"`
+      );
+    }
+    queryParam = frontmatter.x402_query_param;
+  }
+  const rawMaxUpstream = frontmatter.x402_max_upstream;
+  if (rawMaxUpstream === void 0 || rawMaxUpstream === null) {
+    throw new Error(
+      `SKILL.md "${skillName}": mode 'x402' requires "x402_max_upstream" (integer subunits - the ceiling on the upstream quote)`
+    );
+  }
+  let maxUpstreamSubunits;
+  if (typeof rawMaxUpstream === "number" && Number.isSafeInteger(rawMaxUpstream)) {
+    maxUpstreamSubunits = BigInt(rawMaxUpstream);
+  } else if (typeof rawMaxUpstream === "string" && /^[0-9]+$/.test(rawMaxUpstream)) {
+    maxUpstreamSubunits = BigInt(rawMaxUpstream);
+  } else {
+    throw new Error(
+      `SKILL.md "${skillName}": "x402_max_upstream" must be a non-negative integer (subunits)`
+    );
+  }
+  if (maxUpstreamSubunits <= 0n) {
+    throw new Error(`SKILL.md "${skillName}": "x402_max_upstream" must be > 0`);
+  }
+  let maxInputBytes = DEFAULT_X402_MAX_INPUT_BYTES;
+  if (frontmatter.x402_max_input_bytes !== void 0 && frontmatter.x402_max_input_bytes !== null) {
+    const raw = frontmatter.x402_max_input_bytes;
+    if (typeof raw !== "number" || !Number.isInteger(raw) || raw <= 0) {
+      throw new Error(
+        `SKILL.md "${skillName}": "x402_max_input_bytes" must be a positive integer (bytes)`
+      );
+    }
+    if (raw > LIMITS.MAX_REINLINE_TEXT_BYTES) {
+      throw new Error(
+        `SKILL.md "${skillName}": "x402_max_input_bytes" must be <= ${LIMITS.MAX_REINLINE_TEXT_BYTES} (inputs above it never reach the skill as text)`
+      );
+    }
+    maxInputBytes = raw;
+  }
+  return {
+    url: frontmatter.x402_url,
+    method,
+    queryParam,
+    maxUpstreamSubunits,
+    maxInputBytes
+  };
+}
 function validateSkillFrontmatter(frontmatter, systemPrompt, options = {}) {
   if (typeof frontmatter.name !== "string" || frontmatter.name.length === 0) {
     throw new Error('SKILL.md: missing or invalid "name" field');
@@ -1015,6 +1181,7 @@ function validateSkillFrontmatter(frontmatter, systemPrompt, options = {}) {
     frontmatter.name,
     frontmatter.max_execution_secs
   );
+  const x402 = validateX402Config(frontmatter.name, frontmatter, mode, options);
   return {
     name: frontmatter.name,
     description: frontmatter.description,
@@ -1036,7 +1203,9 @@ function validateSkillFrontmatter(frontmatter, systemPrompt, options = {}) {
     inputMime,
     inputText,
     rateLimit,
-    executionTimeoutSecs
+    executionTimeoutSecs,
+    x402,
+    noInput: x402 === void 0 ? void 0 : x402.method === "GET" && x402.queryParam === void 0
   };
 }
 function buildSkillFromParsed(parsed, skillDir, logger) {
@@ -1115,6 +1284,23 @@ function buildSkillFromParsed(parsed, skillDir, logger) {
       };
       return parsed.mode === "dynamic-script" ? new DynamicScriptSkill({ ...scriptParams, outputMime: parsed.outputMime }) : new StaticScriptSkill(scriptParams);
     }
+    case "x402": {
+      if (parsed.x402 === void 0) {
+        throw new Error(
+          `SKILL.md "${parsed.name}": internal error - x402 config missing for mode 'x402'`
+        );
+      }
+      return new X402ProxySkill({
+        name: parsed.name,
+        description: parsed.description,
+        capabilities: parsed.capabilities,
+        priceSubunits: parsed.priceSubunits,
+        asset: parsed.asset,
+        x402: parsed.x402,
+        image: parsed.image,
+        imageFile
+      });
+    }
   }
 }
 function loadSkillsFromDir(skillsDir, options = {}) {
@@ -1152,12 +1338,14 @@ function loadSkillsFromDir(skillsDir, options = {}) {
 
 exports.DEFAULT_MAX_TOOL_ROUNDS = DEFAULT_MAX_TOOL_ROUNDS;
 exports.DEFAULT_SCRIPT_TIMEOUT_MS = DEFAULT_SCRIPT_TIMEOUT_MS;
+exports.DEFAULT_X402_MAX_INPUT_BYTES = DEFAULT_X402_MAX_INPUT_BYTES;
 exports.DynamicScriptSkill = DynamicScriptSkill;
 exports.MAX_SCRIPT_OUTPUT = MAX_SCRIPT_OUTPUT;
 exports.MAX_STATIC_FILE_SIZE = MAX_STATIC_FILE_SIZE;
 exports.ScriptSkill = ScriptSkill;
 exports.StaticFileSkill = StaticFileSkill;
 exports.StaticScriptSkill = StaticScriptSkill;
+exports.X402ProxySkill = X402ProxySkill;
 exports.loadSkillsFromDir = loadSkillsFromDir;
 exports.parseSkillMd = parseSkillMd;
 exports.resolveInsidePath = resolveInsidePath;